1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 1990 Mentat Inc.
25 * Copyright (c) 2011 Joyent, Inc. All rights reserved.
26 */
27
28 #include <sys/types.h>
29 #include <sys/stream.h>
30 #include <sys/dlpi.h>
31 #include <sys/stropts.h>
32 #include <sys/sysmacros.h>
33 #include <sys/strsubr.h>
34 #include <sys/strlog.h>
35 #include <sys/strsun.h>
36 #include <sys/zone.h>
37 #define _SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/xti_inet.h>
40 #include <sys/ddi.h>
41 #include <sys/suntpi.h>
42 #include <sys/cmn_err.h>
43 #include <sys/debug.h>
44 #include <sys/kobj.h>
45 #include <sys/modctl.h>
46 #include <sys/atomic.h>
47 #include <sys/policy.h>
48 #include <sys/priv.h>
49 #include <sys/taskq.h>
50
51 #include <sys/systm.h>
52 #include <sys/param.h>
53 #include <sys/kmem.h>
54 #include <sys/sdt.h>
55 #include <sys/socket.h>
56 #include <sys/vtrace.h>
57 #include <sys/isa_defs.h>
58 #include <sys/mac.h>
59 #include <net/if.h>
60 #include <net/if_arp.h>
61 #include <net/route.h>
62 #include <sys/sockio.h>
63 #include <netinet/in.h>
64 #include <net/if_dl.h>
65
66 #include <inet/common.h>
67 #include <inet/mi.h>
68 #include <inet/mib2.h>
69 #include <inet/nd.h>
70 #include <inet/arp.h>
71 #include <inet/snmpcom.h>
72 #include <inet/optcom.h>
73 #include <inet/kstatcom.h>
74
75 #include <netinet/igmp_var.h>
76 #include <netinet/ip6.h>
77 #include <netinet/icmp6.h>
78 #include <netinet/sctp.h>
79
80 #include <inet/ip.h>
81 #include <inet/ip_impl.h>
82 #include <inet/ip6.h>
83 #include <inet/ip6_asp.h>
84 #include <inet/tcp.h>
85 #include <inet/tcp_impl.h>
86 #include <inet/ip_multi.h>
87 #include <inet/ip_if.h>
88 #include <inet/ip_ire.h>
89 #include <inet/ip_ftable.h>
90 #include <inet/ip_rts.h>
91 #include <inet/ip_ndp.h>
92 #include <inet/ip_listutils.h>
93 #include <netinet/igmp.h>
94 #include <netinet/ip_mroute.h>
95 #include <inet/ipp_common.h>
96
97 #include <net/pfkeyv2.h>
98 #include <inet/sadb.h>
99 #include <inet/ipsec_impl.h>
100 #include <inet/iptun/iptun_impl.h>
101 #include <inet/ipdrop.h>
102 #include <inet/ip_netinfo.h>
103 #include <inet/ilb_ip.h>
104
105 #include <sys/ethernet.h>
106 #include <net/if_types.h>
107 #include <sys/cpuvar.h>
108
109 #include <ipp/ipp.h>
110 #include <ipp/ipp_impl.h>
111 #include <ipp/ipgpc/ipgpc.h>
112
113 #include <sys/pattr.h>
114 #include <inet/dccp.h>
115 #include <inet/dccp_impl.h>
116 #include <inet/dccp_ip.h>
117 #include <inet/ipclassifier.h>
118 #include <inet/sctp_ip.h>
119 #include <inet/sctp/sctp_impl.h>
120 #include <inet/udp_impl.h>
121 #include <inet/rawip_impl.h>
122 #include <inet/rts_impl.h>
123
124 #include <sys/tsol/label.h>
125 #include <sys/tsol/tnet.h>
126
127 #include <sys/squeue_impl.h>
128 #include <inet/ip_arp.h>
129
130 #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */
131
132 /*
133 * Values for squeue switch:
134 * IP_SQUEUE_ENTER_NODRAIN: SQ_NODRAIN
135 * IP_SQUEUE_ENTER: SQ_PROCESS
136 * IP_SQUEUE_FILL: SQ_FILL
137 */
138 int ip_squeue_enter = IP_SQUEUE_ENTER; /* Setable in /etc/system */
139
140 int ip_squeue_flag;
141
142 /*
143 * Setable in /etc/system
144 */
145 int ip_poll_normal_ms = 100;
146 int ip_poll_normal_ticks = 0;
147 int ip_modclose_ackwait_ms = 3000;
148
149 /*
150 * It would be nice to have these present only in DEBUG systems, but the
151 * current design of the global symbol checking logic requires them to be
152 * unconditionally present.
153 */
154 uint_t ip_thread_data; /* TSD key for debug support */
155 krwlock_t ip_thread_rwlock;
156 list_t ip_thread_list;
157
158 /*
159 * Structure to represent a linked list of msgblks. Used by ip_snmp_ functions.
160 */
161
162 struct listptr_s {
163 mblk_t *lp_head; /* pointer to the head of the list */
164 mblk_t *lp_tail; /* pointer to the tail of the list */
165 };
166
167 typedef struct listptr_s listptr_t;
168
169 /*
170 * This is used by ip_snmp_get_mib2_ip_route_media and
171 * ip_snmp_get_mib2_ip6_route_media to carry the lists of return data.
172 */
173 typedef struct iproutedata_s {
174 uint_t ird_idx;
175 uint_t ird_flags; /* see below */
176 listptr_t ird_route; /* ipRouteEntryTable */
177 listptr_t ird_netmedia; /* ipNetToMediaEntryTable */
178 listptr_t ird_attrs; /* ipRouteAttributeTable */
179 } iproutedata_t;
180
181 /* Include ire_testhidden and IRE_IF_CLONE routes */
182 #define IRD_REPORT_ALL 0x01
183
184 /*
185 * Cluster specific hooks. These should be NULL when booted as a non-cluster
186 */
187
188 /*
189 * Hook functions to enable cluster networking
190 * On non-clustered systems these vectors must always be NULL.
191 *
192 * Hook function to Check ip specified ip address is a shared ip address
193 * in the cluster
194 *
195 */
196 int (*cl_inet_isclusterwide)(netstackid_t stack_id, uint8_t protocol,
197 sa_family_t addr_family, uint8_t *laddrp, void *args) = NULL;
198
199 /*
200 * Hook function to generate cluster wide ip fragment identifier
201 */
202 uint32_t (*cl_inet_ipident)(netstackid_t stack_id, uint8_t protocol,
203 sa_family_t addr_family, uint8_t *laddrp, uint8_t *faddrp,
204 void *args) = NULL;
205
206 /*
207 * Hook function to generate cluster wide SPI.
208 */
209 void (*cl_inet_getspi)(netstackid_t, uint8_t, uint8_t *, size_t,
210 void *) = NULL;
211
212 /*
213 * Hook function to verify if the SPI is already utlized.
214 */
215
216 int (*cl_inet_checkspi)(netstackid_t, uint8_t, uint32_t, void *) = NULL;
217
218 /*
219 * Hook function to delete the SPI from the cluster wide repository.
220 */
221
222 void (*cl_inet_deletespi)(netstackid_t, uint8_t, uint32_t, void *) = NULL;
223
224 /*
225 * Hook function to inform the cluster when packet received on an IDLE SA
226 */
227
228 void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, sa_family_t,
229 in6_addr_t, in6_addr_t, void *) = NULL;
230
231 /*
232 * Synchronization notes:
233 *
234 * IP is a fully D_MP STREAMS module/driver. Thus it does not depend on any
235 * MT level protection given by STREAMS. IP uses a combination of its own
236 * internal serialization mechanism and standard Solaris locking techniques.
237 * The internal serialization is per phyint. This is used to serialize
238 * plumbing operations, IPMP operations, most set ioctls, etc.
239 *
240 * Plumbing is a long sequence of operations involving message
241 * exchanges between IP, ARP and device drivers. Many set ioctls are typically
242 * involved in plumbing operations. A natural model is to serialize these
243 * ioctls one per ill. For example plumbing of hme0 and qfe0 can go on in
244 * parallel without any interference. But various set ioctls on hme0 are best
245 * serialized, along with IPMP operations and processing of DLPI control
246 * messages received from drivers on a per phyint basis. This serialization is
247 * provided by the ipsq_t and primitives operating on this. Details can
248 * be found in ip_if.c above the core primitives operating on ipsq_t.
249 *
250 * Lookups of an ipif or ill by a thread return a refheld ipif / ill.
251 * Simiarly lookup of an ire by a thread also returns a refheld ire.
252 * In addition ipif's and ill's referenced by the ire are also indirectly
253 * refheld. Thus no ipif or ill can vanish as long as an ipif is refheld
254 * directly or indirectly. For example an SIOCSLIFADDR ioctl that changes the
255 * address of an ipif has to go through the ipsq_t. This ensures that only
256 * one such exclusive operation proceeds at any time on the ipif. It then
257 * waits for all refcnts
258 * associated with this ipif to come down to zero. The address is changed
259 * only after the ipif has been quiesced. Then the ipif is brought up again.
260 * More details are described above the comment in ip_sioctl_flags.
261 *
262 * Packet processing is based mostly on IREs and are fully multi-threaded
263 * using standard Solaris MT techniques.
264 *
265 * There are explicit locks in IP to handle:
266 * - The ip_g_head list maintained by mi_open_link() and friends.
267 *
268 * - The reassembly data structures (one lock per hash bucket)
269 *
270 * - conn_lock is meant to protect conn_t fields. The fields actually
271 * protected by conn_lock are documented in the conn_t definition.
272 *
273 * - ire_lock to protect some of the fields of the ire, IRE tables
274 * (one lock per hash bucket). Refer to ip_ire.c for details.
275 *
276 * - ndp_g_lock and ncec_lock for protecting NCEs.
277 *
278 * - ill_lock protects fields of the ill and ipif. Details in ip.h
279 *
280 * - ill_g_lock: This is a global reader/writer lock. Protects the following
281 * * The AVL tree based global multi list of all ills.
282 * * The linked list of all ipifs of an ill
283 * * The <ipsq-xop> mapping
284 * * <ill-phyint> association
285 * Insertion/deletion of an ill in the system, insertion/deletion of an ipif
286 * into an ill, changing the <ipsq-xop> mapping of an ill, changing the
287 * <ill-phyint> assoc of an ill will all have to hold the ill_g_lock as
288 * writer for the actual duration of the insertion/deletion/change.
289 *
290 * - ill_lock: This is a per ill mutex.
291 * It protects some members of the ill_t struct; see ip.h for details.
292 * It also protects the <ill-phyint> assoc.
293 * It also protects the list of ipifs hanging off the ill.
294 *
295 * - ipsq_lock: This is a per ipsq_t mutex lock.
296 * This protects some members of the ipsq_t struct; see ip.h for details.
297 * It also protects the <ipsq-ipxop> mapping
298 *
299 * - ipx_lock: This is a per ipxop_t mutex lock.
300 * This protects some members of the ipxop_t struct; see ip.h for details.
301 *
302 * - phyint_lock: This is a per phyint mutex lock. Protects just the
303 * phyint_flags
304 *
305 * - ip_addr_avail_lock: This is used to ensure the uniqueness of IP addresses.
306 * This lock is held in ipif_up_done and the ipif is marked IPIF_UP and the
307 * uniqueness check also done atomically.
308 *
309 * - ill_g_usesrc_lock: This readers/writer lock protects the usesrc
310 * group list linked by ill_usesrc_grp_next. It also protects the
311 * ill_usesrc_ifindex field. It is taken as a writer when a member of the
312 * group is being added or deleted. This lock is taken as a reader when
313 * walking the list/group(eg: to get the number of members in a usesrc group).
314 * Note, it is only necessary to take this lock if the ill_usesrc_grp_next
315 * field is changing state i.e from NULL to non-NULL or vice-versa. For
316 * example, it is not necessary to take this lock in the initial portion
317 * of ip_sioctl_slifusesrc or at all in ip_sioctl_flags since these
318 * operations are executed exclusively and that ensures that the "usesrc
319 * group state" cannot change. The "usesrc group state" change can happen
320 * only in the latter part of ip_sioctl_slifusesrc and in ill_delete.
321 *
322 * Changing <ill-phyint>, <ipsq-xop> assocications:
323 *
324 * To change the <ill-phyint> association, the ill_g_lock must be held
325 * as writer, and the ill_locks of both the v4 and v6 instance of the ill
326 * must be held.
327 *
328 * To change the <ipsq-xop> association, the ill_g_lock must be held as
329 * writer, the ipsq_lock must be held, and one must be writer on the ipsq.
330 * This is only done when ills are added or removed from IPMP groups.
331 *
332 * To add or delete an ipif from the list of ipifs hanging off the ill,
333 * ill_g_lock (writer) and ill_lock must be held and the thread must be
334 * a writer on the associated ipsq.
335 *
336 * To add or delete an ill to the system, the ill_g_lock must be held as
337 * writer and the thread must be a writer on the associated ipsq.
338 *
339 * To add or delete an ilm to an ill, the ill_lock must be held and the thread
340 * must be a writer on the associated ipsq.
341 *
342 * Lock hierarchy
343 *
344 * Some lock hierarchy scenarios are listed below.
345 *
346 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock
347 * ill_g_lock -> ill_lock(s) -> phyint_lock
348 * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock
349 * ill_g_lock -> ip_addr_avail_lock
350 * conn_lock -> irb_lock -> ill_lock -> ire_lock
351 * ill_g_lock -> ip_g_nd_lock
352 * ill_g_lock -> ips_ipmp_lock -> ill_lock -> nce_lock
353 * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock -> nce_lock
354 * arl_lock -> ill_lock
355 * ips_ire_dep_lock -> irb_lock
356 *
357 * When more than 1 ill lock is needed to be held, all ill lock addresses
358 * are sorted on address and locked starting from highest addressed lock
359 * downward.
360 *
361 * Multicast scenarios
362 * ips_ill_g_lock -> ill_mcast_lock
363 * conn_ilg_lock -> ips_ill_g_lock -> ill_lock
364 * ill_mcast_serializer -> ill_mcast_lock -> ips_ipmp_lock -> ill_lock
365 * ill_mcast_serializer -> ill_mcast_lock -> connf_lock -> conn_lock
366 * ill_mcast_serializer -> ill_mcast_lock -> conn_ilg_lock
367 * ill_mcast_serializer -> ill_mcast_lock -> ips_igmp_timer_lock
368 *
369 * IPsec scenarios
370 *
371 * ipsa_lock -> ill_g_lock -> ill_lock
372 * ill_g_usesrc_lock -> ill_g_lock -> ill_lock
373 *
374 * Trusted Solaris scenarios
375 *
376 * igsa_lock -> gcgrp_rwlock -> gcgrp_lock
377 * igsa_lock -> gcdb_lock
378 * gcgrp_rwlock -> ire_lock
379 * gcgrp_rwlock -> gcdb_lock
380 *
381 * squeue(sq_lock), flow related (ft_lock, fe_lock) locking
382 *
383 * cpu_lock --> ill_lock --> sqset_lock --> sq_lock
384 * sq_lock -> conn_lock -> QLOCK(q)
385 * ill_lock -> ft_lock -> fe_lock
386 *
387 * Routing/forwarding table locking notes:
388 *
389 * Lock acquisition order: Radix tree lock, irb_lock.
390 * Requirements:
391 * i. Walker must not hold any locks during the walker callback.
392 * ii Walker must not see a truncated tree during the walk because of any node
393 * deletion.
394 * iii Existing code assumes ire_bucket is valid if it is non-null and is used
395 * in many places in the code to walk the irb list. Thus even if all the
396 * ires in a bucket have been deleted, we still can't free the radix node
397 * until the ires have actually been inactive'd (freed).
398 *
399 * Tree traversal - Need to hold the global tree lock in read mode.
400 * Before dropping the global tree lock, need to either increment the ire_refcnt
401 * to ensure that the radix node can't be deleted.
402 *
403 * Tree add - Need to hold the global tree lock in write mode to add a
404 * radix node. To prevent the node from being deleted, increment the
405 * irb_refcnt, after the node is added to the tree. The ire itself is
406 * added later while holding the irb_lock, but not the tree lock.
407 *
408 * Tree delete - Need to hold the global tree lock and irb_lock in write mode.
409 * All associated ires must be inactive (i.e. freed), and irb_refcnt
410 * must be zero.
411 *
412 * Walker - Increment irb_refcnt before calling the walker callback. Hold the
413 * global tree lock (read mode) for traversal.
414 *
415 * IRE dependencies - In some cases we hold ips_ire_dep_lock across ire_refrele
416 * hence we will acquire irb_lock while holding ips_ire_dep_lock.
417 *
418 * IPsec notes :
419 *
420 * IP interacts with the IPsec code (AH/ESP) by storing IPsec attributes
421 * in the ip_xmit_attr_t ip_recv_attr_t. For outbound datagrams, the
422 * ip_xmit_attr_t has the
423 * information used by the IPsec code for applying the right level of
424 * protection. The information initialized by IP in the ip_xmit_attr_t
425 * is determined by the per-socket policy or global policy in the system.
426 * For inbound datagrams, the ip_recv_attr_t
427 * starts out with nothing in it. It gets filled
428 * with the right information if it goes through the AH/ESP code, which
429 * happens if the incoming packet is secure. The information initialized
430 * by AH/ESP, is later used by IP (during fanouts to ULP) to see whether
431 * the policy requirements needed by per-socket policy or global policy
432 * is met or not.
433 *
434 * For fully connected sockets i.e dst, src [addr, port] is known,
435 * conn_policy_cached is set indicating that policy has been cached.
436 * conn_in_enforce_policy may or may not be set depending on whether
437 * there is a global policy match or per-socket policy match.
438 * Policy inheriting happpens in ip_policy_set once the destination is known.
439 * Once the right policy is set on the conn_t, policy cannot change for
440 * this socket. This makes life simpler for TCP (UDP ?) where
441 * re-transmissions go out with the same policy. For symmetry, policy
442 * is cached for fully connected UDP sockets also. Thus if policy is cached,
443 * it also implies that policy is latched i.e policy cannot change
444 * on these sockets. As we have the right policy on the conn, we don't
445 * have to lookup global policy for every outbound and inbound datagram
446 * and thus serving as an optimization. Note that a global policy change
447 * does not affect fully connected sockets if they have policy. If fully
448 * connected sockets did not have any policy associated with it, global
449 * policy change may affect them.
450 *
451 * IP Flow control notes:
452 * ---------------------
453 * Non-TCP streams are flow controlled by IP. The way this is accomplished
454 * differs when ILL_CAPAB_DLD_DIRECT is enabled for that IP instance. When
455 * ILL_DIRECT_CAPABLE(ill) is TRUE, IP can do direct function calls into
456 * GLDv3. Otherwise packets are sent down to lower layers using STREAMS
457 * functions.
458 *
459 * Per Tx ring udp flow control:
460 * This is applicable only when ILL_CAPAB_DLD_DIRECT capability is set in
461 * the ill (i.e. ILL_DIRECT_CAPABLE(ill) is true).
462 *
463 * The underlying link can expose multiple Tx rings to the GLDv3 mac layer.
464 * To achieve best performance, outgoing traffic need to be fanned out among
465 * these Tx ring. mac_tx() is called (via str_mdata_fastpath_put()) to send
466 * traffic out of the NIC and it takes a fanout hint. UDP connections pass
467 * the address of connp as fanout hint to mac_tx(). Under flow controlled
468 * condition, mac_tx() returns a non-NULL cookie (ip_mac_tx_cookie_t). This
469 * cookie points to a specific Tx ring that is blocked. The cookie is used to
470 * hash into an idl_tx_list[] entry in idl_tx_list[] array. Each idl_tx_list_t
471 * point to drain_lists (idl_t's). These drain list will store the blocked UDP
472 * connp's. The drain list is not a single list but a configurable number of
473 * lists.
474 *
475 * The diagram below shows idl_tx_list_t's and their drain_lists. ip_stack_t
476 * has an array of idl_tx_list_t. The size of the array is TX_FANOUT_SIZE
477 * which is equal to 128. This array in turn contains a pointer to idl_t[],
478 * the ip drain list. The idl_t[] array size is MIN(max_ncpus, 8). The drain
479 * list will point to the list of connp's that are flow controlled.
480 *
481 * --------------- ------- ------- -------
482 * |->|drain_list[0]|-->|connp|-->|connp|-->|connp|-->
483 * | --------------- ------- ------- -------
484 * | --------------- ------- ------- -------
485 * |->|drain_list[1]|-->|connp|-->|connp|-->|connp|-->
486 * ---------------- | --------------- ------- ------- -------
487 * |idl_tx_list[0]|->| --------------- ------- ------- -------
488 * ---------------- |->|drain_list[2]|-->|connp|-->|connp|-->|connp|-->
489 * | --------------- ------- ------- -------
490 * . . . . .
491 * | --------------- ------- ------- -------
492 * |->|drain_list[n]|-->|connp|-->|connp|-->|connp|-->
493 * --------------- ------- ------- -------
494 * --------------- ------- ------- -------
495 * |->|drain_list[0]|-->|connp|-->|connp|-->|connp|-->
496 * | --------------- ------- ------- -------
497 * | --------------- ------- ------- -------
498 * ---------------- |->|drain_list[1]|-->|connp|-->|connp|-->|connp|-->
499 * |idl_tx_list[1]|->| --------------- ------- ------- -------
500 * ---------------- | . . . .
501 * | --------------- ------- ------- -------
502 * |->|drain_list[n]|-->|connp|-->|connp|-->|connp|-->
503 * --------------- ------- ------- -------
504 * .....
505 * ----------------
506 * |idl_tx_list[n]|-> ...
507 * ----------------
508 *
509 * When mac_tx() returns a cookie, the cookie is hashed into an index into
510 * ips_idl_tx_list[], and conn_drain_insert() is called with the idl_tx_list
511 * to insert the conn onto. conn_drain_insert() asserts flow control for the
512 * sockets via su_txq_full() (non-STREAMS) or QFULL on conn_wq (STREAMS).
513 * Further, conn_blocked is set to indicate that the conn is blocked.
514 *
515 * GLDv3 calls ill_flow_enable() when flow control is relieved. The cookie
516 * passed in the call to ill_flow_enable() identifies the blocked Tx ring and
517 * is again hashed to locate the appropriate idl_tx_list, which is then
518 * drained via conn_walk_drain(). conn_walk_drain() goes through each conn in
519 * the drain list and calls conn_drain_remove() to clear flow control (via
520 * calling su_txq_full() or clearing QFULL), and remove the conn from the
521 * drain list.
522 *
523 * Note that the drain list is not a single list but a (configurable) array of
524 * lists (8 elements by default). Synchronization between drain insertion and
525 * flow control wakeup is handled by using idl_txl->txl_lock, and only
526 * conn_drain_insert() and conn_drain_remove() manipulate the drain list.
527 *
528 * Flow control via STREAMS is used when ILL_DIRECT_CAPABLE() returns FALSE.
529 * On the send side, if the packet cannot be sent down to the driver by IP
530 * (canput() fails), ip_xmit() drops the packet and returns EWOULDBLOCK to the
531 * caller, who may then invoke ixa_check_drain_insert() to insert the conn on
532 * the 0'th drain list. When ip_wsrv() runs on the ill_wq because flow
533 * control has been relieved, the blocked conns in the 0'th drain list are
534 * drained as in the non-STREAMS case.
535 *
536 * In both the STREAMS and non-STREAMS cases, the sockfs upcall to set QFULL
537 * is done when the conn is inserted into the drain list (conn_drain_insert())
538 * and cleared when the conn is removed from the it (conn_drain_remove()).
539 *
540 * IPQOS notes:
541 *
542 * IPQoS Policies are applied to packets using IPPF (IP Policy framework)
543 * and IPQoS modules. IPPF includes hooks in IP at different control points
544 * (callout positions) which direct packets to IPQoS modules for policy
545 * processing. Policies, if present, are global.
546 *
547 * The callout positions are located in the following paths:
548 * o local_in (packets destined for this host)
549 * o local_out (packets orginating from this host )
550 * o fwd_in (packets forwarded by this m/c - inbound)
551 * o fwd_out (packets forwarded by this m/c - outbound)
552 * Hooks at these callout points can be enabled/disabled using the ndd variable
553 * ip_policy_mask (a bit mask with the 4 LSB indicating the callout positions).
554 * By default all the callout positions are enabled.
555 *
556 * Outbound (local_out)
557 * Hooks are placed in ire_send_wire_v4 and ire_send_wire_v6.
558 *
559 * Inbound (local_in)
560 * Hooks are placed in ip_fanout_v4 and ip_fanout_v6.
561 *
562 * Forwarding (in and out)
563 * Hooks are placed in ire_recv_forward_v4/v6.
564 *
565 * IP Policy Framework processing (IPPF processing)
566 * Policy processing for a packet is initiated by ip_process, which ascertains
567 * that the classifier (ipgpc) is loaded and configured, failing which the
568 * packet resumes normal processing in IP. If the clasifier is present, the
569 * packet is acted upon by one or more IPQoS modules (action instances), per
570 * filters configured in ipgpc and resumes normal IP processing thereafter.
571 * An action instance can drop a packet in course of its processing.
572 *
573 * Zones notes:
574 *
575 * The partitioning rules for networking are as follows:
576 * 1) Packets coming from a zone must have a source address belonging to that
577 * zone.
578 * 2) Packets coming from a zone can only be sent on a physical interface on
579 * which the zone has an IP address.
580 * 3) Between two zones on the same machine, packet delivery is only allowed if
581 * there's a matching route for the destination and zone in the forwarding
582 * table.
583 * 4) The TCP and UDP port spaces are per-zone; that is, two processes in
584 * different zones can bind to the same port with the wildcard address
585 * (INADDR_ANY).
586 *
587 * The granularity of interface partitioning is at the logical interface level.
588 * Therefore, every zone has its own IP addresses, and incoming packets can be
589 * attributed to a zone unambiguously. A logical interface is placed into a zone
590 * using the SIOCSLIFZONE ioctl; this sets the ipif_zoneid field in the ipif_t
591 * structure. Rule (1) is implemented by modifying the source address selection
592 * algorithm so that the list of eligible addresses is filtered based on the
593 * sending process zone.
594 *
595 * The Internet Routing Entries (IREs) are either exclusive to a zone or shared
596 * across all zones, depending on their type. Here is the break-up:
597 *
598 * IRE type Shared/exclusive
599 * -------- ----------------
600 * IRE_BROADCAST Exclusive
601 * IRE_DEFAULT (default routes) Shared (*)
602 * IRE_LOCAL Exclusive (x)
603 * IRE_LOOPBACK Exclusive
604 * IRE_PREFIX (net routes) Shared (*)
605 * IRE_IF_NORESOLVER (interface routes) Exclusive
606 * IRE_IF_RESOLVER (interface routes) Exclusive
607 * IRE_IF_CLONE (interface routes) Exclusive
608 * IRE_HOST (host routes) Shared (*)
609 *
610 * (*) A zone can only use a default or off-subnet route if the gateway is
611 * directly reachable from the zone, that is, if the gateway's address matches
612 * one of the zone's logical interfaces.
613 *
614 * (x) IRE_LOCAL are handled a bit differently.
615 * When ip_restrict_interzone_loopback is set (the default),
616 * ire_route_recursive restricts loopback using an IRE_LOCAL
617 * between zone to the case when L2 would have conceptually looped the packet
618 * back, i.e. the loopback which is required since neither Ethernet drivers
619 * nor Ethernet hardware loops them back. This is the case when the normal
620 * routes (ignoring IREs with different zoneids) would send out the packet on
621 * the same ill as the ill with which is IRE_LOCAL is associated.
622 *
623 * Multiple zones can share a common broadcast address; typically all zones
624 * share the 255.255.255.255 address. Incoming as well as locally originated
625 * broadcast packets must be dispatched to all the zones on the broadcast
626 * network. For directed broadcasts (e.g. 10.16.72.255) this is not trivial
627 * since some zones may not be on the 10.16.72/24 network. To handle this, each
628 * zone has its own set of IRE_BROADCAST entries; then, broadcast packets are
629 * sent to every zone that has an IRE_BROADCAST entry for the destination
630 * address on the input ill, see ip_input_broadcast().
631 *
632 * Applications in different zones can join the same multicast group address.
633 * The same logic applies for multicast as for broadcast. ip_input_multicast
634 * dispatches packets to all zones that have members on the physical interface.
635 */
636
637 /*
638 * Squeue Fanout flags:
639 * 0: No fanout.
640 * 1: Fanout across all squeues
641 */
642 boolean_t ip_squeue_fanout = 0;
643
644 /*
645 * Maximum dups allowed per packet.
646 */
647 uint_t ip_max_frag_dups = 10;
648
649 static int ip_open(queue_t *q, dev_t *devp, int flag, int sflag,
650 cred_t *credp, boolean_t isv6);
651 static mblk_t *ip_xmit_attach_llhdr(mblk_t *, nce_t *);
652
653 static boolean_t icmp_inbound_verify_v4(mblk_t *, icmph_t *, ip_recv_attr_t *);
654 static void icmp_inbound_too_big_v4(icmph_t *, ip_recv_attr_t *);
655 static void icmp_inbound_error_fanout_v4(mblk_t *, icmph_t *,
656 ip_recv_attr_t *);
657 static void icmp_options_update(ipha_t *);
658 static void icmp_param_problem(mblk_t *, uint8_t, ip_recv_attr_t *);
659 static void icmp_pkt(mblk_t *, void *, size_t, ip_recv_attr_t *);
660 static mblk_t *icmp_pkt_err_ok(mblk_t *, ip_recv_attr_t *);
661 static void icmp_redirect_v4(mblk_t *mp, ipha_t *, icmph_t *,
662 ip_recv_attr_t *);
663 static void icmp_send_redirect(mblk_t *, ipaddr_t, ip_recv_attr_t *);
664 static void icmp_send_reply_v4(mblk_t *, ipha_t *, icmph_t *,
665 ip_recv_attr_t *);
666
667 mblk_t *ip_dlpi_alloc(size_t, t_uscalar_t);
668 char *ip_dot_addr(ipaddr_t, char *);
669 mblk_t *ip_carve_mp(mblk_t **, ssize_t);
670 int ip_close(queue_t *, int);
671 static char *ip_dot_saddr(uchar_t *, char *);
672 static void ip_lrput(queue_t *, mblk_t *);
673 ipaddr_t ip_net_mask(ipaddr_t);
674 char *ip_nv_lookup(nv_t *, int);
675 void ip_rput(queue_t *, mblk_t *);
676 static void ip_rput_dlpi_writer(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp,
677 void *dummy_arg);
678 int ip_snmp_get(queue_t *, mblk_t *, int, boolean_t);
679 static mblk_t *ip_snmp_get_mib2_ip(queue_t *, mblk_t *,
680 mib2_ipIfStatsEntry_t *, ip_stack_t *, boolean_t);
681 static mblk_t *ip_snmp_get_mib2_ip_traffic_stats(queue_t *, mblk_t *,
682 ip_stack_t *, boolean_t);
683 static mblk_t *ip_snmp_get_mib2_ip6(queue_t *, mblk_t *, ip_stack_t *,
684 boolean_t);
685 static mblk_t *ip_snmp_get_mib2_icmp(queue_t *, mblk_t *, ip_stack_t *ipst);
686 static mblk_t *ip_snmp_get_mib2_icmp6(queue_t *, mblk_t *, ip_stack_t *ipst);
687 static mblk_t *ip_snmp_get_mib2_igmp(queue_t *, mblk_t *, ip_stack_t *ipst);
688 static mblk_t *ip_snmp_get_mib2_multi(queue_t *, mblk_t *, ip_stack_t *ipst);
689 static mblk_t *ip_snmp_get_mib2_ip_addr(queue_t *, mblk_t *,
690 ip_stack_t *ipst, boolean_t);
691 static mblk_t *ip_snmp_get_mib2_ip6_addr(queue_t *, mblk_t *,
692 ip_stack_t *ipst, boolean_t);
693 static mblk_t *ip_snmp_get_mib2_ip_group_src(queue_t *, mblk_t *,
694 ip_stack_t *ipst);
695 static mblk_t *ip_snmp_get_mib2_ip6_group_src(queue_t *, mblk_t *,
696 ip_stack_t *ipst);
697 static mblk_t *ip_snmp_get_mib2_ip_group_mem(queue_t *, mblk_t *,
698 ip_stack_t *ipst);
699 static mblk_t *ip_snmp_get_mib2_ip6_group_mem(queue_t *, mblk_t *,
700 ip_stack_t *ipst);
701 static mblk_t *ip_snmp_get_mib2_virt_multi(queue_t *, mblk_t *,
702 ip_stack_t *ipst);
703 static mblk_t *ip_snmp_get_mib2_multi_rtable(queue_t *, mblk_t *,
704 ip_stack_t *ipst);
705 static mblk_t *ip_snmp_get_mib2_ip_route_media(queue_t *, mblk_t *, int,
706 ip_stack_t *ipst);
707 static mblk_t *ip_snmp_get_mib2_ip6_route_media(queue_t *, mblk_t *, int,
708 ip_stack_t *ipst);
709 static void ip_snmp_get2_v4(ire_t *, iproutedata_t *);
710 static void ip_snmp_get2_v6_route(ire_t *, iproutedata_t *);
711 static int ip_snmp_get2_v4_media(ncec_t *, iproutedata_t *);
712 static int ip_snmp_get2_v6_media(ncec_t *, iproutedata_t *);
713 int ip_snmp_set(queue_t *, int, int, uchar_t *, int);
714
715 static mblk_t *ip_fragment_copyhdr(uchar_t *, int, int, ip_stack_t *,
716 mblk_t *);
717
718 static void conn_drain_init(ip_stack_t *);
719 static void conn_drain_fini(ip_stack_t *);
720 static void conn_drain(conn_t *connp, boolean_t closing);
721
722 static void conn_walk_drain(ip_stack_t *, idl_tx_list_t *);
723 static void conn_walk_sctp(pfv_t, void *, zoneid_t, netstack_t *);
724
725 static void *ip_stack_init(netstackid_t stackid, netstack_t *ns);
726 static void ip_stack_shutdown(netstackid_t stackid, void *arg);
727 static void ip_stack_fini(netstackid_t stackid, void *arg);
728
729 static int ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t,
730 const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *),
731 ire_t *, conn_t *, boolean_t, const in6_addr_t *, mcast_record_t,
732 const in6_addr_t *);
733
734 static int ip_squeue_switch(int);
735
736 static void *ip_kstat_init(netstackid_t, ip_stack_t *);
737 static void ip_kstat_fini(netstackid_t, kstat_t *);
738 static int ip_kstat_update(kstat_t *kp, int rw);
739 static void *icmp_kstat_init(netstackid_t);
740 static void icmp_kstat_fini(netstackid_t, kstat_t *);
741 static int icmp_kstat_update(kstat_t *kp, int rw);
742 static void *ip_kstat2_init(netstackid_t, ip_stat_t *);
743 static void ip_kstat2_fini(netstackid_t, kstat_t *);
744
745 static void ipobs_init(ip_stack_t *);
746 static void ipobs_fini(ip_stack_t *);
747
748 static int ip_tp_cpu_update(cpu_setup_t, int, void *);
749
750 ipaddr_t ip_g_all_ones = IP_HOST_MASK;
751
752 static long ip_rput_pullups;
753 int dohwcksum = 1; /* use h/w cksum if supported by the hardware */
754
755 vmem_t *ip_minor_arena_sa; /* for minor nos. from INET_MIN_DEV+2 thru 2^^18-1 */
756 vmem_t *ip_minor_arena_la; /* for minor nos. from 2^^18 thru 2^^32-1 */
757
758 int ip_debug;
759
760 /*
761 * Multirouting/CGTP stuff
762 */
763 int ip_cgtp_filter_rev = CGTP_FILTER_REV; /* CGTP hooks version */
764
765 /*
766 * IP tunables related declarations. Definitions are in ip_tunables.c
767 */
768 extern mod_prop_info_t ip_propinfo_tbl[];
769 extern int ip_propinfo_count;
770
771 /*
772 * Table of IP ioctls encoding the various properties of the ioctl and
773 * indexed based on the last byte of the ioctl command. Occasionally there
774 * is a clash, and there is more than 1 ioctl with the same last byte.
775 * In such a case 1 ioctl is encoded in the ndx table and the remaining
776 * ioctls are encoded in the misc table. An entry in the ndx table is
777 * retrieved by indexing on the last byte of the ioctl command and comparing
778 * the ioctl command with the value in the ndx table. In the event of a
779 * mismatch the misc table is then searched sequentially for the desired
780 * ioctl command.
781 *
782 * Entry: <command> <copyin_size> <flags> <cmd_type> <function> <restart_func>
783 */
784 ip_ioctl_cmd_t ip_ndx_ioctl_table[] = {
785 /* 000 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
786 /* 001 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
787 /* 002 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
788 /* 003 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
789 /* 004 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
790 /* 005 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
791 /* 006 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
792 /* 007 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
793 /* 008 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
794 /* 009 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
795
796 /* 010 */ { SIOCADDRT, sizeof (struct rtentry), IPI_PRIV,
797 MISC_CMD, ip_siocaddrt, NULL },
798 /* 011 */ { SIOCDELRT, sizeof (struct rtentry), IPI_PRIV,
799 MISC_CMD, ip_siocdelrt, NULL },
800
801 /* 012 */ { SIOCSIFADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
802 IF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
803 /* 013 */ { SIOCGIFADDR, sizeof (struct ifreq), IPI_GET_CMD,
804 IF_CMD, ip_sioctl_get_addr, NULL },
805
806 /* 014 */ { SIOCSIFDSTADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
807 IF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
808 /* 015 */ { SIOCGIFDSTADDR, sizeof (struct ifreq),
809 IPI_GET_CMD, IF_CMD, ip_sioctl_get_dstaddr, NULL },
810
811 /* 016 */ { SIOCSIFFLAGS, sizeof (struct ifreq),
812 IPI_PRIV | IPI_WR,
813 IF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
814 /* 017 */ { SIOCGIFFLAGS, sizeof (struct ifreq),
815 IPI_MODOK | IPI_GET_CMD,
816 IF_CMD, ip_sioctl_get_flags, NULL },
817
818 /* 018 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
819 /* 019 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
820
821 /* copyin size cannot be coded for SIOCGIFCONF */
822 /* 020 */ { O_SIOCGIFCONF, 0, IPI_GET_CMD,
823 MISC_CMD, ip_sioctl_get_ifconf, NULL },
824
825 /* 021 */ { SIOCSIFMTU, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
826 IF_CMD, ip_sioctl_mtu, NULL },
827 /* 022 */ { SIOCGIFMTU, sizeof (struct ifreq), IPI_GET_CMD,
828 IF_CMD, ip_sioctl_get_mtu, NULL },
829 /* 023 */ { SIOCGIFBRDADDR, sizeof (struct ifreq),
830 IPI_GET_CMD, IF_CMD, ip_sioctl_get_brdaddr, NULL },
831 /* 024 */ { SIOCSIFBRDADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
832 IF_CMD, ip_sioctl_brdaddr, NULL },
833 /* 025 */ { SIOCGIFNETMASK, sizeof (struct ifreq),
834 IPI_GET_CMD, IF_CMD, ip_sioctl_get_netmask, NULL },
835 /* 026 */ { SIOCSIFNETMASK, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
836 IF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
837 /* 027 */ { SIOCGIFMETRIC, sizeof (struct ifreq),
838 IPI_GET_CMD, IF_CMD, ip_sioctl_get_metric, NULL },
839 /* 028 */ { SIOCSIFMETRIC, sizeof (struct ifreq), IPI_PRIV,
840 IF_CMD, ip_sioctl_metric, NULL },
841 /* 029 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
842
843 /* See 166-168 below for extended SIOC*XARP ioctls */
844 /* 030 */ { SIOCSARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR,
845 ARP_CMD, ip_sioctl_arp, NULL },
846 /* 031 */ { SIOCGARP, sizeof (struct arpreq), IPI_GET_CMD,
847 ARP_CMD, ip_sioctl_arp, NULL },
848 /* 032 */ { SIOCDARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR,
849 ARP_CMD, ip_sioctl_arp, NULL },
850
851 /* 033 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
852 /* 034 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
853 /* 035 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
854 /* 036 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
855 /* 037 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
856 /* 038 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
857 /* 039 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
858 /* 040 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
859 /* 041 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
860 /* 042 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
861 /* 043 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
862 /* 044 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
863 /* 045 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
864 /* 046 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
865 /* 047 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
866 /* 048 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
867 /* 049 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
868 /* 050 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
869 /* 051 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
870 /* 052 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
871 /* 053 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
872
873 /* 054 */ { IF_UNITSEL, sizeof (int), IPI_PRIV | IPI_WR | IPI_MODOK,
874 MISC_CMD, if_unitsel, if_unitsel_restart },
875
876 /* 055 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
877 /* 056 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
878 /* 057 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
879 /* 058 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
880 /* 059 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
881 /* 060 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
882 /* 061 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
883 /* 062 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
884 /* 063 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
885 /* 064 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
886 /* 065 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
887 /* 066 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
888 /* 067 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
889 /* 068 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
890 /* 069 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
891 /* 070 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
892 /* 071 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
893 /* 072 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
894
895 /* 073 */ { SIOCSIFNAME, sizeof (struct ifreq),
896 IPI_PRIV | IPI_WR | IPI_MODOK,
897 IF_CMD, ip_sioctl_sifname, NULL },
898
899 /* 074 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
900 /* 075 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
901 /* 076 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
902 /* 077 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
903 /* 078 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
904 /* 079 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
905 /* 080 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
906 /* 081 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
907 /* 082 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
908 /* 083 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
909 /* 084 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
910 /* 085 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
911 /* 086 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
912
913 /* 087 */ { SIOCGIFNUM, sizeof (int), IPI_GET_CMD,
914 MISC_CMD, ip_sioctl_get_ifnum, NULL },
915 /* 088 */ { SIOCGIFMUXID, sizeof (struct ifreq), IPI_GET_CMD,
916 IF_CMD, ip_sioctl_get_muxid, NULL },
917 /* 089 */ { SIOCSIFMUXID, sizeof (struct ifreq),
918 IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_muxid, NULL },
919
920 /* Both if and lif variants share same func */
921 /* 090 */ { SIOCGIFINDEX, sizeof (struct ifreq), IPI_GET_CMD,
922 IF_CMD, ip_sioctl_get_lifindex, NULL },
923 /* Both if and lif variants share same func */
924 /* 091 */ { SIOCSIFINDEX, sizeof (struct ifreq),
925 IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_slifindex, NULL },
926
927 /* copyin size cannot be coded for SIOCGIFCONF */
928 /* 092 */ { SIOCGIFCONF, 0, IPI_GET_CMD,
929 MISC_CMD, ip_sioctl_get_ifconf, NULL },
930 /* 093 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
931 /* 094 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
932 /* 095 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
933 /* 096 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
934 /* 097 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
935 /* 098 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
936 /* 099 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
937 /* 100 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
938 /* 101 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
939 /* 102 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
940 /* 103 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
941 /* 104 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
942 /* 105 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
943 /* 106 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
944 /* 107 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
945 /* 108 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
946 /* 109 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
947
948 /* 110 */ { SIOCLIFREMOVEIF, sizeof (struct lifreq),
949 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_removeif,
950 ip_sioctl_removeif_restart },
951 /* 111 */ { SIOCLIFADDIF, sizeof (struct lifreq),
952 IPI_GET_CMD | IPI_PRIV | IPI_WR,
953 LIF_CMD, ip_sioctl_addif, NULL },
954 #define SIOCLIFADDR_NDX 112
955 /* 112 */ { SIOCSLIFADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
956 LIF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
957 /* 113 */ { SIOCGLIFADDR, sizeof (struct lifreq),
958 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_addr, NULL },
959 /* 114 */ { SIOCSLIFDSTADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
960 LIF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
961 /* 115 */ { SIOCGLIFDSTADDR, sizeof (struct lifreq),
962 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dstaddr, NULL },
963 /* 116 */ { SIOCSLIFFLAGS, sizeof (struct lifreq),
964 IPI_PRIV | IPI_WR,
965 LIF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
966 /* 117 */ { SIOCGLIFFLAGS, sizeof (struct lifreq),
967 IPI_GET_CMD | IPI_MODOK,
968 LIF_CMD, ip_sioctl_get_flags, NULL },
969
970 /* 118 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
971 /* 119 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
972
973 /* 120 */ { O_SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD,
974 ip_sioctl_get_lifconf, NULL },
975 /* 121 */ { SIOCSLIFMTU, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
976 LIF_CMD, ip_sioctl_mtu, NULL },
977 /* 122 */ { SIOCGLIFMTU, sizeof (struct lifreq), IPI_GET_CMD,
978 LIF_CMD, ip_sioctl_get_mtu, NULL },
979 /* 123 */ { SIOCGLIFBRDADDR, sizeof (struct lifreq),
980 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_brdaddr, NULL },
981 /* 124 */ { SIOCSLIFBRDADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
982 LIF_CMD, ip_sioctl_brdaddr, NULL },
983 /* 125 */ { SIOCGLIFNETMASK, sizeof (struct lifreq),
984 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_netmask, NULL },
985 /* 126 */ { SIOCSLIFNETMASK, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
986 LIF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
987 /* 127 */ { SIOCGLIFMETRIC, sizeof (struct lifreq),
988 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_metric, NULL },
989 /* 128 */ { SIOCSLIFMETRIC, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
990 LIF_CMD, ip_sioctl_metric, NULL },
991 /* 129 */ { SIOCSLIFNAME, sizeof (struct lifreq),
992 IPI_PRIV | IPI_WR | IPI_MODOK,
993 LIF_CMD, ip_sioctl_slifname,
994 ip_sioctl_slifname_restart },
995
996 /* 130 */ { SIOCGLIFNUM, sizeof (struct lifnum), IPI_GET_CMD,
997 MISC_CMD, ip_sioctl_get_lifnum, NULL },
998 /* 131 */ { SIOCGLIFMUXID, sizeof (struct lifreq),
999 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_muxid, NULL },
1000 /* 132 */ { SIOCSLIFMUXID, sizeof (struct lifreq),
1001 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_muxid, NULL },
1002 /* 133 */ { SIOCGLIFINDEX, sizeof (struct lifreq),
1003 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifindex, 0 },
1004 /* 134 */ { SIOCSLIFINDEX, sizeof (struct lifreq),
1005 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifindex, 0 },
1006 /* 135 */ { SIOCSLIFTOKEN, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1007 LIF_CMD, ip_sioctl_token, NULL },
1008 /* 136 */ { SIOCGLIFTOKEN, sizeof (struct lifreq),
1009 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_token, NULL },
1010 /* 137 */ { SIOCSLIFSUBNET, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1011 LIF_CMD, ip_sioctl_subnet, ip_sioctl_subnet_restart },
1012 /* 138 */ { SIOCGLIFSUBNET, sizeof (struct lifreq),
1013 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_subnet, NULL },
1014 /* 139 */ { SIOCSLIFLNKINFO, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1015 LIF_CMD, ip_sioctl_lnkinfo, NULL },
1016
1017 /* 140 */ { SIOCGLIFLNKINFO, sizeof (struct lifreq),
1018 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lnkinfo, NULL },
1019 /* 141 */ { SIOCLIFDELND, sizeof (struct lifreq), IPI_PRIV,
1020 LIF_CMD, ip_siocdelndp_v6, NULL },
1021 /* 142 */ { SIOCLIFGETND, sizeof (struct lifreq), IPI_GET_CMD,
1022 LIF_CMD, ip_siocqueryndp_v6, NULL },
1023 /* 143 */ { SIOCLIFSETND, sizeof (struct lifreq), IPI_PRIV,
1024 LIF_CMD, ip_siocsetndp_v6, NULL },
1025 /* 144 */ { SIOCTMYADDR, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1026 MISC_CMD, ip_sioctl_tmyaddr, NULL },
1027 /* 145 */ { SIOCTONLINK, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1028 MISC_CMD, ip_sioctl_tonlink, NULL },
1029 /* 146 */ { SIOCTMYSITE, sizeof (struct sioc_addrreq), 0,
1030 MISC_CMD, ip_sioctl_tmysite, NULL },
1031 /* 147 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1032 /* 148 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1033 /* IPSECioctls handled in ip_sioctl_copyin_setup itself */
1034 /* 149 */ { SIOCFIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1035 /* 150 */ { SIOCSIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1036 /* 151 */ { SIOCDIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1037 /* 152 */ { SIOCLIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL },
1038
1039 /* 153 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1040
1041 /* 154 */ { SIOCGLIFBINDING, sizeof (struct lifreq), IPI_GET_CMD,
1042 LIF_CMD, ip_sioctl_get_binding, NULL },
1043 /* 155 */ { SIOCSLIFGROUPNAME, sizeof (struct lifreq),
1044 IPI_PRIV | IPI_WR,
1045 LIF_CMD, ip_sioctl_groupname, ip_sioctl_groupname },
1046 /* 156 */ { SIOCGLIFGROUPNAME, sizeof (struct lifreq),
1047 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_groupname, NULL },
1048 /* 157 */ { SIOCGLIFGROUPINFO, sizeof (lifgroupinfo_t),
1049 IPI_GET_CMD, MISC_CMD, ip_sioctl_groupinfo, NULL },
1050
1051 /* Leave 158-160 unused; used to be SIOC*IFARP ioctls */
1052 /* 158 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1053 /* 159 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1054 /* 160 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1055
1056 /* 161 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1057
1058 /* These are handled in ip_sioctl_copyin_setup itself */
1059 /* 162 */ { SIOCGIP6ADDRPOLICY, 0, IPI_NULL_BCONT,
1060 MISC_CMD, NULL, NULL },
1061 /* 163 */ { SIOCSIP6ADDRPOLICY, 0, IPI_PRIV | IPI_NULL_BCONT,
1062 MISC_CMD, NULL, NULL },
1063 /* 164 */ { SIOCGDSTINFO, 0, IPI_GET_CMD, MISC_CMD, NULL, NULL },
1064
1065 /* 165 */ { SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD,
1066 ip_sioctl_get_lifconf, NULL },
1067
1068 /* 166 */ { SIOCSXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR,
1069 XARP_CMD, ip_sioctl_arp, NULL },
1070 /* 167 */ { SIOCGXARP, sizeof (struct xarpreq), IPI_GET_CMD,
1071 XARP_CMD, ip_sioctl_arp, NULL },
1072 /* 168 */ { SIOCDXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR,
1073 XARP_CMD, ip_sioctl_arp, NULL },
1074
1075 /* SIOCPOPSOCKFS is not handled by IP */
1076 /* 169 */ { IPI_DONTCARE /* SIOCPOPSOCKFS */, 0, 0, 0, NULL, NULL },
1077
1078 /* 170 */ { SIOCGLIFZONE, sizeof (struct lifreq),
1079 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifzone, NULL },
1080 /* 171 */ { SIOCSLIFZONE, sizeof (struct lifreq),
1081 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifzone,
1082 ip_sioctl_slifzone_restart },
1083 /* 172-174 are SCTP ioctls and not handled by IP */
1084 /* 172 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1085 /* 173 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1086 /* 174 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1087 /* 175 */ { SIOCGLIFUSESRC, sizeof (struct lifreq),
1088 IPI_GET_CMD, LIF_CMD,
1089 ip_sioctl_get_lifusesrc, 0 },
1090 /* 176 */ { SIOCSLIFUSESRC, sizeof (struct lifreq),
1091 IPI_PRIV | IPI_WR,
1092 LIF_CMD, ip_sioctl_slifusesrc,
1093 NULL },
1094 /* 177 */ { SIOCGLIFSRCOF, 0, IPI_GET_CMD, MISC_CMD,
1095 ip_sioctl_get_lifsrcof, NULL },
1096 /* 178 */ { SIOCGMSFILTER, sizeof (struct group_filter), IPI_GET_CMD,
1097 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1098 /* 179 */ { SIOCSMSFILTER, sizeof (struct group_filter), 0,
1099 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1100 /* 180 */ { SIOCGIPMSFILTER, sizeof (struct ip_msfilter), IPI_GET_CMD,
1101 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1102 /* 181 */ { SIOCSIPMSFILTER, sizeof (struct ip_msfilter), 0,
1103 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1104 /* 182 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1105 /* SIOCSENABLESDP is handled by SDP */
1106 /* 183 */ { IPI_DONTCARE /* SIOCSENABLESDP */, 0, 0, 0, NULL, NULL },
1107 /* 184 */ { IPI_DONTCARE /* SIOCSQPTR */, 0, 0, 0, NULL, NULL },
1108 /* 185 */ { SIOCGIFHWADDR, sizeof (struct ifreq), IPI_GET_CMD,
1109 IF_CMD, ip_sioctl_get_ifhwaddr, NULL },
1110 /* 186 */ { IPI_DONTCARE /* SIOCGSTAMP */, 0, 0, 0, NULL, NULL },
1111 /* 187 */ { SIOCILB, 0, IPI_PRIV | IPI_GET_CMD, MISC_CMD,
1112 ip_sioctl_ilb_cmd, NULL },
1113 /* 188 */ { SIOCGETPROP, 0, IPI_GET_CMD, 0, NULL, NULL },
1114 /* 189 */ { SIOCSETPROP, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL},
1115 /* 190 */ { SIOCGLIFDADSTATE, sizeof (struct lifreq),
1116 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dadstate, NULL },
1117 /* 191 */ { SIOCSLIFPREFIX, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1118 LIF_CMD, ip_sioctl_prefix, ip_sioctl_prefix_restart },
1119 /* 192 */ { SIOCGLIFHWADDR, sizeof (struct lifreq), IPI_GET_CMD,
1120 LIF_CMD, ip_sioctl_get_lifhwaddr, NULL }
1121 };
1122
1123 int ip_ndx_ioctl_count = sizeof (ip_ndx_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1124
1125 ip_ioctl_cmd_t ip_misc_ioctl_table[] = {
1126 { I_LINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1127 { I_UNLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1128 { I_PLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1129 { I_PUNLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1130 { ND_GET, 0, 0, 0, NULL, NULL },
1131 { ND_SET, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1132 { IP_IOCTL, 0, 0, 0, NULL, NULL },
1133 { SIOCGETVIFCNT, sizeof (struct sioc_vif_req), IPI_GET_CMD,
1134 MISC_CMD, mrt_ioctl},
1135 { SIOCGETSGCNT, sizeof (struct sioc_sg_req), IPI_GET_CMD,
1136 MISC_CMD, mrt_ioctl},
1137 { SIOCGETLSGCNT, sizeof (struct sioc_lsg_req), IPI_GET_CMD,
1138 MISC_CMD, mrt_ioctl}
1139 };
1140
1141 int ip_misc_ioctl_count =
1142 sizeof (ip_misc_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1143
1144 int conn_drain_nthreads; /* Number of drainers reqd. */
1145 /* Settable in /etc/system */
1146 /* Defined in ip_ire.c */
1147 extern uint32_t ip_ire_max_bucket_cnt, ip6_ire_max_bucket_cnt;
1148 extern uint32_t ip_ire_min_bucket_cnt, ip6_ire_min_bucket_cnt;
1149 extern uint32_t ip_ire_mem_ratio, ip_ire_cpu_ratio;
1150
1151 static nv_t ire_nv_arr[] = {
1152 { IRE_BROADCAST, "BROADCAST" },
1153 { IRE_LOCAL, "LOCAL" },
1154 { IRE_LOOPBACK, "LOOPBACK" },
1155 { IRE_DEFAULT, "DEFAULT" },
1156 { IRE_PREFIX, "PREFIX" },
1157 { IRE_IF_NORESOLVER, "IF_NORESOL" },
1158 { IRE_IF_RESOLVER, "IF_RESOLV" },
1159 { IRE_IF_CLONE, "IF_CLONE" },
1160 { IRE_HOST, "HOST" },
1161 { IRE_MULTICAST, "MULTICAST" },
1162 { IRE_NOROUTE, "NOROUTE" },
1163 { 0 }
1164 };
1165
1166 nv_t *ire_nv_tbl = ire_nv_arr;
1167
1168 /* Simple ICMP IP Header Template */
1169 static ipha_t icmp_ipha = {
1170 IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
1171 };
1172
1173 struct module_info ip_mod_info = {
1174 IP_MOD_ID, IP_MOD_NAME, IP_MOD_MINPSZ, IP_MOD_MAXPSZ, IP_MOD_HIWAT,
1175 IP_MOD_LOWAT
1176 };
1177
1178 /*
1179 * Duplicate static symbols within a module confuses mdb; so we avoid the
1180 * problem by making the symbols here distinct from those in udp.c.
1181 */
1182
1183 /*
1184 * Entry points for IP as a device and as a module.
1185 * We have separate open functions for the /dev/ip and /dev/ip6 devices.
1186 */
1187 static struct qinit iprinitv4 = {
1188 (pfi_t)ip_rput, NULL, ip_openv4, ip_close, NULL,
1189 &ip_mod_info
1190 };
1191
1192 struct qinit iprinitv6 = {
1193 (pfi_t)ip_rput_v6, NULL, ip_openv6, ip_close, NULL,
1194 &ip_mod_info
1195 };
1196
1197 static struct qinit ipwinit = {
1198 (pfi_t)ip_wput_nondata, (pfi_t)ip_wsrv, NULL, NULL, NULL,
1199 &ip_mod_info
1200 };
1201
1202 static struct qinit iplrinit = {
1203 (pfi_t)ip_lrput, NULL, ip_openv4, ip_close, NULL,
1204 &ip_mod_info
1205 };
1206
1207 static struct qinit iplwinit = {
1208 (pfi_t)ip_lwput, NULL, NULL, NULL, NULL,
1209 &ip_mod_info
1210 };
1211
1212 /* For AF_INET aka /dev/ip */
1213 struct streamtab ipinfov4 = {
1214 &iprinitv4, &ipwinit, &iplrinit, &iplwinit
1215 };
1216
1217 /* For AF_INET6 aka /dev/ip6 */
1218 struct streamtab ipinfov6 = {
1219 &iprinitv6, &ipwinit, &iplrinit, &iplwinit
1220 };
1221
1222 #ifdef DEBUG
1223 boolean_t skip_sctp_cksum = B_FALSE;
1224 #endif
1225
1226 /*
1227 * Generate an ICMP fragmentation needed message.
1228 * When called from ip_output side a minimal ip_recv_attr_t needs to be
1229 * constructed by the caller.
1230 */
1231 void
1232 icmp_frag_needed(mblk_t *mp, int mtu, ip_recv_attr_t *ira)
1233 {
1234 icmph_t icmph;
1235 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
1236
1237 mp = icmp_pkt_err_ok(mp, ira);
1238 if (mp == NULL)
1239 return;
1240
1241 bzero(&icmph, sizeof (icmph_t));
1242 icmph.icmph_type = ICMP_DEST_UNREACHABLE;
1243 icmph.icmph_code = ICMP_FRAGMENTATION_NEEDED;
1244 icmph.icmph_du_mtu = htons((uint16_t)mtu);
1245 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutFragNeeded);
1246 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs);
1247
1248 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
1249 }
1250
1251 /*
1252 * icmp_inbound_v4 deals with ICMP messages that are handled by IP.
1253 * If the ICMP message is consumed by IP, i.e., it should not be delivered
1254 * to any IPPROTO_ICMP raw sockets, then it returns NULL.
1255 * Likewise, if the ICMP error is misformed (too short, etc), then it
1256 * returns NULL. The caller uses this to determine whether or not to send
1257 * to raw sockets.
1258 *
1259 * All error messages are passed to the matching transport stream.
1260 *
1261 * The following cases are handled by icmp_inbound:
1262 * 1) It needs to send a reply back and possibly delivering it
1263 * to the "interested" upper clients.
1264 * 2) Return the mblk so that the caller can pass it to the RAW socket clients.
1265 * 3) It needs to change some values in IP only.
1266 * 4) It needs to change some values in IP and upper layers e.g TCP
1267 * by delivering an error to the upper layers.
1268 *
1269 * We handle the above three cases in the context of IPsec in the
1270 * following way :
1271 *
1272 * 1) Send the reply back in the same way as the request came in.
1273 * If it came in encrypted, it goes out encrypted. If it came in
1274 * clear, it goes out in clear. Thus, this will prevent chosen
1275 * plain text attack.
1276 * 2) The client may or may not expect things to come in secure.
1277 * If it comes in secure, the policy constraints are checked
1278 * before delivering it to the upper layers. If it comes in
1279 * clear, ipsec_inbound_accept_clear will decide whether to
1280 * accept this in clear or not. In both the cases, if the returned
1281 * message (IP header + 8 bytes) that caused the icmp message has
1282 * AH/ESP headers, it is sent up to AH/ESP for validation before
1283 * sending up. If there are only 8 bytes of returned message, then
1284 * upper client will not be notified.
1285 * 3) Check with global policy to see whether it matches the constaints.
1286 * But this will be done only if icmp_accept_messages_in_clear is
1287 * zero.
1288 * 4) If we need to change both in IP and ULP, then the decision taken
1289 * while affecting the values in IP and while delivering up to TCP
1290 * should be the same.
1291 *
1292 * There are two cases.
1293 *
1294 * a) If we reject data at the IP layer (ipsec_check_global_policy()
1295 * failed), we will not deliver it to the ULP, even though they
1296 * are *willing* to accept in *clear*. This is fine as our global
1297 * disposition to icmp messages asks us reject the datagram.
1298 *
1299 * b) If we accept data at the IP layer (ipsec_check_global_policy()
1300 * succeeded or icmp_accept_messages_in_clear is 1), and not able
1301 * to deliver it to ULP (policy failed), it can lead to
1302 * consistency problems. The cases known at this time are
1303 * ICMP_DESTINATION_UNREACHABLE messages with following code
1304 * values :
1305 *
1306 * - ICMP_FRAGMENTATION_NEEDED : IP adapts to the new value
1307 * and Upper layer rejects. Then the communication will
1308 * come to a stop. This is solved by making similar decisions
1309 * at both levels. Currently, when we are unable to deliver
1310 * to the Upper Layer (due to policy failures) while IP has
1311 * adjusted dce_pmtu, the next outbound datagram would
1312 * generate a local ICMP_FRAGMENTATION_NEEDED message - which
1313 * will be with the right level of protection. Thus the right
1314 * value will be communicated even if we are not able to
1315 * communicate when we get from the wire initially. But this
1316 * assumes there would be at least one outbound datagram after
1317 * IP has adjusted its dce_pmtu value. To make things
1318 * simpler, we accept in clear after the validation of
1319 * AH/ESP headers.
1320 *
1321 * - Other ICMP ERRORS : We may not be able to deliver it to the
1322 * upper layer depending on the level of protection the upper
1323 * layer expects and the disposition in ipsec_inbound_accept_clear().
1324 * ipsec_inbound_accept_clear() decides whether a given ICMP error
1325 * should be accepted in clear when the Upper layer expects secure.
1326 * Thus the communication may get aborted by some bad ICMP
1327 * packets.
1328 */
1329 mblk_t *
1330 icmp_inbound_v4(mblk_t *mp, ip_recv_attr_t *ira)
1331 {
1332 icmph_t *icmph;
1333 ipha_t *ipha; /* Outer header */
1334 int ip_hdr_length; /* Outer header length */
1335 boolean_t interested;
1336 ipif_t *ipif;
1337 uint32_t ts;
1338 uint32_t *tsp;
1339 timestruc_t now;
1340 ill_t *ill = ira->ira_ill;
1341 ip_stack_t *ipst = ill->ill_ipst;
1342 zoneid_t zoneid = ira->ira_zoneid;
1343 int len_needed;
1344 mblk_t *mp_ret = NULL;
1345
1346 ipha = (ipha_t *)mp->b_rptr;
1347
1348 BUMP_MIB(&ipst->ips_icmp_mib, icmpInMsgs);
1349
1350 ip_hdr_length = ira->ira_ip_hdr_length;
1351 if ((mp->b_wptr - mp->b_rptr) < (ip_hdr_length + ICMPH_SIZE)) {
1352 if (ira->ira_pktlen < (ip_hdr_length + ICMPH_SIZE)) {
1353 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
1354 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
1355 freemsg(mp);
1356 return (NULL);
1357 }
1358 /* Last chance to get real. */
1359 ipha = ip_pullup(mp, ip_hdr_length + ICMPH_SIZE, ira);
1360 if (ipha == NULL) {
1361 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
1362 freemsg(mp);
1363 return (NULL);
1364 }
1365 }
1366
1367 /* The IP header will always be a multiple of four bytes */
1368 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1369 ip2dbg(("icmp_inbound_v4: type %d code %d\n", icmph->icmph_type,
1370 icmph->icmph_code));
1371
1372 /*
1373 * We will set "interested" to "true" if we should pass a copy to
1374 * the transport or if we handle the packet locally.
1375 */
1376 interested = B_FALSE;
1377 switch (icmph->icmph_type) {
1378 case ICMP_ECHO_REPLY:
1379 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchoReps);
1380 break;
1381 case ICMP_DEST_UNREACHABLE:
1382 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED)
1383 BUMP_MIB(&ipst->ips_icmp_mib, icmpInFragNeeded);
1384 interested = B_TRUE; /* Pass up to transport */
1385 BUMP_MIB(&ipst->ips_icmp_mib, icmpInDestUnreachs);
1386 break;
1387 case ICMP_SOURCE_QUENCH:
1388 interested = B_TRUE; /* Pass up to transport */
1389 BUMP_MIB(&ipst->ips_icmp_mib, icmpInSrcQuenchs);
1390 break;
1391 case ICMP_REDIRECT:
1392 if (!ipst->ips_ip_ignore_redirect)
1393 interested = B_TRUE;
1394 BUMP_MIB(&ipst->ips_icmp_mib, icmpInRedirects);
1395 break;
1396 case ICMP_ECHO_REQUEST:
1397 /*
1398 * Whether to respond to echo requests that come in as IP
1399 * broadcasts or as IP multicast is subject to debate
1400 * (what isn't?). We aim to please, you pick it.
1401 * Default is do it.
1402 */
1403 if (ira->ira_flags & IRAF_MULTICAST) {
1404 /* multicast: respond based on tunable */
1405 interested = ipst->ips_ip_g_resp_to_echo_mcast;
1406 } else if (ira->ira_flags & IRAF_BROADCAST) {
1407 /* broadcast: respond based on tunable */
1408 interested = ipst->ips_ip_g_resp_to_echo_bcast;
1409 } else {
1410 /* unicast: always respond */
1411 interested = B_TRUE;
1412 }
1413 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchos);
1414 if (!interested) {
1415 /* We never pass these to RAW sockets */
1416 freemsg(mp);
1417 return (NULL);
1418 }
1419
1420 /* Check db_ref to make sure we can modify the packet. */
1421 if (mp->b_datap->db_ref > 1) {
1422 mblk_t *mp1;
1423
1424 mp1 = copymsg(mp);
1425 freemsg(mp);
1426 if (!mp1) {
1427 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1428 return (NULL);
1429 }
1430 mp = mp1;
1431 ipha = (ipha_t *)mp->b_rptr;
1432 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1433 }
1434 icmph->icmph_type = ICMP_ECHO_REPLY;
1435 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutEchoReps);
1436 icmp_send_reply_v4(mp, ipha, icmph, ira);
1437 return (NULL);
1438
1439 case ICMP_ROUTER_ADVERTISEMENT:
1440 case ICMP_ROUTER_SOLICITATION:
1441 break;
1442 case ICMP_TIME_EXCEEDED:
1443 interested = B_TRUE; /* Pass up to transport */
1444 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimeExcds);
1445 break;
1446 case ICMP_PARAM_PROBLEM:
1447 interested = B_TRUE; /* Pass up to transport */
1448 BUMP_MIB(&ipst->ips_icmp_mib, icmpInParmProbs);
1449 break;
1450 case ICMP_TIME_STAMP_REQUEST:
1451 /* Response to Time Stamp Requests is local policy. */
1452 if (ipst->ips_ip_g_resp_to_timestamp) {
1453 if (ira->ira_flags & IRAF_MULTIBROADCAST)
1454 interested =
1455 ipst->ips_ip_g_resp_to_timestamp_bcast;
1456 else
1457 interested = B_TRUE;
1458 }
1459 if (!interested) {
1460 /* We never pass these to RAW sockets */
1461 freemsg(mp);
1462 return (NULL);
1463 }
1464
1465 /* Make sure we have enough of the packet */
1466 len_needed = ip_hdr_length + ICMPH_SIZE +
1467 3 * sizeof (uint32_t);
1468
1469 if (mp->b_wptr - mp->b_rptr < len_needed) {
1470 ipha = ip_pullup(mp, len_needed, ira);
1471 if (ipha == NULL) {
1472 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1473 ip_drop_input("ipIfStatsInDiscards - ip_pullup",
1474 mp, ill);
1475 freemsg(mp);
1476 return (NULL);
1477 }
1478 /* Refresh following the pullup. */
1479 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1480 }
1481 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestamps);
1482 /* Check db_ref to make sure we can modify the packet. */
1483 if (mp->b_datap->db_ref > 1) {
1484 mblk_t *mp1;
1485
1486 mp1 = copymsg(mp);
1487 freemsg(mp);
1488 if (!mp1) {
1489 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1490 return (NULL);
1491 }
1492 mp = mp1;
1493 ipha = (ipha_t *)mp->b_rptr;
1494 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1495 }
1496 icmph->icmph_type = ICMP_TIME_STAMP_REPLY;
1497 tsp = (uint32_t *)&icmph[1];
1498 tsp++; /* Skip past 'originate time' */
1499 /* Compute # of milliseconds since midnight */
1500 gethrestime(&now);
1501 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
1502 now.tv_nsec / (NANOSEC / MILLISEC);
1503 *tsp++ = htonl(ts); /* Lay in 'receive time' */
1504 *tsp++ = htonl(ts); /* Lay in 'send time' */
1505 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimestampReps);
1506 icmp_send_reply_v4(mp, ipha, icmph, ira);
1507 return (NULL);
1508
1509 case ICMP_TIME_STAMP_REPLY:
1510 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestampReps);
1511 break;
1512 case ICMP_INFO_REQUEST:
1513 /* Per RFC 1122 3.2.2.7, ignore this. */
1514 case ICMP_INFO_REPLY:
1515 break;
1516 case ICMP_ADDRESS_MASK_REQUEST:
1517 if (ira->ira_flags & IRAF_MULTIBROADCAST) {
1518 interested =
1519 ipst->ips_ip_respond_to_address_mask_broadcast;
1520 } else {
1521 interested = B_TRUE;
1522 }
1523 if (!interested) {
1524 /* We never pass these to RAW sockets */
1525 freemsg(mp);
1526 return (NULL);
1527 }
1528 len_needed = ip_hdr_length + ICMPH_SIZE + IP_ADDR_LEN;
1529 if (mp->b_wptr - mp->b_rptr < len_needed) {
1530 ipha = ip_pullup(mp, len_needed, ira);
1531 if (ipha == NULL) {
1532 BUMP_MIB(ill->ill_ip_mib,
1533 ipIfStatsInTruncatedPkts);
1534 ip_drop_input("ipIfStatsInTruncatedPkts", mp,
1535 ill);
1536 freemsg(mp);
1537 return (NULL);
1538 }
1539 /* Refresh following the pullup. */
1540 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1541 }
1542 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMasks);
1543 /* Check db_ref to make sure we can modify the packet. */
1544 if (mp->b_datap->db_ref > 1) {
1545 mblk_t *mp1;
1546
1547 mp1 = copymsg(mp);
1548 freemsg(mp);
1549 if (!mp1) {
1550 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1551 return (NULL);
1552 }
1553 mp = mp1;
1554 ipha = (ipha_t *)mp->b_rptr;
1555 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1556 }
1557 /*
1558 * Need the ipif with the mask be the same as the source
1559 * address of the mask reply. For unicast we have a specific
1560 * ipif. For multicast/broadcast we only handle onlink
1561 * senders, and use the source address to pick an ipif.
1562 */
1563 ipif = ipif_lookup_addr(ipha->ipha_dst, ill, zoneid, ipst);
1564 if (ipif == NULL) {
1565 /* Broadcast or multicast */
1566 ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid);
1567 if (ipif == NULL) {
1568 freemsg(mp);
1569 return (NULL);
1570 }
1571 }
1572 icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
1573 bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
1574 ipif_refrele(ipif);
1575 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutAddrMaskReps);
1576 icmp_send_reply_v4(mp, ipha, icmph, ira);
1577 return (NULL);
1578
1579 case ICMP_ADDRESS_MASK_REPLY:
1580 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMaskReps);
1581 break;
1582 default:
1583 interested = B_TRUE; /* Pass up to transport */
1584 BUMP_MIB(&ipst->ips_icmp_mib, icmpInUnknowns);
1585 break;
1586 }
1587 /*
1588 * See if there is an ICMP client to avoid an extra copymsg/freemsg
1589 * if there isn't one.
1590 */
1591 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_ICMP].connf_head != NULL) {
1592 /* If there is an ICMP client and we want one too, copy it. */
1593
1594 if (!interested) {
1595 /* Caller will deliver to RAW sockets */
1596 return (mp);
1597 }
1598 mp_ret = copymsg(mp);
1599 if (mp_ret == NULL) {
1600 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1601 ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill);
1602 }
1603 } else if (!interested) {
1604 /* Neither we nor raw sockets are interested. Drop packet now */
1605 freemsg(mp);
1606 return (NULL);
1607 }
1608
1609 /*
1610 * ICMP error or redirect packet. Make sure we have enough of
1611 * the header and that db_ref == 1 since we might end up modifying
1612 * the packet.
1613 */
1614 if (mp->b_cont != NULL) {
1615 if (ip_pullup(mp, -1, ira) == NULL) {
1616 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1617 ip_drop_input("ipIfStatsInDiscards - ip_pullup",
1618 mp, ill);
1619 freemsg(mp);
1620 return (mp_ret);
1621 }
1622 }
1623
1624 if (mp->b_datap->db_ref > 1) {
1625 mblk_t *mp1;
1626
1627 mp1 = copymsg(mp);
1628 if (mp1 == NULL) {
1629 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1630 ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill);
1631 freemsg(mp);
1632 return (mp_ret);
1633 }
1634 freemsg(mp);
1635 mp = mp1;
1636 }
1637
1638 /*
1639 * In case mp has changed, verify the message before any further
1640 * processes.
1641 */
1642 ipha = (ipha_t *)mp->b_rptr;
1643 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1644 if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
1645 freemsg(mp);
1646 return (mp_ret);
1647 }
1648
1649 switch (icmph->icmph_type) {
1650 case ICMP_REDIRECT:
1651 icmp_redirect_v4(mp, ipha, icmph, ira);
1652 break;
1653 case ICMP_DEST_UNREACHABLE:
1654 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) {
1655 /* Update DCE and adjust MTU is icmp header if needed */
1656 icmp_inbound_too_big_v4(icmph, ira);
1657 }
1658 /* FALLTHRU */
1659 default:
1660 icmp_inbound_error_fanout_v4(mp, icmph, ira);
1661 break;
1662 }
1663 return (mp_ret);
1664 }
1665
1666 /*
1667 * Send an ICMP echo, timestamp or address mask reply.
1668 * The caller has already updated the payload part of the packet.
1669 * We handle the ICMP checksum, IP source address selection and feed
1670 * the packet into ip_output_simple.
1671 */
1672 static void
1673 icmp_send_reply_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph,
1674 ip_recv_attr_t *ira)
1675 {
1676 uint_t ip_hdr_length = ira->ira_ip_hdr_length;
1677 ill_t *ill = ira->ira_ill;
1678 ip_stack_t *ipst = ill->ill_ipst;
1679 ip_xmit_attr_t ixas;
1680
1681 /* Send out an ICMP packet */
1682 icmph->icmph_checksum = 0;
1683 icmph->icmph_checksum = IP_CSUM(mp, ip_hdr_length, 0);
1684 /* Reset time to live. */
1685 ipha->ipha_ttl = ipst->ips_ip_def_ttl;
1686 {
1687 /* Swap source and destination addresses */
1688 ipaddr_t tmp;
1689
1690 tmp = ipha->ipha_src;
1691 ipha->ipha_src = ipha->ipha_dst;
1692 ipha->ipha_dst = tmp;
1693 }
1694 ipha->ipha_ident = 0;
1695 if (!IS_SIMPLE_IPH(ipha))
1696 icmp_options_update(ipha);
1697
1698 bzero(&ixas, sizeof (ixas));
1699 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
1700 ixas.ixa_zoneid = ira->ira_zoneid;
1701 ixas.ixa_cred = kcred;
1702 ixas.ixa_cpid = NOPID;
1703 ixas.ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */
1704 ixas.ixa_ifindex = 0;
1705 ixas.ixa_ipst = ipst;
1706 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1707
1708 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
1709 /*
1710 * This packet should go out the same way as it
1711 * came in i.e in clear, independent of the IPsec policy
1712 * for transmitting packets.
1713 */
1714 ixas.ixa_flags |= IXAF_NO_IPSEC;
1715 } else {
1716 if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) {
1717 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1718 /* Note: mp already consumed and ip_drop_packet done */
1719 return;
1720 }
1721 }
1722 if (ira->ira_flags & IRAF_MULTIBROADCAST) {
1723 /*
1724 * Not one or our addresses (IRE_LOCALs), thus we let
1725 * ip_output_simple pick the source.
1726 */
1727 ipha->ipha_src = INADDR_ANY;
1728 ixas.ixa_flags |= IXAF_SET_SOURCE;
1729 }
1730 /* Should we send with DF and use dce_pmtu? */
1731 if (ipst->ips_ipv4_icmp_return_pmtu) {
1732 ixas.ixa_flags |= IXAF_PMTU_DISCOVERY;
1733 ipha->ipha_fragment_offset_and_flags |= IPH_DF_HTONS;
1734 }
1735
1736 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs);
1737
1738 (void) ip_output_simple(mp, &ixas);
1739 ixa_cleanup(&ixas);
1740 }
1741
1742 /*
1743 * Verify the ICMP messages for either for ICMP error or redirect packet.
1744 * The caller should have fully pulled up the message. If it's a redirect
1745 * packet, only basic checks on IP header will be done; otherwise, verify
1746 * the packet by looking at the included ULP header.
1747 *
1748 * Called before icmp_inbound_error_fanout_v4 is called.
1749 */
1750 static boolean_t
1751 icmp_inbound_verify_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira)
1752 {
1753 ill_t *ill = ira->ira_ill;
1754 int hdr_length;
1755 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
1756 conn_t *connp;
1757 ipha_t *ipha; /* Inner IP header */
1758
1759 ipha = (ipha_t *)&icmph[1];
1760 if ((uchar_t *)ipha + IP_SIMPLE_HDR_LENGTH > mp->b_wptr)
1761 goto truncated;
1762
1763 hdr_length = IPH_HDR_LENGTH(ipha);
1764
1765 if ((IPH_HDR_VERSION(ipha) != IPV4_VERSION))
1766 goto discard_pkt;
1767
1768 if (hdr_length < sizeof (ipha_t))
1769 goto truncated;
1770
1771 if ((uchar_t *)ipha + hdr_length > mp->b_wptr)
1772 goto truncated;
1773
1774 /*
1775 * Stop here for ICMP_REDIRECT.
1776 */
1777 if (icmph->icmph_type == ICMP_REDIRECT)
1778 return (B_TRUE);
1779
1780 /*
1781 * ICMP errors only.
1782 */
1783 switch (ipha->ipha_protocol) {
1784 case IPPROTO_UDP:
1785 /*
1786 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1787 * transport header.
1788 */
1789 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1790 mp->b_wptr)
1791 goto truncated;
1792 break;
1793 case IPPROTO_TCP: {
1794 tcpha_t *tcpha;
1795
1796 /*
1797 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1798 * transport header.
1799 */
1800 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1801 mp->b_wptr)
1802 goto truncated;
1803
1804 tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length);
1805 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN,
1806 ipst);
1807 if (connp == NULL)
1808 goto discard_pkt;
1809
1810 if ((connp->conn_verifyicmp != NULL) &&
1811 !connp->conn_verifyicmp(connp, tcpha, icmph, NULL, ira)) {
1812 CONN_DEC_REF(connp);
1813 goto discard_pkt;
1814 }
1815 CONN_DEC_REF(connp);
1816 break;
1817 }
1818 case IPPROTO_SCTP:
1819 /*
1820 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1821 * transport header.
1822 */
1823 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1824 mp->b_wptr)
1825 goto truncated;
1826 break;
1827 case IPPROTO_DCCP: {
1828 dccpha_t *dccpha;
1829
1830 /*
1831 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1832 * transport header.
1833 */
1834 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1835 mp->b_wptr)
1836 goto truncated;
1837
1838 cmn_err(CE_NOTE, "icmp_inbound_verify_v4");
1839
1840 dccpha = (dccpha_t *)((uchar_t *)ipha + hdr_length);
1841 /* XXX:DCCP */
1842 /*
1843 connp = ipcl_dccp_lookup_reversed_ipv4(ipha, dccpha,
1844 DCCPS_LISTEN, ipst);
1845 if (connp == NULL) {
1846 goto discard_pkt;
1847 }
1848
1849 if ((connp->conn_verifyicmp != NULL) &&
1850 !connp->conn_verifyicmp(connp, dccpha, icmph, NULL, ira)) {
1851 CONN_DEC_REF(connp);
1852 goto discard_pkt;
1853 }
1854
1855 CONN_DEC_REF(connp);
1856 */
1857 break;
1858 }
1859 case IPPROTO_ESP:
1860 case IPPROTO_AH:
1861 break;
1862 case IPPROTO_ENCAP:
1863 if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) >
1864 mp->b_wptr)
1865 goto truncated;
1866 break;
1867 default:
1868 break;
1869 }
1870
1871 return (B_TRUE);
1872
1873 discard_pkt:
1874 /* Bogus ICMP error. */
1875 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1876 return (B_FALSE);
1877
1878 truncated:
1879 /* We pulled up everthing already. Must be truncated */
1880 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
1881 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
1882 return (B_FALSE);
1883 }
1884
1885 /* Table from RFC 1191 */
1886 static int icmp_frag_size_table[] =
1887 { 32000, 17914, 8166, 4352, 2002, 1496, 1006, 508, 296, 68 };
1888
1889 /*
1890 * Process received ICMP Packet too big.
1891 * Just handles the DCE create/update, including using the above table of
1892 * PMTU guesses. The caller is responsible for validating the packet before
1893 * passing it in and also to fanout the ICMP error to any matching transport
1894 * conns. Assumes the message has been fully pulled up and verified.
1895 *
1896 * Before getting here, the caller has called icmp_inbound_verify_v4()
1897 * that should have verified with ULP to prevent undoing the changes we're
1898 * going to make to DCE. For example, TCP might have verified that the packet
1899 * which generated error is in the send window.
1900 *
1901 * In some cases modified this MTU in the ICMP header packet; the caller
1902 * should pass to the matching ULP after this returns.
1903 */
1904 static void
1905 icmp_inbound_too_big_v4(icmph_t *icmph, ip_recv_attr_t *ira)
1906 {
1907 dce_t *dce;
1908 int old_mtu;
1909 int mtu, orig_mtu;
1910 ipaddr_t dst;
1911 boolean_t disable_pmtud;
1912 ill_t *ill = ira->ira_ill;
1913 ip_stack_t *ipst = ill->ill_ipst;
1914 uint_t hdr_length;
1915 ipha_t *ipha;
1916
1917 /* Caller already pulled up everything. */
1918 ipha = (ipha_t *)&icmph[1];
1919 ASSERT(icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
1920 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED);
1921 ASSERT(ill != NULL);
1922
1923 hdr_length = IPH_HDR_LENGTH(ipha);
1924
1925 /*
1926 * We handle path MTU for source routed packets since the DCE
1927 * is looked up using the final destination.
1928 */
1929 dst = ip_get_dst(ipha);
1930
1931 dce = dce_lookup_and_add_v4(dst, ipst);
1932 if (dce == NULL) {
1933 /* Couldn't add a unique one - ENOMEM */
1934 ip1dbg(("icmp_inbound_too_big_v4: no dce for 0x%x\n",
1935 ntohl(dst)));
1936 return;
1937 }
1938
1939 /* Check for MTU discovery advice as described in RFC 1191 */
1940 mtu = ntohs(icmph->icmph_du_mtu);
1941 orig_mtu = mtu;
1942 disable_pmtud = B_FALSE;
1943
1944 mutex_enter(&dce->dce_lock);
1945 if (dce->dce_flags & DCEF_PMTU)
1946 old_mtu = dce->dce_pmtu;
1947 else
1948 old_mtu = ill->ill_mtu;
1949
1950 if (icmph->icmph_du_zero != 0 || mtu < ipst->ips_ip_pmtu_min) {
1951 uint32_t length;
1952 int i;
1953
1954 /*
1955 * Use the table from RFC 1191 to figure out
1956 * the next "plateau" based on the length in
1957 * the original IP packet.
1958 */
1959 length = ntohs(ipha->ipha_length);
1960 DTRACE_PROBE2(ip4__pmtu__guess, dce_t *, dce,
1961 uint32_t, length);
1962 if (old_mtu <= length &&
1963 old_mtu >= length - hdr_length) {
1964 /*
1965 * Handle broken BSD 4.2 systems that
1966 * return the wrong ipha_length in ICMP
1967 * errors.
1968 */
1969 ip1dbg(("Wrong mtu: sent %d, dce %d\n",
1970 length, old_mtu));
1971 length -= hdr_length;
1972 }
1973 for (i = 0; i < A_CNT(icmp_frag_size_table); i++) {
1974 if (length > icmp_frag_size_table[i])
1975 break;
1976 }
1977 if (i == A_CNT(icmp_frag_size_table)) {
1978 /* Smaller than IP_MIN_MTU! */
1979 ip1dbg(("Too big for packet size %d\n",
1980 length));
1981 disable_pmtud = B_TRUE;
1982 mtu = ipst->ips_ip_pmtu_min;
1983 } else {
1984 mtu = icmp_frag_size_table[i];
1985 ip1dbg(("Calculated mtu %d, packet size %d, "
1986 "before %d\n", mtu, length, old_mtu));
1987 if (mtu < ipst->ips_ip_pmtu_min) {
1988 mtu = ipst->ips_ip_pmtu_min;
1989 disable_pmtud = B_TRUE;
1990 }
1991 }
1992 }
1993 if (disable_pmtud)
1994 dce->dce_flags |= DCEF_TOO_SMALL_PMTU;
1995 else
1996 dce->dce_flags &= ~DCEF_TOO_SMALL_PMTU;
1997
1998 dce->dce_pmtu = MIN(old_mtu, mtu);
1999 /* Prepare to send the new max frag size for the ULP. */
2000 icmph->icmph_du_zero = 0;
2001 icmph->icmph_du_mtu = htons((uint16_t)dce->dce_pmtu);
2002 DTRACE_PROBE4(ip4__pmtu__change, icmph_t *, icmph, dce_t *,
2003 dce, int, orig_mtu, int, mtu);
2004
2005 /* We now have a PMTU for sure */
2006 dce->dce_flags |= DCEF_PMTU;
2007 dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64());
2008 mutex_exit(&dce->dce_lock);
2009 /*
2010 * After dropping the lock the new value is visible to everyone.
2011 * Then we bump the generation number so any cached values reinspect
2012 * the dce_t.
2013 */
2014 dce_increment_generation(dce);
2015 dce_refrele(dce);
2016 }
2017
2018 /*
2019 * If the packet in error is Self-Encapsulated, icmp_inbound_error_fanout_v4
2020 * calls this function.
2021 */
2022 static mblk_t *
2023 icmp_inbound_self_encap_error_v4(mblk_t *mp, ipha_t *ipha, ipha_t *in_ipha)
2024 {
2025 int length;
2026
2027 ASSERT(mp->b_datap->db_type == M_DATA);
2028
2029 /* icmp_inbound_v4 has already pulled up the whole error packet */
2030 ASSERT(mp->b_cont == NULL);
2031
2032 /*
2033 * The length that we want to overlay is the inner header
2034 * and what follows it.
2035 */
2036 length = msgdsize(mp) - ((uchar_t *)in_ipha - mp->b_rptr);
2037
2038 /*
2039 * Overlay the inner header and whatever follows it over the
2040 * outer header.
2041 */
2042 bcopy((uchar_t *)in_ipha, (uchar_t *)ipha, length);
2043
2044 /* Adjust for what we removed */
2045 mp->b_wptr -= (uchar_t *)in_ipha - (uchar_t *)ipha;
2046 return (mp);
2047 }
2048
2049 /*
2050 * Try to pass the ICMP message upstream in case the ULP cares.
2051 *
2052 * If the packet that caused the ICMP error is secure, we send
2053 * it to AH/ESP to make sure that the attached packet has a
2054 * valid association. ipha in the code below points to the
2055 * IP header of the packet that caused the error.
2056 *
2057 * For IPsec cases, we let the next-layer-up (which has access to
2058 * cached policy on the conn_t, or can query the SPD directly)
2059 * subtract out any IPsec overhead if they must. We therefore make no
2060 * adjustments here for IPsec overhead.
2061 *
2062 * IFN could have been generated locally or by some router.
2063 *
2064 * LOCAL : ire_send_wire (before calling ipsec_out_process) can call
2065 * icmp_frag_needed/icmp_pkt2big_v6 to generated a local IFN.
2066 * This happens because IP adjusted its value of MTU on an
2067 * earlier IFN message and could not tell the upper layer,
2068 * the new adjusted value of MTU e.g. Packet was encrypted
2069 * or there was not enough information to fanout to upper
2070 * layers. Thus on the next outbound datagram, ire_send_wire
2071 * generates the IFN, where IPsec processing has *not* been
2072 * done.
2073 *
2074 * Note that we retain ixa_fragsize across IPsec thus once
2075 * we have picking ixa_fragsize and entered ipsec_out_process we do
2076 * no change the fragsize even if the path MTU changes before
2077 * we reach ip_output_post_ipsec.
2078 *
2079 * In the local case, IRAF_LOOPBACK will be set indicating
2080 * that IFN was generated locally.
2081 *
2082 * ROUTER : IFN could be secure or non-secure.
2083 *
2084 * * SECURE : We use the IPSEC_IN to fanout to AH/ESP if the
2085 * packet in error has AH/ESP headers to validate the AH/ESP
2086 * headers. AH/ESP will verify whether there is a valid SA or
2087 * not and send it back. We will fanout again if we have more
2088 * data in the packet.
2089 *
2090 * If the packet in error does not have AH/ESP, we handle it
2091 * like any other case.
2092 *
2093 * * NON_SECURE : If the packet in error has AH/ESP headers, we send it
2094 * up to AH/ESP for validation. AH/ESP will verify whether there is a
2095 * valid SA or not and send it back. We will fanout again if
2096 * we have more data in the packet.
2097 *
2098 * If the packet in error does not have AH/ESP, we handle it
2099 * like any other case.
2100 *
2101 * The caller must have called icmp_inbound_verify_v4.
2102 */
2103 static void
2104 icmp_inbound_error_fanout_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira)
2105 {
2106 uint16_t *up; /* Pointer to ports in ULP header */
2107 uint32_t ports; /* reversed ports for fanout */
2108 ipha_t ripha; /* With reversed addresses */
2109 ipha_t *ipha; /* Inner IP header */
2110 uint_t hdr_length; /* Inner IP header length */
2111 tcpha_t *tcpha;
2112 conn_t *connp;
2113 ill_t *ill = ira->ira_ill;
2114 ip_stack_t *ipst = ill->ill_ipst;
2115 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
2116 ill_t *rill = ira->ira_rill;
2117
2118 /* Caller already pulled up everything. */
2119 ipha = (ipha_t *)&icmph[1];
2120 ASSERT((uchar_t *)&ipha[1] <= mp->b_wptr);
2121 ASSERT(mp->b_cont == NULL);
2122
2123 hdr_length = IPH_HDR_LENGTH(ipha);
2124 ira->ira_protocol = ipha->ipha_protocol;
2125
2126 /*
2127 * We need a separate IP header with the source and destination
2128 * addresses reversed to do fanout/classification because the ipha in
2129 * the ICMP error is in the form we sent it out.
2130 */
2131 ripha.ipha_src = ipha->ipha_dst;
2132 ripha.ipha_dst = ipha->ipha_src;
2133 ripha.ipha_protocol = ipha->ipha_protocol;
2134 ripha.ipha_version_and_hdr_length = ipha->ipha_version_and_hdr_length;
2135
2136 ip2dbg(("icmp_inbound_error_v4: proto %d %x to %x: %d/%d\n",
2137 ripha.ipha_protocol, ntohl(ipha->ipha_src),
2138 ntohl(ipha->ipha_dst),
2139 icmph->icmph_type, icmph->icmph_code));
2140
2141 switch (ipha->ipha_protocol) {
2142 case IPPROTO_UDP:
2143 up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2144
2145 /* Attempt to find a client stream based on port. */
2146 ip2dbg(("icmp_inbound_error_v4: UDP ports %d to %d\n",
2147 ntohs(up[0]), ntohs(up[1])));
2148
2149 /* Note that we send error to all matches. */
2150 ira->ira_flags |= IRAF_ICMP_ERROR;
2151 ip_fanout_udp_multi_v4(mp, &ripha, up[0], up[1], ira);
2152 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2153 return;
2154
2155 case IPPROTO_TCP:
2156 /*
2157 * Find a TCP client stream for this packet.
2158 * Note that we do a reverse lookup since the header is
2159 * in the form we sent it out.
2160 */
2161 tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length);
2162 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN,
2163 ipst);
2164 if (connp == NULL)
2165 goto discard_pkt;
2166
2167 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2168 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
2169 mp = ipsec_check_inbound_policy(mp, connp,
2170 ipha, NULL, ira);
2171 if (mp == NULL) {
2172 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2173 /* Note that mp is NULL */
2174 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2175 CONN_DEC_REF(connp);
2176 return;
2177 }
2178 }
2179
2180 ira->ira_flags |= IRAF_ICMP_ERROR;
2181 ira->ira_ill = ira->ira_rill = NULL;
2182 if (IPCL_IS_TCP(connp)) {
2183 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2184 connp->conn_recvicmp, connp, ira, SQ_FILL,
2185 SQTAG_TCP_INPUT_ICMP_ERR);
2186 } else {
2187 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2188 (connp->conn_recv)(connp, mp, NULL, ira);
2189 CONN_DEC_REF(connp);
2190 }
2191 ira->ira_ill = ill;
2192 ira->ira_rill = rill;
2193 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2194 return;
2195
2196 case IPPROTO_SCTP:
2197 up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2198 /* Find a SCTP client stream for this packet. */
2199 ((uint16_t *)&ports)[0] = up[1];
2200 ((uint16_t *)&ports)[1] = up[0];
2201
2202 ira->ira_flags |= IRAF_ICMP_ERROR;
2203 ip_fanout_sctp(mp, &ripha, NULL, ports, ira);
2204 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2205 return;
2206
2207 case IPPROTO_DCCP:
2208 cmn_err(CE_NOTE, "icmp_inbound_error_fanout_v4");
2209 return;
2210
2211 case IPPROTO_ESP:
2212 case IPPROTO_AH:
2213 if (!ipsec_loaded(ipss)) {
2214 ip_proto_not_sup(mp, ira);
2215 return;
2216 }
2217
2218 if (ipha->ipha_protocol == IPPROTO_ESP)
2219 mp = ipsecesp_icmp_error(mp, ira);
2220 else
2221 mp = ipsecah_icmp_error(mp, ira);
2222 if (mp == NULL)
2223 return;
2224
2225 /* Just in case ipsec didn't preserve the NULL b_cont */
2226 if (mp->b_cont != NULL) {
2227 if (!pullupmsg(mp, -1))
2228 goto discard_pkt;
2229 }
2230
2231 /*
2232 * Note that ira_pktlen and ira_ip_hdr_length are no longer
2233 * correct, but we don't use them any more here.
2234 *
2235 * If succesful, the mp has been modified to not include
2236 * the ESP/AH header so we can fanout to the ULP's icmp
2237 * error handler.
2238 */
2239 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH)
2240 goto truncated;
2241
2242 /* Verify the modified message before any further processes. */
2243 ipha = (ipha_t *)mp->b_rptr;
2244 hdr_length = IPH_HDR_LENGTH(ipha);
2245 icmph = (icmph_t *)&mp->b_rptr[hdr_length];
2246 if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
2247 freemsg(mp);
2248 return;
2249 }
2250
2251 icmp_inbound_error_fanout_v4(mp, icmph, ira);
2252 return;
2253
2254 case IPPROTO_ENCAP: {
2255 /* Look for self-encapsulated packets that caused an error */
2256 ipha_t *in_ipha;
2257
2258 /*
2259 * Caller has verified that length has to be
2260 * at least the size of IP header.
2261 */
2262 ASSERT(hdr_length >= sizeof (ipha_t));
2263 /*
2264 * Check the sanity of the inner IP header like
2265 * we did for the outer header.
2266 */
2267 in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length);
2268 if ((IPH_HDR_VERSION(in_ipha) != IPV4_VERSION)) {
2269 goto discard_pkt;
2270 }
2271 if (IPH_HDR_LENGTH(in_ipha) < sizeof (ipha_t)) {
2272 goto discard_pkt;
2273 }
2274 /* Check for Self-encapsulated tunnels */
2275 if (in_ipha->ipha_src == ipha->ipha_src &&
2276 in_ipha->ipha_dst == ipha->ipha_dst) {
2277
2278 mp = icmp_inbound_self_encap_error_v4(mp, ipha,
2279 in_ipha);
2280 if (mp == NULL)
2281 goto discard_pkt;
2282
2283 /*
2284 * Just in case self_encap didn't preserve the NULL
2285 * b_cont
2286 */
2287 if (mp->b_cont != NULL) {
2288 if (!pullupmsg(mp, -1))
2289 goto discard_pkt;
2290 }
2291 /*
2292 * Note that ira_pktlen and ira_ip_hdr_length are no
2293 * longer correct, but we don't use them any more here.
2294 */
2295 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH)
2296 goto truncated;
2297
2298 /*
2299 * Verify the modified message before any further
2300 * processes.
2301 */
2302 ipha = (ipha_t *)mp->b_rptr;
2303 hdr_length = IPH_HDR_LENGTH(ipha);
2304 icmph = (icmph_t *)&mp->b_rptr[hdr_length];
2305 if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
2306 freemsg(mp);
2307 return;
2308 }
2309
2310 /*
2311 * The packet in error is self-encapsualted.
2312 * And we are finding it further encapsulated
2313 * which we could not have possibly generated.
2314 */
2315 if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2316 goto discard_pkt;
2317 }
2318 icmp_inbound_error_fanout_v4(mp, icmph, ira);
2319 return;
2320 }
2321 /* No self-encapsulated */
2322 /* FALLTHRU */
2323 }
2324 case IPPROTO_IPV6:
2325 if ((connp = ipcl_iptun_classify_v4(&ripha.ipha_src,
2326 &ripha.ipha_dst, ipst)) != NULL) {
2327 ira->ira_flags |= IRAF_ICMP_ERROR;
2328 connp->conn_recvicmp(connp, mp, NULL, ira);
2329 CONN_DEC_REF(connp);
2330 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2331 return;
2332 }
2333 /*
2334 * No IP tunnel is interested, fallthrough and see
2335 * if a raw socket will want it.
2336 */
2337 /* FALLTHRU */
2338 default:
2339 ira->ira_flags |= IRAF_ICMP_ERROR;
2340 ip_fanout_proto_v4(mp, &ripha, ira);
2341 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2342 return;
2343 }
2344 /* NOTREACHED */
2345 discard_pkt:
2346 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2347 ip1dbg(("icmp_inbound_error_fanout_v4: drop pkt\n"));
2348 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2349 freemsg(mp);
2350 return;
2351
2352 truncated:
2353 /* We pulled up everthing already. Must be truncated */
2354 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2355 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2356 freemsg(mp);
2357 }
2358
2359 /*
2360 * Common IP options parser.
2361 *
2362 * Setup routine: fill in *optp with options-parsing state, then
2363 * tail-call ipoptp_next to return the first option.
2364 */
2365 uint8_t
2366 ipoptp_first(ipoptp_t *optp, ipha_t *ipha)
2367 {
2368 uint32_t totallen; /* total length of all options */
2369
2370 totallen = ipha->ipha_version_and_hdr_length -
2371 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
2372 totallen <<= 2;
2373 optp->ipoptp_next = (uint8_t *)(&ipha[1]);
2374 optp->ipoptp_end = optp->ipoptp_next + totallen;
2375 optp->ipoptp_flags = 0;
2376 return (ipoptp_next(optp));
2377 }
2378
2379 /* Like above but without an ipha_t */
2380 uint8_t
2381 ipoptp_first2(ipoptp_t *optp, uint32_t totallen, uint8_t *opt)
2382 {
2383 optp->ipoptp_next = opt;
2384 optp->ipoptp_end = optp->ipoptp_next + totallen;
2385 optp->ipoptp_flags = 0;
2386 return (ipoptp_next(optp));
2387 }
2388
2389 /*
2390 * Common IP options parser: extract next option.
2391 */
2392 uint8_t
2393 ipoptp_next(ipoptp_t *optp)
2394 {
2395 uint8_t *end = optp->ipoptp_end;
2396 uint8_t *cur = optp->ipoptp_next;
2397 uint8_t opt, len, pointer;
2398
2399 /*
2400 * If cur > end already, then the ipoptp_end or ipoptp_next pointer
2401 * has been corrupted.
2402 */
2403 ASSERT(cur <= end);
2404
2405 if (cur == end)
2406 return (IPOPT_EOL);
2407
2408 opt = cur[IPOPT_OPTVAL];
2409
2410 /*
2411 * Skip any NOP options.
2412 */
2413 while (opt == IPOPT_NOP) {
2414 cur++;
2415 if (cur == end)
2416 return (IPOPT_EOL);
2417 opt = cur[IPOPT_OPTVAL];
2418 }
2419
2420 if (opt == IPOPT_EOL)
2421 return (IPOPT_EOL);
2422
2423 /*
2424 * Option requiring a length.
2425 */
2426 if ((cur + 1) >= end) {
2427 optp->ipoptp_flags |= IPOPTP_ERROR;
2428 return (IPOPT_EOL);
2429 }
2430 len = cur[IPOPT_OLEN];
2431 if (len < 2) {
2432 optp->ipoptp_flags |= IPOPTP_ERROR;
2433 return (IPOPT_EOL);
2434 }
2435 optp->ipoptp_cur = cur;
2436 optp->ipoptp_len = len;
2437 optp->ipoptp_next = cur + len;
2438 if (cur + len > end) {
2439 optp->ipoptp_flags |= IPOPTP_ERROR;
2440 return (IPOPT_EOL);
2441 }
2442
2443 /*
2444 * For the options which require a pointer field, make sure
2445 * its there, and make sure it points to either something
2446 * inside this option, or the end of the option.
2447 */
2448 switch (opt) {
2449 case IPOPT_RR:
2450 case IPOPT_TS:
2451 case IPOPT_LSRR:
2452 case IPOPT_SSRR:
2453 if (len <= IPOPT_OFFSET) {
2454 optp->ipoptp_flags |= IPOPTP_ERROR;
2455 return (opt);
2456 }
2457 pointer = cur[IPOPT_OFFSET];
2458 if (pointer - 1 > len) {
2459 optp->ipoptp_flags |= IPOPTP_ERROR;
2460 return (opt);
2461 }
2462 break;
2463 }
2464
2465 /*
2466 * Sanity check the pointer field based on the type of the
2467 * option.
2468 */
2469 switch (opt) {
2470 case IPOPT_RR:
2471 case IPOPT_SSRR:
2472 case IPOPT_LSRR:
2473 if (pointer < IPOPT_MINOFF_SR)
2474 optp->ipoptp_flags |= IPOPTP_ERROR;
2475 break;
2476 case IPOPT_TS:
2477 if (pointer < IPOPT_MINOFF_IT)
2478 optp->ipoptp_flags |= IPOPTP_ERROR;
2479 /*
2480 * Note that the Internet Timestamp option also
2481 * contains two four bit fields (the Overflow field,
2482 * and the Flag field), which follow the pointer
2483 * field. We don't need to check that these fields
2484 * fall within the length of the option because this
2485 * was implicitely done above. We've checked that the
2486 * pointer value is at least IPOPT_MINOFF_IT, and that
2487 * it falls within the option. Since IPOPT_MINOFF_IT >
2488 * IPOPT_POS_OV_FLG, we don't need the explicit check.
2489 */
2490 ASSERT(len > IPOPT_POS_OV_FLG);
2491 break;
2492 }
2493
2494 return (opt);
2495 }
2496
2497 /*
2498 * Use the outgoing IP header to create an IP_OPTIONS option the way
2499 * it was passed down from the application.
2500 *
2501 * This is compatible with BSD in that it returns
2502 * the reverse source route with the final destination
2503 * as the last entry. The first 4 bytes of the option
2504 * will contain the final destination.
2505 */
2506 int
2507 ip_opt_get_user(conn_t *connp, uchar_t *buf)
2508 {
2509 ipoptp_t opts;
2510 uchar_t *opt;
2511 uint8_t optval;
2512 uint8_t optlen;
2513 uint32_t len = 0;
2514 uchar_t *buf1 = buf;
2515 uint32_t totallen;
2516 ipaddr_t dst;
2517 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
2518
2519 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
2520 return (0);
2521
2522 totallen = ipp->ipp_ipv4_options_len;
2523 if (totallen & 0x3)
2524 return (0);
2525
2526 buf += IP_ADDR_LEN; /* Leave room for final destination */
2527 len += IP_ADDR_LEN;
2528 bzero(buf1, IP_ADDR_LEN);
2529
2530 dst = connp->conn_faddr_v4;
2531
2532 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
2533 optval != IPOPT_EOL;
2534 optval = ipoptp_next(&opts)) {
2535 int off;
2536
2537 opt = opts.ipoptp_cur;
2538 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
2539 break;
2540 }
2541 optlen = opts.ipoptp_len;
2542
2543 switch (optval) {
2544 case IPOPT_SSRR:
2545 case IPOPT_LSRR:
2546
2547 /*
2548 * Insert destination as the first entry in the source
2549 * route and move down the entries on step.
2550 * The last entry gets placed at buf1.
2551 */
2552 buf[IPOPT_OPTVAL] = optval;
2553 buf[IPOPT_OLEN] = optlen;
2554 buf[IPOPT_OFFSET] = optlen;
2555
2556 off = optlen - IP_ADDR_LEN;
2557 if (off < 0) {
2558 /* No entries in source route */
2559 break;
2560 }
2561 /* Last entry in source route if not already set */
2562 if (dst == INADDR_ANY)
2563 bcopy(opt + off, buf1, IP_ADDR_LEN);
2564 off -= IP_ADDR_LEN;
2565
2566 while (off > 0) {
2567 bcopy(opt + off,
2568 buf + off + IP_ADDR_LEN,
2569 IP_ADDR_LEN);
2570 off -= IP_ADDR_LEN;
2571 }
2572 /* ipha_dst into first slot */
2573 bcopy(&dst, buf + off + IP_ADDR_LEN,
2574 IP_ADDR_LEN);
2575 buf += optlen;
2576 len += optlen;
2577 break;
2578
2579 default:
2580 bcopy(opt, buf, optlen);
2581 buf += optlen;
2582 len += optlen;
2583 break;
2584 }
2585 }
2586 done:
2587 /* Pad the resulting options */
2588 while (len & 0x3) {
2589 *buf++ = IPOPT_EOL;
2590 len++;
2591 }
2592 return (len);
2593 }
2594
2595 /*
2596 * Update any record route or timestamp options to include this host.
2597 * Reverse any source route option.
2598 * This routine assumes that the options are well formed i.e. that they
2599 * have already been checked.
2600 */
2601 static void
2602 icmp_options_update(ipha_t *ipha)
2603 {
2604 ipoptp_t opts;
2605 uchar_t *opt;
2606 uint8_t optval;
2607 ipaddr_t src; /* Our local address */
2608 ipaddr_t dst;
2609
2610 ip2dbg(("icmp_options_update\n"));
2611 src = ipha->ipha_src;
2612 dst = ipha->ipha_dst;
2613
2614 for (optval = ipoptp_first(&opts, ipha);
2615 optval != IPOPT_EOL;
2616 optval = ipoptp_next(&opts)) {
2617 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
2618 opt = opts.ipoptp_cur;
2619 ip2dbg(("icmp_options_update: opt %d, len %d\n",
2620 optval, opts.ipoptp_len));
2621 switch (optval) {
2622 int off1, off2;
2623 case IPOPT_SSRR:
2624 case IPOPT_LSRR:
2625 /*
2626 * Reverse the source route. The first entry
2627 * should be the next to last one in the current
2628 * source route (the last entry is our address).
2629 * The last entry should be the final destination.
2630 */
2631 off1 = IPOPT_MINOFF_SR - 1;
2632 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
2633 if (off2 < 0) {
2634 /* No entries in source route */
2635 ip1dbg((
2636 "icmp_options_update: bad src route\n"));
2637 break;
2638 }
2639 bcopy((char *)opt + off2, &dst, IP_ADDR_LEN);
2640 bcopy(&ipha->ipha_dst, (char *)opt + off2, IP_ADDR_LEN);
2641 bcopy(&dst, &ipha->ipha_dst, IP_ADDR_LEN);
2642 off2 -= IP_ADDR_LEN;
2643
2644 while (off1 < off2) {
2645 bcopy((char *)opt + off1, &src, IP_ADDR_LEN);
2646 bcopy((char *)opt + off2, (char *)opt + off1,
2647 IP_ADDR_LEN);
2648 bcopy(&src, (char *)opt + off2, IP_ADDR_LEN);
2649 off1 += IP_ADDR_LEN;
2650 off2 -= IP_ADDR_LEN;
2651 }
2652 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
2653 break;
2654 }
2655 }
2656 }
2657
2658 /*
2659 * Process received ICMP Redirect messages.
2660 * Assumes the caller has verified that the headers are in the pulled up mblk.
2661 * Consumes mp.
2662 */
2663 static void
2664 icmp_redirect_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph, ip_recv_attr_t *ira)
2665 {
2666 ire_t *ire, *nire;
2667 ire_t *prev_ire;
2668 ipaddr_t src, dst, gateway;
2669 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2670 ipha_t *inner_ipha; /* Inner IP header */
2671
2672 /* Caller already pulled up everything. */
2673 inner_ipha = (ipha_t *)&icmph[1];
2674 src = ipha->ipha_src;
2675 dst = inner_ipha->ipha_dst;
2676 gateway = icmph->icmph_rd_gateway;
2677 /* Make sure the new gateway is reachable somehow. */
2678 ire = ire_ftable_lookup_v4(gateway, 0, 0, IRE_ONLINK, NULL,
2679 ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
2680 /*
2681 * Make sure we had a route for the dest in question and that
2682 * that route was pointing to the old gateway (the source of the
2683 * redirect packet.)
2684 * We do longest match and then compare ire_gateway_addr below.
2685 */
2686 prev_ire = ire_ftable_lookup_v4(dst, 0, 0, 0, NULL, ALL_ZONES,
2687 NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
2688 /*
2689 * Check that
2690 * the redirect was not from ourselves
2691 * the new gateway and the old gateway are directly reachable
2692 */
2693 if (prev_ire == NULL || ire == NULL ||
2694 (prev_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) ||
2695 (prev_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2696 !(ire->ire_type & IRE_IF_ALL) ||
2697 prev_ire->ire_gateway_addr != src) {
2698 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects);
2699 ip_drop_input("icmpInBadRedirects - ire", mp, ira->ira_ill);
2700 freemsg(mp);
2701 if (ire != NULL)
2702 ire_refrele(ire);
2703 if (prev_ire != NULL)
2704 ire_refrele(prev_ire);
2705 return;
2706 }
2707
2708 ire_refrele(prev_ire);
2709 ire_refrele(ire);
2710
2711 /*
2712 * TODO: more precise handling for cases 0, 2, 3, the latter two
2713 * require TOS routing
2714 */
2715 switch (icmph->icmph_code) {
2716 case 0:
2717 case 1:
2718 /* TODO: TOS specificity for cases 2 and 3 */
2719 case 2:
2720 case 3:
2721 break;
2722 default:
2723 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects);
2724 ip_drop_input("icmpInBadRedirects - code", mp, ira->ira_ill);
2725 freemsg(mp);
2726 return;
2727 }
2728 /*
2729 * Create a Route Association. This will allow us to remember that
2730 * someone we believe told us to use the particular gateway.
2731 */
2732 ire = ire_create(
2733 (uchar_t *)&dst, /* dest addr */
2734 (uchar_t *)&ip_g_all_ones, /* mask */
2735 (uchar_t *)&gateway, /* gateway addr */
2736 IRE_HOST,
2737 NULL, /* ill */
2738 ALL_ZONES,
2739 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
2740 NULL, /* tsol_gc_t */
2741 ipst);
2742
2743 if (ire == NULL) {
2744 freemsg(mp);
2745 return;
2746 }
2747 nire = ire_add(ire);
2748 /* Check if it was a duplicate entry */
2749 if (nire != NULL && nire != ire) {
2750 ASSERT(nire->ire_identical_ref > 1);
2751 ire_delete(nire);
2752 ire_refrele(nire);
2753 nire = NULL;
2754 }
2755 ire = nire;
2756 if (ire != NULL) {
2757 ire_refrele(ire); /* Held in ire_add */
2758
2759 /* tell routing sockets that we received a redirect */
2760 ip_rts_change(RTM_REDIRECT, dst, gateway, IP_HOST_MASK, 0, src,
2761 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
2762 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR), ipst);
2763 }
2764
2765 /*
2766 * Delete any existing IRE_HOST type redirect ires for this destination.
2767 * This together with the added IRE has the effect of
2768 * modifying an existing redirect.
2769 */
2770 prev_ire = ire_ftable_lookup_v4(dst, 0, src, IRE_HOST, NULL,
2771 ALL_ZONES, NULL, (MATCH_IRE_GW | MATCH_IRE_TYPE), 0, ipst, NULL);
2772 if (prev_ire != NULL) {
2773 if (prev_ire ->ire_flags & RTF_DYNAMIC)
2774 ire_delete(prev_ire);
2775 ire_refrele(prev_ire);
2776 }
2777
2778 freemsg(mp);
2779 }
2780
2781 /*
2782 * Generate an ICMP parameter problem message.
2783 * When called from ip_output side a minimal ip_recv_attr_t needs to be
2784 * constructed by the caller.
2785 */
2786 static void
2787 icmp_param_problem(mblk_t *mp, uint8_t ptr, ip_recv_attr_t *ira)
2788 {
2789 icmph_t icmph;
2790 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2791
2792 mp = icmp_pkt_err_ok(mp, ira);
2793 if (mp == NULL)
2794 return;
2795
2796 bzero(&icmph, sizeof (icmph_t));
2797 icmph.icmph_type = ICMP_PARAM_PROBLEM;
2798 icmph.icmph_pp_ptr = ptr;
2799 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutParmProbs);
2800 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
2801 }
2802
2803 /*
2804 * Build and ship an IPv4 ICMP message using the packet data in mp, and
2805 * the ICMP header pointed to by "stuff". (May be called as writer.)
2806 * Note: assumes that icmp_pkt_err_ok has been called to verify that
2807 * an icmp error packet can be sent.
2808 * Assigns an appropriate source address to the packet. If ipha_dst is
2809 * one of our addresses use it for source. Otherwise let ip_output_simple
2810 * pick the source address.
2811 */
2812 static void
2813 icmp_pkt(mblk_t *mp, void *stuff, size_t len, ip_recv_attr_t *ira)
2814 {
2815 ipaddr_t dst;
2816 icmph_t *icmph;
2817 ipha_t *ipha;
2818 uint_t len_needed;
2819 size_t msg_len;
2820 mblk_t *mp1;
2821 ipaddr_t src;
2822 ire_t *ire;
2823 ip_xmit_attr_t ixas;
2824 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2825
2826 ipha = (ipha_t *)mp->b_rptr;
2827
2828 bzero(&ixas, sizeof (ixas));
2829 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
2830 ixas.ixa_zoneid = ira->ira_zoneid;
2831 ixas.ixa_ifindex = 0;
2832 ixas.ixa_ipst = ipst;
2833 ixas.ixa_cred = kcred;
2834 ixas.ixa_cpid = NOPID;
2835 ixas.ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */
2836 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
2837
2838 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2839 /*
2840 * Apply IPsec based on how IPsec was applied to
2841 * the packet that had the error.
2842 *
2843 * If it was an outbound packet that caused the ICMP
2844 * error, then the caller will have setup the IRA
2845 * appropriately.
2846 */
2847 if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) {
2848 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
2849 /* Note: mp already consumed and ip_drop_packet done */
2850 return;
2851 }
2852 } else {
2853 /*
2854 * This is in clear. The icmp message we are building
2855 * here should go out in clear, independent of our policy.
2856 */
2857 ixas.ixa_flags |= IXAF_NO_IPSEC;
2858 }
2859
2860 /* Remember our eventual destination */
2861 dst = ipha->ipha_src;
2862
2863 /*
2864 * If the packet was for one of our unicast addresses, make
2865 * sure we respond with that as the source. Otherwise
2866 * have ip_output_simple pick the source address.
2867 */
2868 ire = ire_ftable_lookup_v4(ipha->ipha_dst, 0, 0,
2869 (IRE_LOCAL|IRE_LOOPBACK), NULL, ira->ira_zoneid, NULL,
2870 MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY, 0, ipst, NULL);
2871 if (ire != NULL) {
2872 ire_refrele(ire);
2873 src = ipha->ipha_dst;
2874 } else {
2875 src = INADDR_ANY;
2876 ixas.ixa_flags |= IXAF_SET_SOURCE;
2877 }
2878
2879 /*
2880 * Check if we can send back more then 8 bytes in addition to
2881 * the IP header. We try to send 64 bytes of data and the internal
2882 * header in the special cases of ipv4 encapsulated ipv4 or ipv6.
2883 */
2884 len_needed = IPH_HDR_LENGTH(ipha);
2885 if (ipha->ipha_protocol == IPPROTO_ENCAP ||
2886 ipha->ipha_protocol == IPPROTO_IPV6) {
2887 if (!pullupmsg(mp, -1)) {
2888 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
2889 ip_drop_output("ipIfStatsOutDiscards", mp, NULL);
2890 freemsg(mp);
2891 return;
2892 }
2893 ipha = (ipha_t *)mp->b_rptr;
2894
2895 if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2896 len_needed += IPH_HDR_LENGTH(((uchar_t *)ipha +
2897 len_needed));
2898 } else {
2899 ip6_t *ip6h = (ip6_t *)((uchar_t *)ipha + len_needed);
2900
2901 ASSERT(ipha->ipha_protocol == IPPROTO_IPV6);
2902 len_needed += ip_hdr_length_v6(mp, ip6h);
2903 }
2904 }
2905 len_needed += ipst->ips_ip_icmp_return;
2906 msg_len = msgdsize(mp);
2907 if (msg_len > len_needed) {
2908 (void) adjmsg(mp, len_needed - msg_len);
2909 msg_len = len_needed;
2910 }
2911 mp1 = allocb(sizeof (icmp_ipha) + len, BPRI_MED);
2912 if (mp1 == NULL) {
2913 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutErrors);
2914 freemsg(mp);
2915 return;
2916 }
2917 mp1->b_cont = mp;
2918 mp = mp1;
2919
2920 /*
2921 * Set IXAF_TRUSTED_ICMP so we can let the ICMP messages this
2922 * node generates be accepted in peace by all on-host destinations.
2923 * If we do NOT assume that all on-host destinations trust
2924 * self-generated ICMP messages, then rework here, ip6.c, and spd.c.
2925 * (Look for IXAF_TRUSTED_ICMP).
2926 */
2927 ixas.ixa_flags |= IXAF_TRUSTED_ICMP;
2928
2929 ipha = (ipha_t *)mp->b_rptr;
2930 mp1->b_wptr = (uchar_t *)ipha + (sizeof (icmp_ipha) + len);
2931 *ipha = icmp_ipha;
2932 ipha->ipha_src = src;
2933 ipha->ipha_dst = dst;
2934 ipha->ipha_ttl = ipst->ips_ip_def_ttl;
2935 msg_len += sizeof (icmp_ipha) + len;
2936 if (msg_len > IP_MAXPACKET) {
2937 (void) adjmsg(mp, IP_MAXPACKET - msg_len);
2938 msg_len = IP_MAXPACKET;
2939 }
2940 ipha->ipha_length = htons((uint16_t)msg_len);
2941 icmph = (icmph_t *)&ipha[1];
2942 bcopy(stuff, icmph, len);
2943 icmph->icmph_checksum = 0;
2944 icmph->icmph_checksum = IP_CSUM(mp, (int32_t)sizeof (ipha_t), 0);
2945 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs);
2946
2947 (void) ip_output_simple(mp, &ixas);
2948 ixa_cleanup(&ixas);
2949 }
2950
2951 /*
2952 * Determine if an ICMP error packet can be sent given the rate limit.
2953 * The limit consists of an average frequency (icmp_pkt_err_interval measured
2954 * in milliseconds) and a burst size. Burst size number of packets can
2955 * be sent arbitrarely closely spaced.
2956 * The state is tracked using two variables to implement an approximate
2957 * token bucket filter:
2958 * icmp_pkt_err_last - lbolt value when the last burst started
2959 * icmp_pkt_err_sent - number of packets sent in current burst
2960 */
2961 boolean_t
2962 icmp_err_rate_limit(ip_stack_t *ipst)
2963 {
2964 clock_t now = TICK_TO_MSEC(ddi_get_lbolt());
2965 uint_t refilled; /* Number of packets refilled in tbf since last */
2966 /* Guard against changes by loading into local variable */
2967 uint_t err_interval = ipst->ips_ip_icmp_err_interval;
2968
2969 if (err_interval == 0)
2970 return (B_FALSE);
2971
2972 if (ipst->ips_icmp_pkt_err_last > now) {
2973 /* 100HZ lbolt in ms for 32bit arch wraps every 49.7 days */
2974 ipst->ips_icmp_pkt_err_last = 0;
2975 ipst->ips_icmp_pkt_err_sent = 0;
2976 }
2977 /*
2978 * If we are in a burst update the token bucket filter.
2979 * Update the "last" time to be close to "now" but make sure
2980 * we don't loose precision.
2981 */
2982 if (ipst->ips_icmp_pkt_err_sent != 0) {
2983 refilled = (now - ipst->ips_icmp_pkt_err_last)/err_interval;
2984 if (refilled > ipst->ips_icmp_pkt_err_sent) {
2985 ipst->ips_icmp_pkt_err_sent = 0;
2986 } else {
2987 ipst->ips_icmp_pkt_err_sent -= refilled;
2988 ipst->ips_icmp_pkt_err_last += refilled * err_interval;
2989 }
2990 }
2991 if (ipst->ips_icmp_pkt_err_sent == 0) {
2992 /* Start of new burst */
2993 ipst->ips_icmp_pkt_err_last = now;
2994 }
2995 if (ipst->ips_icmp_pkt_err_sent < ipst->ips_ip_icmp_err_burst) {
2996 ipst->ips_icmp_pkt_err_sent++;
2997 ip1dbg(("icmp_err_rate_limit: %d sent in burst\n",
2998 ipst->ips_icmp_pkt_err_sent));
2999 return (B_FALSE);
3000 }
3001 ip1dbg(("icmp_err_rate_limit: dropped\n"));
3002 return (B_TRUE);
3003 }
3004
3005 /*
3006 * Check if it is ok to send an IPv4 ICMP error packet in
3007 * response to the IPv4 packet in mp.
3008 * Free the message and return null if no
3009 * ICMP error packet should be sent.
3010 */
3011 static mblk_t *
3012 icmp_pkt_err_ok(mblk_t *mp, ip_recv_attr_t *ira)
3013 {
3014 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3015 icmph_t *icmph;
3016 ipha_t *ipha;
3017 uint_t len_needed;
3018
3019 if (!mp)
3020 return (NULL);
3021 ipha = (ipha_t *)mp->b_rptr;
3022 if (ip_csum_hdr(ipha)) {
3023 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInCksumErrs);
3024 ip_drop_input("ipIfStatsInCksumErrs", mp, NULL);
3025 freemsg(mp);
3026 return (NULL);
3027 }
3028 if (ip_type_v4(ipha->ipha_dst, ipst) == IRE_BROADCAST ||
3029 ip_type_v4(ipha->ipha_src, ipst) == IRE_BROADCAST ||
3030 CLASSD(ipha->ipha_dst) ||
3031 CLASSD(ipha->ipha_src) ||
3032 (ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET)) {
3033 /* Note: only errors to the fragment with offset 0 */
3034 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3035 freemsg(mp);
3036 return (NULL);
3037 }
3038 if (ipha->ipha_protocol == IPPROTO_ICMP) {
3039 /*
3040 * Check the ICMP type. RFC 1122 sez: don't send ICMP
3041 * errors in response to any ICMP errors.
3042 */
3043 len_needed = IPH_HDR_LENGTH(ipha) + ICMPH_SIZE;
3044 if (mp->b_wptr - mp->b_rptr < len_needed) {
3045 if (!pullupmsg(mp, len_needed)) {
3046 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
3047 freemsg(mp);
3048 return (NULL);
3049 }
3050 ipha = (ipha_t *)mp->b_rptr;
3051 }
3052 icmph = (icmph_t *)
3053 (&((char *)ipha)[IPH_HDR_LENGTH(ipha)]);
3054 switch (icmph->icmph_type) {
3055 case ICMP_DEST_UNREACHABLE:
3056 case ICMP_SOURCE_QUENCH:
3057 case ICMP_TIME_EXCEEDED:
3058 case ICMP_PARAM_PROBLEM:
3059 case ICMP_REDIRECT:
3060 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3061 freemsg(mp);
3062 return (NULL);
3063 default:
3064 break;
3065 }
3066 }
3067 /*
3068 * If this is a labeled system, then check to see if we're allowed to
3069 * send a response to this particular sender. If not, then just drop.
3070 */
3071 if (is_system_labeled() && !tsol_can_reply_error(mp, ira)) {
3072 ip2dbg(("icmp_pkt_err_ok: can't respond to packet\n"));
3073 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3074 freemsg(mp);
3075 return (NULL);
3076 }
3077 if (icmp_err_rate_limit(ipst)) {
3078 /*
3079 * Only send ICMP error packets every so often.
3080 * This should be done on a per port/source basis,
3081 * but for now this will suffice.
3082 */
3083 freemsg(mp);
3084 return (NULL);
3085 }
3086 return (mp);
3087 }
3088
3089 /*
3090 * Called when a packet was sent out the same link that it arrived on.
3091 * Check if it is ok to send a redirect and then send it.
3092 */
3093 void
3094 ip_send_potential_redirect_v4(mblk_t *mp, ipha_t *ipha, ire_t *ire,
3095 ip_recv_attr_t *ira)
3096 {
3097 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3098 ipaddr_t src, nhop;
3099 mblk_t *mp1;
3100 ire_t *nhop_ire;
3101
3102 /*
3103 * Check the source address to see if it originated
3104 * on the same logical subnet it is going back out on.
3105 * If so, we should be able to send it a redirect.
3106 * Avoid sending a redirect if the destination
3107 * is directly connected (i.e., we matched an IRE_ONLINK),
3108 * or if the packet was source routed out this interface.
3109 *
3110 * We avoid sending a redirect if the
3111 * destination is directly connected
3112 * because it is possible that multiple
3113 * IP subnets may have been configured on
3114 * the link, and the source may not
3115 * be on the same subnet as ip destination,
3116 * even though they are on the same
3117 * physical link.
3118 */
3119 if ((ire->ire_type & IRE_ONLINK) ||
3120 ip_source_routed(ipha, ipst))
3121 return;
3122
3123 nhop_ire = ire_nexthop(ire);
3124 if (nhop_ire == NULL)
3125 return;
3126
3127 nhop = nhop_ire->ire_addr;
3128
3129 if (nhop_ire->ire_type & IRE_IF_CLONE) {
3130 ire_t *ire2;
3131
3132 /* Follow ire_dep_parent to find non-clone IRE_INTERFACE */
3133 mutex_enter(&nhop_ire->ire_lock);
3134 ire2 = nhop_ire->ire_dep_parent;
3135 if (ire2 != NULL)
3136 ire_refhold(ire2);
3137 mutex_exit(&nhop_ire->ire_lock);
3138 ire_refrele(nhop_ire);
3139 nhop_ire = ire2;
3140 }
3141 if (nhop_ire == NULL)
3142 return;
3143
3144 ASSERT(!(nhop_ire->ire_type & IRE_IF_CLONE));
3145
3146 src = ipha->ipha_src;
3147
3148 /*
3149 * We look at the interface ire for the nexthop,
3150 * to see if ipha_src is in the same subnet
3151 * as the nexthop.
3152 */
3153 if ((src & nhop_ire->ire_mask) == (nhop & nhop_ire->ire_mask)) {
3154 /*
3155 * The source is directly connected.
3156 */
3157 mp1 = copymsg(mp);
3158 if (mp1 != NULL) {
3159 icmp_send_redirect(mp1, nhop, ira);
3160 }
3161 }
3162 ire_refrele(nhop_ire);
3163 }
3164
3165 /*
3166 * Generate an ICMP redirect message.
3167 */
3168 static void
3169 icmp_send_redirect(mblk_t *mp, ipaddr_t gateway, ip_recv_attr_t *ira)
3170 {
3171 icmph_t icmph;
3172 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3173
3174 mp = icmp_pkt_err_ok(mp, ira);
3175 if (mp == NULL)
3176 return;
3177
3178 bzero(&icmph, sizeof (icmph_t));
3179 icmph.icmph_type = ICMP_REDIRECT;
3180 icmph.icmph_code = 1;
3181 icmph.icmph_rd_gateway = gateway;
3182 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutRedirects);
3183 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3184 }
3185
3186 /*
3187 * Generate an ICMP time exceeded message.
3188 */
3189 void
3190 icmp_time_exceeded(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira)
3191 {
3192 icmph_t icmph;
3193 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3194
3195 mp = icmp_pkt_err_ok(mp, ira);
3196 if (mp == NULL)
3197 return;
3198
3199 bzero(&icmph, sizeof (icmph_t));
3200 icmph.icmph_type = ICMP_TIME_EXCEEDED;
3201 icmph.icmph_code = code;
3202 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimeExcds);
3203 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3204 }
3205
3206 /*
3207 * Generate an ICMP unreachable message.
3208 * When called from ip_output side a minimal ip_recv_attr_t needs to be
3209 * constructed by the caller.
3210 */
3211 void
3212 icmp_unreachable(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira)
3213 {
3214 icmph_t icmph;
3215 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3216
3217 mp = icmp_pkt_err_ok(mp, ira);
3218 if (mp == NULL)
3219 return;
3220
3221 bzero(&icmph, sizeof (icmph_t));
3222 icmph.icmph_type = ICMP_DEST_UNREACHABLE;
3223 icmph.icmph_code = code;
3224 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs);
3225 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3226 }
3227
3228 /*
3229 * Latch in the IPsec state for a stream based the policy in the listener
3230 * and the actions in the ip_recv_attr_t.
3231 * Called directly from TCP and SCTP.
3232 */
3233 boolean_t
3234 ip_ipsec_policy_inherit(conn_t *connp, conn_t *lconnp, ip_recv_attr_t *ira)
3235 {
3236 ASSERT(lconnp->conn_policy != NULL);
3237 ASSERT(connp->conn_policy == NULL);
3238
3239 IPPH_REFHOLD(lconnp->conn_policy);
3240 connp->conn_policy = lconnp->conn_policy;
3241
3242 if (ira->ira_ipsec_action != NULL) {
3243 if (connp->conn_latch == NULL) {
3244 connp->conn_latch = iplatch_create();
3245 if (connp->conn_latch == NULL)
3246 return (B_FALSE);
3247 }
3248 ipsec_latch_inbound(connp, ira);
3249 }
3250 return (B_TRUE);
3251 }
3252
3253 /*
3254 * Verify whether or not the IP address is a valid local address.
3255 * Could be a unicast, including one for a down interface.
3256 * If allow_mcbc then a multicast or broadcast address is also
3257 * acceptable.
3258 *
3259 * In the case of a broadcast/multicast address, however, the
3260 * upper protocol is expected to reset the src address
3261 * to zero when we return IPVL_MCAST/IPVL_BCAST so that
3262 * no packets are emitted with broadcast/multicast address as
3263 * source address (that violates hosts requirements RFC 1122)
3264 * The addresses valid for bind are:
3265 * (1) - INADDR_ANY (0)
3266 * (2) - IP address of an UP interface
3267 * (3) - IP address of a DOWN interface
3268 * (4) - valid local IP broadcast addresses. In this case
3269 * the conn will only receive packets destined to
3270 * the specified broadcast address.
3271 * (5) - a multicast address. In this case
3272 * the conn will only receive packets destined to
3273 * the specified multicast address. Note: the
3274 * application still has to issue an
3275 * IP_ADD_MEMBERSHIP socket option.
3276 *
3277 * In all the above cases, the bound address must be valid in the current zone.
3278 * When the address is loopback, multicast or broadcast, there might be many
3279 * matching IREs so bind has to look up based on the zone.
3280 */
3281 ip_laddr_t
3282 ip_laddr_verify_v4(ipaddr_t src_addr, zoneid_t zoneid,
3283 ip_stack_t *ipst, boolean_t allow_mcbc)
3284 {
3285 ire_t *src_ire;
3286
3287 ASSERT(src_addr != INADDR_ANY);
3288
3289 src_ire = ire_ftable_lookup_v4(src_addr, 0, 0, 0,
3290 NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, 0, ipst, NULL);
3291
3292 /*
3293 * If an address other than in6addr_any is requested,
3294 * we verify that it is a valid address for bind
3295 * Note: Following code is in if-else-if form for
3296 * readability compared to a condition check.
3297 */
3298 if (src_ire != NULL && (src_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK))) {
3299 /*
3300 * (2) Bind to address of local UP interface
3301 */
3302 ire_refrele(src_ire);
3303 return (IPVL_UNICAST_UP);
3304 } else if (src_ire != NULL && src_ire->ire_type & IRE_BROADCAST) {
3305 /*
3306 * (4) Bind to broadcast address
3307 */
3308 ire_refrele(src_ire);
3309 if (allow_mcbc)
3310 return (IPVL_BCAST);
3311 else
3312 return (IPVL_BAD);
3313 } else if (CLASSD(src_addr)) {
3314 /* (5) bind to multicast address. */
3315 if (src_ire != NULL)
3316 ire_refrele(src_ire);
3317
3318 if (allow_mcbc)
3319 return (IPVL_MCAST);
3320 else
3321 return (IPVL_BAD);
3322 } else {
3323 ipif_t *ipif;
3324
3325 /*
3326 * (3) Bind to address of local DOWN interface?
3327 * (ipif_lookup_addr() looks up all interfaces
3328 * but we do not get here for UP interfaces
3329 * - case (2) above)
3330 */
3331 if (src_ire != NULL)
3332 ire_refrele(src_ire);
3333
3334 ipif = ipif_lookup_addr(src_addr, NULL, zoneid, ipst);
3335 if (ipif == NULL)
3336 return (IPVL_BAD);
3337
3338 /* Not a useful source? */
3339 if (ipif->ipif_flags & (IPIF_NOLOCAL | IPIF_ANYCAST)) {
3340 ipif_refrele(ipif);
3341 return (IPVL_BAD);
3342 }
3343 ipif_refrele(ipif);
3344 return (IPVL_UNICAST_DOWN);
3345 }
3346 }
3347
3348 /*
3349 * Insert in the bind fanout for IPv4 and IPv6.
3350 * The caller should already have used ip_laddr_verify_v*() before calling
3351 * this.
3352 */
3353 int
3354 ip_laddr_fanout_insert(conn_t *connp)
3355 {
3356 int error;
3357
3358 /*
3359 * Allow setting new policies. For example, disconnects result
3360 * in us being called. As we would have set conn_policy_cached
3361 * to B_TRUE before, we should set it to B_FALSE, so that policy
3362 * can change after the disconnect.
3363 */
3364 connp->conn_policy_cached = B_FALSE;
3365
3366 error = ipcl_bind_insert(connp);
3367 if (error != 0) {
3368 if (connp->conn_anon_port) {
3369 (void) tsol_mlp_anon(crgetzone(connp->conn_cred),
3370 connp->conn_mlp_type, connp->conn_proto,
3371 ntohs(connp->conn_lport), B_FALSE);
3372 }
3373 connp->conn_mlp_type = mlptSingle;
3374 }
3375 return (error);
3376 }
3377
3378 /*
3379 * Verify that both the source and destination addresses are valid. If
3380 * IPDF_VERIFY_DST is not set, then the destination address may be unreachable,
3381 * i.e. have no route to it. Protocols like TCP want to verify destination
3382 * reachability, while tunnels do not.
3383 *
3384 * Determine the route, the interface, and (optionally) the source address
3385 * to use to reach a given destination.
3386 * Note that we allow connect to broadcast and multicast addresses when
3387 * IPDF_ALLOW_MCBC is set.
3388 * first_hop and dst_addr are normally the same, but if source routing
3389 * they will differ; in that case the first_hop is what we'll use for the
3390 * routing lookup but the dce and label checks will be done on dst_addr,
3391 *
3392 * If uinfo is set, then we fill in the best available information
3393 * we have for the destination. This is based on (in priority order) any
3394 * metrics and path MTU stored in a dce_t, route metrics, and finally the
3395 * ill_mtu/ill_mc_mtu.
3396 *
3397 * Tsol note: If we have a source route then dst_addr != firsthop. But we
3398 * always do the label check on dst_addr.
3399 */
3400 int
3401 ip_set_destination_v4(ipaddr_t *src_addrp, ipaddr_t dst_addr, ipaddr_t firsthop,
3402 ip_xmit_attr_t *ixa, iulp_t *uinfo, uint32_t flags, uint_t mac_mode)
3403 {
3404 ire_t *ire = NULL;
3405 int error = 0;
3406 ipaddr_t setsrc; /* RTF_SETSRC */
3407 zoneid_t zoneid = ixa->ixa_zoneid; /* Honors SO_ALLZONES */
3408 ip_stack_t *ipst = ixa->ixa_ipst;
3409 dce_t *dce;
3410 uint_t pmtu;
3411 uint_t generation;
3412 nce_t *nce;
3413 ill_t *ill = NULL;
3414 boolean_t multirt = B_FALSE;
3415
3416 ASSERT(ixa->ixa_flags & IXAF_IS_IPV4);
3417
3418 /*
3419 * We never send to zero; the ULPs map it to the loopback address.
3420 * We can't allow it since we use zero to mean unitialized in some
3421 * places.
3422 */
3423 ASSERT(dst_addr != INADDR_ANY);
3424
3425 if (is_system_labeled()) {
3426 ts_label_t *tsl = NULL;
3427
3428 error = tsol_check_dest(ixa->ixa_tsl, &dst_addr, IPV4_VERSION,
3429 mac_mode, (flags & IPDF_ZONE_IS_GLOBAL) != 0, &tsl);
3430 if (error != 0)
3431 return (error);
3432 if (tsl != NULL) {
3433 /* Update the label */
3434 ip_xmit_attr_replace_tsl(ixa, tsl);
3435 }
3436 }
3437
3438 setsrc = INADDR_ANY;
3439 /*
3440 * Select a route; For IPMP interfaces, we would only select
3441 * a "hidden" route (i.e., going through a specific under_ill)
3442 * if ixa_ifindex has been specified.
3443 */
3444 ire = ip_select_route_v4(firsthop, *src_addrp, ixa,
3445 &generation, &setsrc, &error, &multirt);
3446 ASSERT(ire != NULL); /* IRE_NOROUTE if none found */
3447 if (error != 0)
3448 goto bad_addr;
3449
3450 /*
3451 * ire can't be a broadcast or multicast unless IPDF_ALLOW_MCBC is set.
3452 * If IPDF_VERIFY_DST is set, the destination must be reachable;
3453 * Otherwise the destination needn't be reachable.
3454 *
3455 * If we match on a reject or black hole, then we've got a
3456 * local failure. May as well fail out the connect() attempt,
3457 * since it's never going to succeed.
3458 */
3459 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
3460 /*
3461 * If we're verifying destination reachability, we always want
3462 * to complain here.
3463 *
3464 * If we're not verifying destination reachability but the
3465 * destination has a route, we still want to fail on the
3466 * temporary address and broadcast address tests.
3467 *
3468 * In both cases do we let the code continue so some reasonable
3469 * information is returned to the caller. That enables the
3470 * caller to use (and even cache) the IRE. conn_ip_ouput will
3471 * use the generation mismatch path to check for the unreachable
3472 * case thereby avoiding any specific check in the main path.
3473 */
3474 ASSERT(generation == IRE_GENERATION_VERIFY);
3475 if (flags & IPDF_VERIFY_DST) {
3476 /*
3477 * Set errno but continue to set up ixa_ire to be
3478 * the RTF_REJECT|RTF_BLACKHOLE IRE.
3479 * That allows callers to use ip_output to get an
3480 * ICMP error back.
3481 */
3482 if (!(ire->ire_type & IRE_HOST))
3483 error = ENETUNREACH;
3484 else
3485 error = EHOSTUNREACH;
3486 }
3487 }
3488
3489 if ((ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST)) &&
3490 !(flags & IPDF_ALLOW_MCBC)) {
3491 ire_refrele(ire);
3492 ire = ire_reject(ipst, B_FALSE);
3493 generation = IRE_GENERATION_VERIFY;
3494 error = ENETUNREACH;
3495 }
3496
3497 /* Cache things */
3498 if (ixa->ixa_ire != NULL)
3499 ire_refrele_notr(ixa->ixa_ire);
3500 #ifdef DEBUG
3501 ire_refhold_notr(ire);
3502 ire_refrele(ire);
3503 #endif
3504 ixa->ixa_ire = ire;
3505 ixa->ixa_ire_generation = generation;
3506
3507 /*
3508 * Ensure that ixa_dce is always set any time that ixa_ire is set,
3509 * since some callers will send a packet to conn_ip_output() even if
3510 * there's an error.
3511 */
3512 if (flags & IPDF_UNIQUE_DCE) {
3513 /* Fallback to the default dce if allocation fails */
3514 dce = dce_lookup_and_add_v4(dst_addr, ipst);
3515 if (dce != NULL)
3516 generation = dce->dce_generation;
3517 else
3518 dce = dce_lookup_v4(dst_addr, ipst, &generation);
3519 } else {
3520 dce = dce_lookup_v4(dst_addr, ipst, &generation);
3521 }
3522 ASSERT(dce != NULL);
3523 if (ixa->ixa_dce != NULL)
3524 dce_refrele_notr(ixa->ixa_dce);
3525 #ifdef DEBUG
3526 dce_refhold_notr(dce);
3527 dce_refrele(dce);
3528 #endif
3529 ixa->ixa_dce = dce;
3530 ixa->ixa_dce_generation = generation;
3531
3532 /*
3533 * For multicast with multirt we have a flag passed back from
3534 * ire_lookup_multi_ill_v4 since we don't have an IRE for each
3535 * possible multicast address.
3536 * We also need a flag for multicast since we can't check
3537 * whether RTF_MULTIRT is set in ixa_ire for multicast.
3538 */
3539 if (multirt) {
3540 ixa->ixa_postfragfn = ip_postfrag_multirt_v4;
3541 ixa->ixa_flags |= IXAF_MULTIRT_MULTICAST;
3542 } else {
3543 ixa->ixa_postfragfn = ire->ire_postfragfn;
3544 ixa->ixa_flags &= ~IXAF_MULTIRT_MULTICAST;
3545 }
3546 if (!(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) {
3547 /* Get an nce to cache. */
3548 nce = ire_to_nce(ire, firsthop, NULL);
3549 if (nce == NULL) {
3550 /* Allocation failure? */
3551 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
3552 } else {
3553 if (ixa->ixa_nce != NULL)
3554 nce_refrele(ixa->ixa_nce);
3555 ixa->ixa_nce = nce;
3556 }
3557 }
3558
3559 /*
3560 * If the source address is a loopback address, the
3561 * destination had best be local or multicast.
3562 * If we are sending to an IRE_LOCAL using a loopback source then
3563 * it had better be the same zoneid.
3564 */
3565 if (*src_addrp == htonl(INADDR_LOOPBACK)) {
3566 if ((ire->ire_type & IRE_LOCAL) && ire->ire_zoneid != zoneid) {
3567 ire = NULL; /* Stored in ixa_ire */
3568 error = EADDRNOTAVAIL;
3569 goto bad_addr;
3570 }
3571 if (!(ire->ire_type & (IRE_LOOPBACK|IRE_LOCAL|IRE_MULTICAST))) {
3572 ire = NULL; /* Stored in ixa_ire */
3573 error = EADDRNOTAVAIL;
3574 goto bad_addr;
3575 }
3576 }
3577 if (ire->ire_type & IRE_BROADCAST) {
3578 /*
3579 * If the ULP didn't have a specified source, then we
3580 * make sure we reselect the source when sending
3581 * broadcasts out different interfaces.
3582 */
3583 if (flags & IPDF_SELECT_SRC)
3584 ixa->ixa_flags |= IXAF_SET_SOURCE;
3585 else
3586 ixa->ixa_flags &= ~IXAF_SET_SOURCE;
3587 }
3588
3589 /*
3590 * Does the caller want us to pick a source address?
3591 */
3592 if (flags & IPDF_SELECT_SRC) {
3593 ipaddr_t src_addr;
3594
3595 /*
3596 * We use use ire_nexthop_ill to avoid the under ipmp
3597 * interface for source address selection. Note that for ipmp
3598 * probe packets, ixa_ifindex would have been specified, and
3599 * the ip_select_route() invocation would have picked an ire
3600 * will ire_ill pointing at an under interface.
3601 */
3602 ill = ire_nexthop_ill(ire);
3603
3604 /* If unreachable we have no ill but need some source */
3605 if (ill == NULL) {
3606 src_addr = htonl(INADDR_LOOPBACK);
3607 /* Make sure we look for a better source address */
3608 generation = SRC_GENERATION_VERIFY;
3609 } else {
3610 error = ip_select_source_v4(ill, setsrc, dst_addr,
3611 ixa->ixa_multicast_ifaddr, zoneid,
3612 ipst, &src_addr, &generation, NULL);
3613 if (error != 0) {
3614 ire = NULL; /* Stored in ixa_ire */
3615 goto bad_addr;
3616 }
3617 }
3618
3619 /*
3620 * We allow the source address to to down.
3621 * However, we check that we don't use the loopback address
3622 * as a source when sending out on the wire.
3623 */
3624 if ((src_addr == htonl(INADDR_LOOPBACK)) &&
3625 !(ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK|IRE_MULTICAST)) &&
3626 !(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) {
3627 ire = NULL; /* Stored in ixa_ire */
3628 error = EADDRNOTAVAIL;
3629 goto bad_addr;
3630 }
3631
3632 *src_addrp = src_addr;
3633 ixa->ixa_src_generation = generation;
3634 }
3635
3636 /*
3637 * Make sure we don't leave an unreachable ixa_nce in place
3638 * since ip_select_route is used when we unplumb i.e., remove
3639 * references on ixa_ire, ixa_nce, and ixa_dce.
3640 */
3641 nce = ixa->ixa_nce;
3642 if (nce != NULL && nce->nce_is_condemned) {
3643 nce_refrele(nce);
3644 ixa->ixa_nce = NULL;
3645 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
3646 }
3647
3648 /*
3649 * The caller has set IXAF_PMTU_DISCOVERY if path MTU is desired.
3650 * However, we can't do it for IPv4 multicast or broadcast.
3651 */
3652 if (ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST))
3653 ixa->ixa_flags &= ~IXAF_PMTU_DISCOVERY;
3654
3655 /*
3656 * Set initial value for fragmentation limit. Either conn_ip_output
3657 * or ULP might updates it when there are routing changes.
3658 * Handles a NULL ixa_ire->ire_ill or a NULL ixa_nce for RTF_REJECT.
3659 */
3660 pmtu = ip_get_pmtu(ixa);
3661 ixa->ixa_fragsize = pmtu;
3662 /* Make sure ixa_fragsize and ixa_pmtu remain identical */
3663 if (ixa->ixa_flags & IXAF_VERIFY_PMTU)
3664 ixa->ixa_pmtu = pmtu;
3665
3666 /*
3667 * Extract information useful for some transports.
3668 * First we look for DCE metrics. Then we take what we have in
3669 * the metrics in the route, where the offlink is used if we have
3670 * one.
3671 */
3672 if (uinfo != NULL) {
3673 bzero(uinfo, sizeof (*uinfo));
3674
3675 if (dce->dce_flags & DCEF_UINFO)
3676 *uinfo = dce->dce_uinfo;
3677
3678 rts_merge_metrics(uinfo, &ire->ire_metrics);
3679
3680 /* Allow ire_metrics to decrease the path MTU from above */
3681 if (uinfo->iulp_mtu == 0 || uinfo->iulp_mtu > pmtu)
3682 uinfo->iulp_mtu = pmtu;
3683
3684 uinfo->iulp_localnet = (ire->ire_type & IRE_ONLINK) != 0;
3685 uinfo->iulp_loopback = (ire->ire_type & IRE_LOOPBACK) != 0;
3686 uinfo->iulp_local = (ire->ire_type & IRE_LOCAL) != 0;
3687 }
3688
3689 if (ill != NULL)
3690 ill_refrele(ill);
3691
3692 return (error);
3693
3694 bad_addr:
3695 if (ire != NULL)
3696 ire_refrele(ire);
3697
3698 if (ill != NULL)
3699 ill_refrele(ill);
3700
3701 /*
3702 * Make sure we don't leave an unreachable ixa_nce in place
3703 * since ip_select_route is used when we unplumb i.e., remove
3704 * references on ixa_ire, ixa_nce, and ixa_dce.
3705 */
3706 nce = ixa->ixa_nce;
3707 if (nce != NULL && nce->nce_is_condemned) {
3708 nce_refrele(nce);
3709 ixa->ixa_nce = NULL;
3710 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
3711 }
3712
3713 return (error);
3714 }
3715
3716
3717 /*
3718 * Get the base MTU for the case when path MTU discovery is not used.
3719 * Takes the MTU of the IRE into account.
3720 */
3721 uint_t
3722 ip_get_base_mtu(ill_t *ill, ire_t *ire)
3723 {
3724 uint_t mtu;
3725 uint_t iremtu = ire->ire_metrics.iulp_mtu;
3726
3727 if (ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST))
3728 mtu = ill->ill_mc_mtu;
3729 else
3730 mtu = ill->ill_mtu;
3731
3732 if (iremtu != 0 && iremtu < mtu)
3733 mtu = iremtu;
3734
3735 return (mtu);
3736 }
3737
3738 /*
3739 * Get the PMTU for the attributes. Handles both IPv4 and IPv6.
3740 * Assumes that ixa_ire, dce, and nce have already been set up.
3741 *
3742 * The caller has set IXAF_PMTU_DISCOVERY if path MTU discovery is desired.
3743 * We avoid path MTU discovery if it is disabled with ndd.
3744 * Furtermore, if the path MTU is too small, then we don't set DF for IPv4.
3745 *
3746 * NOTE: We also used to turn it off for source routed packets. That
3747 * is no longer required since the dce is per final destination.
3748 */
3749 uint_t
3750 ip_get_pmtu(ip_xmit_attr_t *ixa)
3751 {
3752 ip_stack_t *ipst = ixa->ixa_ipst;
3753 dce_t *dce;
3754 nce_t *nce;
3755 ire_t *ire;
3756 uint_t pmtu;
3757
3758 ire = ixa->ixa_ire;
3759 dce = ixa->ixa_dce;
3760 nce = ixa->ixa_nce;
3761
3762 /*
3763 * If path MTU discovery has been turned off by ndd, then we ignore
3764 * any dce_pmtu and for IPv4 we will not set DF.
3765 */
3766 if (!ipst->ips_ip_path_mtu_discovery)
3767 ixa->ixa_flags &= ~IXAF_PMTU_DISCOVERY;
3768
3769 pmtu = IP_MAXPACKET;
3770 /*
3771 * Decide whether whether IPv4 sets DF
3772 * For IPv6 "no DF" means to use the 1280 mtu
3773 */
3774 if (ixa->ixa_flags & IXAF_PMTU_DISCOVERY) {
3775 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF;
3776 } else {
3777 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF;
3778 if (!(ixa->ixa_flags & IXAF_IS_IPV4))
3779 pmtu = IPV6_MIN_MTU;
3780 }
3781
3782 /* Check if the PMTU is to old before we use it */
3783 if ((dce->dce_flags & DCEF_PMTU) &&
3784 TICK_TO_SEC(ddi_get_lbolt64()) - dce->dce_last_change_time >
3785 ipst->ips_ip_pathmtu_interval) {
3786 /*
3787 * Older than 20 minutes. Drop the path MTU information.
3788 */
3789 mutex_enter(&dce->dce_lock);
3790 dce->dce_flags &= ~(DCEF_PMTU|DCEF_TOO_SMALL_PMTU);
3791 dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64());
3792 mutex_exit(&dce->dce_lock);
3793 dce_increment_generation(dce);
3794 }
3795
3796 /* The metrics on the route can lower the path MTU */
3797 if (ire->ire_metrics.iulp_mtu != 0 &&
3798 ire->ire_metrics.iulp_mtu < pmtu)
3799 pmtu = ire->ire_metrics.iulp_mtu;
3800
3801 /*
3802 * If the path MTU is smaller than some minimum, we still use dce_pmtu
3803 * above (would be 576 for IPv4 and 1280 for IPv6), but we clear
3804 * IXAF_PMTU_IPV4_DF so that we avoid setting DF for IPv4.
3805 */
3806 if (ixa->ixa_flags & IXAF_PMTU_DISCOVERY) {
3807 if (dce->dce_flags & DCEF_PMTU) {
3808 if (dce->dce_pmtu < pmtu)
3809 pmtu = dce->dce_pmtu;
3810
3811 if (dce->dce_flags & DCEF_TOO_SMALL_PMTU) {
3812 ixa->ixa_flags |= IXAF_PMTU_TOO_SMALL;
3813 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF;
3814 } else {
3815 ixa->ixa_flags &= ~IXAF_PMTU_TOO_SMALL;
3816 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF;
3817 }
3818 } else {
3819 ixa->ixa_flags &= ~IXAF_PMTU_TOO_SMALL;
3820 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF;
3821 }
3822 }
3823
3824 /*
3825 * If we have an IRE_LOCAL we use the loopback mtu instead of
3826 * the ill for going out the wire i.e., IRE_LOCAL gets the same
3827 * mtu as IRE_LOOPBACK.
3828 */
3829 if (ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
3830 uint_t loopback_mtu;
3831
3832 loopback_mtu = (ire->ire_ipversion == IPV6_VERSION) ?
3833 ip_loopback_mtu_v6plus : ip_loopback_mtuplus;
3834
3835 if (loopback_mtu < pmtu)
3836 pmtu = loopback_mtu;
3837 } else if (nce != NULL) {
3838 /*
3839 * Make sure we don't exceed the interface MTU.
3840 * In the case of RTF_REJECT or RTF_BLACKHOLE we might not have
3841 * an ill. We'd use the above IP_MAXPACKET in that case just
3842 * to tell the transport something larger than zero.
3843 */
3844 if (ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST)) {
3845 if (nce->nce_common->ncec_ill->ill_mc_mtu < pmtu)
3846 pmtu = nce->nce_common->ncec_ill->ill_mc_mtu;
3847 if (nce->nce_common->ncec_ill != nce->nce_ill &&
3848 nce->nce_ill->ill_mc_mtu < pmtu) {
3849 /*
3850 * for interfaces in an IPMP group, the mtu of
3851 * the nce_ill (under_ill) could be different
3852 * from the mtu of the ncec_ill, so we take the
3853 * min of the two.
3854 */
3855 pmtu = nce->nce_ill->ill_mc_mtu;
3856 }
3857 } else {
3858 if (nce->nce_common->ncec_ill->ill_mtu < pmtu)
3859 pmtu = nce->nce_common->ncec_ill->ill_mtu;
3860 if (nce->nce_common->ncec_ill != nce->nce_ill &&
3861 nce->nce_ill->ill_mtu < pmtu) {
3862 /*
3863 * for interfaces in an IPMP group, the mtu of
3864 * the nce_ill (under_ill) could be different
3865 * from the mtu of the ncec_ill, so we take the
3866 * min of the two.
3867 */
3868 pmtu = nce->nce_ill->ill_mtu;
3869 }
3870 }
3871 }
3872
3873 /*
3874 * Handle the IPV6_USE_MIN_MTU socket option or ancillary data.
3875 * Only applies to IPv6.
3876 */
3877 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) {
3878 if (ixa->ixa_flags & IXAF_USE_MIN_MTU) {
3879 switch (ixa->ixa_use_min_mtu) {
3880 case IPV6_USE_MIN_MTU_MULTICAST:
3881 if (ire->ire_type & IRE_MULTICAST)
3882 pmtu = IPV6_MIN_MTU;
3883 break;
3884 case IPV6_USE_MIN_MTU_ALWAYS:
3885 pmtu = IPV6_MIN_MTU;
3886 break;
3887 case IPV6_USE_MIN_MTU_NEVER:
3888 break;
3889 }
3890 } else {
3891 /* Default is IPV6_USE_MIN_MTU_MULTICAST */
3892 if (ire->ire_type & IRE_MULTICAST)
3893 pmtu = IPV6_MIN_MTU;
3894 }
3895 }
3896
3897 /*
3898 * After receiving an ICMPv6 "packet too big" message with a
3899 * MTU < 1280, and for multirouted IPv6 packets, the IP layer
3900 * will insert a 8-byte fragment header in every packet. We compensate
3901 * for those cases by returning a smaller path MTU to the ULP.
3902 *
3903 * In the case of CGTP then ip_output will add a fragment header.
3904 * Make sure there is room for it by telling a smaller number
3905 * to the transport.
3906 *
3907 * When IXAF_IPV6_ADDR_FRAGHDR we subtract the frag hdr here
3908 * so the ULPs consistently see a iulp_pmtu and ip_get_pmtu()
3909 * which is the size of the packets it can send.
3910 */
3911 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) {
3912 if ((dce->dce_flags & DCEF_TOO_SMALL_PMTU) ||
3913 (ire->ire_flags & RTF_MULTIRT) ||
3914 (ixa->ixa_flags & IXAF_MULTIRT_MULTICAST)) {
3915 pmtu -= sizeof (ip6_frag_t);
3916 ixa->ixa_flags |= IXAF_IPV6_ADD_FRAGHDR;
3917 }
3918 }
3919
3920 return (pmtu);
3921 }
3922
3923 /*
3924 * Carve "len" bytes out of an mblk chain, consuming any we empty, and duping
3925 * the final piece where we don't. Return a pointer to the first mblk in the
3926 * result, and update the pointer to the next mblk to chew on. If anything
3927 * goes wrong (i.e., dupb fails), we waste everything in sight and return a
3928 * NULL pointer.
3929 */
3930 mblk_t *
3931 ip_carve_mp(mblk_t **mpp, ssize_t len)
3932 {
3933 mblk_t *mp0;
3934 mblk_t *mp1;
3935 mblk_t *mp2;
3936
3937 if (!len || !mpp || !(mp0 = *mpp))
3938 return (NULL);
3939 /* If we aren't going to consume the first mblk, we need a dup. */
3940 if (mp0->b_wptr - mp0->b_rptr > len) {
3941 mp1 = dupb(mp0);
3942 if (mp1) {
3943 /* Partition the data between the two mblks. */
3944 mp1->b_wptr = mp1->b_rptr + len;
3945 mp0->b_rptr = mp1->b_wptr;
3946 /*
3947 * after adjustments if mblk not consumed is now
3948 * unaligned, try to align it. If this fails free
3949 * all messages and let upper layer recover.
3950 */
3951 if (!OK_32PTR(mp0->b_rptr)) {
3952 if (!pullupmsg(mp0, -1)) {
3953 freemsg(mp0);
3954 freemsg(mp1);
3955 *mpp = NULL;
3956 return (NULL);
3957 }
3958 }
3959 }
3960 return (mp1);
3961 }
3962 /* Eat through as many mblks as we need to get len bytes. */
3963 len -= mp0->b_wptr - mp0->b_rptr;
3964 for (mp2 = mp1 = mp0; (mp2 = mp2->b_cont) != 0 && len; mp1 = mp2) {
3965 if (mp2->b_wptr - mp2->b_rptr > len) {
3966 /*
3967 * We won't consume the entire last mblk. Like
3968 * above, dup and partition it.
3969 */
3970 mp1->b_cont = dupb(mp2);
3971 mp1 = mp1->b_cont;
3972 if (!mp1) {
3973 /*
3974 * Trouble. Rather than go to a lot of
3975 * trouble to clean up, we free the messages.
3976 * This won't be any worse than losing it on
3977 * the wire.
3978 */
3979 freemsg(mp0);
3980 freemsg(mp2);
3981 *mpp = NULL;
3982 return (NULL);
3983 }
3984 mp1->b_wptr = mp1->b_rptr + len;
3985 mp2->b_rptr = mp1->b_wptr;
3986 /*
3987 * after adjustments if mblk not consumed is now
3988 * unaligned, try to align it. If this fails free
3989 * all messages and let upper layer recover.
3990 */
3991 if (!OK_32PTR(mp2->b_rptr)) {
3992 if (!pullupmsg(mp2, -1)) {
3993 freemsg(mp0);
3994 freemsg(mp2);
3995 *mpp = NULL;
3996 return (NULL);
3997 }
3998 }
3999 *mpp = mp2;
4000 return (mp0);
4001 }
4002 /* Decrement len by the amount we just got. */
4003 len -= mp2->b_wptr - mp2->b_rptr;
4004 }
4005 /*
4006 * len should be reduced to zero now. If not our caller has
4007 * screwed up.
4008 */
4009 if (len) {
4010 /* Shouldn't happen! */
4011 freemsg(mp0);
4012 *mpp = NULL;
4013 return (NULL);
4014 }
4015 /*
4016 * We consumed up to exactly the end of an mblk. Detach the part
4017 * we are returning from the rest of the chain.
4018 */
4019 mp1->b_cont = NULL;
4020 *mpp = mp2;
4021 return (mp0);
4022 }
4023
4024 /* The ill stream is being unplumbed. Called from ip_close */
4025 int
4026 ip_modclose(ill_t *ill)
4027 {
4028 boolean_t success;
4029 ipsq_t *ipsq;
4030 ipif_t *ipif;
4031 queue_t *q = ill->ill_rq;
4032 ip_stack_t *ipst = ill->ill_ipst;
4033 int i;
4034 arl_ill_common_t *ai = ill->ill_common;
4035
4036 /*
4037 * The punlink prior to this may have initiated a capability
4038 * negotiation. But ipsq_enter will block until that finishes or
4039 * times out.
4040 */
4041 success = ipsq_enter(ill, B_FALSE, NEW_OP);
4042
4043 /*
4044 * Open/close/push/pop is guaranteed to be single threaded
4045 * per stream by STREAMS. FS guarantees that all references
4046 * from top are gone before close is called. So there can't
4047 * be another close thread that has set CONDEMNED on this ill.
4048 * and cause ipsq_enter to return failure.
4049 */
4050 ASSERT(success);
4051 ipsq = ill->ill_phyint->phyint_ipsq;
4052
4053 /*
4054 * Mark it condemned. No new reference will be made to this ill.
4055 * Lookup functions will return an error. Threads that try to
4056 * increment the refcnt must check for ILL_CAN_LOOKUP. This ensures
4057 * that the refcnt will drop down to zero.
4058 */
4059 mutex_enter(&ill->ill_lock);
4060 ill->ill_state_flags |= ILL_CONDEMNED;
4061 for (ipif = ill->ill_ipif; ipif != NULL;
4062 ipif = ipif->ipif_next) {
4063 ipif->ipif_state_flags |= IPIF_CONDEMNED;
4064 }
4065 /*
4066 * Wake up anybody waiting to enter the ipsq. ipsq_enter
4067 * returns error if ILL_CONDEMNED is set
4068 */
4069 cv_broadcast(&ill->ill_cv);
4070 mutex_exit(&ill->ill_lock);
4071
4072 /*
4073 * Send all the deferred DLPI messages downstream which came in
4074 * during the small window right before ipsq_enter(). We do this
4075 * without waiting for the ACKs because all the ACKs for M_PROTO
4076 * messages are ignored in ip_rput() when ILL_CONDEMNED is set.
4077 */
4078 ill_dlpi_send_deferred(ill);
4079
4080 /*
4081 * Shut down fragmentation reassembly.
4082 * ill_frag_timer won't start a timer again.
4083 * Now cancel any existing timer
4084 */
4085 (void) untimeout(ill->ill_frag_timer_id);
4086 (void) ill_frag_timeout(ill, 0);
4087
4088 /*
4089 * Call ill_delete to bring down the ipifs, ilms and ill on
4090 * this ill. Then wait for the refcnts to drop to zero.
4091 * ill_is_freeable checks whether the ill is really quiescent.
4092 * Then make sure that threads that are waiting to enter the
4093 * ipsq have seen the error returned by ipsq_enter and have
4094 * gone away. Then we call ill_delete_tail which does the
4095 * DL_UNBIND_REQ with the driver and then qprocsoff.
4096 */
4097 ill_delete(ill);
4098 mutex_enter(&ill->ill_lock);
4099 while (!ill_is_freeable(ill))
4100 cv_wait(&ill->ill_cv, &ill->ill_lock);
4101
4102 while (ill->ill_waiters)
4103 cv_wait(&ill->ill_cv, &ill->ill_lock);
4104
4105 mutex_exit(&ill->ill_lock);
4106
4107 /*
4108 * ill_delete_tail drops reference on ill_ipst, but we need to keep
4109 * it held until the end of the function since the cleanup
4110 * below needs to be able to use the ip_stack_t.
4111 */
4112 netstack_hold(ipst->ips_netstack);
4113
4114 /* qprocsoff is done via ill_delete_tail */
4115 ill_delete_tail(ill);
4116 /*
4117 * synchronously wait for arp stream to unbind. After this, we
4118 * cannot get any data packets up from the driver.
4119 */
4120 arp_unbind_complete(ill);
4121 ASSERT(ill->ill_ipst == NULL);
4122
4123 /*
4124 * Walk through all conns and qenable those that have queued data.
4125 * Close synchronization needs this to
4126 * be done to ensure that all upper layers blocked
4127 * due to flow control to the closing device
4128 * get unblocked.
4129 */
4130 ip1dbg(("ip_wsrv: walking\n"));
4131 for (i = 0; i < TX_FANOUT_SIZE; i++) {
4132 conn_walk_drain(ipst, &ipst->ips_idl_tx_list[i]);
4133 }
4134
4135 /*
4136 * ai can be null if this is an IPv6 ill, or if the IPv4
4137 * stream is being torn down before ARP was plumbed (e.g.,
4138 * /sbin/ifconfig plumbing a stream twice, and encountering
4139 * an error
4140 */
4141 if (ai != NULL) {
4142 ASSERT(!ill->ill_isv6);
4143 mutex_enter(&ai->ai_lock);
4144 ai->ai_ill = NULL;
4145 if (ai->ai_arl == NULL) {
4146 mutex_destroy(&ai->ai_lock);
4147 kmem_free(ai, sizeof (*ai));
4148 } else {
4149 cv_signal(&ai->ai_ill_unplumb_done);
4150 mutex_exit(&ai->ai_lock);
4151 }
4152 }
4153
4154 mutex_enter(&ipst->ips_ip_mi_lock);
4155 mi_close_unlink(&ipst->ips_ip_g_head, (IDP)ill);
4156 mutex_exit(&ipst->ips_ip_mi_lock);
4157
4158 /*
4159 * credp could be null if the open didn't succeed and ip_modopen
4160 * itself calls ip_close.
4161 */
4162 if (ill->ill_credp != NULL)
4163 crfree(ill->ill_credp);
4164
4165 mutex_destroy(&ill->ill_saved_ire_lock);
4166 mutex_destroy(&ill->ill_lock);
4167 rw_destroy(&ill->ill_mcast_lock);
4168 mutex_destroy(&ill->ill_mcast_serializer);
4169 list_destroy(&ill->ill_nce);
4170
4171 /*
4172 * Now we are done with the module close pieces that
4173 * need the netstack_t.
4174 */
4175 netstack_rele(ipst->ips_netstack);
4176
4177 mi_close_free((IDP)ill);
4178 q->q_ptr = WR(q)->q_ptr = NULL;
4179
4180 ipsq_exit(ipsq);
4181
4182 return (0);
4183 }
4184
4185 /*
4186 * This is called as part of close() for IP, UDP, ICMP, and RTS
4187 * in order to quiesce the conn.
4188 */
4189 void
4190 ip_quiesce_conn(conn_t *connp)
4191 {
4192 boolean_t drain_cleanup_reqd = B_FALSE;
4193 boolean_t conn_ioctl_cleanup_reqd = B_FALSE;
4194 boolean_t ilg_cleanup_reqd = B_FALSE;
4195 ip_stack_t *ipst;
4196
4197 ASSERT(!IPCL_IS_TCP(connp));
4198 ipst = connp->conn_netstack->netstack_ip;
4199
4200 /*
4201 * Mark the conn as closing, and this conn must not be
4202 * inserted in future into any list. Eg. conn_drain_insert(),
4203 * won't insert this conn into the conn_drain_list.
4204 *
4205 * conn_idl, and conn_ilg cannot get set henceforth.
4206 */
4207 mutex_enter(&connp->conn_lock);
4208 ASSERT(!(connp->conn_state_flags & CONN_QUIESCED));
4209 connp->conn_state_flags |= CONN_CLOSING;
4210 if (connp->conn_idl != NULL)
4211 drain_cleanup_reqd = B_TRUE;
4212 if (connp->conn_oper_pending_ill != NULL)
4213 conn_ioctl_cleanup_reqd = B_TRUE;
4214 if (connp->conn_dhcpinit_ill != NULL) {
4215 ASSERT(connp->conn_dhcpinit_ill->ill_dhcpinit != 0);
4216 atomic_dec_32(&connp->conn_dhcpinit_ill->ill_dhcpinit);
4217 ill_set_inputfn(connp->conn_dhcpinit_ill);
4218 connp->conn_dhcpinit_ill = NULL;
4219 }
4220 if (connp->conn_ilg != NULL)
4221 ilg_cleanup_reqd = B_TRUE;
4222 mutex_exit(&connp->conn_lock);
4223
4224 if (conn_ioctl_cleanup_reqd)
4225 conn_ioctl_cleanup(connp);
4226
4227 if (is_system_labeled() && connp->conn_anon_port) {
4228 (void) tsol_mlp_anon(crgetzone(connp->conn_cred),
4229 connp->conn_mlp_type, connp->conn_proto,
4230 ntohs(connp->conn_lport), B_FALSE);
4231 connp->conn_anon_port = 0;
4232 }
4233 connp->conn_mlp_type = mlptSingle;
4234
4235 /*
4236 * Remove this conn from any fanout list it is on.
4237 * and then wait for any threads currently operating
4238 * on this endpoint to finish
4239 */
4240 ipcl_hash_remove(connp);
4241
4242 /*
4243 * Remove this conn from the drain list, and do any other cleanup that
4244 * may be required. (TCP conns are never flow controlled, and
4245 * conn_idl will be NULL.)
4246 */
4247 if (drain_cleanup_reqd && connp->conn_idl != NULL) {
4248 idl_t *idl = connp->conn_idl;
4249
4250 mutex_enter(&idl->idl_lock);
4251 conn_drain(connp, B_TRUE);
4252 mutex_exit(&idl->idl_lock);
4253 }
4254
4255 if (connp == ipst->ips_ip_g_mrouter)
4256 (void) ip_mrouter_done(ipst);
4257
4258 if (ilg_cleanup_reqd)
4259 ilg_delete_all(connp);
4260
4261 /*
4262 * Now conn refcnt can increase only thru CONN_INC_REF_LOCKED.
4263 * callers from write side can't be there now because close
4264 * is in progress. The only other caller is ipcl_walk
4265 * which checks for the condemned flag.
4266 */
4267 mutex_enter(&connp->conn_lock);
4268 connp->conn_state_flags |= CONN_CONDEMNED;
4269 while (connp->conn_ref != 1)
4270 cv_wait(&connp->conn_cv, &connp->conn_lock);
4271 connp->conn_state_flags |= CONN_QUIESCED;
4272 mutex_exit(&connp->conn_lock);
4273 }
4274
4275 /* ARGSUSED */
4276 int
4277 ip_close(queue_t *q, int flags)
4278 {
4279 conn_t *connp;
4280
4281 /*
4282 * Call the appropriate delete routine depending on whether this is
4283 * a module or device.
4284 */
4285 if (WR(q)->q_next != NULL) {
4286 /* This is a module close */
4287 return (ip_modclose((ill_t *)q->q_ptr));
4288 }
4289
4290 connp = q->q_ptr;
4291 ip_quiesce_conn(connp);
4292
4293 qprocsoff(q);
4294
4295 /*
4296 * Now we are truly single threaded on this stream, and can
4297 * delete the things hanging off the connp, and finally the connp.
4298 * We removed this connp from the fanout list, it cannot be
4299 * accessed thru the fanouts, and we already waited for the
4300 * conn_ref to drop to 0. We are already in close, so
4301 * there cannot be any other thread from the top. qprocsoff
4302 * has completed, and service has completed or won't run in
4303 * future.
4304 */
4305 ASSERT(connp->conn_ref == 1);
4306
4307 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4308
4309 connp->conn_ref--;
4310 ipcl_conn_destroy(connp);
4311
4312 q->q_ptr = WR(q)->q_ptr = NULL;
4313 return (0);
4314 }
4315
4316 /*
4317 * Wapper around putnext() so that ip_rts_request can merely use
4318 * conn_recv.
4319 */
4320 /*ARGSUSED2*/
4321 static void
4322 ip_conn_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
4323 {
4324 conn_t *connp = (conn_t *)arg1;
4325
4326 putnext(connp->conn_rq, mp);
4327 }
4328
4329 /* Dummy in case ICMP error delivery is attempted to a /dev/ip instance */
4330 /* ARGSUSED */
4331 static void
4332 ip_conn_input_icmp(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
4333 {
4334 freemsg(mp);
4335 }
4336
4337 /*
4338 * Called when the module is about to be unloaded
4339 */
4340 void
4341 ip_ddi_destroy(void)
4342 {
4343 /* This needs to be called before destroying any transports. */
4344 mutex_enter(&cpu_lock);
4345 unregister_cpu_setup_func(ip_tp_cpu_update, NULL);
4346 mutex_exit(&cpu_lock);
4347
4348 tnet_fini();
4349
4350 icmp_ddi_g_destroy();
4351 rts_ddi_g_destroy();
4352 udp_ddi_g_destroy();
4353 dccp_ddi_g_destroy();
4354 sctp_ddi_g_destroy();
4355 tcp_ddi_g_destroy();
4356 ilb_ddi_g_destroy();
4357 dce_g_destroy();
4358 ipsec_policy_g_destroy();
4359 ipcl_g_destroy();
4360 ip_net_g_destroy();
4361 ip_ire_g_fini();
4362 inet_minor_destroy(ip_minor_arena_sa);
4363 #if defined(_LP64)
4364 inet_minor_destroy(ip_minor_arena_la);
4365 #endif
4366
4367 #ifdef DEBUG
4368 list_destroy(&ip_thread_list);
4369 rw_destroy(&ip_thread_rwlock);
4370 tsd_destroy(&ip_thread_data);
4371 #endif
4372
4373 netstack_unregister(NS_IP);
4374 }
4375
4376 /*
4377 * First step in cleanup.
4378 */
4379 /* ARGSUSED */
4380 static void
4381 ip_stack_shutdown(netstackid_t stackid, void *arg)
4382 {
4383 ip_stack_t *ipst = (ip_stack_t *)arg;
4384
4385 #ifdef NS_DEBUG
4386 printf("ip_stack_shutdown(%p, stack %d)\n", (void *)ipst, stackid);
4387 #endif
4388
4389 /*
4390 * Perform cleanup for special interfaces (loopback and IPMP).
4391 */
4392 ip_interface_cleanup(ipst);
4393
4394 /*
4395 * The *_hook_shutdown()s start the process of notifying any
4396 * consumers that things are going away.... nothing is destroyed.
4397 */
4398 ipv4_hook_shutdown(ipst);
4399 ipv6_hook_shutdown(ipst);
4400 arp_hook_shutdown(ipst);
4401
4402 mutex_enter(&ipst->ips_capab_taskq_lock);
4403 ipst->ips_capab_taskq_quit = B_TRUE;
4404 cv_signal(&ipst->ips_capab_taskq_cv);
4405 mutex_exit(&ipst->ips_capab_taskq_lock);
4406 }
4407
4408 /*
4409 * Free the IP stack instance.
4410 */
4411 static void
4412 ip_stack_fini(netstackid_t stackid, void *arg)
4413 {
4414 ip_stack_t *ipst = (ip_stack_t *)arg;
4415 int ret;
4416
4417 #ifdef NS_DEBUG
4418 printf("ip_stack_fini(%p, stack %d)\n", (void *)ipst, stackid);
4419 #endif
4420 /*
4421 * At this point, all of the notifications that the events and
4422 * protocols are going away have been run, meaning that we can
4423 * now set about starting to clean things up.
4424 */
4425 ipobs_fini(ipst);
4426 ipv4_hook_destroy(ipst);
4427 ipv6_hook_destroy(ipst);
4428 arp_hook_destroy(ipst);
4429 ip_net_destroy(ipst);
4430
4431 ipmp_destroy(ipst);
4432
4433 ip_kstat_fini(stackid, ipst->ips_ip_mibkp);
4434 ipst->ips_ip_mibkp = NULL;
4435 icmp_kstat_fini(stackid, ipst->ips_icmp_mibkp);
4436 ipst->ips_icmp_mibkp = NULL;
4437 ip_kstat2_fini(stackid, ipst->ips_ip_kstat);
4438 ipst->ips_ip_kstat = NULL;
4439 bzero(&ipst->ips_ip_statistics, sizeof (ipst->ips_ip_statistics));
4440 ip6_kstat_fini(stackid, ipst->ips_ip6_kstat);
4441 ipst->ips_ip6_kstat = NULL;
4442 bzero(&ipst->ips_ip6_statistics, sizeof (ipst->ips_ip6_statistics));
4443
4444 kmem_free(ipst->ips_propinfo_tbl,
4445 ip_propinfo_count * sizeof (mod_prop_info_t));
4446 ipst->ips_propinfo_tbl = NULL;
4447
4448 dce_stack_destroy(ipst);
4449 ip_mrouter_stack_destroy(ipst);
4450
4451 ret = untimeout(ipst->ips_igmp_timeout_id);
4452 if (ret == -1) {
4453 ASSERT(ipst->ips_igmp_timeout_id == 0);
4454 } else {
4455 ASSERT(ipst->ips_igmp_timeout_id != 0);
4456 ipst->ips_igmp_timeout_id = 0;
4457 }
4458 ret = untimeout(ipst->ips_igmp_slowtimeout_id);
4459 if (ret == -1) {
4460 ASSERT(ipst->ips_igmp_slowtimeout_id == 0);
4461 } else {
4462 ASSERT(ipst->ips_igmp_slowtimeout_id != 0);
4463 ipst->ips_igmp_slowtimeout_id = 0;
4464 }
4465 ret = untimeout(ipst->ips_mld_timeout_id);
4466 if (ret == -1) {
4467 ASSERT(ipst->ips_mld_timeout_id == 0);
4468 } else {
4469 ASSERT(ipst->ips_mld_timeout_id != 0);
4470 ipst->ips_mld_timeout_id = 0;
4471 }
4472 ret = untimeout(ipst->ips_mld_slowtimeout_id);
4473 if (ret == -1) {
4474 ASSERT(ipst->ips_mld_slowtimeout_id == 0);
4475 } else {
4476 ASSERT(ipst->ips_mld_slowtimeout_id != 0);
4477 ipst->ips_mld_slowtimeout_id = 0;
4478 }
4479
4480 ip_ire_fini(ipst);
4481 ip6_asp_free(ipst);
4482 conn_drain_fini(ipst);
4483 ipcl_destroy(ipst);
4484
4485 mutex_destroy(&ipst->ips_ndp4->ndp_g_lock);
4486 mutex_destroy(&ipst->ips_ndp6->ndp_g_lock);
4487 kmem_free(ipst->ips_ndp4, sizeof (ndp_g_t));
4488 ipst->ips_ndp4 = NULL;
4489 kmem_free(ipst->ips_ndp6, sizeof (ndp_g_t));
4490 ipst->ips_ndp6 = NULL;
4491
4492 if (ipst->ips_loopback_ksp != NULL) {
4493 kstat_delete_netstack(ipst->ips_loopback_ksp, stackid);
4494 ipst->ips_loopback_ksp = NULL;
4495 }
4496
4497 mutex_destroy(&ipst->ips_capab_taskq_lock);
4498 cv_destroy(&ipst->ips_capab_taskq_cv);
4499
4500 rw_destroy(&ipst->ips_srcid_lock);
4501
4502 mutex_destroy(&ipst->ips_ip_mi_lock);
4503 rw_destroy(&ipst->ips_ill_g_usesrc_lock);
4504
4505 mutex_destroy(&ipst->ips_igmp_timer_lock);
4506 mutex_destroy(&ipst->ips_mld_timer_lock);
4507 mutex_destroy(&ipst->ips_igmp_slowtimeout_lock);
4508 mutex_destroy(&ipst->ips_mld_slowtimeout_lock);
4509 mutex_destroy(&ipst->ips_ip_addr_avail_lock);
4510 rw_destroy(&ipst->ips_ill_g_lock);
4511
4512 kmem_free(ipst->ips_phyint_g_list, sizeof (phyint_list_t));
4513 ipst->ips_phyint_g_list = NULL;
4514 kmem_free(ipst->ips_ill_g_heads, sizeof (ill_g_head_t) * MAX_G_HEADS);
4515 ipst->ips_ill_g_heads = NULL;
4516
4517 ldi_ident_release(ipst->ips_ldi_ident);
4518 kmem_free(ipst, sizeof (*ipst));
4519 }
4520
4521 /*
4522 * This function is called from the TSD destructor, and is used to debug
4523 * reference count issues in IP. See block comment in <inet/ip_if.h> for
4524 * details.
4525 */
4526 static void
4527 ip_thread_exit(void *phash)
4528 {
4529 th_hash_t *thh = phash;
4530
4531 rw_enter(&ip_thread_rwlock, RW_WRITER);
4532 list_remove(&ip_thread_list, thh);
4533 rw_exit(&ip_thread_rwlock);
4534 mod_hash_destroy_hash(thh->thh_hash);
4535 kmem_free(thh, sizeof (*thh));
4536 }
4537
4538 /*
4539 * Called when the IP kernel module is loaded into the kernel
4540 */
4541 void
4542 ip_ddi_init(void)
4543 {
4544 ip_squeue_flag = ip_squeue_switch(ip_squeue_enter);
4545
4546 /*
4547 * For IP and TCP the minor numbers should start from 2 since we have 4
4548 * initial devices: ip, ip6, tcp, tcp6.
4549 */
4550 /*
4551 * If this is a 64-bit kernel, then create two separate arenas -
4552 * one for TLIs in the range of INET_MIN_DEV+2 through 2^^18-1, and the
4553 * other for socket apps in the range 2^^18 through 2^^32-1.
4554 */
4555 ip_minor_arena_la = NULL;
4556 ip_minor_arena_sa = NULL;
4557 #if defined(_LP64)
4558 if ((ip_minor_arena_sa = inet_minor_create("ip_minor_arena_sa",
4559 INET_MIN_DEV + 2, MAXMIN32, KM_SLEEP)) == NULL) {
4560 cmn_err(CE_PANIC,
4561 "ip_ddi_init: ip_minor_arena_sa creation failed\n");
4562 }
4563 if ((ip_minor_arena_la = inet_minor_create("ip_minor_arena_la",
4564 MAXMIN32 + 1, MAXMIN64, KM_SLEEP)) == NULL) {
4565 cmn_err(CE_PANIC,
4566 "ip_ddi_init: ip_minor_arena_la creation failed\n");
4567 }
4568 #else
4569 if ((ip_minor_arena_sa = inet_minor_create("ip_minor_arena_sa",
4570 INET_MIN_DEV + 2, MAXMIN, KM_SLEEP)) == NULL) {
4571 cmn_err(CE_PANIC,
4572 "ip_ddi_init: ip_minor_arena_sa creation failed\n");
4573 }
4574 #endif
4575 ip_poll_normal_ticks = MSEC_TO_TICK_ROUNDUP(ip_poll_normal_ms);
4576
4577 ipcl_g_init();
4578 ip_ire_g_init();
4579 ip_net_g_init();
4580
4581 #ifdef DEBUG
4582 tsd_create(&ip_thread_data, ip_thread_exit);
4583 rw_init(&ip_thread_rwlock, NULL, RW_DEFAULT, NULL);
4584 list_create(&ip_thread_list, sizeof (th_hash_t),
4585 offsetof(th_hash_t, thh_link));
4586 #endif
4587 ipsec_policy_g_init();
4588 tcp_ddi_g_init();
4589 sctp_ddi_g_init();
4590 dccp_ddi_g_init();
4591 dce_g_init();
4592
4593 /*
4594 * We want to be informed each time a stack is created or
4595 * destroyed in the kernel, so we can maintain the
4596 * set of udp_stack_t's.
4597 */
4598 netstack_register(NS_IP, ip_stack_init, ip_stack_shutdown,
4599 ip_stack_fini);
4600
4601 tnet_init();
4602
4603 udp_ddi_g_init();
4604 rts_ddi_g_init();
4605 icmp_ddi_g_init();
4606 ilb_ddi_g_init();
4607
4608 /* This needs to be called after all transports are initialized. */
4609 mutex_enter(&cpu_lock);
4610 register_cpu_setup_func(ip_tp_cpu_update, NULL);
4611 mutex_exit(&cpu_lock);
4612 }
4613
4614 /*
4615 * Initialize the IP stack instance.
4616 */
4617 static void *
4618 ip_stack_init(netstackid_t stackid, netstack_t *ns)
4619 {
4620 ip_stack_t *ipst;
4621 size_t arrsz;
4622 major_t major;
4623
4624 #ifdef NS_DEBUG
4625 printf("ip_stack_init(stack %d)\n", stackid);
4626 #endif
4627
4628 ipst = (ip_stack_t *)kmem_zalloc(sizeof (*ipst), KM_SLEEP);
4629 ipst->ips_netstack = ns;
4630
4631 ipst->ips_ill_g_heads = kmem_zalloc(sizeof (ill_g_head_t) * MAX_G_HEADS,
4632 KM_SLEEP);
4633 ipst->ips_phyint_g_list = kmem_zalloc(sizeof (phyint_list_t),
4634 KM_SLEEP);
4635 ipst->ips_ndp4 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP);
4636 ipst->ips_ndp6 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP);
4637 mutex_init(&ipst->ips_ndp4->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL);
4638 mutex_init(&ipst->ips_ndp6->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL);
4639
4640 mutex_init(&ipst->ips_igmp_timer_lock, NULL, MUTEX_DEFAULT, NULL);
4641 ipst->ips_igmp_deferred_next = INFINITY;
4642 mutex_init(&ipst->ips_mld_timer_lock, NULL, MUTEX_DEFAULT, NULL);
4643 ipst->ips_mld_deferred_next = INFINITY;
4644 mutex_init(&ipst->ips_igmp_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL);
4645 mutex_init(&ipst->ips_mld_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL);
4646 mutex_init(&ipst->ips_ip_mi_lock, NULL, MUTEX_DEFAULT, NULL);
4647 mutex_init(&ipst->ips_ip_addr_avail_lock, NULL, MUTEX_DEFAULT, NULL);
4648 rw_init(&ipst->ips_ill_g_lock, NULL, RW_DEFAULT, NULL);
4649 rw_init(&ipst->ips_ill_g_usesrc_lock, NULL, RW_DEFAULT, NULL);
4650
4651 ipcl_init(ipst);
4652 ip_ire_init(ipst);
4653 ip6_asp_init(ipst);
4654 ipif_init(ipst);
4655 conn_drain_init(ipst);
4656 ip_mrouter_stack_init(ipst);
4657 dce_stack_init(ipst);
4658
4659 ipst->ips_ip_multirt_log_interval = 1000;
4660
4661 ipst->ips_ill_index = 1;
4662
4663 ipst->ips_saved_ip_forwarding = -1;
4664 ipst->ips_reg_vif_num = ALL_VIFS; /* Index to Register vif */
4665
4666 arrsz = ip_propinfo_count * sizeof (mod_prop_info_t);
4667 ipst->ips_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP);
4668 bcopy(ip_propinfo_tbl, ipst->ips_propinfo_tbl, arrsz);
4669
4670 ipst->ips_ip_mibkp = ip_kstat_init(stackid, ipst);
4671 ipst->ips_icmp_mibkp = icmp_kstat_init(stackid);
4672 ipst->ips_ip_kstat = ip_kstat2_init(stackid, &ipst->ips_ip_statistics);
4673 ipst->ips_ip6_kstat =
4674 ip6_kstat_init(stackid, &ipst->ips_ip6_statistics);
4675
4676 ipst->ips_ip_src_id = 1;
4677 rw_init(&ipst->ips_srcid_lock, NULL, RW_DEFAULT, NULL);
4678
4679 ipst->ips_src_generation = SRC_GENERATION_INITIAL;
4680
4681 ip_net_init(ipst, ns);
4682 ipv4_hook_init(ipst);
4683 ipv6_hook_init(ipst);
4684 arp_hook_init(ipst);
4685 ipmp_init(ipst);
4686 ipobs_init(ipst);
4687
4688 /*
4689 * Create the taskq dispatcher thread and initialize related stuff.
4690 */
4691 mutex_init(&ipst->ips_capab_taskq_lock, NULL, MUTEX_DEFAULT, NULL);
4692 cv_init(&ipst->ips_capab_taskq_cv, NULL, CV_DEFAULT, NULL);
4693 ipst->ips_capab_taskq_thread = thread_create(NULL, 0,
4694 ill_taskq_dispatch, ipst, 0, &p0, TS_RUN, minclsyspri);
4695
4696 major = mod_name_to_major(INET_NAME);
4697 (void) ldi_ident_from_major(major, &ipst->ips_ldi_ident);
4698 return (ipst);
4699 }
4700
4701 /*
4702 * Allocate and initialize a DLPI template of the specified length. (May be
4703 * called as writer.)
4704 */
4705 mblk_t *
4706 ip_dlpi_alloc(size_t len, t_uscalar_t prim)
4707 {
4708 mblk_t *mp;
4709
4710 mp = allocb(len, BPRI_MED);
4711 if (!mp)
4712 return (NULL);
4713
4714 /*
4715 * DLPIv2 says that DL_INFO_REQ and DL_TOKEN_REQ (the latter
4716 * of which we don't seem to use) are sent with M_PCPROTO, and
4717 * that other DLPI are M_PROTO.
4718 */
4719 if (prim == DL_INFO_REQ) {
4720 mp->b_datap->db_type = M_PCPROTO;
4721 } else {
4722 mp->b_datap->db_type = M_PROTO;
4723 }
4724
4725 mp->b_wptr = mp->b_rptr + len;
4726 bzero(mp->b_rptr, len);
4727 ((dl_unitdata_req_t *)mp->b_rptr)->dl_primitive = prim;
4728 return (mp);
4729 }
4730
4731 /*
4732 * Allocate and initialize a DLPI notification. (May be called as writer.)
4733 */
4734 mblk_t *
4735 ip_dlnotify_alloc(uint_t notification, uint_t data)
4736 {
4737 dl_notify_ind_t *notifyp;
4738 mblk_t *mp;
4739
4740 if ((mp = ip_dlpi_alloc(DL_NOTIFY_IND_SIZE, DL_NOTIFY_IND)) == NULL)
4741 return (NULL);
4742
4743 notifyp = (dl_notify_ind_t *)mp->b_rptr;
4744 notifyp->dl_notification = notification;
4745 notifyp->dl_data = data;
4746 return (mp);
4747 }
4748
4749 mblk_t *
4750 ip_dlnotify_alloc2(uint_t notification, uint_t data1, uint_t data2)
4751 {
4752 dl_notify_ind_t *notifyp;
4753 mblk_t *mp;
4754
4755 if ((mp = ip_dlpi_alloc(DL_NOTIFY_IND_SIZE, DL_NOTIFY_IND)) == NULL)
4756 return (NULL);
4757
4758 notifyp = (dl_notify_ind_t *)mp->b_rptr;
4759 notifyp->dl_notification = notification;
4760 notifyp->dl_data1 = data1;
4761 notifyp->dl_data2 = data2;
4762 return (mp);
4763 }
4764
4765 /*
4766 * Debug formatting routine. Returns a character string representation of the
4767 * addr in buf, of the form xxx.xxx.xxx.xxx. This routine takes the address
4768 * in the form of a ipaddr_t and calls ip_dot_saddr with a pointer.
4769 *
4770 * Once the ndd table-printing interfaces are removed, this can be changed to
4771 * standard dotted-decimal form.
4772 */
4773 char *
4774 ip_dot_addr(ipaddr_t addr, char *buf)
4775 {
4776 uint8_t *ap = (uint8_t *)&addr;
4777
4778 (void) mi_sprintf(buf, "%03d.%03d.%03d.%03d",
4779 ap[0] & 0xFF, ap[1] & 0xFF, ap[2] & 0xFF, ap[3] & 0xFF);
4780 return (buf);
4781 }
4782
4783 /*
4784 * Write the given MAC address as a printable string in the usual colon-
4785 * separated format.
4786 */
4787 const char *
4788 mac_colon_addr(const uint8_t *addr, size_t alen, char *buf, size_t buflen)
4789 {
4790 char *bp;
4791
4792 if (alen == 0 || buflen < 4)
4793 return ("?");
4794 bp = buf;
4795 for (;;) {
4796 /*
4797 * If there are more MAC address bytes available, but we won't
4798 * have any room to print them, then add "..." to the string
4799 * instead. See below for the 'magic number' explanation.
4800 */
4801 if ((alen == 2 && buflen < 6) || (alen > 2 && buflen < 7)) {
4802 (void) strcpy(bp, "...");
4803 break;
4804 }
4805 (void) sprintf(bp, "%02x", *addr++);
4806 bp += 2;
4807 if (--alen == 0)
4808 break;
4809 *bp++ = ':';
4810 buflen -= 3;
4811 /*
4812 * At this point, based on the first 'if' statement above,
4813 * either alen == 1 and buflen >= 3, or alen > 1 and
4814 * buflen >= 4. The first case leaves room for the final "xx"
4815 * number and trailing NUL byte. The second leaves room for at
4816 * least "...". Thus the apparently 'magic' numbers chosen for
4817 * that statement.
4818 */
4819 }
4820 return (buf);
4821 }
4822
4823 /*
4824 * Called when it is conceptually a ULP that would sent the packet
4825 * e.g., port unreachable and protocol unreachable. Check that the packet
4826 * would have passed the IPsec global policy before sending the error.
4827 *
4828 * Send an ICMP error after patching up the packet appropriately.
4829 * Uses ip_drop_input and bumps the appropriate MIB.
4830 */
4831 void
4832 ip_fanout_send_icmp_v4(mblk_t *mp, uint_t icmp_type, uint_t icmp_code,
4833 ip_recv_attr_t *ira)
4834 {
4835 ipha_t *ipha;
4836 boolean_t secure;
4837 ill_t *ill = ira->ira_ill;
4838 ip_stack_t *ipst = ill->ill_ipst;
4839 netstack_t *ns = ipst->ips_netstack;
4840 ipsec_stack_t *ipss = ns->netstack_ipsec;
4841
4842 secure = ira->ira_flags & IRAF_IPSEC_SECURE;
4843
4844 /*
4845 * We are generating an icmp error for some inbound packet.
4846 * Called from all ip_fanout_(udp, tcp, proto) functions.
4847 * Before we generate an error, check with global policy
4848 * to see whether this is allowed to enter the system. As
4849 * there is no "conn", we are checking with global policy.
4850 */
4851 ipha = (ipha_t *)mp->b_rptr;
4852 if (secure || ipss->ipsec_inbound_v4_policy_present) {
4853 mp = ipsec_check_global_policy(mp, NULL, ipha, NULL, ira, ns);
4854 if (mp == NULL)
4855 return;
4856 }
4857
4858 /* We never send errors for protocols that we do implement */
4859 if (ira->ira_protocol == IPPROTO_ICMP ||
4860 ira->ira_protocol == IPPROTO_IGMP) {
4861 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
4862 ip_drop_input("ip_fanout_send_icmp_v4", mp, ill);
4863 freemsg(mp);
4864 return;
4865 }
4866 /*
4867 * Have to correct checksum since
4868 * the packet might have been
4869 * fragmented and the reassembly code in ip_rput
4870 * does not restore the IP checksum.
4871 */
4872 ipha->ipha_hdr_checksum = 0;
4873 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
4874
4875 switch (icmp_type) {
4876 case ICMP_DEST_UNREACHABLE:
4877 switch (icmp_code) {
4878 case ICMP_PROTOCOL_UNREACHABLE:
4879 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInUnknownProtos);
4880 ip_drop_input("ipIfStatsInUnknownProtos", mp, ill);
4881 break;
4882 case ICMP_PORT_UNREACHABLE:
4883 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts);
4884 ip_drop_input("ipIfStatsNoPorts", mp, ill);
4885 break;
4886 }
4887
4888 icmp_unreachable(mp, icmp_code, ira);
4889 break;
4890 default:
4891 #ifdef DEBUG
4892 panic("ip_fanout_send_icmp_v4: wrong type");
4893 /*NOTREACHED*/
4894 #else
4895 freemsg(mp);
4896 break;
4897 #endif
4898 }
4899 }
4900
4901 /*
4902 * Used to send an ICMP error message when a packet is received for
4903 * a protocol that is not supported. The mblk passed as argument
4904 * is consumed by this function.
4905 */
4906 void
4907 ip_proto_not_sup(mblk_t *mp, ip_recv_attr_t *ira)
4908 {
4909 ipha_t *ipha;
4910
4911 ipha = (ipha_t *)mp->b_rptr;
4912 if (ira->ira_flags & IRAF_IS_IPV4) {
4913 ASSERT(IPH_HDR_VERSION(ipha) == IP_VERSION);
4914 ip_fanout_send_icmp_v4(mp, ICMP_DEST_UNREACHABLE,
4915 ICMP_PROTOCOL_UNREACHABLE, ira);
4916 } else {
4917 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
4918 ip_fanout_send_icmp_v6(mp, ICMP6_PARAM_PROB,
4919 ICMP6_PARAMPROB_NEXTHEADER, ira);
4920 }
4921 }
4922
4923 /*
4924 * Deliver a rawip packet to the given conn, possibly applying ipsec policy.
4925 * Handles IPv4 and IPv6.
4926 * We are responsible for disposing of mp, such as by freemsg() or putnext()
4927 * Caller is responsible for dropping references to the conn.
4928 */
4929 void
4930 ip_fanout_proto_conn(conn_t *connp, mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
4931 ip_recv_attr_t *ira)
4932 {
4933 ill_t *ill = ira->ira_ill;
4934 ip_stack_t *ipst = ill->ill_ipst;
4935 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
4936 boolean_t secure;
4937 uint_t protocol = ira->ira_protocol;
4938 iaflags_t iraflags = ira->ira_flags;
4939 queue_t *rq;
4940
4941 secure = iraflags & IRAF_IPSEC_SECURE;
4942
4943 rq = connp->conn_rq;
4944 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : !canputnext(rq)) {
4945 switch (protocol) {
4946 case IPPROTO_ICMPV6:
4947 BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInOverflows);
4948 break;
4949 case IPPROTO_ICMP:
4950 BUMP_MIB(&ipst->ips_icmp_mib, icmpInOverflows);
4951 break;
4952 default:
4953 BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows);
4954 break;
4955 }
4956 freemsg(mp);
4957 return;
4958 }
4959
4960 ASSERT(!(IPCL_IS_IPTUN(connp)));
4961
4962 if (((iraflags & IRAF_IS_IPV4) ?
4963 CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
4964 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
4965 secure) {
4966 mp = ipsec_check_inbound_policy(mp, connp, ipha,
4967 ip6h, ira);
4968 if (mp == NULL) {
4969 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
4970 /* Note that mp is NULL */
4971 ip_drop_input("ipIfStatsInDiscards", mp, ill);
4972 return;
4973 }
4974 }
4975
4976 if (iraflags & IRAF_ICMP_ERROR) {
4977 (connp->conn_recvicmp)(connp, mp, NULL, ira);
4978 } else {
4979 ill_t *rill = ira->ira_rill;
4980
4981 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
4982 ira->ira_ill = ira->ira_rill = NULL;
4983 /* Send it upstream */
4984 (connp->conn_recv)(connp, mp, NULL, ira);
4985 ira->ira_ill = ill;
4986 ira->ira_rill = rill;
4987 }
4988 }
4989
4990 /*
4991 * Handle protocols with which IP is less intimate. There
4992 * can be more than one stream bound to a particular
4993 * protocol. When this is the case, normally each one gets a copy
4994 * of any incoming packets.
4995 *
4996 * IPsec NOTE :
4997 *
4998 * Don't allow a secure packet going up a non-secure connection.
4999 * We don't allow this because
5000 *
5001 * 1) Reply might go out in clear which will be dropped at
5002 * the sending side.
5003 * 2) If the reply goes out in clear it will give the
5004 * adversary enough information for getting the key in
5005 * most of the cases.
5006 *
5007 * Moreover getting a secure packet when we expect clear
5008 * implies that SA's were added without checking for
5009 * policy on both ends. This should not happen once ISAKMP
5010 * is used to negotiate SAs as SAs will be added only after
5011 * verifying the policy.
5012 *
5013 * Zones notes:
5014 * Earlier in ip_input on a system with multiple shared-IP zones we
5015 * duplicate the multicast and broadcast packets and send them up
5016 * with each explicit zoneid that exists on that ill.
5017 * This means that here we can match the zoneid with SO_ALLZONES being special.
5018 */
5019 void
5020 ip_fanout_proto_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
5021 {
5022 mblk_t *mp1;
5023 ipaddr_t laddr;
5024 conn_t *connp, *first_connp, *next_connp;
5025 connf_t *connfp;
5026 ill_t *ill = ira->ira_ill;
5027 ip_stack_t *ipst = ill->ill_ipst;
5028
5029 laddr = ipha->ipha_dst;
5030
5031 connfp = &ipst->ips_ipcl_proto_fanout_v4[ira->ira_protocol];
5032 mutex_enter(&connfp->connf_lock);
5033 connp = connfp->connf_head;
5034 for (connp = connfp->connf_head; connp != NULL;
5035 connp = connp->conn_next) {
5036 /* Note: IPCL_PROTO_MATCH includes conn_wantpacket */
5037 if (IPCL_PROTO_MATCH(connp, ira, ipha) &&
5038 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5039 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp))) {
5040 break;
5041 }
5042 }
5043
5044 if (connp == NULL) {
5045 /*
5046 * No one bound to these addresses. Is
5047 * there a client that wants all
5048 * unclaimed datagrams?
5049 */
5050 mutex_exit(&connfp->connf_lock);
5051 ip_fanout_send_icmp_v4(mp, ICMP_DEST_UNREACHABLE,
5052 ICMP_PROTOCOL_UNREACHABLE, ira);
5053 return;
5054 }
5055
5056 ASSERT(IPCL_IS_NONSTR(connp) || connp->conn_rq != NULL);
5057
5058 CONN_INC_REF(connp);
5059 first_connp = connp;
5060 connp = connp->conn_next;
5061
5062 for (;;) {
5063 while (connp != NULL) {
5064 /* Note: IPCL_PROTO_MATCH includes conn_wantpacket */
5065 if (IPCL_PROTO_MATCH(connp, ira, ipha) &&
5066 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5067 tsol_receive_local(mp, &laddr, IPV4_VERSION,
5068 ira, connp)))
5069 break;
5070 connp = connp->conn_next;
5071 }
5072
5073 if (connp == NULL) {
5074 /* No more interested clients */
5075 connp = first_connp;
5076 break;
5077 }
5078 if (((mp1 = dupmsg(mp)) == NULL) &&
5079 ((mp1 = copymsg(mp)) == NULL)) {
5080 /* Memory allocation failed */
5081 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5082 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5083 connp = first_connp;
5084 break;
5085 }
5086
5087 CONN_INC_REF(connp);
5088 mutex_exit(&connfp->connf_lock);
5089
5090 ip_fanout_proto_conn(connp, mp1, (ipha_t *)mp1->b_rptr, NULL,
5091 ira);
5092
5093 mutex_enter(&connfp->connf_lock);
5094 /* Follow the next pointer before releasing the conn. */
5095 next_connp = connp->conn_next;
5096 CONN_DEC_REF(connp);
5097 connp = next_connp;
5098 }
5099
5100 /* Last one. Send it upstream. */
5101 mutex_exit(&connfp->connf_lock);
5102
5103 ip_fanout_proto_conn(connp, mp, ipha, NULL, ira);
5104
5105 CONN_DEC_REF(connp);
5106 }
5107
5108 /*
5109 * If we have a IPsec NAT-Traversal packet, strip the zero-SPI or
5110 * pass it along to ESP if the SPI is non-zero. Returns the mblk if the mblk
5111 * is not consumed.
5112 *
5113 * One of three things can happen, all of which affect the passed-in mblk:
5114 *
5115 * 1.) The packet is stock UDP and gets its zero-SPI stripped. Return mblk..
5116 *
5117 * 2.) The packet is ESP-in-UDP, gets transformed into an equivalent
5118 * ESP packet, and is passed along to ESP for consumption. Return NULL.
5119 *
5120 * 3.) The packet is an ESP-in-UDP Keepalive. Drop it and return NULL.
5121 */
5122 mblk_t *
5123 zero_spi_check(mblk_t *mp, ip_recv_attr_t *ira)
5124 {
5125 int shift, plen, iph_len;
5126 ipha_t *ipha;
5127 udpha_t *udpha;
5128 uint32_t *spi;
5129 uint32_t esp_ports;
5130 uint8_t *orptr;
5131 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
5132 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5133
5134 ipha = (ipha_t *)mp->b_rptr;
5135 iph_len = ira->ira_ip_hdr_length;
5136 plen = ira->ira_pktlen;
5137
5138 if (plen - iph_len - sizeof (udpha_t) < sizeof (uint32_t)) {
5139 /*
5140 * Most likely a keepalive for the benefit of an intervening
5141 * NAT. These aren't for us, per se, so drop it.
5142 *
5143 * RFC 3947/8 doesn't say for sure what to do for 2-3
5144 * byte packets (keepalives are 1-byte), but we'll drop them
5145 * also.
5146 */
5147 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
5148 DROPPER(ipss, ipds_esp_nat_t_ka), &ipss->ipsec_dropper);
5149 return (NULL);
5150 }
5151
5152 if (MBLKL(mp) < iph_len + sizeof (udpha_t) + sizeof (*spi)) {
5153 /* might as well pull it all up - it might be ESP. */
5154 if (!pullupmsg(mp, -1)) {
5155 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
5156 DROPPER(ipss, ipds_esp_nomem),
5157 &ipss->ipsec_dropper);
5158 return (NULL);
5159 }
5160
5161 ipha = (ipha_t *)mp->b_rptr;
5162 }
5163 spi = (uint32_t *)(mp->b_rptr + iph_len + sizeof (udpha_t));
5164 if (*spi == 0) {
5165 /* UDP packet - remove 0-spi. */
5166 shift = sizeof (uint32_t);
5167 } else {
5168 /* ESP-in-UDP packet - reduce to ESP. */
5169 ipha->ipha_protocol = IPPROTO_ESP;
5170 shift = sizeof (udpha_t);
5171 }
5172
5173 /* Fix IP header */
5174 ira->ira_pktlen = (plen - shift);
5175 ipha->ipha_length = htons(ira->ira_pktlen);
5176 ipha->ipha_hdr_checksum = 0;
5177
5178 orptr = mp->b_rptr;
5179 mp->b_rptr += shift;
5180
5181 udpha = (udpha_t *)(orptr + iph_len);
5182 if (*spi == 0) {
5183 ASSERT((uint8_t *)ipha == orptr);
5184 udpha->uha_length = htons(plen - shift - iph_len);
5185 iph_len += sizeof (udpha_t); /* For the call to ovbcopy(). */
5186 esp_ports = 0;
5187 } else {
5188 esp_ports = *((uint32_t *)udpha);
5189 ASSERT(esp_ports != 0);
5190 }
5191 ovbcopy(orptr, orptr + shift, iph_len);
5192 if (esp_ports != 0) /* Punt up for ESP processing. */ {
5193 ipha = (ipha_t *)(orptr + shift);
5194
5195 ira->ira_flags |= IRAF_ESP_UDP_PORTS;
5196 ira->ira_esp_udp_ports = esp_ports;
5197 ip_fanout_v4(mp, ipha, ira);
5198 return (NULL);
5199 }
5200 return (mp);
5201 }
5202
5203 /*
5204 * Deliver a udp packet to the given conn, possibly applying ipsec policy.
5205 * Handles IPv4 and IPv6.
5206 * We are responsible for disposing of mp, such as by freemsg() or putnext()
5207 * Caller is responsible for dropping references to the conn.
5208 */
5209 void
5210 ip_fanout_udp_conn(conn_t *connp, mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
5211 ip_recv_attr_t *ira)
5212 {
5213 ill_t *ill = ira->ira_ill;
5214 ip_stack_t *ipst = ill->ill_ipst;
5215 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5216 boolean_t secure;
5217 iaflags_t iraflags = ira->ira_flags;
5218
5219 secure = iraflags & IRAF_IPSEC_SECURE;
5220
5221 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld :
5222 !canputnext(connp->conn_rq)) {
5223 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
5224 freemsg(mp);
5225 return;
5226 }
5227
5228 if (((iraflags & IRAF_IS_IPV4) ?
5229 CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
5230 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
5231 secure) {
5232 mp = ipsec_check_inbound_policy(mp, connp, ipha,
5233 ip6h, ira);
5234 if (mp == NULL) {
5235 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5236 /* Note that mp is NULL */
5237 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5238 return;
5239 }
5240 }
5241
5242 /*
5243 * Since this code is not used for UDP unicast we don't need a NAT_T
5244 * check. Only ip_fanout_v4 has that check.
5245 */
5246 if (ira->ira_flags & IRAF_ICMP_ERROR) {
5247 (connp->conn_recvicmp)(connp, mp, NULL, ira);
5248 } else {
5249 ill_t *rill = ira->ira_rill;
5250
5251 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
5252 ira->ira_ill = ira->ira_rill = NULL;
5253 /* Send it upstream */
5254 (connp->conn_recv)(connp, mp, NULL, ira);
5255 ira->ira_ill = ill;
5256 ira->ira_rill = rill;
5257 }
5258 }
5259
5260 /*
5261 * Fanout for UDP packets that are multicast or broadcast, and ICMP errors.
5262 * (Unicast fanout is handled in ip_input_v4.)
5263 *
5264 * If SO_REUSEADDR is set all multicast and broadcast packets
5265 * will be delivered to all conns bound to the same port.
5266 *
5267 * If there is at least one matching AF_INET receiver, then we will
5268 * ignore any AF_INET6 receivers.
5269 * In the special case where an AF_INET socket binds to 0.0.0.0/<port> and an
5270 * AF_INET6 socket binds to ::/<port>, only the AF_INET socket receives the IPv4
5271 * packets.
5272 *
5273 * Zones notes:
5274 * Earlier in ip_input on a system with multiple shared-IP zones we
5275 * duplicate the multicast and broadcast packets and send them up
5276 * with each explicit zoneid that exists on that ill.
5277 * This means that here we can match the zoneid with SO_ALLZONES being special.
5278 */
5279 void
5280 ip_fanout_udp_multi_v4(mblk_t *mp, ipha_t *ipha, uint16_t lport, uint16_t fport,
5281 ip_recv_attr_t *ira)
5282 {
5283 ipaddr_t laddr;
5284 in6_addr_t v6faddr;
5285 conn_t *connp;
5286 connf_t *connfp;
5287 ipaddr_t faddr;
5288 ill_t *ill = ira->ira_ill;
5289 ip_stack_t *ipst = ill->ill_ipst;
5290
5291 ASSERT(ira->ira_flags & (IRAF_MULTIBROADCAST|IRAF_ICMP_ERROR));
5292
5293 laddr = ipha->ipha_dst;
5294 faddr = ipha->ipha_src;
5295
5296 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)];
5297 mutex_enter(&connfp->connf_lock);
5298 connp = connfp->connf_head;
5299
5300 /*
5301 * If SO_REUSEADDR has been set on the first we send the
5302 * packet to all clients that have joined the group and
5303 * match the port.
5304 */
5305 while (connp != NULL) {
5306 if ((IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)) &&
5307 conn_wantpacket(connp, ira, ipha) &&
5308 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5309 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp)))
5310 break;
5311 connp = connp->conn_next;
5312 }
5313
5314 if (connp == NULL)
5315 goto notfound;
5316
5317 CONN_INC_REF(connp);
5318
5319 if (connp->conn_reuseaddr) {
5320 conn_t *first_connp = connp;
5321 conn_t *next_connp;
5322 mblk_t *mp1;
5323
5324 connp = connp->conn_next;
5325 for (;;) {
5326 while (connp != NULL) {
5327 if (IPCL_UDP_MATCH(connp, lport, laddr,
5328 fport, faddr) &&
5329 conn_wantpacket(connp, ira, ipha) &&
5330 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5331 tsol_receive_local(mp, &laddr, IPV4_VERSION,
5332 ira, connp)))
5333 break;
5334 connp = connp->conn_next;
5335 }
5336 if (connp == NULL) {
5337 /* No more interested clients */
5338 connp = first_connp;
5339 break;
5340 }
5341 if (((mp1 = dupmsg(mp)) == NULL) &&
5342 ((mp1 = copymsg(mp)) == NULL)) {
5343 /* Memory allocation failed */
5344 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5345 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5346 connp = first_connp;
5347 break;
5348 }
5349 CONN_INC_REF(connp);
5350 mutex_exit(&connfp->connf_lock);
5351
5352 IP_STAT(ipst, ip_udp_fanmb);
5353 ip_fanout_udp_conn(connp, mp1, (ipha_t *)mp1->b_rptr,
5354 NULL, ira);
5355 mutex_enter(&connfp->connf_lock);
5356 /* Follow the next pointer before releasing the conn */
5357 next_connp = connp->conn_next;
5358 CONN_DEC_REF(connp);
5359 connp = next_connp;
5360 }
5361 }
5362
5363 /* Last one. Send it upstream. */
5364 mutex_exit(&connfp->connf_lock);
5365 IP_STAT(ipst, ip_udp_fanmb);
5366 ip_fanout_udp_conn(connp, mp, ipha, NULL, ira);
5367 CONN_DEC_REF(connp);
5368 return;
5369
5370 notfound:
5371 mutex_exit(&connfp->connf_lock);
5372 /*
5373 * IPv6 endpoints bound to multicast IPv4-mapped addresses
5374 * have already been matched above, since they live in the IPv4
5375 * fanout tables. This implies we only need to
5376 * check for IPv6 in6addr_any endpoints here.
5377 * Thus we compare using ipv6_all_zeros instead of the destination
5378 * address, except for the multicast group membership lookup which
5379 * uses the IPv4 destination.
5380 */
5381 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6faddr);
5382 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)];
5383 mutex_enter(&connfp->connf_lock);
5384 connp = connfp->connf_head;
5385 /*
5386 * IPv4 multicast packet being delivered to an AF_INET6
5387 * in6addr_any endpoint.
5388 * Need to check conn_wantpacket(). Note that we use conn_wantpacket()
5389 * and not conn_wantpacket_v6() since any multicast membership is
5390 * for an IPv4-mapped multicast address.
5391 */
5392 while (connp != NULL) {
5393 if (IPCL_UDP_MATCH_V6(connp, lport, ipv6_all_zeros,
5394 fport, v6faddr) &&
5395 conn_wantpacket(connp, ira, ipha) &&
5396 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5397 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp)))
5398 break;
5399 connp = connp->conn_next;
5400 }
5401
5402 if (connp == NULL) {
5403 /*
5404 * No one bound to this port. Is
5405 * there a client that wants all
5406 * unclaimed datagrams?
5407 */
5408 mutex_exit(&connfp->connf_lock);
5409
5410 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].connf_head !=
5411 NULL) {
5412 ASSERT(ira->ira_protocol == IPPROTO_UDP);
5413 ip_fanout_proto_v4(mp, ipha, ira);
5414 } else {
5415 /*
5416 * We used to attempt to send an icmp error here, but
5417 * since this is known to be a multicast packet
5418 * and we don't send icmp errors in response to
5419 * multicast, just drop the packet and give up sooner.
5420 */
5421 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts);
5422 freemsg(mp);
5423 }
5424 return;
5425 }
5426 ASSERT(IPCL_IS_NONSTR(connp) || connp->conn_rq != NULL);
5427
5428 /*
5429 * If SO_REUSEADDR has been set on the first we send the
5430 * packet to all clients that have joined the group and
5431 * match the port.
5432 */
5433 if (connp->conn_reuseaddr) {
5434 conn_t *first_connp = connp;
5435 conn_t *next_connp;
5436 mblk_t *mp1;
5437
5438 CONN_INC_REF(connp);
5439 connp = connp->conn_next;
5440 for (;;) {
5441 while (connp != NULL) {
5442 if (IPCL_UDP_MATCH_V6(connp, lport,
5443 ipv6_all_zeros, fport, v6faddr) &&
5444 conn_wantpacket(connp, ira, ipha) &&
5445 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5446 tsol_receive_local(mp, &laddr, IPV4_VERSION,
5447 ira, connp)))
5448 break;
5449 connp = connp->conn_next;
5450 }
5451 if (connp == NULL) {
5452 /* No more interested clients */
5453 connp = first_connp;
5454 break;
5455 }
5456 if (((mp1 = dupmsg(mp)) == NULL) &&
5457 ((mp1 = copymsg(mp)) == NULL)) {
5458 /* Memory allocation failed */
5459 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5460 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5461 connp = first_connp;
5462 break;
5463 }
5464 CONN_INC_REF(connp);
5465 mutex_exit(&connfp->connf_lock);
5466
5467 IP_STAT(ipst, ip_udp_fanmb);
5468 ip_fanout_udp_conn(connp, mp1, (ipha_t *)mp1->b_rptr,
5469 NULL, ira);
5470 mutex_enter(&connfp->connf_lock);
5471 /* Follow the next pointer before releasing the conn */
5472 next_connp = connp->conn_next;
5473 CONN_DEC_REF(connp);
5474 connp = next_connp;
5475 }
5476 }
5477
5478 /* Last one. Send it upstream. */
5479 mutex_exit(&connfp->connf_lock);
5480 IP_STAT(ipst, ip_udp_fanmb);
5481 ip_fanout_udp_conn(connp, mp, ipha, NULL, ira);
5482 CONN_DEC_REF(connp);
5483 }
5484
5485 /*
5486 * Split an incoming packet's IPv4 options into the label and the other options.
5487 * If 'allocate' is set it does memory allocation for the ip_pkt_t, including
5488 * clearing out any leftover label or options.
5489 * Otherwise it just makes ipp point into the packet.
5490 *
5491 * Returns zero if ok; ENOMEM if the buffer couldn't be allocated.
5492 */
5493 int
5494 ip_find_hdr_v4(ipha_t *ipha, ip_pkt_t *ipp, boolean_t allocate)
5495 {
5496 uchar_t *opt;
5497 uint32_t totallen;
5498 uint32_t optval;
5499 uint32_t optlen;
5500
5501 ipp->ipp_fields |= IPPF_HOPLIMIT | IPPF_TCLASS | IPPF_ADDR;
5502 ipp->ipp_hoplimit = ipha->ipha_ttl;
5503 ipp->ipp_type_of_service = ipha->ipha_type_of_service;
5504 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &ipp->ipp_addr);
5505
5506 /*
5507 * Get length (in 4 byte octets) of IP header options.
5508 */
5509 totallen = ipha->ipha_version_and_hdr_length -
5510 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
5511
5512 if (totallen == 0) {
5513 if (!allocate)
5514 return (0);
5515
5516 /* Clear out anything from a previous packet */
5517 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
5518 kmem_free(ipp->ipp_ipv4_options,
5519 ipp->ipp_ipv4_options_len);
5520 ipp->ipp_ipv4_options = NULL;
5521 ipp->ipp_ipv4_options_len = 0;
5522 ipp->ipp_fields &= ~IPPF_IPV4_OPTIONS;
5523 }
5524 if (ipp->ipp_fields & IPPF_LABEL_V4) {
5525 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4);
5526 ipp->ipp_label_v4 = NULL;
5527 ipp->ipp_label_len_v4 = 0;
5528 ipp->ipp_fields &= ~IPPF_LABEL_V4;
5529 }
5530 return (0);
5531 }
5532
5533 totallen <<= 2;
5534 opt = (uchar_t *)&ipha[1];
5535 if (!is_system_labeled()) {
5536
5537 copyall:
5538 if (!allocate) {
5539 if (totallen != 0) {
5540 ipp->ipp_ipv4_options = opt;
5541 ipp->ipp_ipv4_options_len = totallen;
5542 ipp->ipp_fields |= IPPF_IPV4_OPTIONS;
5543 }
5544 return (0);
5545 }
5546 /* Just copy all of options */
5547 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
5548 if (totallen == ipp->ipp_ipv4_options_len) {
5549 bcopy(opt, ipp->ipp_ipv4_options, totallen);
5550 return (0);
5551 }
5552 kmem_free(ipp->ipp_ipv4_options,
5553 ipp->ipp_ipv4_options_len);
5554 ipp->ipp_ipv4_options = NULL;
5555 ipp->ipp_ipv4_options_len = 0;
5556 ipp->ipp_fields &= ~IPPF_IPV4_OPTIONS;
5557 }
5558 if (totallen == 0)
5559 return (0);
5560
5561 ipp->ipp_ipv4_options = kmem_alloc(totallen, KM_NOSLEEP);
5562 if (ipp->ipp_ipv4_options == NULL)
5563 return (ENOMEM);
5564 ipp->ipp_ipv4_options_len = totallen;
5565 ipp->ipp_fields |= IPPF_IPV4_OPTIONS;
5566 bcopy(opt, ipp->ipp_ipv4_options, totallen);
5567 return (0);
5568 }
5569
5570 if (allocate && (ipp->ipp_fields & IPPF_LABEL_V4)) {
5571 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4);
5572 ipp->ipp_label_v4 = NULL;
5573 ipp->ipp_label_len_v4 = 0;
5574 ipp->ipp_fields &= ~IPPF_LABEL_V4;
5575 }
5576
5577 /*
5578 * Search for CIPSO option.
5579 * We assume CIPSO is first in options if it is present.
5580 * If it isn't, then ipp_opt_ipv4_options will not include the options
5581 * prior to the CIPSO option.
5582 */
5583 while (totallen != 0) {
5584 switch (optval = opt[IPOPT_OPTVAL]) {
5585 case IPOPT_EOL:
5586 return (0);
5587 case IPOPT_NOP:
5588 optlen = 1;
5589 break;
5590 default:
5591 if (totallen <= IPOPT_OLEN)
5592 return (EINVAL);
5593 optlen = opt[IPOPT_OLEN];
5594 if (optlen < 2)
5595 return (EINVAL);
5596 }
5597 if (optlen > totallen)
5598 return (EINVAL);
5599
5600 switch (optval) {
5601 case IPOPT_COMSEC:
5602 if (!allocate) {
5603 ipp->ipp_label_v4 = opt;
5604 ipp->ipp_label_len_v4 = optlen;
5605 ipp->ipp_fields |= IPPF_LABEL_V4;
5606 } else {
5607 ipp->ipp_label_v4 = kmem_alloc(optlen,
5608 KM_NOSLEEP);
5609 if (ipp->ipp_label_v4 == NULL)
5610 return (ENOMEM);
5611 ipp->ipp_label_len_v4 = optlen;
5612 ipp->ipp_fields |= IPPF_LABEL_V4;
5613 bcopy(opt, ipp->ipp_label_v4, optlen);
5614 }
5615 totallen -= optlen;
5616 opt += optlen;
5617
5618 /* Skip padding bytes until we get to a multiple of 4 */
5619 while ((totallen & 3) != 0 && opt[0] == IPOPT_NOP) {
5620 totallen--;
5621 opt++;
5622 }
5623 /* Remaining as ipp_ipv4_options */
5624 goto copyall;
5625 }
5626 totallen -= optlen;
5627 opt += optlen;
5628 }
5629 /* No CIPSO found; return everything as ipp_ipv4_options */
5630 totallen = ipha->ipha_version_and_hdr_length -
5631 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
5632 totallen <<= 2;
5633 opt = (uchar_t *)&ipha[1];
5634 goto copyall;
5635 }
5636
5637 /*
5638 * Efficient versions of lookup for an IRE when we only
5639 * match the address.
5640 * For RTF_REJECT or BLACKHOLE we return IRE_NOROUTE.
5641 * Does not handle multicast addresses.
5642 */
5643 uint_t
5644 ip_type_v4(ipaddr_t addr, ip_stack_t *ipst)
5645 {
5646 ire_t *ire;
5647 uint_t result;
5648
5649 ire = ire_ftable_lookup_simple_v4(addr, 0, ipst, NULL);
5650 ASSERT(ire != NULL);
5651 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))
5652 result = IRE_NOROUTE;
5653 else
5654 result = ire->ire_type;
5655 ire_refrele(ire);
5656 return (result);
5657 }
5658
5659 /*
5660 * Efficient versions of lookup for an IRE when we only
5661 * match the address.
5662 * For RTF_REJECT or BLACKHOLE we return IRE_NOROUTE.
5663 * Does not handle multicast addresses.
5664 */
5665 uint_t
5666 ip_type_v6(const in6_addr_t *addr, ip_stack_t *ipst)
5667 {
5668 ire_t *ire;
5669 uint_t result;
5670
5671 ire = ire_ftable_lookup_simple_v6(addr, 0, ipst, NULL);
5672 ASSERT(ire != NULL);
5673 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))
5674 result = IRE_NOROUTE;
5675 else
5676 result = ire->ire_type;
5677 ire_refrele(ire);
5678 return (result);
5679 }
5680
5681 /*
5682 * Nobody should be sending
5683 * packets up this stream
5684 */
5685 static void
5686 ip_lrput(queue_t *q, mblk_t *mp)
5687 {
5688 switch (mp->b_datap->db_type) {
5689 case M_FLUSH:
5690 /* Turn around */
5691 if (*mp->b_rptr & FLUSHW) {
5692 *mp->b_rptr &= ~FLUSHR;
5693 qreply(q, mp);
5694 return;
5695 }
5696 break;
5697 }
5698 freemsg(mp);
5699 }
5700
5701 /* Nobody should be sending packets down this stream */
5702 /* ARGSUSED */
5703 void
5704 ip_lwput(queue_t *q, mblk_t *mp)
5705 {
5706 freemsg(mp);
5707 }
5708
5709 /*
5710 * Move the first hop in any source route to ipha_dst and remove that part of
5711 * the source route. Called by other protocols. Errors in option formatting
5712 * are ignored - will be handled by ip_output_options. Return the final
5713 * destination (either ipha_dst or the last entry in a source route.)
5714 */
5715 ipaddr_t
5716 ip_massage_options(ipha_t *ipha, netstack_t *ns)
5717 {
5718 ipoptp_t opts;
5719 uchar_t *opt;
5720 uint8_t optval;
5721 uint8_t optlen;
5722 ipaddr_t dst;
5723 int i;
5724 ip_stack_t *ipst = ns->netstack_ip;
5725
5726 ip2dbg(("ip_massage_options\n"));
5727 dst = ipha->ipha_dst;
5728 for (optval = ipoptp_first(&opts, ipha);
5729 optval != IPOPT_EOL;
5730 optval = ipoptp_next(&opts)) {
5731 opt = opts.ipoptp_cur;
5732 switch (optval) {
5733 uint8_t off;
5734 case IPOPT_SSRR:
5735 case IPOPT_LSRR:
5736 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
5737 ip1dbg(("ip_massage_options: bad src route\n"));
5738 break;
5739 }
5740 optlen = opts.ipoptp_len;
5741 off = opt[IPOPT_OFFSET];
5742 off--;
5743 redo_srr:
5744 if (optlen < IP_ADDR_LEN ||
5745 off > optlen - IP_ADDR_LEN) {
5746 /* End of source route */
5747 ip1dbg(("ip_massage_options: end of SR\n"));
5748 break;
5749 }
5750 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
5751 ip1dbg(("ip_massage_options: next hop 0x%x\n",
5752 ntohl(dst)));
5753 /*
5754 * Check if our address is present more than
5755 * once as consecutive hops in source route.
5756 * XXX verify per-interface ip_forwarding
5757 * for source route?
5758 */
5759 if (ip_type_v4(dst, ipst) == IRE_LOCAL) {
5760 off += IP_ADDR_LEN;
5761 goto redo_srr;
5762 }
5763 if (dst == htonl(INADDR_LOOPBACK)) {
5764 ip1dbg(("ip_massage_options: loopback addr in "
5765 "source route!\n"));
5766 break;
5767 }
5768 /*
5769 * Update ipha_dst to be the first hop and remove the
5770 * first hop from the source route (by overwriting
5771 * part of the option with NOP options).
5772 */
5773 ipha->ipha_dst = dst;
5774 /* Put the last entry in dst */
5775 off = ((optlen - IP_ADDR_LEN - 3) & ~(IP_ADDR_LEN-1)) +
5776 3;
5777 bcopy(&opt[off], &dst, IP_ADDR_LEN);
5778
5779 ip1dbg(("ip_massage_options: last hop 0x%x\n",
5780 ntohl(dst)));
5781 /* Move down and overwrite */
5782 opt[IP_ADDR_LEN] = opt[0];
5783 opt[IP_ADDR_LEN+1] = opt[IPOPT_OLEN] - IP_ADDR_LEN;
5784 opt[IP_ADDR_LEN+2] = opt[IPOPT_OFFSET];
5785 for (i = 0; i < IP_ADDR_LEN; i++)
5786 opt[i] = IPOPT_NOP;
5787 break;
5788 }
5789 }
5790 return (dst);
5791 }
5792
5793 /*
5794 * Return the network mask
5795 * associated with the specified address.
5796 */
5797 ipaddr_t
5798 ip_net_mask(ipaddr_t addr)
5799 {
5800 uchar_t *up = (uchar_t *)&addr;
5801 ipaddr_t mask = 0;
5802 uchar_t *maskp = (uchar_t *)&mask;
5803
5804 #if defined(__i386) || defined(__amd64)
5805 #define TOTALLY_BRAIN_DAMAGED_C_COMPILER
5806 #endif
5807 #ifdef TOTALLY_BRAIN_DAMAGED_C_COMPILER
5808 maskp[0] = maskp[1] = maskp[2] = maskp[3] = 0;
5809 #endif
5810 if (CLASSD(addr)) {
5811 maskp[0] = 0xF0;
5812 return (mask);
5813 }
5814
5815 /* We assume Class E default netmask to be 32 */
5816 if (CLASSE(addr))
5817 return (0xffffffffU);
5818
5819 if (addr == 0)
5820 return (0);
5821 maskp[0] = 0xFF;
5822 if ((up[0] & 0x80) == 0)
5823 return (mask);
5824
5825 maskp[1] = 0xFF;
5826 if ((up[0] & 0xC0) == 0x80)
5827 return (mask);
5828
5829 maskp[2] = 0xFF;
5830 if ((up[0] & 0xE0) == 0xC0)
5831 return (mask);
5832
5833 /* Otherwise return no mask */
5834 return ((ipaddr_t)0);
5835 }
5836
5837 /* Name/Value Table Lookup Routine */
5838 char *
5839 ip_nv_lookup(nv_t *nv, int value)
5840 {
5841 if (!nv)
5842 return (NULL);
5843 for (; nv->nv_name; nv++) {
5844 if (nv->nv_value == value)
5845 return (nv->nv_name);
5846 }
5847 return ("unknown");
5848 }
5849
5850 static int
5851 ip_wait_for_info_ack(ill_t *ill)
5852 {
5853 int err;
5854
5855 mutex_enter(&ill->ill_lock);
5856 while (ill->ill_state_flags & ILL_LL_SUBNET_PENDING) {
5857 /*
5858 * Return value of 0 indicates a pending signal.
5859 */
5860 err = cv_wait_sig(&ill->ill_cv, &ill->ill_lock);
5861 if (err == 0) {
5862 mutex_exit(&ill->ill_lock);
5863 return (EINTR);
5864 }
5865 }
5866 mutex_exit(&ill->ill_lock);
5867 /*
5868 * ip_rput_other could have set an error in ill_error on
5869 * receipt of M_ERROR.
5870 */
5871 return (ill->ill_error);
5872 }
5873
5874 /*
5875 * This is a module open, i.e. this is a control stream for access
5876 * to a DLPI device. We allocate an ill_t as the instance data in
5877 * this case.
5878 */
5879 static int
5880 ip_modopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
5881 {
5882 ill_t *ill;
5883 int err;
5884 zoneid_t zoneid;
5885 netstack_t *ns;
5886 ip_stack_t *ipst;
5887
5888 /*
5889 * Prevent unprivileged processes from pushing IP so that
5890 * they can't send raw IP.
5891 */
5892 if (secpolicy_net_rawaccess(credp) != 0)
5893 return (EPERM);
5894
5895 ns = netstack_find_by_cred(credp);
5896 ASSERT(ns != NULL);
5897 ipst = ns->netstack_ip;
5898 ASSERT(ipst != NULL);
5899
5900 /*
5901 * For exclusive stacks we set the zoneid to zero
5902 * to make IP operate as if in the global zone.
5903 */
5904 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID)
5905 zoneid = GLOBAL_ZONEID;
5906 else
5907 zoneid = crgetzoneid(credp);
5908
5909 ill = (ill_t *)mi_open_alloc_sleep(sizeof (ill_t));
5910 q->q_ptr = WR(q)->q_ptr = ill;
5911 ill->ill_ipst = ipst;
5912 ill->ill_zoneid = zoneid;
5913
5914 /*
5915 * ill_init initializes the ill fields and then sends down
5916 * down a DL_INFO_REQ after calling qprocson.
5917 */
5918 err = ill_init(q, ill);
5919
5920 if (err != 0) {
5921 mi_free(ill);
5922 netstack_rele(ipst->ips_netstack);
5923 q->q_ptr = NULL;
5924 WR(q)->q_ptr = NULL;
5925 return (err);
5926 }
5927
5928 /*
5929 * Wait for the DL_INFO_ACK if a DL_INFO_REQ was sent.
5930 *
5931 * ill_init initializes the ipsq marking this thread as
5932 * writer
5933 */
5934 ipsq_exit(ill->ill_phyint->phyint_ipsq);
5935 err = ip_wait_for_info_ack(ill);
5936 if (err == 0)
5937 ill->ill_credp = credp;
5938 else
5939 goto fail;
5940
5941 crhold(credp);
5942
5943 mutex_enter(&ipst->ips_ip_mi_lock);
5944 err = mi_open_link(&ipst->ips_ip_g_head, (IDP)q->q_ptr, devp, flag,
5945 sflag, credp);
5946 mutex_exit(&ipst->ips_ip_mi_lock);
5947 fail:
5948 if (err) {
5949 (void) ip_close(q, 0);
5950 return (err);
5951 }
5952 return (0);
5953 }
5954
5955 /* For /dev/ip aka AF_INET open */
5956 int
5957 ip_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
5958 {
5959 return (ip_open(q, devp, flag, sflag, credp, B_FALSE));
5960 }
5961
5962 /* For /dev/ip6 aka AF_INET6 open */
5963 int
5964 ip_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
5965 {
5966 return (ip_open(q, devp, flag, sflag, credp, B_TRUE));
5967 }
5968
5969 /* IP open routine. */
5970 int
5971 ip_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
5972 boolean_t isv6)
5973 {
5974 conn_t *connp;
5975 major_t maj;
5976 zoneid_t zoneid;
5977 netstack_t *ns;
5978 ip_stack_t *ipst;
5979
5980 /* Allow reopen. */
5981 if (q->q_ptr != NULL)
5982 return (0);
5983
5984 if (sflag & MODOPEN) {
5985 /* This is a module open */
5986 return (ip_modopen(q, devp, flag, sflag, credp));
5987 }
5988
5989 if ((flag & ~(FKLYR)) == IP_HELPER_STR) {
5990 /*
5991 * Non streams based socket looking for a stream
5992 * to access IP
5993 */
5994 return (ip_helper_stream_setup(q, devp, flag, sflag,
5995 credp, isv6));
5996 }
5997
5998 ns = netstack_find_by_cred(credp);
5999 ASSERT(ns != NULL);
6000 ipst = ns->netstack_ip;
6001 ASSERT(ipst != NULL);
6002
6003 /*
6004 * For exclusive stacks we set the zoneid to zero
6005 * to make IP operate as if in the global zone.
6006 */
6007 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID)
6008 zoneid = GLOBAL_ZONEID;
6009 else
6010 zoneid = crgetzoneid(credp);
6011
6012 /*
6013 * We are opening as a device. This is an IP client stream, and we
6014 * allocate an conn_t as the instance data.
6015 */
6016 connp = ipcl_conn_create(IPCL_IPCCONN, KM_SLEEP, ipst->ips_netstack);
6017
6018 /*
6019 * ipcl_conn_create did a netstack_hold. Undo the hold that was
6020 * done by netstack_find_by_cred()
6021 */
6022 netstack_rele(ipst->ips_netstack);
6023
6024 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
6025 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
6026 connp->conn_ixa->ixa_zoneid = zoneid;
6027 connp->conn_zoneid = zoneid;
6028
6029 connp->conn_rq = q;
6030 q->q_ptr = WR(q)->q_ptr = connp;
6031
6032 /* Minor tells us which /dev entry was opened */
6033 if (isv6) {
6034 connp->conn_family = AF_INET6;
6035 connp->conn_ipversion = IPV6_VERSION;
6036 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
6037 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT;
6038 } else {
6039 connp->conn_family = AF_INET;
6040 connp->conn_ipversion = IPV4_VERSION;
6041 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
6042 }
6043
6044 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
6045 ((connp->conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
6046 connp->conn_minor_arena = ip_minor_arena_la;
6047 } else {
6048 /*
6049 * Either minor numbers in the large arena were exhausted
6050 * or a non socket application is doing the open.
6051 * Try to allocate from the small arena.
6052 */
6053 if ((connp->conn_dev =
6054 inet_minor_alloc(ip_minor_arena_sa)) == 0) {
6055 /* CONN_DEC_REF takes care of netstack_rele() */
6056 q->q_ptr = WR(q)->q_ptr = NULL;
6057 CONN_DEC_REF(connp);
6058 return (EBUSY);
6059 }
6060 connp->conn_minor_arena = ip_minor_arena_sa;
6061 }
6062
6063 maj = getemajor(*devp);
6064 *devp = makedevice(maj, (minor_t)connp->conn_dev);
6065
6066 /*
6067 * connp->conn_cred is crfree()ed in ipcl_conn_destroy()
6068 */
6069 connp->conn_cred = credp;
6070 connp->conn_cpid = curproc->p_pid;
6071 /* Cache things in ixa without an extra refhold */
6072 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
6073 connp->conn_ixa->ixa_cred = connp->conn_cred;
6074 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
6075 if (is_system_labeled())
6076 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
6077
6078 /*
6079 * Handle IP_IOC_RTS_REQUEST and other ioctls which use conn_recv
6080 */
6081 connp->conn_recv = ip_conn_input;
6082 connp->conn_recvicmp = ip_conn_input_icmp;
6083
6084 crhold(connp->conn_cred);
6085
6086 /*
6087 * If the caller has the process-wide flag set, then default to MAC
6088 * exempt mode. This allows read-down to unlabeled hosts.
6089 */
6090 if (getpflags(NET_MAC_AWARE, credp) != 0)
6091 connp->conn_mac_mode = CONN_MAC_AWARE;
6092
6093 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
6094
6095 connp->conn_rq = q;
6096 connp->conn_wq = WR(q);
6097
6098 /* Non-zero default values */
6099 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP;
6100
6101 /*
6102 * Make the conn globally visible to walkers
6103 */
6104 ASSERT(connp->conn_ref == 1);
6105 mutex_enter(&connp->conn_lock);
6106 connp->conn_state_flags &= ~CONN_INCIPIENT;
6107 mutex_exit(&connp->conn_lock);
6108
6109 qprocson(q);
6110
6111 return (0);
6112 }
6113
6114 /*
6115 * Set IPsec policy from an ipsec_req_t. If the req is not "zero" and valid,
6116 * all of them are copied to the conn_t. If the req is "zero", the policy is
6117 * zeroed out. A "zero" policy has zero ipsr_{ah,req,self_encap}_req
6118 * fields.
6119 * We keep only the latest setting of the policy and thus policy setting
6120 * is not incremental/cumulative.
6121 *
6122 * Requests to set policies with multiple alternative actions will
6123 * go through a different API.
6124 */
6125 int
6126 ipsec_set_req(cred_t *cr, conn_t *connp, ipsec_req_t *req)
6127 {
6128 uint_t ah_req = 0;
6129 uint_t esp_req = 0;
6130 uint_t se_req = 0;
6131 ipsec_act_t *actp = NULL;
6132 uint_t nact;
6133 ipsec_policy_head_t *ph;
6134 boolean_t is_pol_reset, is_pol_inserted = B_FALSE;
6135 int error = 0;
6136 netstack_t *ns = connp->conn_netstack;
6137 ip_stack_t *ipst = ns->netstack_ip;
6138 ipsec_stack_t *ipss = ns->netstack_ipsec;
6139
6140 #define REQ_MASK (IPSEC_PREF_REQUIRED|IPSEC_PREF_NEVER)
6141
6142 /*
6143 * The IP_SEC_OPT option does not allow variable length parameters,
6144 * hence a request cannot be NULL.
6145 */
6146 if (req == NULL)
6147 return (EINVAL);
6148
6149 ah_req = req->ipsr_ah_req;
6150 esp_req = req->ipsr_esp_req;
6151 se_req = req->ipsr_self_encap_req;
6152
6153 /* Don't allow setting self-encap without one or more of AH/ESP. */
6154 if (se_req != 0 && esp_req == 0 && ah_req == 0)
6155 return (EINVAL);
6156
6157 /*
6158 * Are we dealing with a request to reset the policy (i.e.
6159 * zero requests).
6160 */
6161 is_pol_reset = ((ah_req & REQ_MASK) == 0 &&
6162 (esp_req & REQ_MASK) == 0 &&
6163 (se_req & REQ_MASK) == 0);
6164
6165 if (!is_pol_reset) {
6166 /*
6167 * If we couldn't load IPsec, fail with "protocol
6168 * not supported".
6169 * IPsec may not have been loaded for a request with zero
6170 * policies, so we don't fail in this case.
6171 */
6172 mutex_enter(&ipss->ipsec_loader_lock);
6173 if (ipss->ipsec_loader_state != IPSEC_LOADER_SUCCEEDED) {
6174 mutex_exit(&ipss->ipsec_loader_lock);
6175 return (EPROTONOSUPPORT);
6176 }
6177 mutex_exit(&ipss->ipsec_loader_lock);
6178
6179 /*
6180 * Test for valid requests. Invalid algorithms
6181 * need to be tested by IPsec code because new
6182 * algorithms can be added dynamically.
6183 */
6184 if ((ah_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 ||
6185 (esp_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 ||
6186 (se_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0) {
6187 return (EINVAL);
6188 }
6189
6190 /*
6191 * Only privileged users can issue these
6192 * requests.
6193 */
6194 if (((ah_req & IPSEC_PREF_NEVER) ||
6195 (esp_req & IPSEC_PREF_NEVER) ||
6196 (se_req & IPSEC_PREF_NEVER)) &&
6197 secpolicy_ip_config(cr, B_FALSE) != 0) {
6198 return (EPERM);
6199 }
6200
6201 /*
6202 * The IPSEC_PREF_REQUIRED and IPSEC_PREF_NEVER
6203 * are mutually exclusive.
6204 */
6205 if (((ah_req & REQ_MASK) == REQ_MASK) ||
6206 ((esp_req & REQ_MASK) == REQ_MASK) ||
6207 ((se_req & REQ_MASK) == REQ_MASK)) {
6208 /* Both of them are set */
6209 return (EINVAL);
6210 }
6211 }
6212
6213 ASSERT(MUTEX_HELD(&connp->conn_lock));
6214
6215 /*
6216 * If we have already cached policies in conn_connect(), don't
6217 * let them change now. We cache policies for connections
6218 * whose src,dst [addr, port] is known.
6219 */
6220 if (connp->conn_policy_cached) {
6221 return (EINVAL);
6222 }
6223
6224 /*
6225 * We have a zero policies, reset the connection policy if already
6226 * set. This will cause the connection to inherit the
6227 * global policy, if any.
6228 */
6229 if (is_pol_reset) {
6230 if (connp->conn_policy != NULL) {
6231 IPPH_REFRELE(connp->conn_policy, ipst->ips_netstack);
6232 connp->conn_policy = NULL;
6233 }
6234 connp->conn_in_enforce_policy = B_FALSE;
6235 connp->conn_out_enforce_policy = B_FALSE;
6236 return (0);
6237 }
6238
6239 ph = connp->conn_policy = ipsec_polhead_split(connp->conn_policy,
6240 ipst->ips_netstack);
6241 if (ph == NULL)
6242 goto enomem;
6243
6244 ipsec_actvec_from_req(req, &actp, &nact, ipst->ips_netstack);
6245 if (actp == NULL)
6246 goto enomem;
6247
6248 /*
6249 * Always insert IPv4 policy entries, since they can also apply to
6250 * ipv6 sockets being used in ipv4-compat mode.
6251 */
6252 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V4,
6253 IPSEC_TYPE_INBOUND, ns))
6254 goto enomem;
6255 is_pol_inserted = B_TRUE;
6256 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V4,
6257 IPSEC_TYPE_OUTBOUND, ns))
6258 goto enomem;
6259
6260 /*
6261 * We're looking at a v6 socket, also insert the v6-specific
6262 * entries.
6263 */
6264 if (connp->conn_family == AF_INET6) {
6265 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V6,
6266 IPSEC_TYPE_INBOUND, ns))
6267 goto enomem;
6268 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V6,
6269 IPSEC_TYPE_OUTBOUND, ns))
6270 goto enomem;
6271 }
6272
6273 ipsec_actvec_free(actp, nact);
6274
6275 /*
6276 * If the requests need security, set enforce_policy.
6277 * If the requests are IPSEC_PREF_NEVER, one should
6278 * still set conn_out_enforce_policy so that ip_set_destination
6279 * marks the ip_xmit_attr_t appropriatly. This is needed so that
6280 * for connections that we don't cache policy in at connect time,
6281 * if global policy matches in ip_output_attach_policy, we
6282 * don't wrongly inherit global policy. Similarly, we need
6283 * to set conn_in_enforce_policy also so that we don't verify
6284 * policy wrongly.
6285 */
6286 if ((ah_req & REQ_MASK) != 0 ||
6287 (esp_req & REQ_MASK) != 0 ||
6288 (se_req & REQ_MASK) != 0) {
6289 connp->conn_in_enforce_policy = B_TRUE;
6290 connp->conn_out_enforce_policy = B_TRUE;
6291 }
6292
6293 return (error);
6294 #undef REQ_MASK
6295
6296 /*
6297 * Common memory-allocation-failure exit path.
6298 */
6299 enomem:
6300 if (actp != NULL)
6301 ipsec_actvec_free(actp, nact);
6302 if (is_pol_inserted)
6303 ipsec_polhead_flush(ph, ns);
6304 return (ENOMEM);
6305 }
6306
6307 /*
6308 * Set socket options for joining and leaving multicast groups.
6309 * Common to IPv4 and IPv6; inet6 indicates the type of socket.
6310 * The caller has already check that the option name is consistent with
6311 * the address family of the socket.
6312 */
6313 int
6314 ip_opt_set_multicast_group(conn_t *connp, t_scalar_t name,
6315 uchar_t *invalp, boolean_t inet6, boolean_t checkonly)
6316 {
6317 int *i1 = (int *)invalp;
6318 int error = 0;
6319 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
6320 struct ip_mreq *v4_mreqp;
6321 struct ipv6_mreq *v6_mreqp;
6322 struct group_req *greqp;
6323 ire_t *ire;
6324 boolean_t done = B_FALSE;
6325 ipaddr_t ifaddr;
6326 in6_addr_t v6group;
6327 uint_t ifindex;
6328 boolean_t mcast_opt = B_TRUE;
6329 mcast_record_t fmode;
6330 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *,
6331 ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *);
6332
6333 switch (name) {
6334 case IP_ADD_MEMBERSHIP:
6335 case IPV6_JOIN_GROUP:
6336 mcast_opt = B_FALSE;
6337 /* FALLTHRU */
6338 case MCAST_JOIN_GROUP:
6339 fmode = MODE_IS_EXCLUDE;
6340 optfn = ip_opt_add_group;
6341 break;
6342
6343 case IP_DROP_MEMBERSHIP:
6344 case IPV6_LEAVE_GROUP:
6345 mcast_opt = B_FALSE;
6346 /* FALLTHRU */
6347 case MCAST_LEAVE_GROUP:
6348 fmode = MODE_IS_INCLUDE;
6349 optfn = ip_opt_delete_group;
6350 break;
6351 default:
6352 ASSERT(0);
6353 }
6354
6355 if (mcast_opt) {
6356 struct sockaddr_in *sin;
6357 struct sockaddr_in6 *sin6;
6358
6359 greqp = (struct group_req *)i1;
6360 if (greqp->gr_group.ss_family == AF_INET) {
6361 sin = (struct sockaddr_in *)&(greqp->gr_group);
6362 IN6_INADDR_TO_V4MAPPED(&sin->sin_addr, &v6group);
6363 } else {
6364 if (!inet6)
6365 return (EINVAL); /* Not on INET socket */
6366
6367 sin6 = (struct sockaddr_in6 *)&(greqp->gr_group);
6368 v6group = sin6->sin6_addr;
6369 }
6370 ifaddr = INADDR_ANY;
6371 ifindex = greqp->gr_interface;
6372 } else if (inet6) {
6373 v6_mreqp = (struct ipv6_mreq *)i1;
6374 v6group = v6_mreqp->ipv6mr_multiaddr;
6375 ifaddr = INADDR_ANY;
6376 ifindex = v6_mreqp->ipv6mr_interface;
6377 } else {
6378 v4_mreqp = (struct ip_mreq *)i1;
6379 IN6_INADDR_TO_V4MAPPED(&v4_mreqp->imr_multiaddr, &v6group);
6380 ifaddr = (ipaddr_t)v4_mreqp->imr_interface.s_addr;
6381 ifindex = 0;
6382 }
6383
6384 /*
6385 * In the multirouting case, we need to replicate
6386 * the request on all interfaces that will take part
6387 * in replication. We do so because multirouting is
6388 * reflective, thus we will probably receive multi-
6389 * casts on those interfaces.
6390 * The ip_multirt_apply_membership() succeeds if
6391 * the operation succeeds on at least one interface.
6392 */
6393 if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
6394 ipaddr_t group;
6395
6396 IN6_V4MAPPED_TO_IPADDR(&v6group, group);
6397
6398 ire = ire_ftable_lookup_v4(group, IP_HOST_MASK, 0,
6399 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6400 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6401 } else {
6402 ire = ire_ftable_lookup_v6(&v6group, &ipv6_all_ones, 0,
6403 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6404 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6405 }
6406 if (ire != NULL) {
6407 if (ire->ire_flags & RTF_MULTIRT) {
6408 error = ip_multirt_apply_membership(optfn, ire, connp,
6409 checkonly, &v6group, fmode, &ipv6_all_zeros);
6410 done = B_TRUE;
6411 }
6412 ire_refrele(ire);
6413 }
6414
6415 if (!done) {
6416 error = optfn(connp, checkonly, &v6group, ifaddr, ifindex,
6417 fmode, &ipv6_all_zeros);
6418 }
6419 return (error);
6420 }
6421
6422 /*
6423 * Set socket options for joining and leaving multicast groups
6424 * for specific sources.
6425 * Common to IPv4 and IPv6; inet6 indicates the type of socket.
6426 * The caller has already check that the option name is consistent with
6427 * the address family of the socket.
6428 */
6429 int
6430 ip_opt_set_multicast_sources(conn_t *connp, t_scalar_t name,
6431 uchar_t *invalp, boolean_t inet6, boolean_t checkonly)
6432 {
6433 int *i1 = (int *)invalp;
6434 int error = 0;
6435 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
6436 struct ip_mreq_source *imreqp;
6437 struct group_source_req *gsreqp;
6438 in6_addr_t v6group, v6src;
6439 uint32_t ifindex;
6440 ipaddr_t ifaddr;
6441 boolean_t mcast_opt = B_TRUE;
6442 mcast_record_t fmode;
6443 ire_t *ire;
6444 boolean_t done = B_FALSE;
6445 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *,
6446 ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *);
6447
6448 switch (name) {
6449 case IP_BLOCK_SOURCE:
6450 mcast_opt = B_FALSE;
6451 /* FALLTHRU */
6452 case MCAST_BLOCK_SOURCE:
6453 fmode = MODE_IS_EXCLUDE;
6454 optfn = ip_opt_add_group;
6455 break;
6456
6457 case IP_UNBLOCK_SOURCE:
6458 mcast_opt = B_FALSE;
6459 /* FALLTHRU */
6460 case MCAST_UNBLOCK_SOURCE:
6461 fmode = MODE_IS_EXCLUDE;
6462 optfn = ip_opt_delete_group;
6463 break;
6464
6465 case IP_ADD_SOURCE_MEMBERSHIP:
6466 mcast_opt = B_FALSE;
6467 /* FALLTHRU */
6468 case MCAST_JOIN_SOURCE_GROUP:
6469 fmode = MODE_IS_INCLUDE;
6470 optfn = ip_opt_add_group;
6471 break;
6472
6473 case IP_DROP_SOURCE_MEMBERSHIP:
6474 mcast_opt = B_FALSE;
6475 /* FALLTHRU */
6476 case MCAST_LEAVE_SOURCE_GROUP:
6477 fmode = MODE_IS_INCLUDE;
6478 optfn = ip_opt_delete_group;
6479 break;
6480 default:
6481 ASSERT(0);
6482 }
6483
6484 if (mcast_opt) {
6485 gsreqp = (struct group_source_req *)i1;
6486 ifindex = gsreqp->gsr_interface;
6487 if (gsreqp->gsr_group.ss_family == AF_INET) {
6488 struct sockaddr_in *s;
6489 s = (struct sockaddr_in *)&gsreqp->gsr_group;
6490 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6group);
6491 s = (struct sockaddr_in *)&gsreqp->gsr_source;
6492 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6src);
6493 } else {
6494 struct sockaddr_in6 *s6;
6495
6496 if (!inet6)
6497 return (EINVAL); /* Not on INET socket */
6498
6499 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_group;
6500 v6group = s6->sin6_addr;
6501 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_source;
6502 v6src = s6->sin6_addr;
6503 }
6504 ifaddr = INADDR_ANY;
6505 } else {
6506 imreqp = (struct ip_mreq_source *)i1;
6507 IN6_INADDR_TO_V4MAPPED(&imreqp->imr_multiaddr, &v6group);
6508 IN6_INADDR_TO_V4MAPPED(&imreqp->imr_sourceaddr, &v6src);
6509 ifaddr = (ipaddr_t)imreqp->imr_interface.s_addr;
6510 ifindex = 0;
6511 }
6512
6513 /*
6514 * Handle src being mapped INADDR_ANY by changing it to unspecified.
6515 */
6516 if (IN6_IS_ADDR_V4MAPPED_ANY(&v6src))
6517 v6src = ipv6_all_zeros;
6518
6519 /*
6520 * In the multirouting case, we need to replicate
6521 * the request as noted in the mcast cases above.
6522 */
6523 if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
6524 ipaddr_t group;
6525
6526 IN6_V4MAPPED_TO_IPADDR(&v6group, group);
6527
6528 ire = ire_ftable_lookup_v4(group, IP_HOST_MASK, 0,
6529 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6530 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6531 } else {
6532 ire = ire_ftable_lookup_v6(&v6group, &ipv6_all_ones, 0,
6533 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6534 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6535 }
6536 if (ire != NULL) {
6537 if (ire->ire_flags & RTF_MULTIRT) {
6538 error = ip_multirt_apply_membership(optfn, ire, connp,
6539 checkonly, &v6group, fmode, &v6src);
6540 done = B_TRUE;
6541 }
6542 ire_refrele(ire);
6543 }
6544 if (!done) {
6545 error = optfn(connp, checkonly, &v6group, ifaddr, ifindex,
6546 fmode, &v6src);
6547 }
6548 return (error);
6549 }
6550
6551 /*
6552 * Given a destination address and a pointer to where to put the information
6553 * this routine fills in the mtuinfo.
6554 * The socket must be connected.
6555 * For sctp conn_faddr is the primary address.
6556 */
6557 int
6558 ip_fill_mtuinfo(conn_t *connp, ip_xmit_attr_t *ixa, struct ip6_mtuinfo *mtuinfo)
6559 {
6560 uint32_t pmtu = IP_MAXPACKET;
6561 uint_t scopeid;
6562
6563 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6))
6564 return (-1);
6565
6566 /* In case we never sent or called ip_set_destination_v4/v6 */
6567 if (ixa->ixa_ire != NULL)
6568 pmtu = ip_get_pmtu(ixa);
6569
6570 if (ixa->ixa_flags & IXAF_SCOPEID_SET)
6571 scopeid = ixa->ixa_scopeid;
6572 else
6573 scopeid = 0;
6574
6575 bzero(mtuinfo, sizeof (*mtuinfo));
6576 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
6577 mtuinfo->ip6m_addr.sin6_port = connp->conn_fport;
6578 mtuinfo->ip6m_addr.sin6_addr = connp->conn_faddr_v6;
6579 mtuinfo->ip6m_addr.sin6_scope_id = scopeid;
6580 mtuinfo->ip6m_mtu = pmtu;
6581
6582 return (sizeof (struct ip6_mtuinfo));
6583 }
6584
6585 /*
6586 * When the src multihoming is changed from weak to [strong, preferred]
6587 * ip_ire_rebind_walker is called to walk the list of all ire_t entries
6588 * and identify routes that were created by user-applications in the
6589 * unbound state (i.e., without RTA_IFP), and for which an ire_ill is not
6590 * currently defined. These routes are then 'rebound', i.e., their ire_ill
6591 * is selected by finding an interface route for the gateway.
6592 */
6593 /* ARGSUSED */
6594 void
6595 ip_ire_rebind_walker(ire_t *ire, void *notused)
6596 {
6597 if (!ire->ire_unbound || ire->ire_ill != NULL)
6598 return;
6599 ire_rebind(ire);
6600 ire_delete(ire);
6601 }
6602
6603 /*
6604 * When the src multihoming is changed from [strong, preferred] to weak,
6605 * ip_ire_unbind_walker is called to walk the list of all ire_t entries, and
6606 * set any entries that were created by user-applications in the unbound state
6607 * (i.e., without RTA_IFP) back to having a NULL ire_ill.
6608 */
6609 /* ARGSUSED */
6610 void
6611 ip_ire_unbind_walker(ire_t *ire, void *notused)
6612 {
6613 ire_t *new_ire;
6614
6615 if (!ire->ire_unbound || ire->ire_ill == NULL)
6616 return;
6617 if (ire->ire_ipversion == IPV6_VERSION) {
6618 new_ire = ire_create_v6(&ire->ire_addr_v6, &ire->ire_mask_v6,
6619 &ire->ire_gateway_addr_v6, ire->ire_type, NULL,
6620 ire->ire_zoneid, ire->ire_flags, NULL, ire->ire_ipst);
6621 } else {
6622 new_ire = ire_create((uchar_t *)&ire->ire_addr,
6623 (uchar_t *)&ire->ire_mask,
6624 (uchar_t *)&ire->ire_gateway_addr, ire->ire_type, NULL,
6625 ire->ire_zoneid, ire->ire_flags, NULL, ire->ire_ipst);
6626 }
6627 if (new_ire == NULL)
6628 return;
6629 new_ire->ire_unbound = B_TRUE;
6630 /*
6631 * The bound ire must first be deleted so that we don't return
6632 * the existing one on the attempt to add the unbound new_ire.
6633 */
6634 ire_delete(ire);
6635 new_ire = ire_add(new_ire);
6636 if (new_ire != NULL)
6637 ire_refrele(new_ire);
6638 }
6639
6640 /*
6641 * When the settings of ip*_strict_src_multihoming tunables are changed,
6642 * all cached routes need to be recomputed. This recomputation needs to be
6643 * done when going from weaker to stronger modes so that the cached ire
6644 * for the connection does not violate the current ip*_strict_src_multihoming
6645 * setting. It also needs to be done when going from stronger to weaker modes,
6646 * so that we fall back to matching on the longest-matching-route (as opposed
6647 * to a shorter match that may have been selected in the strong mode
6648 * to satisfy src_multihoming settings).
6649 *
6650 * The cached ixa_ire entires for all conn_t entries are marked as
6651 * "verify" so that they will be recomputed for the next packet.
6652 */
6653 void
6654 conn_ire_revalidate(conn_t *connp, void *arg)
6655 {
6656 boolean_t isv6 = (boolean_t)arg;
6657
6658 if ((isv6 && connp->conn_ipversion != IPV6_VERSION) ||
6659 (!isv6 && connp->conn_ipversion != IPV4_VERSION))
6660 return;
6661 connp->conn_ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
6662 }
6663
6664 /*
6665 * Handles both IPv4 and IPv6 reassembly - doing the out-of-order cases,
6666 * When an ipf is passed here for the first time, if
6667 * we already have in-order fragments on the queue, we convert from the fast-
6668 * path reassembly scheme to the hard-case scheme. From then on, additional
6669 * fragments are reassembled here. We keep track of the start and end offsets
6670 * of each piece, and the number of holes in the chain. When the hole count
6671 * goes to zero, we are done!
6672 *
6673 * The ipf_count will be updated to account for any mblk(s) added (pointed to
6674 * by mp) or subtracted (freeb()ed dups), upon return the caller must update
6675 * ipfb_count and ill_frag_count by the difference of ipf_count before and
6676 * after the call to ip_reassemble().
6677 */
6678 int
6679 ip_reassemble(mblk_t *mp, ipf_t *ipf, uint_t start, boolean_t more, ill_t *ill,
6680 size_t msg_len)
6681 {
6682 uint_t end;
6683 mblk_t *next_mp;
6684 mblk_t *mp1;
6685 uint_t offset;
6686 boolean_t incr_dups = B_TRUE;
6687 boolean_t offset_zero_seen = B_FALSE;
6688 boolean_t pkt_boundary_checked = B_FALSE;
6689
6690 /* If start == 0 then ipf_nf_hdr_len has to be set. */
6691 ASSERT(start != 0 || ipf->ipf_nf_hdr_len != 0);
6692
6693 /* Add in byte count */
6694 ipf->ipf_count += msg_len;
6695 if (ipf->ipf_end) {
6696 /*
6697 * We were part way through in-order reassembly, but now there
6698 * is a hole. We walk through messages already queued, and
6699 * mark them for hard case reassembly. We know that up till
6700 * now they were in order starting from offset zero.
6701 */
6702 offset = 0;
6703 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) {
6704 IP_REASS_SET_START(mp1, offset);
6705 if (offset == 0) {
6706 ASSERT(ipf->ipf_nf_hdr_len != 0);
6707 offset = -ipf->ipf_nf_hdr_len;
6708 }
6709 offset += mp1->b_wptr - mp1->b_rptr;
6710 IP_REASS_SET_END(mp1, offset);
6711 }
6712 /* One hole at the end. */
6713 ipf->ipf_hole_cnt = 1;
6714 /* Brand it as a hard case, forever. */
6715 ipf->ipf_end = 0;
6716 }
6717 /* Walk through all the new pieces. */
6718 do {
6719 end = start + (mp->b_wptr - mp->b_rptr);
6720 /*
6721 * If start is 0, decrease 'end' only for the first mblk of
6722 * the fragment. Otherwise 'end' can get wrong value in the
6723 * second pass of the loop if first mblk is exactly the
6724 * size of ipf_nf_hdr_len.
6725 */
6726 if (start == 0 && !offset_zero_seen) {
6727 /* First segment */
6728 ASSERT(ipf->ipf_nf_hdr_len != 0);
6729 end -= ipf->ipf_nf_hdr_len;
6730 offset_zero_seen = B_TRUE;
6731 }
6732 next_mp = mp->b_cont;
6733 /*
6734 * We are checking to see if there is any interesing data
6735 * to process. If there isn't and the mblk isn't the
6736 * one which carries the unfragmentable header then we
6737 * drop it. It's possible to have just the unfragmentable
6738 * header come through without any data. That needs to be
6739 * saved.
6740 *
6741 * If the assert at the top of this function holds then the
6742 * term "ipf->ipf_nf_hdr_len != 0" isn't needed. This code
6743 * is infrequently traveled enough that the test is left in
6744 * to protect against future code changes which break that
6745 * invariant.
6746 */
6747 if (start == end && start != 0 && ipf->ipf_nf_hdr_len != 0) {
6748 /* Empty. Blast it. */
6749 IP_REASS_SET_START(mp, 0);
6750 IP_REASS_SET_END(mp, 0);
6751 /*
6752 * If the ipf points to the mblk we are about to free,
6753 * update ipf to point to the next mblk (or NULL
6754 * if none).
6755 */
6756 if (ipf->ipf_mp->b_cont == mp)
6757 ipf->ipf_mp->b_cont = next_mp;
6758 freeb(mp);
6759 continue;
6760 }
6761 mp->b_cont = NULL;
6762 IP_REASS_SET_START(mp, start);
6763 IP_REASS_SET_END(mp, end);
6764 if (!ipf->ipf_tail_mp) {
6765 ipf->ipf_tail_mp = mp;
6766 ipf->ipf_mp->b_cont = mp;
6767 if (start == 0 || !more) {
6768 ipf->ipf_hole_cnt = 1;
6769 /*
6770 * if the first fragment comes in more than one
6771 * mblk, this loop will be executed for each
6772 * mblk. Need to adjust hole count so exiting
6773 * this routine will leave hole count at 1.
6774 */
6775 if (next_mp)
6776 ipf->ipf_hole_cnt++;
6777 } else
6778 ipf->ipf_hole_cnt = 2;
6779 continue;
6780 } else if (ipf->ipf_last_frag_seen && !more &&
6781 !pkt_boundary_checked) {
6782 /*
6783 * We check datagram boundary only if this fragment
6784 * claims to be the last fragment and we have seen a
6785 * last fragment in the past too. We do this only
6786 * once for a given fragment.
6787 *
6788 * start cannot be 0 here as fragments with start=0
6789 * and MF=0 gets handled as a complete packet. These
6790 * fragments should not reach here.
6791 */
6792
6793 if (start + msgdsize(mp) !=
6794 IP_REASS_END(ipf->ipf_tail_mp)) {
6795 /*
6796 * We have two fragments both of which claim
6797 * to be the last fragment but gives conflicting
6798 * information about the whole datagram size.
6799 * Something fishy is going on. Drop the
6800 * fragment and free up the reassembly list.
6801 */
6802 return (IP_REASS_FAILED);
6803 }
6804
6805 /*
6806 * We shouldn't come to this code block again for this
6807 * particular fragment.
6808 */
6809 pkt_boundary_checked = B_TRUE;
6810 }
6811
6812 /* New stuff at or beyond tail? */
6813 offset = IP_REASS_END(ipf->ipf_tail_mp);
6814 if (start >= offset) {
6815 if (ipf->ipf_last_frag_seen) {
6816 /* current fragment is beyond last fragment */
6817 return (IP_REASS_FAILED);
6818 }
6819 /* Link it on end. */
6820 ipf->ipf_tail_mp->b_cont = mp;
6821 ipf->ipf_tail_mp = mp;
6822 if (more) {
6823 if (start != offset)
6824 ipf->ipf_hole_cnt++;
6825 } else if (start == offset && next_mp == NULL)
6826 ipf->ipf_hole_cnt--;
6827 continue;
6828 }
6829 mp1 = ipf->ipf_mp->b_cont;
6830 offset = IP_REASS_START(mp1);
6831 /* New stuff at the front? */
6832 if (start < offset) {
6833 if (start == 0) {
6834 if (end >= offset) {
6835 /* Nailed the hole at the begining. */
6836 ipf->ipf_hole_cnt--;
6837 }
6838 } else if (end < offset) {
6839 /*
6840 * A hole, stuff, and a hole where there used
6841 * to be just a hole.
6842 */
6843 ipf->ipf_hole_cnt++;
6844 }
6845 mp->b_cont = mp1;
6846 /* Check for overlap. */
6847 while (end > offset) {
6848 if (end < IP_REASS_END(mp1)) {
6849 mp->b_wptr -= end - offset;
6850 IP_REASS_SET_END(mp, offset);
6851 BUMP_MIB(ill->ill_ip_mib,
6852 ipIfStatsReasmPartDups);
6853 break;
6854 }
6855 /* Did we cover another hole? */
6856 if ((mp1->b_cont &&
6857 IP_REASS_END(mp1) !=
6858 IP_REASS_START(mp1->b_cont) &&
6859 end >= IP_REASS_START(mp1->b_cont)) ||
6860 (!ipf->ipf_last_frag_seen && !more)) {
6861 ipf->ipf_hole_cnt--;
6862 }
6863 /* Clip out mp1. */
6864 if ((mp->b_cont = mp1->b_cont) == NULL) {
6865 /*
6866 * After clipping out mp1, this guy
6867 * is now hanging off the end.
6868 */
6869 ipf->ipf_tail_mp = mp;
6870 }
6871 IP_REASS_SET_START(mp1, 0);
6872 IP_REASS_SET_END(mp1, 0);
6873 /* Subtract byte count */
6874 ipf->ipf_count -= mp1->b_datap->db_lim -
6875 mp1->b_datap->db_base;
6876 freeb(mp1);
6877 BUMP_MIB(ill->ill_ip_mib,
6878 ipIfStatsReasmPartDups);
6879 mp1 = mp->b_cont;
6880 if (!mp1)
6881 break;
6882 offset = IP_REASS_START(mp1);
6883 }
6884 ipf->ipf_mp->b_cont = mp;
6885 continue;
6886 }
6887 /*
6888 * The new piece starts somewhere between the start of the head
6889 * and before the end of the tail.
6890 */
6891 for (; mp1; mp1 = mp1->b_cont) {
6892 offset = IP_REASS_END(mp1);
6893 if (start < offset) {
6894 if (end <= offset) {
6895 /* Nothing new. */
6896 IP_REASS_SET_START(mp, 0);
6897 IP_REASS_SET_END(mp, 0);
6898 /* Subtract byte count */
6899 ipf->ipf_count -= mp->b_datap->db_lim -
6900 mp->b_datap->db_base;
6901 if (incr_dups) {
6902 ipf->ipf_num_dups++;
6903 incr_dups = B_FALSE;
6904 }
6905 freeb(mp);
6906 BUMP_MIB(ill->ill_ip_mib,
6907 ipIfStatsReasmDuplicates);
6908 break;
6909 }
6910 /*
6911 * Trim redundant stuff off beginning of new
6912 * piece.
6913 */
6914 IP_REASS_SET_START(mp, offset);
6915 mp->b_rptr += offset - start;
6916 BUMP_MIB(ill->ill_ip_mib,
6917 ipIfStatsReasmPartDups);
6918 start = offset;
6919 if (!mp1->b_cont) {
6920 /*
6921 * After trimming, this guy is now
6922 * hanging off the end.
6923 */
6924 mp1->b_cont = mp;
6925 ipf->ipf_tail_mp = mp;
6926 if (!more) {
6927 ipf->ipf_hole_cnt--;
6928 }
6929 break;
6930 }
6931 }
6932 if (start >= IP_REASS_START(mp1->b_cont))
6933 continue;
6934 /* Fill a hole */
6935 if (start > offset)
6936 ipf->ipf_hole_cnt++;
6937 mp->b_cont = mp1->b_cont;
6938 mp1->b_cont = mp;
6939 mp1 = mp->b_cont;
6940 offset = IP_REASS_START(mp1);
6941 if (end >= offset) {
6942 ipf->ipf_hole_cnt--;
6943 /* Check for overlap. */
6944 while (end > offset) {
6945 if (end < IP_REASS_END(mp1)) {
6946 mp->b_wptr -= end - offset;
6947 IP_REASS_SET_END(mp, offset);
6948 /*
6949 * TODO we might bump
6950 * this up twice if there is
6951 * overlap at both ends.
6952 */
6953 BUMP_MIB(ill->ill_ip_mib,
6954 ipIfStatsReasmPartDups);
6955 break;
6956 }
6957 /* Did we cover another hole? */
6958 if ((mp1->b_cont &&
6959 IP_REASS_END(mp1)
6960 != IP_REASS_START(mp1->b_cont) &&
6961 end >=
6962 IP_REASS_START(mp1->b_cont)) ||
6963 (!ipf->ipf_last_frag_seen &&
6964 !more)) {
6965 ipf->ipf_hole_cnt--;
6966 }
6967 /* Clip out mp1. */
6968 if ((mp->b_cont = mp1->b_cont) ==
6969 NULL) {
6970 /*
6971 * After clipping out mp1,
6972 * this guy is now hanging
6973 * off the end.
6974 */
6975 ipf->ipf_tail_mp = mp;
6976 }
6977 IP_REASS_SET_START(mp1, 0);
6978 IP_REASS_SET_END(mp1, 0);
6979 /* Subtract byte count */
6980 ipf->ipf_count -=
6981 mp1->b_datap->db_lim -
6982 mp1->b_datap->db_base;
6983 freeb(mp1);
6984 BUMP_MIB(ill->ill_ip_mib,
6985 ipIfStatsReasmPartDups);
6986 mp1 = mp->b_cont;
6987 if (!mp1)
6988 break;
6989 offset = IP_REASS_START(mp1);
6990 }
6991 }
6992 break;
6993 }
6994 } while (start = end, mp = next_mp);
6995
6996 /* Fragment just processed could be the last one. Remember this fact */
6997 if (!more)
6998 ipf->ipf_last_frag_seen = B_TRUE;
6999
7000 /* Still got holes? */
7001 if (ipf->ipf_hole_cnt)
7002 return (IP_REASS_PARTIAL);
7003 /* Clean up overloaded fields to avoid upstream disasters. */
7004 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) {
7005 IP_REASS_SET_START(mp1, 0);
7006 IP_REASS_SET_END(mp1, 0);
7007 }
7008 return (IP_REASS_COMPLETE);
7009 }
7010
7011 /*
7012 * Fragmentation reassembly. Each ILL has a hash table for
7013 * queuing packets undergoing reassembly for all IPIFs
7014 * associated with the ILL. The hash is based on the packet
7015 * IP ident field. The ILL frag hash table was allocated
7016 * as a timer block at the time the ILL was created. Whenever
7017 * there is anything on the reassembly queue, the timer will
7018 * be running. Returns the reassembled packet if reassembly completes.
7019 */
7020 mblk_t *
7021 ip_input_fragment(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
7022 {
7023 uint32_t frag_offset_flags;
7024 mblk_t *t_mp;
7025 ipaddr_t dst;
7026 uint8_t proto = ipha->ipha_protocol;
7027 uint32_t sum_val;
7028 uint16_t sum_flags;
7029 ipf_t *ipf;
7030 ipf_t **ipfp;
7031 ipfb_t *ipfb;
7032 uint16_t ident;
7033 uint32_t offset;
7034 ipaddr_t src;
7035 uint_t hdr_length;
7036 uint32_t end;
7037 mblk_t *mp1;
7038 mblk_t *tail_mp;
7039 size_t count;
7040 size_t msg_len;
7041 uint8_t ecn_info = 0;
7042 uint32_t packet_size;
7043 boolean_t pruned = B_FALSE;
7044 ill_t *ill = ira->ira_ill;
7045 ip_stack_t *ipst = ill->ill_ipst;
7046
7047 /*
7048 * Drop the fragmented as early as possible, if
7049 * we don't have resource(s) to re-assemble.
7050 */
7051 if (ipst->ips_ip_reass_queue_bytes == 0) {
7052 freemsg(mp);
7053 return (NULL);
7054 }
7055
7056 /* Check for fragmentation offset; return if there's none */
7057 if ((frag_offset_flags = ntohs(ipha->ipha_fragment_offset_and_flags) &
7058 (IPH_MF | IPH_OFFSET)) == 0)
7059 return (mp);
7060
7061 /*
7062 * We utilize hardware computed checksum info only for UDP since
7063 * IP fragmentation is a normal occurrence for the protocol. In
7064 * addition, checksum offload support for IP fragments carrying
7065 * UDP payload is commonly implemented across network adapters.
7066 */
7067 ASSERT(ira->ira_rill != NULL);
7068 if (proto == IPPROTO_UDP && dohwcksum &&
7069 ILL_HCKSUM_CAPABLE(ira->ira_rill) &&
7070 (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) {
7071 mblk_t *mp1 = mp->b_cont;
7072 int32_t len;
7073
7074 /* Record checksum information from the packet */
7075 sum_val = (uint32_t)DB_CKSUM16(mp);
7076 sum_flags = DB_CKSUMFLAGS(mp);
7077
7078 /* IP payload offset from beginning of mblk */
7079 offset = ((uchar_t *)ipha + IPH_HDR_LENGTH(ipha)) - mp->b_rptr;
7080
7081 if ((sum_flags & HCK_PARTIALCKSUM) &&
7082 (mp1 == NULL || mp1->b_cont == NULL) &&
7083 offset >= DB_CKSUMSTART(mp) &&
7084 ((len = offset - DB_CKSUMSTART(mp)) & 1) == 0) {
7085 uint32_t adj;
7086 /*
7087 * Partial checksum has been calculated by hardware
7088 * and attached to the packet; in addition, any
7089 * prepended extraneous data is even byte aligned.
7090 * If any such data exists, we adjust the checksum;
7091 * this would also handle any postpended data.
7092 */
7093 IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp),
7094 mp, mp1, len, adj);
7095
7096 /* One's complement subtract extraneous checksum */
7097 if (adj >= sum_val)
7098 sum_val = ~(adj - sum_val) & 0xFFFF;
7099 else
7100 sum_val -= adj;
7101 }
7102 } else {
7103 sum_val = 0;
7104 sum_flags = 0;
7105 }
7106
7107 /* Clear hardware checksumming flag */
7108 DB_CKSUMFLAGS(mp) = 0;
7109
7110 ident = ipha->ipha_ident;
7111 offset = (frag_offset_flags << 3) & 0xFFFF;
7112 src = ipha->ipha_src;
7113 dst = ipha->ipha_dst;
7114 hdr_length = IPH_HDR_LENGTH(ipha);
7115 end = ntohs(ipha->ipha_length) - hdr_length;
7116
7117 /* If end == 0 then we have a packet with no data, so just free it */
7118 if (end == 0) {
7119 freemsg(mp);
7120 return (NULL);
7121 }
7122
7123 /* Record the ECN field info. */
7124 ecn_info = (ipha->ipha_type_of_service & 0x3);
7125 if (offset != 0) {
7126 /*
7127 * If this isn't the first piece, strip the header, and
7128 * add the offset to the end value.
7129 */
7130 mp->b_rptr += hdr_length;
7131 end += offset;
7132 }
7133
7134 /* Handle vnic loopback of fragments */
7135 if (mp->b_datap->db_ref > 2)
7136 msg_len = 0;
7137 else
7138 msg_len = MBLKSIZE(mp);
7139
7140 tail_mp = mp;
7141 while (tail_mp->b_cont != NULL) {
7142 tail_mp = tail_mp->b_cont;
7143 if (tail_mp->b_datap->db_ref <= 2)
7144 msg_len += MBLKSIZE(tail_mp);
7145 }
7146
7147 /* If the reassembly list for this ILL will get too big, prune it */
7148 if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >=
7149 ipst->ips_ip_reass_queue_bytes) {
7150 DTRACE_PROBE3(ip_reass_queue_bytes, uint_t, msg_len,
7151 uint_t, ill->ill_frag_count,
7152 uint_t, ipst->ips_ip_reass_queue_bytes);
7153 ill_frag_prune(ill,
7154 (ipst->ips_ip_reass_queue_bytes < msg_len) ? 0 :
7155 (ipst->ips_ip_reass_queue_bytes - msg_len));
7156 pruned = B_TRUE;
7157 }
7158
7159 ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH(src, ident)];
7160 mutex_enter(&ipfb->ipfb_lock);
7161
7162 ipfp = &ipfb->ipfb_ipf;
7163 /* Try to find an existing fragment queue for this packet. */
7164 for (;;) {
7165 ipf = ipfp[0];
7166 if (ipf != NULL) {
7167 /*
7168 * It has to match on ident and src/dst address.
7169 */
7170 if (ipf->ipf_ident == ident &&
7171 ipf->ipf_src == src &&
7172 ipf->ipf_dst == dst &&
7173 ipf->ipf_protocol == proto) {
7174 /*
7175 * If we have received too many
7176 * duplicate fragments for this packet
7177 * free it.
7178 */
7179 if (ipf->ipf_num_dups > ip_max_frag_dups) {
7180 ill_frag_free_pkts(ill, ipfb, ipf, 1);
7181 freemsg(mp);
7182 mutex_exit(&ipfb->ipfb_lock);
7183 return (NULL);
7184 }
7185 /* Found it. */
7186 break;
7187 }
7188 ipfp = &ipf->ipf_hash_next;
7189 continue;
7190 }
7191
7192 /*
7193 * If we pruned the list, do we want to store this new
7194 * fragment?. We apply an optimization here based on the
7195 * fact that most fragments will be received in order.
7196 * So if the offset of this incoming fragment is zero,
7197 * it is the first fragment of a new packet. We will
7198 * keep it. Otherwise drop the fragment, as we have
7199 * probably pruned the packet already (since the
7200 * packet cannot be found).
7201 */
7202 if (pruned && offset != 0) {
7203 mutex_exit(&ipfb->ipfb_lock);
7204 freemsg(mp);
7205 return (NULL);
7206 }
7207
7208 if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS(ipst)) {
7209 /*
7210 * Too many fragmented packets in this hash
7211 * bucket. Free the oldest.
7212 */
7213 ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1);
7214 }
7215
7216 /* New guy. Allocate a frag message. */
7217 mp1 = allocb(sizeof (*ipf), BPRI_MED);
7218 if (mp1 == NULL) {
7219 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7220 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7221 freemsg(mp);
7222 reass_done:
7223 mutex_exit(&ipfb->ipfb_lock);
7224 return (NULL);
7225 }
7226
7227 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmReqds);
7228 mp1->b_cont = mp;
7229
7230 /* Initialize the fragment header. */
7231 ipf = (ipf_t *)mp1->b_rptr;
7232 ipf->ipf_mp = mp1;
7233 ipf->ipf_ptphn = ipfp;
7234 ipfp[0] = ipf;
7235 ipf->ipf_hash_next = NULL;
7236 ipf->ipf_ident = ident;
7237 ipf->ipf_protocol = proto;
7238 ipf->ipf_src = src;
7239 ipf->ipf_dst = dst;
7240 ipf->ipf_nf_hdr_len = 0;
7241 /* Record reassembly start time. */
7242 ipf->ipf_timestamp = gethrestime_sec();
7243 /* Record ipf generation and account for frag header */
7244 ipf->ipf_gen = ill->ill_ipf_gen++;
7245 ipf->ipf_count = MBLKSIZE(mp1);
7246 ipf->ipf_last_frag_seen = B_FALSE;
7247 ipf->ipf_ecn = ecn_info;
7248 ipf->ipf_num_dups = 0;
7249 ipfb->ipfb_frag_pkts++;
7250 ipf->ipf_checksum = 0;
7251 ipf->ipf_checksum_flags = 0;
7252
7253 /* Store checksum value in fragment header */
7254 if (sum_flags != 0) {
7255 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7256 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7257 ipf->ipf_checksum = sum_val;
7258 ipf->ipf_checksum_flags = sum_flags;
7259 }
7260
7261 /*
7262 * We handle reassembly two ways. In the easy case,
7263 * where all the fragments show up in order, we do
7264 * minimal bookkeeping, and just clip new pieces on
7265 * the end. If we ever see a hole, then we go off
7266 * to ip_reassemble which has to mark the pieces and
7267 * keep track of the number of holes, etc. Obviously,
7268 * the point of having both mechanisms is so we can
7269 * handle the easy case as efficiently as possible.
7270 */
7271 if (offset == 0) {
7272 /* Easy case, in-order reassembly so far. */
7273 ipf->ipf_count += msg_len;
7274 ipf->ipf_tail_mp = tail_mp;
7275 /*
7276 * Keep track of next expected offset in
7277 * ipf_end.
7278 */
7279 ipf->ipf_end = end;
7280 ipf->ipf_nf_hdr_len = hdr_length;
7281 } else {
7282 /* Hard case, hole at the beginning. */
7283 ipf->ipf_tail_mp = NULL;
7284 /*
7285 * ipf_end == 0 means that we have given up
7286 * on easy reassembly.
7287 */
7288 ipf->ipf_end = 0;
7289
7290 /* Forget checksum offload from now on */
7291 ipf->ipf_checksum_flags = 0;
7292
7293 /*
7294 * ipf_hole_cnt is set by ip_reassemble.
7295 * ipf_count is updated by ip_reassemble.
7296 * No need to check for return value here
7297 * as we don't expect reassembly to complete
7298 * or fail for the first fragment itself.
7299 */
7300 (void) ip_reassemble(mp, ipf,
7301 (frag_offset_flags & IPH_OFFSET) << 3,
7302 (frag_offset_flags & IPH_MF), ill, msg_len);
7303 }
7304 /* Update per ipfb and ill byte counts */
7305 ipfb->ipfb_count += ipf->ipf_count;
7306 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
7307 atomic_add_32(&ill->ill_frag_count, ipf->ipf_count);
7308 /* If the frag timer wasn't already going, start it. */
7309 mutex_enter(&ill->ill_lock);
7310 ill_frag_timer_start(ill);
7311 mutex_exit(&ill->ill_lock);
7312 goto reass_done;
7313 }
7314
7315 /*
7316 * If the packet's flag has changed (it could be coming up
7317 * from an interface different than the previous, therefore
7318 * possibly different checksum capability), then forget about
7319 * any stored checksum states. Otherwise add the value to
7320 * the existing one stored in the fragment header.
7321 */
7322 if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) {
7323 sum_val += ipf->ipf_checksum;
7324 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7325 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7326 ipf->ipf_checksum = sum_val;
7327 } else if (ipf->ipf_checksum_flags != 0) {
7328 /* Forget checksum offload from now on */
7329 ipf->ipf_checksum_flags = 0;
7330 }
7331
7332 /*
7333 * We have a new piece of a datagram which is already being
7334 * reassembled. Update the ECN info if all IP fragments
7335 * are ECN capable. If there is one which is not, clear
7336 * all the info. If there is at least one which has CE
7337 * code point, IP needs to report that up to transport.
7338 */
7339 if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) {
7340 if (ecn_info == IPH_ECN_CE)
7341 ipf->ipf_ecn = IPH_ECN_CE;
7342 } else {
7343 ipf->ipf_ecn = IPH_ECN_NECT;
7344 }
7345 if (offset && ipf->ipf_end == offset) {
7346 /* The new fragment fits at the end */
7347 ipf->ipf_tail_mp->b_cont = mp;
7348 /* Update the byte count */
7349 ipf->ipf_count += msg_len;
7350 /* Update per ipfb and ill byte counts */
7351 ipfb->ipfb_count += msg_len;
7352 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
7353 atomic_add_32(&ill->ill_frag_count, msg_len);
7354 if (frag_offset_flags & IPH_MF) {
7355 /* More to come. */
7356 ipf->ipf_end = end;
7357 ipf->ipf_tail_mp = tail_mp;
7358 goto reass_done;
7359 }
7360 } else {
7361 /* Go do the hard cases. */
7362 int ret;
7363
7364 if (offset == 0)
7365 ipf->ipf_nf_hdr_len = hdr_length;
7366
7367 /* Save current byte count */
7368 count = ipf->ipf_count;
7369 ret = ip_reassemble(mp, ipf,
7370 (frag_offset_flags & IPH_OFFSET) << 3,
7371 (frag_offset_flags & IPH_MF), ill, msg_len);
7372 /* Count of bytes added and subtracted (freeb()ed) */
7373 count = ipf->ipf_count - count;
7374 if (count) {
7375 /* Update per ipfb and ill byte counts */
7376 ipfb->ipfb_count += count;
7377 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
7378 atomic_add_32(&ill->ill_frag_count, count);
7379 }
7380 if (ret == IP_REASS_PARTIAL) {
7381 goto reass_done;
7382 } else if (ret == IP_REASS_FAILED) {
7383 /* Reassembly failed. Free up all resources */
7384 ill_frag_free_pkts(ill, ipfb, ipf, 1);
7385 for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) {
7386 IP_REASS_SET_START(t_mp, 0);
7387 IP_REASS_SET_END(t_mp, 0);
7388 }
7389 freemsg(mp);
7390 goto reass_done;
7391 }
7392 /* We will reach here iff 'ret' is IP_REASS_COMPLETE */
7393 }
7394 /*
7395 * We have completed reassembly. Unhook the frag header from
7396 * the reassembly list.
7397 *
7398 * Before we free the frag header, record the ECN info
7399 * to report back to the transport.
7400 */
7401 ecn_info = ipf->ipf_ecn;
7402 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmOKs);
7403 ipfp = ipf->ipf_ptphn;
7404
7405 /* We need to supply these to caller */
7406 if ((sum_flags = ipf->ipf_checksum_flags) != 0)
7407 sum_val = ipf->ipf_checksum;
7408 else
7409 sum_val = 0;
7410
7411 mp1 = ipf->ipf_mp;
7412 count = ipf->ipf_count;
7413 ipf = ipf->ipf_hash_next;
7414 if (ipf != NULL)
7415 ipf->ipf_ptphn = ipfp;
7416 ipfp[0] = ipf;
7417 atomic_add_32(&ill->ill_frag_count, -count);
7418 ASSERT(ipfb->ipfb_count >= count);
7419 ipfb->ipfb_count -= count;
7420 ipfb->ipfb_frag_pkts--;
7421 mutex_exit(&ipfb->ipfb_lock);
7422 /* Ditch the frag header. */
7423 mp = mp1->b_cont;
7424
7425 freeb(mp1);
7426
7427 /* Restore original IP length in header. */
7428 packet_size = (uint32_t)msgdsize(mp);
7429 if (packet_size > IP_MAXPACKET) {
7430 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7431 ip_drop_input("Reassembled packet too large", mp, ill);
7432 freemsg(mp);
7433 return (NULL);
7434 }
7435
7436 if (DB_REF(mp) > 1) {
7437 mblk_t *mp2 = copymsg(mp);
7438
7439 if (mp2 == NULL) {
7440 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7441 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7442 freemsg(mp);
7443 return (NULL);
7444 }
7445 freemsg(mp);
7446 mp = mp2;
7447 }
7448 ipha = (ipha_t *)mp->b_rptr;
7449
7450 ipha->ipha_length = htons((uint16_t)packet_size);
7451 /* We're now complete, zip the frag state */
7452 ipha->ipha_fragment_offset_and_flags = 0;
7453 /* Record the ECN info. */
7454 ipha->ipha_type_of_service &= 0xFC;
7455 ipha->ipha_type_of_service |= ecn_info;
7456
7457 /* Update the receive attributes */
7458 ira->ira_pktlen = packet_size;
7459 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
7460
7461 /* Reassembly is successful; set checksum information in packet */
7462 DB_CKSUM16(mp) = (uint16_t)sum_val;
7463 DB_CKSUMFLAGS(mp) = sum_flags;
7464 DB_CKSUMSTART(mp) = ira->ira_ip_hdr_length;
7465
7466 return (mp);
7467 }
7468
7469 /*
7470 * Pullup function that should be used for IP input in order to
7471 * ensure we do not loose the L2 source address; we need the l2 source
7472 * address for IP_RECVSLLA and for ndp_input.
7473 *
7474 * We return either NULL or b_rptr.
7475 */
7476 void *
7477 ip_pullup(mblk_t *mp, ssize_t len, ip_recv_attr_t *ira)
7478 {
7479 ill_t *ill = ira->ira_ill;
7480
7481 if (ip_rput_pullups++ == 0) {
7482 (void) mi_strlog(ill->ill_rq, 1, SL_ERROR|SL_TRACE,
7483 "ip_pullup: %s forced us to "
7484 " pullup pkt, hdr len %ld, hdr addr %p",
7485 ill->ill_name, len, (void *)mp->b_rptr);
7486 }
7487 if (!(ira->ira_flags & IRAF_L2SRC_SET))
7488 ip_setl2src(mp, ira, ira->ira_rill);
7489 ASSERT(ira->ira_flags & IRAF_L2SRC_SET);
7490 if (!pullupmsg(mp, len))
7491 return (NULL);
7492 else
7493 return (mp->b_rptr);
7494 }
7495
7496 /*
7497 * Make sure ira_l2src has an address. If we don't have one fill with zeros.
7498 * When called from the ULP ira_rill will be NULL hence the caller has to
7499 * pass in the ill.
7500 */
7501 /* ARGSUSED */
7502 void
7503 ip_setl2src(mblk_t *mp, ip_recv_attr_t *ira, ill_t *ill)
7504 {
7505 const uchar_t *addr;
7506 int alen;
7507
7508 if (ira->ira_flags & IRAF_L2SRC_SET)
7509 return;
7510
7511 ASSERT(ill != NULL);
7512 alen = ill->ill_phys_addr_length;
7513 ASSERT(alen <= sizeof (ira->ira_l2src));
7514 if (ira->ira_mhip != NULL &&
7515 (addr = ira->ira_mhip->mhi_saddr) != NULL) {
7516 bcopy(addr, ira->ira_l2src, alen);
7517 } else if ((ira->ira_flags & IRAF_L2SRC_LOOPBACK) &&
7518 (addr = ill->ill_phys_addr) != NULL) {
7519 bcopy(addr, ira->ira_l2src, alen);
7520 } else {
7521 bzero(ira->ira_l2src, alen);
7522 }
7523 ira->ira_flags |= IRAF_L2SRC_SET;
7524 }
7525
7526 /*
7527 * check ip header length and align it.
7528 */
7529 mblk_t *
7530 ip_check_and_align_header(mblk_t *mp, uint_t min_size, ip_recv_attr_t *ira)
7531 {
7532 ill_t *ill = ira->ira_ill;
7533 ssize_t len;
7534
7535 len = MBLKL(mp);
7536
7537 if (!OK_32PTR(mp->b_rptr))
7538 IP_STAT(ill->ill_ipst, ip_notaligned);
7539 else
7540 IP_STAT(ill->ill_ipst, ip_recv_pullup);
7541
7542 /* Guard against bogus device drivers */
7543 if (len < 0) {
7544 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7545 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7546 freemsg(mp);
7547 return (NULL);
7548 }
7549
7550 if (len == 0) {
7551 /* GLD sometimes sends up mblk with b_rptr == b_wptr! */
7552 mblk_t *mp1 = mp->b_cont;
7553
7554 if (!(ira->ira_flags & IRAF_L2SRC_SET))
7555 ip_setl2src(mp, ira, ira->ira_rill);
7556 ASSERT(ira->ira_flags & IRAF_L2SRC_SET);
7557
7558 freeb(mp);
7559 mp = mp1;
7560 if (mp == NULL)
7561 return (NULL);
7562
7563 if (OK_32PTR(mp->b_rptr) && MBLKL(mp) >= min_size)
7564 return (mp);
7565 }
7566 if (ip_pullup(mp, min_size, ira) == NULL) {
7567 if (msgdsize(mp) < min_size) {
7568 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7569 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7570 } else {
7571 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7572 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7573 }
7574 freemsg(mp);
7575 return (NULL);
7576 }
7577 return (mp);
7578 }
7579
7580 /*
7581 * Common code for IPv4 and IPv6 to check and pullup multi-mblks
7582 */
7583 mblk_t *
7584 ip_check_length(mblk_t *mp, uchar_t *rptr, ssize_t len, uint_t pkt_len,
7585 uint_t min_size, ip_recv_attr_t *ira)
7586 {
7587 ill_t *ill = ira->ira_ill;
7588
7589 /*
7590 * Make sure we have data length consistent
7591 * with the IP header.
7592 */
7593 if (mp->b_cont == NULL) {
7594 /* pkt_len is based on ipha_len, not the mblk length */
7595 if (pkt_len < min_size) {
7596 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7597 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7598 freemsg(mp);
7599 return (NULL);
7600 }
7601 if (len < 0) {
7602 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
7603 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
7604 freemsg(mp);
7605 return (NULL);
7606 }
7607 /* Drop any pad */
7608 mp->b_wptr = rptr + pkt_len;
7609 } else if ((len += msgdsize(mp->b_cont)) != 0) {
7610 ASSERT(pkt_len >= min_size);
7611 if (pkt_len < min_size) {
7612 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7613 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7614 freemsg(mp);
7615 return (NULL);
7616 }
7617 if (len < 0) {
7618 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
7619 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
7620 freemsg(mp);
7621 return (NULL);
7622 }
7623 /* Drop any pad */
7624 (void) adjmsg(mp, -len);
7625 /*
7626 * adjmsg may have freed an mblk from the chain, hence
7627 * invalidate any hw checksum here. This will force IP to
7628 * calculate the checksum in sw, but only for this packet.
7629 */
7630 DB_CKSUMFLAGS(mp) = 0;
7631 IP_STAT(ill->ill_ipst, ip_multimblk);
7632 }
7633 return (mp);
7634 }
7635
7636 /*
7637 * Check that the IPv4 opt_len is consistent with the packet and pullup
7638 * the options.
7639 */
7640 mblk_t *
7641 ip_check_optlen(mblk_t *mp, ipha_t *ipha, uint_t opt_len, uint_t pkt_len,
7642 ip_recv_attr_t *ira)
7643 {
7644 ill_t *ill = ira->ira_ill;
7645 ssize_t len;
7646
7647 /* Assume no IPv6 packets arrive over the IPv4 queue */
7648 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
7649 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7650 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInWrongIPVersion);
7651 ip_drop_input("IPvN packet on IPv4 ill", mp, ill);
7652 freemsg(mp);
7653 return (NULL);
7654 }
7655
7656 if (opt_len > (15 - IP_SIMPLE_HDR_LENGTH_IN_WORDS)) {
7657 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7658 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7659 freemsg(mp);
7660 return (NULL);
7661 }
7662 /*
7663 * Recompute complete header length and make sure we
7664 * have access to all of it.
7665 */
7666 len = ((size_t)opt_len + IP_SIMPLE_HDR_LENGTH_IN_WORDS) << 2;
7667 if (len > (mp->b_wptr - mp->b_rptr)) {
7668 if (len > pkt_len) {
7669 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7670 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7671 freemsg(mp);
7672 return (NULL);
7673 }
7674 if (ip_pullup(mp, len, ira) == NULL) {
7675 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7676 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7677 freemsg(mp);
7678 return (NULL);
7679 }
7680 }
7681 return (mp);
7682 }
7683
7684 /*
7685 * Returns a new ire, or the same ire, or NULL.
7686 * If a different IRE is returned, then it is held; the caller
7687 * needs to release it.
7688 * In no case is there any hold/release on the ire argument.
7689 */
7690 ire_t *
7691 ip_check_multihome(void *addr, ire_t *ire, ill_t *ill)
7692 {
7693 ire_t *new_ire;
7694 ill_t *ire_ill;
7695 uint_t ifindex;
7696 ip_stack_t *ipst = ill->ill_ipst;
7697 boolean_t strict_check = B_FALSE;
7698
7699 /*
7700 * IPMP common case: if IRE and ILL are in the same group, there's no
7701 * issue (e.g. packet received on an underlying interface matched an
7702 * IRE_LOCAL on its associated group interface).
7703 */
7704 ASSERT(ire->ire_ill != NULL);
7705 if (IS_IN_SAME_ILLGRP(ill, ire->ire_ill))
7706 return (ire);
7707
7708 /*
7709 * Do another ire lookup here, using the ingress ill, to see if the
7710 * interface is in a usesrc group.
7711 * As long as the ills belong to the same group, we don't consider
7712 * them to be arriving on the wrong interface. Thus, if the switch
7713 * is doing inbound load spreading, we won't drop packets when the
7714 * ip*_strict_dst_multihoming switch is on.
7715 * We also need to check for IPIF_UNNUMBERED point2point interfaces
7716 * where the local address may not be unique. In this case we were
7717 * at the mercy of the initial ire lookup and the IRE_LOCAL it
7718 * actually returned. The new lookup, which is more specific, should
7719 * only find the IRE_LOCAL associated with the ingress ill if one
7720 * exists.
7721 */
7722 if (ire->ire_ipversion == IPV4_VERSION) {
7723 if (ipst->ips_ip_strict_dst_multihoming)
7724 strict_check = B_TRUE;
7725 new_ire = ire_ftable_lookup_v4(*((ipaddr_t *)addr), 0, 0,
7726 IRE_LOCAL, ill, ALL_ZONES, NULL,
7727 (MATCH_IRE_TYPE|MATCH_IRE_ILL), 0, ipst, NULL);
7728 } else {
7729 ASSERT(!IN6_IS_ADDR_MULTICAST((in6_addr_t *)addr));
7730 if (ipst->ips_ipv6_strict_dst_multihoming)
7731 strict_check = B_TRUE;
7732 new_ire = ire_ftable_lookup_v6((in6_addr_t *)addr, NULL, NULL,
7733 IRE_LOCAL, ill, ALL_ZONES, NULL,
7734 (MATCH_IRE_TYPE|MATCH_IRE_ILL), 0, ipst, NULL);
7735 }
7736 /*
7737 * If the same ire that was returned in ip_input() is found then this
7738 * is an indication that usesrc groups are in use. The packet
7739 * arrived on a different ill in the group than the one associated with
7740 * the destination address. If a different ire was found then the same
7741 * IP address must be hosted on multiple ills. This is possible with
7742 * unnumbered point2point interfaces. We switch to use this new ire in
7743 * order to have accurate interface statistics.
7744 */
7745 if (new_ire != NULL) {
7746 /* Note: held in one case but not the other? Caller handles */
7747 if (new_ire != ire)
7748 return (new_ire);
7749 /* Unchanged */
7750 ire_refrele(new_ire);
7751 return (ire);
7752 }
7753
7754 /*
7755 * Chase pointers once and store locally.
7756 */
7757 ASSERT(ire->ire_ill != NULL);
7758 ire_ill = ire->ire_ill;
7759 ifindex = ill->ill_usesrc_ifindex;
7760
7761 /*
7762 * Check if it's a legal address on the 'usesrc' interface.
7763 * For IPMP data addresses the IRE_LOCAL is the upper, hence we
7764 * can just check phyint_ifindex.
7765 */
7766 if (ifindex != 0 && ifindex == ire_ill->ill_phyint->phyint_ifindex) {
7767 return (ire);
7768 }
7769
7770 /*
7771 * If the ip*_strict_dst_multihoming switch is on then we can
7772 * only accept this packet if the interface is marked as routing.
7773 */
7774 if (!(strict_check))
7775 return (ire);
7776
7777 if ((ill->ill_flags & ire->ire_ill->ill_flags & ILLF_ROUTER) != 0) {
7778 return (ire);
7779 }
7780 return (NULL);
7781 }
7782
7783 /*
7784 * This function is used to construct a mac_header_info_s from a
7785 * DL_UNITDATA_IND message.
7786 * The address fields in the mhi structure points into the message,
7787 * thus the caller can't use those fields after freeing the message.
7788 *
7789 * We determine whether the packet received is a non-unicast packet
7790 * and in doing so, determine whether or not it is broadcast vs multicast.
7791 * For it to be a broadcast packet, we must have the appropriate mblk_t
7792 * hanging off the ill_t. If this is either not present or doesn't match
7793 * the destination mac address in the DL_UNITDATA_IND, the packet is deemed
7794 * to be multicast. Thus NICs that have no broadcast address (or no
7795 * capability for one, such as point to point links) cannot return as
7796 * the packet being broadcast.
7797 */
7798 void
7799 ip_dlur_to_mhi(ill_t *ill, mblk_t *mb, struct mac_header_info_s *mhip)
7800 {
7801 dl_unitdata_ind_t *ind = (dl_unitdata_ind_t *)mb->b_rptr;
7802 mblk_t *bmp;
7803 uint_t extra_offset;
7804
7805 bzero(mhip, sizeof (struct mac_header_info_s));
7806
7807 mhip->mhi_dsttype = MAC_ADDRTYPE_UNICAST;
7808
7809 if (ill->ill_sap_length < 0)
7810 extra_offset = 0;
7811 else
7812 extra_offset = ill->ill_sap_length;
7813
7814 mhip->mhi_daddr = (uchar_t *)ind + ind->dl_dest_addr_offset +
7815 extra_offset;
7816 mhip->mhi_saddr = (uchar_t *)ind + ind->dl_src_addr_offset +
7817 extra_offset;
7818
7819 if (!ind->dl_group_address)
7820 return;
7821
7822 /* Multicast or broadcast */
7823 mhip->mhi_dsttype = MAC_ADDRTYPE_MULTICAST;
7824
7825 if (ind->dl_dest_addr_offset > sizeof (*ind) &&
7826 ind->dl_dest_addr_offset + ind->dl_dest_addr_length < MBLKL(mb) &&
7827 (bmp = ill->ill_bcast_mp) != NULL) {
7828 dl_unitdata_req_t *dlur;
7829 uint8_t *bphys_addr;
7830
7831 dlur = (dl_unitdata_req_t *)bmp->b_rptr;
7832 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
7833 extra_offset;
7834
7835 if (bcmp(mhip->mhi_daddr, bphys_addr,
7836 ind->dl_dest_addr_length) == 0)
7837 mhip->mhi_dsttype = MAC_ADDRTYPE_BROADCAST;
7838 }
7839 }
7840
7841 /*
7842 * This function is used to construct a mac_header_info_s from a
7843 * M_DATA fastpath message from a DLPI driver.
7844 * The address fields in the mhi structure points into the message,
7845 * thus the caller can't use those fields after freeing the message.
7846 *
7847 * We determine whether the packet received is a non-unicast packet
7848 * and in doing so, determine whether or not it is broadcast vs multicast.
7849 * For it to be a broadcast packet, we must have the appropriate mblk_t
7850 * hanging off the ill_t. If this is either not present or doesn't match
7851 * the destination mac address in the DL_UNITDATA_IND, the packet is deemed
7852 * to be multicast. Thus NICs that have no broadcast address (or no
7853 * capability for one, such as point to point links) cannot return as
7854 * the packet being broadcast.
7855 */
7856 void
7857 ip_mdata_to_mhi(ill_t *ill, mblk_t *mp, struct mac_header_info_s *mhip)
7858 {
7859 mblk_t *bmp;
7860 struct ether_header *pether;
7861
7862 bzero(mhip, sizeof (struct mac_header_info_s));
7863
7864 mhip->mhi_dsttype = MAC_ADDRTYPE_UNICAST;
7865
7866 pether = (struct ether_header *)((char *)mp->b_rptr
7867 - sizeof (struct ether_header));
7868
7869 /*
7870 * Make sure the interface is an ethernet type, since we don't
7871 * know the header format for anything but Ethernet. Also make
7872 * sure we are pointing correctly above db_base.
7873 */
7874 if (ill->ill_type != IFT_ETHER)
7875 return;
7876
7877 retry:
7878 if ((uchar_t *)pether < mp->b_datap->db_base)
7879 return;
7880
7881 /* Is there a VLAN tag? */
7882 if (ill->ill_isv6) {
7883 if (pether->ether_type != htons(ETHERTYPE_IPV6)) {
7884 pether = (struct ether_header *)((char *)pether - 4);
7885 goto retry;
7886 }
7887 } else {
7888 if (pether->ether_type != htons(ETHERTYPE_IP)) {
7889 pether = (struct ether_header *)((char *)pether - 4);
7890 goto retry;
7891 }
7892 }
7893 mhip->mhi_daddr = (uchar_t *)&pether->ether_dhost;
7894 mhip->mhi_saddr = (uchar_t *)&pether->ether_shost;
7895
7896 if (!(mhip->mhi_daddr[0] & 0x01))
7897 return;
7898
7899 /* Multicast or broadcast */
7900 mhip->mhi_dsttype = MAC_ADDRTYPE_MULTICAST;
7901
7902 if ((bmp = ill->ill_bcast_mp) != NULL) {
7903 dl_unitdata_req_t *dlur;
7904 uint8_t *bphys_addr;
7905 uint_t addrlen;
7906
7907 dlur = (dl_unitdata_req_t *)bmp->b_rptr;
7908 addrlen = dlur->dl_dest_addr_length;
7909 if (ill->ill_sap_length < 0) {
7910 bphys_addr = (uchar_t *)dlur +
7911 dlur->dl_dest_addr_offset;
7912 addrlen += ill->ill_sap_length;
7913 } else {
7914 bphys_addr = (uchar_t *)dlur +
7915 dlur->dl_dest_addr_offset +
7916 ill->ill_sap_length;
7917 addrlen -= ill->ill_sap_length;
7918 }
7919 if (bcmp(mhip->mhi_daddr, bphys_addr, addrlen) == 0)
7920 mhip->mhi_dsttype = MAC_ADDRTYPE_BROADCAST;
7921 }
7922 }
7923
7924 /*
7925 * Handle anything but M_DATA messages
7926 * We see the DL_UNITDATA_IND which are part
7927 * of the data path, and also the other messages from the driver.
7928 */
7929 void
7930 ip_rput_notdata(ill_t *ill, mblk_t *mp)
7931 {
7932 mblk_t *first_mp;
7933 struct iocblk *iocp;
7934 struct mac_header_info_s mhi;
7935
7936 switch (DB_TYPE(mp)) {
7937 case M_PROTO:
7938 case M_PCPROTO: {
7939 if (((dl_unitdata_ind_t *)mp->b_rptr)->dl_primitive !=
7940 DL_UNITDATA_IND) {
7941 /* Go handle anything other than data elsewhere. */
7942 ip_rput_dlpi(ill, mp);
7943 return;
7944 }
7945
7946 first_mp = mp;
7947 mp = first_mp->b_cont;
7948 first_mp->b_cont = NULL;
7949
7950 if (mp == NULL) {
7951 freeb(first_mp);
7952 return;
7953 }
7954 ip_dlur_to_mhi(ill, first_mp, &mhi);
7955 if (ill->ill_isv6)
7956 ip_input_v6(ill, NULL, mp, &mhi);
7957 else
7958 ip_input(ill, NULL, mp, &mhi);
7959
7960 /* Ditch the DLPI header. */
7961 freeb(first_mp);
7962 return;
7963 }
7964 case M_IOCACK:
7965 iocp = (struct iocblk *)mp->b_rptr;
7966 switch (iocp->ioc_cmd) {
7967 case DL_IOC_HDR_INFO:
7968 ill_fastpath_ack(ill, mp);
7969 return;
7970 default:
7971 putnext(ill->ill_rq, mp);
7972 return;
7973 }
7974 /* FALLTHRU */
7975 case M_ERROR:
7976 case M_HANGUP:
7977 mutex_enter(&ill->ill_lock);
7978 if (ill->ill_state_flags & ILL_CONDEMNED) {
7979 mutex_exit(&ill->ill_lock);
7980 freemsg(mp);
7981 return;
7982 }
7983 ill_refhold_locked(ill);
7984 mutex_exit(&ill->ill_lock);
7985 qwriter_ip(ill, ill->ill_rq, mp, ip_rput_other, CUR_OP,
7986 B_FALSE);
7987 return;
7988 case M_CTL:
7989 putnext(ill->ill_rq, mp);
7990 return;
7991 case M_IOCNAK:
7992 ip1dbg(("got iocnak "));
7993 iocp = (struct iocblk *)mp->b_rptr;
7994 switch (iocp->ioc_cmd) {
7995 case DL_IOC_HDR_INFO:
7996 ip_rput_other(NULL, ill->ill_rq, mp, NULL);
7997 return;
7998 default:
7999 break;
8000 }
8001 /* FALLTHRU */
8002 default:
8003 putnext(ill->ill_rq, mp);
8004 return;
8005 }
8006 }
8007
8008 /* Read side put procedure. Packets coming from the wire arrive here. */
8009 void
8010 ip_rput(queue_t *q, mblk_t *mp)
8011 {
8012 ill_t *ill;
8013 union DL_primitives *dl;
8014
8015 ill = (ill_t *)q->q_ptr;
8016
8017 if (ill->ill_state_flags & (ILL_CONDEMNED | ILL_LL_SUBNET_PENDING)) {
8018 /*
8019 * If things are opening or closing, only accept high-priority
8020 * DLPI messages. (On open ill->ill_ipif has not yet been
8021 * created; on close, things hanging off the ill may have been
8022 * freed already.)
8023 */
8024 dl = (union DL_primitives *)mp->b_rptr;
8025 if (DB_TYPE(mp) != M_PCPROTO ||
8026 dl->dl_primitive == DL_UNITDATA_IND) {
8027 inet_freemsg(mp);
8028 return;
8029 }
8030 }
8031 if (DB_TYPE(mp) == M_DATA) {
8032 struct mac_header_info_s mhi;
8033
8034 ip_mdata_to_mhi(ill, mp, &mhi);
8035 ip_input(ill, NULL, mp, &mhi);
8036 } else {
8037 ip_rput_notdata(ill, mp);
8038 }
8039 }
8040
8041 /*
8042 * Move the information to a copy.
8043 */
8044 mblk_t *
8045 ip_fix_dbref(mblk_t *mp, ip_recv_attr_t *ira)
8046 {
8047 mblk_t *mp1;
8048 ill_t *ill = ira->ira_ill;
8049 ip_stack_t *ipst = ill->ill_ipst;
8050
8051 IP_STAT(ipst, ip_db_ref);
8052
8053 /* Make sure we have ira_l2src before we loose the original mblk */
8054 if (!(ira->ira_flags & IRAF_L2SRC_SET))
8055 ip_setl2src(mp, ira, ira->ira_rill);
8056
8057 mp1 = copymsg(mp);
8058 if (mp1 == NULL) {
8059 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8060 ip_drop_input("ipIfStatsInDiscards", mp, ill);
8061 freemsg(mp);
8062 return (NULL);
8063 }
8064 /* preserve the hardware checksum flags and data, if present */
8065 if (DB_CKSUMFLAGS(mp) != 0) {
8066 DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp);
8067 DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp);
8068 DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp);
8069 DB_CKSUMEND(mp1) = DB_CKSUMEND(mp);
8070 DB_CKSUM16(mp1) = DB_CKSUM16(mp);
8071 }
8072 freemsg(mp);
8073 return (mp1);
8074 }
8075
8076 static void
8077 ip_dlpi_error(ill_t *ill, t_uscalar_t prim, t_uscalar_t dl_err,
8078 t_uscalar_t err)
8079 {
8080 if (dl_err == DL_SYSERR) {
8081 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
8082 "%s: %s failed: DL_SYSERR (errno %u)\n",
8083 ill->ill_name, dl_primstr(prim), err);
8084 return;
8085 }
8086
8087 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
8088 "%s: %s failed: %s\n", ill->ill_name, dl_primstr(prim),
8089 dl_errstr(dl_err));
8090 }
8091
8092 /*
8093 * ip_rput_dlpi is called by ip_rput to handle all DLPI messages other
8094 * than DL_UNITDATA_IND messages. If we need to process this message
8095 * exclusively, we call qwriter_ip, in which case we also need to call
8096 * ill_refhold before that, since qwriter_ip does an ill_refrele.
8097 */
8098 void
8099 ip_rput_dlpi(ill_t *ill, mblk_t *mp)
8100 {
8101 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr;
8102 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa;
8103 queue_t *q = ill->ill_rq;
8104 t_uscalar_t prim = dloa->dl_primitive;
8105 t_uscalar_t reqprim = DL_PRIM_INVAL;
8106
8107 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi",
8108 char *, dl_primstr(prim), ill_t *, ill);
8109 ip1dbg(("ip_rput_dlpi"));
8110
8111 /*
8112 * If we received an ACK but didn't send a request for it, then it
8113 * can't be part of any pending operation; discard up-front.
8114 */
8115 switch (prim) {
8116 case DL_ERROR_ACK:
8117 reqprim = dlea->dl_error_primitive;
8118 ip2dbg(("ip_rput_dlpi(%s): DL_ERROR_ACK for %s (0x%x): %s "
8119 "(0x%x), unix %u\n", ill->ill_name, dl_primstr(reqprim),
8120 reqprim, dl_errstr(dlea->dl_errno), dlea->dl_errno,
8121 dlea->dl_unix_errno));
8122 break;
8123 case DL_OK_ACK:
8124 reqprim = dloa->dl_correct_primitive;
8125 break;
8126 case DL_INFO_ACK:
8127 reqprim = DL_INFO_REQ;
8128 break;
8129 case DL_BIND_ACK:
8130 reqprim = DL_BIND_REQ;
8131 break;
8132 case DL_PHYS_ADDR_ACK:
8133 reqprim = DL_PHYS_ADDR_REQ;
8134 break;
8135 case DL_NOTIFY_ACK:
8136 reqprim = DL_NOTIFY_REQ;
8137 break;
8138 case DL_CAPABILITY_ACK:
8139 reqprim = DL_CAPABILITY_REQ;
8140 break;
8141 }
8142
8143 if (prim != DL_NOTIFY_IND) {
8144 if (reqprim == DL_PRIM_INVAL ||
8145 !ill_dlpi_pending(ill, reqprim)) {
8146 /* Not a DLPI message we support or expected */
8147 freemsg(mp);
8148 return;
8149 }
8150 ip1dbg(("ip_rput: received %s for %s\n", dl_primstr(prim),
8151 dl_primstr(reqprim)));
8152 }
8153
8154 switch (reqprim) {
8155 case DL_UNBIND_REQ:
8156 /*
8157 * NOTE: we mark the unbind as complete even if we got a
8158 * DL_ERROR_ACK, since there's not much else we can do.
8159 */
8160 mutex_enter(&ill->ill_lock);
8161 ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
8162 cv_signal(&ill->ill_cv);
8163 mutex_exit(&ill->ill_lock);
8164 break;
8165
8166 case DL_ENABMULTI_REQ:
8167 if (prim == DL_OK_ACK) {
8168 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS)
8169 ill->ill_dlpi_multicast_state = IDS_OK;
8170 }
8171 break;
8172 }
8173
8174 /*
8175 * The message is one we're waiting for (or DL_NOTIFY_IND), but we
8176 * need to become writer to continue to process it. Because an
8177 * exclusive operation doesn't complete until replies to all queued
8178 * DLPI messages have been received, we know we're in the middle of an
8179 * exclusive operation and pass CUR_OP (except for DL_NOTIFY_IND).
8180 *
8181 * As required by qwriter_ip(), we refhold the ill; it will refrele.
8182 * Since this is on the ill stream we unconditionally bump up the
8183 * refcount without doing ILL_CAN_LOOKUP().
8184 */
8185 ill_refhold(ill);
8186 if (prim == DL_NOTIFY_IND)
8187 qwriter_ip(ill, q, mp, ip_rput_dlpi_writer, NEW_OP, B_FALSE);
8188 else
8189 qwriter_ip(ill, q, mp, ip_rput_dlpi_writer, CUR_OP, B_FALSE);
8190 }
8191
8192 /*
8193 * Handling of DLPI messages that require exclusive access to the ipsq.
8194 *
8195 * Need to do ipsq_pending_mp_get on ioctl completion, which could
8196 * happen here. (along with mi_copy_done)
8197 */
8198 /* ARGSUSED */
8199 static void
8200 ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8201 {
8202 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr;
8203 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa;
8204 int err = 0;
8205 ill_t *ill = (ill_t *)q->q_ptr;
8206 ipif_t *ipif = NULL;
8207 mblk_t *mp1 = NULL;
8208 conn_t *connp = NULL;
8209 t_uscalar_t paddrreq;
8210 mblk_t *mp_hw;
8211 boolean_t success;
8212 boolean_t ioctl_aborted = B_FALSE;
8213 boolean_t log = B_TRUE;
8214
8215 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer",
8216 char *, dl_primstr(dloa->dl_primitive), ill_t *, ill);
8217
8218 ip1dbg(("ip_rput_dlpi_writer .."));
8219 ASSERT(ipsq->ipsq_xop == ill->ill_phyint->phyint_ipsq->ipsq_xop);
8220 ASSERT(IAM_WRITER_ILL(ill));
8221
8222 ipif = ipsq->ipsq_xop->ipx_pending_ipif;
8223 /*
8224 * The current ioctl could have been aborted by the user and a new
8225 * ioctl to bring up another ill could have started. We could still
8226 * get a response from the driver later.
8227 */
8228 if (ipif != NULL && ipif->ipif_ill != ill)
8229 ioctl_aborted = B_TRUE;
8230
8231 switch (dloa->dl_primitive) {
8232 case DL_ERROR_ACK:
8233 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for %s\n",
8234 dl_primstr(dlea->dl_error_primitive)));
8235
8236 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer error",
8237 char *, dl_primstr(dlea->dl_error_primitive),
8238 ill_t *, ill);
8239
8240 switch (dlea->dl_error_primitive) {
8241 case DL_DISABMULTI_REQ:
8242 ill_dlpi_done(ill, dlea->dl_error_primitive);
8243 break;
8244 case DL_PROMISCON_REQ:
8245 case DL_PROMISCOFF_REQ:
8246 case DL_UNBIND_REQ:
8247 case DL_ATTACH_REQ:
8248 case DL_INFO_REQ:
8249 ill_dlpi_done(ill, dlea->dl_error_primitive);
8250 break;
8251 case DL_NOTIFY_REQ:
8252 ill_dlpi_done(ill, DL_NOTIFY_REQ);
8253 log = B_FALSE;
8254 break;
8255 case DL_PHYS_ADDR_REQ:
8256 /*
8257 * For IPv6 only, there are two additional
8258 * phys_addr_req's sent to the driver to get the
8259 * IPv6 token and lla. This allows IP to acquire
8260 * the hardware address format for a given interface
8261 * without having built in knowledge of the hardware
8262 * address. ill_phys_addr_pend keeps track of the last
8263 * DL_PAR sent so we know which response we are
8264 * dealing with. ill_dlpi_done will update
8265 * ill_phys_addr_pend when it sends the next req.
8266 * We don't complete the IOCTL until all three DL_PARs
8267 * have been attempted, so set *_len to 0 and break.
8268 */
8269 paddrreq = ill->ill_phys_addr_pend;
8270 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ);
8271 if (paddrreq == DL_IPV6_TOKEN) {
8272 ill->ill_token_length = 0;
8273 log = B_FALSE;
8274 break;
8275 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) {
8276 ill->ill_nd_lla_len = 0;
8277 log = B_FALSE;
8278 break;
8279 }
8280 /*
8281 * Something went wrong with the DL_PHYS_ADDR_REQ.
8282 * We presumably have an IOCTL hanging out waiting
8283 * for completion. Find it and complete the IOCTL
8284 * with the error noted.
8285 * However, ill_dl_phys was called on an ill queue
8286 * (from SIOCSLIFNAME), thus conn_pending_ill is not
8287 * set. But the ioctl is known to be pending on ill_wq.
8288 */
8289 if (!ill->ill_ifname_pending)
8290 break;
8291 ill->ill_ifname_pending = 0;
8292 if (!ioctl_aborted)
8293 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8294 if (mp1 != NULL) {
8295 /*
8296 * This operation (SIOCSLIFNAME) must have
8297 * happened on the ill. Assert there is no conn
8298 */
8299 ASSERT(connp == NULL);
8300 q = ill->ill_wq;
8301 }
8302 break;
8303 case DL_BIND_REQ:
8304 ill_dlpi_done(ill, DL_BIND_REQ);
8305 if (ill->ill_ifname_pending)
8306 break;
8307 mutex_enter(&ill->ill_lock);
8308 ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
8309 mutex_exit(&ill->ill_lock);
8310 /*
8311 * Something went wrong with the bind. We presumably
8312 * have an IOCTL hanging out waiting for completion.
8313 * Find it, take down the interface that was coming
8314 * up, and complete the IOCTL with the error noted.
8315 */
8316 if (!ioctl_aborted)
8317 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8318 if (mp1 != NULL) {
8319 /*
8320 * This might be a result of a DL_NOTE_REPLUMB
8321 * notification. In that case, connp is NULL.
8322 */
8323 if (connp != NULL)
8324 q = CONNP_TO_WQ(connp);
8325
8326 (void) ipif_down(ipif, NULL, NULL);
8327 /* error is set below the switch */
8328 }
8329 break;
8330 case DL_ENABMULTI_REQ:
8331 ill_dlpi_done(ill, DL_ENABMULTI_REQ);
8332
8333 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS)
8334 ill->ill_dlpi_multicast_state = IDS_FAILED;
8335 if (ill->ill_dlpi_multicast_state == IDS_FAILED) {
8336
8337 printf("ip: joining multicasts failed (%d)"
8338 " on %s - will use link layer "
8339 "broadcasts for multicast\n",
8340 dlea->dl_errno, ill->ill_name);
8341
8342 /*
8343 * Set up for multi_bcast; We are the
8344 * writer, so ok to access ill->ill_ipif
8345 * without any lock.
8346 */
8347 mutex_enter(&ill->ill_phyint->phyint_lock);
8348 ill->ill_phyint->phyint_flags |=
8349 PHYI_MULTI_BCAST;
8350 mutex_exit(&ill->ill_phyint->phyint_lock);
8351
8352 }
8353 freemsg(mp); /* Don't want to pass this up */
8354 return;
8355 case DL_CAPABILITY_REQ:
8356 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for "
8357 "DL_CAPABILITY REQ\n"));
8358 if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
8359 ill->ill_dlpi_capab_state = IDCS_FAILED;
8360 ill_capability_done(ill);
8361 freemsg(mp);
8362 return;
8363 }
8364 /*
8365 * Note the error for IOCTL completion (mp1 is set when
8366 * ready to complete ioctl). If ill_ifname_pending_err is
8367 * set, an error occured during plumbing (ill_ifname_pending),
8368 * so we want to report that error.
8369 *
8370 * NOTE: there are two addtional DL_PHYS_ADDR_REQ's
8371 * (DL_IPV6_TOKEN and DL_IPV6_LINK_LAYER_ADDR) that are
8372 * expected to get errack'd if the driver doesn't support
8373 * these flags (e.g. ethernet). log will be set to B_FALSE
8374 * if these error conditions are encountered.
8375 */
8376 if (mp1 != NULL) {
8377 if (ill->ill_ifname_pending_err != 0) {
8378 err = ill->ill_ifname_pending_err;
8379 ill->ill_ifname_pending_err = 0;
8380 } else {
8381 err = dlea->dl_unix_errno ?
8382 dlea->dl_unix_errno : ENXIO;
8383 }
8384 /*
8385 * If we're plumbing an interface and an error hasn't already
8386 * been saved, set ill_ifname_pending_err to the error passed
8387 * up. Ignore the error if log is B_FALSE (see comment above).
8388 */
8389 } else if (log && ill->ill_ifname_pending &&
8390 ill->ill_ifname_pending_err == 0) {
8391 ill->ill_ifname_pending_err = dlea->dl_unix_errno ?
8392 dlea->dl_unix_errno : ENXIO;
8393 }
8394
8395 if (log)
8396 ip_dlpi_error(ill, dlea->dl_error_primitive,
8397 dlea->dl_errno, dlea->dl_unix_errno);
8398 break;
8399 case DL_CAPABILITY_ACK:
8400 ill_capability_ack(ill, mp);
8401 /*
8402 * The message has been handed off to ill_capability_ack
8403 * and must not be freed below
8404 */
8405 mp = NULL;
8406 break;
8407
8408 case DL_INFO_ACK:
8409 /* Call a routine to handle this one. */
8410 ill_dlpi_done(ill, DL_INFO_REQ);
8411 ip_ll_subnet_defaults(ill, mp);
8412 ASSERT(!MUTEX_HELD(&ill->ill_phyint->phyint_ipsq->ipsq_lock));
8413 return;
8414 case DL_BIND_ACK:
8415 /*
8416 * We should have an IOCTL waiting on this unless
8417 * sent by ill_dl_phys, in which case just return
8418 */
8419 ill_dlpi_done(ill, DL_BIND_REQ);
8420
8421 if (ill->ill_ifname_pending) {
8422 DTRACE_PROBE2(ip__rput__dlpi__ifname__pending,
8423 ill_t *, ill, mblk_t *, mp);
8424 break;
8425 }
8426 mutex_enter(&ill->ill_lock);
8427 ill->ill_dl_up = 1;
8428 ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
8429 mutex_exit(&ill->ill_lock);
8430
8431 if (!ioctl_aborted)
8432 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8433 if (mp1 == NULL) {
8434 DTRACE_PROBE1(ip__rput__dlpi__no__mblk, ill_t *, ill);
8435 break;
8436 }
8437 /*
8438 * mp1 was added by ill_dl_up(). if that is a result of
8439 * a DL_NOTE_REPLUMB notification, connp could be NULL.
8440 */
8441 if (connp != NULL)
8442 q = CONNP_TO_WQ(connp);
8443 /*
8444 * We are exclusive. So nothing can change even after
8445 * we get the pending mp.
8446 */
8447 ip1dbg(("ip_rput_dlpi: bind_ack %s\n", ill->ill_name));
8448 DTRACE_PROBE1(ip__rput__dlpi__bind__ack, ill_t *, ill);
8449 ill_nic_event_dispatch(ill, 0, NE_UP, NULL, 0);
8450
8451 /*
8452 * Now bring up the resolver; when that is complete, we'll
8453 * create IREs. Note that we intentionally mirror what
8454 * ipif_up() would have done, because we got here by way of
8455 * ill_dl_up(), which stopped ipif_up()'s processing.
8456 */
8457 if (ill->ill_isv6) {
8458 /*
8459 * v6 interfaces.
8460 * Unlike ARP which has to do another bind
8461 * and attach, once we get here we are
8462 * done with NDP
8463 */
8464 (void) ipif_resolver_up(ipif, Res_act_initial);
8465 if ((err = ipif_ndp_up(ipif, B_TRUE)) == 0)
8466 err = ipif_up_done_v6(ipif);
8467 } else if (ill->ill_net_type == IRE_IF_RESOLVER) {
8468 /*
8469 * ARP and other v4 external resolvers.
8470 * Leave the pending mblk intact so that
8471 * the ioctl completes in ip_rput().
8472 */
8473 if (connp != NULL)
8474 mutex_enter(&connp->conn_lock);
8475 mutex_enter(&ill->ill_lock);
8476 success = ipsq_pending_mp_add(connp, ipif, q, mp1, 0);
8477 mutex_exit(&ill->ill_lock);
8478 if (connp != NULL)
8479 mutex_exit(&connp->conn_lock);
8480 if (success) {
8481 err = ipif_resolver_up(ipif, Res_act_initial);
8482 if (err == EINPROGRESS) {
8483 freemsg(mp);
8484 return;
8485 }
8486 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8487 } else {
8488 /* The conn has started closing */
8489 err = EINTR;
8490 }
8491 } else {
8492 /*
8493 * This one is complete. Reply to pending ioctl.
8494 */
8495 (void) ipif_resolver_up(ipif, Res_act_initial);
8496 err = ipif_up_done(ipif);
8497 }
8498
8499 if ((err == 0) && (ill->ill_up_ipifs)) {
8500 err = ill_up_ipifs(ill, q, mp1);
8501 if (err == EINPROGRESS) {
8502 freemsg(mp);
8503 return;
8504 }
8505 }
8506
8507 /*
8508 * If we have a moved ipif to bring up, and everything has
8509 * succeeded to this point, bring it up on the IPMP ill.
8510 * Otherwise, leave it down -- the admin can try to bring it
8511 * up by hand if need be.
8512 */
8513 if (ill->ill_move_ipif != NULL) {
8514 if (err != 0) {
8515 ill->ill_move_ipif = NULL;
8516 } else {
8517 ipif = ill->ill_move_ipif;
8518 ill->ill_move_ipif = NULL;
8519 err = ipif_up(ipif, q, mp1);
8520 if (err == EINPROGRESS) {
8521 freemsg(mp);
8522 return;
8523 }
8524 }
8525 }
8526 break;
8527
8528 case DL_NOTIFY_IND: {
8529 dl_notify_ind_t *notify = (dl_notify_ind_t *)mp->b_rptr;
8530 uint_t orig_mtu, orig_mc_mtu;
8531
8532 switch (notify->dl_notification) {
8533 case DL_NOTE_PHYS_ADDR:
8534 err = ill_set_phys_addr(ill, mp);
8535 break;
8536
8537 case DL_NOTE_REPLUMB:
8538 /*
8539 * Directly return after calling ill_replumb().
8540 * Note that we should not free mp as it is reused
8541 * in the ill_replumb() function.
8542 */
8543 err = ill_replumb(ill, mp);
8544 return;
8545
8546 case DL_NOTE_FASTPATH_FLUSH:
8547 nce_flush(ill, B_FALSE);
8548 break;
8549
8550 case DL_NOTE_SDU_SIZE:
8551 case DL_NOTE_SDU_SIZE2:
8552 /*
8553 * The dce and fragmentation code can cope with
8554 * this changing while packets are being sent.
8555 * When packets are sent ip_output will discover
8556 * a change.
8557 *
8558 * Change the MTU size of the interface.
8559 */
8560 mutex_enter(&ill->ill_lock);
8561 orig_mtu = ill->ill_mtu;
8562 orig_mc_mtu = ill->ill_mc_mtu;
8563 switch (notify->dl_notification) {
8564 case DL_NOTE_SDU_SIZE:
8565 ill->ill_current_frag =
8566 (uint_t)notify->dl_data;
8567 ill->ill_mc_mtu = (uint_t)notify->dl_data;
8568 break;
8569 case DL_NOTE_SDU_SIZE2:
8570 ill->ill_current_frag =
8571 (uint_t)notify->dl_data1;
8572 ill->ill_mc_mtu = (uint_t)notify->dl_data2;
8573 break;
8574 }
8575 if (ill->ill_current_frag > ill->ill_max_frag)
8576 ill->ill_max_frag = ill->ill_current_frag;
8577
8578 if (!(ill->ill_flags & ILLF_FIXEDMTU)) {
8579 ill->ill_mtu = ill->ill_current_frag;
8580
8581 /*
8582 * If ill_user_mtu was set (via
8583 * SIOCSLIFLNKINFO), clamp ill_mtu at it.
8584 */
8585 if (ill->ill_user_mtu != 0 &&
8586 ill->ill_user_mtu < ill->ill_mtu)
8587 ill->ill_mtu = ill->ill_user_mtu;
8588
8589 if (ill->ill_user_mtu != 0 &&
8590 ill->ill_user_mtu < ill->ill_mc_mtu)
8591 ill->ill_mc_mtu = ill->ill_user_mtu;
8592
8593 if (ill->ill_isv6) {
8594 if (ill->ill_mtu < IPV6_MIN_MTU)
8595 ill->ill_mtu = IPV6_MIN_MTU;
8596 if (ill->ill_mc_mtu < IPV6_MIN_MTU)
8597 ill->ill_mc_mtu = IPV6_MIN_MTU;
8598 } else {
8599 if (ill->ill_mtu < IP_MIN_MTU)
8600 ill->ill_mtu = IP_MIN_MTU;
8601 if (ill->ill_mc_mtu < IP_MIN_MTU)
8602 ill->ill_mc_mtu = IP_MIN_MTU;
8603 }
8604 } else if (ill->ill_mc_mtu > ill->ill_mtu) {
8605 ill->ill_mc_mtu = ill->ill_mtu;
8606 }
8607
8608 mutex_exit(&ill->ill_lock);
8609 /*
8610 * Make sure all dce_generation checks find out
8611 * that ill_mtu/ill_mc_mtu has changed.
8612 */
8613 if (orig_mtu != ill->ill_mtu ||
8614 orig_mc_mtu != ill->ill_mc_mtu) {
8615 dce_increment_all_generations(ill->ill_isv6,
8616 ill->ill_ipst);
8617 }
8618
8619 /*
8620 * Refresh IPMP meta-interface MTU if necessary.
8621 */
8622 if (IS_UNDER_IPMP(ill))
8623 ipmp_illgrp_refresh_mtu(ill->ill_grp);
8624 break;
8625
8626 case DL_NOTE_LINK_UP:
8627 case DL_NOTE_LINK_DOWN: {
8628 /*
8629 * We are writer. ill / phyint / ipsq assocs stable.
8630 * The RUNNING flag reflects the state of the link.
8631 */
8632 phyint_t *phyint = ill->ill_phyint;
8633 uint64_t new_phyint_flags;
8634 boolean_t changed = B_FALSE;
8635 boolean_t went_up;
8636
8637 went_up = notify->dl_notification == DL_NOTE_LINK_UP;
8638 mutex_enter(&phyint->phyint_lock);
8639
8640 new_phyint_flags = went_up ?
8641 phyint->phyint_flags | PHYI_RUNNING :
8642 phyint->phyint_flags & ~PHYI_RUNNING;
8643
8644 if (IS_IPMP(ill)) {
8645 new_phyint_flags = went_up ?
8646 new_phyint_flags & ~PHYI_FAILED :
8647 new_phyint_flags | PHYI_FAILED;
8648 }
8649
8650 if (new_phyint_flags != phyint->phyint_flags) {
8651 phyint->phyint_flags = new_phyint_flags;
8652 changed = B_TRUE;
8653 }
8654 mutex_exit(&phyint->phyint_lock);
8655 /*
8656 * ill_restart_dad handles the DAD restart and routing
8657 * socket notification logic.
8658 */
8659 if (changed) {
8660 ill_restart_dad(phyint->phyint_illv4, went_up);
8661 ill_restart_dad(phyint->phyint_illv6, went_up);
8662 }
8663 break;
8664 }
8665 case DL_NOTE_PROMISC_ON_PHYS: {
8666 phyint_t *phyint = ill->ill_phyint;
8667
8668 mutex_enter(&phyint->phyint_lock);
8669 phyint->phyint_flags |= PHYI_PROMISC;
8670 mutex_exit(&phyint->phyint_lock);
8671 break;
8672 }
8673 case DL_NOTE_PROMISC_OFF_PHYS: {
8674 phyint_t *phyint = ill->ill_phyint;
8675
8676 mutex_enter(&phyint->phyint_lock);
8677 phyint->phyint_flags &= ~PHYI_PROMISC;
8678 mutex_exit(&phyint->phyint_lock);
8679 break;
8680 }
8681 case DL_NOTE_CAPAB_RENEG:
8682 /*
8683 * Something changed on the driver side.
8684 * It wants us to renegotiate the capabilities
8685 * on this ill. One possible cause is the aggregation
8686 * interface under us where a port got added or
8687 * went away.
8688 *
8689 * If the capability negotiation is already done
8690 * or is in progress, reset the capabilities and
8691 * mark the ill's ill_capab_reneg to be B_TRUE,
8692 * so that when the ack comes back, we can start
8693 * the renegotiation process.
8694 *
8695 * Note that if ill_capab_reneg is already B_TRUE
8696 * (ill_dlpi_capab_state is IDS_UNKNOWN in this case),
8697 * the capability resetting request has been sent
8698 * and the renegotiation has not been started yet;
8699 * nothing needs to be done in this case.
8700 */
8701 ipsq_current_start(ipsq, ill->ill_ipif, 0);
8702 ill_capability_reset(ill, B_TRUE);
8703 ipsq_current_finish(ipsq);
8704 break;
8705
8706 case DL_NOTE_ALLOWED_IPS:
8707 ill_set_allowed_ips(ill, mp);
8708 break;
8709 default:
8710 ip0dbg(("ip_rput_dlpi_writer: unknown notification "
8711 "type 0x%x for DL_NOTIFY_IND\n",
8712 notify->dl_notification));
8713 break;
8714 }
8715
8716 /*
8717 * As this is an asynchronous operation, we
8718 * should not call ill_dlpi_done
8719 */
8720 break;
8721 }
8722 case DL_NOTIFY_ACK: {
8723 dl_notify_ack_t *noteack = (dl_notify_ack_t *)mp->b_rptr;
8724
8725 if (noteack->dl_notifications & DL_NOTE_LINK_UP)
8726 ill->ill_note_link = 1;
8727 ill_dlpi_done(ill, DL_NOTIFY_REQ);
8728 break;
8729 }
8730 case DL_PHYS_ADDR_ACK: {
8731 /*
8732 * As part of plumbing the interface via SIOCSLIFNAME,
8733 * ill_dl_phys() will queue a series of DL_PHYS_ADDR_REQs,
8734 * whose answers we receive here. As each answer is received,
8735 * we call ill_dlpi_done() to dispatch the next request as
8736 * we're processing the current one. Once all answers have
8737 * been received, we use ipsq_pending_mp_get() to dequeue the
8738 * outstanding IOCTL and reply to it. (Because ill_dl_phys()
8739 * is invoked from an ill queue, conn_oper_pending_ill is not
8740 * available, but we know the ioctl is pending on ill_wq.)
8741 */
8742 uint_t paddrlen, paddroff;
8743 uint8_t *addr;
8744
8745 paddrreq = ill->ill_phys_addr_pend;
8746 paddrlen = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_length;
8747 paddroff = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_offset;
8748 addr = mp->b_rptr + paddroff;
8749
8750 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ);
8751 if (paddrreq == DL_IPV6_TOKEN) {
8752 /*
8753 * bcopy to low-order bits of ill_token
8754 *
8755 * XXX Temporary hack - currently, all known tokens
8756 * are 64 bits, so I'll cheat for the moment.
8757 */
8758 bcopy(addr, &ill->ill_token.s6_addr32[2], paddrlen);
8759 ill->ill_token_length = paddrlen;
8760 break;
8761 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) {
8762 ASSERT(ill->ill_nd_lla_mp == NULL);
8763 ill_set_ndmp(ill, mp, paddroff, paddrlen);
8764 mp = NULL;
8765 break;
8766 } else if (paddrreq == DL_CURR_DEST_ADDR) {
8767 ASSERT(ill->ill_dest_addr_mp == NULL);
8768 ill->ill_dest_addr_mp = mp;
8769 ill->ill_dest_addr = addr;
8770 mp = NULL;
8771 if (ill->ill_isv6) {
8772 ill_setdesttoken(ill);
8773 ipif_setdestlinklocal(ill->ill_ipif);
8774 }
8775 break;
8776 }
8777
8778 ASSERT(paddrreq == DL_CURR_PHYS_ADDR);
8779 ASSERT(ill->ill_phys_addr_mp == NULL);
8780 if (!ill->ill_ifname_pending)
8781 break;
8782 ill->ill_ifname_pending = 0;
8783 if (!ioctl_aborted)
8784 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8785 if (mp1 != NULL) {
8786 ASSERT(connp == NULL);
8787 q = ill->ill_wq;
8788 }
8789 /*
8790 * If any error acks received during the plumbing sequence,
8791 * ill_ifname_pending_err will be set. Break out and send up
8792 * the error to the pending ioctl.
8793 */
8794 if (ill->ill_ifname_pending_err != 0) {
8795 err = ill->ill_ifname_pending_err;
8796 ill->ill_ifname_pending_err = 0;
8797 break;
8798 }
8799
8800 ill->ill_phys_addr_mp = mp;
8801 ill->ill_phys_addr = (paddrlen == 0 ? NULL : addr);
8802 mp = NULL;
8803
8804 /*
8805 * If paddrlen or ill_phys_addr_length is zero, the DLPI
8806 * provider doesn't support physical addresses. We check both
8807 * paddrlen and ill_phys_addr_length because sppp (PPP) does
8808 * not have physical addresses, but historically adversises a
8809 * physical address length of 0 in its DL_INFO_ACK, but 6 in
8810 * its DL_PHYS_ADDR_ACK.
8811 */
8812 if (paddrlen == 0 || ill->ill_phys_addr_length == 0) {
8813 ill->ill_phys_addr = NULL;
8814 } else if (paddrlen != ill->ill_phys_addr_length) {
8815 ip0dbg(("DL_PHYS_ADDR_ACK: got addrlen %d, expected %d",
8816 paddrlen, ill->ill_phys_addr_length));
8817 err = EINVAL;
8818 break;
8819 }
8820
8821 if (ill->ill_nd_lla_mp == NULL) {
8822 if ((mp_hw = copyb(ill->ill_phys_addr_mp)) == NULL) {
8823 err = ENOMEM;
8824 break;
8825 }
8826 ill_set_ndmp(ill, mp_hw, paddroff, paddrlen);
8827 }
8828
8829 if (ill->ill_isv6) {
8830 ill_setdefaulttoken(ill);
8831 ipif_setlinklocal(ill->ill_ipif);
8832 }
8833 break;
8834 }
8835 case DL_OK_ACK:
8836 ip2dbg(("DL_OK_ACK %s (0x%x)\n",
8837 dl_primstr((int)dloa->dl_correct_primitive),
8838 dloa->dl_correct_primitive));
8839 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer ok",
8840 char *, dl_primstr(dloa->dl_correct_primitive),
8841 ill_t *, ill);
8842
8843 switch (dloa->dl_correct_primitive) {
8844 case DL_ENABMULTI_REQ:
8845 case DL_DISABMULTI_REQ:
8846 ill_dlpi_done(ill, dloa->dl_correct_primitive);
8847 break;
8848 case DL_PROMISCON_REQ:
8849 case DL_PROMISCOFF_REQ:
8850 case DL_UNBIND_REQ:
8851 case DL_ATTACH_REQ:
8852 ill_dlpi_done(ill, dloa->dl_correct_primitive);
8853 break;
8854 }
8855 break;
8856 default:
8857 break;
8858 }
8859
8860 freemsg(mp);
8861 if (mp1 == NULL)
8862 return;
8863
8864 /*
8865 * The operation must complete without EINPROGRESS since
8866 * ipsq_pending_mp_get() has removed the mblk (mp1). Otherwise,
8867 * the operation will be stuck forever inside the IPSQ.
8868 */
8869 ASSERT(err != EINPROGRESS);
8870
8871 DTRACE_PROBE4(ipif__ioctl, char *, "ip_rput_dlpi_writer finish",
8872 int, ipsq->ipsq_xop->ipx_current_ioctl, ill_t *, ill,
8873 ipif_t *, NULL);
8874
8875 switch (ipsq->ipsq_xop->ipx_current_ioctl) {
8876 case 0:
8877 ipsq_current_finish(ipsq);
8878 break;
8879
8880 case SIOCSLIFNAME:
8881 case IF_UNITSEL: {
8882 ill_t *ill_other = ILL_OTHER(ill);
8883
8884 /*
8885 * If SIOCSLIFNAME or IF_UNITSEL is about to succeed, and the
8886 * ill has a peer which is in an IPMP group, then place ill
8887 * into the same group. One catch: although ifconfig plumbs
8888 * the appropriate IPMP meta-interface prior to plumbing this
8889 * ill, it is possible for multiple ifconfig applications to
8890 * race (or for another application to adjust plumbing), in
8891 * which case the IPMP meta-interface we need will be missing.
8892 * If so, kick the phyint out of the group.
8893 */
8894 if (err == 0 && ill_other != NULL && IS_UNDER_IPMP(ill_other)) {
8895 ipmp_grp_t *grp = ill->ill_phyint->phyint_grp;
8896 ipmp_illgrp_t *illg;
8897
8898 illg = ill->ill_isv6 ? grp->gr_v6 : grp->gr_v4;
8899 if (illg == NULL)
8900 ipmp_phyint_leave_grp(ill->ill_phyint);
8901 else
8902 ipmp_ill_join_illgrp(ill, illg);
8903 }
8904
8905 if (ipsq->ipsq_xop->ipx_current_ioctl == IF_UNITSEL)
8906 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
8907 else
8908 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq);
8909 break;
8910 }
8911 case SIOCLIFADDIF:
8912 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq);
8913 break;
8914
8915 default:
8916 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
8917 break;
8918 }
8919 }
8920
8921 /*
8922 * ip_rput_other is called by ip_rput to handle messages modifying the global
8923 * state in IP. If 'ipsq' is non-NULL, caller is writer on it.
8924 */
8925 /* ARGSUSED */
8926 void
8927 ip_rput_other(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8928 {
8929 ill_t *ill = q->q_ptr;
8930 struct iocblk *iocp;
8931
8932 ip1dbg(("ip_rput_other "));
8933 if (ipsq != NULL) {
8934 ASSERT(IAM_WRITER_IPSQ(ipsq));
8935 ASSERT(ipsq->ipsq_xop ==
8936 ill->ill_phyint->phyint_ipsq->ipsq_xop);
8937 }
8938
8939 switch (mp->b_datap->db_type) {
8940 case M_ERROR:
8941 case M_HANGUP:
8942 /*
8943 * The device has a problem. We force the ILL down. It can
8944 * be brought up again manually using SIOCSIFFLAGS (via
8945 * ifconfig or equivalent).
8946 */
8947 ASSERT(ipsq != NULL);
8948 if (mp->b_rptr < mp->b_wptr)
8949 ill->ill_error = (int)(*mp->b_rptr & 0xFF);
8950 if (ill->ill_error == 0)
8951 ill->ill_error = ENXIO;
8952 if (!ill_down_start(q, mp))
8953 return;
8954 ipif_all_down_tail(ipsq, q, mp, NULL);
8955 break;
8956 case M_IOCNAK: {
8957 iocp = (struct iocblk *)mp->b_rptr;
8958
8959 ASSERT(iocp->ioc_cmd == DL_IOC_HDR_INFO);
8960 /*
8961 * If this was the first attempt, turn off the fastpath
8962 * probing.
8963 */
8964 mutex_enter(&ill->ill_lock);
8965 if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS) {
8966 ill->ill_dlpi_fastpath_state = IDS_FAILED;
8967 mutex_exit(&ill->ill_lock);
8968 /*
8969 * don't flush the nce_t entries: we use them
8970 * as an index to the ncec itself.
8971 */
8972 ip1dbg(("ip_rput: DLPI fastpath off on interface %s\n",
8973 ill->ill_name));
8974 } else {
8975 mutex_exit(&ill->ill_lock);
8976 }
8977 freemsg(mp);
8978 break;
8979 }
8980 default:
8981 ASSERT(0);
8982 break;
8983 }
8984 }
8985
8986 /*
8987 * Update any source route, record route or timestamp options
8988 * When it fails it has consumed the message and BUMPed the MIB.
8989 */
8990 boolean_t
8991 ip_forward_options(mblk_t *mp, ipha_t *ipha, ill_t *dst_ill,
8992 ip_recv_attr_t *ira)
8993 {
8994 ipoptp_t opts;
8995 uchar_t *opt;
8996 uint8_t optval;
8997 uint8_t optlen;
8998 ipaddr_t dst;
8999 ipaddr_t ifaddr;
9000 uint32_t ts;
9001 timestruc_t now;
9002 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
9003
9004 ip2dbg(("ip_forward_options\n"));
9005 dst = ipha->ipha_dst;
9006 for (optval = ipoptp_first(&opts, ipha);
9007 optval != IPOPT_EOL;
9008 optval = ipoptp_next(&opts)) {
9009 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
9010 opt = opts.ipoptp_cur;
9011 optlen = opts.ipoptp_len;
9012 ip2dbg(("ip_forward_options: opt %d, len %d\n",
9013 optval, opts.ipoptp_len));
9014 switch (optval) {
9015 uint32_t off;
9016 case IPOPT_SSRR:
9017 case IPOPT_LSRR:
9018 /* Check if adminstratively disabled */
9019 if (!ipst->ips_ip_forward_src_routed) {
9020 BUMP_MIB(dst_ill->ill_ip_mib,
9021 ipIfStatsForwProhibits);
9022 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
9023 mp, dst_ill);
9024 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED,
9025 ira);
9026 return (B_FALSE);
9027 }
9028 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9029 /*
9030 * Must be partial since ip_input_options
9031 * checked for strict.
9032 */
9033 break;
9034 }
9035 off = opt[IPOPT_OFFSET];
9036 off--;
9037 redo_srr:
9038 if (optlen < IP_ADDR_LEN ||
9039 off > optlen - IP_ADDR_LEN) {
9040 /* End of source route */
9041 ip1dbg((
9042 "ip_forward_options: end of SR\n"));
9043 break;
9044 }
9045 /* Pick a reasonable address on the outbound if */
9046 ASSERT(dst_ill != NULL);
9047 if (ip_select_source_v4(dst_ill, INADDR_ANY, dst,
9048 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL,
9049 NULL) != 0) {
9050 /* No source! Shouldn't happen */
9051 ifaddr = INADDR_ANY;
9052 }
9053 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9054 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9055 ip1dbg(("ip_forward_options: next hop 0x%x\n",
9056 ntohl(dst)));
9057
9058 /*
9059 * Check if our address is present more than
9060 * once as consecutive hops in source route.
9061 */
9062 if (ip_type_v4(dst, ipst) == IRE_LOCAL) {
9063 off += IP_ADDR_LEN;
9064 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9065 goto redo_srr;
9066 }
9067 ipha->ipha_dst = dst;
9068 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9069 break;
9070 case IPOPT_RR:
9071 off = opt[IPOPT_OFFSET];
9072 off--;
9073 if (optlen < IP_ADDR_LEN ||
9074 off > optlen - IP_ADDR_LEN) {
9075 /* No more room - ignore */
9076 ip1dbg((
9077 "ip_forward_options: end of RR\n"));
9078 break;
9079 }
9080 /* Pick a reasonable address on the outbound if */
9081 ASSERT(dst_ill != NULL);
9082 if (ip_select_source_v4(dst_ill, INADDR_ANY, dst,
9083 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL,
9084 NULL) != 0) {
9085 /* No source! Shouldn't happen */
9086 ifaddr = INADDR_ANY;
9087 }
9088 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9089 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9090 break;
9091 case IPOPT_TS:
9092 /* Insert timestamp if there is room */
9093 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9094 case IPOPT_TS_TSONLY:
9095 off = IPOPT_TS_TIMELEN;
9096 break;
9097 case IPOPT_TS_PRESPEC:
9098 case IPOPT_TS_PRESPEC_RFC791:
9099 /* Verify that the address matched */
9100 off = opt[IPOPT_OFFSET] - 1;
9101 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9102 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9103 /* Not for us */
9104 break;
9105 }
9106 /* FALLTHRU */
9107 case IPOPT_TS_TSANDADDR:
9108 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
9109 break;
9110 default:
9111 /*
9112 * ip_*put_options should have already
9113 * dropped this packet.
9114 */
9115 cmn_err(CE_PANIC, "ip_forward_options: "
9116 "unknown IT - bug in ip_input_options?\n");
9117 return (B_TRUE); /* Keep "lint" happy */
9118 }
9119 if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
9120 /* Increase overflow counter */
9121 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
9122 opt[IPOPT_POS_OV_FLG] =
9123 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) |
9124 (off << 4));
9125 break;
9126 }
9127 off = opt[IPOPT_OFFSET] - 1;
9128 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9129 case IPOPT_TS_PRESPEC:
9130 case IPOPT_TS_PRESPEC_RFC791:
9131 case IPOPT_TS_TSANDADDR:
9132 /* Pick a reasonable addr on the outbound if */
9133 ASSERT(dst_ill != NULL);
9134 if (ip_select_source_v4(dst_ill, INADDR_ANY,
9135 dst, INADDR_ANY, ALL_ZONES, ipst, &ifaddr,
9136 NULL, NULL) != 0) {
9137 /* No source! Shouldn't happen */
9138 ifaddr = INADDR_ANY;
9139 }
9140 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9141 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9142 /* FALLTHRU */
9143 case IPOPT_TS_TSONLY:
9144 off = opt[IPOPT_OFFSET] - 1;
9145 /* Compute # of milliseconds since midnight */
9146 gethrestime(&now);
9147 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
9148 now.tv_nsec / (NANOSEC / MILLISEC);
9149 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
9150 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
9151 break;
9152 }
9153 break;
9154 }
9155 }
9156 return (B_TRUE);
9157 }
9158
9159 /*
9160 * Call ill_frag_timeout to do garbage collection. ill_frag_timeout
9161 * returns 'true' if there are still fragments left on the queue, in
9162 * which case we restart the timer.
9163 */
9164 void
9165 ill_frag_timer(void *arg)
9166 {
9167 ill_t *ill = (ill_t *)arg;
9168 boolean_t frag_pending;
9169 ip_stack_t *ipst = ill->ill_ipst;
9170 time_t timeout;
9171
9172 mutex_enter(&ill->ill_lock);
9173 ASSERT(!ill->ill_fragtimer_executing);
9174 if (ill->ill_state_flags & ILL_CONDEMNED) {
9175 ill->ill_frag_timer_id = 0;
9176 mutex_exit(&ill->ill_lock);
9177 return;
9178 }
9179 ill->ill_fragtimer_executing = 1;
9180 mutex_exit(&ill->ill_lock);
9181
9182 timeout = (ill->ill_isv6 ? ipst->ips_ipv6_reassembly_timeout :
9183 ipst->ips_ip_reassembly_timeout);
9184
9185 frag_pending = ill_frag_timeout(ill, timeout);
9186
9187 /*
9188 * Restart the timer, if we have fragments pending or if someone
9189 * wanted us to be scheduled again.
9190 */
9191 mutex_enter(&ill->ill_lock);
9192 ill->ill_fragtimer_executing = 0;
9193 ill->ill_frag_timer_id = 0;
9194 if (frag_pending || ill->ill_fragtimer_needrestart)
9195 ill_frag_timer_start(ill);
9196 mutex_exit(&ill->ill_lock);
9197 }
9198
9199 void
9200 ill_frag_timer_start(ill_t *ill)
9201 {
9202 ip_stack_t *ipst = ill->ill_ipst;
9203 clock_t timeo_ms;
9204
9205 ASSERT(MUTEX_HELD(&ill->ill_lock));
9206
9207 /* If the ill is closing or opening don't proceed */
9208 if (ill->ill_state_flags & ILL_CONDEMNED)
9209 return;
9210
9211 if (ill->ill_fragtimer_executing) {
9212 /*
9213 * ill_frag_timer is currently executing. Just record the
9214 * the fact that we want the timer to be restarted.
9215 * ill_frag_timer will post a timeout before it returns,
9216 * ensuring it will be called again.
9217 */
9218 ill->ill_fragtimer_needrestart = 1;
9219 return;
9220 }
9221
9222 if (ill->ill_frag_timer_id == 0) {
9223 timeo_ms = (ill->ill_isv6 ? ipst->ips_ipv6_reassembly_timeout :
9224 ipst->ips_ip_reassembly_timeout) * SECONDS;
9225
9226 /*
9227 * The timer is neither running nor is the timeout handler
9228 * executing. Post a timeout so that ill_frag_timer will be
9229 * called
9230 */
9231 ill->ill_frag_timer_id = timeout(ill_frag_timer, ill,
9232 MSEC_TO_TICK(timeo_ms >> 1));
9233 ill->ill_fragtimer_needrestart = 0;
9234 }
9235 }
9236
9237 /*
9238 * Update any source route, record route or timestamp options.
9239 * Check that we are at end of strict source route.
9240 * The options have already been checked for sanity in ip_input_options().
9241 */
9242 boolean_t
9243 ip_input_local_options(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
9244 {
9245 ipoptp_t opts;
9246 uchar_t *opt;
9247 uint8_t optval;
9248 uint8_t optlen;
9249 ipaddr_t dst;
9250 ipaddr_t ifaddr;
9251 uint32_t ts;
9252 timestruc_t now;
9253 ill_t *ill = ira->ira_ill;
9254 ip_stack_t *ipst = ill->ill_ipst;
9255
9256 ip2dbg(("ip_input_local_options\n"));
9257
9258 for (optval = ipoptp_first(&opts, ipha);
9259 optval != IPOPT_EOL;
9260 optval = ipoptp_next(&opts)) {
9261 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
9262 opt = opts.ipoptp_cur;
9263 optlen = opts.ipoptp_len;
9264 ip2dbg(("ip_input_local_options: opt %d, len %d\n",
9265 optval, optlen));
9266 switch (optval) {
9267 uint32_t off;
9268 case IPOPT_SSRR:
9269 case IPOPT_LSRR:
9270 off = opt[IPOPT_OFFSET];
9271 off--;
9272 if (optlen < IP_ADDR_LEN ||
9273 off > optlen - IP_ADDR_LEN) {
9274 /* End of source route */
9275 ip1dbg(("ip_input_local_options: end of SR\n"));
9276 break;
9277 }
9278 /*
9279 * This will only happen if two consecutive entries
9280 * in the source route contains our address or if
9281 * it is a packet with a loose source route which
9282 * reaches us before consuming the whole source route
9283 */
9284 ip1dbg(("ip_input_local_options: not end of SR\n"));
9285 if (optval == IPOPT_SSRR) {
9286 goto bad_src_route;
9287 }
9288 /*
9289 * Hack: instead of dropping the packet truncate the
9290 * source route to what has been used by filling the
9291 * rest with IPOPT_NOP.
9292 */
9293 opt[IPOPT_OLEN] = (uint8_t)off;
9294 while (off < optlen) {
9295 opt[off++] = IPOPT_NOP;
9296 }
9297 break;
9298 case IPOPT_RR:
9299 off = opt[IPOPT_OFFSET];
9300 off--;
9301 if (optlen < IP_ADDR_LEN ||
9302 off > optlen - IP_ADDR_LEN) {
9303 /* No more room - ignore */
9304 ip1dbg((
9305 "ip_input_local_options: end of RR\n"));
9306 break;
9307 }
9308 /* Pick a reasonable address on the outbound if */
9309 if (ip_select_source_v4(ill, INADDR_ANY, ipha->ipha_dst,
9310 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL,
9311 NULL) != 0) {
9312 /* No source! Shouldn't happen */
9313 ifaddr = INADDR_ANY;
9314 }
9315 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9316 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9317 break;
9318 case IPOPT_TS:
9319 /* Insert timestamp if there is romm */
9320 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9321 case IPOPT_TS_TSONLY:
9322 off = IPOPT_TS_TIMELEN;
9323 break;
9324 case IPOPT_TS_PRESPEC:
9325 case IPOPT_TS_PRESPEC_RFC791:
9326 /* Verify that the address matched */
9327 off = opt[IPOPT_OFFSET] - 1;
9328 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9329 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9330 /* Not for us */
9331 break;
9332 }
9333 /* FALLTHRU */
9334 case IPOPT_TS_TSANDADDR:
9335 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
9336 break;
9337 default:
9338 /*
9339 * ip_*put_options should have already
9340 * dropped this packet.
9341 */
9342 cmn_err(CE_PANIC, "ip_input_local_options: "
9343 "unknown IT - bug in ip_input_options?\n");
9344 return (B_TRUE); /* Keep "lint" happy */
9345 }
9346 if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
9347 /* Increase overflow counter */
9348 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
9349 opt[IPOPT_POS_OV_FLG] =
9350 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) |
9351 (off << 4));
9352 break;
9353 }
9354 off = opt[IPOPT_OFFSET] - 1;
9355 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9356 case IPOPT_TS_PRESPEC:
9357 case IPOPT_TS_PRESPEC_RFC791:
9358 case IPOPT_TS_TSANDADDR:
9359 /* Pick a reasonable addr on the outbound if */
9360 if (ip_select_source_v4(ill, INADDR_ANY,
9361 ipha->ipha_dst, INADDR_ANY, ALL_ZONES, ipst,
9362 &ifaddr, NULL, NULL) != 0) {
9363 /* No source! Shouldn't happen */
9364 ifaddr = INADDR_ANY;
9365 }
9366 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9367 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9368 /* FALLTHRU */
9369 case IPOPT_TS_TSONLY:
9370 off = opt[IPOPT_OFFSET] - 1;
9371 /* Compute # of milliseconds since midnight */
9372 gethrestime(&now);
9373 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
9374 now.tv_nsec / (NANOSEC / MILLISEC);
9375 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
9376 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
9377 break;
9378 }
9379 break;
9380 }
9381 }
9382 return (B_TRUE);
9383
9384 bad_src_route:
9385 /* make sure we clear any indication of a hardware checksum */
9386 DB_CKSUMFLAGS(mp) = 0;
9387 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
9388 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
9389 return (B_FALSE);
9390
9391 }
9392
9393 /*
9394 * Process IP options in an inbound packet. Always returns the nexthop.
9395 * Normally this is the passed in nexthop, but if there is an option
9396 * that effects the nexthop (such as a source route) that will be returned.
9397 * Sets *errorp if there is an error, in which case an ICMP error has been sent
9398 * and mp freed.
9399 */
9400 ipaddr_t
9401 ip_input_options(ipha_t *ipha, ipaddr_t dst, mblk_t *mp,
9402 ip_recv_attr_t *ira, int *errorp)
9403 {
9404 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
9405 ipoptp_t opts;
9406 uchar_t *opt;
9407 uint8_t optval;
9408 uint8_t optlen;
9409 intptr_t code = 0;
9410 ire_t *ire;
9411
9412 ip2dbg(("ip_input_options\n"));
9413 *errorp = 0;
9414 for (optval = ipoptp_first(&opts, ipha);
9415 optval != IPOPT_EOL;
9416 optval = ipoptp_next(&opts)) {
9417 opt = opts.ipoptp_cur;
9418 optlen = opts.ipoptp_len;
9419 ip2dbg(("ip_input_options: opt %d, len %d\n",
9420 optval, optlen));
9421 /*
9422 * Note: we need to verify the checksum before we
9423 * modify anything thus this routine only extracts the next
9424 * hop dst from any source route.
9425 */
9426 switch (optval) {
9427 uint32_t off;
9428 case IPOPT_SSRR:
9429 case IPOPT_LSRR:
9430 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9431 if (optval == IPOPT_SSRR) {
9432 ip1dbg(("ip_input_options: not next"
9433 " strict source route 0x%x\n",
9434 ntohl(dst)));
9435 code = (char *)&ipha->ipha_dst -
9436 (char *)ipha;
9437 goto param_prob; /* RouterReq's */
9438 }
9439 ip2dbg(("ip_input_options: "
9440 "not next source route 0x%x\n",
9441 ntohl(dst)));
9442 break;
9443 }
9444
9445 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
9446 ip1dbg((
9447 "ip_input_options: bad option offset\n"));
9448 code = (char *)&opt[IPOPT_OLEN] -
9449 (char *)ipha;
9450 goto param_prob;
9451 }
9452 off = opt[IPOPT_OFFSET];
9453 off--;
9454 redo_srr:
9455 if (optlen < IP_ADDR_LEN ||
9456 off > optlen - IP_ADDR_LEN) {
9457 /* End of source route */
9458 ip1dbg(("ip_input_options: end of SR\n"));
9459 break;
9460 }
9461 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9462 ip1dbg(("ip_input_options: next hop 0x%x\n",
9463 ntohl(dst)));
9464
9465 /*
9466 * Check if our address is present more than
9467 * once as consecutive hops in source route.
9468 * XXX verify per-interface ip_forwarding
9469 * for source route?
9470 */
9471 if (ip_type_v4(dst, ipst) == IRE_LOCAL) {
9472 off += IP_ADDR_LEN;
9473 goto redo_srr;
9474 }
9475
9476 if (dst == htonl(INADDR_LOOPBACK)) {
9477 ip1dbg(("ip_input_options: loopback addr in "
9478 "source route!\n"));
9479 goto bad_src_route;
9480 }
9481 /*
9482 * For strict: verify that dst is directly
9483 * reachable.
9484 */
9485 if (optval == IPOPT_SSRR) {
9486 ire = ire_ftable_lookup_v4(dst, 0, 0,
9487 IRE_INTERFACE, NULL, ALL_ZONES,
9488 ira->ira_tsl,
9489 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst,
9490 NULL);
9491 if (ire == NULL) {
9492 ip1dbg(("ip_input_options: SSRR not "
9493 "directly reachable: 0x%x\n",
9494 ntohl(dst)));
9495 goto bad_src_route;
9496 }
9497 ire_refrele(ire);
9498 }
9499 /*
9500 * Defer update of the offset and the record route
9501 * until the packet is forwarded.
9502 */
9503 break;
9504 case IPOPT_RR:
9505 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
9506 ip1dbg((
9507 "ip_input_options: bad option offset\n"));
9508 code = (char *)&opt[IPOPT_OLEN] -
9509 (char *)ipha;
9510 goto param_prob;
9511 }
9512 break;
9513 case IPOPT_TS:
9514 /*
9515 * Verify that length >= 5 and that there is either
9516 * room for another timestamp or that the overflow
9517 * counter is not maxed out.
9518 */
9519 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha;
9520 if (optlen < IPOPT_MINLEN_IT) {
9521 goto param_prob;
9522 }
9523 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
9524 ip1dbg((
9525 "ip_input_options: bad option offset\n"));
9526 code = (char *)&opt[IPOPT_OFFSET] -
9527 (char *)ipha;
9528 goto param_prob;
9529 }
9530 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9531 case IPOPT_TS_TSONLY:
9532 off = IPOPT_TS_TIMELEN;
9533 break;
9534 case IPOPT_TS_TSANDADDR:
9535 case IPOPT_TS_PRESPEC:
9536 case IPOPT_TS_PRESPEC_RFC791:
9537 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
9538 break;
9539 default:
9540 code = (char *)&opt[IPOPT_POS_OV_FLG] -
9541 (char *)ipha;
9542 goto param_prob;
9543 }
9544 if (opt[IPOPT_OFFSET] - 1 + off > optlen &&
9545 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) {
9546 /*
9547 * No room and the overflow counter is 15
9548 * already.
9549 */
9550 goto param_prob;
9551 }
9552 break;
9553 }
9554 }
9555
9556 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) {
9557 return (dst);
9558 }
9559
9560 ip1dbg(("ip_input_options: error processing IP options."));
9561 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha;
9562
9563 param_prob:
9564 /* make sure we clear any indication of a hardware checksum */
9565 DB_CKSUMFLAGS(mp) = 0;
9566 ip_drop_input("ICMP_PARAM_PROBLEM", mp, ira->ira_ill);
9567 icmp_param_problem(mp, (uint8_t)code, ira);
9568 *errorp = -1;
9569 return (dst);
9570
9571 bad_src_route:
9572 /* make sure we clear any indication of a hardware checksum */
9573 DB_CKSUMFLAGS(mp) = 0;
9574 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ira->ira_ill);
9575 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
9576 *errorp = -1;
9577 return (dst);
9578 }
9579
9580 /*
9581 * IP & ICMP info in >=14 msg's ...
9582 * - ip fixed part (mib2_ip_t)
9583 * - icmp fixed part (mib2_icmp_t)
9584 * - ipAddrEntryTable (ip 20) all IPv4 ipifs
9585 * - ipRouteEntryTable (ip 21) all IPv4 IREs
9586 * - ipNetToMediaEntryTable (ip 22) all IPv4 Neighbor Cache entries
9587 * - ipRouteAttributeTable (ip 102) labeled routes
9588 * - ip multicast membership (ip_member_t)
9589 * - ip multicast source filtering (ip_grpsrc_t)
9590 * - igmp fixed part (struct igmpstat)
9591 * - multicast routing stats (struct mrtstat)
9592 * - multicast routing vifs (array of struct vifctl)
9593 * - multicast routing routes (array of struct mfcctl)
9594 * - ip6 fixed part (mib2_ipv6IfStatsEntry_t)
9595 * One per ill plus one generic
9596 * - icmp6 fixed part (mib2_ipv6IfIcmpEntry_t)
9597 * One per ill plus one generic
9598 * - ipv6RouteEntry all IPv6 IREs
9599 * - ipv6RouteAttributeTable (ip6 102) labeled routes
9600 * - ipv6NetToMediaEntry all IPv6 Neighbor Cache entries
9601 * - ipv6AddrEntry all IPv6 ipifs
9602 * - ipv6 multicast membership (ipv6_member_t)
9603 * - ipv6 multicast source filtering (ipv6_grpsrc_t)
9604 *
9605 * NOTE: original mpctl is copied for msg's 2..N, since its ctl part is
9606 * already filled in by the caller.
9607 * If legacy_req is true then MIB structures needs to be truncated to their
9608 * legacy sizes before being returned.
9609 * Return value of 0 indicates that no messages were sent and caller
9610 * should free mpctl.
9611 */
9612 int
9613 ip_snmp_get(queue_t *q, mblk_t *mpctl, int level, boolean_t legacy_req)
9614 {
9615 ip_stack_t *ipst;
9616 sctp_stack_t *sctps;
9617
9618 if (q->q_next != NULL) {
9619 ipst = ILLQ_TO_IPST(q);
9620 } else {
9621 ipst = CONNQ_TO_IPST(q);
9622 }
9623 ASSERT(ipst != NULL);
9624 sctps = ipst->ips_netstack->netstack_sctp;
9625
9626 if (mpctl == NULL || mpctl->b_cont == NULL) {
9627 return (0);
9628 }
9629
9630 /*
9631 * For the purposes of the (broken) packet shell use
9632 * of the level we make sure MIB2_TCP/MIB2_UDP can be used
9633 * to make TCP and UDP appear first in the list of mib items.
9634 * TBD: We could expand this and use it in netstat so that
9635 * the kernel doesn't have to produce large tables (connections,
9636 * routes, etc) when netstat only wants the statistics or a particular
9637 * table.
9638 */
9639 if (!(level == MIB2_TCP || level == MIB2_UDP)) {
9640 if ((mpctl = icmp_snmp_get(q, mpctl)) == NULL) {
9641 return (1);
9642 }
9643 }
9644
9645 if (level != MIB2_TCP) {
9646 if ((mpctl = udp_snmp_get(q, mpctl, legacy_req)) == NULL) {
9647 return (1);
9648 }
9649 }
9650
9651 if (level != MIB2_UDP) {
9652 if ((mpctl = tcp_snmp_get(q, mpctl, legacy_req)) == NULL) {
9653 return (1);
9654 }
9655 }
9656
9657 if ((mpctl = ip_snmp_get_mib2_ip_traffic_stats(q, mpctl,
9658 ipst, legacy_req)) == NULL) {
9659 return (1);
9660 }
9661
9662 if ((mpctl = ip_snmp_get_mib2_ip6(q, mpctl, ipst,
9663 legacy_req)) == NULL) {
9664 return (1);
9665 }
9666
9667 if ((mpctl = ip_snmp_get_mib2_icmp(q, mpctl, ipst)) == NULL) {
9668 return (1);
9669 }
9670
9671 if ((mpctl = ip_snmp_get_mib2_icmp6(q, mpctl, ipst)) == NULL) {
9672 return (1);
9673 }
9674
9675 if ((mpctl = ip_snmp_get_mib2_igmp(q, mpctl, ipst)) == NULL) {
9676 return (1);
9677 }
9678
9679 if ((mpctl = ip_snmp_get_mib2_multi(q, mpctl, ipst)) == NULL) {
9680 return (1);
9681 }
9682
9683 if ((mpctl = ip_snmp_get_mib2_ip_addr(q, mpctl, ipst,
9684 legacy_req)) == NULL) {
9685 return (1);
9686 }
9687
9688 if ((mpctl = ip_snmp_get_mib2_ip6_addr(q, mpctl, ipst,
9689 legacy_req)) == NULL) {
9690 return (1);
9691 }
9692
9693 if ((mpctl = ip_snmp_get_mib2_ip_group_mem(q, mpctl, ipst)) == NULL) {
9694 return (1);
9695 }
9696
9697 if ((mpctl = ip_snmp_get_mib2_ip6_group_mem(q, mpctl, ipst)) == NULL) {
9698 return (1);
9699 }
9700
9701 if ((mpctl = ip_snmp_get_mib2_ip_group_src(q, mpctl, ipst)) == NULL) {
9702 return (1);
9703 }
9704
9705 if ((mpctl = ip_snmp_get_mib2_ip6_group_src(q, mpctl, ipst)) == NULL) {
9706 return (1);
9707 }
9708
9709 if ((mpctl = ip_snmp_get_mib2_virt_multi(q, mpctl, ipst)) == NULL) {
9710 return (1);
9711 }
9712
9713 if ((mpctl = ip_snmp_get_mib2_multi_rtable(q, mpctl, ipst)) == NULL) {
9714 return (1);
9715 }
9716
9717 mpctl = ip_snmp_get_mib2_ip_route_media(q, mpctl, level, ipst);
9718 if (mpctl == NULL)
9719 return (1);
9720
9721 mpctl = ip_snmp_get_mib2_ip6_route_media(q, mpctl, level, ipst);
9722 if (mpctl == NULL)
9723 return (1);
9724
9725 if ((mpctl = sctp_snmp_get_mib2(q, mpctl, sctps)) == NULL) {
9726 return (1);
9727 }
9728
9729 if ((mpctl = ip_snmp_get_mib2_ip_dce(q, mpctl, ipst)) == NULL) {
9730 return (1);
9731 }
9732
9733 if ((mpctl = dccp_snmp_get(q, mpctl, legacy_req)) == NULL) {
9734 return (1);
9735 }
9736
9737 freemsg(mpctl);
9738 return (1);
9739 }
9740
9741 /* Get global (legacy) IPv4 statistics */
9742 static mblk_t *
9743 ip_snmp_get_mib2_ip(queue_t *q, mblk_t *mpctl, mib2_ipIfStatsEntry_t *ipmib,
9744 ip_stack_t *ipst, boolean_t legacy_req)
9745 {
9746 mib2_ip_t old_ip_mib;
9747 struct opthdr *optp;
9748 mblk_t *mp2ctl;
9749 mib2_ipAddrEntry_t mae;
9750
9751 /*
9752 * make a copy of the original message
9753 */
9754 mp2ctl = copymsg(mpctl);
9755
9756 /* fixed length IP structure... */
9757 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9758 optp->level = MIB2_IP;
9759 optp->name = 0;
9760 SET_MIB(old_ip_mib.ipForwarding,
9761 (WE_ARE_FORWARDING(ipst) ? 1 : 2));
9762 SET_MIB(old_ip_mib.ipDefaultTTL,
9763 (uint32_t)ipst->ips_ip_def_ttl);
9764 SET_MIB(old_ip_mib.ipReasmTimeout,
9765 ipst->ips_ip_reassembly_timeout);
9766 SET_MIB(old_ip_mib.ipAddrEntrySize,
9767 (legacy_req) ? LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t) :
9768 sizeof (mib2_ipAddrEntry_t));
9769 SET_MIB(old_ip_mib.ipRouteEntrySize,
9770 sizeof (mib2_ipRouteEntry_t));
9771 SET_MIB(old_ip_mib.ipNetToMediaEntrySize,
9772 sizeof (mib2_ipNetToMediaEntry_t));
9773 SET_MIB(old_ip_mib.ipMemberEntrySize, sizeof (ip_member_t));
9774 SET_MIB(old_ip_mib.ipGroupSourceEntrySize, sizeof (ip_grpsrc_t));
9775 SET_MIB(old_ip_mib.ipRouteAttributeSize,
9776 sizeof (mib2_ipAttributeEntry_t));
9777 SET_MIB(old_ip_mib.transportMLPSize, sizeof (mib2_transportMLPEntry_t));
9778 SET_MIB(old_ip_mib.ipDestEntrySize, sizeof (dest_cache_entry_t));
9779
9780 /*
9781 * Grab the statistics from the new IP MIB
9782 */
9783 SET_MIB(old_ip_mib.ipInReceives,
9784 (uint32_t)ipmib->ipIfStatsHCInReceives);
9785 SET_MIB(old_ip_mib.ipInHdrErrors, ipmib->ipIfStatsInHdrErrors);
9786 SET_MIB(old_ip_mib.ipInAddrErrors, ipmib->ipIfStatsInAddrErrors);
9787 SET_MIB(old_ip_mib.ipForwDatagrams,
9788 (uint32_t)ipmib->ipIfStatsHCOutForwDatagrams);
9789 SET_MIB(old_ip_mib.ipInUnknownProtos,
9790 ipmib->ipIfStatsInUnknownProtos);
9791 SET_MIB(old_ip_mib.ipInDiscards, ipmib->ipIfStatsInDiscards);
9792 SET_MIB(old_ip_mib.ipInDelivers,
9793 (uint32_t)ipmib->ipIfStatsHCInDelivers);
9794 SET_MIB(old_ip_mib.ipOutRequests,
9795 (uint32_t)ipmib->ipIfStatsHCOutRequests);
9796 SET_MIB(old_ip_mib.ipOutDiscards, ipmib->ipIfStatsOutDiscards);
9797 SET_MIB(old_ip_mib.ipOutNoRoutes, ipmib->ipIfStatsOutNoRoutes);
9798 SET_MIB(old_ip_mib.ipReasmReqds, ipmib->ipIfStatsReasmReqds);
9799 SET_MIB(old_ip_mib.ipReasmOKs, ipmib->ipIfStatsReasmOKs);
9800 SET_MIB(old_ip_mib.ipReasmFails, ipmib->ipIfStatsReasmFails);
9801 SET_MIB(old_ip_mib.ipFragOKs, ipmib->ipIfStatsOutFragOKs);
9802 SET_MIB(old_ip_mib.ipFragFails, ipmib->ipIfStatsOutFragFails);
9803 SET_MIB(old_ip_mib.ipFragCreates, ipmib->ipIfStatsOutFragCreates);
9804
9805 /* ipRoutingDiscards is not being used */
9806 SET_MIB(old_ip_mib.ipRoutingDiscards, 0);
9807 SET_MIB(old_ip_mib.tcpInErrs, ipmib->tcpIfStatsInErrs);
9808 SET_MIB(old_ip_mib.udpNoPorts, ipmib->udpIfStatsNoPorts);
9809 SET_MIB(old_ip_mib.ipInCksumErrs, ipmib->ipIfStatsInCksumErrs);
9810 SET_MIB(old_ip_mib.ipReasmDuplicates,
9811 ipmib->ipIfStatsReasmDuplicates);
9812 SET_MIB(old_ip_mib.ipReasmPartDups, ipmib->ipIfStatsReasmPartDups);
9813 SET_MIB(old_ip_mib.ipForwProhibits, ipmib->ipIfStatsForwProhibits);
9814 SET_MIB(old_ip_mib.udpInCksumErrs, ipmib->udpIfStatsInCksumErrs);
9815 SET_MIB(old_ip_mib.udpInOverflows, ipmib->udpIfStatsInOverflows);
9816 SET_MIB(old_ip_mib.rawipInOverflows,
9817 ipmib->rawipIfStatsInOverflows);
9818
9819 SET_MIB(old_ip_mib.ipsecInSucceeded, ipmib->ipsecIfStatsInSucceeded);
9820 SET_MIB(old_ip_mib.ipsecInFailed, ipmib->ipsecIfStatsInFailed);
9821 SET_MIB(old_ip_mib.ipInIPv6, ipmib->ipIfStatsInWrongIPVersion);
9822 SET_MIB(old_ip_mib.ipOutIPv6, ipmib->ipIfStatsOutWrongIPVersion);
9823 SET_MIB(old_ip_mib.ipOutSwitchIPv6,
9824 ipmib->ipIfStatsOutSwitchIPVersion);
9825
9826 if (!snmp_append_data(mpctl->b_cont, (char *)&old_ip_mib,
9827 (int)sizeof (old_ip_mib))) {
9828 ip1dbg(("ip_snmp_get_mib2_ip: failed to allocate %u bytes\n",
9829 (uint_t)sizeof (old_ip_mib)));
9830 }
9831
9832 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9833 ip3dbg(("ip_snmp_get_mib2_ip: level %d, name %d, len %d\n",
9834 (int)optp->level, (int)optp->name, (int)optp->len));
9835 qreply(q, mpctl);
9836 return (mp2ctl);
9837 }
9838
9839 /* Per interface IPv4 statistics */
9840 static mblk_t *
9841 ip_snmp_get_mib2_ip_traffic_stats(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
9842 boolean_t legacy_req)
9843 {
9844 struct opthdr *optp;
9845 mblk_t *mp2ctl;
9846 ill_t *ill;
9847 ill_walk_context_t ctx;
9848 mblk_t *mp_tail = NULL;
9849 mib2_ipIfStatsEntry_t global_ip_mib;
9850 mib2_ipAddrEntry_t mae;
9851
9852 /*
9853 * Make a copy of the original message
9854 */
9855 mp2ctl = copymsg(mpctl);
9856
9857 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9858 optp->level = MIB2_IP;
9859 optp->name = MIB2_IP_TRAFFIC_STATS;
9860 /* Include "unknown interface" ip_mib */
9861 ipst->ips_ip_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
9862 ipst->ips_ip_mib.ipIfStatsIfIndex =
9863 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */
9864 SET_MIB(ipst->ips_ip_mib.ipIfStatsForwarding,
9865 (ipst->ips_ip_forwarding ? 1 : 2));
9866 SET_MIB(ipst->ips_ip_mib.ipIfStatsDefaultTTL,
9867 (uint32_t)ipst->ips_ip_def_ttl);
9868 SET_MIB(ipst->ips_ip_mib.ipIfStatsEntrySize,
9869 sizeof (mib2_ipIfStatsEntry_t));
9870 SET_MIB(ipst->ips_ip_mib.ipIfStatsAddrEntrySize,
9871 sizeof (mib2_ipAddrEntry_t));
9872 SET_MIB(ipst->ips_ip_mib.ipIfStatsRouteEntrySize,
9873 sizeof (mib2_ipRouteEntry_t));
9874 SET_MIB(ipst->ips_ip_mib.ipIfStatsNetToMediaEntrySize,
9875 sizeof (mib2_ipNetToMediaEntry_t));
9876 SET_MIB(ipst->ips_ip_mib.ipIfStatsMemberEntrySize,
9877 sizeof (ip_member_t));
9878 SET_MIB(ipst->ips_ip_mib.ipIfStatsGroupSourceEntrySize,
9879 sizeof (ip_grpsrc_t));
9880
9881 bcopy(&ipst->ips_ip_mib, &global_ip_mib, sizeof (global_ip_mib));
9882
9883 if (legacy_req) {
9884 SET_MIB(global_ip_mib.ipIfStatsAddrEntrySize,
9885 LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t));
9886 }
9887
9888 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
9889 (char *)&global_ip_mib, (int)sizeof (global_ip_mib))) {
9890 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: "
9891 "failed to allocate %u bytes\n",
9892 (uint_t)sizeof (global_ip_mib)));
9893 }
9894
9895 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
9896 ill = ILL_START_WALK_V4(&ctx, ipst);
9897 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
9898 ill->ill_ip_mib->ipIfStatsIfIndex =
9899 ill->ill_phyint->phyint_ifindex;
9900 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding,
9901 (ipst->ips_ip_forwarding ? 1 : 2));
9902 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultTTL,
9903 (uint32_t)ipst->ips_ip_def_ttl);
9904
9905 ip_mib2_add_ip_stats(&global_ip_mib, ill->ill_ip_mib);
9906 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
9907 (char *)ill->ill_ip_mib,
9908 (int)sizeof (*ill->ill_ip_mib))) {
9909 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: "
9910 "failed to allocate %u bytes\n",
9911 (uint_t)sizeof (*ill->ill_ip_mib)));
9912 }
9913 }
9914 rw_exit(&ipst->ips_ill_g_lock);
9915
9916 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9917 ip3dbg(("ip_snmp_get_mib2_ip_traffic_stats: "
9918 "level %d, name %d, len %d\n",
9919 (int)optp->level, (int)optp->name, (int)optp->len));
9920 qreply(q, mpctl);
9921
9922 if (mp2ctl == NULL)
9923 return (NULL);
9924
9925 return (ip_snmp_get_mib2_ip(q, mp2ctl, &global_ip_mib, ipst,
9926 legacy_req));
9927 }
9928
9929 /* Global IPv4 ICMP statistics */
9930 static mblk_t *
9931 ip_snmp_get_mib2_icmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
9932 {
9933 struct opthdr *optp;
9934 mblk_t *mp2ctl;
9935
9936 /*
9937 * Make a copy of the original message
9938 */
9939 mp2ctl = copymsg(mpctl);
9940
9941 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9942 optp->level = MIB2_ICMP;
9943 optp->name = 0;
9944 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_icmp_mib,
9945 (int)sizeof (ipst->ips_icmp_mib))) {
9946 ip1dbg(("ip_snmp_get_mib2_icmp: failed to allocate %u bytes\n",
9947 (uint_t)sizeof (ipst->ips_icmp_mib)));
9948 }
9949 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9950 ip3dbg(("ip_snmp_get_mib2_icmp: level %d, name %d, len %d\n",
9951 (int)optp->level, (int)optp->name, (int)optp->len));
9952 qreply(q, mpctl);
9953 return (mp2ctl);
9954 }
9955
9956 /* Global IPv4 IGMP statistics */
9957 static mblk_t *
9958 ip_snmp_get_mib2_igmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
9959 {
9960 struct opthdr *optp;
9961 mblk_t *mp2ctl;
9962
9963 /*
9964 * make a copy of the original message
9965 */
9966 mp2ctl = copymsg(mpctl);
9967
9968 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9969 optp->level = EXPER_IGMP;
9970 optp->name = 0;
9971 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_igmpstat,
9972 (int)sizeof (ipst->ips_igmpstat))) {
9973 ip1dbg(("ip_snmp_get_mib2_igmp: failed to allocate %u bytes\n",
9974 (uint_t)sizeof (ipst->ips_igmpstat)));
9975 }
9976 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9977 ip3dbg(("ip_snmp_get_mib2_igmp: level %d, name %d, len %d\n",
9978 (int)optp->level, (int)optp->name, (int)optp->len));
9979 qreply(q, mpctl);
9980 return (mp2ctl);
9981 }
9982
9983 /* Global IPv4 Multicast Routing statistics */
9984 static mblk_t *
9985 ip_snmp_get_mib2_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
9986 {
9987 struct opthdr *optp;
9988 mblk_t *mp2ctl;
9989
9990 /*
9991 * make a copy of the original message
9992 */
9993 mp2ctl = copymsg(mpctl);
9994
9995 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9996 optp->level = EXPER_DVMRP;
9997 optp->name = 0;
9998 if (!ip_mroute_stats(mpctl->b_cont, ipst)) {
9999 ip0dbg(("ip_mroute_stats: failed\n"));
10000 }
10001 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10002 ip3dbg(("ip_snmp_get_mib2_multi: level %d, name %d, len %d\n",
10003 (int)optp->level, (int)optp->name, (int)optp->len));
10004 qreply(q, mpctl);
10005 return (mp2ctl);
10006 }
10007
10008 /* IPv4 address information */
10009 static mblk_t *
10010 ip_snmp_get_mib2_ip_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
10011 boolean_t legacy_req)
10012 {
10013 struct opthdr *optp;
10014 mblk_t *mp2ctl;
10015 mblk_t *mp_tail = NULL;
10016 ill_t *ill;
10017 ipif_t *ipif;
10018 uint_t bitval;
10019 mib2_ipAddrEntry_t mae;
10020 size_t mae_size;
10021 zoneid_t zoneid;
10022 ill_walk_context_t ctx;
10023
10024 /*
10025 * make a copy of the original message
10026 */
10027 mp2ctl = copymsg(mpctl);
10028
10029 mae_size = (legacy_req) ? LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t) :
10030 sizeof (mib2_ipAddrEntry_t);
10031
10032 /* ipAddrEntryTable */
10033
10034 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10035 optp->level = MIB2_IP;
10036 optp->name = MIB2_IP_ADDR;
10037 zoneid = Q_TO_CONN(q)->conn_zoneid;
10038
10039 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10040 ill = ILL_START_WALK_V4(&ctx, ipst);
10041 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10042 for (ipif = ill->ill_ipif; ipif != NULL;
10043 ipif = ipif->ipif_next) {
10044 if (ipif->ipif_zoneid != zoneid &&
10045 ipif->ipif_zoneid != ALL_ZONES)
10046 continue;
10047 /* Sum of count from dead IRE_LO* and our current */
10048 mae.ipAdEntInfo.ae_ibcnt = ipif->ipif_ib_pkt_count;
10049 if (ipif->ipif_ire_local != NULL) {
10050 mae.ipAdEntInfo.ae_ibcnt +=
10051 ipif->ipif_ire_local->ire_ib_pkt_count;
10052 }
10053 mae.ipAdEntInfo.ae_obcnt = 0;
10054 mae.ipAdEntInfo.ae_focnt = 0;
10055
10056 ipif_get_name(ipif, mae.ipAdEntIfIndex.o_bytes,
10057 OCTET_LENGTH);
10058 mae.ipAdEntIfIndex.o_length =
10059 mi_strlen(mae.ipAdEntIfIndex.o_bytes);
10060 mae.ipAdEntAddr = ipif->ipif_lcl_addr;
10061 mae.ipAdEntNetMask = ipif->ipif_net_mask;
10062 mae.ipAdEntInfo.ae_subnet = ipif->ipif_subnet;
10063 mae.ipAdEntInfo.ae_subnet_len =
10064 ip_mask_to_plen(ipif->ipif_net_mask);
10065 mae.ipAdEntInfo.ae_src_addr = ipif->ipif_lcl_addr;
10066 for (bitval = 1;
10067 bitval &&
10068 !(bitval & ipif->ipif_brd_addr);
10069 bitval <<= 1)
10070 noop;
10071 mae.ipAdEntBcastAddr = bitval;
10072 mae.ipAdEntReasmMaxSize = IP_MAXPACKET;
10073 mae.ipAdEntInfo.ae_mtu = ipif->ipif_ill->ill_mtu;
10074 mae.ipAdEntInfo.ae_metric = ipif->ipif_ill->ill_metric;
10075 mae.ipAdEntInfo.ae_broadcast_addr =
10076 ipif->ipif_brd_addr;
10077 mae.ipAdEntInfo.ae_pp_dst_addr =
10078 ipif->ipif_pp_dst_addr;
10079 mae.ipAdEntInfo.ae_flags = ipif->ipif_flags |
10080 ill->ill_flags | ill->ill_phyint->phyint_flags;
10081 mae.ipAdEntRetransmitTime =
10082 ill->ill_reachable_retrans_time;
10083
10084 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10085 (char *)&mae, (int)mae_size)) {
10086 ip1dbg(("ip_snmp_get_mib2_ip_addr: failed to "
10087 "allocate %u bytes\n", (uint_t)mae_size));
10088 }
10089 }
10090 }
10091 rw_exit(&ipst->ips_ill_g_lock);
10092
10093 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10094 ip3dbg(("ip_snmp_get_mib2_ip_addr: level %d, name %d, len %d\n",
10095 (int)optp->level, (int)optp->name, (int)optp->len));
10096 qreply(q, mpctl);
10097 return (mp2ctl);
10098 }
10099
10100 /* IPv6 address information */
10101 static mblk_t *
10102 ip_snmp_get_mib2_ip6_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
10103 boolean_t legacy_req)
10104 {
10105 struct opthdr *optp;
10106 mblk_t *mp2ctl;
10107 mblk_t *mp_tail = NULL;
10108 ill_t *ill;
10109 ipif_t *ipif;
10110 mib2_ipv6AddrEntry_t mae6;
10111 size_t mae6_size;
10112 zoneid_t zoneid;
10113 ill_walk_context_t ctx;
10114
10115 /*
10116 * make a copy of the original message
10117 */
10118 mp2ctl = copymsg(mpctl);
10119
10120 mae6_size = (legacy_req) ?
10121 LEGACY_MIB_SIZE(&mae6, mib2_ipv6AddrEntry_t) :
10122 sizeof (mib2_ipv6AddrEntry_t);
10123
10124 /* ipv6AddrEntryTable */
10125
10126 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10127 optp->level = MIB2_IP6;
10128 optp->name = MIB2_IP6_ADDR;
10129 zoneid = Q_TO_CONN(q)->conn_zoneid;
10130
10131 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10132 ill = ILL_START_WALK_V6(&ctx, ipst);
10133 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10134 for (ipif = ill->ill_ipif; ipif != NULL;
10135 ipif = ipif->ipif_next) {
10136 if (ipif->ipif_zoneid != zoneid &&
10137 ipif->ipif_zoneid != ALL_ZONES)
10138 continue;
10139 /* Sum of count from dead IRE_LO* and our current */
10140 mae6.ipv6AddrInfo.ae_ibcnt = ipif->ipif_ib_pkt_count;
10141 if (ipif->ipif_ire_local != NULL) {
10142 mae6.ipv6AddrInfo.ae_ibcnt +=
10143 ipif->ipif_ire_local->ire_ib_pkt_count;
10144 }
10145 mae6.ipv6AddrInfo.ae_obcnt = 0;
10146 mae6.ipv6AddrInfo.ae_focnt = 0;
10147
10148 ipif_get_name(ipif, mae6.ipv6AddrIfIndex.o_bytes,
10149 OCTET_LENGTH);
10150 mae6.ipv6AddrIfIndex.o_length =
10151 mi_strlen(mae6.ipv6AddrIfIndex.o_bytes);
10152 mae6.ipv6AddrAddress = ipif->ipif_v6lcl_addr;
10153 mae6.ipv6AddrPfxLength =
10154 ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
10155 mae6.ipv6AddrInfo.ae_subnet = ipif->ipif_v6subnet;
10156 mae6.ipv6AddrInfo.ae_subnet_len =
10157 mae6.ipv6AddrPfxLength;
10158 mae6.ipv6AddrInfo.ae_src_addr = ipif->ipif_v6lcl_addr;
10159
10160 /* Type: stateless(1), stateful(2), unknown(3) */
10161 if (ipif->ipif_flags & IPIF_ADDRCONF)
10162 mae6.ipv6AddrType = 1;
10163 else
10164 mae6.ipv6AddrType = 2;
10165 /* Anycast: true(1), false(2) */
10166 if (ipif->ipif_flags & IPIF_ANYCAST)
10167 mae6.ipv6AddrAnycastFlag = 1;
10168 else
10169 mae6.ipv6AddrAnycastFlag = 2;
10170
10171 /*
10172 * Address status: preferred(1), deprecated(2),
10173 * invalid(3), inaccessible(4), unknown(5)
10174 */
10175 if (ipif->ipif_flags & IPIF_NOLOCAL)
10176 mae6.ipv6AddrStatus = 3;
10177 else if (ipif->ipif_flags & IPIF_DEPRECATED)
10178 mae6.ipv6AddrStatus = 2;
10179 else
10180 mae6.ipv6AddrStatus = 1;
10181 mae6.ipv6AddrInfo.ae_mtu = ipif->ipif_ill->ill_mtu;
10182 mae6.ipv6AddrInfo.ae_metric =
10183 ipif->ipif_ill->ill_metric;
10184 mae6.ipv6AddrInfo.ae_pp_dst_addr =
10185 ipif->ipif_v6pp_dst_addr;
10186 mae6.ipv6AddrInfo.ae_flags = ipif->ipif_flags |
10187 ill->ill_flags | ill->ill_phyint->phyint_flags;
10188 mae6.ipv6AddrReasmMaxSize = IP_MAXPACKET;
10189 mae6.ipv6AddrIdentifier = ill->ill_token;
10190 mae6.ipv6AddrIdentifierLen = ill->ill_token_length;
10191 mae6.ipv6AddrReachableTime = ill->ill_reachable_time;
10192 mae6.ipv6AddrRetransmitTime =
10193 ill->ill_reachable_retrans_time;
10194 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10195 (char *)&mae6, (int)mae6_size)) {
10196 ip1dbg(("ip_snmp_get_mib2_ip6_addr: failed to "
10197 "allocate %u bytes\n",
10198 (uint_t)mae6_size));
10199 }
10200 }
10201 }
10202 rw_exit(&ipst->ips_ill_g_lock);
10203
10204 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10205 ip3dbg(("ip_snmp_get_mib2_ip6_addr: level %d, name %d, len %d\n",
10206 (int)optp->level, (int)optp->name, (int)optp->len));
10207 qreply(q, mpctl);
10208 return (mp2ctl);
10209 }
10210
10211 /* IPv4 multicast group membership. */
10212 static mblk_t *
10213 ip_snmp_get_mib2_ip_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10214 {
10215 struct opthdr *optp;
10216 mblk_t *mp2ctl;
10217 ill_t *ill;
10218 ipif_t *ipif;
10219 ilm_t *ilm;
10220 ip_member_t ipm;
10221 mblk_t *mp_tail = NULL;
10222 ill_walk_context_t ctx;
10223 zoneid_t zoneid;
10224
10225 /*
10226 * make a copy of the original message
10227 */
10228 mp2ctl = copymsg(mpctl);
10229 zoneid = Q_TO_CONN(q)->conn_zoneid;
10230
10231 /* ipGroupMember table */
10232 optp = (struct opthdr *)&mpctl->b_rptr[
10233 sizeof (struct T_optmgmt_ack)];
10234 optp->level = MIB2_IP;
10235 optp->name = EXPER_IP_GROUP_MEMBERSHIP;
10236
10237 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10238 ill = ILL_START_WALK_V4(&ctx, ipst);
10239 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10240 /* Make sure the ill isn't going away. */
10241 if (!ill_check_and_refhold(ill))
10242 continue;
10243 rw_exit(&ipst->ips_ill_g_lock);
10244 rw_enter(&ill->ill_mcast_lock, RW_READER);
10245 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10246 if (ilm->ilm_zoneid != zoneid &&
10247 ilm->ilm_zoneid != ALL_ZONES)
10248 continue;
10249
10250 /* Is there an ipif for ilm_ifaddr? */
10251 for (ipif = ill->ill_ipif; ipif != NULL;
10252 ipif = ipif->ipif_next) {
10253 if (!IPIF_IS_CONDEMNED(ipif) &&
10254 ipif->ipif_lcl_addr == ilm->ilm_ifaddr &&
10255 ilm->ilm_ifaddr != INADDR_ANY)
10256 break;
10257 }
10258 if (ipif != NULL) {
10259 ipif_get_name(ipif,
10260 ipm.ipGroupMemberIfIndex.o_bytes,
10261 OCTET_LENGTH);
10262 } else {
10263 ill_get_name(ill,
10264 ipm.ipGroupMemberIfIndex.o_bytes,
10265 OCTET_LENGTH);
10266 }
10267 ipm.ipGroupMemberIfIndex.o_length =
10268 mi_strlen(ipm.ipGroupMemberIfIndex.o_bytes);
10269
10270 ipm.ipGroupMemberAddress = ilm->ilm_addr;
10271 ipm.ipGroupMemberRefCnt = ilm->ilm_refcnt;
10272 ipm.ipGroupMemberFilterMode = ilm->ilm_fmode;
10273 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10274 (char *)&ipm, (int)sizeof (ipm))) {
10275 ip1dbg(("ip_snmp_get_mib2_ip_group: "
10276 "failed to allocate %u bytes\n",
10277 (uint_t)sizeof (ipm)));
10278 }
10279 }
10280 rw_exit(&ill->ill_mcast_lock);
10281 ill_refrele(ill);
10282 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10283 }
10284 rw_exit(&ipst->ips_ill_g_lock);
10285 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10286 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10287 (int)optp->level, (int)optp->name, (int)optp->len));
10288 qreply(q, mpctl);
10289 return (mp2ctl);
10290 }
10291
10292 /* IPv6 multicast group membership. */
10293 static mblk_t *
10294 ip_snmp_get_mib2_ip6_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10295 {
10296 struct opthdr *optp;
10297 mblk_t *mp2ctl;
10298 ill_t *ill;
10299 ilm_t *ilm;
10300 ipv6_member_t ipm6;
10301 mblk_t *mp_tail = NULL;
10302 ill_walk_context_t ctx;
10303 zoneid_t zoneid;
10304
10305 /*
10306 * make a copy of the original message
10307 */
10308 mp2ctl = copymsg(mpctl);
10309 zoneid = Q_TO_CONN(q)->conn_zoneid;
10310
10311 /* ip6GroupMember table */
10312 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10313 optp->level = MIB2_IP6;
10314 optp->name = EXPER_IP6_GROUP_MEMBERSHIP;
10315
10316 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10317 ill = ILL_START_WALK_V6(&ctx, ipst);
10318 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10319 /* Make sure the ill isn't going away. */
10320 if (!ill_check_and_refhold(ill))
10321 continue;
10322 rw_exit(&ipst->ips_ill_g_lock);
10323 /*
10324 * Normally we don't have any members on under IPMP interfaces.
10325 * We report them as a debugging aid.
10326 */
10327 rw_enter(&ill->ill_mcast_lock, RW_READER);
10328 ipm6.ipv6GroupMemberIfIndex = ill->ill_phyint->phyint_ifindex;
10329 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10330 if (ilm->ilm_zoneid != zoneid &&
10331 ilm->ilm_zoneid != ALL_ZONES)
10332 continue; /* not this zone */
10333 ipm6.ipv6GroupMemberAddress = ilm->ilm_v6addr;
10334 ipm6.ipv6GroupMemberRefCnt = ilm->ilm_refcnt;
10335 ipm6.ipv6GroupMemberFilterMode = ilm->ilm_fmode;
10336 if (!snmp_append_data2(mpctl->b_cont,
10337 &mp_tail,
10338 (char *)&ipm6, (int)sizeof (ipm6))) {
10339 ip1dbg(("ip_snmp_get_mib2_ip6_group: "
10340 "failed to allocate %u bytes\n",
10341 (uint_t)sizeof (ipm6)));
10342 }
10343 }
10344 rw_exit(&ill->ill_mcast_lock);
10345 ill_refrele(ill);
10346 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10347 }
10348 rw_exit(&ipst->ips_ill_g_lock);
10349
10350 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10351 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10352 (int)optp->level, (int)optp->name, (int)optp->len));
10353 qreply(q, mpctl);
10354 return (mp2ctl);
10355 }
10356
10357 /* IP multicast filtered sources */
10358 static mblk_t *
10359 ip_snmp_get_mib2_ip_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10360 {
10361 struct opthdr *optp;
10362 mblk_t *mp2ctl;
10363 ill_t *ill;
10364 ipif_t *ipif;
10365 ilm_t *ilm;
10366 ip_grpsrc_t ips;
10367 mblk_t *mp_tail = NULL;
10368 ill_walk_context_t ctx;
10369 zoneid_t zoneid;
10370 int i;
10371 slist_t *sl;
10372
10373 /*
10374 * make a copy of the original message
10375 */
10376 mp2ctl = copymsg(mpctl);
10377 zoneid = Q_TO_CONN(q)->conn_zoneid;
10378
10379 /* ipGroupSource table */
10380 optp = (struct opthdr *)&mpctl->b_rptr[
10381 sizeof (struct T_optmgmt_ack)];
10382 optp->level = MIB2_IP;
10383 optp->name = EXPER_IP_GROUP_SOURCES;
10384
10385 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10386 ill = ILL_START_WALK_V4(&ctx, ipst);
10387 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10388 /* Make sure the ill isn't going away. */
10389 if (!ill_check_and_refhold(ill))
10390 continue;
10391 rw_exit(&ipst->ips_ill_g_lock);
10392 rw_enter(&ill->ill_mcast_lock, RW_READER);
10393 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10394 sl = ilm->ilm_filter;
10395 if (ilm->ilm_zoneid != zoneid &&
10396 ilm->ilm_zoneid != ALL_ZONES)
10397 continue;
10398 if (SLIST_IS_EMPTY(sl))
10399 continue;
10400
10401 /* Is there an ipif for ilm_ifaddr? */
10402 for (ipif = ill->ill_ipif; ipif != NULL;
10403 ipif = ipif->ipif_next) {
10404 if (!IPIF_IS_CONDEMNED(ipif) &&
10405 ipif->ipif_lcl_addr == ilm->ilm_ifaddr &&
10406 ilm->ilm_ifaddr != INADDR_ANY)
10407 break;
10408 }
10409 if (ipif != NULL) {
10410 ipif_get_name(ipif,
10411 ips.ipGroupSourceIfIndex.o_bytes,
10412 OCTET_LENGTH);
10413 } else {
10414 ill_get_name(ill,
10415 ips.ipGroupSourceIfIndex.o_bytes,
10416 OCTET_LENGTH);
10417 }
10418 ips.ipGroupSourceIfIndex.o_length =
10419 mi_strlen(ips.ipGroupSourceIfIndex.o_bytes);
10420
10421 ips.ipGroupSourceGroup = ilm->ilm_addr;
10422 for (i = 0; i < sl->sl_numsrc; i++) {
10423 if (!IN6_IS_ADDR_V4MAPPED(&sl->sl_addr[i]))
10424 continue;
10425 IN6_V4MAPPED_TO_IPADDR(&sl->sl_addr[i],
10426 ips.ipGroupSourceAddress);
10427 if (snmp_append_data2(mpctl->b_cont, &mp_tail,
10428 (char *)&ips, (int)sizeof (ips)) == 0) {
10429 ip1dbg(("ip_snmp_get_mib2_ip_group_src:"
10430 " failed to allocate %u bytes\n",
10431 (uint_t)sizeof (ips)));
10432 }
10433 }
10434 }
10435 rw_exit(&ill->ill_mcast_lock);
10436 ill_refrele(ill);
10437 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10438 }
10439 rw_exit(&ipst->ips_ill_g_lock);
10440 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10441 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10442 (int)optp->level, (int)optp->name, (int)optp->len));
10443 qreply(q, mpctl);
10444 return (mp2ctl);
10445 }
10446
10447 /* IPv6 multicast filtered sources. */
10448 static mblk_t *
10449 ip_snmp_get_mib2_ip6_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10450 {
10451 struct opthdr *optp;
10452 mblk_t *mp2ctl;
10453 ill_t *ill;
10454 ilm_t *ilm;
10455 ipv6_grpsrc_t ips6;
10456 mblk_t *mp_tail = NULL;
10457 ill_walk_context_t ctx;
10458 zoneid_t zoneid;
10459 int i;
10460 slist_t *sl;
10461
10462 /*
10463 * make a copy of the original message
10464 */
10465 mp2ctl = copymsg(mpctl);
10466 zoneid = Q_TO_CONN(q)->conn_zoneid;
10467
10468 /* ip6GroupMember table */
10469 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10470 optp->level = MIB2_IP6;
10471 optp->name = EXPER_IP6_GROUP_SOURCES;
10472
10473 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10474 ill = ILL_START_WALK_V6(&ctx, ipst);
10475 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10476 /* Make sure the ill isn't going away. */
10477 if (!ill_check_and_refhold(ill))
10478 continue;
10479 rw_exit(&ipst->ips_ill_g_lock);
10480 /*
10481 * Normally we don't have any members on under IPMP interfaces.
10482 * We report them as a debugging aid.
10483 */
10484 rw_enter(&ill->ill_mcast_lock, RW_READER);
10485 ips6.ipv6GroupSourceIfIndex = ill->ill_phyint->phyint_ifindex;
10486 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10487 sl = ilm->ilm_filter;
10488 if (ilm->ilm_zoneid != zoneid &&
10489 ilm->ilm_zoneid != ALL_ZONES)
10490 continue;
10491 if (SLIST_IS_EMPTY(sl))
10492 continue;
10493 ips6.ipv6GroupSourceGroup = ilm->ilm_v6addr;
10494 for (i = 0; i < sl->sl_numsrc; i++) {
10495 ips6.ipv6GroupSourceAddress = sl->sl_addr[i];
10496 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10497 (char *)&ips6, (int)sizeof (ips6))) {
10498 ip1dbg(("ip_snmp_get_mib2_ip6_"
10499 "group_src: failed to allocate "
10500 "%u bytes\n",
10501 (uint_t)sizeof (ips6)));
10502 }
10503 }
10504 }
10505 rw_exit(&ill->ill_mcast_lock);
10506 ill_refrele(ill);
10507 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10508 }
10509 rw_exit(&ipst->ips_ill_g_lock);
10510
10511 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10512 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10513 (int)optp->level, (int)optp->name, (int)optp->len));
10514 qreply(q, mpctl);
10515 return (mp2ctl);
10516 }
10517
10518 /* Multicast routing virtual interface table. */
10519 static mblk_t *
10520 ip_snmp_get_mib2_virt_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10521 {
10522 struct opthdr *optp;
10523 mblk_t *mp2ctl;
10524
10525 /*
10526 * make a copy of the original message
10527 */
10528 mp2ctl = copymsg(mpctl);
10529
10530 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10531 optp->level = EXPER_DVMRP;
10532 optp->name = EXPER_DVMRP_VIF;
10533 if (!ip_mroute_vif(mpctl->b_cont, ipst)) {
10534 ip0dbg(("ip_mroute_vif: failed\n"));
10535 }
10536 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10537 ip3dbg(("ip_snmp_get_mib2_virt_multi: level %d, name %d, len %d\n",
10538 (int)optp->level, (int)optp->name, (int)optp->len));
10539 qreply(q, mpctl);
10540 return (mp2ctl);
10541 }
10542
10543 /* Multicast routing table. */
10544 static mblk_t *
10545 ip_snmp_get_mib2_multi_rtable(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10546 {
10547 struct opthdr *optp;
10548 mblk_t *mp2ctl;
10549
10550 /*
10551 * make a copy of the original message
10552 */
10553 mp2ctl = copymsg(mpctl);
10554
10555 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10556 optp->level = EXPER_DVMRP;
10557 optp->name = EXPER_DVMRP_MRT;
10558 if (!ip_mroute_mrt(mpctl->b_cont, ipst)) {
10559 ip0dbg(("ip_mroute_mrt: failed\n"));
10560 }
10561 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10562 ip3dbg(("ip_snmp_get_mib2_multi_rtable: level %d, name %d, len %d\n",
10563 (int)optp->level, (int)optp->name, (int)optp->len));
10564 qreply(q, mpctl);
10565 return (mp2ctl);
10566 }
10567
10568 /*
10569 * Return ipRouteEntryTable, ipNetToMediaEntryTable, and ipRouteAttributeTable
10570 * in one IRE walk.
10571 */
10572 static mblk_t *
10573 ip_snmp_get_mib2_ip_route_media(queue_t *q, mblk_t *mpctl, int level,
10574 ip_stack_t *ipst)
10575 {
10576 struct opthdr *optp;
10577 mblk_t *mp2ctl; /* Returned */
10578 mblk_t *mp3ctl; /* nettomedia */
10579 mblk_t *mp4ctl; /* routeattrs */
10580 iproutedata_t ird;
10581 zoneid_t zoneid;
10582
10583 /*
10584 * make copies of the original message
10585 * - mp2ctl is returned unchanged to the caller for his use
10586 * - mpctl is sent upstream as ipRouteEntryTable
10587 * - mp3ctl is sent upstream as ipNetToMediaEntryTable
10588 * - mp4ctl is sent upstream as ipRouteAttributeTable
10589 */
10590 mp2ctl = copymsg(mpctl);
10591 mp3ctl = copymsg(mpctl);
10592 mp4ctl = copymsg(mpctl);
10593 if (mp3ctl == NULL || mp4ctl == NULL) {
10594 freemsg(mp4ctl);
10595 freemsg(mp3ctl);
10596 freemsg(mp2ctl);
10597 freemsg(mpctl);
10598 return (NULL);
10599 }
10600
10601 bzero(&ird, sizeof (ird));
10602
10603 ird.ird_route.lp_head = mpctl->b_cont;
10604 ird.ird_netmedia.lp_head = mp3ctl->b_cont;
10605 ird.ird_attrs.lp_head = mp4ctl->b_cont;
10606 /*
10607 * If the level has been set the special EXPER_IP_AND_ALL_IRES value,
10608 * then also include ire_testhidden IREs and IRE_IF_CLONE. This is
10609 * intended a temporary solution until a proper MIB API is provided
10610 * that provides complete filtering/caller-opt-in.
10611 */
10612 if (level == EXPER_IP_AND_ALL_IRES)
10613 ird.ird_flags |= IRD_REPORT_ALL;
10614
10615 zoneid = Q_TO_CONN(q)->conn_zoneid;
10616 ire_walk_v4(ip_snmp_get2_v4, &ird, zoneid, ipst);
10617
10618 /* ipRouteEntryTable in mpctl */
10619 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10620 optp->level = MIB2_IP;
10621 optp->name = MIB2_IP_ROUTE;
10622 optp->len = msgdsize(ird.ird_route.lp_head);
10623 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
10624 (int)optp->level, (int)optp->name, (int)optp->len));
10625 qreply(q, mpctl);
10626
10627 /* ipNetToMediaEntryTable in mp3ctl */
10628 ncec_walk(NULL, ip_snmp_get2_v4_media, &ird, ipst);
10629
10630 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10631 optp->level = MIB2_IP;
10632 optp->name = MIB2_IP_MEDIA;
10633 optp->len = msgdsize(ird.ird_netmedia.lp_head);
10634 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
10635 (int)optp->level, (int)optp->name, (int)optp->len));
10636 qreply(q, mp3ctl);
10637
10638 /* ipRouteAttributeTable in mp4ctl */
10639 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10640 optp->level = MIB2_IP;
10641 optp->name = EXPER_IP_RTATTR;
10642 optp->len = msgdsize(ird.ird_attrs.lp_head);
10643 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
10644 (int)optp->level, (int)optp->name, (int)optp->len));
10645 if (optp->len == 0)
10646 freemsg(mp4ctl);
10647 else
10648 qreply(q, mp4ctl);
10649
10650 return (mp2ctl);
10651 }
10652
10653 /*
10654 * Return ipv6RouteEntryTable and ipv6RouteAttributeTable in one IRE walk, and
10655 * ipv6NetToMediaEntryTable in an NDP walk.
10656 */
10657 static mblk_t *
10658 ip_snmp_get_mib2_ip6_route_media(queue_t *q, mblk_t *mpctl, int level,
10659 ip_stack_t *ipst)
10660 {
10661 struct opthdr *optp;
10662 mblk_t *mp2ctl; /* Returned */
10663 mblk_t *mp3ctl; /* nettomedia */
10664 mblk_t *mp4ctl; /* routeattrs */
10665 iproutedata_t ird;
10666 zoneid_t zoneid;
10667
10668 /*
10669 * make copies of the original message
10670 * - mp2ctl is returned unchanged to the caller for his use
10671 * - mpctl is sent upstream as ipv6RouteEntryTable
10672 * - mp3ctl is sent upstream as ipv6NetToMediaEntryTable
10673 * - mp4ctl is sent upstream as ipv6RouteAttributeTable
10674 */
10675 mp2ctl = copymsg(mpctl);
10676 mp3ctl = copymsg(mpctl);
10677 mp4ctl = copymsg(mpctl);
10678 if (mp3ctl == NULL || mp4ctl == NULL) {
10679 freemsg(mp4ctl);
10680 freemsg(mp3ctl);
10681 freemsg(mp2ctl);
10682 freemsg(mpctl);
10683 return (NULL);
10684 }
10685
10686 bzero(&ird, sizeof (ird));
10687
10688 ird.ird_route.lp_head = mpctl->b_cont;
10689 ird.ird_netmedia.lp_head = mp3ctl->b_cont;
10690 ird.ird_attrs.lp_head = mp4ctl->b_cont;
10691 /*
10692 * If the level has been set the special EXPER_IP_AND_ALL_IRES value,
10693 * then also include ire_testhidden IREs and IRE_IF_CLONE. This is
10694 * intended a temporary solution until a proper MIB API is provided
10695 * that provides complete filtering/caller-opt-in.
10696 */
10697 if (level == EXPER_IP_AND_ALL_IRES)
10698 ird.ird_flags |= IRD_REPORT_ALL;
10699
10700 zoneid = Q_TO_CONN(q)->conn_zoneid;
10701 ire_walk_v6(ip_snmp_get2_v6_route, &ird, zoneid, ipst);
10702
10703 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10704 optp->level = MIB2_IP6;
10705 optp->name = MIB2_IP6_ROUTE;
10706 optp->len = msgdsize(ird.ird_route.lp_head);
10707 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
10708 (int)optp->level, (int)optp->name, (int)optp->len));
10709 qreply(q, mpctl);
10710
10711 /* ipv6NetToMediaEntryTable in mp3ctl */
10712 ncec_walk(NULL, ip_snmp_get2_v6_media, &ird, ipst);
10713
10714 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10715 optp->level = MIB2_IP6;
10716 optp->name = MIB2_IP6_MEDIA;
10717 optp->len = msgdsize(ird.ird_netmedia.lp_head);
10718 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
10719 (int)optp->level, (int)optp->name, (int)optp->len));
10720 qreply(q, mp3ctl);
10721
10722 /* ipv6RouteAttributeTable in mp4ctl */
10723 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10724 optp->level = MIB2_IP6;
10725 optp->name = EXPER_IP_RTATTR;
10726 optp->len = msgdsize(ird.ird_attrs.lp_head);
10727 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
10728 (int)optp->level, (int)optp->name, (int)optp->len));
10729 if (optp->len == 0)
10730 freemsg(mp4ctl);
10731 else
10732 qreply(q, mp4ctl);
10733
10734 return (mp2ctl);
10735 }
10736
10737 /*
10738 * IPv6 mib: One per ill
10739 */
10740 static mblk_t *
10741 ip_snmp_get_mib2_ip6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
10742 boolean_t legacy_req)
10743 {
10744 struct opthdr *optp;
10745 mblk_t *mp2ctl;
10746 ill_t *ill;
10747 ill_walk_context_t ctx;
10748 mblk_t *mp_tail = NULL;
10749 mib2_ipv6AddrEntry_t mae6;
10750 mib2_ipIfStatsEntry_t *ise;
10751 size_t ise_size, iae_size;
10752
10753 /*
10754 * Make a copy of the original message
10755 */
10756 mp2ctl = copymsg(mpctl);
10757
10758 /* fixed length IPv6 structure ... */
10759
10760 if (legacy_req) {
10761 ise_size = LEGACY_MIB_SIZE(&ipst->ips_ip6_mib,
10762 mib2_ipIfStatsEntry_t);
10763 iae_size = LEGACY_MIB_SIZE(&mae6, mib2_ipv6AddrEntry_t);
10764 } else {
10765 ise_size = sizeof (mib2_ipIfStatsEntry_t);
10766 iae_size = sizeof (mib2_ipv6AddrEntry_t);
10767 }
10768
10769 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10770 optp->level = MIB2_IP6;
10771 optp->name = 0;
10772 /* Include "unknown interface" ip6_mib */
10773 ipst->ips_ip6_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
10774 ipst->ips_ip6_mib.ipIfStatsIfIndex =
10775 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */
10776 SET_MIB(ipst->ips_ip6_mib.ipIfStatsForwarding,
10777 ipst->ips_ipv6_forwarding ? 1 : 2);
10778 SET_MIB(ipst->ips_ip6_mib.ipIfStatsDefaultHopLimit,
10779 ipst->ips_ipv6_def_hops);
10780 SET_MIB(ipst->ips_ip6_mib.ipIfStatsEntrySize,
10781 sizeof (mib2_ipIfStatsEntry_t));
10782 SET_MIB(ipst->ips_ip6_mib.ipIfStatsAddrEntrySize,
10783 sizeof (mib2_ipv6AddrEntry_t));
10784 SET_MIB(ipst->ips_ip6_mib.ipIfStatsRouteEntrySize,
10785 sizeof (mib2_ipv6RouteEntry_t));
10786 SET_MIB(ipst->ips_ip6_mib.ipIfStatsNetToMediaEntrySize,
10787 sizeof (mib2_ipv6NetToMediaEntry_t));
10788 SET_MIB(ipst->ips_ip6_mib.ipIfStatsMemberEntrySize,
10789 sizeof (ipv6_member_t));
10790 SET_MIB(ipst->ips_ip6_mib.ipIfStatsGroupSourceEntrySize,
10791 sizeof (ipv6_grpsrc_t));
10792
10793 /*
10794 * Synchronize 64- and 32-bit counters
10795 */
10796 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInReceives,
10797 ipIfStatsHCInReceives);
10798 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInDelivers,
10799 ipIfStatsHCInDelivers);
10800 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutRequests,
10801 ipIfStatsHCOutRequests);
10802 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutForwDatagrams,
10803 ipIfStatsHCOutForwDatagrams);
10804 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutMcastPkts,
10805 ipIfStatsHCOutMcastPkts);
10806 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInMcastPkts,
10807 ipIfStatsHCInMcastPkts);
10808
10809 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10810 (char *)&ipst->ips_ip6_mib, (int)ise_size)) {
10811 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate %u bytes\n",
10812 (uint_t)ise_size));
10813 } else if (legacy_req) {
10814 /* Adjust the EntrySize fields for legacy requests. */
10815 ise =
10816 (mib2_ipIfStatsEntry_t *)(mp_tail->b_wptr - (int)ise_size);
10817 SET_MIB(ise->ipIfStatsEntrySize, ise_size);
10818 SET_MIB(ise->ipIfStatsAddrEntrySize, iae_size);
10819 }
10820
10821 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10822 ill = ILL_START_WALK_V6(&ctx, ipst);
10823 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10824 ill->ill_ip_mib->ipIfStatsIfIndex =
10825 ill->ill_phyint->phyint_ifindex;
10826 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding,
10827 ipst->ips_ipv6_forwarding ? 1 : 2);
10828 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultHopLimit,
10829 ill->ill_max_hops);
10830
10831 /*
10832 * Synchronize 64- and 32-bit counters
10833 */
10834 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInReceives,
10835 ipIfStatsHCInReceives);
10836 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInDelivers,
10837 ipIfStatsHCInDelivers);
10838 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutRequests,
10839 ipIfStatsHCOutRequests);
10840 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutForwDatagrams,
10841 ipIfStatsHCOutForwDatagrams);
10842 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutMcastPkts,
10843 ipIfStatsHCOutMcastPkts);
10844 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInMcastPkts,
10845 ipIfStatsHCInMcastPkts);
10846
10847 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10848 (char *)ill->ill_ip_mib, (int)ise_size)) {
10849 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate "
10850 "%u bytes\n", (uint_t)ise_size));
10851 } else if (legacy_req) {
10852 /* Adjust the EntrySize fields for legacy requests. */
10853 ise = (mib2_ipIfStatsEntry_t *)(mp_tail->b_wptr -
10854 (int)ise_size);
10855 SET_MIB(ise->ipIfStatsEntrySize, ise_size);
10856 SET_MIB(ise->ipIfStatsAddrEntrySize, iae_size);
10857 }
10858 }
10859 rw_exit(&ipst->ips_ill_g_lock);
10860
10861 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10862 ip3dbg(("ip_snmp_get_mib2_ip6: level %d, name %d, len %d\n",
10863 (int)optp->level, (int)optp->name, (int)optp->len));
10864 qreply(q, mpctl);
10865 return (mp2ctl);
10866 }
10867
10868 /*
10869 * ICMPv6 mib: One per ill
10870 */
10871 static mblk_t *
10872 ip_snmp_get_mib2_icmp6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10873 {
10874 struct opthdr *optp;
10875 mblk_t *mp2ctl;
10876 ill_t *ill;
10877 ill_walk_context_t ctx;
10878 mblk_t *mp_tail = NULL;
10879 /*
10880 * Make a copy of the original message
10881 */
10882 mp2ctl = copymsg(mpctl);
10883
10884 /* fixed length ICMPv6 structure ... */
10885
10886 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10887 optp->level = MIB2_ICMP6;
10888 optp->name = 0;
10889 /* Include "unknown interface" icmp6_mib */
10890 ipst->ips_icmp6_mib.ipv6IfIcmpIfIndex =
10891 MIB2_UNKNOWN_INTERFACE; /* netstat flag */
10892 ipst->ips_icmp6_mib.ipv6IfIcmpEntrySize =
10893 sizeof (mib2_ipv6IfIcmpEntry_t);
10894 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10895 (char *)&ipst->ips_icmp6_mib,
10896 (int)sizeof (ipst->ips_icmp6_mib))) {
10897 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate %u bytes\n",
10898 (uint_t)sizeof (ipst->ips_icmp6_mib)));
10899 }
10900
10901 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10902 ill = ILL_START_WALK_V6(&ctx, ipst);
10903 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10904 ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
10905 ill->ill_phyint->phyint_ifindex;
10906 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10907 (char *)ill->ill_icmp6_mib,
10908 (int)sizeof (*ill->ill_icmp6_mib))) {
10909 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate "
10910 "%u bytes\n",
10911 (uint_t)sizeof (*ill->ill_icmp6_mib)));
10912 }
10913 }
10914 rw_exit(&ipst->ips_ill_g_lock);
10915
10916 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10917 ip3dbg(("ip_snmp_get_mib2_icmp6: level %d, name %d, len %d\n",
10918 (int)optp->level, (int)optp->name, (int)optp->len));
10919 qreply(q, mpctl);
10920 return (mp2ctl);
10921 }
10922
10923 /*
10924 * ire_walk routine to create both ipRouteEntryTable and
10925 * ipRouteAttributeTable in one IRE walk
10926 */
10927 static void
10928 ip_snmp_get2_v4(ire_t *ire, iproutedata_t *ird)
10929 {
10930 ill_t *ill;
10931 mib2_ipRouteEntry_t *re;
10932 mib2_ipAttributeEntry_t iaes;
10933 tsol_ire_gw_secattr_t *attrp;
10934 tsol_gc_t *gc = NULL;
10935 tsol_gcgrp_t *gcgrp = NULL;
10936 ip_stack_t *ipst = ire->ire_ipst;
10937
10938 ASSERT(ire->ire_ipversion == IPV4_VERSION);
10939
10940 if (!(ird->ird_flags & IRD_REPORT_ALL)) {
10941 if (ire->ire_testhidden)
10942 return;
10943 if (ire->ire_type & IRE_IF_CLONE)
10944 return;
10945 }
10946
10947 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL)
10948 return;
10949
10950 if ((attrp = ire->ire_gw_secattr) != NULL) {
10951 mutex_enter(&attrp->igsa_lock);
10952 if ((gc = attrp->igsa_gc) != NULL) {
10953 gcgrp = gc->gc_grp;
10954 ASSERT(gcgrp != NULL);
10955 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER);
10956 }
10957 mutex_exit(&attrp->igsa_lock);
10958 }
10959 /*
10960 * Return all IRE types for route table... let caller pick and choose
10961 */
10962 re->ipRouteDest = ire->ire_addr;
10963 ill = ire->ire_ill;
10964 re->ipRouteIfIndex.o_length = 0;
10965 if (ill != NULL) {
10966 ill_get_name(ill, re->ipRouteIfIndex.o_bytes, OCTET_LENGTH);
10967 re->ipRouteIfIndex.o_length =
10968 mi_strlen(re->ipRouteIfIndex.o_bytes);
10969 }
10970 re->ipRouteMetric1 = -1;
10971 re->ipRouteMetric2 = -1;
10972 re->ipRouteMetric3 = -1;
10973 re->ipRouteMetric4 = -1;
10974
10975 re->ipRouteNextHop = ire->ire_gateway_addr;
10976 /* indirect(4), direct(3), or invalid(2) */
10977 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
10978 re->ipRouteType = 2;
10979 else if (ire->ire_type & IRE_ONLINK)
10980 re->ipRouteType = 3;
10981 else
10982 re->ipRouteType = 4;
10983
10984 re->ipRouteProto = -1;
10985 re->ipRouteAge = gethrestime_sec() - ire->ire_create_time;
10986 re->ipRouteMask = ire->ire_mask;
10987 re->ipRouteMetric5 = -1;
10988 re->ipRouteInfo.re_max_frag = ire->ire_metrics.iulp_mtu;
10989 if (ire->ire_ill != NULL && re->ipRouteInfo.re_max_frag == 0)
10990 re->ipRouteInfo.re_max_frag = ire->ire_ill->ill_mtu;
10991
10992 re->ipRouteInfo.re_frag_flag = 0;
10993 re->ipRouteInfo.re_rtt = 0;
10994 re->ipRouteInfo.re_src_addr = 0;
10995 re->ipRouteInfo.re_ref = ire->ire_refcnt;
10996 re->ipRouteInfo.re_obpkt = ire->ire_ob_pkt_count;
10997 re->ipRouteInfo.re_ibpkt = ire->ire_ib_pkt_count;
10998 re->ipRouteInfo.re_flags = ire->ire_flags;
10999
11000 /* Add the IRE_IF_CLONE's counters to their parent IRE_INTERFACE */
11001 if (ire->ire_type & IRE_INTERFACE) {
11002 ire_t *child;
11003
11004 rw_enter(&ipst->ips_ire_dep_lock, RW_READER);
11005 child = ire->ire_dep_children;
11006 while (child != NULL) {
11007 re->ipRouteInfo.re_obpkt += child->ire_ob_pkt_count;
11008 re->ipRouteInfo.re_ibpkt += child->ire_ib_pkt_count;
11009 child = child->ire_dep_sib_next;
11010 }
11011 rw_exit(&ipst->ips_ire_dep_lock);
11012 }
11013
11014 if (ire->ire_flags & RTF_DYNAMIC) {
11015 re->ipRouteInfo.re_ire_type = IRE_HOST_REDIRECT;
11016 } else {
11017 re->ipRouteInfo.re_ire_type = ire->ire_type;
11018 }
11019
11020 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail,
11021 (char *)re, (int)sizeof (*re))) {
11022 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n",
11023 (uint_t)sizeof (*re)));
11024 }
11025
11026 if (gc != NULL) {
11027 iaes.iae_routeidx = ird->ird_idx;
11028 iaes.iae_doi = gc->gc_db->gcdb_doi;
11029 iaes.iae_slrange = gc->gc_db->gcdb_slrange;
11030
11031 if (!snmp_append_data2(ird->ird_attrs.lp_head,
11032 &ird->ird_attrs.lp_tail, (char *)&iaes, sizeof (iaes))) {
11033 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u "
11034 "bytes\n", (uint_t)sizeof (iaes)));
11035 }
11036 }
11037
11038 /* bump route index for next pass */
11039 ird->ird_idx++;
11040
11041 kmem_free(re, sizeof (*re));
11042 if (gcgrp != NULL)
11043 rw_exit(&gcgrp->gcgrp_rwlock);
11044 }
11045
11046 /*
11047 * ire_walk routine to create ipv6RouteEntryTable and ipRouteEntryTable.
11048 */
11049 static void
11050 ip_snmp_get2_v6_route(ire_t *ire, iproutedata_t *ird)
11051 {
11052 ill_t *ill;
11053 mib2_ipv6RouteEntry_t *re;
11054 mib2_ipAttributeEntry_t iaes;
11055 tsol_ire_gw_secattr_t *attrp;
11056 tsol_gc_t *gc = NULL;
11057 tsol_gcgrp_t *gcgrp = NULL;
11058 ip_stack_t *ipst = ire->ire_ipst;
11059
11060 ASSERT(ire->ire_ipversion == IPV6_VERSION);
11061
11062 if (!(ird->ird_flags & IRD_REPORT_ALL)) {
11063 if (ire->ire_testhidden)
11064 return;
11065 if (ire->ire_type & IRE_IF_CLONE)
11066 return;
11067 }
11068
11069 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL)
11070 return;
11071
11072 if ((attrp = ire->ire_gw_secattr) != NULL) {
11073 mutex_enter(&attrp->igsa_lock);
11074 if ((gc = attrp->igsa_gc) != NULL) {
11075 gcgrp = gc->gc_grp;
11076 ASSERT(gcgrp != NULL);
11077 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER);
11078 }
11079 mutex_exit(&attrp->igsa_lock);
11080 }
11081 /*
11082 * Return all IRE types for route table... let caller pick and choose
11083 */
11084 re->ipv6RouteDest = ire->ire_addr_v6;
11085 re->ipv6RoutePfxLength = ip_mask_to_plen_v6(&ire->ire_mask_v6);
11086 re->ipv6RouteIndex = 0; /* Unique when multiple with same dest/plen */
11087 re->ipv6RouteIfIndex.o_length = 0;
11088 ill = ire->ire_ill;
11089 if (ill != NULL) {
11090 ill_get_name(ill, re->ipv6RouteIfIndex.o_bytes, OCTET_LENGTH);
11091 re->ipv6RouteIfIndex.o_length =
11092 mi_strlen(re->ipv6RouteIfIndex.o_bytes);
11093 }
11094
11095 ASSERT(!(ire->ire_type & IRE_BROADCAST));
11096
11097 mutex_enter(&ire->ire_lock);
11098 re->ipv6RouteNextHop = ire->ire_gateway_addr_v6;
11099 mutex_exit(&ire->ire_lock);
11100
11101 /* remote(4), local(3), or discard(2) */
11102 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
11103 re->ipv6RouteType = 2;
11104 else if (ire->ire_type & IRE_ONLINK)
11105 re->ipv6RouteType = 3;
11106 else
11107 re->ipv6RouteType = 4;
11108
11109 re->ipv6RouteProtocol = -1;
11110 re->ipv6RoutePolicy = 0;
11111 re->ipv6RouteAge = gethrestime_sec() - ire->ire_create_time;
11112 re->ipv6RouteNextHopRDI = 0;
11113 re->ipv6RouteWeight = 0;
11114 re->ipv6RouteMetric = 0;
11115 re->ipv6RouteInfo.re_max_frag = ire->ire_metrics.iulp_mtu;
11116 if (ire->ire_ill != NULL && re->ipv6RouteInfo.re_max_frag == 0)
11117 re->ipv6RouteInfo.re_max_frag = ire->ire_ill->ill_mtu;
11118
11119 re->ipv6RouteInfo.re_frag_flag = 0;
11120 re->ipv6RouteInfo.re_rtt = 0;
11121 re->ipv6RouteInfo.re_src_addr = ipv6_all_zeros;
11122 re->ipv6RouteInfo.re_obpkt = ire->ire_ob_pkt_count;
11123 re->ipv6RouteInfo.re_ibpkt = ire->ire_ib_pkt_count;
11124 re->ipv6RouteInfo.re_ref = ire->ire_refcnt;
11125 re->ipv6RouteInfo.re_flags = ire->ire_flags;
11126
11127 /* Add the IRE_IF_CLONE's counters to their parent IRE_INTERFACE */
11128 if (ire->ire_type & IRE_INTERFACE) {
11129 ire_t *child;
11130
11131 rw_enter(&ipst->ips_ire_dep_lock, RW_READER);
11132 child = ire->ire_dep_children;
11133 while (child != NULL) {
11134 re->ipv6RouteInfo.re_obpkt += child->ire_ob_pkt_count;
11135 re->ipv6RouteInfo.re_ibpkt += child->ire_ib_pkt_count;
11136 child = child->ire_dep_sib_next;
11137 }
11138 rw_exit(&ipst->ips_ire_dep_lock);
11139 }
11140 if (ire->ire_flags & RTF_DYNAMIC) {
11141 re->ipv6RouteInfo.re_ire_type = IRE_HOST_REDIRECT;
11142 } else {
11143 re->ipv6RouteInfo.re_ire_type = ire->ire_type;
11144 }
11145
11146 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail,
11147 (char *)re, (int)sizeof (*re))) {
11148 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u bytes\n",
11149 (uint_t)sizeof (*re)));
11150 }
11151
11152 if (gc != NULL) {
11153 iaes.iae_routeidx = ird->ird_idx;
11154 iaes.iae_doi = gc->gc_db->gcdb_doi;
11155 iaes.iae_slrange = gc->gc_db->gcdb_slrange;
11156
11157 if (!snmp_append_data2(ird->ird_attrs.lp_head,
11158 &ird->ird_attrs.lp_tail, (char *)&iaes, sizeof (iaes))) {
11159 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u "
11160 "bytes\n", (uint_t)sizeof (iaes)));
11161 }
11162 }
11163
11164 /* bump route index for next pass */
11165 ird->ird_idx++;
11166
11167 kmem_free(re, sizeof (*re));
11168 if (gcgrp != NULL)
11169 rw_exit(&gcgrp->gcgrp_rwlock);
11170 }
11171
11172 /*
11173 * ncec_walk routine to create ipv6NetToMediaEntryTable
11174 */
11175 static int
11176 ip_snmp_get2_v6_media(ncec_t *ncec, iproutedata_t *ird)
11177 {
11178 ill_t *ill;
11179 mib2_ipv6NetToMediaEntry_t ntme;
11180
11181 ill = ncec->ncec_ill;
11182 /* skip arpce entries, and loopback ncec entries */
11183 if (ill->ill_isv6 == B_FALSE || ill->ill_net_type == IRE_LOOPBACK)
11184 return (0);
11185 /*
11186 * Neighbor cache entry attached to IRE with on-link
11187 * destination.
11188 * We report all IPMP groups on ncec_ill which is normally the upper.
11189 */
11190 ntme.ipv6NetToMediaIfIndex = ill->ill_phyint->phyint_ifindex;
11191 ntme.ipv6NetToMediaNetAddress = ncec->ncec_addr;
11192 ntme.ipv6NetToMediaPhysAddress.o_length = ill->ill_phys_addr_length;
11193 if (ncec->ncec_lladdr != NULL) {
11194 bcopy(ncec->ncec_lladdr, ntme.ipv6NetToMediaPhysAddress.o_bytes,
11195 ntme.ipv6NetToMediaPhysAddress.o_length);
11196 }
11197 /*
11198 * Note: Returns ND_* states. Should be:
11199 * reachable(1), stale(2), delay(3), probe(4),
11200 * invalid(5), unknown(6)
11201 */
11202 ntme.ipv6NetToMediaState = ncec->ncec_state;
11203 ntme.ipv6NetToMediaLastUpdated = 0;
11204
11205 /* other(1), dynamic(2), static(3), local(4) */
11206 if (NCE_MYADDR(ncec)) {
11207 ntme.ipv6NetToMediaType = 4;
11208 } else if (ncec->ncec_flags & NCE_F_PUBLISH) {
11209 ntme.ipv6NetToMediaType = 1; /* proxy */
11210 } else if (ncec->ncec_flags & NCE_F_STATIC) {
11211 ntme.ipv6NetToMediaType = 3;
11212 } else if (ncec->ncec_flags & (NCE_F_MCAST|NCE_F_BCAST)) {
11213 ntme.ipv6NetToMediaType = 1;
11214 } else {
11215 ntme.ipv6NetToMediaType = 2;
11216 }
11217
11218 if (!snmp_append_data2(ird->ird_netmedia.lp_head,
11219 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) {
11220 ip1dbg(("ip_snmp_get2_v6_media: failed to allocate %u bytes\n",
11221 (uint_t)sizeof (ntme)));
11222 }
11223 return (0);
11224 }
11225
11226 int
11227 nce2ace(ncec_t *ncec)
11228 {
11229 int flags = 0;
11230
11231 if (NCE_ISREACHABLE(ncec))
11232 flags |= ACE_F_RESOLVED;
11233 if (ncec->ncec_flags & NCE_F_AUTHORITY)
11234 flags |= ACE_F_AUTHORITY;
11235 if (ncec->ncec_flags & NCE_F_PUBLISH)
11236 flags |= ACE_F_PUBLISH;
11237 if ((ncec->ncec_flags & NCE_F_NONUD) != 0)
11238 flags |= ACE_F_PERMANENT;
11239 if (NCE_MYADDR(ncec))
11240 flags |= (ACE_F_MYADDR | ACE_F_AUTHORITY);
11241 if (ncec->ncec_flags & NCE_F_UNVERIFIED)
11242 flags |= ACE_F_UNVERIFIED;
11243 if (ncec->ncec_flags & NCE_F_AUTHORITY)
11244 flags |= ACE_F_AUTHORITY;
11245 if (ncec->ncec_flags & NCE_F_DELAYED)
11246 flags |= ACE_F_DELAYED;
11247 return (flags);
11248 }
11249
11250 /*
11251 * ncec_walk routine to create ipNetToMediaEntryTable
11252 */
11253 static int
11254 ip_snmp_get2_v4_media(ncec_t *ncec, iproutedata_t *ird)
11255 {
11256 ill_t *ill;
11257 mib2_ipNetToMediaEntry_t ntme;
11258 const char *name = "unknown";
11259 ipaddr_t ncec_addr;
11260
11261 ill = ncec->ncec_ill;
11262 if (ill->ill_isv6 || (ncec->ncec_flags & NCE_F_BCAST) ||
11263 ill->ill_net_type == IRE_LOOPBACK)
11264 return (0);
11265
11266 /* We report all IPMP groups on ncec_ill which is normally the upper. */
11267 name = ill->ill_name;
11268 /* Based on RFC 4293: other(1), inval(2), dyn(3), stat(4) */
11269 if (NCE_MYADDR(ncec)) {
11270 ntme.ipNetToMediaType = 4;
11271 } else if (ncec->ncec_flags & (NCE_F_MCAST|NCE_F_BCAST|NCE_F_PUBLISH)) {
11272 ntme.ipNetToMediaType = 1;
11273 } else {
11274 ntme.ipNetToMediaType = 3;
11275 }
11276 ntme.ipNetToMediaIfIndex.o_length = MIN(OCTET_LENGTH, strlen(name));
11277 bcopy(name, ntme.ipNetToMediaIfIndex.o_bytes,
11278 ntme.ipNetToMediaIfIndex.o_length);
11279
11280 IN6_V4MAPPED_TO_IPADDR(&ncec->ncec_addr, ncec_addr);
11281 bcopy(&ncec_addr, &ntme.ipNetToMediaNetAddress, sizeof (ncec_addr));
11282
11283 ntme.ipNetToMediaInfo.ntm_mask.o_length = sizeof (ipaddr_t);
11284 ncec_addr = INADDR_BROADCAST;
11285 bcopy(&ncec_addr, ntme.ipNetToMediaInfo.ntm_mask.o_bytes,
11286 sizeof (ncec_addr));
11287 /*
11288 * map all the flags to the ACE counterpart.
11289 */
11290 ntme.ipNetToMediaInfo.ntm_flags = nce2ace(ncec);
11291
11292 ntme.ipNetToMediaPhysAddress.o_length =
11293 MIN(OCTET_LENGTH, ill->ill_phys_addr_length);
11294
11295 if (!NCE_ISREACHABLE(ncec))
11296 ntme.ipNetToMediaPhysAddress.o_length = 0;
11297 else {
11298 if (ncec->ncec_lladdr != NULL) {
11299 bcopy(ncec->ncec_lladdr,
11300 ntme.ipNetToMediaPhysAddress.o_bytes,
11301 ntme.ipNetToMediaPhysAddress.o_length);
11302 }
11303 }
11304
11305 if (!snmp_append_data2(ird->ird_netmedia.lp_head,
11306 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) {
11307 ip1dbg(("ip_snmp_get2_v4_media: failed to allocate %u bytes\n",
11308 (uint_t)sizeof (ntme)));
11309 }
11310 return (0);
11311 }
11312
11313 /*
11314 * return (0) if invalid set request, 1 otherwise, including non-tcp requests
11315 */
11316 /* ARGSUSED */
11317 int
11318 ip_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len)
11319 {
11320 switch (level) {
11321 case MIB2_IP:
11322 case MIB2_ICMP:
11323 switch (name) {
11324 default:
11325 break;
11326 }
11327 return (1);
11328 default:
11329 return (1);
11330 }
11331 }
11332
11333 /*
11334 * When there exists both a 64- and 32-bit counter of a particular type
11335 * (i.e., InReceives), only the 64-bit counters are added.
11336 */
11337 void
11338 ip_mib2_add_ip_stats(mib2_ipIfStatsEntry_t *o1, mib2_ipIfStatsEntry_t *o2)
11339 {
11340 UPDATE_MIB(o1, ipIfStatsInHdrErrors, o2->ipIfStatsInHdrErrors);
11341 UPDATE_MIB(o1, ipIfStatsInTooBigErrors, o2->ipIfStatsInTooBigErrors);
11342 UPDATE_MIB(o1, ipIfStatsInNoRoutes, o2->ipIfStatsInNoRoutes);
11343 UPDATE_MIB(o1, ipIfStatsInAddrErrors, o2->ipIfStatsInAddrErrors);
11344 UPDATE_MIB(o1, ipIfStatsInUnknownProtos, o2->ipIfStatsInUnknownProtos);
11345 UPDATE_MIB(o1, ipIfStatsInTruncatedPkts, o2->ipIfStatsInTruncatedPkts);
11346 UPDATE_MIB(o1, ipIfStatsInDiscards, o2->ipIfStatsInDiscards);
11347 UPDATE_MIB(o1, ipIfStatsOutDiscards, o2->ipIfStatsOutDiscards);
11348 UPDATE_MIB(o1, ipIfStatsOutFragOKs, o2->ipIfStatsOutFragOKs);
11349 UPDATE_MIB(o1, ipIfStatsOutFragFails, o2->ipIfStatsOutFragFails);
11350 UPDATE_MIB(o1, ipIfStatsOutFragCreates, o2->ipIfStatsOutFragCreates);
11351 UPDATE_MIB(o1, ipIfStatsReasmReqds, o2->ipIfStatsReasmReqds);
11352 UPDATE_MIB(o1, ipIfStatsReasmOKs, o2->ipIfStatsReasmOKs);
11353 UPDATE_MIB(o1, ipIfStatsReasmFails, o2->ipIfStatsReasmFails);
11354 UPDATE_MIB(o1, ipIfStatsOutNoRoutes, o2->ipIfStatsOutNoRoutes);
11355 UPDATE_MIB(o1, ipIfStatsReasmDuplicates, o2->ipIfStatsReasmDuplicates);
11356 UPDATE_MIB(o1, ipIfStatsReasmPartDups, o2->ipIfStatsReasmPartDups);
11357 UPDATE_MIB(o1, ipIfStatsForwProhibits, o2->ipIfStatsForwProhibits);
11358 UPDATE_MIB(o1, udpInCksumErrs, o2->udpInCksumErrs);
11359 UPDATE_MIB(o1, udpInOverflows, o2->udpInOverflows);
11360 UPDATE_MIB(o1, rawipInOverflows, o2->rawipInOverflows);
11361 UPDATE_MIB(o1, ipIfStatsInWrongIPVersion,
11362 o2->ipIfStatsInWrongIPVersion);
11363 UPDATE_MIB(o1, ipIfStatsOutWrongIPVersion,
11364 o2->ipIfStatsInWrongIPVersion);
11365 UPDATE_MIB(o1, ipIfStatsOutSwitchIPVersion,
11366 o2->ipIfStatsOutSwitchIPVersion);
11367 UPDATE_MIB(o1, ipIfStatsHCInReceives, o2->ipIfStatsHCInReceives);
11368 UPDATE_MIB(o1, ipIfStatsHCInOctets, o2->ipIfStatsHCInOctets);
11369 UPDATE_MIB(o1, ipIfStatsHCInForwDatagrams,
11370 o2->ipIfStatsHCInForwDatagrams);
11371 UPDATE_MIB(o1, ipIfStatsHCInDelivers, o2->ipIfStatsHCInDelivers);
11372 UPDATE_MIB(o1, ipIfStatsHCOutRequests, o2->ipIfStatsHCOutRequests);
11373 UPDATE_MIB(o1, ipIfStatsHCOutForwDatagrams,
11374 o2->ipIfStatsHCOutForwDatagrams);
11375 UPDATE_MIB(o1, ipIfStatsOutFragReqds, o2->ipIfStatsOutFragReqds);
11376 UPDATE_MIB(o1, ipIfStatsHCOutTransmits, o2->ipIfStatsHCOutTransmits);
11377 UPDATE_MIB(o1, ipIfStatsHCOutOctets, o2->ipIfStatsHCOutOctets);
11378 UPDATE_MIB(o1, ipIfStatsHCInMcastPkts, o2->ipIfStatsHCInMcastPkts);
11379 UPDATE_MIB(o1, ipIfStatsHCInMcastOctets, o2->ipIfStatsHCInMcastOctets);
11380 UPDATE_MIB(o1, ipIfStatsHCOutMcastPkts, o2->ipIfStatsHCOutMcastPkts);
11381 UPDATE_MIB(o1, ipIfStatsHCOutMcastOctets,
11382 o2->ipIfStatsHCOutMcastOctets);
11383 UPDATE_MIB(o1, ipIfStatsHCInBcastPkts, o2->ipIfStatsHCInBcastPkts);
11384 UPDATE_MIB(o1, ipIfStatsHCOutBcastPkts, o2->ipIfStatsHCOutBcastPkts);
11385 UPDATE_MIB(o1, ipsecInSucceeded, o2->ipsecInSucceeded);
11386 UPDATE_MIB(o1, ipsecInFailed, o2->ipsecInFailed);
11387 UPDATE_MIB(o1, ipInCksumErrs, o2->ipInCksumErrs);
11388 UPDATE_MIB(o1, tcpInErrs, o2->tcpInErrs);
11389 UPDATE_MIB(o1, udpNoPorts, o2->udpNoPorts);
11390 }
11391
11392 void
11393 ip_mib2_add_icmp6_stats(mib2_ipv6IfIcmpEntry_t *o1, mib2_ipv6IfIcmpEntry_t *o2)
11394 {
11395 UPDATE_MIB(o1, ipv6IfIcmpInMsgs, o2->ipv6IfIcmpInMsgs);
11396 UPDATE_MIB(o1, ipv6IfIcmpInErrors, o2->ipv6IfIcmpInErrors);
11397 UPDATE_MIB(o1, ipv6IfIcmpInDestUnreachs, o2->ipv6IfIcmpInDestUnreachs);
11398 UPDATE_MIB(o1, ipv6IfIcmpInAdminProhibs, o2->ipv6IfIcmpInAdminProhibs);
11399 UPDATE_MIB(o1, ipv6IfIcmpInTimeExcds, o2->ipv6IfIcmpInTimeExcds);
11400 UPDATE_MIB(o1, ipv6IfIcmpInParmProblems, o2->ipv6IfIcmpInParmProblems);
11401 UPDATE_MIB(o1, ipv6IfIcmpInPktTooBigs, o2->ipv6IfIcmpInPktTooBigs);
11402 UPDATE_MIB(o1, ipv6IfIcmpInEchos, o2->ipv6IfIcmpInEchos);
11403 UPDATE_MIB(o1, ipv6IfIcmpInEchoReplies, o2->ipv6IfIcmpInEchoReplies);
11404 UPDATE_MIB(o1, ipv6IfIcmpInRouterSolicits,
11405 o2->ipv6IfIcmpInRouterSolicits);
11406 UPDATE_MIB(o1, ipv6IfIcmpInRouterAdvertisements,
11407 o2->ipv6IfIcmpInRouterAdvertisements);
11408 UPDATE_MIB(o1, ipv6IfIcmpInNeighborSolicits,
11409 o2->ipv6IfIcmpInNeighborSolicits);
11410 UPDATE_MIB(o1, ipv6IfIcmpInNeighborAdvertisements,
11411 o2->ipv6IfIcmpInNeighborAdvertisements);
11412 UPDATE_MIB(o1, ipv6IfIcmpInRedirects, o2->ipv6IfIcmpInRedirects);
11413 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembQueries,
11414 o2->ipv6IfIcmpInGroupMembQueries);
11415 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembResponses,
11416 o2->ipv6IfIcmpInGroupMembResponses);
11417 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembReductions,
11418 o2->ipv6IfIcmpInGroupMembReductions);
11419 UPDATE_MIB(o1, ipv6IfIcmpOutMsgs, o2->ipv6IfIcmpOutMsgs);
11420 UPDATE_MIB(o1, ipv6IfIcmpOutErrors, o2->ipv6IfIcmpOutErrors);
11421 UPDATE_MIB(o1, ipv6IfIcmpOutDestUnreachs,
11422 o2->ipv6IfIcmpOutDestUnreachs);
11423 UPDATE_MIB(o1, ipv6IfIcmpOutAdminProhibs,
11424 o2->ipv6IfIcmpOutAdminProhibs);
11425 UPDATE_MIB(o1, ipv6IfIcmpOutTimeExcds, o2->ipv6IfIcmpOutTimeExcds);
11426 UPDATE_MIB(o1, ipv6IfIcmpOutParmProblems,
11427 o2->ipv6IfIcmpOutParmProblems);
11428 UPDATE_MIB(o1, ipv6IfIcmpOutPktTooBigs, o2->ipv6IfIcmpOutPktTooBigs);
11429 UPDATE_MIB(o1, ipv6IfIcmpOutEchos, o2->ipv6IfIcmpOutEchos);
11430 UPDATE_MIB(o1, ipv6IfIcmpOutEchoReplies, o2->ipv6IfIcmpOutEchoReplies);
11431 UPDATE_MIB(o1, ipv6IfIcmpOutRouterSolicits,
11432 o2->ipv6IfIcmpOutRouterSolicits);
11433 UPDATE_MIB(o1, ipv6IfIcmpOutRouterAdvertisements,
11434 o2->ipv6IfIcmpOutRouterAdvertisements);
11435 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborSolicits,
11436 o2->ipv6IfIcmpOutNeighborSolicits);
11437 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborAdvertisements,
11438 o2->ipv6IfIcmpOutNeighborAdvertisements);
11439 UPDATE_MIB(o1, ipv6IfIcmpOutRedirects, o2->ipv6IfIcmpOutRedirects);
11440 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembQueries,
11441 o2->ipv6IfIcmpOutGroupMembQueries);
11442 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembResponses,
11443 o2->ipv6IfIcmpOutGroupMembResponses);
11444 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembReductions,
11445 o2->ipv6IfIcmpOutGroupMembReductions);
11446 UPDATE_MIB(o1, ipv6IfIcmpInOverflows, o2->ipv6IfIcmpInOverflows);
11447 UPDATE_MIB(o1, ipv6IfIcmpBadHoplimit, o2->ipv6IfIcmpBadHoplimit);
11448 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborAdvertisements,
11449 o2->ipv6IfIcmpInBadNeighborAdvertisements);
11450 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborSolicitations,
11451 o2->ipv6IfIcmpInBadNeighborSolicitations);
11452 UPDATE_MIB(o1, ipv6IfIcmpInBadRedirects, o2->ipv6IfIcmpInBadRedirects);
11453 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembTotal,
11454 o2->ipv6IfIcmpInGroupMembTotal);
11455 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadQueries,
11456 o2->ipv6IfIcmpInGroupMembBadQueries);
11457 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadReports,
11458 o2->ipv6IfIcmpInGroupMembBadReports);
11459 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembOurReports,
11460 o2->ipv6IfIcmpInGroupMembOurReports);
11461 }
11462
11463 /*
11464 * Called before the options are updated to check if this packet will
11465 * be source routed from here.
11466 * This routine assumes that the options are well formed i.e. that they
11467 * have already been checked.
11468 */
11469 boolean_t
11470 ip_source_routed(ipha_t *ipha, ip_stack_t *ipst)
11471 {
11472 ipoptp_t opts;
11473 uchar_t *opt;
11474 uint8_t optval;
11475 uint8_t optlen;
11476 ipaddr_t dst;
11477
11478 if (IS_SIMPLE_IPH(ipha)) {
11479 ip2dbg(("not source routed\n"));
11480 return (B_FALSE);
11481 }
11482 dst = ipha->ipha_dst;
11483 for (optval = ipoptp_first(&opts, ipha);
11484 optval != IPOPT_EOL;
11485 optval = ipoptp_next(&opts)) {
11486 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
11487 opt = opts.ipoptp_cur;
11488 optlen = opts.ipoptp_len;
11489 ip2dbg(("ip_source_routed: opt %d, len %d\n",
11490 optval, optlen));
11491 switch (optval) {
11492 uint32_t off;
11493 case IPOPT_SSRR:
11494 case IPOPT_LSRR:
11495 /*
11496 * If dst is one of our addresses and there are some
11497 * entries left in the source route return (true).
11498 */
11499 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
11500 ip2dbg(("ip_source_routed: not next"
11501 " source route 0x%x\n",
11502 ntohl(dst)));
11503 return (B_FALSE);
11504 }
11505 off = opt[IPOPT_OFFSET];
11506 off--;
11507 if (optlen < IP_ADDR_LEN ||
11508 off > optlen - IP_ADDR_LEN) {
11509 /* End of source route */
11510 ip1dbg(("ip_source_routed: end of SR\n"));
11511 return (B_FALSE);
11512 }
11513 return (B_TRUE);
11514 }
11515 }
11516 ip2dbg(("not source routed\n"));
11517 return (B_FALSE);
11518 }
11519
11520 /*
11521 * ip_unbind is called by the transports to remove a conn from
11522 * the fanout table.
11523 */
11524 void
11525 ip_unbind(conn_t *connp)
11526 {
11527
11528 ASSERT(!MUTEX_HELD(&connp->conn_lock));
11529
11530 if (is_system_labeled() && connp->conn_anon_port) {
11531 (void) tsol_mlp_anon(crgetzone(connp->conn_cred),
11532 connp->conn_mlp_type, connp->conn_proto,
11533 ntohs(connp->conn_lport), B_FALSE);
11534 connp->conn_anon_port = 0;
11535 }
11536 connp->conn_mlp_type = mlptSingle;
11537
11538 ipcl_hash_remove(connp);
11539 }
11540
11541 /*
11542 * Used for deciding the MSS size for the upper layer. Thus
11543 * we need to check the outbound policy values in the conn.
11544 */
11545 int
11546 conn_ipsec_length(conn_t *connp)
11547 {
11548 ipsec_latch_t *ipl;
11549
11550 ipl = connp->conn_latch;
11551 if (ipl == NULL)
11552 return (0);
11553
11554 if (connp->conn_ixa->ixa_ipsec_policy == NULL)
11555 return (0);
11556
11557 return (connp->conn_ixa->ixa_ipsec_policy->ipsp_act->ipa_ovhd);
11558 }
11559
11560 /*
11561 * Returns an estimate of the IPsec headers size. This is used if
11562 * we don't want to call into IPsec to get the exact size.
11563 */
11564 int
11565 ipsec_out_extra_length(ip_xmit_attr_t *ixa)
11566 {
11567 ipsec_action_t *a;
11568
11569 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
11570 return (0);
11571
11572 a = ixa->ixa_ipsec_action;
11573 if (a == NULL) {
11574 ASSERT(ixa->ixa_ipsec_policy != NULL);
11575 a = ixa->ixa_ipsec_policy->ipsp_act;
11576 }
11577 ASSERT(a != NULL);
11578
11579 return (a->ipa_ovhd);
11580 }
11581
11582 /*
11583 * If there are any source route options, return the true final
11584 * destination. Otherwise, return the destination.
11585 */
11586 ipaddr_t
11587 ip_get_dst(ipha_t *ipha)
11588 {
11589 ipoptp_t opts;
11590 uchar_t *opt;
11591 uint8_t optval;
11592 uint8_t optlen;
11593 ipaddr_t dst;
11594 uint32_t off;
11595
11596 dst = ipha->ipha_dst;
11597
11598 if (IS_SIMPLE_IPH(ipha))
11599 return (dst);
11600
11601 for (optval = ipoptp_first(&opts, ipha);
11602 optval != IPOPT_EOL;
11603 optval = ipoptp_next(&opts)) {
11604 opt = opts.ipoptp_cur;
11605 optlen = opts.ipoptp_len;
11606 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
11607 switch (optval) {
11608 case IPOPT_SSRR:
11609 case IPOPT_LSRR:
11610 off = opt[IPOPT_OFFSET];
11611 /*
11612 * If one of the conditions is true, it means
11613 * end of options and dst already has the right
11614 * value.
11615 */
11616 if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) {
11617 off = optlen - IP_ADDR_LEN;
11618 bcopy(&opt[off], &dst, IP_ADDR_LEN);
11619 }
11620 return (dst);
11621 default:
11622 break;
11623 }
11624 }
11625
11626 return (dst);
11627 }
11628
11629 /*
11630 * Outbound IP fragmentation routine.
11631 * Assumes the caller has checked whether or not fragmentation should
11632 * be allowed. Here we copy the DF bit from the header to all the generated
11633 * fragments.
11634 */
11635 int
11636 ip_fragment_v4(mblk_t *mp_orig, nce_t *nce, iaflags_t ixaflags,
11637 uint_t pkt_len, uint32_t max_frag, uint32_t xmit_hint, zoneid_t szone,
11638 zoneid_t nolzid, pfirepostfrag_t postfragfn, uintptr_t *ixa_cookie)
11639 {
11640 int i1;
11641 int hdr_len;
11642 mblk_t *hdr_mp;
11643 ipha_t *ipha;
11644 int ip_data_end;
11645 int len;
11646 mblk_t *mp = mp_orig;
11647 int offset;
11648 ill_t *ill = nce->nce_ill;
11649 ip_stack_t *ipst = ill->ill_ipst;
11650 mblk_t *carve_mp;
11651 uint32_t frag_flag;
11652 uint_t priority = mp->b_band;
11653 int error = 0;
11654
11655 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragReqds);
11656
11657 if (pkt_len != msgdsize(mp)) {
11658 ip0dbg(("Packet length mismatch: %d, %ld\n",
11659 pkt_len, msgdsize(mp)));
11660 freemsg(mp);
11661 return (EINVAL);
11662 }
11663
11664 if (max_frag == 0) {
11665 ip1dbg(("ip_fragment_v4: max_frag is zero. Dropping packet\n"));
11666 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11667 ip_drop_output("FragFails: zero max_frag", mp, ill);
11668 freemsg(mp);
11669 return (EINVAL);
11670 }
11671
11672 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
11673 ipha = (ipha_t *)mp->b_rptr;
11674 ASSERT(ntohs(ipha->ipha_length) == pkt_len);
11675 frag_flag = ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_DF;
11676
11677 /*
11678 * Establish the starting offset. May not be zero if we are fragging
11679 * a fragment that is being forwarded.
11680 */
11681 offset = ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET;
11682
11683 /* TODO why is this test needed? */
11684 if (((max_frag - ntohs(ipha->ipha_length)) & ~7) < 8) {
11685 /* TODO: notify ulp somehow */
11686 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11687 ip_drop_output("FragFails: bad starting offset", mp, ill);
11688 freemsg(mp);
11689 return (EINVAL);
11690 }
11691
11692 hdr_len = IPH_HDR_LENGTH(ipha);
11693 ipha->ipha_hdr_checksum = 0;
11694
11695 /*
11696 * Establish the number of bytes maximum per frag, after putting
11697 * in the header.
11698 */
11699 len = (max_frag - hdr_len) & ~7;
11700
11701 /* Get a copy of the header for the trailing frags */
11702 hdr_mp = ip_fragment_copyhdr((uchar_t *)ipha, hdr_len, offset, ipst,
11703 mp);
11704 if (hdr_mp == NULL) {
11705 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11706 ip_drop_output("FragFails: no hdr_mp", mp, ill);
11707 freemsg(mp);
11708 return (ENOBUFS);
11709 }
11710
11711 /* Store the starting offset, with the MoreFrags flag. */
11712 i1 = offset | IPH_MF | frag_flag;
11713 ipha->ipha_fragment_offset_and_flags = htons((uint16_t)i1);
11714
11715 /* Establish the ending byte offset, based on the starting offset. */
11716 offset <<= 3;
11717 ip_data_end = offset + ntohs(ipha->ipha_length) - hdr_len;
11718
11719 /* Store the length of the first fragment in the IP header. */
11720 i1 = len + hdr_len;
11721 ASSERT(i1 <= IP_MAXPACKET);
11722 ipha->ipha_length = htons((uint16_t)i1);
11723
11724 /*
11725 * Compute the IP header checksum for the first frag. We have to
11726 * watch out that we stop at the end of the header.
11727 */
11728 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
11729
11730 /*
11731 * Now carve off the first frag. Note that this will include the
11732 * original IP header.
11733 */
11734 if (!(mp = ip_carve_mp(&mp_orig, i1))) {
11735 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11736 ip_drop_output("FragFails: could not carve mp", mp_orig, ill);
11737 freeb(hdr_mp);
11738 freemsg(mp_orig);
11739 return (ENOBUFS);
11740 }
11741
11742 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
11743
11744 error = postfragfn(mp, nce, ixaflags, i1, xmit_hint, szone, nolzid,
11745 ixa_cookie);
11746 if (error != 0 && error != EWOULDBLOCK) {
11747 /* No point in sending the other fragments */
11748 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11749 ip_drop_output("FragFails: postfragfn failed", mp_orig, ill);
11750 freeb(hdr_mp);
11751 freemsg(mp_orig);
11752 return (error);
11753 }
11754
11755 /* No need to redo state machine in loop */
11756 ixaflags &= ~IXAF_REACH_CONF;
11757
11758 /* Advance the offset to the second frag starting point. */
11759 offset += len;
11760 /*
11761 * Update hdr_len from the copied header - there might be less options
11762 * in the later fragments.
11763 */
11764 hdr_len = IPH_HDR_LENGTH(hdr_mp->b_rptr);
11765 /* Loop until done. */
11766 for (;;) {
11767 uint16_t offset_and_flags;
11768 uint16_t ip_len;
11769
11770 if (ip_data_end - offset > len) {
11771 /*
11772 * Carve off the appropriate amount from the original
11773 * datagram.
11774 */
11775 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) {
11776 mp = NULL;
11777 break;
11778 }
11779 /*
11780 * More frags after this one. Get another copy
11781 * of the header.
11782 */
11783 if (carve_mp->b_datap->db_ref == 1 &&
11784 hdr_mp->b_wptr - hdr_mp->b_rptr <
11785 carve_mp->b_rptr - carve_mp->b_datap->db_base) {
11786 /* Inline IP header */
11787 carve_mp->b_rptr -= hdr_mp->b_wptr -
11788 hdr_mp->b_rptr;
11789 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr,
11790 hdr_mp->b_wptr - hdr_mp->b_rptr);
11791 mp = carve_mp;
11792 } else {
11793 if (!(mp = copyb(hdr_mp))) {
11794 freemsg(carve_mp);
11795 break;
11796 }
11797 /* Get priority marking, if any. */
11798 mp->b_band = priority;
11799 mp->b_cont = carve_mp;
11800 }
11801 ipha = (ipha_t *)mp->b_rptr;
11802 offset_and_flags = IPH_MF;
11803 } else {
11804 /*
11805 * Last frag. Consume the header. Set len to
11806 * the length of this last piece.
11807 */
11808 len = ip_data_end - offset;
11809
11810 /*
11811 * Carve off the appropriate amount from the original
11812 * datagram.
11813 */
11814 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) {
11815 mp = NULL;
11816 break;
11817 }
11818 if (carve_mp->b_datap->db_ref == 1 &&
11819 hdr_mp->b_wptr - hdr_mp->b_rptr <
11820 carve_mp->b_rptr - carve_mp->b_datap->db_base) {
11821 /* Inline IP header */
11822 carve_mp->b_rptr -= hdr_mp->b_wptr -
11823 hdr_mp->b_rptr;
11824 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr,
11825 hdr_mp->b_wptr - hdr_mp->b_rptr);
11826 mp = carve_mp;
11827 freeb(hdr_mp);
11828 hdr_mp = mp;
11829 } else {
11830 mp = hdr_mp;
11831 /* Get priority marking, if any. */
11832 mp->b_band = priority;
11833 mp->b_cont = carve_mp;
11834 }
11835 ipha = (ipha_t *)mp->b_rptr;
11836 /* A frag of a frag might have IPH_MF non-zero */
11837 offset_and_flags =
11838 ntohs(ipha->ipha_fragment_offset_and_flags) &
11839 IPH_MF;
11840 }
11841 offset_and_flags |= (uint16_t)(offset >> 3);
11842 offset_and_flags |= (uint16_t)frag_flag;
11843 /* Store the offset and flags in the IP header. */
11844 ipha->ipha_fragment_offset_and_flags = htons(offset_and_flags);
11845
11846 /* Store the length in the IP header. */
11847 ip_len = (uint16_t)(len + hdr_len);
11848 ipha->ipha_length = htons(ip_len);
11849
11850 /*
11851 * Set the IP header checksum. Note that mp is just
11852 * the header, so this is easy to pass to ip_csum.
11853 */
11854 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
11855
11856 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
11857
11858 error = postfragfn(mp, nce, ixaflags, ip_len, xmit_hint, szone,
11859 nolzid, ixa_cookie);
11860 /* All done if we just consumed the hdr_mp. */
11861 if (mp == hdr_mp) {
11862 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragOKs);
11863 return (error);
11864 }
11865 if (error != 0 && error != EWOULDBLOCK) {
11866 DTRACE_PROBE2(ip__xmit__frag__fail, ill_t *, ill,
11867 mblk_t *, hdr_mp);
11868 /* No point in sending the other fragments */
11869 break;
11870 }
11871
11872 /* Otherwise, advance and loop. */
11873 offset += len;
11874 }
11875 /* Clean up following allocation failure. */
11876 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11877 ip_drop_output("FragFails: loop ended", NULL, ill);
11878 if (mp != hdr_mp)
11879 freeb(hdr_mp);
11880 if (mp != mp_orig)
11881 freemsg(mp_orig);
11882 return (error);
11883 }
11884
11885 /*
11886 * Copy the header plus those options which have the copy bit set
11887 */
11888 static mblk_t *
11889 ip_fragment_copyhdr(uchar_t *rptr, int hdr_len, int offset, ip_stack_t *ipst,
11890 mblk_t *src)
11891 {
11892 mblk_t *mp;
11893 uchar_t *up;
11894
11895 /*
11896 * Quick check if we need to look for options without the copy bit
11897 * set
11898 */
11899 mp = allocb_tmpl(ipst->ips_ip_wroff_extra + hdr_len, src);
11900 if (!mp)
11901 return (mp);
11902 mp->b_rptr += ipst->ips_ip_wroff_extra;
11903 if (hdr_len == IP_SIMPLE_HDR_LENGTH || offset != 0) {
11904 bcopy(rptr, mp->b_rptr, hdr_len);
11905 mp->b_wptr += hdr_len + ipst->ips_ip_wroff_extra;
11906 return (mp);
11907 }
11908 up = mp->b_rptr;
11909 bcopy(rptr, up, IP_SIMPLE_HDR_LENGTH);
11910 up += IP_SIMPLE_HDR_LENGTH;
11911 rptr += IP_SIMPLE_HDR_LENGTH;
11912 hdr_len -= IP_SIMPLE_HDR_LENGTH;
11913 while (hdr_len > 0) {
11914 uint32_t optval;
11915 uint32_t optlen;
11916
11917 optval = *rptr;
11918 if (optval == IPOPT_EOL)
11919 break;
11920 if (optval == IPOPT_NOP)
11921 optlen = 1;
11922 else
11923 optlen = rptr[1];
11924 if (optval & IPOPT_COPY) {
11925 bcopy(rptr, up, optlen);
11926 up += optlen;
11927 }
11928 rptr += optlen;
11929 hdr_len -= optlen;
11930 }
11931 /*
11932 * Make sure that we drop an even number of words by filling
11933 * with EOL to the next word boundary.
11934 */
11935 for (hdr_len = up - (mp->b_rptr + IP_SIMPLE_HDR_LENGTH);
11936 hdr_len & 0x3; hdr_len++)
11937 *up++ = IPOPT_EOL;
11938 mp->b_wptr = up;
11939 /* Update header length */
11940 mp->b_rptr[0] = (uint8_t)((IP_VERSION << 4) | ((up - mp->b_rptr) >> 2));
11941 return (mp);
11942 }
11943
11944 /*
11945 * Update any source route, record route, or timestamp options when
11946 * sending a packet back to ourselves.
11947 * Check that we are at end of strict source route.
11948 * The options have been sanity checked by ip_output_options().
11949 */
11950 void
11951 ip_output_local_options(ipha_t *ipha, ip_stack_t *ipst)
11952 {
11953 ipoptp_t opts;
11954 uchar_t *opt;
11955 uint8_t optval;
11956 uint8_t optlen;
11957 ipaddr_t dst;
11958 uint32_t ts;
11959 timestruc_t now;
11960
11961 for (optval = ipoptp_first(&opts, ipha);
11962 optval != IPOPT_EOL;
11963 optval = ipoptp_next(&opts)) {
11964 opt = opts.ipoptp_cur;
11965 optlen = opts.ipoptp_len;
11966 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
11967 switch (optval) {
11968 uint32_t off;
11969 case IPOPT_SSRR:
11970 case IPOPT_LSRR:
11971 off = opt[IPOPT_OFFSET];
11972 off--;
11973 if (optlen < IP_ADDR_LEN ||
11974 off > optlen - IP_ADDR_LEN) {
11975 /* End of source route */
11976 break;
11977 }
11978 /*
11979 * This will only happen if two consecutive entries
11980 * in the source route contains our address or if
11981 * it is a packet with a loose source route which
11982 * reaches us before consuming the whole source route
11983 */
11984
11985 if (optval == IPOPT_SSRR) {
11986 return;
11987 }
11988 /*
11989 * Hack: instead of dropping the packet truncate the
11990 * source route to what has been used by filling the
11991 * rest with IPOPT_NOP.
11992 */
11993 opt[IPOPT_OLEN] = (uint8_t)off;
11994 while (off < optlen) {
11995 opt[off++] = IPOPT_NOP;
11996 }
11997 break;
11998 case IPOPT_RR:
11999 off = opt[IPOPT_OFFSET];
12000 off--;
12001 if (optlen < IP_ADDR_LEN ||
12002 off > optlen - IP_ADDR_LEN) {
12003 /* No more room - ignore */
12004 ip1dbg((
12005 "ip_output_local_options: end of RR\n"));
12006 break;
12007 }
12008 dst = htonl(INADDR_LOOPBACK);
12009 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN);
12010 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
12011 break;
12012 case IPOPT_TS:
12013 /* Insert timestamp if there is romm */
12014 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
12015 case IPOPT_TS_TSONLY:
12016 off = IPOPT_TS_TIMELEN;
12017 break;
12018 case IPOPT_TS_PRESPEC:
12019 case IPOPT_TS_PRESPEC_RFC791:
12020 /* Verify that the address matched */
12021 off = opt[IPOPT_OFFSET] - 1;
12022 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
12023 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
12024 /* Not for us */
12025 break;
12026 }
12027 /* FALLTHRU */
12028 case IPOPT_TS_TSANDADDR:
12029 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
12030 break;
12031 default:
12032 /*
12033 * ip_*put_options should have already
12034 * dropped this packet.
12035 */
12036 cmn_err(CE_PANIC, "ip_output_local_options: "
12037 "unknown IT - bug in ip_output_options?\n");
12038 return; /* Keep "lint" happy */
12039 }
12040 if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
12041 /* Increase overflow counter */
12042 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
12043 opt[IPOPT_POS_OV_FLG] = (uint8_t)
12044 (opt[IPOPT_POS_OV_FLG] & 0x0F) |
12045 (off << 4);
12046 break;
12047 }
12048 off = opt[IPOPT_OFFSET] - 1;
12049 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
12050 case IPOPT_TS_PRESPEC:
12051 case IPOPT_TS_PRESPEC_RFC791:
12052 case IPOPT_TS_TSANDADDR:
12053 dst = htonl(INADDR_LOOPBACK);
12054 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN);
12055 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
12056 /* FALLTHRU */
12057 case IPOPT_TS_TSONLY:
12058 off = opt[IPOPT_OFFSET] - 1;
12059 /* Compute # of milliseconds since midnight */
12060 gethrestime(&now);
12061 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
12062 now.tv_nsec / (NANOSEC / MILLISEC);
12063 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
12064 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
12065 break;
12066 }
12067 break;
12068 }
12069 }
12070 }
12071
12072 /*
12073 * Prepend an M_DATA fastpath header, and if none present prepend a
12074 * DL_UNITDATA_REQ. Frees the mblk on failure.
12075 *
12076 * nce_dlur_mp and nce_fp_mp can not disappear once they have been set.
12077 * If there is a change to them, the nce will be deleted (condemned) and
12078 * a new nce_t will be created when packets are sent. Thus we need no locks
12079 * to access those fields.
12080 *
12081 * We preserve b_band to support IPQoS. If a DL_UNITDATA_REQ is prepended
12082 * we place b_band in dl_priority.dl_max.
12083 */
12084 static mblk_t *
12085 ip_xmit_attach_llhdr(mblk_t *mp, nce_t *nce)
12086 {
12087 uint_t hlen;
12088 mblk_t *mp1;
12089 uint_t priority;
12090 uchar_t *rptr;
12091
12092 rptr = mp->b_rptr;
12093
12094 ASSERT(DB_TYPE(mp) == M_DATA);
12095 priority = mp->b_band;
12096
12097 ASSERT(nce != NULL);
12098 if ((mp1 = nce->nce_fp_mp) != NULL) {
12099 hlen = MBLKL(mp1);
12100 /*
12101 * Check if we have enough room to prepend fastpath
12102 * header
12103 */
12104 if (hlen != 0 && (rptr - mp->b_datap->db_base) >= hlen) {
12105 rptr -= hlen;
12106 bcopy(mp1->b_rptr, rptr, hlen);
12107 /*
12108 * Set the b_rptr to the start of the link layer
12109 * header
12110 */
12111 mp->b_rptr = rptr;
12112 return (mp);
12113 }
12114 mp1 = copyb(mp1);
12115 if (mp1 == NULL) {
12116 ill_t *ill = nce->nce_ill;
12117
12118 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12119 ip_drop_output("ipIfStatsOutDiscards", mp, ill);
12120 freemsg(mp);
12121 return (NULL);
12122 }
12123 mp1->b_band = priority;
12124 mp1->b_cont = mp;
12125 DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp);
12126 DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp);
12127 DB_CKSUMEND(mp1) = DB_CKSUMEND(mp);
12128 DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp);
12129 DB_LSOMSS(mp1) = DB_LSOMSS(mp);
12130 DTRACE_PROBE1(ip__xmit__copyb, (mblk_t *), mp1);
12131 /*
12132 * XXX disable ICK_VALID and compute checksum
12133 * here; can happen if nce_fp_mp changes and
12134 * it can't be copied now due to insufficient
12135 * space. (unlikely, fp mp can change, but it
12136 * does not increase in length)
12137 */
12138 return (mp1);
12139 }
12140 mp1 = copyb(nce->nce_dlur_mp);
12141
12142 if (mp1 == NULL) {
12143 ill_t *ill = nce->nce_ill;
12144
12145 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12146 ip_drop_output("ipIfStatsOutDiscards", mp, ill);
12147 freemsg(mp);
12148 return (NULL);
12149 }
12150 mp1->b_cont = mp;
12151 if (priority != 0) {
12152 mp1->b_band = priority;
12153 ((dl_unitdata_req_t *)(mp1->b_rptr))->dl_priority.dl_max =
12154 priority;
12155 }
12156 return (mp1);
12157 #undef rptr
12158 }
12159
12160 /*
12161 * Finish the outbound IPsec processing. This function is called from
12162 * ipsec_out_process() if the IPsec packet was processed
12163 * synchronously, or from {ah,esp}_kcf_callback_outbound() if it was processed
12164 * asynchronously.
12165 *
12166 * This is common to IPv4 and IPv6.
12167 */
12168 int
12169 ip_output_post_ipsec(mblk_t *mp, ip_xmit_attr_t *ixa)
12170 {
12171 iaflags_t ixaflags = ixa->ixa_flags;
12172 uint_t pktlen;
12173
12174
12175 /* AH/ESP don't update ixa_pktlen when they modify the packet */
12176 if (ixaflags & IXAF_IS_IPV4) {
12177 ipha_t *ipha = (ipha_t *)mp->b_rptr;
12178
12179 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
12180 pktlen = ntohs(ipha->ipha_length);
12181 } else {
12182 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
12183
12184 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
12185 pktlen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
12186 }
12187
12188 /*
12189 * We release any hard reference on the SAs here to make
12190 * sure the SAs can be garbage collected. ipsr_sa has a soft reference
12191 * on the SAs.
12192 * If in the future we want the hard latching of the SAs in the
12193 * ip_xmit_attr_t then we should remove this.
12194 */
12195 if (ixa->ixa_ipsec_esp_sa != NULL) {
12196 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
12197 ixa->ixa_ipsec_esp_sa = NULL;
12198 }
12199 if (ixa->ixa_ipsec_ah_sa != NULL) {
12200 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
12201 ixa->ixa_ipsec_ah_sa = NULL;
12202 }
12203
12204 /* Do we need to fragment? */
12205 if ((ixa->ixa_flags & IXAF_IPV6_ADD_FRAGHDR) ||
12206 pktlen > ixa->ixa_fragsize) {
12207 if (ixaflags & IXAF_IS_IPV4) {
12208 ASSERT(!(ixa->ixa_flags & IXAF_IPV6_ADD_FRAGHDR));
12209 /*
12210 * We check for the DF case in ipsec_out_process
12211 * hence this only handles the non-DF case.
12212 */
12213 return (ip_fragment_v4(mp, ixa->ixa_nce, ixa->ixa_flags,
12214 pktlen, ixa->ixa_fragsize,
12215 ixa->ixa_xmit_hint, ixa->ixa_zoneid,
12216 ixa->ixa_no_loop_zoneid, ixa->ixa_postfragfn,
12217 &ixa->ixa_cookie));
12218 } else {
12219 mp = ip_fraghdr_add_v6(mp, ixa->ixa_ident, ixa);
12220 if (mp == NULL) {
12221 /* MIB and ip_drop_output already done */
12222 return (ENOMEM);
12223 }
12224 pktlen += sizeof (ip6_frag_t);
12225 if (pktlen > ixa->ixa_fragsize) {
12226 return (ip_fragment_v6(mp, ixa->ixa_nce,
12227 ixa->ixa_flags, pktlen,
12228 ixa->ixa_fragsize, ixa->ixa_xmit_hint,
12229 ixa->ixa_zoneid, ixa->ixa_no_loop_zoneid,
12230 ixa->ixa_postfragfn, &ixa->ixa_cookie));
12231 }
12232 }
12233 }
12234 return ((ixa->ixa_postfragfn)(mp, ixa->ixa_nce, ixa->ixa_flags,
12235 pktlen, ixa->ixa_xmit_hint, ixa->ixa_zoneid,
12236 ixa->ixa_no_loop_zoneid, NULL));
12237 }
12238
12239 /*
12240 * Finish the inbound IPsec processing. This function is called from
12241 * ipsec_out_process() if the IPsec packet was processed
12242 * synchronously, or from {ah,esp}_kcf_callback_outbound() if it was processed
12243 * asynchronously.
12244 *
12245 * This is common to IPv4 and IPv6.
12246 */
12247 void
12248 ip_input_post_ipsec(mblk_t *mp, ip_recv_attr_t *ira)
12249 {
12250 iaflags_t iraflags = ira->ira_flags;
12251
12252 /* Length might have changed */
12253 if (iraflags & IRAF_IS_IPV4) {
12254 ipha_t *ipha = (ipha_t *)mp->b_rptr;
12255
12256 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
12257 ira->ira_pktlen = ntohs(ipha->ipha_length);
12258 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
12259 ira->ira_protocol = ipha->ipha_protocol;
12260
12261 ip_fanout_v4(mp, ipha, ira);
12262 } else {
12263 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
12264 uint8_t *nexthdrp;
12265
12266 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
12267 ira->ira_pktlen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
12268 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ira->ira_ip_hdr_length,
12269 &nexthdrp)) {
12270 /* Malformed packet */
12271 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
12272 ip_drop_input("ipIfStatsInDiscards", mp, ira->ira_ill);
12273 freemsg(mp);
12274 return;
12275 }
12276 ira->ira_protocol = *nexthdrp;
12277 ip_fanout_v6(mp, ip6h, ira);
12278 }
12279 }
12280
12281 /*
12282 * Select which AH & ESP SA's to use (if any) for the outbound packet.
12283 *
12284 * If this function returns B_TRUE, the requested SA's have been filled
12285 * into the ixa_ipsec_*_sa pointers.
12286 *
12287 * If the function returns B_FALSE, the packet has been "consumed", most
12288 * likely by an ACQUIRE sent up via PF_KEY to a key management daemon.
12289 *
12290 * The SA references created by the protocol-specific "select"
12291 * function will be released in ip_output_post_ipsec.
12292 */
12293 static boolean_t
12294 ipsec_out_select_sa(mblk_t *mp, ip_xmit_attr_t *ixa)
12295 {
12296 boolean_t need_ah_acquire = B_FALSE, need_esp_acquire = B_FALSE;
12297 ipsec_policy_t *pp;
12298 ipsec_action_t *ap;
12299
12300 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE);
12301 ASSERT((ixa->ixa_ipsec_policy != NULL) ||
12302 (ixa->ixa_ipsec_action != NULL));
12303
12304 ap = ixa->ixa_ipsec_action;
12305 if (ap == NULL) {
12306 pp = ixa->ixa_ipsec_policy;
12307 ASSERT(pp != NULL);
12308 ap = pp->ipsp_act;
12309 ASSERT(ap != NULL);
12310 }
12311
12312 /*
12313 * We have an action. now, let's select SA's.
12314 * A side effect of setting ixa_ipsec_*_sa is that it will
12315 * be cached in the conn_t.
12316 */
12317 if (ap->ipa_want_esp) {
12318 if (ixa->ixa_ipsec_esp_sa == NULL) {
12319 need_esp_acquire = !ipsec_outbound_sa(mp, ixa,
12320 IPPROTO_ESP);
12321 }
12322 ASSERT(need_esp_acquire || ixa->ixa_ipsec_esp_sa != NULL);
12323 }
12324
12325 if (ap->ipa_want_ah) {
12326 if (ixa->ixa_ipsec_ah_sa == NULL) {
12327 need_ah_acquire = !ipsec_outbound_sa(mp, ixa,
12328 IPPROTO_AH);
12329 }
12330 ASSERT(need_ah_acquire || ixa->ixa_ipsec_ah_sa != NULL);
12331 /*
12332 * The ESP and AH processing order needs to be preserved
12333 * when both protocols are required (ESP should be applied
12334 * before AH for an outbound packet). Force an ESP ACQUIRE
12335 * when both ESP and AH are required, and an AH ACQUIRE
12336 * is needed.
12337 */
12338 if (ap->ipa_want_esp && need_ah_acquire)
12339 need_esp_acquire = B_TRUE;
12340 }
12341
12342 /*
12343 * Send an ACQUIRE (extended, regular, or both) if we need one.
12344 * Release SAs that got referenced, but will not be used until we
12345 * acquire _all_ of the SAs we need.
12346 */
12347 if (need_ah_acquire || need_esp_acquire) {
12348 if (ixa->ixa_ipsec_ah_sa != NULL) {
12349 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
12350 ixa->ixa_ipsec_ah_sa = NULL;
12351 }
12352 if (ixa->ixa_ipsec_esp_sa != NULL) {
12353 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
12354 ixa->ixa_ipsec_esp_sa = NULL;
12355 }
12356
12357 sadb_acquire(mp, ixa, need_ah_acquire, need_esp_acquire);
12358 return (B_FALSE);
12359 }
12360
12361 return (B_TRUE);
12362 }
12363
12364 /*
12365 * Handle IPsec output processing.
12366 * This function is only entered once for a given packet.
12367 * We try to do things synchronously, but if we need to have user-level
12368 * set up SAs, or ESP or AH uses asynchronous kEF, then the operation
12369 * will be completed
12370 * - when the SAs are added in esp_add_sa_finish/ah_add_sa_finish
12371 * - when asynchronous ESP is done it will do AH
12372 *
12373 * In all cases we come back in ip_output_post_ipsec() to fragment and
12374 * send out the packet.
12375 */
12376 int
12377 ipsec_out_process(mblk_t *mp, ip_xmit_attr_t *ixa)
12378 {
12379 ill_t *ill = ixa->ixa_nce->nce_ill;
12380 ip_stack_t *ipst = ixa->ixa_ipst;
12381 ipsec_stack_t *ipss;
12382 ipsec_policy_t *pp;
12383 ipsec_action_t *ap;
12384
12385 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE);
12386
12387 ASSERT((ixa->ixa_ipsec_policy != NULL) ||
12388 (ixa->ixa_ipsec_action != NULL));
12389
12390 ipss = ipst->ips_netstack->netstack_ipsec;
12391 if (!ipsec_loaded(ipss)) {
12392 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12393 ip_drop_packet(mp, B_TRUE, ill,
12394 DROPPER(ipss, ipds_ip_ipsec_not_loaded),
12395 &ipss->ipsec_dropper);
12396 return (ENOTSUP);
12397 }
12398
12399 ap = ixa->ixa_ipsec_action;
12400 if (ap == NULL) {
12401 pp = ixa->ixa_ipsec_policy;
12402 ASSERT(pp != NULL);
12403 ap = pp->ipsp_act;
12404 ASSERT(ap != NULL);
12405 }
12406
12407 /* Handle explicit drop action and bypass. */
12408 switch (ap->ipa_act.ipa_type) {
12409 case IPSEC_ACT_DISCARD:
12410 case IPSEC_ACT_REJECT:
12411 ip_drop_packet(mp, B_FALSE, ill,
12412 DROPPER(ipss, ipds_spd_explicit), &ipss->ipsec_spd_dropper);
12413 return (EHOSTUNREACH); /* IPsec policy failure */
12414 case IPSEC_ACT_BYPASS:
12415 return (ip_output_post_ipsec(mp, ixa));
12416 }
12417
12418 /*
12419 * The order of processing is first insert a IP header if needed.
12420 * Then insert the ESP header and then the AH header.
12421 */
12422 if ((ixa->ixa_flags & IXAF_IS_IPV4) && ap->ipa_want_se) {
12423 /*
12424 * First get the outer IP header before sending
12425 * it to ESP.
12426 */
12427 ipha_t *oipha, *iipha;
12428 mblk_t *outer_mp, *inner_mp;
12429
12430 if ((outer_mp = allocb(sizeof (ipha_t), BPRI_HI)) == NULL) {
12431 (void) mi_strlog(ill->ill_rq, 0,
12432 SL_ERROR|SL_TRACE|SL_CONSOLE,
12433 "ipsec_out_process: "
12434 "Self-Encapsulation failed: Out of memory\n");
12435 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12436 ip_drop_output("ipIfStatsOutDiscards", mp, ill);
12437 freemsg(mp);
12438 return (ENOBUFS);
12439 }
12440 inner_mp = mp;
12441 ASSERT(inner_mp->b_datap->db_type == M_DATA);
12442 oipha = (ipha_t *)outer_mp->b_rptr;
12443 iipha = (ipha_t *)inner_mp->b_rptr;
12444 *oipha = *iipha;
12445 outer_mp->b_wptr += sizeof (ipha_t);
12446 oipha->ipha_length = htons(ntohs(iipha->ipha_length) +
12447 sizeof (ipha_t));
12448 oipha->ipha_protocol = IPPROTO_ENCAP;
12449 oipha->ipha_version_and_hdr_length =
12450 IP_SIMPLE_HDR_VERSION;
12451 oipha->ipha_hdr_checksum = 0;
12452 oipha->ipha_hdr_checksum = ip_csum_hdr(oipha);
12453 outer_mp->b_cont = inner_mp;
12454 mp = outer_mp;
12455
12456 ixa->ixa_flags |= IXAF_IPSEC_TUNNEL;
12457 }
12458
12459 /* If we need to wait for a SA then we can't return any errno */
12460 if (((ap->ipa_want_ah && (ixa->ixa_ipsec_ah_sa == NULL)) ||
12461 (ap->ipa_want_esp && (ixa->ixa_ipsec_esp_sa == NULL))) &&
12462 !ipsec_out_select_sa(mp, ixa))
12463 return (0);
12464
12465 /*
12466 * By now, we know what SA's to use. Toss over to ESP & AH
12467 * to do the heavy lifting.
12468 */
12469 if (ap->ipa_want_esp) {
12470 ASSERT(ixa->ixa_ipsec_esp_sa != NULL);
12471
12472 mp = ixa->ixa_ipsec_esp_sa->ipsa_output_func(mp, ixa);
12473 if (mp == NULL) {
12474 /*
12475 * Either it failed or is pending. In the former case
12476 * ipIfStatsInDiscards was increased.
12477 */
12478 return (0);
12479 }
12480 }
12481
12482 if (ap->ipa_want_ah) {
12483 ASSERT(ixa->ixa_ipsec_ah_sa != NULL);
12484
12485 mp = ixa->ixa_ipsec_ah_sa->ipsa_output_func(mp, ixa);
12486 if (mp == NULL) {
12487 /*
12488 * Either it failed or is pending. In the former case
12489 * ipIfStatsInDiscards was increased.
12490 */
12491 return (0);
12492 }
12493 }
12494 /*
12495 * We are done with IPsec processing. Send it over
12496 * the wire.
12497 */
12498 return (ip_output_post_ipsec(mp, ixa));
12499 }
12500
12501 /*
12502 * ioctls that go through a down/up sequence may need to wait for the down
12503 * to complete. This involves waiting for the ire and ipif refcnts to go down
12504 * to zero. Subsequently the ioctl is restarted from ipif_ill_refrele_tail.
12505 */
12506 /* ARGSUSED */
12507 void
12508 ip_reprocess_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
12509 {
12510 struct iocblk *iocp;
12511 mblk_t *mp1;
12512 ip_ioctl_cmd_t *ipip;
12513 int err;
12514 sin_t *sin;
12515 struct lifreq *lifr;
12516 struct ifreq *ifr;
12517
12518 iocp = (struct iocblk *)mp->b_rptr;
12519 ASSERT(ipsq != NULL);
12520 /* Existence of mp1 verified in ip_wput_nondata */
12521 mp1 = mp->b_cont->b_cont;
12522 ipip = ip_sioctl_lookup(iocp->ioc_cmd);
12523 if (ipip->ipi_cmd == SIOCSLIFNAME || ipip->ipi_cmd == IF_UNITSEL) {
12524 /*
12525 * Special case where ipx_current_ipif is not set:
12526 * ill_phyint_reinit merged the v4 and v6 into a single ipsq.
12527 * We are here as were not able to complete the operation in
12528 * ipif_set_values because we could not become exclusive on
12529 * the new ipsq.
12530 */
12531 ill_t *ill = q->q_ptr;
12532 ipsq_current_start(ipsq, ill->ill_ipif, ipip->ipi_cmd);
12533 }
12534 ASSERT(ipsq->ipsq_xop->ipx_current_ipif != NULL);
12535
12536 if (ipip->ipi_cmd_type == IF_CMD) {
12537 /* This a old style SIOC[GS]IF* command */
12538 ifr = (struct ifreq *)mp1->b_rptr;
12539 sin = (sin_t *)&ifr->ifr_addr;
12540 } else if (ipip->ipi_cmd_type == LIF_CMD) {
12541 /* This a new style SIOC[GS]LIF* command */
12542 lifr = (struct lifreq *)mp1->b_rptr;
12543 sin = (sin_t *)&lifr->lifr_addr;
12544 } else {
12545 sin = NULL;
12546 }
12547
12548 err = (*ipip->ipi_func_restart)(ipsq->ipsq_xop->ipx_current_ipif, sin,
12549 q, mp, ipip, mp1->b_rptr);
12550
12551 DTRACE_PROBE4(ipif__ioctl, char *, "ip_reprocess_ioctl finish",
12552 int, ipip->ipi_cmd,
12553 ill_t *, ipsq->ipsq_xop->ipx_current_ipif->ipif_ill,
12554 ipif_t *, ipsq->ipsq_xop->ipx_current_ipif);
12555
12556 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq);
12557 }
12558
12559 /*
12560 * ioctl processing
12561 *
12562 * ioctl processing starts with ip_sioctl_copyin_setup(), which looks up
12563 * the ioctl command in the ioctl tables, determines the copyin data size
12564 * from the ipi_copyin_size field, and does an mi_copyin() of that size.
12565 *
12566 * ioctl processing then continues when the M_IOCDATA makes its way down to
12567 * ip_wput_nondata(). The ioctl is looked up again in the ioctl table, its
12568 * associated 'conn' is refheld till the end of the ioctl and the general
12569 * ioctl processing function ip_process_ioctl() is called to extract the
12570 * arguments and process the ioctl. To simplify extraction, ioctl commands
12571 * are "typed" based on the arguments they take (e.g., LIF_CMD which takes a
12572 * `struct lifreq'), and a common extract function (e.g., ip_extract_lifreq())
12573 * is used to extract the ioctl's arguments.
12574 *
12575 * ip_process_ioctl determines if the ioctl needs to be serialized, and if
12576 * so goes thru the serialization primitive ipsq_try_enter. Then the
12577 * appropriate function to handle the ioctl is called based on the entry in
12578 * the ioctl table. ioctl completion is encapsulated in ip_ioctl_finish
12579 * which also refreleases the 'conn' that was refheld at the start of the
12580 * ioctl. Finally ipsq_exit is called if needed to exit the ipsq.
12581 *
12582 * Many exclusive ioctls go thru an internal down up sequence as part of
12583 * the operation. For example an attempt to change the IP address of an
12584 * ipif entails ipif_down, set address, ipif_up. Bringing down the interface
12585 * does all the cleanup such as deleting all ires that use this address.
12586 * Then we need to wait till all references to the interface go away.
12587 */
12588 void
12589 ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12590 {
12591 struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
12592 ip_ioctl_cmd_t *ipip = arg;
12593 ip_extract_func_t *extract_funcp;
12594 cmd_info_t ci;
12595 int err;
12596 boolean_t entered_ipsq = B_FALSE;
12597
12598 ip3dbg(("ip_process_ioctl: ioctl %X\n", iocp->ioc_cmd));
12599
12600 if (ipip == NULL)
12601 ipip = ip_sioctl_lookup(iocp->ioc_cmd);
12602
12603 /*
12604 * SIOCLIFADDIF needs to go thru a special path since the
12605 * ill may not exist yet. This happens in the case of lo0
12606 * which is created using this ioctl.
12607 */
12608 if (ipip->ipi_cmd == SIOCLIFADDIF) {
12609 err = ip_sioctl_addif(NULL, NULL, q, mp, NULL, NULL);
12610 DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish",
12611 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL);
12612 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);
12613 return;
12614 }
12615
12616 ci.ci_ipif = NULL;
12617 switch (ipip->ipi_cmd_type) {
12618 case MISC_CMD:
12619 case MSFILT_CMD:
12620 /*
12621 * All MISC_CMD ioctls come in here -- e.g. SIOCGLIFCONF.
12622 */
12623 if (ipip->ipi_cmd == IF_UNITSEL) {
12624 /* ioctl comes down the ill */
12625 ci.ci_ipif = ((ill_t *)q->q_ptr)->ill_ipif;
12626 ipif_refhold(ci.ci_ipif);
12627 }
12628 err = 0;
12629 ci.ci_sin = NULL;
12630 ci.ci_sin6 = NULL;
12631 ci.ci_lifr = NULL;
12632 extract_funcp = NULL;
12633 break;
12634
12635 case IF_CMD:
12636 case LIF_CMD:
12637 extract_funcp = ip_extract_lifreq;
12638 break;
12639
12640 case ARP_CMD:
12641 case XARP_CMD:
12642 extract_funcp = ip_extract_arpreq;
12643 break;
12644
12645 default:
12646 ASSERT(0);
12647 }
12648
12649 if (extract_funcp != NULL) {
12650 err = (*extract_funcp)(q, mp, ipip, &ci);
12651 if (err != 0) {
12652 DTRACE_PROBE4(ipif__ioctl,
12653 char *, "ip_process_ioctl finish err",
12654 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL);
12655 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);
12656 return;
12657 }
12658
12659 /*
12660 * All of the extraction functions return a refheld ipif.
12661 */
12662 ASSERT(ci.ci_ipif != NULL);
12663 }
12664
12665 if (!(ipip->ipi_flags & IPI_WR)) {
12666 /*
12667 * A return value of EINPROGRESS means the ioctl is
12668 * either queued and waiting for some reason or has
12669 * already completed.
12670 */
12671 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip,
12672 ci.ci_lifr);
12673 if (ci.ci_ipif != NULL) {
12674 DTRACE_PROBE4(ipif__ioctl,
12675 char *, "ip_process_ioctl finish RD",
12676 int, ipip->ipi_cmd, ill_t *, ci.ci_ipif->ipif_ill,
12677 ipif_t *, ci.ci_ipif);
12678 ipif_refrele(ci.ci_ipif);
12679 } else {
12680 DTRACE_PROBE4(ipif__ioctl,
12681 char *, "ip_process_ioctl finish RD",
12682 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL);
12683 }
12684 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);
12685 return;
12686 }
12687
12688 ASSERT(ci.ci_ipif != NULL);
12689
12690 /*
12691 * If ipsq is non-NULL, we are already being called exclusively
12692 */
12693 ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq));
12694 if (ipsq == NULL) {
12695 ipsq = ipsq_try_enter(ci.ci_ipif, NULL, q, mp, ip_process_ioctl,
12696 NEW_OP, B_TRUE);
12697 if (ipsq == NULL) {
12698 ipif_refrele(ci.ci_ipif);
12699 return;
12700 }
12701 entered_ipsq = B_TRUE;
12702 }
12703 /*
12704 * Release the ipif so that ipif_down and friends that wait for
12705 * references to go away are not misled about the current ipif_refcnt
12706 * values. We are writer so we can access the ipif even after releasing
12707 * the ipif.
12708 */
12709 ipif_refrele(ci.ci_ipif);
12710
12711 ipsq_current_start(ipsq, ci.ci_ipif, ipip->ipi_cmd);
12712
12713 /*
12714 * A return value of EINPROGRESS means the ioctl is
12715 * either queued and waiting for some reason or has
12716 * already completed.
12717 */
12718 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, ci.ci_lifr);
12719
12720 DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish WR",
12721 int, ipip->ipi_cmd,
12722 ill_t *, ci.ci_ipif == NULL ? NULL : ci.ci_ipif->ipif_ill,
12723 ipif_t *, ci.ci_ipif);
12724 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq);
12725
12726 if (entered_ipsq)
12727 ipsq_exit(ipsq);
12728 }
12729
12730 /*
12731 * Complete the ioctl. Typically ioctls use the mi package and need to
12732 * do mi_copyout/mi_copy_done.
12733 */
12734 void
12735 ip_ioctl_finish(queue_t *q, mblk_t *mp, int err, int mode, ipsq_t *ipsq)
12736 {
12737 conn_t *connp = NULL;
12738
12739 if (err == EINPROGRESS)
12740 return;
12741
12742 if (CONN_Q(q)) {
12743 connp = Q_TO_CONN(q);
12744 ASSERT(connp->conn_ref >= 2);
12745 }
12746
12747 switch (mode) {
12748 case COPYOUT:
12749 if (err == 0)
12750 mi_copyout(q, mp);
12751 else
12752 mi_copy_done(q, mp, err);
12753 break;
12754
12755 case NO_COPYOUT:
12756 mi_copy_done(q, mp, err);
12757 break;
12758
12759 default:
12760 ASSERT(mode == CONN_CLOSE); /* aborted through CONN_CLOSE */
12761 break;
12762 }
12763
12764 /*
12765 * The conn refhold and ioctlref placed on the conn at the start of the
12766 * ioctl are released here.
12767 */
12768 if (connp != NULL) {
12769 CONN_DEC_IOCTLREF(connp);
12770 CONN_OPER_PENDING_DONE(connp);
12771 }
12772
12773 if (ipsq != NULL)
12774 ipsq_current_finish(ipsq);
12775 }
12776
12777 /* Handles all non data messages */
12778 void
12779 ip_wput_nondata(queue_t *q, mblk_t *mp)
12780 {
12781 mblk_t *mp1;
12782 struct iocblk *iocp;
12783 ip_ioctl_cmd_t *ipip;
12784 conn_t *connp;
12785 cred_t *cr;
12786 char *proto_str;
12787
12788 if (CONN_Q(q))
12789 connp = Q_TO_CONN(q);
12790 else
12791 connp = NULL;
12792
12793 switch (DB_TYPE(mp)) {
12794 case M_IOCTL:
12795 /*
12796 * IOCTL processing begins in ip_sioctl_copyin_setup which
12797 * will arrange to copy in associated control structures.
12798 */
12799 ip_sioctl_copyin_setup(q, mp);
12800 return;
12801 case M_IOCDATA:
12802 /*
12803 * Ensure that this is associated with one of our trans-
12804 * parent ioctls. If it's not ours, discard it if we're
12805 * running as a driver, or pass it on if we're a module.
12806 */
12807 iocp = (struct iocblk *)mp->b_rptr;
12808 ipip = ip_sioctl_lookup(iocp->ioc_cmd);
12809 if (ipip == NULL) {
12810 if (q->q_next == NULL) {
12811 goto nak;
12812 } else {
12813 putnext(q, mp);
12814 }
12815 return;
12816 }
12817 if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
12818 /*
12819 * The ioctl is one we recognise, but is not consumed
12820 * by IP as a module and we are a module, so we drop
12821 */
12822 goto nak;
12823 }
12824
12825 /* IOCTL continuation following copyin or copyout. */
12826 if (mi_copy_state(q, mp, NULL) == -1) {
12827 /*
12828 * The copy operation failed. mi_copy_state already
12829 * cleaned up, so we're out of here.
12830 */
12831 return;
12832 }
12833 /*
12834 * If we just completed a copy in, we become writer and
12835 * continue processing in ip_sioctl_copyin_done. If it
12836 * was a copy out, we call mi_copyout again. If there is
12837 * nothing more to copy out, it will complete the IOCTL.
12838 */
12839 if (MI_COPY_DIRECTION(mp) == MI_COPY_IN) {
12840 if (!(mp1 = mp->b_cont) || !(mp1 = mp1->b_cont)) {
12841 mi_copy_done(q, mp, EPROTO);
12842 return;
12843 }
12844 /*
12845 * Check for cases that need more copying. A return
12846 * value of 0 means a second copyin has been started,
12847 * so we return; a return value of 1 means no more
12848 * copying is needed, so we continue.
12849 */
12850 if (ipip->ipi_cmd_type == MSFILT_CMD &&
12851 MI_COPY_COUNT(mp) == 1) {
12852 if (ip_copyin_msfilter(q, mp) == 0)
12853 return;
12854 }
12855 /*
12856 * Refhold the conn, till the ioctl completes. This is
12857 * needed in case the ioctl ends up in the pending mp
12858 * list. Every mp in the ipx_pending_mp list must have
12859 * a refhold on the conn to resume processing. The
12860 * refhold is released when the ioctl completes
12861 * (whether normally or abnormally). An ioctlref is also
12862 * placed on the conn to prevent TCP from removing the
12863 * queue needed to send the ioctl reply back.
12864 * In all cases ip_ioctl_finish is called to finish
12865 * the ioctl and release the refholds.
12866 */
12867 if (connp != NULL) {
12868 /* This is not a reentry */
12869 CONN_INC_REF(connp);
12870 CONN_INC_IOCTLREF(connp);
12871 } else {
12872 if (!(ipip->ipi_flags & IPI_MODOK)) {
12873 mi_copy_done(q, mp, EINVAL);
12874 return;
12875 }
12876 }
12877
12878 ip_process_ioctl(NULL, q, mp, ipip);
12879
12880 } else {
12881 mi_copyout(q, mp);
12882 }
12883 return;
12884
12885 case M_IOCNAK:
12886 /*
12887 * The only way we could get here is if a resolver didn't like
12888 * an IOCTL we sent it. This shouldn't happen.
12889 */
12890 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
12891 "ip_wput_nondata: unexpected M_IOCNAK, ioc_cmd 0x%x",
12892 ((struct iocblk *)mp->b_rptr)->ioc_cmd);
12893 freemsg(mp);
12894 return;
12895 case M_IOCACK:
12896 /* /dev/ip shouldn't see this */
12897 goto nak;
12898 case M_FLUSH:
12899 if (*mp->b_rptr & FLUSHW)
12900 flushq(q, FLUSHALL);
12901 if (q->q_next) {
12902 putnext(q, mp);
12903 return;
12904 }
12905 if (*mp->b_rptr & FLUSHR) {
12906 *mp->b_rptr &= ~FLUSHW;
12907 qreply(q, mp);
12908 return;
12909 }
12910 freemsg(mp);
12911 return;
12912 case M_CTL:
12913 break;
12914 case M_PROTO:
12915 case M_PCPROTO:
12916 /*
12917 * The only PROTO messages we expect are SNMP-related.
12918 */
12919 switch (((union T_primitives *)mp->b_rptr)->type) {
12920 case T_SVR4_OPTMGMT_REQ:
12921 ip2dbg(("ip_wput_nondata: T_SVR4_OPTMGMT_REQ "
12922 "flags %x\n",
12923 ((struct T_optmgmt_req *)mp->b_rptr)->MGMT_flags));
12924
12925 if (connp == NULL) {
12926 proto_str = "T_SVR4_OPTMGMT_REQ";
12927 goto protonak;
12928 }
12929
12930 /*
12931 * All Solaris components should pass a db_credp
12932 * for this TPI message, hence we ASSERT.
12933 * But in case there is some other M_PROTO that looks
12934 * like a TPI message sent by some other kernel
12935 * component, we check and return an error.
12936 */
12937 cr = msg_getcred(mp, NULL);
12938 ASSERT(cr != NULL);
12939 if (cr == NULL) {
12940 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, EINVAL);
12941 if (mp != NULL)
12942 qreply(q, mp);
12943 return;
12944 }
12945
12946 if (!snmpcom_req(q, mp, ip_snmp_set, ip_snmp_get, cr)) {
12947 proto_str = "Bad SNMPCOM request?";
12948 goto protonak;
12949 }
12950 return;
12951 default:
12952 ip1dbg(("ip_wput_nondata: dropping M_PROTO prim %u\n",
12953 (int)*(uint_t *)mp->b_rptr));
12954 freemsg(mp);
12955 return;
12956 }
12957 default:
12958 break;
12959 }
12960 if (q->q_next) {
12961 putnext(q, mp);
12962 } else
12963 freemsg(mp);
12964 return;
12965
12966 nak:
12967 iocp->ioc_error = EINVAL;
12968 mp->b_datap->db_type = M_IOCNAK;
12969 iocp->ioc_count = 0;
12970 qreply(q, mp);
12971 return;
12972
12973 protonak:
12974 cmn_err(CE_NOTE, "IP doesn't process %s as a module", proto_str);
12975 if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, EINVAL)) != NULL)
12976 qreply(q, mp);
12977 }
12978
12979 /*
12980 * Process IP options in an outbound packet. Verify that the nexthop in a
12981 * strict source route is onlink.
12982 * Returns non-zero if something fails in which case an ICMP error has been
12983 * sent and mp freed.
12984 *
12985 * Assumes the ULP has called ip_massage_options to move nexthop into ipha_dst.
12986 */
12987 int
12988 ip_output_options(mblk_t *mp, ipha_t *ipha, ip_xmit_attr_t *ixa, ill_t *ill)
12989 {
12990 ipoptp_t opts;
12991 uchar_t *opt;
12992 uint8_t optval;
12993 uint8_t optlen;
12994 ipaddr_t dst;
12995 intptr_t code = 0;
12996 ire_t *ire;
12997 ip_stack_t *ipst = ixa->ixa_ipst;
12998 ip_recv_attr_t iras;
12999
13000 ip2dbg(("ip_output_options\n"));
13001
13002 dst = ipha->ipha_dst;
13003 for (optval = ipoptp_first(&opts, ipha);
13004 optval != IPOPT_EOL;
13005 optval = ipoptp_next(&opts)) {
13006 opt = opts.ipoptp_cur;
13007 optlen = opts.ipoptp_len;
13008 ip2dbg(("ip_output_options: opt %d, len %d\n",
13009 optval, optlen));
13010 switch (optval) {
13011 uint32_t off;
13012 case IPOPT_SSRR:
13013 case IPOPT_LSRR:
13014 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
13015 ip1dbg((
13016 "ip_output_options: bad option offset\n"));
13017 code = (char *)&opt[IPOPT_OLEN] -
13018 (char *)ipha;
13019 goto param_prob;
13020 }
13021 off = opt[IPOPT_OFFSET];
13022 ip1dbg(("ip_output_options: next hop 0x%x\n",
13023 ntohl(dst)));
13024 /*
13025 * For strict: verify that dst is directly
13026 * reachable.
13027 */
13028 if (optval == IPOPT_SSRR) {
13029 ire = ire_ftable_lookup_v4(dst, 0, 0,
13030 IRE_INTERFACE, NULL, ALL_ZONES,
13031 ixa->ixa_tsl,
13032 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst,
13033 NULL);
13034 if (ire == NULL) {
13035 ip1dbg(("ip_output_options: SSRR not"
13036 " directly reachable: 0x%x\n",
13037 ntohl(dst)));
13038 goto bad_src_route;
13039 }
13040 ire_refrele(ire);
13041 }
13042 break;
13043 case IPOPT_RR:
13044 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
13045 ip1dbg((
13046 "ip_output_options: bad option offset\n"));
13047 code = (char *)&opt[IPOPT_OLEN] -
13048 (char *)ipha;
13049 goto param_prob;
13050 }
13051 break;
13052 case IPOPT_TS:
13053 /*
13054 * Verify that length >=5 and that there is either
13055 * room for another timestamp or that the overflow
13056 * counter is not maxed out.
13057 */
13058 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha;
13059 if (optlen < IPOPT_MINLEN_IT) {
13060 goto param_prob;
13061 }
13062 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
13063 ip1dbg((
13064 "ip_output_options: bad option offset\n"));
13065 code = (char *)&opt[IPOPT_OFFSET] -
13066 (char *)ipha;
13067 goto param_prob;
13068 }
13069 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
13070 case IPOPT_TS_TSONLY:
13071 off = IPOPT_TS_TIMELEN;
13072 break;
13073 case IPOPT_TS_TSANDADDR:
13074 case IPOPT_TS_PRESPEC:
13075 case IPOPT_TS_PRESPEC_RFC791:
13076 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
13077 break;
13078 default:
13079 code = (char *)&opt[IPOPT_POS_OV_FLG] -
13080 (char *)ipha;
13081 goto param_prob;
13082 }
13083 if (opt[IPOPT_OFFSET] - 1 + off > optlen &&
13084 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) {
13085 /*
13086 * No room and the overflow counter is 15
13087 * already.
13088 */
13089 goto param_prob;
13090 }
13091 break;
13092 }
13093 }
13094
13095 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0)
13096 return (0);
13097
13098 ip1dbg(("ip_output_options: error processing IP options."));
13099 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha;
13100
13101 param_prob:
13102 bzero(&iras, sizeof (iras));
13103 iras.ira_ill = iras.ira_rill = ill;
13104 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
13105 iras.ira_rifindex = iras.ira_ruifindex;
13106 iras.ira_flags = IRAF_IS_IPV4;
13107
13108 ip_drop_output("ip_output_options", mp, ill);
13109 icmp_param_problem(mp, (uint8_t)code, &iras);
13110 ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
13111 return (-1);
13112
13113 bad_src_route:
13114 bzero(&iras, sizeof (iras));
13115 iras.ira_ill = iras.ira_rill = ill;
13116 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
13117 iras.ira_rifindex = iras.ira_ruifindex;
13118 iras.ira_flags = IRAF_IS_IPV4;
13119
13120 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
13121 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, &iras);
13122 ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
13123 return (-1);
13124 }
13125
13126 /*
13127 * The maximum value of conn_drain_list_cnt is CONN_MAXDRAINCNT.
13128 * conn_drain_list_cnt can be changed by setting conn_drain_nthreads
13129 * thru /etc/system.
13130 */
13131 #define CONN_MAXDRAINCNT 64
13132
13133 static void
13134 conn_drain_init(ip_stack_t *ipst)
13135 {
13136 int i, j;
13137 idl_tx_list_t *itl_tx;
13138
13139 ipst->ips_conn_drain_list_cnt = conn_drain_nthreads;
13140
13141 if ((ipst->ips_conn_drain_list_cnt == 0) ||
13142 (ipst->ips_conn_drain_list_cnt > CONN_MAXDRAINCNT)) {
13143 /*
13144 * Default value of the number of drainers is the
13145 * number of cpus, subject to maximum of 8 drainers.
13146 */
13147 if (boot_max_ncpus != -1)
13148 ipst->ips_conn_drain_list_cnt = MIN(boot_max_ncpus, 8);
13149 else
13150 ipst->ips_conn_drain_list_cnt = MIN(max_ncpus, 8);
13151 }
13152
13153 ipst->ips_idl_tx_list =
13154 kmem_zalloc(TX_FANOUT_SIZE * sizeof (idl_tx_list_t), KM_SLEEP);
13155 for (i = 0; i < TX_FANOUT_SIZE; i++) {
13156 itl_tx = &ipst->ips_idl_tx_list[i];
13157 itl_tx->txl_drain_list =
13158 kmem_zalloc(ipst->ips_conn_drain_list_cnt *
13159 sizeof (idl_t), KM_SLEEP);
13160 mutex_init(&itl_tx->txl_lock, NULL, MUTEX_DEFAULT, NULL);
13161 for (j = 0; j < ipst->ips_conn_drain_list_cnt; j++) {
13162 mutex_init(&itl_tx->txl_drain_list[j].idl_lock, NULL,
13163 MUTEX_DEFAULT, NULL);
13164 itl_tx->txl_drain_list[j].idl_itl = itl_tx;
13165 }
13166 }
13167 }
13168
13169 static void
13170 conn_drain_fini(ip_stack_t *ipst)
13171 {
13172 int i;
13173 idl_tx_list_t *itl_tx;
13174
13175 for (i = 0; i < TX_FANOUT_SIZE; i++) {
13176 itl_tx = &ipst->ips_idl_tx_list[i];
13177 kmem_free(itl_tx->txl_drain_list,
13178 ipst->ips_conn_drain_list_cnt * sizeof (idl_t));
13179 }
13180 kmem_free(ipst->ips_idl_tx_list,
13181 TX_FANOUT_SIZE * sizeof (idl_tx_list_t));
13182 ipst->ips_idl_tx_list = NULL;
13183 }
13184
13185 /*
13186 * Flow control has blocked us from proceeding. Insert the given conn in one
13187 * of the conn drain lists. When flow control is unblocked, either ip_wsrv()
13188 * (STREAMS) or ill_flow_enable() (direct) will be called back, which in turn
13189 * will call conn_walk_drain(). See the flow control notes at the top of this
13190 * file for more details.
13191 */
13192 void
13193 conn_drain_insert(conn_t *connp, idl_tx_list_t *tx_list)
13194 {
13195 idl_t *idl = tx_list->txl_drain_list;
13196 uint_t index;
13197 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
13198
13199 mutex_enter(&connp->conn_lock);
13200 if (connp->conn_state_flags & CONN_CLOSING) {
13201 /*
13202 * The conn is closing as a result of which CONN_CLOSING
13203 * is set. Return.
13204 */
13205 mutex_exit(&connp->conn_lock);
13206 return;
13207 } else if (connp->conn_idl == NULL) {
13208 /*
13209 * Assign the next drain list round robin. We dont' use
13210 * a lock, and thus it may not be strictly round robin.
13211 * Atomicity of load/stores is enough to make sure that
13212 * conn_drain_list_index is always within bounds.
13213 */
13214 index = tx_list->txl_drain_index;
13215 ASSERT(index < ipst->ips_conn_drain_list_cnt);
13216 connp->conn_idl = &tx_list->txl_drain_list[index];
13217 index++;
13218 if (index == ipst->ips_conn_drain_list_cnt)
13219 index = 0;
13220 tx_list->txl_drain_index = index;
13221 } else {
13222 ASSERT(connp->conn_idl->idl_itl == tx_list);
13223 }
13224 mutex_exit(&connp->conn_lock);
13225
13226 idl = connp->conn_idl;
13227 mutex_enter(&idl->idl_lock);
13228 if ((connp->conn_drain_prev != NULL) ||
13229 (connp->conn_state_flags & CONN_CLOSING)) {
13230 /*
13231 * The conn is either already in the drain list or closing.
13232 * (We needed to check for CONN_CLOSING again since close can
13233 * sneak in between dropping conn_lock and acquiring idl_lock.)
13234 */
13235 mutex_exit(&idl->idl_lock);
13236 return;
13237 }
13238
13239 /*
13240 * The conn is not in the drain list. Insert it at the
13241 * tail of the drain list. The drain list is circular
13242 * and doubly linked. idl_conn points to the 1st element
13243 * in the list.
13244 */
13245 if (idl->idl_conn == NULL) {
13246 idl->idl_conn = connp;
13247 connp->conn_drain_next = connp;
13248 connp->conn_drain_prev = connp;
13249 } else {
13250 conn_t *head = idl->idl_conn;
13251
13252 connp->conn_drain_next = head;
13253 connp->conn_drain_prev = head->conn_drain_prev;
13254 head->conn_drain_prev->conn_drain_next = connp;
13255 head->conn_drain_prev = connp;
13256 }
13257 /*
13258 * For non streams based sockets assert flow control.
13259 */
13260 conn_setqfull(connp, NULL);
13261 mutex_exit(&idl->idl_lock);
13262 }
13263
13264 static void
13265 conn_drain_remove(conn_t *connp)
13266 {
13267 idl_t *idl = connp->conn_idl;
13268
13269 if (idl != NULL) {
13270 /*
13271 * Remove ourself from the drain list.
13272 */
13273 if (connp->conn_drain_next == connp) {
13274 /* Singleton in the list */
13275 ASSERT(connp->conn_drain_prev == connp);
13276 idl->idl_conn = NULL;
13277 } else {
13278 connp->conn_drain_prev->conn_drain_next =
13279 connp->conn_drain_next;
13280 connp->conn_drain_next->conn_drain_prev =
13281 connp->conn_drain_prev;
13282 if (idl->idl_conn == connp)
13283 idl->idl_conn = connp->conn_drain_next;
13284 }
13285
13286 /*
13287 * NOTE: because conn_idl is associated with a specific drain
13288 * list which in turn is tied to the index the TX ring
13289 * (txl_cookie) hashes to, and because the TX ring can change
13290 * over the lifetime of the conn_t, we must clear conn_idl so
13291 * a subsequent conn_drain_insert() will set conn_idl again
13292 * based on the latest txl_cookie.
13293 */
13294 connp->conn_idl = NULL;
13295 }
13296 connp->conn_drain_next = NULL;
13297 connp->conn_drain_prev = NULL;
13298
13299 conn_clrqfull(connp, NULL);
13300 /*
13301 * For streams based sockets open up flow control.
13302 */
13303 if (!IPCL_IS_NONSTR(connp))
13304 enableok(connp->conn_wq);
13305 }
13306
13307 /*
13308 * This conn is closing, and we are called from ip_close. OR
13309 * this conn is draining because flow-control on the ill has been relieved.
13310 *
13311 * We must also need to remove conn's on this idl from the list, and also
13312 * inform the sockfs upcalls about the change in flow-control.
13313 */
13314 static void
13315 conn_drain(conn_t *connp, boolean_t closing)
13316 {
13317 idl_t *idl;
13318 conn_t *next_connp;
13319
13320 /*
13321 * connp->conn_idl is stable at this point, and no lock is needed
13322 * to check it. If we are called from ip_close, close has already
13323 * set CONN_CLOSING, thus freezing the value of conn_idl, and
13324 * called us only because conn_idl is non-null. If we are called thru
13325 * service, conn_idl could be null, but it cannot change because
13326 * service is single-threaded per queue, and there cannot be another
13327 * instance of service trying to call conn_drain_insert on this conn
13328 * now.
13329 */
13330 ASSERT(!closing || connp == NULL || connp->conn_idl != NULL);
13331
13332 /*
13333 * If the conn doesn't exist or is not on a drain list, bail.
13334 */
13335 if (connp == NULL || connp->conn_idl == NULL ||
13336 connp->conn_drain_prev == NULL) {
13337 return;
13338 }
13339
13340 idl = connp->conn_idl;
13341 ASSERT(MUTEX_HELD(&idl->idl_lock));
13342
13343 if (!closing) {
13344 next_connp = connp->conn_drain_next;
13345 while (next_connp != connp) {
13346 conn_t *delconnp = next_connp;
13347
13348 next_connp = next_connp->conn_drain_next;
13349 conn_drain_remove(delconnp);
13350 }
13351 ASSERT(connp->conn_drain_next == idl->idl_conn);
13352 }
13353 conn_drain_remove(connp);
13354 }
13355
13356 /*
13357 * Write service routine. Shared perimeter entry point.
13358 * The device queue's messages has fallen below the low water mark and STREAMS
13359 * has backenabled the ill_wq. Send sockfs notification about flow-control on
13360 * each waiting conn.
13361 */
13362 void
13363 ip_wsrv(queue_t *q)
13364 {
13365 ill_t *ill;
13366
13367 ill = (ill_t *)q->q_ptr;
13368 if (ill->ill_state_flags == 0) {
13369 ip_stack_t *ipst = ill->ill_ipst;
13370
13371 /*
13372 * The device flow control has opened up.
13373 * Walk through conn drain lists and qenable the
13374 * first conn in each list. This makes sense only
13375 * if the stream is fully plumbed and setup.
13376 * Hence the ill_state_flags check above.
13377 */
13378 ip1dbg(("ip_wsrv: walking\n"));
13379 conn_walk_drain(ipst, &ipst->ips_idl_tx_list[0]);
13380 enableok(ill->ill_wq);
13381 }
13382 }
13383
13384 /*
13385 * Callback to disable flow control in IP.
13386 *
13387 * This is a mac client callback added when the DLD_CAPAB_DIRECT capability
13388 * is enabled.
13389 *
13390 * When MAC_TX() is not able to send any more packets, dld sets its queue
13391 * to QFULL and enable the STREAMS flow control. Later, when the underlying
13392 * driver is able to continue to send packets, it calls mac_tx_(ring_)update()
13393 * function and wakes up corresponding mac worker threads, which in turn
13394 * calls this callback function, and disables flow control.
13395 */
13396 void
13397 ill_flow_enable(void *arg, ip_mac_tx_cookie_t cookie)
13398 {
13399 ill_t *ill = (ill_t *)arg;
13400 ip_stack_t *ipst = ill->ill_ipst;
13401 idl_tx_list_t *idl_txl;
13402
13403 idl_txl = &ipst->ips_idl_tx_list[IDLHASHINDEX(cookie)];
13404 mutex_enter(&idl_txl->txl_lock);
13405 /* add code to to set a flag to indicate idl_txl is enabled */
13406 conn_walk_drain(ipst, idl_txl);
13407 mutex_exit(&idl_txl->txl_lock);
13408 }
13409
13410 /*
13411 * Flow control has been relieved and STREAMS has backenabled us; drain
13412 * all the conn lists on `tx_list'.
13413 */
13414 static void
13415 conn_walk_drain(ip_stack_t *ipst, idl_tx_list_t *tx_list)
13416 {
13417 int i;
13418 idl_t *idl;
13419
13420 IP_STAT(ipst, ip_conn_walk_drain);
13421
13422 for (i = 0; i < ipst->ips_conn_drain_list_cnt; i++) {
13423 idl = &tx_list->txl_drain_list[i];
13424 mutex_enter(&idl->idl_lock);
13425 conn_drain(idl->idl_conn, B_FALSE);
13426 mutex_exit(&idl->idl_lock);
13427 }
13428 }
13429
13430 /*
13431 * Determine if the ill and multicast aspects of that packets
13432 * "matches" the conn.
13433 */
13434 boolean_t
13435 conn_wantpacket(conn_t *connp, ip_recv_attr_t *ira, ipha_t *ipha)
13436 {
13437 ill_t *ill = ira->ira_rill;
13438 zoneid_t zoneid = ira->ira_zoneid;
13439 uint_t in_ifindex;
13440 ipaddr_t dst, src;
13441
13442 dst = ipha->ipha_dst;
13443 src = ipha->ipha_src;
13444
13445 /*
13446 * conn_incoming_ifindex is set by IP_BOUND_IF which limits
13447 * unicast, broadcast and multicast reception to
13448 * conn_incoming_ifindex.
13449 * conn_wantpacket is called for unicast, broadcast and
13450 * multicast packets.
13451 */
13452 in_ifindex = connp->conn_incoming_ifindex;
13453
13454 /* mpathd can bind to the under IPMP interface, which we allow */
13455 if (in_ifindex != 0 && in_ifindex != ill->ill_phyint->phyint_ifindex) {
13456 if (!IS_UNDER_IPMP(ill))
13457 return (B_FALSE);
13458
13459 if (in_ifindex != ipmp_ill_get_ipmp_ifindex(ill))
13460 return (B_FALSE);
13461 }
13462
13463 if (!IPCL_ZONE_MATCH(connp, zoneid))
13464 return (B_FALSE);
13465
13466 if (!(ira->ira_flags & IRAF_MULTICAST))
13467 return (B_TRUE);
13468
13469 if (connp->conn_multi_router) {
13470 /* multicast packet and multicast router socket: send up */
13471 return (B_TRUE);
13472 }
13473
13474 if (ipha->ipha_protocol == IPPROTO_PIM ||
13475 ipha->ipha_protocol == IPPROTO_RSVP)
13476 return (B_TRUE);
13477
13478 return (conn_hasmembers_ill_withsrc_v4(connp, dst, src, ira->ira_ill));
13479 }
13480
13481 void
13482 conn_setqfull(conn_t *connp, boolean_t *flow_stopped)
13483 {
13484 if (IPCL_IS_NONSTR(connp)) {
13485 (*connp->conn_upcalls->su_txq_full)
13486 (connp->conn_upper_handle, B_TRUE);
13487 if (flow_stopped != NULL)
13488 *flow_stopped = B_TRUE;
13489 } else {
13490 queue_t *q = connp->conn_wq;
13491
13492 ASSERT(q != NULL);
13493 if (!(q->q_flag & QFULL)) {
13494 mutex_enter(QLOCK(q));
13495 if (!(q->q_flag & QFULL)) {
13496 /* still need to set QFULL */
13497 q->q_flag |= QFULL;
13498 /* set flow_stopped to true under QLOCK */
13499 if (flow_stopped != NULL)
13500 *flow_stopped = B_TRUE;
13501 mutex_exit(QLOCK(q));
13502 } else {
13503 /* flow_stopped is left unchanged */
13504 mutex_exit(QLOCK(q));
13505 }
13506 }
13507 }
13508 }
13509
13510 void
13511 conn_clrqfull(conn_t *connp, boolean_t *flow_stopped)
13512 {
13513 if (IPCL_IS_NONSTR(connp)) {
13514 (*connp->conn_upcalls->su_txq_full)
13515 (connp->conn_upper_handle, B_FALSE);
13516 if (flow_stopped != NULL)
13517 *flow_stopped = B_FALSE;
13518 } else {
13519 queue_t *q = connp->conn_wq;
13520
13521 ASSERT(q != NULL);
13522 if (q->q_flag & QFULL) {
13523 mutex_enter(QLOCK(q));
13524 if (q->q_flag & QFULL) {
13525 q->q_flag &= ~QFULL;
13526 /* set flow_stopped to false under QLOCK */
13527 if (flow_stopped != NULL)
13528 *flow_stopped = B_FALSE;
13529 mutex_exit(QLOCK(q));
13530 if (q->q_flag & QWANTW)
13531 qbackenable(q, 0);
13532 } else {
13533 /* flow_stopped is left unchanged */
13534 mutex_exit(QLOCK(q));
13535 }
13536 }
13537 }
13538
13539 mutex_enter(&connp->conn_lock);
13540 connp->conn_blocked = B_FALSE;
13541 mutex_exit(&connp->conn_lock);
13542 }
13543
13544 /*
13545 * Return the length in bytes of the IPv4 headers (base header, label, and
13546 * other IP options) that will be needed based on the
13547 * ip_pkt_t structure passed by the caller.
13548 *
13549 * The returned length does not include the length of the upper level
13550 * protocol (ULP) header.
13551 * The caller needs to check that the length doesn't exceed the max for IPv4.
13552 */
13553 int
13554 ip_total_hdrs_len_v4(const ip_pkt_t *ipp)
13555 {
13556 int len;
13557
13558 len = IP_SIMPLE_HDR_LENGTH;
13559 if (ipp->ipp_fields & IPPF_LABEL_V4) {
13560 ASSERT(ipp->ipp_label_len_v4 != 0);
13561 /* We need to round up here */
13562 len += (ipp->ipp_label_len_v4 + 3) & ~3;
13563 }
13564
13565 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
13566 ASSERT(ipp->ipp_ipv4_options_len != 0);
13567 ASSERT((ipp->ipp_ipv4_options_len & 3) == 0);
13568 len += ipp->ipp_ipv4_options_len;
13569 }
13570 return (len);
13571 }
13572
13573 /*
13574 * All-purpose routine to build an IPv4 header with options based
13575 * on the abstract ip_pkt_t.
13576 *
13577 * The caller has to set the source and destination address as well as
13578 * ipha_length. The caller has to massage any source route and compensate
13579 * for the ULP pseudo-header checksum due to the source route.
13580 */
13581 void
13582 ip_build_hdrs_v4(uchar_t *buf, uint_t buf_len, const ip_pkt_t *ipp,
13583 uint8_t protocol)
13584 {
13585 ipha_t *ipha = (ipha_t *)buf;
13586 uint8_t *cp;
13587
13588 /* Initialize IPv4 header */
13589 ipha->ipha_type_of_service = ipp->ipp_type_of_service;
13590 ipha->ipha_length = 0; /* Caller will set later */
13591 ipha->ipha_ident = 0;
13592 ipha->ipha_fragment_offset_and_flags = 0;
13593 ipha->ipha_ttl = ipp->ipp_unicast_hops;
13594 ipha->ipha_protocol = protocol;
13595 ipha->ipha_hdr_checksum = 0;
13596
13597 if ((ipp->ipp_fields & IPPF_ADDR) &&
13598 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
13599 ipha->ipha_src = ipp->ipp_addr_v4;
13600
13601 cp = (uint8_t *)&ipha[1];
13602 if (ipp->ipp_fields & IPPF_LABEL_V4) {
13603 ASSERT(ipp->ipp_label_len_v4 != 0);
13604 bcopy(ipp->ipp_label_v4, cp, ipp->ipp_label_len_v4);
13605 cp += ipp->ipp_label_len_v4;
13606 /* We need to round up here */
13607 while ((uintptr_t)cp & 0x3) {
13608 *cp++ = IPOPT_NOP;
13609 }
13610 }
13611
13612 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
13613 ASSERT(ipp->ipp_ipv4_options_len != 0);
13614 ASSERT((ipp->ipp_ipv4_options_len & 3) == 0);
13615 bcopy(ipp->ipp_ipv4_options, cp, ipp->ipp_ipv4_options_len);
13616 cp += ipp->ipp_ipv4_options_len;
13617 }
13618 ipha->ipha_version_and_hdr_length =
13619 (uint8_t)((IP_VERSION << 4) + buf_len / 4);
13620
13621 ASSERT((int)(cp - buf) == buf_len);
13622 }
13623
13624 /* Allocate the private structure */
13625 static int
13626 ip_priv_alloc(void **bufp)
13627 {
13628 void *buf;
13629
13630 if ((buf = kmem_alloc(sizeof (ip_priv_t), KM_NOSLEEP)) == NULL)
13631 return (ENOMEM);
13632
13633 *bufp = buf;
13634 return (0);
13635 }
13636
13637 /* Function to delete the private structure */
13638 void
13639 ip_priv_free(void *buf)
13640 {
13641 ASSERT(buf != NULL);
13642 kmem_free(buf, sizeof (ip_priv_t));
13643 }
13644
13645 /*
13646 * The entry point for IPPF processing.
13647 * If the classifier (IPGPC_CLASSIFY) is not loaded and configured, the
13648 * routine just returns.
13649 *
13650 * When called, ip_process generates an ipp_packet_t structure
13651 * which holds the state information for this packet and invokes the
13652 * the classifier (via ipp_packet_process). The classification, depending on
13653 * configured filters, results in a list of actions for this packet. Invoking
13654 * an action may cause the packet to be dropped, in which case we return NULL.
13655 * proc indicates the callout position for
13656 * this packet and ill is the interface this packet arrived on or will leave
13657 * on (inbound and outbound resp.).
13658 *
13659 * We do the processing on the rill (mapped to the upper if ipmp), but MIB
13660 * on the ill corrsponding to the destination IP address.
13661 */
13662 mblk_t *
13663 ip_process(ip_proc_t proc, mblk_t *mp, ill_t *rill, ill_t *ill)
13664 {
13665 ip_priv_t *priv;
13666 ipp_action_id_t aid;
13667 int rc = 0;
13668 ipp_packet_t *pp;
13669
13670 /* If the classifier is not loaded, return */
13671 if ((aid = ipp_action_lookup(IPGPC_CLASSIFY)) == IPP_ACTION_INVAL) {
13672 return (mp);
13673 }
13674
13675 ASSERT(mp != NULL);
13676
13677 /* Allocate the packet structure */
13678 rc = ipp_packet_alloc(&pp, "ip", aid);
13679 if (rc != 0)
13680 goto drop;
13681
13682 /* Allocate the private structure */
13683 rc = ip_priv_alloc((void **)&priv);
13684 if (rc != 0) {
13685 ipp_packet_free(pp);
13686 goto drop;
13687 }
13688 priv->proc = proc;
13689 priv->ill_index = ill_get_upper_ifindex(rill);
13690
13691 ipp_packet_set_private(pp, priv, ip_priv_free);
13692 ipp_packet_set_data(pp, mp);
13693
13694 /* Invoke the classifier */
13695 rc = ipp_packet_process(&pp);
13696 if (pp != NULL) {
13697 mp = ipp_packet_get_data(pp);
13698 ipp_packet_free(pp);
13699 if (rc != 0)
13700 goto drop;
13701 return (mp);
13702 } else {
13703 /* No mp to trace in ip_drop_input/ip_drop_output */
13704 mp = NULL;
13705 }
13706 drop:
13707 if (proc == IPP_LOCAL_IN || proc == IPP_FWD_IN) {
13708 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
13709 ip_drop_input("ip_process", mp, ill);
13710 } else {
13711 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13712 ip_drop_output("ip_process", mp, ill);
13713 }
13714 freemsg(mp);
13715 return (NULL);
13716 }
13717
13718 /*
13719 * Propagate a multicast group membership operation (add/drop) on
13720 * all the interfaces crossed by the related multirt routes.
13721 * The call is considered successful if the operation succeeds
13722 * on at least one interface.
13723 *
13724 * This assumes that a set of IRE_HOST/RTF_MULTIRT has been created for the
13725 * multicast addresses with the ire argument being the first one.
13726 * We walk the bucket to find all the of those.
13727 *
13728 * Common to IPv4 and IPv6.
13729 */
13730 static int
13731 ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t,
13732 const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *),
13733 ire_t *ire, conn_t *connp, boolean_t checkonly, const in6_addr_t *v6group,
13734 mcast_record_t fmode, const in6_addr_t *v6src)
13735 {
13736 ire_t *ire_gw;
13737 irb_t *irb;
13738 int ifindex;
13739 int error = 0;
13740 int result;
13741 ip_stack_t *ipst = ire->ire_ipst;
13742 ipaddr_t group;
13743 boolean_t isv6;
13744 int match_flags;
13745
13746 if (IN6_IS_ADDR_V4MAPPED(v6group)) {
13747 IN6_V4MAPPED_TO_IPADDR(v6group, group);
13748 isv6 = B_FALSE;
13749 } else {
13750 isv6 = B_TRUE;
13751 }
13752
13753 irb = ire->ire_bucket;
13754 ASSERT(irb != NULL);
13755
13756 result = 0;
13757 irb_refhold(irb);
13758 for (; ire != NULL; ire = ire->ire_next) {
13759 if ((ire->ire_flags & RTF_MULTIRT) == 0)
13760 continue;
13761
13762 /* We handle -ifp routes by matching on the ill if set */
13763 match_flags = MATCH_IRE_TYPE;
13764 if (ire->ire_ill != NULL)
13765 match_flags |= MATCH_IRE_ILL;
13766
13767 if (isv6) {
13768 if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6group))
13769 continue;
13770
13771 ire_gw = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6,
13772 0, 0, IRE_INTERFACE, ire->ire_ill, ALL_ZONES, NULL,
13773 match_flags, 0, ipst, NULL);
13774 } else {
13775 if (ire->ire_addr != group)
13776 continue;
13777
13778 ire_gw = ire_ftable_lookup_v4(ire->ire_gateway_addr,
13779 0, 0, IRE_INTERFACE, ire->ire_ill, ALL_ZONES, NULL,
13780 match_flags, 0, ipst, NULL);
13781 }
13782 /* No interface route exists for the gateway; skip this ire. */
13783 if (ire_gw == NULL)
13784 continue;
13785 if (ire_gw->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
13786 ire_refrele(ire_gw);
13787 continue;
13788 }
13789 ASSERT(ire_gw->ire_ill != NULL); /* IRE_INTERFACE */
13790 ifindex = ire_gw->ire_ill->ill_phyint->phyint_ifindex;
13791
13792 /*
13793 * The operation is considered a success if
13794 * it succeeds at least once on any one interface.
13795 */
13796 error = fn(connp, checkonly, v6group, INADDR_ANY, ifindex,
13797 fmode, v6src);
13798 if (error == 0)
13799 result = CGTP_MCAST_SUCCESS;
13800
13801 ire_refrele(ire_gw);
13802 }
13803 irb_refrele(irb);
13804 /*
13805 * Consider the call as successful if we succeeded on at least
13806 * one interface. Otherwise, return the last encountered error.
13807 */
13808 return (result == CGTP_MCAST_SUCCESS ? 0 : error);
13809 }
13810
13811 /*
13812 * Return the expected CGTP hooks version number.
13813 */
13814 int
13815 ip_cgtp_filter_supported(void)
13816 {
13817 return (ip_cgtp_filter_rev);
13818 }
13819
13820 /*
13821 * CGTP hooks can be registered by invoking this function.
13822 * Checks that the version number matches.
13823 */
13824 int
13825 ip_cgtp_filter_register(netstackid_t stackid, cgtp_filter_ops_t *ops)
13826 {
13827 netstack_t *ns;
13828 ip_stack_t *ipst;
13829
13830 if (ops->cfo_filter_rev != CGTP_FILTER_REV)
13831 return (ENOTSUP);
13832
13833 ns = netstack_find_by_stackid(stackid);
13834 if (ns == NULL)
13835 return (EINVAL);
13836 ipst = ns->netstack_ip;
13837 ASSERT(ipst != NULL);
13838
13839 if (ipst->ips_ip_cgtp_filter_ops != NULL) {
13840 netstack_rele(ns);
13841 return (EALREADY);
13842 }
13843
13844 ipst->ips_ip_cgtp_filter_ops = ops;
13845
13846 ill_set_inputfn_all(ipst);
13847
13848 netstack_rele(ns);
13849 return (0);
13850 }
13851
13852 /*
13853 * CGTP hooks can be unregistered by invoking this function.
13854 * Returns ENXIO if there was no registration.
13855 * Returns EBUSY if the ndd variable has not been turned off.
13856 */
13857 int
13858 ip_cgtp_filter_unregister(netstackid_t stackid)
13859 {
13860 netstack_t *ns;
13861 ip_stack_t *ipst;
13862
13863 ns = netstack_find_by_stackid(stackid);
13864 if (ns == NULL)
13865 return (EINVAL);
13866 ipst = ns->netstack_ip;
13867 ASSERT(ipst != NULL);
13868
13869 if (ipst->ips_ip_cgtp_filter) {
13870 netstack_rele(ns);
13871 return (EBUSY);
13872 }
13873
13874 if (ipst->ips_ip_cgtp_filter_ops == NULL) {
13875 netstack_rele(ns);
13876 return (ENXIO);
13877 }
13878 ipst->ips_ip_cgtp_filter_ops = NULL;
13879
13880 ill_set_inputfn_all(ipst);
13881
13882 netstack_rele(ns);
13883 return (0);
13884 }
13885
13886 /*
13887 * Check whether there is a CGTP filter registration.
13888 * Returns non-zero if there is a registration, otherwise returns zero.
13889 * Note: returns zero if bad stackid.
13890 */
13891 int
13892 ip_cgtp_filter_is_registered(netstackid_t stackid)
13893 {
13894 netstack_t *ns;
13895 ip_stack_t *ipst;
13896 int ret;
13897
13898 ns = netstack_find_by_stackid(stackid);
13899 if (ns == NULL)
13900 return (0);
13901 ipst = ns->netstack_ip;
13902 ASSERT(ipst != NULL);
13903
13904 if (ipst->ips_ip_cgtp_filter_ops != NULL)
13905 ret = 1;
13906 else
13907 ret = 0;
13908
13909 netstack_rele(ns);
13910 return (ret);
13911 }
13912
13913 static int
13914 ip_squeue_switch(int val)
13915 {
13916 int rval;
13917
13918 switch (val) {
13919 case IP_SQUEUE_ENTER_NODRAIN:
13920 rval = SQ_NODRAIN;
13921 break;
13922 case IP_SQUEUE_ENTER:
13923 rval = SQ_PROCESS;
13924 break;
13925 case IP_SQUEUE_FILL:
13926 default:
13927 rval = SQ_FILL;
13928 break;
13929 }
13930 return (rval);
13931 }
13932
13933 static void *
13934 ip_kstat2_init(netstackid_t stackid, ip_stat_t *ip_statisticsp)
13935 {
13936 kstat_t *ksp;
13937
13938 ip_stat_t template = {
13939 { "ip_udp_fannorm", KSTAT_DATA_UINT64 },
13940 { "ip_udp_fanmb", KSTAT_DATA_UINT64 },
13941 { "ip_recv_pullup", KSTAT_DATA_UINT64 },
13942 { "ip_db_ref", KSTAT_DATA_UINT64 },
13943 { "ip_notaligned", KSTAT_DATA_UINT64 },
13944 { "ip_multimblk", KSTAT_DATA_UINT64 },
13945 { "ip_opt", KSTAT_DATA_UINT64 },
13946 { "ipsec_proto_ahesp", KSTAT_DATA_UINT64 },
13947 { "ip_conn_flputbq", KSTAT_DATA_UINT64 },
13948 { "ip_conn_walk_drain", KSTAT_DATA_UINT64 },
13949 { "ip_out_sw_cksum", KSTAT_DATA_UINT64 },
13950 { "ip_out_sw_cksum_bytes", KSTAT_DATA_UINT64 },
13951 { "ip_in_sw_cksum", KSTAT_DATA_UINT64 },
13952 { "ip_ire_reclaim_calls", KSTAT_DATA_UINT64 },
13953 { "ip_ire_reclaim_deleted", KSTAT_DATA_UINT64 },
13954 { "ip_nce_reclaim_calls", KSTAT_DATA_UINT64 },
13955 { "ip_nce_reclaim_deleted", KSTAT_DATA_UINT64 },
13956 { "ip_dce_reclaim_calls", KSTAT_DATA_UINT64 },
13957 { "ip_dce_reclaim_deleted", KSTAT_DATA_UINT64 },
13958 { "ip_tcp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 },
13959 { "ip_tcp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 },
13960 { "ip_tcp_in_sw_cksum_err", KSTAT_DATA_UINT64 },
13961 { "ip_udp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 },
13962 { "ip_udp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 },
13963 { "ip_udp_in_sw_cksum_err", KSTAT_DATA_UINT64 },
13964 { "conn_in_recvdstaddr", KSTAT_DATA_UINT64 },
13965 { "conn_in_recvopts", KSTAT_DATA_UINT64 },
13966 { "conn_in_recvif", KSTAT_DATA_UINT64 },
13967 { "conn_in_recvslla", KSTAT_DATA_UINT64 },
13968 { "conn_in_recvucred", KSTAT_DATA_UINT64 },
13969 { "conn_in_recvttl", KSTAT_DATA_UINT64 },
13970 { "conn_in_recvhopopts", KSTAT_DATA_UINT64 },
13971 { "conn_in_recvhoplimit", KSTAT_DATA_UINT64 },
13972 { "conn_in_recvdstopts", KSTAT_DATA_UINT64 },
13973 { "conn_in_recvrthdrdstopts", KSTAT_DATA_UINT64 },
13974 { "conn_in_recvrthdr", KSTAT_DATA_UINT64 },
13975 { "conn_in_recvpktinfo", KSTAT_DATA_UINT64 },
13976 { "conn_in_recvtclass", KSTAT_DATA_UINT64 },
13977 { "conn_in_timestamp", KSTAT_DATA_UINT64 },
13978 };
13979
13980 ksp = kstat_create_netstack("ip", 0, "ipstat", "net",
13981 KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t),
13982 KSTAT_FLAG_VIRTUAL, stackid);
13983
13984 if (ksp == NULL)
13985 return (NULL);
13986
13987 bcopy(&template, ip_statisticsp, sizeof (template));
13988 ksp->ks_data = (void *)ip_statisticsp;
13989 ksp->ks_private = (void *)(uintptr_t)stackid;
13990
13991 kstat_install(ksp);
13992 return (ksp);
13993 }
13994
13995 static void
13996 ip_kstat2_fini(netstackid_t stackid, kstat_t *ksp)
13997 {
13998 if (ksp != NULL) {
13999 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
14000 kstat_delete_netstack(ksp, stackid);
14001 }
14002 }
14003
14004 static void *
14005 ip_kstat_init(netstackid_t stackid, ip_stack_t *ipst)
14006 {
14007 kstat_t *ksp;
14008
14009 ip_named_kstat_t template = {
14010 { "forwarding", KSTAT_DATA_UINT32, 0 },
14011 { "defaultTTL", KSTAT_DATA_UINT32, 0 },
14012 { "inReceives", KSTAT_DATA_UINT64, 0 },
14013 { "inHdrErrors", KSTAT_DATA_UINT32, 0 },
14014 { "inAddrErrors", KSTAT_DATA_UINT32, 0 },
14015 { "forwDatagrams", KSTAT_DATA_UINT64, 0 },
14016 { "inUnknownProtos", KSTAT_DATA_UINT32, 0 },
14017 { "inDiscards", KSTAT_DATA_UINT32, 0 },
14018 { "inDelivers", KSTAT_DATA_UINT64, 0 },
14019 { "outRequests", KSTAT_DATA_UINT64, 0 },
14020 { "outDiscards", KSTAT_DATA_UINT32, 0 },
14021 { "outNoRoutes", KSTAT_DATA_UINT32, 0 },
14022 { "reasmTimeout", KSTAT_DATA_UINT32, 0 },
14023 { "reasmReqds", KSTAT_DATA_UINT32, 0 },
14024 { "reasmOKs", KSTAT_DATA_UINT32, 0 },
14025 { "reasmFails", KSTAT_DATA_UINT32, 0 },
14026 { "fragOKs", KSTAT_DATA_UINT32, 0 },
14027 { "fragFails", KSTAT_DATA_UINT32, 0 },
14028 { "fragCreates", KSTAT_DATA_UINT32, 0 },
14029 { "addrEntrySize", KSTAT_DATA_INT32, 0 },
14030 { "routeEntrySize", KSTAT_DATA_INT32, 0 },
14031 { "netToMediaEntrySize", KSTAT_DATA_INT32, 0 },
14032 { "routingDiscards", KSTAT_DATA_UINT32, 0 },
14033 { "inErrs", KSTAT_DATA_UINT32, 0 },
14034 { "noPorts", KSTAT_DATA_UINT32, 0 },
14035 { "inCksumErrs", KSTAT_DATA_UINT32, 0 },
14036 { "reasmDuplicates", KSTAT_DATA_UINT32, 0 },
14037 { "reasmPartDups", KSTAT_DATA_UINT32, 0 },
14038 { "forwProhibits", KSTAT_DATA_UINT32, 0 },
14039 { "udpInCksumErrs", KSTAT_DATA_UINT32, 0 },
14040 { "udpInOverflows", KSTAT_DATA_UINT32, 0 },
14041 { "rawipInOverflows", KSTAT_DATA_UINT32, 0 },
14042 { "ipsecInSucceeded", KSTAT_DATA_UINT32, 0 },
14043 { "ipsecInFailed", KSTAT_DATA_INT32, 0 },
14044 { "memberEntrySize", KSTAT_DATA_INT32, 0 },
14045 { "inIPv6", KSTAT_DATA_UINT32, 0 },
14046 { "outIPv6", KSTAT_DATA_UINT32, 0 },
14047 { "outSwitchIPv6", KSTAT_DATA_UINT32, 0 },
14048 };
14049
14050 ksp = kstat_create_netstack("ip", 0, "ip", "mib2", KSTAT_TYPE_NAMED,
14051 NUM_OF_FIELDS(ip_named_kstat_t), 0, stackid);
14052 if (ksp == NULL || ksp->ks_data == NULL)
14053 return (NULL);
14054
14055 template.forwarding.value.ui32 = WE_ARE_FORWARDING(ipst) ? 1:2;
14056 template.defaultTTL.value.ui32 = (uint32_t)ipst->ips_ip_def_ttl;
14057 template.reasmTimeout.value.ui32 = ipst->ips_ip_reassembly_timeout;
14058 template.addrEntrySize.value.i32 = sizeof (mib2_ipAddrEntry_t);
14059 template.routeEntrySize.value.i32 = sizeof (mib2_ipRouteEntry_t);
14060
14061 template.netToMediaEntrySize.value.i32 =
14062 sizeof (mib2_ipNetToMediaEntry_t);
14063
14064 template.memberEntrySize.value.i32 = sizeof (ipv6_member_t);
14065
14066 bcopy(&template, ksp->ks_data, sizeof (template));
14067 ksp->ks_update = ip_kstat_update;
14068 ksp->ks_private = (void *)(uintptr_t)stackid;
14069
14070 kstat_install(ksp);
14071 return (ksp);
14072 }
14073
14074 static void
14075 ip_kstat_fini(netstackid_t stackid, kstat_t *ksp)
14076 {
14077 if (ksp != NULL) {
14078 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
14079 kstat_delete_netstack(ksp, stackid);
14080 }
14081 }
14082
14083 static int
14084 ip_kstat_update(kstat_t *kp, int rw)
14085 {
14086 ip_named_kstat_t *ipkp;
14087 mib2_ipIfStatsEntry_t ipmib;
14088 ill_walk_context_t ctx;
14089 ill_t *ill;
14090 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private;
14091 netstack_t *ns;
14092 ip_stack_t *ipst;
14093
14094 if (kp == NULL || kp->ks_data == NULL)
14095 return (EIO);
14096
14097 if (rw == KSTAT_WRITE)
14098 return (EACCES);
14099
14100 ns = netstack_find_by_stackid(stackid);
14101 if (ns == NULL)
14102 return (-1);
14103 ipst = ns->netstack_ip;
14104 if (ipst == NULL) {
14105 netstack_rele(ns);
14106 return (-1);
14107 }
14108 ipkp = (ip_named_kstat_t *)kp->ks_data;
14109
14110 bcopy(&ipst->ips_ip_mib, &ipmib, sizeof (ipmib));
14111 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
14112 ill = ILL_START_WALK_V4(&ctx, ipst);
14113 for (; ill != NULL; ill = ill_next(&ctx, ill))
14114 ip_mib2_add_ip_stats(&ipmib, ill->ill_ip_mib);
14115 rw_exit(&ipst->ips_ill_g_lock);
14116
14117 ipkp->forwarding.value.ui32 = ipmib.ipIfStatsForwarding;
14118 ipkp->defaultTTL.value.ui32 = ipmib.ipIfStatsDefaultTTL;
14119 ipkp->inReceives.value.ui64 = ipmib.ipIfStatsHCInReceives;
14120 ipkp->inHdrErrors.value.ui32 = ipmib.ipIfStatsInHdrErrors;
14121 ipkp->inAddrErrors.value.ui32 = ipmib.ipIfStatsInAddrErrors;
14122 ipkp->forwDatagrams.value.ui64 = ipmib.ipIfStatsHCOutForwDatagrams;
14123 ipkp->inUnknownProtos.value.ui32 = ipmib.ipIfStatsInUnknownProtos;
14124 ipkp->inDiscards.value.ui32 = ipmib.ipIfStatsInDiscards;
14125 ipkp->inDelivers.value.ui64 = ipmib.ipIfStatsHCInDelivers;
14126 ipkp->outRequests.value.ui64 = ipmib.ipIfStatsHCOutRequests;
14127 ipkp->outDiscards.value.ui32 = ipmib.ipIfStatsOutDiscards;
14128 ipkp->outNoRoutes.value.ui32 = ipmib.ipIfStatsOutNoRoutes;
14129 ipkp->reasmTimeout.value.ui32 = ipst->ips_ip_reassembly_timeout;
14130 ipkp->reasmReqds.value.ui32 = ipmib.ipIfStatsReasmReqds;
14131 ipkp->reasmOKs.value.ui32 = ipmib.ipIfStatsReasmOKs;
14132 ipkp->reasmFails.value.ui32 = ipmib.ipIfStatsReasmFails;
14133 ipkp->fragOKs.value.ui32 = ipmib.ipIfStatsOutFragOKs;
14134 ipkp->fragFails.value.ui32 = ipmib.ipIfStatsOutFragFails;
14135 ipkp->fragCreates.value.ui32 = ipmib.ipIfStatsOutFragCreates;
14136
14137 ipkp->routingDiscards.value.ui32 = 0;
14138 ipkp->inErrs.value.ui32 = ipmib.tcpIfStatsInErrs;
14139 ipkp->noPorts.value.ui32 = ipmib.udpIfStatsNoPorts;
14140 ipkp->inCksumErrs.value.ui32 = ipmib.ipIfStatsInCksumErrs;
14141 ipkp->reasmDuplicates.value.ui32 = ipmib.ipIfStatsReasmDuplicates;
14142 ipkp->reasmPartDups.value.ui32 = ipmib.ipIfStatsReasmPartDups;
14143 ipkp->forwProhibits.value.ui32 = ipmib.ipIfStatsForwProhibits;
14144 ipkp->udpInCksumErrs.value.ui32 = ipmib.udpIfStatsInCksumErrs;
14145 ipkp->udpInOverflows.value.ui32 = ipmib.udpIfStatsInOverflows;
14146 ipkp->rawipInOverflows.value.ui32 = ipmib.rawipIfStatsInOverflows;
14147 ipkp->ipsecInSucceeded.value.ui32 = ipmib.ipsecIfStatsInSucceeded;
14148 ipkp->ipsecInFailed.value.i32 = ipmib.ipsecIfStatsInFailed;
14149
14150 ipkp->inIPv6.value.ui32 = ipmib.ipIfStatsInWrongIPVersion;
14151 ipkp->outIPv6.value.ui32 = ipmib.ipIfStatsOutWrongIPVersion;
14152 ipkp->outSwitchIPv6.value.ui32 = ipmib.ipIfStatsOutSwitchIPVersion;
14153
14154 netstack_rele(ns);
14155
14156 return (0);
14157 }
14158
14159 static void *
14160 icmp_kstat_init(netstackid_t stackid)
14161 {
14162 kstat_t *ksp;
14163
14164 icmp_named_kstat_t template = {
14165 { "inMsgs", KSTAT_DATA_UINT32 },
14166 { "inErrors", KSTAT_DATA_UINT32 },
14167 { "inDestUnreachs", KSTAT_DATA_UINT32 },
14168 { "inTimeExcds", KSTAT_DATA_UINT32 },
14169 { "inParmProbs", KSTAT_DATA_UINT32 },
14170 { "inSrcQuenchs", KSTAT_DATA_UINT32 },
14171 { "inRedirects", KSTAT_DATA_UINT32 },
14172 { "inEchos", KSTAT_DATA_UINT32 },
14173 { "inEchoReps", KSTAT_DATA_UINT32 },
14174 { "inTimestamps", KSTAT_DATA_UINT32 },
14175 { "inTimestampReps", KSTAT_DATA_UINT32 },
14176 { "inAddrMasks", KSTAT_DATA_UINT32 },
14177 { "inAddrMaskReps", KSTAT_DATA_UINT32 },
14178 { "outMsgs", KSTAT_DATA_UINT32 },
14179 { "outErrors", KSTAT_DATA_UINT32 },
14180 { "outDestUnreachs", KSTAT_DATA_UINT32 },
14181 { "outTimeExcds", KSTAT_DATA_UINT32 },
14182 { "outParmProbs", KSTAT_DATA_UINT32 },
14183 { "outSrcQuenchs", KSTAT_DATA_UINT32 },
14184 { "outRedirects", KSTAT_DATA_UINT32 },
14185 { "outEchos", KSTAT_DATA_UINT32 },
14186 { "outEchoReps", KSTAT_DATA_UINT32 },
14187 { "outTimestamps", KSTAT_DATA_UINT32 },
14188 { "outTimestampReps", KSTAT_DATA_UINT32 },
14189 { "outAddrMasks", KSTAT_DATA_UINT32 },
14190 { "outAddrMaskReps", KSTAT_DATA_UINT32 },
14191 { "inChksumErrs", KSTAT_DATA_UINT32 },
14192 { "inUnknowns", KSTAT_DATA_UINT32 },
14193 { "inFragNeeded", KSTAT_DATA_UINT32 },
14194 { "outFragNeeded", KSTAT_DATA_UINT32 },
14195 { "outDrops", KSTAT_DATA_UINT32 },
14196 { "inOverFlows", KSTAT_DATA_UINT32 },
14197 { "inBadRedirects", KSTAT_DATA_UINT32 },
14198 };
14199
14200 ksp = kstat_create_netstack("ip", 0, "icmp", "mib2", KSTAT_TYPE_NAMED,
14201 NUM_OF_FIELDS(icmp_named_kstat_t), 0, stackid);
14202 if (ksp == NULL || ksp->ks_data == NULL)
14203 return (NULL);
14204
14205 bcopy(&template, ksp->ks_data, sizeof (template));
14206
14207 ksp->ks_update = icmp_kstat_update;
14208 ksp->ks_private = (void *)(uintptr_t)stackid;
14209
14210 kstat_install(ksp);
14211 return (ksp);
14212 }
14213
14214 static void
14215 icmp_kstat_fini(netstackid_t stackid, kstat_t *ksp)
14216 {
14217 if (ksp != NULL) {
14218 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
14219 kstat_delete_netstack(ksp, stackid);
14220 }
14221 }
14222
14223 static int
14224 icmp_kstat_update(kstat_t *kp, int rw)
14225 {
14226 icmp_named_kstat_t *icmpkp;
14227 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private;
14228 netstack_t *ns;
14229 ip_stack_t *ipst;
14230
14231 if ((kp == NULL) || (kp->ks_data == NULL))
14232 return (EIO);
14233
14234 if (rw == KSTAT_WRITE)
14235 return (EACCES);
14236
14237 ns = netstack_find_by_stackid(stackid);
14238 if (ns == NULL)
14239 return (-1);
14240 ipst = ns->netstack_ip;
14241 if (ipst == NULL) {
14242 netstack_rele(ns);
14243 return (-1);
14244 }
14245 icmpkp = (icmp_named_kstat_t *)kp->ks_data;
14246
14247 icmpkp->inMsgs.value.ui32 = ipst->ips_icmp_mib.icmpInMsgs;
14248 icmpkp->inErrors.value.ui32 = ipst->ips_icmp_mib.icmpInErrors;
14249 icmpkp->inDestUnreachs.value.ui32 =
14250 ipst->ips_icmp_mib.icmpInDestUnreachs;
14251 icmpkp->inTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpInTimeExcds;
14252 icmpkp->inParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpInParmProbs;
14253 icmpkp->inSrcQuenchs.value.ui32 = ipst->ips_icmp_mib.icmpInSrcQuenchs;
14254 icmpkp->inRedirects.value.ui32 = ipst->ips_icmp_mib.icmpInRedirects;
14255 icmpkp->inEchos.value.ui32 = ipst->ips_icmp_mib.icmpInEchos;
14256 icmpkp->inEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpInEchoReps;
14257 icmpkp->inTimestamps.value.ui32 = ipst->ips_icmp_mib.icmpInTimestamps;
14258 icmpkp->inTimestampReps.value.ui32 =
14259 ipst->ips_icmp_mib.icmpInTimestampReps;
14260 icmpkp->inAddrMasks.value.ui32 = ipst->ips_icmp_mib.icmpInAddrMasks;
14261 icmpkp->inAddrMaskReps.value.ui32 =
14262 ipst->ips_icmp_mib.icmpInAddrMaskReps;
14263 icmpkp->outMsgs.value.ui32 = ipst->ips_icmp_mib.icmpOutMsgs;
14264 icmpkp->outErrors.value.ui32 = ipst->ips_icmp_mib.icmpOutErrors;
14265 icmpkp->outDestUnreachs.value.ui32 =
14266 ipst->ips_icmp_mib.icmpOutDestUnreachs;
14267 icmpkp->outTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpOutTimeExcds;
14268 icmpkp->outParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpOutParmProbs;
14269 icmpkp->outSrcQuenchs.value.ui32 =
14270 ipst->ips_icmp_mib.icmpOutSrcQuenchs;
14271 icmpkp->outRedirects.value.ui32 = ipst->ips_icmp_mib.icmpOutRedirects;
14272 icmpkp->outEchos.value.ui32 = ipst->ips_icmp_mib.icmpOutEchos;
14273 icmpkp->outEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpOutEchoReps;
14274 icmpkp->outTimestamps.value.ui32 =
14275 ipst->ips_icmp_mib.icmpOutTimestamps;
14276 icmpkp->outTimestampReps.value.ui32 =
14277 ipst->ips_icmp_mib.icmpOutTimestampReps;
14278 icmpkp->outAddrMasks.value.ui32 =
14279 ipst->ips_icmp_mib.icmpOutAddrMasks;
14280 icmpkp->outAddrMaskReps.value.ui32 =
14281 ipst->ips_icmp_mib.icmpOutAddrMaskReps;
14282 icmpkp->inCksumErrs.value.ui32 = ipst->ips_icmp_mib.icmpInCksumErrs;
14283 icmpkp->inUnknowns.value.ui32 = ipst->ips_icmp_mib.icmpInUnknowns;
14284 icmpkp->inFragNeeded.value.ui32 = ipst->ips_icmp_mib.icmpInFragNeeded;
14285 icmpkp->outFragNeeded.value.ui32 =
14286 ipst->ips_icmp_mib.icmpOutFragNeeded;
14287 icmpkp->outDrops.value.ui32 = ipst->ips_icmp_mib.icmpOutDrops;
14288 icmpkp->inOverflows.value.ui32 = ipst->ips_icmp_mib.icmpInOverflows;
14289 icmpkp->inBadRedirects.value.ui32 =
14290 ipst->ips_icmp_mib.icmpInBadRedirects;
14291
14292 netstack_rele(ns);
14293 return (0);
14294 }
14295
14296 /*
14297 * This is the fanout function for raw socket opened for SCTP. Note
14298 * that it is called after SCTP checks that there is no socket which
14299 * wants a packet. Then before SCTP handles this out of the blue packet,
14300 * this function is called to see if there is any raw socket for SCTP.
14301 * If there is and it is bound to the correct address, the packet will
14302 * be sent to that socket. Note that only one raw socket can be bound to
14303 * a port. This is assured in ipcl_sctp_hash_insert();
14304 */
14305 void
14306 ip_fanout_sctp_raw(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, uint32_t ports,
14307 ip_recv_attr_t *ira)
14308 {
14309 conn_t *connp;
14310 queue_t *rq;
14311 boolean_t secure;
14312 ill_t *ill = ira->ira_ill;
14313 ip_stack_t *ipst = ill->ill_ipst;
14314 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
14315 sctp_stack_t *sctps = ipst->ips_netstack->netstack_sctp;
14316 iaflags_t iraflags = ira->ira_flags;
14317 ill_t *rill = ira->ira_rill;
14318
14319 secure = iraflags & IRAF_IPSEC_SECURE;
14320
14321 connp = ipcl_classify_raw(mp, IPPROTO_SCTP, ports, ipha, ip6h,
14322 ira, ipst);
14323 if (connp == NULL) {
14324 /*
14325 * Although raw sctp is not summed, OOB chunks must be.
14326 * Drop the packet here if the sctp checksum failed.
14327 */
14328 if (iraflags & IRAF_SCTP_CSUM_ERR) {
14329 SCTPS_BUMP_MIB(sctps, sctpChecksumError);
14330 freemsg(mp);
14331 return;
14332 }
14333 ira->ira_ill = ira->ira_rill = NULL;
14334 sctp_ootb_input(mp, ira, ipst);
14335 ira->ira_ill = ill;
14336 ira->ira_rill = rill;
14337 return;
14338 }
14339 rq = connp->conn_rq;
14340 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : !canputnext(rq)) {
14341 CONN_DEC_REF(connp);
14342 BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows);
14343 freemsg(mp);
14344 return;
14345 }
14346 if (((iraflags & IRAF_IS_IPV4) ?
14347 CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
14348 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
14349 secure) {
14350 mp = ipsec_check_inbound_policy(mp, connp, ipha,
14351 ip6h, ira);
14352 if (mp == NULL) {
14353 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
14354 /* Note that mp is NULL */
14355 ip_drop_input("ipIfStatsInDiscards", mp, ill);
14356 CONN_DEC_REF(connp);
14357 return;
14358 }
14359 }
14360
14361 if (iraflags & IRAF_ICMP_ERROR) {
14362 (connp->conn_recvicmp)(connp, mp, NULL, ira);
14363 } else {
14364 ill_t *rill = ira->ira_rill;
14365
14366 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
14367 /* This is the SOCK_RAW, IPPROTO_SCTP case. */
14368 ira->ira_ill = ira->ira_rill = NULL;
14369 (connp->conn_recv)(connp, mp, NULL, ira);
14370 ira->ira_ill = ill;
14371 ira->ira_rill = rill;
14372 }
14373 CONN_DEC_REF(connp);
14374 }
14375
14376 /*
14377 * Free a packet that has the link-layer dl_unitdata_req_t or fast-path
14378 * header before the ip payload.
14379 */
14380 static void
14381 ip_xmit_flowctl_drop(ill_t *ill, mblk_t *mp, boolean_t is_fp_mp, int fp_mp_len)
14382 {
14383 int len = (mp->b_wptr - mp->b_rptr);
14384 mblk_t *ip_mp;
14385
14386 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
14387 if (is_fp_mp || len != fp_mp_len) {
14388 if (len > fp_mp_len) {
14389 /*
14390 * fastpath header and ip header in the first mblk
14391 */
14392 mp->b_rptr += fp_mp_len;
14393 } else {
14394 /*
14395 * ip_xmit_attach_llhdr had to prepend an mblk to
14396 * attach the fastpath header before ip header.
14397 */
14398 ip_mp = mp->b_cont;
14399 freeb(mp);
14400 mp = ip_mp;
14401 mp->b_rptr += (fp_mp_len - len);
14402 }
14403 } else {
14404 ip_mp = mp->b_cont;
14405 freeb(mp);
14406 mp = ip_mp;
14407 }
14408 ip_drop_output("ipIfStatsOutDiscards - flow ctl", mp, ill);
14409 freemsg(mp);
14410 }
14411
14412 /*
14413 * Normal post fragmentation function.
14414 *
14415 * Send a packet using the passed in nce. This handles both IPv4 and IPv6
14416 * using the same state machine.
14417 *
14418 * We return an error on failure. In particular we return EWOULDBLOCK
14419 * when the driver flow controls. In that case this ensures that ip_wsrv runs
14420 * (currently by canputnext failure resulting in backenabling from GLD.)
14421 * This allows the callers of conn_ip_output() to use EWOULDBLOCK as an
14422 * indication that they can flow control until ip_wsrv() tells then to restart.
14423 *
14424 * If the nce passed by caller is incomplete, this function
14425 * queues the packet and if necessary, sends ARP request and bails.
14426 * If the Neighbor Cache passed is fully resolved, we simply prepend
14427 * the link-layer header to the packet, do ipsec hw acceleration
14428 * work if necessary, and send the packet out on the wire.
14429 */
14430 /* ARGSUSED6 */
14431 int
14432 ip_xmit(mblk_t *mp, nce_t *nce, iaflags_t ixaflags, uint_t pkt_len,
14433 uint32_t xmit_hint, zoneid_t szone, zoneid_t nolzid, uintptr_t *ixacookie)
14434 {
14435 queue_t *wq;
14436 ill_t *ill = nce->nce_ill;
14437 ip_stack_t *ipst = ill->ill_ipst;
14438 uint64_t delta;
14439 boolean_t isv6 = ill->ill_isv6;
14440 boolean_t fp_mp;
14441 ncec_t *ncec = nce->nce_common;
14442 int64_t now = LBOLT_FASTPATH64;
14443 boolean_t is_probe;
14444
14445 DTRACE_PROBE1(ip__xmit, nce_t *, nce);
14446
14447 ASSERT(mp != NULL);
14448 ASSERT(mp->b_datap->db_type == M_DATA);
14449 ASSERT(pkt_len == msgdsize(mp));
14450
14451 /*
14452 * If we have already been here and are coming back after ARP/ND.
14453 * the IXAF_NO_TRACE flag is set. We skip FW_HOOKS, DTRACE and ipobs
14454 * in that case since they have seen the packet when it came here
14455 * the first time.
14456 */
14457 if (ixaflags & IXAF_NO_TRACE)
14458 goto sendit;
14459
14460 if (ixaflags & IXAF_IS_IPV4) {
14461 ipha_t *ipha = (ipha_t *)mp->b_rptr;
14462
14463 ASSERT(!isv6);
14464 ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length));
14465 if (HOOKS4_INTERESTED_PHYSICAL_OUT(ipst) &&
14466 !(ixaflags & IXAF_NO_PFHOOK)) {
14467 int error;
14468
14469 FW_HOOKS(ipst->ips_ip4_physical_out_event,
14470 ipst->ips_ipv4firewall_physical_out,
14471 NULL, ill, ipha, mp, mp, 0, ipst, error);
14472 DTRACE_PROBE1(ip4__physical__out__end,
14473 mblk_t *, mp);
14474 if (mp == NULL)
14475 return (error);
14476
14477 /* The length could have changed */
14478 pkt_len = msgdsize(mp);
14479 }
14480 if (ipst->ips_ip4_observe.he_interested) {
14481 /*
14482 * Note that for TX the zoneid is the sending
14483 * zone, whether or not MLP is in play.
14484 * Since the szone argument is the IP zoneid (i.e.,
14485 * zero for exclusive-IP zones) and ipobs wants
14486 * the system zoneid, we map it here.
14487 */
14488 szone = IP_REAL_ZONEID(szone, ipst);
14489
14490 /*
14491 * On the outbound path the destination zone will be
14492 * unknown as we're sending this packet out on the
14493 * wire.
14494 */
14495 ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone, ALL_ZONES,
14496 ill, ipst);
14497 }
14498 DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL,
14499 void_ip_t *, ipha, __dtrace_ipsr_ill_t *, ill,
14500 ipha_t *, ipha, ip6_t *, NULL, int, 0);
14501 } else {
14502 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
14503
14504 ASSERT(isv6);
14505 ASSERT(pkt_len ==
14506 ntohs(((ip6_t *)mp->b_rptr)->ip6_plen) + IPV6_HDR_LEN);
14507 if (HOOKS6_INTERESTED_PHYSICAL_OUT(ipst) &&
14508 !(ixaflags & IXAF_NO_PFHOOK)) {
14509 int error;
14510
14511 FW_HOOKS6(ipst->ips_ip6_physical_out_event,
14512 ipst->ips_ipv6firewall_physical_out,
14513 NULL, ill, ip6h, mp, mp, 0, ipst, error);
14514 DTRACE_PROBE1(ip6__physical__out__end,
14515 mblk_t *, mp);
14516 if (mp == NULL)
14517 return (error);
14518
14519 /* The length could have changed */
14520 pkt_len = msgdsize(mp);
14521 }
14522 if (ipst->ips_ip6_observe.he_interested) {
14523 /* See above */
14524 szone = IP_REAL_ZONEID(szone, ipst);
14525
14526 ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone, ALL_ZONES,
14527 ill, ipst);
14528 }
14529 DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL,
14530 void_ip_t *, ip6h, __dtrace_ipsr_ill_t *, ill,
14531 ipha_t *, NULL, ip6_t *, ip6h, int, 0);
14532 }
14533
14534 sendit:
14535 /*
14536 * We check the state without a lock because the state can never
14537 * move "backwards" to initial or incomplete.
14538 */
14539 switch (ncec->ncec_state) {
14540 case ND_REACHABLE:
14541 case ND_STALE:
14542 case ND_DELAY:
14543 case ND_PROBE:
14544 mp = ip_xmit_attach_llhdr(mp, nce);
14545 if (mp == NULL) {
14546 /*
14547 * ip_xmit_attach_llhdr has increased
14548 * ipIfStatsOutDiscards and called ip_drop_output()
14549 */
14550 return (ENOBUFS);
14551 }
14552 /*
14553 * check if nce_fastpath completed and we tagged on a
14554 * copy of nce_fp_mp in ip_xmit_attach_llhdr().
14555 */
14556 fp_mp = (mp->b_datap->db_type == M_DATA);
14557
14558 if (fp_mp &&
14559 (ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT)) {
14560 ill_dld_direct_t *idd;
14561
14562 idd = &ill->ill_dld_capab->idc_direct;
14563 /*
14564 * Send the packet directly to DLD, where it
14565 * may be queued depending on the availability
14566 * of transmit resources at the media layer.
14567 * Return value should be taken into
14568 * account and flow control the TCP.
14569 */
14570 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits);
14571 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
14572 pkt_len);
14573
14574 if (ixaflags & IXAF_NO_DEV_FLOW_CTL) {
14575 (void) idd->idd_tx_df(idd->idd_tx_dh, mp,
14576 (uintptr_t)xmit_hint, IP_DROP_ON_NO_DESC);
14577 } else {
14578 uintptr_t cookie;
14579
14580 if ((cookie = idd->idd_tx_df(idd->idd_tx_dh,
14581 mp, (uintptr_t)xmit_hint, 0)) != 0) {
14582 if (ixacookie != NULL)
14583 *ixacookie = cookie;
14584 return (EWOULDBLOCK);
14585 }
14586 }
14587 } else {
14588 wq = ill->ill_wq;
14589
14590 if (!(ixaflags & IXAF_NO_DEV_FLOW_CTL) &&
14591 !canputnext(wq)) {
14592 if (ixacookie != NULL)
14593 *ixacookie = 0;
14594 ip_xmit_flowctl_drop(ill, mp, fp_mp,
14595 nce->nce_fp_mp != NULL ?
14596 MBLKL(nce->nce_fp_mp) : 0);
14597 return (EWOULDBLOCK);
14598 }
14599 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits);
14600 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
14601 pkt_len);
14602 putnext(wq, mp);
14603 }
14604
14605 /*
14606 * The rest of this function implements Neighbor Unreachability
14607 * detection. Determine if the ncec is eligible for NUD.
14608 */
14609 if (ncec->ncec_flags & NCE_F_NONUD)
14610 return (0);
14611
14612 ASSERT(ncec->ncec_state != ND_INCOMPLETE);
14613
14614 /*
14615 * Check for upper layer advice
14616 */
14617 if (ixaflags & IXAF_REACH_CONF) {
14618 timeout_id_t tid;
14619
14620 /*
14621 * It should be o.k. to check the state without
14622 * a lock here, at most we lose an advice.
14623 */
14624 ncec->ncec_last = TICK_TO_MSEC(now);
14625 if (ncec->ncec_state != ND_REACHABLE) {
14626 mutex_enter(&ncec->ncec_lock);
14627 ncec->ncec_state = ND_REACHABLE;
14628 tid = ncec->ncec_timeout_id;
14629 ncec->ncec_timeout_id = 0;
14630 mutex_exit(&ncec->ncec_lock);
14631 (void) untimeout(tid);
14632 if (ip_debug > 2) {
14633 /* ip1dbg */
14634 pr_addr_dbg("ip_xmit: state"
14635 " for %s changed to"
14636 " REACHABLE\n", AF_INET6,
14637 &ncec->ncec_addr);
14638 }
14639 }
14640 return (0);
14641 }
14642
14643 delta = TICK_TO_MSEC(now) - ncec->ncec_last;
14644 ip1dbg(("ip_xmit: delta = %" PRId64
14645 " ill_reachable_time = %d \n", delta,
14646 ill->ill_reachable_time));
14647 if (delta > (uint64_t)ill->ill_reachable_time) {
14648 mutex_enter(&ncec->ncec_lock);
14649 switch (ncec->ncec_state) {
14650 case ND_REACHABLE:
14651 ASSERT((ncec->ncec_flags & NCE_F_NONUD) == 0);
14652 /* FALLTHROUGH */
14653 case ND_STALE:
14654 /*
14655 * ND_REACHABLE is identical to
14656 * ND_STALE in this specific case. If
14657 * reachable time has expired for this
14658 * neighbor (delta is greater than
14659 * reachable time), conceptually, the
14660 * neighbor cache is no longer in
14661 * REACHABLE state, but already in
14662 * STALE state. So the correct
14663 * transition here is to ND_DELAY.
14664 */
14665 ncec->ncec_state = ND_DELAY;
14666 mutex_exit(&ncec->ncec_lock);
14667 nce_restart_timer(ncec,
14668 ipst->ips_delay_first_probe_time);
14669 if (ip_debug > 3) {
14670 /* ip2dbg */
14671 pr_addr_dbg("ip_xmit: state"
14672 " for %s changed to"
14673 " DELAY\n", AF_INET6,
14674 &ncec->ncec_addr);
14675 }
14676 break;
14677 case ND_DELAY:
14678 case ND_PROBE:
14679 mutex_exit(&ncec->ncec_lock);
14680 /* Timers have already started */
14681 break;
14682 case ND_UNREACHABLE:
14683 /*
14684 * nce_timer has detected that this ncec
14685 * is unreachable and initiated deleting
14686 * this ncec.
14687 * This is a harmless race where we found the
14688 * ncec before it was deleted and have
14689 * just sent out a packet using this
14690 * unreachable ncec.
14691 */
14692 mutex_exit(&ncec->ncec_lock);
14693 break;
14694 default:
14695 ASSERT(0);
14696 mutex_exit(&ncec->ncec_lock);
14697 }
14698 }
14699 return (0);
14700
14701 case ND_INCOMPLETE:
14702 /*
14703 * the state could have changed since we didn't hold the lock.
14704 * Re-verify state under lock.
14705 */
14706 is_probe = ipmp_packet_is_probe(mp, nce->nce_ill);
14707 mutex_enter(&ncec->ncec_lock);
14708 if (NCE_ISREACHABLE(ncec)) {
14709 mutex_exit(&ncec->ncec_lock);
14710 goto sendit;
14711 }
14712 /* queue the packet */
14713 nce_queue_mp(ncec, mp, is_probe);
14714 mutex_exit(&ncec->ncec_lock);
14715 DTRACE_PROBE2(ip__xmit__incomplete,
14716 (ncec_t *), ncec, (mblk_t *), mp);
14717 return (0);
14718
14719 case ND_INITIAL:
14720 /*
14721 * State could have changed since we didn't hold the lock, so
14722 * re-verify state.
14723 */
14724 is_probe = ipmp_packet_is_probe(mp, nce->nce_ill);
14725 mutex_enter(&ncec->ncec_lock);
14726 if (NCE_ISREACHABLE(ncec)) {
14727 mutex_exit(&ncec->ncec_lock);
14728 goto sendit;
14729 }
14730 nce_queue_mp(ncec, mp, is_probe);
14731 if (ncec->ncec_state == ND_INITIAL) {
14732 ncec->ncec_state = ND_INCOMPLETE;
14733 mutex_exit(&ncec->ncec_lock);
14734 /*
14735 * figure out the source we want to use
14736 * and resolve it.
14737 */
14738 ip_ndp_resolve(ncec);
14739 } else {
14740 mutex_exit(&ncec->ncec_lock);
14741 }
14742 return (0);
14743
14744 case ND_UNREACHABLE:
14745 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
14746 ip_drop_output("ipIfStatsOutDiscards - ND_UNREACHABLE",
14747 mp, ill);
14748 freemsg(mp);
14749 return (0);
14750
14751 default:
14752 ASSERT(0);
14753 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
14754 ip_drop_output("ipIfStatsOutDiscards - ND_other",
14755 mp, ill);
14756 freemsg(mp);
14757 return (ENETUNREACH);
14758 }
14759 }
14760
14761 /*
14762 * Return B_TRUE if the buffers differ in length or content.
14763 * This is used for comparing extension header buffers.
14764 * Note that an extension header would be declared different
14765 * even if all that changed was the next header value in that header i.e.
14766 * what really changed is the next extension header.
14767 */
14768 boolean_t
14769 ip_cmpbuf(const void *abuf, uint_t alen, boolean_t b_valid, const void *bbuf,
14770 uint_t blen)
14771 {
14772 if (!b_valid)
14773 blen = 0;
14774
14775 if (alen != blen)
14776 return (B_TRUE);
14777 if (alen == 0)
14778 return (B_FALSE); /* Both zero length */
14779 return (bcmp(abuf, bbuf, alen));
14780 }
14781
14782 /*
14783 * Preallocate memory for ip_savebuf(). Returns B_TRUE if ok.
14784 * Return B_FALSE if memory allocation fails - don't change any state!
14785 */
14786 boolean_t
14787 ip_allocbuf(void **dstp, uint_t *dstlenp, boolean_t src_valid,
14788 const void *src, uint_t srclen)
14789 {
14790 void *dst;
14791
14792 if (!src_valid)
14793 srclen = 0;
14794
14795 ASSERT(*dstlenp == 0);
14796 if (src != NULL && srclen != 0) {
14797 dst = mi_alloc(srclen, BPRI_MED);
14798 if (dst == NULL)
14799 return (B_FALSE);
14800 } else {
14801 dst = NULL;
14802 }
14803 if (*dstp != NULL)
14804 mi_free(*dstp);
14805 *dstp = dst;
14806 *dstlenp = dst == NULL ? 0 : srclen;
14807 return (B_TRUE);
14808 }
14809
14810 /*
14811 * Replace what is in *dst, *dstlen with the source.
14812 * Assumes ip_allocbuf has already been called.
14813 */
14814 void
14815 ip_savebuf(void **dstp, uint_t *dstlenp, boolean_t src_valid,
14816 const void *src, uint_t srclen)
14817 {
14818 if (!src_valid)
14819 srclen = 0;
14820
14821 ASSERT(*dstlenp == srclen);
14822 if (src != NULL && srclen != 0)
14823 bcopy(src, *dstp, srclen);
14824 }
14825
14826 /*
14827 * Free the storage pointed to by the members of an ip_pkt_t.
14828 */
14829 void
14830 ip_pkt_free(ip_pkt_t *ipp)
14831 {
14832 uint_t fields = ipp->ipp_fields;
14833
14834 if (fields & IPPF_HOPOPTS) {
14835 kmem_free(ipp->ipp_hopopts, ipp->ipp_hopoptslen);
14836 ipp->ipp_hopopts = NULL;
14837 ipp->ipp_hopoptslen = 0;
14838 }
14839 if (fields & IPPF_RTHDRDSTOPTS) {
14840 kmem_free(ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
14841 ipp->ipp_rthdrdstopts = NULL;
14842 ipp->ipp_rthdrdstoptslen = 0;
14843 }
14844 if (fields & IPPF_DSTOPTS) {
14845 kmem_free(ipp->ipp_dstopts, ipp->ipp_dstoptslen);
14846 ipp->ipp_dstopts = NULL;
14847 ipp->ipp_dstoptslen = 0;
14848 }
14849 if (fields & IPPF_RTHDR) {
14850 kmem_free(ipp->ipp_rthdr, ipp->ipp_rthdrlen);
14851 ipp->ipp_rthdr = NULL;
14852 ipp->ipp_rthdrlen = 0;
14853 }
14854 if (fields & IPPF_IPV4_OPTIONS) {
14855 kmem_free(ipp->ipp_ipv4_options, ipp->ipp_ipv4_options_len);
14856 ipp->ipp_ipv4_options = NULL;
14857 ipp->ipp_ipv4_options_len = 0;
14858 }
14859 if (fields & IPPF_LABEL_V4) {
14860 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4);
14861 ipp->ipp_label_v4 = NULL;
14862 ipp->ipp_label_len_v4 = 0;
14863 }
14864 if (fields & IPPF_LABEL_V6) {
14865 kmem_free(ipp->ipp_label_v6, ipp->ipp_label_len_v6);
14866 ipp->ipp_label_v6 = NULL;
14867 ipp->ipp_label_len_v6 = 0;
14868 }
14869 ipp->ipp_fields &= ~(IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS |
14870 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6);
14871 }
14872
14873 /*
14874 * Copy from src to dst and allocate as needed.
14875 * Returns zero or ENOMEM.
14876 *
14877 * The caller must initialize dst to zero.
14878 */
14879 int
14880 ip_pkt_copy(ip_pkt_t *src, ip_pkt_t *dst, int kmflag)
14881 {
14882 uint_t fields = src->ipp_fields;
14883
14884 /* Start with fields that don't require memory allocation */
14885 dst->ipp_fields = fields &
14886 ~(IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS |
14887 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6);
14888
14889 dst->ipp_addr = src->ipp_addr;
14890 dst->ipp_unicast_hops = src->ipp_unicast_hops;
14891 dst->ipp_hoplimit = src->ipp_hoplimit;
14892 dst->ipp_tclass = src->ipp_tclass;
14893 dst->ipp_type_of_service = src->ipp_type_of_service;
14894
14895 if (!(fields & (IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS |
14896 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6)))
14897 return (0);
14898
14899 if (fields & IPPF_HOPOPTS) {
14900 dst->ipp_hopopts = kmem_alloc(src->ipp_hopoptslen, kmflag);
14901 if (dst->ipp_hopopts == NULL) {
14902 ip_pkt_free(dst);
14903 return (ENOMEM);
14904 }
14905 dst->ipp_fields |= IPPF_HOPOPTS;
14906 bcopy(src->ipp_hopopts, dst->ipp_hopopts,
14907 src->ipp_hopoptslen);
14908 dst->ipp_hopoptslen = src->ipp_hopoptslen;
14909 }
14910 if (fields & IPPF_RTHDRDSTOPTS) {
14911 dst->ipp_rthdrdstopts = kmem_alloc(src->ipp_rthdrdstoptslen,
14912 kmflag);
14913 if (dst->ipp_rthdrdstopts == NULL) {
14914 ip_pkt_free(dst);
14915 return (ENOMEM);
14916 }
14917 dst->ipp_fields |= IPPF_RTHDRDSTOPTS;
14918 bcopy(src->ipp_rthdrdstopts, dst->ipp_rthdrdstopts,
14919 src->ipp_rthdrdstoptslen);
14920 dst->ipp_rthdrdstoptslen = src->ipp_rthdrdstoptslen;
14921 }
14922 if (fields & IPPF_DSTOPTS) {
14923 dst->ipp_dstopts = kmem_alloc(src->ipp_dstoptslen, kmflag);
14924 if (dst->ipp_dstopts == NULL) {
14925 ip_pkt_free(dst);
14926 return (ENOMEM);
14927 }
14928 dst->ipp_fields |= IPPF_DSTOPTS;
14929 bcopy(src->ipp_dstopts, dst->ipp_dstopts,
14930 src->ipp_dstoptslen);
14931 dst->ipp_dstoptslen = src->ipp_dstoptslen;
14932 }
14933 if (fields & IPPF_RTHDR) {
14934 dst->ipp_rthdr = kmem_alloc(src->ipp_rthdrlen, kmflag);
14935 if (dst->ipp_rthdr == NULL) {
14936 ip_pkt_free(dst);
14937 return (ENOMEM);
14938 }
14939 dst->ipp_fields |= IPPF_RTHDR;
14940 bcopy(src->ipp_rthdr, dst->ipp_rthdr,
14941 src->ipp_rthdrlen);
14942 dst->ipp_rthdrlen = src->ipp_rthdrlen;
14943 }
14944 if (fields & IPPF_IPV4_OPTIONS) {
14945 dst->ipp_ipv4_options = kmem_alloc(src->ipp_ipv4_options_len,
14946 kmflag);
14947 if (dst->ipp_ipv4_options == NULL) {
14948 ip_pkt_free(dst);
14949 return (ENOMEM);
14950 }
14951 dst->ipp_fields |= IPPF_IPV4_OPTIONS;
14952 bcopy(src->ipp_ipv4_options, dst->ipp_ipv4_options,
14953 src->ipp_ipv4_options_len);
14954 dst->ipp_ipv4_options_len = src->ipp_ipv4_options_len;
14955 }
14956 if (fields & IPPF_LABEL_V4) {
14957 dst->ipp_label_v4 = kmem_alloc(src->ipp_label_len_v4, kmflag);
14958 if (dst->ipp_label_v4 == NULL) {
14959 ip_pkt_free(dst);
14960 return (ENOMEM);
14961 }
14962 dst->ipp_fields |= IPPF_LABEL_V4;
14963 bcopy(src->ipp_label_v4, dst->ipp_label_v4,
14964 src->ipp_label_len_v4);
14965 dst->ipp_label_len_v4 = src->ipp_label_len_v4;
14966 }
14967 if (fields & IPPF_LABEL_V6) {
14968 dst->ipp_label_v6 = kmem_alloc(src->ipp_label_len_v6, kmflag);
14969 if (dst->ipp_label_v6 == NULL) {
14970 ip_pkt_free(dst);
14971 return (ENOMEM);
14972 }
14973 dst->ipp_fields |= IPPF_LABEL_V6;
14974 bcopy(src->ipp_label_v6, dst->ipp_label_v6,
14975 src->ipp_label_len_v6);
14976 dst->ipp_label_len_v6 = src->ipp_label_len_v6;
14977 }
14978 if (fields & IPPF_FRAGHDR) {
14979 dst->ipp_fraghdr = kmem_alloc(src->ipp_fraghdrlen, kmflag);
14980 if (dst->ipp_fraghdr == NULL) {
14981 ip_pkt_free(dst);
14982 return (ENOMEM);
14983 }
14984 dst->ipp_fields |= IPPF_FRAGHDR;
14985 bcopy(src->ipp_fraghdr, dst->ipp_fraghdr,
14986 src->ipp_fraghdrlen);
14987 dst->ipp_fraghdrlen = src->ipp_fraghdrlen;
14988 }
14989 return (0);
14990 }
14991
14992 /*
14993 * Returns INADDR_ANY if no source route
14994 */
14995 ipaddr_t
14996 ip_pkt_source_route_v4(const ip_pkt_t *ipp)
14997 {
14998 ipaddr_t nexthop = INADDR_ANY;
14999 ipoptp_t opts;
15000 uchar_t *opt;
15001 uint8_t optval;
15002 uint8_t optlen;
15003 uint32_t totallen;
15004
15005 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
15006 return (INADDR_ANY);
15007
15008 totallen = ipp->ipp_ipv4_options_len;
15009 if (totallen & 0x3)
15010 return (INADDR_ANY);
15011
15012 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
15013 optval != IPOPT_EOL;
15014 optval = ipoptp_next(&opts)) {
15015 opt = opts.ipoptp_cur;
15016 switch (optval) {
15017 uint8_t off;
15018 case IPOPT_SSRR:
15019 case IPOPT_LSRR:
15020 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15021 break;
15022 }
15023 optlen = opts.ipoptp_len;
15024 off = opt[IPOPT_OFFSET];
15025 off--;
15026 if (optlen < IP_ADDR_LEN ||
15027 off > optlen - IP_ADDR_LEN) {
15028 /* End of source route */
15029 break;
15030 }
15031 bcopy((char *)opt + off, &nexthop, IP_ADDR_LEN);
15032 if (nexthop == htonl(INADDR_LOOPBACK)) {
15033 /* Ignore */
15034 nexthop = INADDR_ANY;
15035 break;
15036 }
15037 break;
15038 }
15039 }
15040 return (nexthop);
15041 }
15042
15043 /*
15044 * Reverse a source route.
15045 */
15046 void
15047 ip_pkt_source_route_reverse_v4(ip_pkt_t *ipp)
15048 {
15049 ipaddr_t tmp;
15050 ipoptp_t opts;
15051 uchar_t *opt;
15052 uint8_t optval;
15053 uint32_t totallen;
15054
15055 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
15056 return;
15057
15058 totallen = ipp->ipp_ipv4_options_len;
15059 if (totallen & 0x3)
15060 return;
15061
15062 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
15063 optval != IPOPT_EOL;
15064 optval = ipoptp_next(&opts)) {
15065 uint8_t off1, off2;
15066
15067 opt = opts.ipoptp_cur;
15068 switch (optval) {
15069 case IPOPT_SSRR:
15070 case IPOPT_LSRR:
15071 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15072 break;
15073 }
15074 off1 = IPOPT_MINOFF_SR - 1;
15075 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
15076 while (off2 > off1) {
15077 bcopy(opt + off2, &tmp, IP_ADDR_LEN);
15078 bcopy(opt + off1, opt + off2, IP_ADDR_LEN);
15079 bcopy(&tmp, opt + off2, IP_ADDR_LEN);
15080 off2 -= IP_ADDR_LEN;
15081 off1 += IP_ADDR_LEN;
15082 }
15083 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
15084 break;
15085 }
15086 }
15087 }
15088
15089 /*
15090 * Returns NULL if no routing header
15091 */
15092 in6_addr_t *
15093 ip_pkt_source_route_v6(const ip_pkt_t *ipp)
15094 {
15095 in6_addr_t *nexthop = NULL;
15096 ip6_rthdr0_t *rthdr;
15097
15098 if (!(ipp->ipp_fields & IPPF_RTHDR))
15099 return (NULL);
15100
15101 rthdr = (ip6_rthdr0_t *)ipp->ipp_rthdr;
15102 if (rthdr->ip6r0_segleft == 0)
15103 return (NULL);
15104
15105 nexthop = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
15106 return (nexthop);
15107 }
15108
15109 zoneid_t
15110 ip_get_zoneid_v4(ipaddr_t addr, mblk_t *mp, ip_recv_attr_t *ira,
15111 zoneid_t lookup_zoneid)
15112 {
15113 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
15114 ire_t *ire;
15115 int ire_flags = MATCH_IRE_TYPE;
15116 zoneid_t zoneid = ALL_ZONES;
15117
15118 if (is_system_labeled() && !tsol_can_accept_raw(mp, ira, B_FALSE))
15119 return (ALL_ZONES);
15120
15121 if (lookup_zoneid != ALL_ZONES)
15122 ire_flags |= MATCH_IRE_ZONEONLY;
15123 ire = ire_ftable_lookup_v4(addr, NULL, NULL, IRE_LOCAL | IRE_LOOPBACK,
15124 NULL, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL);
15125 if (ire != NULL) {
15126 zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst);
15127 ire_refrele(ire);
15128 }
15129 return (zoneid);
15130 }
15131
15132 zoneid_t
15133 ip_get_zoneid_v6(in6_addr_t *addr, mblk_t *mp, const ill_t *ill,
15134 ip_recv_attr_t *ira, zoneid_t lookup_zoneid)
15135 {
15136 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
15137 ire_t *ire;
15138 int ire_flags = MATCH_IRE_TYPE;
15139 zoneid_t zoneid = ALL_ZONES;
15140
15141 if (is_system_labeled() && !tsol_can_accept_raw(mp, ira, B_FALSE))
15142 return (ALL_ZONES);
15143
15144 if (IN6_IS_ADDR_LINKLOCAL(addr))
15145 ire_flags |= MATCH_IRE_ILL;
15146
15147 if (lookup_zoneid != ALL_ZONES)
15148 ire_flags |= MATCH_IRE_ZONEONLY;
15149 ire = ire_ftable_lookup_v6(addr, NULL, NULL, IRE_LOCAL | IRE_LOOPBACK,
15150 ill, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL);
15151 if (ire != NULL) {
15152 zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst);
15153 ire_refrele(ire);
15154 }
15155 return (zoneid);
15156 }
15157
15158 /*
15159 * IP obserability hook support functions.
15160 */
15161 static void
15162 ipobs_init(ip_stack_t *ipst)
15163 {
15164 netid_t id;
15165
15166 id = net_getnetidbynetstackid(ipst->ips_netstack->netstack_stackid);
15167
15168 ipst->ips_ip4_observe_pr = net_protocol_lookup(id, NHF_INET);
15169 VERIFY(ipst->ips_ip4_observe_pr != NULL);
15170
15171 ipst->ips_ip6_observe_pr = net_protocol_lookup(id, NHF_INET6);
15172 VERIFY(ipst->ips_ip6_observe_pr != NULL);
15173 }
15174
15175 static void
15176 ipobs_fini(ip_stack_t *ipst)
15177 {
15178
15179 VERIFY(net_protocol_release(ipst->ips_ip4_observe_pr) == 0);
15180 VERIFY(net_protocol_release(ipst->ips_ip6_observe_pr) == 0);
15181 }
15182
15183 /*
15184 * hook_pkt_observe_t is composed in network byte order so that the
15185 * entire mblk_t chain handed into hook_run can be used as-is.
15186 * The caveat is that use of the fields, such as the zone fields,
15187 * requires conversion into host byte order first.
15188 */
15189 void
15190 ipobs_hook(mblk_t *mp, int htype, zoneid_t zsrc, zoneid_t zdst,
15191 const ill_t *ill, ip_stack_t *ipst)
15192 {
15193 hook_pkt_observe_t *hdr;
15194 uint64_t grifindex;
15195 mblk_t *imp;
15196
15197 imp = allocb(sizeof (*hdr), BPRI_HI);
15198 if (imp == NULL)
15199 return;
15200
15201 hdr = (hook_pkt_observe_t *)imp->b_rptr;
15202 /*
15203 * b_wptr is set to make the apparent size of the data in the mblk_t
15204 * to exclude the pointers at the end of hook_pkt_observer_t.
15205 */
15206 imp->b_wptr = imp->b_rptr + sizeof (dl_ipnetinfo_t);
15207 imp->b_cont = mp;
15208
15209 ASSERT(DB_TYPE(mp) == M_DATA);
15210
15211 if (IS_UNDER_IPMP(ill))
15212 grifindex = ipmp_ill_get_ipmp_ifindex(ill);
15213 else
15214 grifindex = 0;
15215
15216 hdr->hpo_version = 1;
15217 hdr->hpo_htype = htons(htype);
15218 hdr->hpo_pktlen = htonl((ulong_t)msgdsize(mp));
15219 hdr->hpo_ifindex = htonl(ill->ill_phyint->phyint_ifindex);
15220 hdr->hpo_grifindex = htonl(grifindex);
15221 hdr->hpo_zsrc = htonl(zsrc);
15222 hdr->hpo_zdst = htonl(zdst);
15223 hdr->hpo_pkt = imp;
15224 hdr->hpo_ctx = ipst->ips_netstack;
15225
15226 if (ill->ill_isv6) {
15227 hdr->hpo_family = AF_INET6;
15228 (void) hook_run(ipst->ips_ipv6_net_data->netd_hooks,
15229 ipst->ips_ipv6observing, (hook_data_t)hdr);
15230 } else {
15231 hdr->hpo_family = AF_INET;
15232 (void) hook_run(ipst->ips_ipv4_net_data->netd_hooks,
15233 ipst->ips_ipv4observing, (hook_data_t)hdr);
15234 }
15235
15236 imp->b_cont = NULL;
15237 freemsg(imp);
15238 }
15239
15240 /*
15241 * Utility routine that checks if `v4srcp' is a valid address on underlying
15242 * interface `ill'. If `ipifp' is non-NULL, it's set to a held ipif
15243 * associated with `v4srcp' on success. NOTE: if this is not called from
15244 * inside the IPSQ (ill_g_lock is not held), `ill' may be removed from the
15245 * group during or after this lookup.
15246 */
15247 boolean_t
15248 ipif_lookup_testaddr_v4(ill_t *ill, const in_addr_t *v4srcp, ipif_t **ipifp)
15249 {
15250 ipif_t *ipif;
15251
15252 ipif = ipif_lookup_addr_exact(*v4srcp, ill, ill->ill_ipst);
15253 if (ipif != NULL) {
15254 if (ipifp != NULL)
15255 *ipifp = ipif;
15256 else
15257 ipif_refrele(ipif);
15258 return (B_TRUE);
15259 }
15260
15261 ip1dbg(("ipif_lookup_testaddr_v4: cannot find ipif for src %x\n",
15262 *v4srcp));
15263 return (B_FALSE);
15264 }
15265
15266 /*
15267 * Transport protocol call back function for CPU state change.
15268 */
15269 /* ARGSUSED */
15270 static int
15271 ip_tp_cpu_update(cpu_setup_t what, int id, void *arg)
15272 {
15273 processorid_t cpu_seqid;
15274 netstack_handle_t nh;
15275 netstack_t *ns;
15276
15277 ASSERT(MUTEX_HELD(&cpu_lock));
15278
15279 switch (what) {
15280 case CPU_CONFIG:
15281 case CPU_ON:
15282 case CPU_INIT:
15283 case CPU_CPUPART_IN:
15284 cpu_seqid = cpu[id]->cpu_seqid;
15285 netstack_next_init(&nh);
15286 while ((ns = netstack_next(&nh)) != NULL) {
15287 dccp_stack_cpu_add(ns->netstack_dccp, cpu_seqid);
15288 tcp_stack_cpu_add(ns->netstack_tcp, cpu_seqid);
15289 sctp_stack_cpu_add(ns->netstack_sctp, cpu_seqid);
15290 udp_stack_cpu_add(ns->netstack_udp, cpu_seqid);
15291 netstack_rele(ns);
15292 }
15293 netstack_next_fini(&nh);
15294 break;
15295 case CPU_UNCONFIG:
15296 case CPU_OFF:
15297 case CPU_CPUPART_OUT:
15298 /*
15299 * Nothing to do. We don't remove the per CPU stats from
15300 * the IP stack even when the CPU goes offline.
15301 */
15302 break;
15303 default:
15304 break;
15305 }
15306 return (0);
15307 }