1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright (c) 2013 by Delphix. All rights reserved.
  24  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
  25  */
  26 /* Copyright (c) 1990 Mentat Inc. */
  27 
  28 #include <sys/types.h>
  29 #include <sys/stream.h>
  30 #include <sys/stropts.h>
  31 #include <sys/strlog.h>
  32 #include <sys/strsun.h>
  33 #define _SUN_TPI_VERSION 2
  34 #include <sys/tihdr.h>
  35 #include <sys/timod.h>
  36 #include <sys/ddi.h>
  37 #include <sys/sunddi.h>
  38 #include <sys/strsubr.h>
  39 #include <sys/suntpi.h>
  40 #include <sys/xti_inet.h>
  41 #include <sys/cmn_err.h>
  42 #include <sys/kmem.h>
  43 #include <sys/cred.h>
  44 #include <sys/policy.h>
  45 #include <sys/priv.h>
  46 #include <sys/ucred.h>
  47 #include <sys/zone.h>
  48 
  49 #include <sys/sockio.h>
  50 #include <sys/socket.h>
  51 #include <sys/socketvar.h>
  52 #include <sys/vtrace.h>
  53 #include <sys/sdt.h>
  54 #include <sys/debug.h>
  55 #include <sys/isa_defs.h>
  56 #include <sys/random.h>
  57 #include <netinet/in.h>
  58 #include <netinet/ip6.h>
  59 #include <netinet/icmp6.h>
  60 #include <netinet/udp.h>
  61 
  62 #include <inet/common.h>
  63 #include <inet/ip.h>
  64 #include <inet/ip_impl.h>
  65 #include <inet/ipsec_impl.h>
  66 #include <inet/ip6.h>
  67 #include <inet/ip_ire.h>
  68 #include <inet/ip_if.h>
  69 #include <inet/ip_multi.h>
  70 #include <inet/ip_ndp.h>
  71 #include <inet/proto_set.h>
  72 #include <inet/mib2.h>
  73 #include <inet/nd.h>
  74 #include <inet/optcom.h>
  75 #include <inet/snmpcom.h>
  76 #include <inet/kstatcom.h>
  77 #include <inet/ipclassifier.h>
  78 
  79 #include <sys/tsol/label.h>
  80 #include <sys/tsol/tnet.h>
  81 
  82 #include <inet/rawip_impl.h>
  83 
  84 #include <sys/disp.h>
  85 
  86 /*
  87  * Synchronization notes:
  88  *
  89  * RAWIP is MT and uses the usual kernel synchronization primitives. We use
  90  * conn_lock to protect the icmp_t.
  91  *
  92  * Plumbing notes:
  93  * ICMP is always a device driver. For compatibility with mibopen() code
  94  * it is possible to I_PUSH "icmp", but that results in pushing a passthrough
  95  * dummy module.
  96  */
  97 static void     icmp_addr_req(queue_t *q, mblk_t *mp);
  98 static void     icmp_tpi_bind(queue_t *q, mblk_t *mp);
  99 static void     icmp_bind_proto(icmp_t *icmp);
 100 static int      icmp_build_hdr_template(conn_t *, const in6_addr_t *,
 101     const in6_addr_t *, uint32_t);
 102 static void     icmp_capability_req(queue_t *q, mblk_t *mp);
 103 static int      icmp_close(queue_t *q, int flags, cred_t *);
 104 static void     icmp_close_free(conn_t *);
 105 static void     icmp_tpi_connect(queue_t *q, mblk_t *mp);
 106 static void     icmp_tpi_disconnect(queue_t *q, mblk_t *mp);
 107 static void     icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
 108     int sys_error);
 109 static void     icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
 110     t_scalar_t tlierr, int sys_error);
 111 static void     icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2,
 112     ip_recv_attr_t *);
 113 static void     icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
 114     ip_recv_attr_t *);
 115 static void     icmp_info_req(queue_t *q, mblk_t *mp);
 116 static void     icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 117 static conn_t   *icmp_open(int family, cred_t *credp, int *err, int flags);
 118 static int      icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
 119                     cred_t *credp);
 120 static int      icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
 121                     cred_t *credp);
 122 static boolean_t icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
 123 int             icmp_opt_set(conn_t *connp, uint_t optset_context,
 124                     int level, int name, uint_t inlen,
 125                     uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
 126                     void *thisdg_attrs, cred_t *cr);
 127 int             icmp_opt_get(conn_t *connp, int level, int name,
 128                     uchar_t *ptr);
 129 static int      icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
 130                     sin6_t *sin6, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa);
 131 static mblk_t   *icmp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
 132     const in6_addr_t *, const in6_addr_t *, uint32_t, mblk_t *, int *);
 133 static mblk_t   *icmp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
 134     mblk_t *, const in6_addr_t *, uint32_t, int *);
 135 static int      icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
 136                     uchar_t *ptr, int len);
 137 static void     icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
 138 static void     icmp_tpi_unbind(queue_t *q, mblk_t *mp);
 139 static int      icmp_wput(queue_t *q, mblk_t *mp);
 140 static int      icmp_wput_fallback(queue_t *q, mblk_t *mp);
 141 static void     icmp_wput_other(queue_t *q, mblk_t *mp);
 142 static void     icmp_wput_iocdata(queue_t *q, mblk_t *mp);
 143 static void     icmp_wput_restricted(queue_t *q, mblk_t *mp);
 144 static void     icmp_ulp_recv(conn_t *, mblk_t *, uint_t);
 145 
 146 static void     *rawip_stack_init(netstackid_t stackid, netstack_t *ns);
 147 static void     rawip_stack_fini(netstackid_t stackid, void *arg);
 148 
 149 static void     *rawip_kstat_init(netstackid_t stackid);
 150 static void     rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp);
 151 static int      rawip_kstat_update(kstat_t *kp, int rw);
 152 static void     rawip_stack_shutdown(netstackid_t stackid, void *arg);
 153 
 154 /* Common routines for TPI and socket module */
 155 static conn_t   *rawip_do_open(int, cred_t *, int *, int);
 156 static void     rawip_do_close(conn_t *);
 157 static int      rawip_do_bind(conn_t *, struct sockaddr *, socklen_t);
 158 static int      rawip_do_unbind(conn_t *);
 159 static int      rawip_do_connect(conn_t *, const struct sockaddr *, socklen_t,
 160     cred_t *, pid_t);
 161 
 162 int             rawip_getsockname(sock_lower_handle_t, struct sockaddr *,
 163                     socklen_t *, cred_t *);
 164 int             rawip_getpeername(sock_lower_handle_t, struct sockaddr *,
 165                     socklen_t *, cred_t *);
 166 
 167 static struct module_info icmp_mod_info =  {
 168         5707, "icmp", 1, INFPSZ, 512, 128
 169 };
 170 
 171 /*
 172  * Entry points for ICMP as a device.
 173  * We have separate open functions for the /dev/icmp and /dev/icmp6 devices.
 174  */
 175 static struct qinit icmprinitv4 = {
 176         NULL, NULL, icmp_openv4, icmp_close, NULL, &icmp_mod_info
 177 };
 178 
 179 static struct qinit icmprinitv6 = {
 180         NULL, NULL, icmp_openv6, icmp_close, NULL, &icmp_mod_info
 181 };
 182 
 183 static struct qinit icmpwinit = {
 184         icmp_wput, ip_wsrv, NULL, NULL, NULL, &icmp_mod_info
 185 };
 186 
 187 /* ICMP entry point during fallback */
 188 static struct qinit icmp_fallback_sock_winit = {
 189         icmp_wput_fallback, NULL, NULL, NULL, NULL, &icmp_mod_info
 190 };
 191 
 192 /* For AF_INET aka /dev/icmp */
 193 struct streamtab icmpinfov4 = {
 194         &icmprinitv4, &icmpwinit
 195 };
 196 
 197 /* For AF_INET6 aka /dev/icmp6 */
 198 struct streamtab icmpinfov6 = {
 199         &icmprinitv6, &icmpwinit
 200 };
 201 
 202 /* Default structure copied into T_INFO_ACK messages */
 203 static struct T_info_ack icmp_g_t_info_ack = {
 204         T_INFO_ACK,
 205         IP_MAXPACKET,    /* TSDU_size.  icmp allows maximum size messages. */
 206         T_INVALID,      /* ETSDU_size.  icmp does not support expedited data. */
 207         T_INVALID,      /* CDATA_size. icmp does not support connect data. */
 208         T_INVALID,      /* DDATA_size. icmp does not support disconnect data. */
 209         0,              /* ADDR_size - filled in later. */
 210         0,              /* OPT_size - not initialized here */
 211         IP_MAXPACKET,   /* TIDU_size.  icmp allows maximum size messages. */
 212         T_CLTS,         /* SERV_type.  icmp supports connection-less. */
 213         TS_UNBND,       /* CURRENT_state.  This is set from icmp_state. */
 214         (XPG4_1|SENDZERO) /* PROVIDER_flag */
 215 };
 216 
 217 static int
 218 icmp_set_buf_prop(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
 219     const char *ifname, const void *pval, uint_t flags)
 220 {
 221         return (mod_set_buf_prop(stack->netstack_icmp->is_propinfo_tbl,
 222             stack, cr, pinfo, ifname, pval, flags));
 223 }
 224 
 225 static int
 226 icmp_get_buf_prop(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
 227     void *val, uint_t psize, uint_t flags)
 228 {
 229         return (mod_get_buf_prop(stack->netstack_icmp->is_propinfo_tbl, stack,
 230             pinfo, ifname, val, psize, flags));
 231 }
 232 
 233 /*
 234  * All of these are alterable, within the min/max values given, at run time.
 235  *
 236  * Note: All those tunables which do not start with "icmp_" are Committed and
 237  * therefore are public. See PSARC 2010/080.
 238  */
 239 static mod_prop_info_t icmp_propinfo_tbl[] = {
 240         /* tunable - 0 */
 241         { "_wroff_extra", MOD_PROTO_RAWIP,
 242             mod_set_uint32, mod_get_uint32,
 243             {0, 128, 32}, {32} },
 244 
 245         { "_ipv4_ttl", MOD_PROTO_RAWIP,
 246             mod_set_uint32, mod_get_uint32,
 247             {1, 255, 255}, {255} },
 248 
 249         { "_ipv6_hoplimit", MOD_PROTO_RAWIP,
 250             mod_set_uint32, mod_get_uint32,
 251             {0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS},
 252             {IPV6_DEFAULT_HOPS} },
 253 
 254         { "_bsd_compat", MOD_PROTO_RAWIP,
 255             mod_set_boolean, mod_get_boolean,
 256             {B_TRUE}, {B_TRUE} },
 257 
 258         { "send_buf", MOD_PROTO_RAWIP,
 259             icmp_set_buf_prop, icmp_get_buf_prop,
 260             {4096, 65536, 8192}, {8192} },
 261 
 262         { "_xmit_lowat", MOD_PROTO_RAWIP,
 263             mod_set_uint32, mod_get_uint32,
 264             {0, 65536, 1024}, {1024} },
 265 
 266         { "recv_buf", MOD_PROTO_RAWIP,
 267             icmp_set_buf_prop, icmp_get_buf_prop,
 268             {4096, 65536, 8192}, {8192} },
 269 
 270         { "max_buf", MOD_PROTO_RAWIP,
 271             mod_set_uint32, mod_get_uint32,
 272             {65536, ULP_MAX_BUF, 256*1024}, {256*1024} },
 273 
 274         { "_pmtu_discovery", MOD_PROTO_RAWIP,
 275             mod_set_boolean, mod_get_boolean,
 276             {B_FALSE}, {B_FALSE} },
 277 
 278         { "_sendto_ignerr", MOD_PROTO_RAWIP,
 279             mod_set_boolean, mod_get_boolean,
 280             {B_FALSE}, {B_FALSE} },
 281 
 282         { "?", MOD_PROTO_RAWIP, NULL, mod_get_allprop, {0}, {0} },
 283 
 284         { NULL, 0, NULL, NULL, {0}, {0} }
 285 };
 286 
 287 #define is_wroff_extra                  is_propinfo_tbl[0].prop_cur_uval
 288 #define is_ipv4_ttl                     is_propinfo_tbl[1].prop_cur_uval
 289 #define is_ipv6_hoplimit                is_propinfo_tbl[2].prop_cur_uval
 290 #define is_bsd_compat                   is_propinfo_tbl[3].prop_cur_bval
 291 #define is_xmit_hiwat                   is_propinfo_tbl[4].prop_cur_uval
 292 #define is_xmit_lowat                   is_propinfo_tbl[5].prop_cur_uval
 293 #define is_recv_hiwat                   is_propinfo_tbl[6].prop_cur_uval
 294 #define is_max_buf                      is_propinfo_tbl[7].prop_cur_uval
 295 #define is_pmtu_discovery               is_propinfo_tbl[8].prop_cur_bval
 296 #define is_sendto_ignerr                is_propinfo_tbl[9].prop_cur_bval
 297 
 298 typedef union T_primitives *t_primp_t;
 299 
 300 /*
 301  * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
 302  * passed to icmp_wput.
 303  * It calls IP to verify the local IP address, and calls IP to insert
 304  * the conn_t in the fanout table.
 305  * If everything is ok it then sends the T_BIND_ACK back up.
 306  */
 307 static void
 308 icmp_tpi_bind(queue_t *q, mblk_t *mp)
 309 {
 310         int     error;
 311         struct sockaddr *sa;
 312         struct T_bind_req *tbr;
 313         socklen_t       len;
 314         sin_t   *sin;
 315         sin6_t  *sin6;
 316         icmp_t          *icmp;
 317         conn_t  *connp = Q_TO_CONN(q);
 318         mblk_t *mp1;
 319         cred_t *cr;
 320 
 321         /*
 322          * All Solaris components should pass a db_credp
 323          * for this TPI message, hence we ASSERT.
 324          * But in case there is some other M_PROTO that looks
 325          * like a TPI message sent by some other kernel
 326          * component, we check and return an error.
 327          */
 328         cr = msg_getcred(mp, NULL);
 329         ASSERT(cr != NULL);
 330         if (cr == NULL) {
 331                 icmp_err_ack(q, mp, TSYSERR, EINVAL);
 332                 return;
 333         }
 334 
 335         icmp = connp->conn_icmp;
 336         if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
 337                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 338                     "icmp_bind: bad req, len %u",
 339                     (uint_t)(mp->b_wptr - mp->b_rptr));
 340                 icmp_err_ack(q, mp, TPROTO, 0);
 341                 return;
 342         }
 343 
 344         if (icmp->icmp_state != TS_UNBND) {
 345                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 346                     "icmp_bind: bad state, %u", icmp->icmp_state);
 347                 icmp_err_ack(q, mp, TOUTSTATE, 0);
 348                 return;
 349         }
 350 
 351         /*
 352          * Reallocate the message to make sure we have enough room for an
 353          * address.
 354          */
 355         mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
 356         if (mp1 == NULL) {
 357                 icmp_err_ack(q, mp, TSYSERR, ENOMEM);
 358                 return;
 359         }
 360         mp = mp1;
 361 
 362         /* Reset the message type in preparation for shipping it back. */
 363         DB_TYPE(mp) = M_PCPROTO;
 364         tbr = (struct T_bind_req *)mp->b_rptr;
 365         len = tbr->ADDR_length;
 366         switch (len) {
 367         case 0: /* request for a generic port */
 368                 tbr->ADDR_offset = sizeof (struct T_bind_req);
 369                 if (connp->conn_family == AF_INET) {
 370                         tbr->ADDR_length = sizeof (sin_t);
 371                         sin = (sin_t *)&tbr[1];
 372                         *sin = sin_null;
 373                         sin->sin_family = AF_INET;
 374                         mp->b_wptr = (uchar_t *)&sin[1];
 375                         sa = (struct sockaddr *)sin;
 376                         len = sizeof (sin_t);
 377                 } else {
 378                         ASSERT(connp->conn_family == AF_INET6);
 379                         tbr->ADDR_length = sizeof (sin6_t);
 380                         sin6 = (sin6_t *)&tbr[1];
 381                         *sin6 = sin6_null;
 382                         sin6->sin6_family = AF_INET6;
 383                         mp->b_wptr = (uchar_t *)&sin6[1];
 384                         sa = (struct sockaddr *)sin6;
 385                         len = sizeof (sin6_t);
 386                 }
 387                 break;
 388 
 389         case sizeof (sin_t):    /* Complete IPv4 address */
 390                 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
 391                     sizeof (sin_t));
 392                 break;
 393 
 394         case sizeof (sin6_t):   /* Complete IPv6 address */
 395                 sa = (struct sockaddr *)mi_offset_param(mp,
 396                     tbr->ADDR_offset, sizeof (sin6_t));
 397                 break;
 398 
 399         default:
 400                 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
 401                     "icmp_bind: bad ADDR_length %u", tbr->ADDR_length);
 402                 icmp_err_ack(q, mp, TBADADDR, 0);
 403                 return;
 404         }
 405 
 406         error = rawip_do_bind(connp, sa, len);
 407         if (error != 0) {
 408                 if (error > 0) {
 409                         icmp_err_ack(q, mp, TSYSERR, error);
 410                 } else {
 411                         icmp_err_ack(q, mp, -error, 0);
 412                 }
 413         } else {
 414                 tbr->PRIM_type = T_BIND_ACK;
 415                 qreply(q, mp);
 416         }
 417 }
 418 
 419 static int
 420 rawip_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len)
 421 {
 422         sin_t           *sin;
 423         sin6_t          *sin6;
 424         icmp_t          *icmp = connp->conn_icmp;
 425         int             error = 0;
 426         ip_laddr_t      laddr_type = IPVL_UNICAST_UP;   /* INADDR_ANY */
 427         in_port_t       lport;          /* Network byte order */
 428         ipaddr_t        v4src;          /* Set if AF_INET */
 429         in6_addr_t      v6src;
 430         uint_t          scopeid = 0;
 431         zoneid_t        zoneid = IPCL_ZONEID(connp);
 432         ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;
 433 
 434         if (sa == NULL || !OK_32PTR((char *)sa)) {
 435                 return (EINVAL);
 436         }
 437 
 438         switch (len) {
 439         case sizeof (sin_t):    /* Complete IPv4 address */
 440                 sin = (sin_t *)sa;
 441                 if (sin->sin_family != AF_INET ||
 442                     connp->conn_family != AF_INET) {
 443                         /* TSYSERR, EAFNOSUPPORT */
 444                         return (EAFNOSUPPORT);
 445                 }
 446                 v4src = sin->sin_addr.s_addr;
 447                 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
 448                 if (v4src != INADDR_ANY) {
 449                         laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
 450                             B_TRUE);
 451                 }
 452                 lport = sin->sin_port;
 453                 break;
 454         case sizeof (sin6_t): /* Complete IPv6 address */
 455                 sin6 = (sin6_t *)sa;
 456                 if (sin6->sin6_family != AF_INET6 ||
 457                     connp->conn_family != AF_INET6) {
 458                         /* TSYSERR, EAFNOSUPPORT */
 459                         return (EAFNOSUPPORT);
 460                 }
 461                 /* No support for mapped addresses on raw sockets */
 462                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
 463                         /* TSYSERR, EADDRNOTAVAIL */
 464                         return (EADDRNOTAVAIL);
 465                 }
 466                 v6src = sin6->sin6_addr;
 467                 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
 468                         if (IN6_IS_ADDR_LINKSCOPE(&v6src))
 469                                 scopeid = sin6->sin6_scope_id;
 470                         laddr_type = ip_laddr_verify_v6(&v6src, zoneid, ipst,
 471                             B_TRUE, scopeid);
 472                 }
 473                 lport = sin6->sin6_port;
 474                 break;
 475 
 476         default:
 477                 /* TBADADDR */
 478                 return (EADDRNOTAVAIL);
 479         }
 480 
 481         /* Is the local address a valid unicast, multicast, or broadcast? */
 482         if (laddr_type == IPVL_BAD)
 483                 return (EADDRNOTAVAIL);
 484 
 485         /*
 486          * The state must be TS_UNBND.
 487          */
 488         mutex_enter(&connp->conn_lock);
 489         if (icmp->icmp_state != TS_UNBND) {
 490                 mutex_exit(&connp->conn_lock);
 491                 return (-TOUTSTATE);
 492         }
 493 
 494         /*
 495          * Copy the source address into our icmp structure.  This address
 496          * may still be zero; if so, ip will fill in the correct address
 497          * each time an outbound packet is passed to it.
 498          * If we are binding to a broadcast or multicast address then
 499          * we just set the conn_bound_addr since we don't want to use
 500          * that as the source address when sending.
 501          */
 502         connp->conn_bound_addr_v6 = v6src;
 503         connp->conn_laddr_v6 = v6src;
 504         if (scopeid != 0) {
 505                 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
 506                 connp->conn_ixa->ixa_scopeid = scopeid;
 507                 connp->conn_incoming_ifindex = scopeid;
 508         } else {
 509                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
 510                 connp->conn_incoming_ifindex = connp->conn_bound_if;
 511         }
 512 
 513         switch (laddr_type) {
 514         case IPVL_UNICAST_UP:
 515         case IPVL_UNICAST_DOWN:
 516                 connp->conn_saddr_v6 = v6src;
 517                 connp->conn_mcbc_bind = B_FALSE;
 518                 break;
 519         case IPVL_MCAST:
 520         case IPVL_BCAST:
 521                 /* ip_set_destination will pick a source address later */
 522                 connp->conn_saddr_v6 = ipv6_all_zeros;
 523                 connp->conn_mcbc_bind = B_TRUE;
 524                 break;
 525         }
 526 
 527         /* Any errors after this point should use late_error */
 528 
 529         /*
 530          * Use sin_port/sin6_port since applications like psh use SOCK_RAW
 531          * with IPPROTO_TCP.
 532          */
 533         connp->conn_lport = lport;
 534         connp->conn_fport = 0;
 535 
 536         if (connp->conn_family == AF_INET) {
 537                 ASSERT(connp->conn_ipversion == IPV4_VERSION);
 538         } else {
 539                 ASSERT(connp->conn_ipversion == IPV6_VERSION);
 540         }
 541 
 542         icmp->icmp_state = TS_IDLE;
 543 
 544         /*
 545          * We create an initial header template here to make a subsequent
 546          * sendto have a starting point. Since conn_last_dst is zero the
 547          * first sendto will always follow the 'dst changed' code path.
 548          * Note that we defer massaging options and the related checksum
 549          * adjustment until we have a destination address.
 550          */
 551         error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
 552             &connp->conn_faddr_v6, connp->conn_flowinfo);
 553         if (error != 0) {
 554                 mutex_exit(&connp->conn_lock);
 555                 goto late_error;
 556         }
 557         /* Just in case */
 558         connp->conn_faddr_v6 = ipv6_all_zeros;
 559         connp->conn_v6lastdst = ipv6_all_zeros;
 560         mutex_exit(&connp->conn_lock);
 561 
 562         error = ip_laddr_fanout_insert(connp);
 563         if (error != 0)
 564                 goto late_error;
 565 
 566         /* Bind succeeded */
 567         return (0);
 568 
 569 late_error:
 570         mutex_enter(&connp->conn_lock);
 571         connp->conn_saddr_v6 = ipv6_all_zeros;
 572         connp->conn_bound_addr_v6 = ipv6_all_zeros;
 573         connp->conn_laddr_v6 = ipv6_all_zeros;
 574         if (scopeid != 0) {
 575                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
 576                 connp->conn_incoming_ifindex = connp->conn_bound_if;
 577         }
 578         icmp->icmp_state = TS_UNBND;
 579         connp->conn_v6lastdst = ipv6_all_zeros;
 580         connp->conn_lport = 0;
 581 
 582         /* Restore the header that was built above - different source address */
 583         (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
 584             &connp->conn_faddr_v6, connp->conn_flowinfo);
 585         mutex_exit(&connp->conn_lock);
 586         return (error);
 587 }
 588 
 589 /*
 590  * Tell IP to just bind to the protocol.
 591  */
 592 static void
 593 icmp_bind_proto(icmp_t *icmp)
 594 {
 595         conn_t  *connp = icmp->icmp_connp;
 596 
 597         mutex_enter(&connp->conn_lock);
 598         connp->conn_saddr_v6 = ipv6_all_zeros;
 599         connp->conn_laddr_v6 = ipv6_all_zeros;
 600         connp->conn_faddr_v6 = ipv6_all_zeros;
 601         connp->conn_v6lastdst = ipv6_all_zeros;
 602         mutex_exit(&connp->conn_lock);
 603 
 604         (void) ip_laddr_fanout_insert(connp);
 605 }
 606 
 607 /*
 608  * This routine handles each T_CONN_REQ message passed to icmp.  It
 609  * associates a default destination address with the stream.
 610  *
 611  * After various error checks are completed, icmp_connect() lays
 612  * the target address and port into the composite header template.
 613  * Then we ask IP for information, including a source address if we didn't
 614  * already have one. Finally we send up the T_OK_ACK reply message.
 615  */
 616 static void
 617 icmp_tpi_connect(queue_t *q, mblk_t *mp)
 618 {
 619         conn_t  *connp = Q_TO_CONN(q);
 620         struct T_conn_req       *tcr;
 621         struct sockaddr *sa;
 622         socklen_t len;
 623         int error;
 624         cred_t *cr;
 625         pid_t pid;
 626         /*
 627          * All Solaris components should pass a db_credp
 628          * for this TPI message, hence we ASSERT.
 629          * But in case there is some other M_PROTO that looks
 630          * like a TPI message sent by some other kernel
 631          * component, we check and return an error.
 632          */
 633         cr = msg_getcred(mp, &pid);
 634         ASSERT(cr != NULL);
 635         if (cr == NULL) {
 636                 icmp_err_ack(q, mp, TSYSERR, EINVAL);
 637                 return;
 638         }
 639 
 640         tcr = (struct T_conn_req *)mp->b_rptr;
 641         /* Sanity checks */
 642         if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
 643                 icmp_err_ack(q, mp, TPROTO, 0);
 644                 return;
 645         }
 646 
 647         if (tcr->OPT_length != 0) {
 648                 icmp_err_ack(q, mp, TBADOPT, 0);
 649                 return;
 650         }
 651 
 652         len = tcr->DEST_length;
 653 
 654         switch (len) {
 655         default:
 656                 icmp_err_ack(q, mp, TBADADDR, 0);
 657                 return;
 658         case sizeof (sin_t):
 659                 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
 660                     sizeof (sin_t));
 661                 break;
 662         case sizeof (sin6_t):
 663                 sa = (struct sockaddr *)mi_offset_param(mp,
 664                     tcr->DEST_offset, sizeof (sin6_t));
 665                 break;
 666         }
 667 
 668         error = proto_verify_ip_addr(connp->conn_family, sa, len);
 669         if (error != 0) {
 670                 icmp_err_ack(q, mp, TSYSERR, error);
 671                 return;
 672         }
 673 
 674         error = rawip_do_connect(connp, sa, len, cr, pid);
 675         if (error != 0) {
 676                 if (error < 0) {
 677                         icmp_err_ack(q, mp, -error, 0);
 678                 } else {
 679                         icmp_err_ack(q, mp, 0, error);
 680                 }
 681         } else {
 682                 mblk_t *mp1;
 683 
 684                 /*
 685                  * We have to send a connection confirmation to
 686                  * keep TLI happy.
 687                  */
 688                 if (connp->conn_family == AF_INET) {
 689                         mp1 = mi_tpi_conn_con(NULL, (char *)sa,
 690                             sizeof (sin_t), NULL, 0);
 691                 } else {
 692                         ASSERT(connp->conn_family == AF_INET6);
 693                         mp1 = mi_tpi_conn_con(NULL, (char *)sa,
 694                             sizeof (sin6_t), NULL, 0);
 695                 }
 696                 if (mp1 == NULL) {
 697                         icmp_err_ack(q, mp, TSYSERR, ENOMEM);
 698                         return;
 699                 }
 700 
 701                 /*
 702                  * Send ok_ack for T_CONN_REQ
 703                  */
 704                 mp = mi_tpi_ok_ack_alloc(mp);
 705                 if (mp == NULL) {
 706                         /* Unable to reuse the T_CONN_REQ for the ack. */
 707                         icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
 708                         return;
 709                 }
 710                 putnext(connp->conn_rq, mp);
 711                 putnext(connp->conn_rq, mp1);
 712         }
 713 }
 714 
 715 static int
 716 rawip_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
 717     cred_t *cr, pid_t pid)
 718 {
 719         icmp_t          *icmp;
 720         sin_t           *sin;
 721         sin6_t          *sin6;
 722         int             error;
 723         uint16_t        dstport;
 724         ipaddr_t        v4dst;
 725         in6_addr_t      v6dst;
 726         uint32_t        flowinfo;
 727         ip_xmit_attr_t  *ixa;
 728         ip_xmit_attr_t  *oldixa;
 729         uint_t          scopeid = 0;
 730         uint_t          srcid = 0;
 731         in6_addr_t      v6src = connp->conn_saddr_v6;
 732 
 733         icmp = connp->conn_icmp;
 734 
 735         if (sa == NULL || !OK_32PTR((char *)sa)) {
 736                 return (EINVAL);
 737         }
 738 
 739         ASSERT(sa != NULL && len != 0);
 740 
 741         /*
 742          * Determine packet type based on type of address passed in
 743          * the request should contain an IPv4 or IPv6 address.
 744          * Make sure that address family matches the type of
 745          * family of the address passed down.
 746          */
 747         switch (len) {
 748         case sizeof (sin_t):
 749                 sin = (sin_t *)sa;
 750 
 751                 v4dst = sin->sin_addr.s_addr;
 752                 dstport = sin->sin_port;
 753                 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
 754                 ASSERT(connp->conn_ipversion == IPV4_VERSION);
 755                 break;
 756 
 757         case sizeof (sin6_t):
 758                 sin6 = (sin6_t *)sa;
 759 
 760                 /* No support for mapped addresses on raw sockets */
 761                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
 762                         return (EADDRNOTAVAIL);
 763                 }
 764                 v6dst = sin6->sin6_addr;
 765                 dstport = sin6->sin6_port;
 766                 ASSERT(connp->conn_ipversion == IPV6_VERSION);
 767                 flowinfo = sin6->sin6_flowinfo;
 768                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
 769                         scopeid = sin6->sin6_scope_id;
 770                 srcid = sin6->__sin6_src_id;
 771                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
 772                         /* Due to check above, we know sin6_addr is v6-only. */
 773                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
 774                             B_FALSE, connp->conn_netstack)) {
 775                                 /* Mismatch - v6src would be v4mapped. */
 776                                 return (EADDRNOTAVAIL);
 777                         }
 778                 }
 779                 break;
 780         }
 781 
 782         /*
 783          * If there is a different thread using conn_ixa then we get a new
 784          * copy and cut the old one loose from conn_ixa. Otherwise we use
 785          * conn_ixa and prevent any other thread from using/changing it.
 786          * Once connect() is done other threads can use conn_ixa since the
 787          * refcnt will be back at one.
 788          * We defer updating conn_ixa until later to handle any concurrent
 789          * conn_ixa_cleanup thread.
 790          */
 791         ixa = conn_get_ixa(connp, B_FALSE);
 792         if (ixa == NULL)
 793                 return (ENOMEM);
 794 
 795         mutex_enter(&connp->conn_lock);
 796         /*
 797          * This icmp_t must have bound already before doing a connect.
 798          * Reject if a connect is in progress (we drop conn_lock during
 799          * rawip_do_connect).
 800          */
 801         if (icmp->icmp_state == TS_UNBND || icmp->icmp_state == TS_WCON_CREQ) {
 802                 mutex_exit(&connp->conn_lock);
 803                 ixa_refrele(ixa);
 804                 return (-TOUTSTATE);
 805         }
 806 
 807         if (icmp->icmp_state == TS_DATA_XFER) {
 808                 /* Already connected - clear out state */
 809                 if (connp->conn_mcbc_bind)
 810                         connp->conn_saddr_v6 = ipv6_all_zeros;
 811                 else
 812                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
 813                 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
 814                 connp->conn_faddr_v6 = ipv6_all_zeros;
 815                 icmp->icmp_state = TS_IDLE;
 816         }
 817 
 818         /*
 819          * Use sin_port/sin6_port since applications like psh use SOCK_RAW
 820          * with IPPROTO_TCP.
 821          */
 822         connp->conn_fport = dstport;
 823         if (connp->conn_ipversion == IPV4_VERSION) {
 824                 /*
 825                  * Interpret a zero destination to mean loopback.
 826                  * Update the T_CONN_REQ (sin/sin6) since it is used to
 827                  * generate the T_CONN_CON.
 828                  */
 829                 if (v4dst == INADDR_ANY) {
 830                         v4dst = htonl(INADDR_LOOPBACK);
 831                         IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
 832                         ASSERT(connp->conn_family == AF_INET);
 833                         sin->sin_addr.s_addr = v4dst;
 834                 }
 835                 connp->conn_faddr_v6 = v6dst;
 836                 connp->conn_flowinfo = 0;
 837         } else {
 838                 ASSERT(connp->conn_ipversion == IPV6_VERSION);
 839                 /*
 840                  * Interpret a zero destination to mean loopback.
 841                  * Update the T_CONN_REQ (sin/sin6) since it is used to
 842                  * generate the T_CONN_CON.
 843                  */
 844                 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
 845                         v6dst = ipv6_loopback;
 846                         sin6->sin6_addr = v6dst;
 847                 }
 848                 connp->conn_faddr_v6 = v6dst;
 849                 connp->conn_flowinfo = flowinfo;
 850         }
 851 
 852         /*
 853          * We update our cred/cpid based on the caller of connect
 854          */
 855         if (connp->conn_cred != cr) {
 856                 crhold(cr);
 857                 crfree(connp->conn_cred);
 858                 connp->conn_cred = cr;
 859         }
 860         connp->conn_cpid = pid;
 861         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
 862         ixa->ixa_cred = cr;
 863         ixa->ixa_cpid = pid;
 864         if (is_system_labeled()) {
 865                 /* We need to restart with a label based on the cred */
 866                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
 867         }
 868 
 869         if (scopeid != 0) {
 870                 ixa->ixa_flags |= IXAF_SCOPEID_SET;
 871                 ixa->ixa_scopeid = scopeid;
 872                 connp->conn_incoming_ifindex = scopeid;
 873         } else {
 874                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
 875                 connp->conn_incoming_ifindex = connp->conn_bound_if;
 876         }
 877 
 878         /*
 879          * conn_connect will drop conn_lock and reacquire it.
 880          * To prevent a send* from messing with this icmp_t while the lock
 881          * is dropped we set icmp_state and clear conn_v6lastdst.
 882          * That will make all send* fail with EISCONN.
 883          */
 884         connp->conn_v6lastdst = ipv6_all_zeros;
 885         icmp->icmp_state = TS_WCON_CREQ;
 886 
 887         error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
 888         mutex_exit(&connp->conn_lock);
 889         if (error != 0)
 890                 goto connect_failed;
 891 
 892         /*
 893          * The addresses have been verified. Time to insert in
 894          * the correct fanout list.
 895          */
 896         error = ipcl_conn_insert(connp);
 897         if (error != 0)
 898                 goto connect_failed;
 899 
 900         mutex_enter(&connp->conn_lock);
 901         error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
 902             &connp->conn_faddr_v6, connp->conn_flowinfo);
 903         if (error != 0) {
 904                 mutex_exit(&connp->conn_lock);
 905                 goto connect_failed;
 906         }
 907 
 908         icmp->icmp_state = TS_DATA_XFER;
 909         /* Record this as the "last" send even though we haven't sent any */
 910         connp->conn_v6lastdst = connp->conn_faddr_v6;
 911         connp->conn_lastipversion = connp->conn_ipversion;
 912         connp->conn_lastdstport = connp->conn_fport;
 913         connp->conn_lastflowinfo = connp->conn_flowinfo;
 914         connp->conn_lastscopeid = scopeid;
 915         connp->conn_lastsrcid = srcid;
 916         /* Also remember a source to use together with lastdst */
 917         connp->conn_v6lastsrc = v6src;
 918 
 919         oldixa = conn_replace_ixa(connp, ixa);
 920         mutex_exit(&connp->conn_lock);
 921         ixa_refrele(oldixa);
 922 
 923         ixa_refrele(ixa);
 924         return (0);
 925 
 926 connect_failed:
 927         if (ixa != NULL)
 928                 ixa_refrele(ixa);
 929         mutex_enter(&connp->conn_lock);
 930         icmp->icmp_state = TS_IDLE;
 931         /* In case the source address was set above */
 932         if (connp->conn_mcbc_bind)
 933                 connp->conn_saddr_v6 = ipv6_all_zeros;
 934         else
 935                 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
 936         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
 937         connp->conn_faddr_v6 = ipv6_all_zeros;
 938         connp->conn_v6lastdst = ipv6_all_zeros;
 939         connp->conn_flowinfo = 0;
 940 
 941         (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
 942             &connp->conn_faddr_v6, connp->conn_flowinfo);
 943         mutex_exit(&connp->conn_lock);
 944         return (error);
 945 }
 946 
 947 static void
 948 rawip_do_close(conn_t *connp)
 949 {
 950         ASSERT(connp != NULL && IPCL_IS_RAWIP(connp));
 951 
 952         ip_quiesce_conn(connp);
 953 
 954         if (!IPCL_IS_NONSTR(connp)) {
 955                 qprocsoff(connp->conn_rq);
 956         }
 957 
 958         icmp_close_free(connp);
 959 
 960         /*
 961          * Now we are truly single threaded on this stream, and can
 962          * delete the things hanging off the connp, and finally the connp.
 963          * We removed this connp from the fanout list, it cannot be
 964          * accessed thru the fanouts, and we already waited for the
 965          * conn_ref to drop to 0. We are already in close, so
 966          * there cannot be any other thread from the top. qprocsoff
 967          * has completed, and service has completed or won't run in
 968          * future.
 969          */
 970         ASSERT(connp->conn_ref == 1);
 971 
 972         if (!IPCL_IS_NONSTR(connp)) {
 973                 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
 974         } else {
 975                 ip_free_helper_stream(connp);
 976         }
 977 
 978         connp->conn_ref--;
 979         ipcl_conn_destroy(connp);
 980 }
 981 
 982 /* ARGSUSED */
 983 static int
 984 icmp_close(queue_t *q, int flags, cred_t *credp __unused)
 985 {
 986         conn_t  *connp;
 987 
 988         if (flags & SO_FALLBACK) {
 989                 /*
 990                  * stream is being closed while in fallback
 991                  * simply free the resources that were allocated
 992                  */
 993                 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
 994                 qprocsoff(q);
 995                 goto done;
 996         }
 997 
 998         connp = Q_TO_CONN(q);
 999         (void) rawip_do_close(connp);
1000 done:
1001         q->q_ptr = WR(q)->q_ptr = NULL;
1002         return (0);
1003 }
1004 
1005 static void
1006 icmp_close_free(conn_t *connp)
1007 {
1008         icmp_t *icmp = connp->conn_icmp;
1009 
1010         if (icmp->icmp_filter != NULL) {
1011                 kmem_free(icmp->icmp_filter, sizeof (icmp6_filter_t));
1012                 icmp->icmp_filter = NULL;
1013         }
1014 
1015         /*
1016          * Clear any fields which the kmem_cache constructor clears.
1017          * Only icmp_connp needs to be preserved.
1018          * TBD: We should make this more efficient to avoid clearing
1019          * everything.
1020          */
1021         ASSERT(icmp->icmp_connp == connp);
1022         bzero(icmp, sizeof (icmp_t));
1023         icmp->icmp_connp = connp;
1024 }
1025 
1026 /*
1027  * This routine handles each T_DISCON_REQ message passed to icmp
1028  * as an indicating that ICMP is no longer connected. This results
1029  * in telling IP to restore the binding to just the local address.
1030  */
1031 static int
1032 icmp_do_disconnect(conn_t *connp)
1033 {
1034         icmp_t  *icmp = connp->conn_icmp;
1035         int     error;
1036 
1037         mutex_enter(&connp->conn_lock);
1038         if (icmp->icmp_state != TS_DATA_XFER) {
1039                 mutex_exit(&connp->conn_lock);
1040                 return (-TOUTSTATE);
1041         }
1042         if (connp->conn_mcbc_bind)
1043                 connp->conn_saddr_v6 = ipv6_all_zeros;
1044         else
1045                 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
1046         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
1047         connp->conn_faddr_v6 = ipv6_all_zeros;
1048         icmp->icmp_state = TS_IDLE;
1049 
1050         connp->conn_v6lastdst = ipv6_all_zeros;
1051         error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
1052             &connp->conn_faddr_v6, connp->conn_flowinfo);
1053         mutex_exit(&connp->conn_lock);
1054         if (error != 0)
1055                 return (error);
1056 
1057         /*
1058          * Tell IP to remove the full binding and revert
1059          * to the local address binding.
1060          */
1061         return (ip_laddr_fanout_insert(connp));
1062 }
1063 
1064 static void
1065 icmp_tpi_disconnect(queue_t *q, mblk_t *mp)
1066 {
1067         conn_t  *connp = Q_TO_CONN(q);
1068         int     error;
1069 
1070         /*
1071          * Allocate the largest primitive we need to send back
1072          * T_error_ack is > than T_ok_ack
1073          */
1074         mp = reallocb(mp, sizeof (struct T_error_ack), 1);
1075         if (mp == NULL) {
1076                 /* Unable to reuse the T_DISCON_REQ for the ack. */
1077                 icmp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
1078                 return;
1079         }
1080 
1081         error = icmp_do_disconnect(connp);
1082 
1083         if (error != 0) {
1084                 if (error > 0) {
1085                         icmp_err_ack(q, mp, 0, error);
1086                 } else {
1087                         icmp_err_ack(q, mp, -error, 0);
1088                 }
1089         } else {
1090                 mp = mi_tpi_ok_ack_alloc(mp);
1091                 ASSERT(mp != NULL);
1092                 qreply(q, mp);
1093         }
1094 }
1095 
1096 static int
1097 icmp_disconnect(conn_t *connp)
1098 {
1099         int     error;
1100 
1101         connp->conn_dgram_errind = B_FALSE;
1102 
1103         error = icmp_do_disconnect(connp);
1104 
1105         if (error < 0)
1106                 error = proto_tlitosyserr(-error);
1107         return (error);
1108 }
1109 
1110 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
1111 static void
1112 icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
1113 {
1114         if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
1115                 qreply(q, mp);
1116 }
1117 
1118 /* Shorthand to generate and send TPI error acks to our client */
1119 static void
1120 icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
1121     t_scalar_t t_error, int sys_error)
1122 {
1123         struct T_error_ack      *teackp;
1124 
1125         if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
1126             M_PCPROTO, T_ERROR_ACK)) != NULL) {
1127                 teackp = (struct T_error_ack *)mp->b_rptr;
1128                 teackp->ERROR_prim = primitive;
1129                 teackp->TLI_error = t_error;
1130                 teackp->UNIX_error = sys_error;
1131                 qreply(q, mp);
1132         }
1133 }
1134 
1135 /*
1136  * icmp_icmp_input is called as conn_recvicmp to process ICMP messages.
1137  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1138  * Assumes that IP has pulled up everything up to and including the ICMP header.
1139  */
1140 /* ARGSUSED2 */
1141 static void
1142 icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1143 {
1144         conn_t          *connp = (conn_t *)arg1;
1145         icmp_t          *icmp = connp->conn_icmp;
1146         icmph_t         *icmph;
1147         ipha_t          *ipha;
1148         int             iph_hdr_length;
1149         sin_t           sin;
1150         mblk_t          *mp1;
1151         int             error = 0;
1152 
1153         ipha = (ipha_t *)mp->b_rptr;
1154 
1155         ASSERT(OK_32PTR(mp->b_rptr));
1156 
1157         if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1158                 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1159                 icmp_icmp_error_ipv6(connp, mp, ira);
1160                 return;
1161         }
1162         ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
1163 
1164         /* Skip past the outer IP and ICMP headers */
1165         ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
1166         iph_hdr_length = ira->ira_ip_hdr_length;
1167         icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1168         ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
1169 
1170         iph_hdr_length = IPH_HDR_LENGTH(ipha);
1171 
1172         switch (icmph->icmph_type) {
1173         case ICMP_DEST_UNREACHABLE:
1174                 switch (icmph->icmph_code) {
1175                 case ICMP_FRAGMENTATION_NEEDED: {
1176                         ipha_t          *ipha;
1177                         ip_xmit_attr_t  *ixa;
1178                         /*
1179                          * IP has already adjusted the path MTU.
1180                          * But we need to adjust DF for IPv4.
1181                          */
1182                         if (connp->conn_ipversion != IPV4_VERSION)
1183                                 break;
1184 
1185                         ixa = conn_get_ixa(connp, B_FALSE);
1186                         if (ixa == NULL || ixa->ixa_ire == NULL) {
1187                                 /*
1188                                  * Some other thread holds conn_ixa. We will
1189                                  * redo this on the next ICMP too big.
1190                                  */
1191                                 if (ixa != NULL)
1192                                         ixa_refrele(ixa);
1193                                 break;
1194                         }
1195                         (void) ip_get_pmtu(ixa);
1196 
1197                         mutex_enter(&connp->conn_lock);
1198                         ipha = (ipha_t *)connp->conn_ht_iphc;
1199                         if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
1200                                 ipha->ipha_fragment_offset_and_flags |=
1201                                     IPH_DF_HTONS;
1202                         } else {
1203                                 ipha->ipha_fragment_offset_and_flags &=
1204                                     ~IPH_DF_HTONS;
1205                         }
1206                         mutex_exit(&connp->conn_lock);
1207                         ixa_refrele(ixa);
1208                         break;
1209                 }
1210                 case ICMP_PORT_UNREACHABLE:
1211                 case ICMP_PROTOCOL_UNREACHABLE:
1212                         error = ECONNREFUSED;
1213                         break;
1214                 default:
1215                         /* Transient errors */
1216                         break;
1217                 }
1218                 break;
1219         default:
1220                 /* Transient errors */
1221                 break;
1222         }
1223         if (error == 0) {
1224                 freemsg(mp);
1225                 return;
1226         }
1227 
1228         /*
1229          * Deliver T_UDERROR_IND when the application has asked for it.
1230          * The socket layer enables this automatically when connected.
1231          */
1232         if (!connp->conn_dgram_errind) {
1233                 freemsg(mp);
1234                 return;
1235         }
1236 
1237         sin = sin_null;
1238         sin.sin_family = AF_INET;
1239         sin.sin_addr.s_addr = ipha->ipha_dst;
1240 
1241         if (IPCL_IS_NONSTR(connp)) {
1242                 mutex_enter(&connp->conn_lock);
1243                 if (icmp->icmp_state == TS_DATA_XFER) {
1244                         if (sin.sin_addr.s_addr == connp->conn_faddr_v4) {
1245                                 mutex_exit(&connp->conn_lock);
1246                                 (*connp->conn_upcalls->su_set_error)
1247                                     (connp->conn_upper_handle, error);
1248                                 goto done;
1249                         }
1250                 } else {
1251                         icmp->icmp_delayed_error = error;
1252                         *((sin_t *)&icmp->icmp_delayed_addr) = sin;
1253                 }
1254                 mutex_exit(&connp->conn_lock);
1255         } else {
1256                 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0,
1257                     error);
1258                 if (mp1 != NULL)
1259                         putnext(connp->conn_rq, mp1);
1260         }
1261 done:
1262         freemsg(mp);
1263 }
1264 
1265 /*
1266  * icmp_icmp_error_ipv6 is called by icmp_icmp_error to process ICMP for IPv6.
1267  * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1268  * Assumes that IP has pulled up all the extension headers as well as the
1269  * ICMPv6 header.
1270  */
1271 static void
1272 icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1273 {
1274         icmp6_t         *icmp6;
1275         ip6_t           *ip6h, *outer_ip6h;
1276         uint16_t        iph_hdr_length;
1277         uint8_t         *nexthdrp;
1278         sin6_t          sin6;
1279         mblk_t          *mp1;
1280         int             error = 0;
1281         icmp_t          *icmp = connp->conn_icmp;
1282 
1283         outer_ip6h = (ip6_t *)mp->b_rptr;
1284 #ifdef DEBUG
1285         if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1286                 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1287         else
1288                 iph_hdr_length = IPV6_HDR_LEN;
1289         ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1290 #endif
1291         /* Skip past the outer IP and ICMP headers */
1292         iph_hdr_length = ira->ira_ip_hdr_length;
1293         icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1294 
1295         ip6h = (ip6_t *)&icmp6[1];  /* Inner IP header */
1296         if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1297                 freemsg(mp);
1298                 return;
1299         }
1300 
1301         switch (icmp6->icmp6_type) {
1302         case ICMP6_DST_UNREACH:
1303                 switch (icmp6->icmp6_code) {
1304                 case ICMP6_DST_UNREACH_NOPORT:
1305                         error = ECONNREFUSED;
1306                         break;
1307                 case ICMP6_DST_UNREACH_ADMIN:
1308                 case ICMP6_DST_UNREACH_NOROUTE:
1309                 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1310                 case ICMP6_DST_UNREACH_ADDR:
1311                         /* Transient errors */
1312                         break;
1313                 default:
1314                         break;
1315                 }
1316                 break;
1317         case ICMP6_PACKET_TOO_BIG: {
1318                 struct T_unitdata_ind   *tudi;
1319                 struct T_opthdr         *toh;
1320                 size_t                  udi_size;
1321                 mblk_t                  *newmp;
1322                 t_scalar_t              opt_length = sizeof (struct T_opthdr) +
1323                     sizeof (struct ip6_mtuinfo);
1324                 sin6_t                  *sin6;
1325                 struct ip6_mtuinfo      *mtuinfo;
1326 
1327                 /*
1328                  * If the application has requested to receive path mtu
1329                  * information, send up an empty message containing an
1330                  * IPV6_PATHMTU ancillary data item.
1331                  */
1332                 if (!connp->conn_ipv6_recvpathmtu)
1333                         break;
1334 
1335                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1336                     opt_length;
1337                 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1338                         BUMP_MIB(&icmp->icmp_is->is_rawip_mib, rawipInErrors);
1339                         break;
1340                 }
1341 
1342                 /*
1343                  * newmp->b_cont is left to NULL on purpose.  This is an
1344                  * empty message containing only ancillary data.
1345                  */
1346                 newmp->b_datap->db_type = M_PROTO;
1347                 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1348                 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1349                 tudi->PRIM_type = T_UNITDATA_IND;
1350                 tudi->SRC_length = sizeof (sin6_t);
1351                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1352                 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1353                 tudi->OPT_length = opt_length;
1354 
1355                 sin6 = (sin6_t *)&tudi[1];
1356                 bzero(sin6, sizeof (sin6_t));
1357                 sin6->sin6_family = AF_INET6;
1358                 sin6->sin6_addr = connp->conn_faddr_v6;
1359 
1360                 toh = (struct T_opthdr *)&sin6[1];
1361                 toh->level = IPPROTO_IPV6;
1362                 toh->name = IPV6_PATHMTU;
1363                 toh->len = opt_length;
1364                 toh->status = 0;
1365 
1366                 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1367                 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1368                 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1369                 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1370                 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1371                 /*
1372                  * We've consumed everything we need from the original
1373                  * message.  Free it, then send our empty message.
1374                  */
1375                 freemsg(mp);
1376                 icmp_ulp_recv(connp, newmp, msgdsize(newmp));
1377                 return;
1378         }
1379         case ICMP6_TIME_EXCEEDED:
1380                 /* Transient errors */
1381                 break;
1382         case ICMP6_PARAM_PROB:
1383                 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1384                 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1385                     (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1386                     (uchar_t *)nexthdrp) {
1387                         error = ECONNREFUSED;
1388                         break;
1389                 }
1390                 break;
1391         }
1392         if (error == 0) {
1393                 freemsg(mp);
1394                 return;
1395         }
1396 
1397         /*
1398          * Deliver T_UDERROR_IND when the application has asked for it.
1399          * The socket layer enables this automatically when connected.
1400          */
1401         if (!connp->conn_dgram_errind) {
1402                 freemsg(mp);
1403                 return;
1404         }
1405 
1406         sin6 = sin6_null;
1407         sin6.sin6_family = AF_INET6;
1408         sin6.sin6_addr = ip6h->ip6_dst;
1409         sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1410         if (IPCL_IS_NONSTR(connp)) {
1411                 mutex_enter(&connp->conn_lock);
1412                 if (icmp->icmp_state == TS_DATA_XFER) {
1413                         if (IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1414                             &connp->conn_faddr_v6)) {
1415                                 mutex_exit(&connp->conn_lock);
1416                                 (*connp->conn_upcalls->su_set_error)
1417                                     (connp->conn_upper_handle, error);
1418                                 goto done;
1419                         }
1420                 } else {
1421                         icmp->icmp_delayed_error = error;
1422                         *((sin6_t *)&icmp->icmp_delayed_addr) = sin6;
1423                 }
1424                 mutex_exit(&connp->conn_lock);
1425         } else {
1426                 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1427                     NULL, 0, error);
1428                 if (mp1 != NULL)
1429                         putnext(connp->conn_rq, mp1);
1430         }
1431 done:
1432         freemsg(mp);
1433 }
1434 
1435 /*
1436  * This routine responds to T_ADDR_REQ messages.  It is called by icmp_wput.
1437  * The local address is filled in if endpoint is bound. The remote address
1438  * is filled in if remote address has been precified ("connected endpoint")
1439  * (The concept of connected CLTS sockets is alien to published TPI
1440  *  but we support it anyway).
1441  */
1442 static void
1443 icmp_addr_req(queue_t *q, mblk_t *mp)
1444 {
1445         struct sockaddr *sa;
1446         mblk_t  *ackmp;
1447         struct T_addr_ack *taa;
1448         icmp_t  *icmp = Q_TO_ICMP(q);
1449         conn_t  *connp = icmp->icmp_connp;
1450         uint_t  addrlen;
1451 
1452         /* Make it large enough for worst case */
1453         ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1454             2 * sizeof (sin6_t), 1);
1455         if (ackmp == NULL) {
1456                 icmp_err_ack(q, mp, TSYSERR, ENOMEM);
1457                 return;
1458         }
1459         taa = (struct T_addr_ack *)ackmp->b_rptr;
1460 
1461         bzero(taa, sizeof (struct T_addr_ack));
1462         ackmp->b_wptr = (uchar_t *)&taa[1];
1463 
1464         taa->PRIM_type = T_ADDR_ACK;
1465         ackmp->b_datap->db_type = M_PCPROTO;
1466 
1467         if (connp->conn_family == AF_INET)
1468                 addrlen = sizeof (sin_t);
1469         else
1470                 addrlen = sizeof (sin6_t);
1471 
1472         mutex_enter(&connp->conn_lock);
1473         /*
1474          * Note: Following code assumes 32 bit alignment of basic
1475          * data structures like sin_t and struct T_addr_ack.
1476          */
1477         if (icmp->icmp_state != TS_UNBND) {
1478                 /*
1479                  * Fill in local address first
1480                  */
1481                 taa->LOCADDR_offset = sizeof (*taa);
1482                 taa->LOCADDR_length = addrlen;
1483                 sa = (struct sockaddr *)&taa[1];
1484                 (void) conn_getsockname(connp, sa, &addrlen);
1485                 ackmp->b_wptr += addrlen;
1486         }
1487         if (icmp->icmp_state == TS_DATA_XFER) {
1488                 /*
1489                  * connected, fill remote address too
1490                  */
1491                 taa->REMADDR_length = addrlen;
1492                 /* assumed 32-bit alignment */
1493                 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1494                 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1495                 (void) conn_getpeername(connp, sa, &addrlen);
1496                 ackmp->b_wptr += addrlen;
1497         }
1498         mutex_exit(&connp->conn_lock);
1499         ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1500         qreply(q, ackmp);
1501 }
1502 
1503 static void
1504 icmp_copy_info(struct T_info_ack *tap, icmp_t *icmp)
1505 {
1506         conn_t          *connp = icmp->icmp_connp;
1507 
1508         *tap = icmp_g_t_info_ack;
1509 
1510         if (connp->conn_family == AF_INET6)
1511                 tap->ADDR_size = sizeof (sin6_t);
1512         else
1513                 tap->ADDR_size = sizeof (sin_t);
1514         tap->CURRENT_state = icmp->icmp_state;
1515         tap->OPT_size = icmp_max_optsize;
1516 }
1517 
1518 static void
1519 icmp_do_capability_ack(icmp_t *icmp, struct T_capability_ack *tcap,
1520     t_uscalar_t cap_bits1)
1521 {
1522         tcap->CAP_bits1 = 0;
1523 
1524         if (cap_bits1 & TC1_INFO) {
1525                 icmp_copy_info(&tcap->INFO_ack, icmp);
1526                 tcap->CAP_bits1 |= TC1_INFO;
1527         }
1528 }
1529 
1530 /*
1531  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
1532  * icmp_wput.  Much of the T_CAPABILITY_ACK information is copied from
1533  * icmp_g_t_info_ack.  The current state of the stream is copied from
1534  * icmp_state.
1535  */
1536 static void
1537 icmp_capability_req(queue_t *q, mblk_t *mp)
1538 {
1539         icmp_t                  *icmp = Q_TO_ICMP(q);
1540         t_uscalar_t             cap_bits1;
1541         struct T_capability_ack *tcap;
1542 
1543         cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1544 
1545         mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1546             mp->b_datap->db_type, T_CAPABILITY_ACK);
1547         if (!mp)
1548                 return;
1549 
1550         tcap = (struct T_capability_ack *)mp->b_rptr;
1551 
1552         icmp_do_capability_ack(icmp, tcap, cap_bits1);
1553 
1554         qreply(q, mp);
1555 }
1556 
1557 /*
1558  * This routine responds to T_INFO_REQ messages.  It is called by icmp_wput.
1559  * Most of the T_INFO_ACK information is copied from icmp_g_t_info_ack.
1560  * The current state of the stream is copied from icmp_state.
1561  */
1562 static void
1563 icmp_info_req(queue_t *q, mblk_t *mp)
1564 {
1565         icmp_t  *icmp = Q_TO_ICMP(q);
1566 
1567         /* Create a T_INFO_ACK message. */
1568         mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1569             T_INFO_ACK);
1570         if (!mp)
1571                 return;
1572         icmp_copy_info((struct T_info_ack *)mp->b_rptr, icmp);
1573         qreply(q, mp);
1574 }
1575 
1576 static int
1577 icmp_tpi_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1578     int family)
1579 {
1580         conn_t *connp;
1581         dev_t   conn_dev;
1582         int     error;
1583 
1584         /* If the stream is already open, return immediately. */
1585         if (q->q_ptr != NULL)
1586                 return (0);
1587 
1588         if (sflag == MODOPEN)
1589                 return (EINVAL);
1590 
1591         /*
1592          * Since ICMP is not used so heavily, allocating from the small
1593          * arena should be sufficient.
1594          */
1595         if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) {
1596                 return (EBUSY);
1597         }
1598 
1599         if (flag & SO_FALLBACK) {
1600                 /*
1601                  * Non streams socket needs a stream to fallback to
1602                  */
1603                 RD(q)->q_ptr = (void *)conn_dev;
1604                 WR(q)->q_qinfo = &icmp_fallback_sock_winit;
1605                 WR(q)->q_ptr = (void *)ip_minor_arena_sa;
1606                 qprocson(q);
1607                 return (0);
1608         }
1609 
1610         connp = rawip_do_open(family, credp, &error, KM_SLEEP);
1611         if (connp == NULL) {
1612                 ASSERT(error != 0);
1613                 inet_minor_free(ip_minor_arena_sa, conn_dev);
1614                 return (error);
1615         }
1616 
1617         *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1618         connp->conn_dev = conn_dev;
1619         connp->conn_minor_arena = ip_minor_arena_sa;
1620 
1621         /*
1622          * Initialize the icmp_t structure for this stream.
1623          */
1624         q->q_ptr = connp;
1625         WR(q)->q_ptr = connp;
1626         connp->conn_rq = q;
1627         connp->conn_wq = WR(q);
1628 
1629         WR(q)->q_hiwat = connp->conn_sndbuf;
1630         WR(q)->q_lowat = connp->conn_sndlowat;
1631 
1632         qprocson(q);
1633 
1634         /* Set the Stream head write offset. */
1635         (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1636         (void) proto_set_rx_hiwat(connp->conn_rq, connp, connp->conn_rcvbuf);
1637 
1638         mutex_enter(&connp->conn_lock);
1639         connp->conn_state_flags &= ~CONN_INCIPIENT;
1640         mutex_exit(&connp->conn_lock);
1641 
1642         icmp_bind_proto(connp->conn_icmp);
1643 
1644         return (0);
1645 }
1646 
1647 /* For /dev/icmp aka AF_INET open */
1648 static int
1649 icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1650 {
1651         return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET));
1652 }
1653 
1654 /* For /dev/icmp6 aka AF_INET6 open */
1655 static int
1656 icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1657 {
1658         return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET6));
1659 }
1660 
1661 /*
1662  * This is the open routine for icmp.  It allocates a icmp_t structure for
1663  * the stream and, on the first open of the module, creates an ND table.
1664  */
1665 static conn_t *
1666 rawip_do_open(int family, cred_t *credp, int *err, int flags)
1667 {
1668         icmp_t  *icmp;
1669         conn_t *connp;
1670         zoneid_t zoneid;
1671         netstack_t *ns;
1672         icmp_stack_t *is;
1673         int len;
1674         boolean_t isv6 = B_FALSE;
1675 
1676         *err = secpolicy_net_icmpaccess(credp);
1677         if (*err != 0)
1678                 return (NULL);
1679 
1680         if (family == AF_INET6)
1681                 isv6 = B_TRUE;
1682 
1683         ns = netstack_find_by_cred(credp);
1684         ASSERT(ns != NULL);
1685         is = ns->netstack_icmp;
1686         ASSERT(is != NULL);
1687 
1688         /*
1689          * For exclusive stacks we set the zoneid to zero
1690          * to make ICMP operate as if in the global zone.
1691          */
1692         if (ns->netstack_stackid != GLOBAL_NETSTACKID)
1693                 zoneid = GLOBAL_ZONEID;
1694         else
1695                 zoneid = crgetzoneid(credp);
1696 
1697         ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
1698 
1699         connp = ipcl_conn_create(IPCL_RAWIPCONN, flags, ns);
1700         icmp = connp->conn_icmp;
1701 
1702         /*
1703          * ipcl_conn_create did a netstack_hold. Undo the hold that was
1704          * done by netstack_find_by_cred()
1705          */
1706         netstack_rele(ns);
1707 
1708         /*
1709          * Since this conn_t/icmp_t is not yet visible to anybody else we don't
1710          * need to lock anything.
1711          */
1712         ASSERT(connp->conn_proto == IPPROTO_ICMP);
1713         ASSERT(connp->conn_icmp == icmp);
1714         ASSERT(icmp->icmp_connp == connp);
1715 
1716         /* Set the initial state of the stream and the privilege status. */
1717         icmp->icmp_state = TS_UNBND;
1718         connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
1719         if (isv6) {
1720                 connp->conn_family = AF_INET6;
1721                 connp->conn_ipversion = IPV6_VERSION;
1722                 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
1723                 connp->conn_proto = IPPROTO_ICMPV6;
1724                 /* May be changed by a SO_PROTOTYPE socket option. */
1725                 connp->conn_proto = IPPROTO_ICMPV6;
1726                 connp->conn_ixa->ixa_protocol = connp->conn_proto;
1727                 connp->conn_ixa->ixa_raw_cksum_offset = 2;
1728                 connp->conn_default_ttl = is->is_ipv6_hoplimit;
1729                 len = sizeof (ip6_t);
1730         } else {
1731                 connp->conn_family = AF_INET;
1732                 connp->conn_ipversion = IPV4_VERSION;
1733                 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
1734                 /* May be changed by a SO_PROTOTYPE socket option. */
1735                 connp->conn_proto = IPPROTO_ICMP;
1736                 connp->conn_ixa->ixa_protocol = connp->conn_proto;
1737                 connp->conn_default_ttl = is->is_ipv4_ttl;
1738                 len = sizeof (ipha_t);
1739         }
1740         connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
1741 
1742         connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1743 
1744         /*
1745          * For the socket of protocol IPPROTO_RAW or when IP_HDRINCL is set,
1746          * the checksum is provided in the pre-built packet. We clear
1747          * IXAF_SET_ULP_CKSUM to tell IP that the application has sent a
1748          * complete IP header and not to compute the transport checksum.
1749          */
1750         connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
1751         /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
1752         connp->conn_ixa->ixa_zoneid = zoneid;
1753 
1754         connp->conn_zoneid = zoneid;
1755 
1756         /*
1757          * If the caller has the process-wide flag set, then default to MAC
1758          * exempt mode.  This allows read-down to unlabeled hosts.
1759          */
1760         if (getpflags(NET_MAC_AWARE, credp) != 0)
1761                 connp->conn_mac_mode = CONN_MAC_AWARE;
1762 
1763         connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
1764 
1765         icmp->icmp_is = is;
1766 
1767         connp->conn_rcvbuf = is->is_recv_hiwat;
1768         connp->conn_sndbuf = is->is_xmit_hiwat;
1769         connp->conn_sndlowat = is->is_xmit_lowat;
1770         connp->conn_rcvlowat = icmp_mod_info.mi_lowat;
1771 
1772         connp->conn_wroff = len + is->is_wroff_extra;
1773         connp->conn_so_type = SOCK_RAW;
1774 
1775         connp->conn_recv = icmp_input;
1776         connp->conn_recvicmp = icmp_icmp_input;
1777         crhold(credp);
1778         connp->conn_cred = credp;
1779         connp->conn_cpid = curproc->p_pid;
1780         connp->conn_open_time = ddi_get_lbolt64();
1781         /* Cache things in ixa without an extra refhold */
1782         ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
1783         connp->conn_ixa->ixa_cred = connp->conn_cred;
1784         connp->conn_ixa->ixa_cpid = connp->conn_cpid;
1785         if (is_system_labeled())
1786                 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
1787 
1788         connp->conn_flow_cntrld = B_FALSE;
1789 
1790         if (is->is_pmtu_discovery)
1791                 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
1792 
1793         return (connp);
1794 }
1795 
1796 /*
1797  * Which ICMP options OK to set through T_UNITDATA_REQ...
1798  */
1799 /* ARGSUSED */
1800 static boolean_t
1801 icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1802 {
1803         return (B_TRUE);
1804 }
1805 
1806 /*
1807  * This routine gets default values of certain options whose default
1808  * values are maintained by protcol specific code
1809  */
1810 int
1811 icmp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1812 {
1813         icmp_t *icmp = Q_TO_ICMP(q);
1814         icmp_stack_t *is = icmp->icmp_is;
1815         int *i1 = (int *)ptr;
1816 
1817         switch (level) {
1818         case IPPROTO_IP:
1819                 switch (name) {
1820                 case IP_MULTICAST_TTL:
1821                         *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1822                         return (sizeof (uchar_t));
1823                 case IP_MULTICAST_LOOP:
1824                         *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1825                         return (sizeof (uchar_t));
1826                 }
1827                 break;
1828         case IPPROTO_IPV6:
1829                 switch (name) {
1830                 case IPV6_MULTICAST_HOPS:
1831                         *i1 = IP_DEFAULT_MULTICAST_TTL;
1832                         return (sizeof (int));
1833                 case IPV6_MULTICAST_LOOP:
1834                         *i1 = IP_DEFAULT_MULTICAST_LOOP;
1835                         return (sizeof (int));
1836                 case IPV6_UNICAST_HOPS:
1837                         *i1 = is->is_ipv6_hoplimit;
1838                         return (sizeof (int));
1839                 }
1840                 break;
1841         case IPPROTO_ICMPV6:
1842                 switch (name) {
1843                 case ICMP6_FILTER:
1844                         /* Make it look like "pass all" */
1845                         ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr);
1846                         return (sizeof (icmp6_filter_t));
1847                 }
1848                 break;
1849         }
1850         return (-1);
1851 }
1852 
1853 /*
1854  * This routine retrieves the current status of socket options.
1855  * It returns the size of the option retrieved, or -1.
1856  */
1857 int
1858 icmp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr)
1859 {
1860         icmp_t          *icmp = connp->conn_icmp;
1861         int             *i1 = (int *)ptr;
1862         conn_opt_arg_t  coas;
1863         int             retval;
1864 
1865         coas.coa_connp = connp;
1866         coas.coa_ixa = connp->conn_ixa;
1867         coas.coa_ipp = &connp->conn_xmit_ipp;
1868         coas.coa_ancillary = B_FALSE;
1869         coas.coa_changed = 0;
1870 
1871         /*
1872          * We assume that the optcom framework has checked for the set
1873          * of levels and names that are supported, hence we don't worry
1874          * about rejecting based on that.
1875          * First check for ICMP specific handling, then pass to common routine.
1876          */
1877         switch (level) {
1878         case IPPROTO_IP:
1879                 /*
1880                  * Only allow IPv4 option processing on IPv4 sockets.
1881                  */
1882                 if (connp->conn_family != AF_INET)
1883                         return (-1);
1884 
1885                 switch (name) {
1886                 case IP_OPTIONS:
1887                 case T_IP_OPTIONS:
1888                         /* Options are passed up with each packet */
1889                         return (0);
1890                 case IP_HDRINCL:
1891                         mutex_enter(&connp->conn_lock);
1892                         *i1 = (int)icmp->icmp_hdrincl;
1893                         mutex_exit(&connp->conn_lock);
1894                         return (sizeof (int));
1895                 }
1896                 break;
1897 
1898         case IPPROTO_IPV6:
1899                 /*
1900                  * Only allow IPv6 option processing on native IPv6 sockets.
1901                  */
1902                 if (connp->conn_family != AF_INET6)
1903                         return (-1);
1904 
1905                 switch (name) {
1906                 case IPV6_CHECKSUM:
1907                         /*
1908                          * Return offset or -1 if no checksum offset.
1909                          * Does not apply to IPPROTO_ICMPV6
1910                          */
1911                         if (connp->conn_proto == IPPROTO_ICMPV6)
1912                                 return (-1);
1913 
1914                         mutex_enter(&connp->conn_lock);
1915                         if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM)
1916                                 *i1 = connp->conn_ixa->ixa_raw_cksum_offset;
1917                         else
1918                                 *i1 = -1;
1919                         mutex_exit(&connp->conn_lock);
1920                         return (sizeof (int));
1921                 }
1922                 break;
1923 
1924         case IPPROTO_ICMPV6:
1925                 /*
1926                  * Only allow IPv6 option processing on native IPv6 sockets.
1927                  */
1928                 if (connp->conn_family != AF_INET6)
1929                         return (-1);
1930 
1931                 if (connp->conn_proto != IPPROTO_ICMPV6)
1932                         return (-1);
1933 
1934                 switch (name) {
1935                 case ICMP6_FILTER:
1936                         mutex_enter(&connp->conn_lock);
1937                         if (icmp->icmp_filter == NULL) {
1938                                 /* Make it look like "pass all" */
1939                                 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr);
1940                         } else {
1941                                 (void) bcopy(icmp->icmp_filter, ptr,
1942                                     sizeof (icmp6_filter_t));
1943                         }
1944                         mutex_exit(&connp->conn_lock);
1945                         return (sizeof (icmp6_filter_t));
1946                 }
1947         }
1948         mutex_enter(&connp->conn_lock);
1949         retval = conn_opt_get(&coas, level, name, ptr);
1950         mutex_exit(&connp->conn_lock);
1951         return (retval);
1952 }
1953 
1954 /*
1955  * This routine retrieves the current status of socket options.
1956  * It returns the size of the option retrieved, or -1.
1957  */
1958 int
1959 icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr)
1960 {
1961         conn_t          *connp = Q_TO_CONN(q);
1962         int             err;
1963 
1964         err = icmp_opt_get(connp, level, name, ptr);
1965         return (err);
1966 }
1967 
1968 /*
1969  * This routine sets socket options.
1970  */
1971 int
1972 icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1973     uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1974 {
1975         conn_t          *connp = coa->coa_connp;
1976         ip_xmit_attr_t  *ixa = coa->coa_ixa;
1977         icmp_t          *icmp = connp->conn_icmp;
1978         icmp_stack_t    *is = icmp->icmp_is;
1979         int             *i1 = (int *)invalp;
1980         boolean_t       onoff = (*i1 == 0) ? 0 : 1;
1981         int             error;
1982 
1983         ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1984 
1985         /*
1986          * For fixed length options, no sanity check
1987          * of passed in length is done. It is assumed *_optcom_req()
1988          * routines do the right thing.
1989          */
1990 
1991         switch (level) {
1992         case SOL_SOCKET:
1993                 switch (name) {
1994                 case SO_PROTOTYPE:
1995                         if ((*i1 & 0xFF) != IPPROTO_ICMP &&
1996                             (*i1 & 0xFF) != IPPROTO_ICMPV6 &&
1997                             secpolicy_net_rawaccess(cr) != 0) {
1998                                 return (EACCES);
1999                         }
2000                         if (checkonly)
2001                                 break;
2002 
2003                         mutex_enter(&connp->conn_lock);
2004                         connp->conn_proto = *i1 & 0xFF;
2005                         ixa->ixa_protocol = connp->conn_proto;
2006                         if ((connp->conn_proto == IPPROTO_RAW ||
2007                             connp->conn_proto == IPPROTO_IGMP) &&
2008                             connp->conn_family == AF_INET) {
2009                                 icmp->icmp_hdrincl = 1;
2010                                 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2011                         } else if (connp->conn_proto == IPPROTO_UDP ||
2012                             connp->conn_proto == IPPROTO_TCP ||
2013                             connp->conn_proto == IPPROTO_SCTP) {
2014                                 /* Used by test applications like psh */
2015                                 icmp->icmp_hdrincl = 0;
2016                                 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2017                         } else {
2018                                 icmp->icmp_hdrincl = 0;
2019                                 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM;
2020                         }
2021 
2022                         if (connp->conn_family == AF_INET6 &&
2023                             connp->conn_proto == IPPROTO_ICMPV6) {
2024                                 /* Set offset for icmp6_cksum */
2025                                 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM;
2026                                 ixa->ixa_raw_cksum_offset = 2;
2027                         }
2028                         if (icmp->icmp_filter != NULL &&
2029                             connp->conn_proto != IPPROTO_ICMPV6) {
2030                                 kmem_free(icmp->icmp_filter,
2031                                     sizeof (icmp6_filter_t));
2032                                 icmp->icmp_filter = NULL;
2033                         }
2034                         mutex_exit(&connp->conn_lock);
2035 
2036                         coa->coa_changed |= COA_HEADER_CHANGED;
2037                         /*
2038                          * For SCTP, we don't use icmp_bind_proto() for
2039                          * raw socket binding.
2040                          */
2041                         if (connp->conn_proto == IPPROTO_SCTP)
2042                                 return (0);
2043 
2044                         coa->coa_changed |= COA_ICMP_BIND_NEEDED;
2045                         return (0);
2046 
2047                 case SO_SNDBUF:
2048                         if (*i1 > is->is_max_buf) {
2049                                 return (ENOBUFS);
2050                         }
2051                         break;
2052                 case SO_RCVBUF:
2053                         if (*i1 > is->is_max_buf) {
2054                                 return (ENOBUFS);
2055                         }
2056                         break;
2057                 }
2058                 break;
2059 
2060         case IPPROTO_IP:
2061                 /*
2062                  * Only allow IPv4 option processing on IPv4 sockets.
2063                  */
2064                 if (connp->conn_family != AF_INET)
2065                         return (EINVAL);
2066 
2067                 switch (name) {
2068                 case IP_HDRINCL:
2069                         if (!checkonly) {
2070                                 mutex_enter(&connp->conn_lock);
2071                                 icmp->icmp_hdrincl = onoff;
2072                                 if (onoff)
2073                                         ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2074                                 else
2075                                         ixa->ixa_flags |= IXAF_SET_ULP_CKSUM;
2076                                 mutex_exit(&connp->conn_lock);
2077                         }
2078                         break;
2079                 }
2080                 break;
2081 
2082         case IPPROTO_IPV6:
2083                 if (connp->conn_family != AF_INET6)
2084                         return (EINVAL);
2085 
2086                 switch (name) {
2087                 case IPV6_CHECKSUM:
2088                         /*
2089                          * Integer offset into the user data of where the
2090                          * checksum is located.
2091                          * Offset of -1 disables option.
2092                          * Does not apply to IPPROTO_ICMPV6.
2093                          */
2094                         if (connp->conn_proto == IPPROTO_ICMPV6 ||
2095                             coa->coa_ancillary) {
2096                                 return (EINVAL);
2097                         }
2098                         if ((*i1 != -1) && ((*i1 < 0) || (*i1 & 0x1) != 0)) {
2099                                 /* Negative or not 16 bit aligned offset */
2100                                 return (EINVAL);
2101                         }
2102                         if (checkonly)
2103                                 break;
2104 
2105                         mutex_enter(&connp->conn_lock);
2106                         if (*i1 == -1) {
2107                                 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM;
2108                                 ixa->ixa_raw_cksum_offset = 0;
2109                                 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2110                         } else {
2111                                 ixa->ixa_flags |= IXAF_SET_RAW_CKSUM;
2112                                 ixa->ixa_raw_cksum_offset = *i1;
2113                                 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM;
2114                         }
2115                         mutex_exit(&connp->conn_lock);
2116                         break;
2117                 }
2118                 break;
2119 
2120         case IPPROTO_ICMPV6:
2121                 /*
2122                  * Only allow IPv6 option processing on IPv6 sockets.
2123                  */
2124                 if (connp->conn_family != AF_INET6)
2125                         return (EINVAL);
2126                 if (connp->conn_proto != IPPROTO_ICMPV6)
2127                         return (EINVAL);
2128 
2129                 switch (name) {
2130                 case ICMP6_FILTER:
2131                         if (checkonly)
2132                                 break;
2133 
2134                         if ((inlen != 0) &&
2135                             (inlen != sizeof (icmp6_filter_t)))
2136                                 return (EINVAL);
2137 
2138                         mutex_enter(&connp->conn_lock);
2139                         if (inlen == 0) {
2140                                 if (icmp->icmp_filter != NULL) {
2141                                         kmem_free(icmp->icmp_filter,
2142                                             sizeof (icmp6_filter_t));
2143                                         icmp->icmp_filter = NULL;
2144                                 }
2145                         } else {
2146                                 if (icmp->icmp_filter == NULL) {
2147                                         icmp->icmp_filter = kmem_alloc(
2148                                             sizeof (icmp6_filter_t),
2149                                             KM_NOSLEEP);
2150                                         if (icmp->icmp_filter == NULL) {
2151                                                 mutex_exit(&connp->conn_lock);
2152                                                 return (ENOBUFS);
2153                                         }
2154                                 }
2155                                 (void) bcopy(invalp, icmp->icmp_filter, inlen);
2156                         }
2157                         mutex_exit(&connp->conn_lock);
2158                         break;
2159                 }
2160                 break;
2161         }
2162         error = conn_opt_set(coa, level, name, inlen, invalp,
2163             checkonly, cr);
2164         return (error);
2165 }
2166 
2167 /*
2168  * This routine sets socket options.
2169  */
2170 int
2171 icmp_opt_set(conn_t *connp, uint_t optset_context, int level, int name,
2172     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
2173     void *thisdg_attrs, cred_t *cr)
2174 {
2175         icmp_t          *icmp = connp->conn_icmp;
2176         int             err;
2177         conn_opt_arg_t  coas, *coa;
2178         boolean_t       checkonly;
2179         icmp_stack_t    *is = icmp->icmp_is;
2180 
2181         switch (optset_context) {
2182         case SETFN_OPTCOM_CHECKONLY:
2183                 checkonly = B_TRUE;
2184                 /*
2185                  * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
2186                  * inlen != 0 implies value supplied and
2187                  *      we have to "pretend" to set it.
2188                  * inlen == 0 implies that there is no
2189                  *      value part in T_CHECK request and just validation
2190                  * done elsewhere should be enough, we just return here.
2191                  */
2192                 if (inlen == 0) {
2193                         *outlenp = 0;
2194                         return (0);
2195                 }
2196                 break;
2197         case SETFN_OPTCOM_NEGOTIATE:
2198                 checkonly = B_FALSE;
2199                 break;
2200         case SETFN_UD_NEGOTIATE:
2201         case SETFN_CONN_NEGOTIATE:
2202                 checkonly = B_FALSE;
2203                 /*
2204                  * Negotiating local and "association-related" options
2205                  * through T_UNITDATA_REQ.
2206                  *
2207                  * Following routine can filter out ones we do not
2208                  * want to be "set" this way.
2209                  */
2210                 if (!icmp_opt_allow_udr_set(level, name)) {
2211                         *outlenp = 0;
2212                         return (EINVAL);
2213                 }
2214                 break;
2215         default:
2216                 /*
2217                  * We should never get here
2218                  */
2219                 *outlenp = 0;
2220                 return (EINVAL);
2221         }
2222 
2223         ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
2224             (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
2225 
2226         if (thisdg_attrs != NULL) {
2227                 /* Options from T_UNITDATA_REQ */
2228                 coa = (conn_opt_arg_t *)thisdg_attrs;
2229                 ASSERT(coa->coa_connp == connp);
2230                 ASSERT(coa->coa_ixa != NULL);
2231                 ASSERT(coa->coa_ipp != NULL);
2232                 ASSERT(coa->coa_ancillary);
2233         } else {
2234                 coa = &coas;
2235                 coas.coa_connp = connp;
2236                 /* Get a reference on conn_ixa to prevent concurrent mods */
2237                 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
2238                 if (coas.coa_ixa == NULL) {
2239                         *outlenp = 0;
2240                         return (ENOMEM);
2241                 }
2242                 coas.coa_ipp = &connp->conn_xmit_ipp;
2243                 coas.coa_ancillary = B_FALSE;
2244                 coas.coa_changed = 0;
2245         }
2246 
2247         err = icmp_do_opt_set(coa, level, name, inlen, invalp,
2248             cr, checkonly);
2249         if (err != 0) {
2250 errout:
2251                 if (!coa->coa_ancillary)
2252                         ixa_refrele(coa->coa_ixa);
2253                 *outlenp = 0;
2254                 return (err);
2255         }
2256 
2257         /*
2258          * Common case of OK return with outval same as inval.
2259          */
2260         if (invalp != outvalp) {
2261                 /* don't trust bcopy for identical src/dst */
2262                 (void) bcopy(invalp, outvalp, inlen);
2263         }
2264         *outlenp = inlen;
2265 
2266         /*
2267          * If this was not ancillary data, then we rebuild the headers,
2268          * update the IRE/NCE, and IPsec as needed.
2269          * Since the label depends on the destination we go through
2270          * ip_set_destination first.
2271          */
2272         if (coa->coa_ancillary) {
2273                 return (0);
2274         }
2275 
2276         if (coa->coa_changed & COA_ROUTE_CHANGED) {
2277                 in6_addr_t saddr, faddr, nexthop;
2278                 in_port_t fport;
2279 
2280                 /*
2281                  * We clear lastdst to make sure we pick up the change
2282                  * next time sending.
2283                  * If we are connected we re-cache the information.
2284                  * We ignore errors to preserve BSD behavior.
2285                  * Note that we don't redo IPsec policy lookup here
2286                  * since the final destination (or source) didn't change.
2287                  */
2288                 mutex_enter(&connp->conn_lock);
2289                 connp->conn_v6lastdst = ipv6_all_zeros;
2290 
2291                 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
2292                     &connp->conn_faddr_v6, &nexthop);
2293                 saddr = connp->conn_saddr_v6;
2294                 faddr = connp->conn_faddr_v6;
2295                 fport = connp->conn_fport;
2296                 mutex_exit(&connp->conn_lock);
2297 
2298                 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
2299                     !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
2300                         (void) ip_attr_connect(connp, coa->coa_ixa,
2301                             &saddr, &faddr, &nexthop, fport, NULL, NULL,
2302                             IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
2303                 }
2304         }
2305 
2306         ixa_refrele(coa->coa_ixa);
2307 
2308         if (coa->coa_changed & COA_HEADER_CHANGED) {
2309                 /*
2310                  * Rebuild the header template if we are connected.
2311                  * Otherwise clear conn_v6lastdst so we rebuild the header
2312                  * in the data path.
2313                  */
2314                 mutex_enter(&connp->conn_lock);
2315                 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
2316                     !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
2317                         err = icmp_build_hdr_template(connp,
2318                             &connp->conn_saddr_v6, &connp->conn_faddr_v6,
2319                             connp->conn_flowinfo);
2320                         if (err != 0) {
2321                                 mutex_exit(&connp->conn_lock);
2322                                 return (err);
2323                         }
2324                 } else {
2325                         connp->conn_v6lastdst = ipv6_all_zeros;
2326                 }
2327                 mutex_exit(&connp->conn_lock);
2328         }
2329         if (coa->coa_changed & COA_RCVBUF_CHANGED) {
2330                 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2331                     connp->conn_rcvbuf);
2332         }
2333         if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
2334                 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
2335         }
2336         if (coa->coa_changed & COA_WROFF_CHANGED) {
2337                 /* Increase wroff if needed */
2338                 uint_t wroff;
2339 
2340                 mutex_enter(&connp->conn_lock);
2341                 wroff = connp->conn_ht_iphc_allocated + is->is_wroff_extra;
2342                 if (wroff > connp->conn_wroff) {
2343                         connp->conn_wroff = wroff;
2344                         mutex_exit(&connp->conn_lock);
2345                         (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
2346                 } else {
2347                         mutex_exit(&connp->conn_lock);
2348                 }
2349         }
2350         if (coa->coa_changed & COA_ICMP_BIND_NEEDED) {
2351                 icmp_bind_proto(icmp);
2352         }
2353         return (err);
2354 }
2355 
2356 /* This routine sets socket options. */
2357 int
2358 icmp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
2359     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
2360     void *thisdg_attrs, cred_t *cr)
2361 {
2362         conn_t  *connp = Q_TO_CONN(q);
2363         int error;
2364 
2365         error = icmp_opt_set(connp, optset_context, level, name, inlen, invalp,
2366             outlenp, outvalp, thisdg_attrs, cr);
2367         return (error);
2368 }
2369 
2370 /*
2371  * Setup IP headers.
2372  *
2373  * Note that IP_HDRINCL has ipha_protocol that is different than conn_proto,
2374  * but icmp_output_hdrincl restores ipha_protocol once we return.
2375  */
2376 mblk_t *
2377 icmp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
2378     const in6_addr_t *v6src, const in6_addr_t *v6dst, uint32_t flowinfo,
2379     mblk_t *data_mp, int *errorp)
2380 {
2381         mblk_t          *mp;
2382         icmp_stack_t    *is = connp->conn_netstack->netstack_icmp;
2383         uint_t          data_len;
2384         uint32_t        cksum;
2385 
2386         data_len = msgdsize(data_mp);
2387         mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, connp->conn_proto,
2388             flowinfo, 0, data_mp, data_len, is->is_wroff_extra, &cksum, errorp);
2389         if (mp == NULL) {
2390                 ASSERT(*errorp != 0);
2391                 return (NULL);
2392         }
2393 
2394         ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2395 
2396         /*
2397          * If there was a routing option/header then conn_prepend_hdr
2398          * has massaged it and placed the pseudo-header checksum difference
2399          * in the cksum argument.
2400          *
2401          * Prepare for ICMPv6 checksum done in IP.
2402          *
2403          * We make it easy for IP to include our pseudo header
2404          * by putting our length (and any routing header adjustment)
2405          * in the ICMPv6 checksum field.
2406          * The IP source, destination, and length have already been set by
2407          * conn_prepend_hdr.
2408          */
2409         cksum += data_len;
2410         cksum = (cksum >> 16) + (cksum & 0xFFFF);
2411         ASSERT(cksum < 0x10000);
2412 
2413         if (ixa->ixa_flags & IXAF_IS_IPV4) {
2414                 ipha_t  *ipha = (ipha_t *)mp->b_rptr;
2415 
2416                 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2417         } else {
2418                 ip6_t   *ip6h = (ip6_t *)mp->b_rptr;
2419                 uint_t  cksum_offset = 0;
2420 
2421                 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2422 
2423                 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) {
2424                         if (connp->conn_proto == IPPROTO_ICMPV6) {
2425                                 cksum_offset = ixa->ixa_ip_hdr_length +
2426                                     offsetof(icmp6_t, icmp6_cksum);
2427                         } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) {
2428                                 cksum_offset = ixa->ixa_ip_hdr_length +
2429                                     ixa->ixa_raw_cksum_offset;
2430                         }
2431                 }
2432                 if (cksum_offset != 0) {
2433                         uint16_t *ptr;
2434 
2435                         /* Make sure the checksum fits in the first mblk */
2436                         if (cksum_offset + sizeof (short) > MBLKL(mp)) {
2437                                 mblk_t *mp1;
2438 
2439                                 mp1 = msgpullup(mp,
2440                                     cksum_offset + sizeof (short));
2441                                 freemsg(mp);
2442                                 if (mp1 == NULL) {
2443                                         *errorp = ENOMEM;
2444                                         return (NULL);
2445                                 }
2446                                 mp = mp1;
2447                                 ip6h = (ip6_t *)mp->b_rptr;
2448                         }
2449                         ptr = (uint16_t *)(mp->b_rptr + cksum_offset);
2450                         *ptr = htons(cksum);
2451                 }
2452         }
2453 
2454         /* Note that we don't try to update wroff due to ancillary data */
2455         return (mp);
2456 }
2457 
2458 static int
2459 icmp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2460     const in6_addr_t *v6dst, uint32_t flowinfo)
2461 {
2462         int             error;
2463 
2464         ASSERT(MUTEX_HELD(&connp->conn_lock));
2465         /*
2466          * We clear lastdst to make sure we don't use the lastdst path
2467          * next time sending since we might not have set v6dst yet.
2468          */
2469         connp->conn_v6lastdst = ipv6_all_zeros;
2470 
2471         error = conn_build_hdr_template(connp, 0, 0, v6src, v6dst, flowinfo);
2472         if (error != 0)
2473                 return (error);
2474 
2475         /*
2476          * Any routing header/option has been massaged. The checksum difference
2477          * is stored in conn_sum.
2478          */
2479         return (0);
2480 }
2481 
2482 static mblk_t *
2483 icmp_queue_fallback(icmp_t *icmp, mblk_t *mp)
2484 {
2485         ASSERT(MUTEX_HELD(&icmp->icmp_recv_lock));
2486         if (IPCL_IS_NONSTR(icmp->icmp_connp)) {
2487                 /*
2488                  * fallback has started but messages have not been moved yet
2489                  */
2490                 if (icmp->icmp_fallback_queue_head == NULL) {
2491                         ASSERT(icmp->icmp_fallback_queue_tail == NULL);
2492                         icmp->icmp_fallback_queue_head = mp;
2493                         icmp->icmp_fallback_queue_tail = mp;
2494                 } else {
2495                         ASSERT(icmp->icmp_fallback_queue_tail != NULL);
2496                         icmp->icmp_fallback_queue_tail->b_next = mp;
2497                         icmp->icmp_fallback_queue_tail = mp;
2498                 }
2499                 return (NULL);
2500         } else {
2501                 /*
2502                  * Fallback completed, let the caller putnext() the mblk.
2503                  */
2504                 return (mp);
2505         }
2506 }
2507 
2508 /*
2509  * Deliver data to ULP. In case we have a socket, and it's falling back to
2510  * TPI, then we'll queue the mp for later processing.
2511  */
2512 static void
2513 icmp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len)
2514 {
2515         if (IPCL_IS_NONSTR(connp)) {
2516                 icmp_t *icmp = connp->conn_icmp;
2517                 int error;
2518 
2519                 ASSERT(len == msgdsize(mp));
2520                 if ((*connp->conn_upcalls->su_recv)
2521                     (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2522                         mutex_enter(&icmp->icmp_recv_lock);
2523                         if (error == ENOSPC) {
2524                                 /*
2525                                  * let's confirm while holding the lock
2526                                  */
2527                                 if ((*connp->conn_upcalls->su_recv)
2528                                     (connp->conn_upper_handle, NULL, 0, 0,
2529                                     &error, NULL) < 0) {
2530                                         ASSERT(error == ENOSPC);
2531                                         if (error == ENOSPC) {
2532                                                 connp->conn_flow_cntrld =
2533                                                     B_TRUE;
2534                                         }
2535                                 }
2536                                 mutex_exit(&icmp->icmp_recv_lock);
2537                         } else {
2538                                 ASSERT(error == EOPNOTSUPP);
2539                                 mp = icmp_queue_fallback(icmp, mp);
2540                                 mutex_exit(&icmp->icmp_recv_lock);
2541                                 if (mp != NULL)
2542                                         putnext(connp->conn_rq, mp);
2543                         }
2544                 }
2545                 ASSERT(MUTEX_NOT_HELD(&icmp->icmp_recv_lock));
2546         } else {
2547                 putnext(connp->conn_rq, mp);
2548         }
2549 }
2550 
2551 /*
2552  * This is the inbound data path.
2553  * IP has already pulled up the IP headers and verified alignment
2554  * etc.
2555  */
2556 /* ARGSUSED2 */
2557 static void
2558 icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2559 {
2560         conn_t                  *connp = (conn_t *)arg1;
2561         struct T_unitdata_ind   *tudi;
2562         uchar_t                 *rptr;          /* Pointer to IP header */
2563         int                     ip_hdr_length;
2564         int                     udi_size;       /* Size of T_unitdata_ind */
2565         int                     pkt_len;
2566         icmp_t                  *icmp;
2567         ip_pkt_t                ipps;
2568         ip6_t                   *ip6h;
2569         mblk_t                  *mp1;
2570         crb_t                   recv_ancillary;
2571         icmp_stack_t            *is;
2572         sin_t                   *sin;
2573         sin6_t                  *sin6;
2574         ipha_t                  *ipha;
2575 
2576         ASSERT(connp->conn_flags & IPCL_RAWIPCONN);
2577 
2578         icmp = connp->conn_icmp;
2579         is = icmp->icmp_is;
2580         rptr = mp->b_rptr;
2581 
2582         ASSERT(DB_TYPE(mp) == M_DATA);
2583         ASSERT(OK_32PTR(rptr));
2584         ASSERT(ira->ira_pktlen == msgdsize(mp));
2585         pkt_len = ira->ira_pktlen;
2586 
2587         /*
2588          * Get a snapshot of these and allow other threads to change
2589          * them after that. We need the same recv_ancillary when determining
2590          * the size as when adding the ancillary data items.
2591          */
2592         mutex_enter(&connp->conn_lock);
2593         recv_ancillary = connp->conn_recv_ancillary;
2594         mutex_exit(&connp->conn_lock);
2595 
2596         ip_hdr_length = ira->ira_ip_hdr_length;
2597         ASSERT(MBLKL(mp) >= ip_hdr_length);  /* IP did a pullup */
2598 
2599         /* Initialize regardless of IP version */
2600         ipps.ipp_fields = 0;
2601 
2602         if (ira->ira_flags & IRAF_IS_IPV4) {
2603                 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2604                 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2605                 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2606 
2607                 ipha = (ipha_t *)mp->b_rptr;
2608                 if (recv_ancillary.crb_all != 0)
2609                         (void) ip_find_hdr_v4(ipha, &ipps, B_FALSE);
2610 
2611                 /*
2612                  * BSD for some reason adjusts ipha_length to exclude the
2613                  * IP header length. We do the same.
2614                  */
2615                 if (is->is_bsd_compat) {
2616                         ushort_t len;
2617 
2618                         len = ntohs(ipha->ipha_length);
2619                         if (mp->b_datap->db_ref > 1) {
2620                                 /*
2621                                  * Allocate a new IP header so that we can
2622                                  * modify ipha_length.
2623                                  */
2624                                 mblk_t  *mp1;
2625 
2626                                 mp1 = allocb(ip_hdr_length, BPRI_MED);
2627                                 if (mp1 == NULL) {
2628                                         freemsg(mp);
2629                                         BUMP_MIB(&is->is_rawip_mib,
2630                                             rawipInErrors);
2631                                         return;
2632                                 }
2633                                 bcopy(rptr, mp1->b_rptr, ip_hdr_length);
2634                                 mp->b_rptr = rptr + ip_hdr_length;
2635                                 rptr = mp1->b_rptr;
2636                                 ipha = (ipha_t *)rptr;
2637                                 mp1->b_cont = mp;
2638                                 mp1->b_wptr = rptr + ip_hdr_length;
2639                                 mp = mp1;
2640                         }
2641                         len -= ip_hdr_length;
2642                         ipha->ipha_length = htons(len);
2643                 }
2644 
2645                 /*
2646                  * For RAW sockets we not pass ICMP/IPv4 packets to AF_INET6
2647                  * sockets. This is ensured by icmp_bind and the IP fanout code.
2648                  */
2649                 ASSERT(connp->conn_family == AF_INET);
2650 
2651                 /*
2652                  * This is the inbound data path.  Packets are passed upstream
2653                  * as T_UNITDATA_IND messages with full IPv4 headers still
2654                  * attached.
2655                  */
2656 
2657                 /*
2658                  * Normally only send up the source address.
2659                  * If any ancillary data items are wanted we add those.
2660                  */
2661                 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2662                 if (recv_ancillary.crb_all != 0) {
2663                         udi_size += conn_recvancillary_size(connp,
2664                             recv_ancillary, ira, mp, &ipps);
2665                 }
2666 
2667                 /* Allocate a message block for the T_UNITDATA_IND structure. */
2668                 mp1 = allocb(udi_size, BPRI_MED);
2669                 if (mp1 == NULL) {
2670                         freemsg(mp);
2671                         BUMP_MIB(&is->is_rawip_mib, rawipInErrors);
2672                         return;
2673                 }
2674                 mp1->b_cont = mp;
2675                 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2676                 mp1->b_datap->db_type = M_PROTO;
2677                 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2678                 tudi->PRIM_type = T_UNITDATA_IND;
2679                 tudi->SRC_length = sizeof (sin_t);
2680                 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2681                 sin = (sin_t *)&tudi[1];
2682                 *sin = sin_null;
2683                 sin->sin_family = AF_INET;
2684                 sin->sin_addr.s_addr = ipha->ipha_src;
2685                 *(uint32_t *)&sin->sin_zero[0] = 0;
2686                 *(uint32_t *)&sin->sin_zero[4] = 0;
2687                 tudi->OPT_offset =  sizeof (struct T_unitdata_ind) +
2688                     sizeof (sin_t);
2689                 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2690                 tudi->OPT_length = udi_size;
2691 
2692                 /*
2693                  * Add options if IP_RECVIF etc is set
2694                  */
2695                 if (udi_size != 0) {
2696                         conn_recvancillary_add(connp, recv_ancillary, ira,
2697                             &ipps, (uchar_t *)&sin[1], udi_size);
2698                 }
2699                 goto deliver;
2700         }
2701 
2702         ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2703         /*
2704          * IPv6 packets can only be received by applications
2705          * that are prepared to receive IPv6 addresses.
2706          * The IP fanout must ensure this.
2707          */
2708         ASSERT(connp->conn_family == AF_INET6);
2709 
2710         /*
2711          * Handle IPv6 packets. We don't pass up the IP headers with the
2712          * payload for IPv6.
2713          */
2714 
2715         ip6h = (ip6_t *)rptr;
2716         if (recv_ancillary.crb_all != 0) {
2717                 /*
2718                  * Call on ip_find_hdr_v6 which gets individual lenghts of
2719                  * extension headers (and pointers to them).
2720                  */
2721                 uint8_t         nexthdr;
2722 
2723                 /* We don't care about the length or nextheader. */
2724                 (void) ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps, &nexthdr);
2725 
2726                 /*
2727                  * We do not pass up hop-by-hop options or any other
2728                  * extension header as part of the packet. Applications
2729                  * that want to see them have to specify IPV6_RECV* socket
2730                  * options. And conn_recvancillary_size/add explicitly
2731                  * drops the TX option from IPV6_HOPOPTS as it does for UDP.
2732                  *
2733                  * If we had multilevel ICMP sockets, then we'd want to
2734                  * modify conn_recvancillary_size/add to
2735                  * allow the user to see the label.
2736                  */
2737         }
2738 
2739         /*
2740          * Check a filter for ICMPv6 types if needed.
2741          * Verify raw checksums if needed.
2742          */
2743         mutex_enter(&connp->conn_lock);
2744         if (icmp->icmp_filter != NULL) {
2745                 int type;
2746 
2747                 /* Assumes that IP has done the pullupmsg */
2748                 type = mp->b_rptr[ip_hdr_length];
2749 
2750                 ASSERT(mp->b_rptr + ip_hdr_length <= mp->b_wptr);
2751                 if (ICMP6_FILTER_WILLBLOCK(type, icmp->icmp_filter)) {
2752                         mutex_exit(&connp->conn_lock);
2753                         freemsg(mp);
2754                         return;
2755                 }
2756         }
2757         if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) {
2758                 /* Checksum */
2759                 uint16_t        *up;
2760                 uint32_t        sum;
2761                 int             remlen;
2762 
2763                 up = (uint16_t *)&ip6h->ip6_src;
2764 
2765                 remlen = msgdsize(mp) - ip_hdr_length;
2766                 sum = htons(connp->conn_proto + remlen)
2767                     + up[0] + up[1] + up[2] + up[3]
2768                     + up[4] + up[5] + up[6] + up[7]
2769                     + up[8] + up[9] + up[10] + up[11]
2770                     + up[12] + up[13] + up[14] + up[15];
2771                 sum = (sum & 0xffff) + (sum >> 16);
2772                 sum = IP_CSUM(mp, ip_hdr_length, sum);
2773                 if (sum != 0) {
2774                         /* IPv6 RAW checksum failed */
2775                         ip0dbg(("icmp_rput: RAW checksum failed %x\n", sum));
2776                         mutex_exit(&connp->conn_lock);
2777                         freemsg(mp);
2778                         BUMP_MIB(&is->is_rawip_mib, rawipInCksumErrs);
2779                         return;
2780                 }
2781         }
2782         mutex_exit(&connp->conn_lock);
2783 
2784         udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2785 
2786         if (recv_ancillary.crb_all != 0) {
2787                 udi_size += conn_recvancillary_size(connp,
2788                     recv_ancillary, ira, mp, &ipps);
2789         }
2790 
2791         mp1 = allocb(udi_size, BPRI_MED);
2792         if (mp1 == NULL) {
2793                 freemsg(mp);
2794                 BUMP_MIB(&is->is_rawip_mib, rawipInErrors);
2795                 return;
2796         }
2797         mp1->b_cont = mp;
2798         mp1->b_datap->db_type = M_PROTO;
2799         tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2800         mp1->b_wptr = (uchar_t *)tudi + udi_size;
2801         tudi->PRIM_type = T_UNITDATA_IND;
2802         tudi->SRC_length = sizeof (sin6_t);
2803         tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2804         tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2805         udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2806         tudi->OPT_length = udi_size;
2807         sin6 = (sin6_t *)&tudi[1];
2808         *sin6 = sin6_null;
2809         sin6->sin6_port = 0;
2810         sin6->sin6_family = AF_INET6;
2811 
2812         sin6->sin6_addr = ip6h->ip6_src;
2813         /* No sin6_flowinfo per API */
2814         sin6->sin6_flowinfo = 0;
2815         /* For link-scope pass up scope id */
2816         if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2817                 sin6->sin6_scope_id = ira->ira_ruifindex;
2818         else
2819                 sin6->sin6_scope_id = 0;
2820         sin6->__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst,
2821             IPCL_ZONEID(connp), is->is_netstack);
2822 
2823         if (udi_size != 0) {
2824                 conn_recvancillary_add(connp, recv_ancillary, ira,
2825                     &ipps, (uchar_t *)&sin6[1], udi_size);
2826         }
2827 
2828         /* Skip all the IPv6 headers per API */
2829         mp->b_rptr += ip_hdr_length;
2830         pkt_len -= ip_hdr_length;
2831 
2832 deliver:
2833         BUMP_MIB(&is->is_rawip_mib, rawipInDatagrams);
2834         icmp_ulp_recv(connp, mp1, pkt_len);
2835 }
2836 
2837 /*
2838  * return SNMP stuff in buffer in mpdata. We don't hold any lock and report
2839  * information that can be changing beneath us.
2840  */
2841 mblk_t *
2842 icmp_snmp_get(queue_t *q, mblk_t *mpctl)
2843 {
2844         mblk_t                  *mpdata;
2845         struct opthdr           *optp;
2846         conn_t                  *connp = Q_TO_CONN(q);
2847         icmp_stack_t            *is = connp->conn_netstack->netstack_icmp;
2848         mblk_t                  *mp2ctl;
2849 
2850         /*
2851          * make a copy of the original message
2852          */
2853         mp2ctl = copymsg(mpctl);
2854 
2855         if (mpctl == NULL ||
2856             (mpdata = mpctl->b_cont) == NULL) {
2857                 freemsg(mpctl);
2858                 freemsg(mp2ctl);
2859                 return (0);
2860         }
2861 
2862         /* fixed length structure for IPv4 and IPv6 counters */
2863         optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
2864         optp->level = EXPER_RAWIP;
2865         optp->name = 0;
2866         (void) snmp_append_data(mpdata, (char *)&is->is_rawip_mib,
2867             sizeof (is->is_rawip_mib));
2868         optp->len = msgdsize(mpdata);
2869         qreply(q, mpctl);
2870 
2871         return (mp2ctl);
2872 }
2873 
2874 /*
2875  * Return 0 if invalid set request, 1 otherwise, including non-rawip requests.
2876  * TODO:  If this ever actually tries to set anything, it needs to be
2877  * to do the appropriate locking.
2878  */
2879 /* ARGSUSED */
2880 int
2881 icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
2882     uchar_t *ptr, int len)
2883 {
2884         switch (level) {
2885         case EXPER_RAWIP:
2886                 return (0);
2887         default:
2888                 return (1);
2889         }
2890 }
2891 
2892 /*
2893  * This routine creates a T_UDERROR_IND message and passes it upstream.
2894  * The address and options are copied from the T_UNITDATA_REQ message
2895  * passed in mp.  This message is freed.
2896  */
2897 static void
2898 icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2899 {
2900         struct T_unitdata_req *tudr;
2901         mblk_t  *mp1;
2902         uchar_t *destaddr;
2903         t_scalar_t destlen;
2904         uchar_t *optaddr;
2905         t_scalar_t optlen;
2906 
2907         if ((mp->b_wptr < mp->b_rptr) ||
2908             (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2909                 goto done;
2910         }
2911         tudr = (struct T_unitdata_req *)mp->b_rptr;
2912         destaddr = mp->b_rptr + tudr->DEST_offset;
2913         if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2914             destaddr + tudr->DEST_length < mp->b_rptr ||
2915             destaddr + tudr->DEST_length > mp->b_wptr) {
2916                 goto done;
2917         }
2918         optaddr = mp->b_rptr + tudr->OPT_offset;
2919         if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2920             optaddr + tudr->OPT_length < mp->b_rptr ||
2921             optaddr + tudr->OPT_length > mp->b_wptr) {
2922                 goto done;
2923         }
2924         destlen = tudr->DEST_length;
2925         optlen = tudr->OPT_length;
2926 
2927         mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2928             (char *)optaddr, optlen, err);
2929         if (mp1 != NULL)
2930                 qreply(q, mp1);
2931 
2932 done:
2933         freemsg(mp);
2934 }
2935 
2936 static int
2937 rawip_do_unbind(conn_t *connp)
2938 {
2939         icmp_t  *icmp = connp->conn_icmp;
2940 
2941         mutex_enter(&connp->conn_lock);
2942         /* If a bind has not been done, we can't unbind. */
2943         if (icmp->icmp_state == TS_UNBND) {
2944                 mutex_exit(&connp->conn_lock);
2945                 return (-TOUTSTATE);
2946         }
2947         connp->conn_saddr_v6 = ipv6_all_zeros;
2948         connp->conn_bound_addr_v6 = ipv6_all_zeros;
2949         connp->conn_laddr_v6 = ipv6_all_zeros;
2950         connp->conn_mcbc_bind = B_FALSE;
2951         connp->conn_lport = 0;
2952         connp->conn_fport = 0;
2953         /* In case we were also connected */
2954         connp->conn_faddr_v6 = ipv6_all_zeros;
2955         connp->conn_v6lastdst = ipv6_all_zeros;
2956 
2957         icmp->icmp_state = TS_UNBND;
2958 
2959         (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
2960             &connp->conn_faddr_v6, connp->conn_flowinfo);
2961         mutex_exit(&connp->conn_lock);
2962 
2963         ip_unbind(connp);
2964         return (0);
2965 }
2966 
2967 /*
2968  * This routine is called by icmp_wput to handle T_UNBIND_REQ messages.
2969  * After some error checking, the message is passed downstream to ip.
2970  */
2971 static void
2972 icmp_tpi_unbind(queue_t *q, mblk_t *mp)
2973 {
2974         conn_t  *connp = Q_TO_CONN(q);
2975         int     error;
2976 
2977         ASSERT(mp->b_cont == NULL);
2978         error = rawip_do_unbind(connp);
2979         if (error) {
2980                 if (error < 0) {
2981                         icmp_err_ack(q, mp, -error, 0);
2982                 } else {
2983                         icmp_err_ack(q, mp, 0, error);
2984                 }
2985                 return;
2986         }
2987 
2988         /*
2989          * Convert mp into a T_OK_ACK
2990          */
2991 
2992         mp = mi_tpi_ok_ack_alloc(mp);
2993 
2994         /*
2995          * should not happen in practice... T_OK_ACK is smaller than the
2996          * original message.
2997          */
2998         ASSERT(mp != NULL);
2999         ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
3000         qreply(q, mp);
3001 }
3002 
3003 /*
3004  * Process IPv4 packets that already include an IP header.
3005  * Used when IP_HDRINCL has been set (implicit for IPPROTO_RAW and
3006  * IPPROTO_IGMP).
3007  * In this case we ignore the address and any options in the T_UNITDATA_REQ.
3008  *
3009  * The packet is assumed to have a base (20 byte) IP header followed
3010  * by the upper-layer protocol. We include any IP_OPTIONS including a
3011  * CIPSO label but otherwise preserve the base IP header.
3012  */
3013 static int
3014 icmp_output_hdrincl(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
3015 {
3016         icmp_t          *icmp = connp->conn_icmp;
3017         icmp_stack_t    *is = icmp->icmp_is;
3018         ipha_t          iphas;
3019         ipha_t          *ipha;
3020         int             ip_hdr_length;
3021         int             tp_hdr_len;
3022         ip_xmit_attr_t  *ixa;
3023         ip_pkt_t        *ipp;
3024         in6_addr_t      v6src;
3025         in6_addr_t      v6dst;
3026         in6_addr_t      v6nexthop;
3027         int             error;
3028         boolean_t       do_ipsec;
3029 
3030         /*
3031          * We need an exclusive copy of conn_ixa since the included IP
3032          * header could have any destination.
3033          * That copy has no pointers hence we
3034          * need to set them up once we've parsed the ancillary data.
3035          */
3036         ixa = conn_get_ixa_exclusive(connp);
3037         if (ixa == NULL) {
3038                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3039                 freemsg(mp);
3040                 return (ENOMEM);
3041         }
3042         ASSERT(cr != NULL);
3043         /*
3044          * Caller has a reference on cr; from db_credp or because we
3045          * are running in process context.
3046          */
3047         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3048         ixa->ixa_cred = cr;
3049         ixa->ixa_cpid = pid;
3050         if (is_system_labeled()) {
3051                 /* We need to restart with a label based on the cred */
3052                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3053         }
3054 
3055         /* In case previous destination was multicast or multirt */
3056         ip_attr_newdst(ixa);
3057 
3058         /* Get a copy of conn_xmit_ipp since the TX label might change it */
3059         ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
3060         if (ipp == NULL) {
3061                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3062                 ixa->ixa_cred = connp->conn_cred; /* Restore */
3063                 ixa->ixa_cpid = connp->conn_cpid;
3064                 ixa_refrele(ixa);
3065                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3066                 freemsg(mp);
3067                 return (ENOMEM);
3068         }
3069         mutex_enter(&connp->conn_lock);
3070         error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
3071         mutex_exit(&connp->conn_lock);
3072         if (error != 0) {
3073                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3074                 freemsg(mp);
3075                 goto done;
3076         }
3077 
3078         /* Sanity check length of packet */
3079         ipha = (ipha_t *)mp->b_rptr;
3080 
3081         ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
3082         if ((mp->b_wptr - mp->b_rptr) < IP_SIMPLE_HDR_LENGTH) {
3083                 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) {
3084                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3085                         freemsg(mp);
3086                         goto done;
3087                 }
3088                 ipha = (ipha_t *)mp->b_rptr;
3089         }
3090         ipha->ipha_version_and_hdr_length =
3091             (IP_VERSION<<4) | (ip_hdr_length>>2);
3092 
3093         /*
3094          * We set IXAF_DONTFRAG if the application set DF which makes
3095          * IP not fragment.
3096          */
3097         ipha->ipha_fragment_offset_and_flags &= htons(IPH_DF);
3098         if (ipha->ipha_fragment_offset_and_flags & htons(IPH_DF))
3099                 ixa->ixa_flags |= (IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
3100         else
3101                 ixa->ixa_flags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
3102 
3103         /* Even for multicast and broadcast we honor the apps ttl */
3104         ixa->ixa_flags |= IXAF_NO_TTL_CHANGE;
3105 
3106         /*
3107          * No source verification for non-local addresses
3108          */
3109         if (ipha->ipha_src != INADDR_ANY &&
3110             ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid,
3111             is->is_netstack->netstack_ip, B_FALSE)
3112             != IPVL_UNICAST_UP) {
3113                 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE;
3114         }
3115 
3116         if (ipha->ipha_dst == INADDR_ANY)
3117                 ipha->ipha_dst = htonl(INADDR_LOOPBACK);
3118 
3119         IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src);
3120         IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst);
3121 
3122         /* Defer IPsec if it might need to look at ICMP type/code */
3123         do_ipsec = ipha->ipha_protocol != IPPROTO_ICMP;
3124         ixa->ixa_flags |= IXAF_IS_IPV4;
3125 
3126         ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
3127         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop,
3128             connp->conn_fport, &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
3129             (do_ipsec ? IPDF_IPSEC : 0));
3130         switch (error) {
3131         case 0:
3132                 break;
3133         case EADDRNOTAVAIL:
3134                 /*
3135                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3136                  * Don't have the application see that errno
3137                  */
3138                 error = ENETUNREACH;
3139                 goto failed;
3140         case ENETDOWN:
3141                 /*
3142                  * Have !ipif_addr_ready address; drop packet silently
3143                  * until we can get applications to not send until we
3144                  * are ready.
3145                  */
3146                 error = 0;
3147                 goto failed;
3148         case EHOSTUNREACH:
3149         case ENETUNREACH:
3150                 if (ixa->ixa_ire != NULL) {
3151                         /*
3152                          * Let conn_ip_output/ire_send_noroute return
3153                          * the error and send any local ICMP error.
3154                          */
3155                         error = 0;
3156                         break;
3157                 }
3158                 /* FALLTHRU */
3159         default:
3160         failed:
3161                 freemsg(mp);
3162                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3163                 goto done;
3164         }
3165         if (ipha->ipha_src == INADDR_ANY)
3166                 IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src);
3167 
3168         /*
3169          * We might be going to a different destination than last time,
3170          * thus check that TX allows the communication and compute any
3171          * needed label.
3172          *
3173          * TSOL Note: We have an exclusive ipp and ixa for this thread so we
3174          * don't have to worry about concurrent threads.
3175          */
3176         if (is_system_labeled()) {
3177                 /*
3178                  * Check whether Trusted Solaris policy allows communication
3179                  * with this host, and pretend that the destination is
3180                  * unreachable if not.
3181                  * Compute any needed label and place it in ipp_label_v4/v6.
3182                  *
3183                  * Later conn_build_hdr_template/conn_prepend_hdr takes
3184                  * ipp_label_v4/v6 to form the packet.
3185                  *
3186                  * Tsol note: We have ipp structure local to this thread so
3187                  * no locking is needed.
3188                  */
3189                 error = conn_update_label(connp, ixa, &v6dst, ipp);
3190                 if (error != 0) {
3191                         freemsg(mp);
3192                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3193                         goto done;
3194                 }
3195         }
3196 
3197         /*
3198          * Save away a copy of the IPv4 header the application passed down
3199          * and then prepend an IPv4 header complete with any IP options
3200          * including label.
3201          * We need a struct copy since icmp_prepend_hdr will reuse the available
3202          * space in the mblk.
3203          */
3204         iphas = *ipha;
3205         mp->b_rptr += IP_SIMPLE_HDR_LENGTH;
3206 
3207         mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, 0, mp, &error);
3208         if (mp == NULL) {
3209                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3210                 ASSERT(error != 0);
3211                 goto done;
3212         }
3213         if (ixa->ixa_pktlen > IP_MAXPACKET) {
3214                 error = EMSGSIZE;
3215                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3216                 freemsg(mp);
3217                 goto done;
3218         }
3219         /* Restore key parts of the header that the application passed down */
3220         ipha = (ipha_t *)mp->b_rptr;
3221         ipha->ipha_type_of_service = iphas.ipha_type_of_service;
3222         ipha->ipha_ident = iphas.ipha_ident;
3223         ipha->ipha_fragment_offset_and_flags =
3224             iphas.ipha_fragment_offset_and_flags;
3225         ipha->ipha_ttl = iphas.ipha_ttl;
3226         ipha->ipha_protocol = iphas.ipha_protocol;
3227         ipha->ipha_src = iphas.ipha_src;
3228         ipha->ipha_dst = iphas.ipha_dst;
3229 
3230         ixa->ixa_protocol = ipha->ipha_protocol;
3231 
3232         /*
3233          * Make sure that the IP header plus any transport header that is
3234          * checksumed by ip_output is in the first mblk. (ip_output assumes
3235          * that at least the checksum field is in the first mblk.)
3236          */
3237         switch (ipha->ipha_protocol) {
3238         case IPPROTO_UDP:
3239                 tp_hdr_len = 8;
3240                 break;
3241         case IPPROTO_TCP:
3242                 tp_hdr_len = 20;
3243                 break;
3244         default:
3245                 tp_hdr_len = 0;
3246                 break;
3247         }
3248         ip_hdr_length = IPH_HDR_LENGTH(ipha);
3249         if (mp->b_wptr - mp->b_rptr < ip_hdr_length + tp_hdr_len) {
3250                 if (!pullupmsg(mp, ip_hdr_length + tp_hdr_len)) {
3251                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3252                         if (mp->b_cont == NULL)
3253                                 error = EINVAL;
3254                         else
3255                                 error = ENOMEM;
3256                         freemsg(mp);
3257                         goto done;
3258                 }
3259         }
3260 
3261         if (!do_ipsec) {
3262                 /* Policy might differ for different ICMP type/code */
3263                 if (ixa->ixa_ipsec_policy != NULL) {
3264                         IPPOL_REFRELE(ixa->ixa_ipsec_policy);
3265                         ixa->ixa_ipsec_policy = NULL;
3266                         ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
3267                 }
3268                 mp = ip_output_attach_policy(mp, ipha, NULL, connp, ixa);
3269                 if (mp == NULL) {
3270                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3271                         error = EHOSTUNREACH;   /* IPsec policy failure */
3272                         goto done;
3273                 }
3274         }
3275 
3276         /* We're done.  Pass the packet to ip. */
3277         BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3278 
3279         error = conn_ip_output(mp, ixa);
3280         /* No rawipOutErrors if an error since IP increases its error counter */
3281         switch (error) {
3282         case 0:
3283                 break;
3284         case EWOULDBLOCK:
3285                 (void) ixa_check_drain_insert(connp, ixa);
3286                 error = 0;
3287                 break;
3288         case EADDRNOTAVAIL:
3289                 /*
3290                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3291                  * Don't have the application see that errno
3292                  */
3293                 error = ENETUNREACH;
3294                 break;
3295         }
3296 done:
3297         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3298         ixa->ixa_cred = connp->conn_cred; /* Restore */
3299         ixa->ixa_cpid = connp->conn_cpid;
3300         ixa_refrele(ixa);
3301         ip_pkt_free(ipp);
3302         kmem_free(ipp, sizeof (*ipp));
3303         return (error);
3304 }
3305 
3306 static mblk_t *
3307 icmp_output_attach_policy(mblk_t *mp, conn_t *connp, ip_xmit_attr_t *ixa)
3308 {
3309         ipha_t  *ipha = NULL;
3310         ip6_t   *ip6h = NULL;
3311 
3312         if (ixa->ixa_flags & IXAF_IS_IPV4)
3313                 ipha = (ipha_t *)mp->b_rptr;
3314         else
3315                 ip6h = (ip6_t *)mp->b_rptr;
3316 
3317         if (ixa->ixa_ipsec_policy != NULL) {
3318                 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
3319                 ixa->ixa_ipsec_policy = NULL;
3320                 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
3321         }
3322         return (ip_output_attach_policy(mp, ipha, ip6h, connp, ixa));
3323 }
3324 
3325 /*
3326  * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
3327  * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
3328  * the TPI options, otherwise we take them from msg_control.
3329  * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
3330  * Always consumes mp; never consumes tudr_mp.
3331  */
3332 static int
3333 icmp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
3334     mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
3335 {
3336         icmp_t          *icmp = connp->conn_icmp;
3337         icmp_stack_t    *is = icmp->icmp_is;
3338         int             error;
3339         ip_xmit_attr_t  *ixa;
3340         ip_pkt_t        *ipp;
3341         in6_addr_t      v6src;
3342         in6_addr_t      v6dst;
3343         in6_addr_t      v6nexthop;
3344         in_port_t       dstport;
3345         uint32_t        flowinfo;
3346         int             is_absreq_failure = 0;
3347         conn_opt_arg_t  coas, *coa;
3348 
3349         ASSERT(tudr_mp != NULL || msg != NULL);
3350 
3351         /*
3352          * Get ixa before checking state to handle a disconnect race.
3353          *
3354          * We need an exclusive copy of conn_ixa since the ancillary data
3355          * options might modify it. That copy has no pointers hence we
3356          * need to set them up once we've parsed the ancillary data.
3357          */
3358         ixa = conn_get_ixa_exclusive(connp);
3359         if (ixa == NULL) {
3360                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3361                 freemsg(mp);
3362                 return (ENOMEM);
3363         }
3364         ASSERT(cr != NULL);
3365         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3366         ixa->ixa_cred = cr;
3367         ixa->ixa_cpid = pid;
3368         if (is_system_labeled()) {
3369                 /* We need to restart with a label based on the cred */
3370                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3371         }
3372 
3373         /* In case previous destination was multicast or multirt */
3374         ip_attr_newdst(ixa);
3375 
3376         /* Get a copy of conn_xmit_ipp since the options might change it */
3377         ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
3378         if (ipp == NULL) {
3379                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3380                 ixa->ixa_cred = connp->conn_cred; /* Restore */
3381                 ixa->ixa_cpid = connp->conn_cpid;
3382                 ixa_refrele(ixa);
3383                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3384                 freemsg(mp);
3385                 return (ENOMEM);
3386         }
3387         mutex_enter(&connp->conn_lock);
3388         error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
3389         mutex_exit(&connp->conn_lock);
3390         if (error != 0) {
3391                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3392                 freemsg(mp);
3393                 goto done;
3394         }
3395 
3396         /*
3397          * Parse the options and update ixa and ipp as a result.
3398          */
3399 
3400         coa = &coas;
3401         coa->coa_connp = connp;
3402         coa->coa_ixa = ixa;
3403         coa->coa_ipp = ipp;
3404         coa->coa_ancillary = B_TRUE;
3405         coa->coa_changed = 0;
3406 
3407         if (msg != NULL) {
3408                 error = process_auxiliary_options(connp, msg->msg_control,
3409                     msg->msg_controllen, coa, &icmp_opt_obj, icmp_opt_set, cr);
3410         } else {
3411                 struct T_unitdata_req *tudr;
3412 
3413                 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
3414                 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
3415                 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
3416                     &tudr->OPT_length, tudr->OPT_offset, cr, &icmp_opt_obj,
3417                     coa, &is_absreq_failure);
3418         }
3419         if (error != 0) {
3420                 /*
3421                  * Note: No special action needed in this
3422                  * module for "is_absreq_failure"
3423                  */
3424                 freemsg(mp);
3425                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3426                 goto done;
3427         }
3428         ASSERT(is_absreq_failure == 0);
3429 
3430         mutex_enter(&connp->conn_lock);
3431         /*
3432          * If laddr is unspecified then we look at sin6_src_id.
3433          * We will give precedence to a source address set with IPV6_PKTINFO
3434          * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3435          * want ip_attr_connect to select a source (since it can fail) when
3436          * IPV6_PKTINFO is specified.
3437          * If this doesn't result in a source address then we get a source
3438          * from ip_attr_connect() below.
3439          */
3440         v6src = connp->conn_saddr_v6;
3441         if (sin != NULL) {
3442                 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3443                 dstport = sin->sin_port;
3444                 flowinfo = 0;
3445                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3446                 ixa->ixa_flags |= IXAF_IS_IPV4;
3447         } else if (sin6 != NULL) {
3448                 boolean_t v4mapped;
3449                 uint_t srcid;
3450 
3451                 v6dst = sin6->sin6_addr;
3452                 dstport = sin6->sin6_port;
3453                 flowinfo = sin6->sin6_flowinfo;
3454                 srcid = sin6->__sin6_src_id;
3455                 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3456                         ixa->ixa_scopeid = sin6->sin6_scope_id;
3457                         ixa->ixa_flags |= IXAF_SCOPEID_SET;
3458                 } else {
3459                         ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3460                 }
3461                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3462                 if (v4mapped)
3463                         ixa->ixa_flags |= IXAF_IS_IPV4;
3464                 else
3465                         ixa->ixa_flags &= ~IXAF_IS_IPV4;
3466                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3467                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3468                             v4mapped, connp->conn_netstack)) {
3469                                 /* Mismatched v4mapped/v6 specified by srcid. */
3470                                 mutex_exit(&connp->conn_lock);
3471                                 error = EADDRNOTAVAIL;
3472                                 goto failed;    /* Does freemsg() and mib. */
3473                         }
3474                 }
3475         } else {
3476                 /* Connected case */
3477                 v6dst = connp->conn_faddr_v6;
3478                 flowinfo = connp->conn_flowinfo;
3479         }
3480         mutex_exit(&connp->conn_lock);
3481         /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3482         if (ipp->ipp_fields & IPPF_ADDR) {
3483                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3484                         if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3485                                 v6src = ipp->ipp_addr;
3486                 } else {
3487                         if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3488                                 v6src = ipp->ipp_addr;
3489                 }
3490         }
3491         /*
3492          * Allow source not assigned to the system
3493          * only if it is not a local addresses
3494          */
3495         if (!V6_OR_V4_INADDR_ANY(v6src)) {
3496                 ip_laddr_t laddr_type;
3497 
3498                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3499                         ipaddr_t v4src;
3500 
3501                         IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
3502                         laddr_type = ip_laddr_verify_v4(v4src, ixa->ixa_zoneid,
3503                             is->is_netstack->netstack_ip, B_FALSE);
3504                 } else {
3505                         laddr_type = ip_laddr_verify_v6(&v6src, ixa->ixa_zoneid,
3506                             is->is_netstack->netstack_ip, B_FALSE, B_FALSE);
3507                 }
3508                 if (laddr_type != IPVL_UNICAST_UP)
3509                         ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE;
3510         }
3511 
3512         ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
3513         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3514             &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
3515 
3516         switch (error) {
3517         case 0:
3518                 break;
3519         case EADDRNOTAVAIL:
3520                 /*
3521                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3522                  * Don't have the application see that errno
3523                  */
3524                 error = ENETUNREACH;
3525                 goto failed;
3526         case ENETDOWN:
3527                 /*
3528                  * Have !ipif_addr_ready address; drop packet silently
3529                  * until we can get applications to not send until we
3530                  * are ready.
3531                  */
3532                 error = 0;
3533                 goto failed;
3534         case EHOSTUNREACH:
3535         case ENETUNREACH:
3536                 if (ixa->ixa_ire != NULL) {
3537                         /*
3538                          * Let conn_ip_output/ire_send_noroute return
3539                          * the error and send any local ICMP error.
3540                          */
3541                         error = 0;
3542                         break;
3543                 }
3544                 /* FALLTHRU */
3545         default:
3546         failed:
3547                 freemsg(mp);
3548                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3549                 goto done;
3550         }
3551 
3552         /*
3553          * We might be going to a different destination than last time,
3554          * thus check that TX allows the communication and compute any
3555          * needed label.
3556          *
3557          * TSOL Note: We have an exclusive ipp and ixa for this thread so we
3558          * don't have to worry about concurrent threads.
3559          */
3560         if (is_system_labeled()) {
3561                 /*
3562                  * Check whether Trusted Solaris policy allows communication
3563                  * with this host, and pretend that the destination is
3564                  * unreachable if not.
3565                  * Compute any needed label and place it in ipp_label_v4/v6.
3566                  *
3567                  * Later conn_build_hdr_template/conn_prepend_hdr takes
3568                  * ipp_label_v4/v6 to form the packet.
3569                  *
3570                  * Tsol note: We have ipp structure local to this thread so
3571                  * no locking is needed.
3572                  */
3573                 error = conn_update_label(connp, ixa, &v6dst, ipp);
3574                 if (error != 0) {
3575                         freemsg(mp);
3576                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3577                         goto done;
3578                 }
3579         }
3580         mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, flowinfo, mp,
3581             &error);
3582         if (mp == NULL) {
3583                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3584                 ASSERT(error != 0);
3585                 goto done;
3586         }
3587         if (ixa->ixa_pktlen > IP_MAXPACKET) {
3588                 error = EMSGSIZE;
3589                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3590                 freemsg(mp);
3591                 goto done;
3592         }
3593 
3594         /* Policy might differ for different ICMP type/code */
3595         mp = icmp_output_attach_policy(mp, connp, ixa);
3596         if (mp == NULL) {
3597                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3598                 error = EHOSTUNREACH;   /* IPsec policy failure */
3599                 goto done;
3600         }
3601 
3602         /* We're done.  Pass the packet to ip. */
3603         BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3604 
3605         error = conn_ip_output(mp, ixa);
3606         if (!connp->conn_unspec_src)
3607                 ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
3608         /* No rawipOutErrors if an error since IP increases its error counter */
3609         switch (error) {
3610         case 0:
3611                 break;
3612         case EWOULDBLOCK:
3613                 (void) ixa_check_drain_insert(connp, ixa);
3614                 error = 0;
3615                 break;
3616         case EADDRNOTAVAIL:
3617                 /*
3618                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3619                  * Don't have the application see that errno
3620                  */
3621                 error = ENETUNREACH;
3622                 /* FALLTHRU */
3623         default:
3624                 mutex_enter(&connp->conn_lock);
3625                 /*
3626                  * Clear the source and v6lastdst so we call ip_attr_connect
3627                  * for the next packet and try to pick a better source.
3628                  */
3629                 if (connp->conn_mcbc_bind)
3630                         connp->conn_saddr_v6 = ipv6_all_zeros;
3631                 else
3632                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3633                 connp->conn_v6lastdst = ipv6_all_zeros;
3634                 mutex_exit(&connp->conn_lock);
3635                 break;
3636         }
3637 done:
3638         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3639         ixa->ixa_cred = connp->conn_cred; /* Restore */
3640         ixa->ixa_cpid = connp->conn_cpid;
3641         ixa_refrele(ixa);
3642         ip_pkt_free(ipp);
3643         kmem_free(ipp, sizeof (*ipp));
3644         return (error);
3645 }
3646 
3647 /*
3648  * Handle sending an M_DATA for a connected socket.
3649  * Handles both IPv4 and IPv6.
3650  */
3651 int
3652 icmp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
3653 {
3654         icmp_t          *icmp = connp->conn_icmp;
3655         icmp_stack_t    *is = icmp->icmp_is;
3656         int             error;
3657         ip_xmit_attr_t  *ixa;
3658         boolean_t       do_ipsec;
3659 
3660         /*
3661          * If no other thread is using conn_ixa this just gets a reference to
3662          * conn_ixa. Otherwise we get a safe copy of conn_ixa.
3663          */
3664         ixa = conn_get_ixa(connp, B_FALSE);
3665         if (ixa == NULL) {
3666                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3667                 freemsg(mp);
3668                 return (ENOMEM);
3669         }
3670 
3671         ASSERT(cr != NULL);
3672         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3673         ixa->ixa_cred = cr;
3674         ixa->ixa_cpid = pid;
3675 
3676         /* Defer IPsec if it might need to look at ICMP type/code */
3677         switch (ixa->ixa_protocol) {
3678         case IPPROTO_ICMP:
3679         case IPPROTO_ICMPV6:
3680                 do_ipsec = B_FALSE;
3681                 break;
3682         default:
3683                 do_ipsec = B_TRUE;
3684         }
3685 
3686         mutex_enter(&connp->conn_lock);
3687         mp = icmp_prepend_header_template(connp, ixa, mp,
3688             &connp->conn_saddr_v6, connp->conn_flowinfo, &error);
3689 
3690         if (mp == NULL) {
3691                 ASSERT(error != 0);
3692                 mutex_exit(&connp->conn_lock);
3693                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3694                 ixa->ixa_cred = connp->conn_cred; /* Restore */
3695                 ixa->ixa_cpid = connp->conn_cpid;
3696                 ixa_refrele(ixa);
3697                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3698                 freemsg(mp);
3699                 return (error);
3700         }
3701 
3702         if (!do_ipsec) {
3703                 /* Policy might differ for different ICMP type/code */
3704                 mp = icmp_output_attach_policy(mp, connp, ixa);
3705                 if (mp == NULL) {
3706                         mutex_exit(&connp->conn_lock);
3707                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3708                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3709                         ixa->ixa_cred = connp->conn_cred; /* Restore */
3710                         ixa->ixa_cpid = connp->conn_cpid;
3711                         ixa_refrele(ixa);
3712                         return (EHOSTUNREACH);  /* IPsec policy failure */
3713                 }
3714         }
3715 
3716         /*
3717          * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3718          * safe copy, then we need to fill in any pointers in it.
3719          */
3720         if (ixa->ixa_ire == NULL) {
3721                 in6_addr_t      faddr, saddr;
3722                 in6_addr_t      nexthop;
3723                 in_port_t       fport;
3724 
3725                 saddr = connp->conn_saddr_v6;
3726                 faddr = connp->conn_faddr_v6;
3727                 fport = connp->conn_fport;
3728                 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
3729                 mutex_exit(&connp->conn_lock);
3730 
3731                 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
3732                     fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
3733                     (do_ipsec ? IPDF_IPSEC : 0));
3734                 switch (error) {
3735                 case 0:
3736                         break;
3737                 case EADDRNOTAVAIL:
3738                         /*
3739                          * IXAF_VERIFY_SOURCE tells us to pick a better source.
3740                          * Don't have the application see that errno
3741                          */
3742                         error = ENETUNREACH;
3743                         goto failed;
3744                 case ENETDOWN:
3745                         /*
3746                          * Have !ipif_addr_ready address; drop packet silently
3747                          * until we can get applications to not send until we
3748                          * are ready.
3749                          */
3750                         error = 0;
3751                         goto failed;
3752                 case EHOSTUNREACH:
3753                 case ENETUNREACH:
3754                         if (ixa->ixa_ire != NULL) {
3755                                 /*
3756                                  * Let conn_ip_output/ire_send_noroute return
3757                                  * the error and send any local ICMP error.
3758                                  */
3759                                 error = 0;
3760                                 break;
3761                         }
3762                         /* FALLTHRU */
3763                 default:
3764                 failed:
3765                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3766                         ixa->ixa_cred = connp->conn_cred; /* Restore */
3767                         ixa->ixa_cpid = connp->conn_cpid;
3768                         ixa_refrele(ixa);
3769                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3770                         freemsg(mp);
3771                         return (error);
3772                 }
3773         } else {
3774                 /* Done with conn_t */
3775                 mutex_exit(&connp->conn_lock);
3776         }
3777 
3778         /* We're done.  Pass the packet to ip. */
3779         BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3780 
3781         error = conn_ip_output(mp, ixa);
3782         /* No rawipOutErrors if an error since IP increases its error counter */
3783         switch (error) {
3784         case 0:
3785                 break;
3786         case EWOULDBLOCK:
3787                 (void) ixa_check_drain_insert(connp, ixa);
3788                 error = 0;
3789                 break;
3790         case EADDRNOTAVAIL:
3791                 /*
3792                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3793                  * Don't have the application see that errno
3794                  */
3795                 error = ENETUNREACH;
3796                 break;
3797         }
3798         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3799         ixa->ixa_cred = connp->conn_cred; /* Restore */
3800         ixa->ixa_cpid = connp->conn_cpid;
3801         ixa_refrele(ixa);
3802         return (error);
3803 }
3804 
3805 /*
3806  * Handle sending an M_DATA to the last destination.
3807  * Handles both IPv4 and IPv6.
3808  *
3809  * NOTE: The caller must hold conn_lock and we drop it here.
3810  */
3811 int
3812 icmp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3813     ip_xmit_attr_t *ixa)
3814 {
3815         icmp_t          *icmp = connp->conn_icmp;
3816         icmp_stack_t    *is = icmp->icmp_is;
3817         int             error;
3818         boolean_t       do_ipsec;
3819 
3820         ASSERT(MUTEX_HELD(&connp->conn_lock));
3821         ASSERT(ixa != NULL);
3822 
3823         ASSERT(cr != NULL);
3824         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3825         ixa->ixa_cred = cr;
3826         ixa->ixa_cpid = pid;
3827 
3828         /* Defer IPsec if it might need to look at ICMP type/code */
3829         switch (ixa->ixa_protocol) {
3830         case IPPROTO_ICMP:
3831         case IPPROTO_ICMPV6:
3832                 do_ipsec = B_FALSE;
3833                 break;
3834         default:
3835                 do_ipsec = B_TRUE;
3836         }
3837 
3838 
3839         mp = icmp_prepend_header_template(connp, ixa, mp,
3840             &connp->conn_v6lastsrc, connp->conn_lastflowinfo, &error);
3841 
3842         if (mp == NULL) {
3843                 ASSERT(error != 0);
3844                 mutex_exit(&connp->conn_lock);
3845                 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3846                 ixa->ixa_cred = connp->conn_cred; /* Restore */
3847                 ixa->ixa_cpid = connp->conn_cpid;
3848                 ixa_refrele(ixa);
3849                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3850                 freemsg(mp);
3851                 return (error);
3852         }
3853 
3854         if (!do_ipsec) {
3855                 /* Policy might differ for different ICMP type/code */
3856                 mp = icmp_output_attach_policy(mp, connp, ixa);
3857                 if (mp == NULL) {
3858                         mutex_exit(&connp->conn_lock);
3859                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3860                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3861                         ixa->ixa_cred = connp->conn_cred; /* Restore */
3862                         ixa->ixa_cpid = connp->conn_cpid;
3863                         ixa_refrele(ixa);
3864                         return (EHOSTUNREACH);  /* IPsec policy failure */
3865                 }
3866         }
3867 
3868         /*
3869          * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3870          * safe copy, then we need to fill in any pointers in it.
3871          */
3872         if (ixa->ixa_ire == NULL) {
3873                 in6_addr_t      lastdst, lastsrc;
3874                 in6_addr_t      nexthop;
3875                 in_port_t       lastport;
3876 
3877                 lastsrc = connp->conn_v6lastsrc;
3878                 lastdst = connp->conn_v6lastdst;
3879                 lastport = connp->conn_lastdstport;
3880                 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3881                 mutex_exit(&connp->conn_lock);
3882 
3883                 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3884                     &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3885                     IPDF_VERIFY_DST | (do_ipsec ? IPDF_IPSEC : 0));
3886                 switch (error) {
3887                 case 0:
3888                         break;
3889                 case EADDRNOTAVAIL:
3890                         /*
3891                          * IXAF_VERIFY_SOURCE tells us to pick a better source.
3892                          * Don't have the application see that errno
3893                          */
3894                         error = ENETUNREACH;
3895                         goto failed;
3896                 case ENETDOWN:
3897                         /*
3898                          * Have !ipif_addr_ready address; drop packet silently
3899                          * until we can get applications to not send until we
3900                          * are ready.
3901                          */
3902                         error = 0;
3903                         goto failed;
3904                 case EHOSTUNREACH:
3905                 case ENETUNREACH:
3906                         if (ixa->ixa_ire != NULL) {
3907                                 /*
3908                                  * Let conn_ip_output/ire_send_noroute return
3909                                  * the error and send any local ICMP error.
3910                                  */
3911                                 error = 0;
3912                                 break;
3913                         }
3914                         /* FALLTHRU */
3915                 default:
3916                 failed:
3917                         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3918                         ixa->ixa_cred = connp->conn_cred; /* Restore */
3919                         ixa->ixa_cpid = connp->conn_cpid;
3920                         ixa_refrele(ixa);
3921                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3922                         freemsg(mp);
3923                         return (error);
3924                 }
3925         } else {
3926                 /* Done with conn_t */
3927                 mutex_exit(&connp->conn_lock);
3928         }
3929 
3930         /* We're done.  Pass the packet to ip. */
3931         BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3932         error = conn_ip_output(mp, ixa);
3933         /* No rawipOutErrors if an error since IP increases its error counter */
3934         switch (error) {
3935         case 0:
3936                 break;
3937         case EWOULDBLOCK:
3938                 (void) ixa_check_drain_insert(connp, ixa);
3939                 error = 0;
3940                 break;
3941         case EADDRNOTAVAIL:
3942                 /*
3943                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
3944                  * Don't have the application see that errno
3945                  */
3946                 error = ENETUNREACH;
3947                 /* FALLTHRU */
3948         default:
3949                 mutex_enter(&connp->conn_lock);
3950                 /*
3951                  * Clear the source and v6lastdst so we call ip_attr_connect
3952                  * for the next packet and try to pick a better source.
3953                  */
3954                 if (connp->conn_mcbc_bind)
3955                         connp->conn_saddr_v6 = ipv6_all_zeros;
3956                 else
3957                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3958                 connp->conn_v6lastdst = ipv6_all_zeros;
3959                 mutex_exit(&connp->conn_lock);
3960                 break;
3961         }
3962         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3963         ixa->ixa_cred = connp->conn_cred; /* Restore */
3964         ixa->ixa_cpid = connp->conn_cpid;
3965         ixa_refrele(ixa);
3966         return (error);
3967 }
3968 
3969 
3970 /*
3971  * Prepend the header template and then fill in the source and
3972  * flowinfo. The caller needs to handle the destination address since
3973  * it's setting is different if rthdr or source route.
3974  *
3975  * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3976  * When it returns NULL it sets errorp.
3977  */
3978 static mblk_t *
3979 icmp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3980     const in6_addr_t *v6src, uint32_t flowinfo, int *errorp)
3981 {
3982         icmp_t          *icmp = connp->conn_icmp;
3983         icmp_stack_t    *is = icmp->icmp_is;
3984         uint_t          pktlen;
3985         uint_t          copylen;
3986         uint8_t         *iph;
3987         uint_t          ip_hdr_length;
3988         uint32_t        cksum;
3989         ip_pkt_t        *ipp;
3990 
3991         ASSERT(MUTEX_HELD(&connp->conn_lock));
3992 
3993         /*
3994          * Copy the header template.
3995          */
3996         copylen = connp->conn_ht_iphc_len;
3997         pktlen = copylen + msgdsize(mp);
3998         if (pktlen > IP_MAXPACKET) {
3999                 freemsg(mp);
4000                 *errorp = EMSGSIZE;
4001                 return (NULL);
4002         }
4003         ixa->ixa_pktlen = pktlen;
4004 
4005         /* check/fix buffer config, setup pointers into it */
4006         iph = mp->b_rptr - copylen;
4007         if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
4008                 mblk_t *mp1;
4009 
4010                 mp1 = allocb(copylen + is->is_wroff_extra, BPRI_MED);
4011                 if (mp1 == NULL) {
4012                         freemsg(mp);
4013                         *errorp = ENOMEM;
4014                         return (NULL);
4015                 }
4016                 mp1->b_wptr = DB_LIM(mp1);
4017                 mp1->b_cont = mp;
4018                 mp = mp1;
4019                 iph = (mp->b_wptr - copylen);
4020         }
4021         mp->b_rptr = iph;
4022         bcopy(connp->conn_ht_iphc, iph, copylen);
4023         ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
4024 
4025         ixa->ixa_ip_hdr_length = ip_hdr_length;
4026 
4027         /*
4028          * Prepare for ICMPv6 checksum done in IP.
4029          *
4030          * icmp_build_hdr_template has already massaged any routing header
4031          * and placed the result in conn_sum.
4032          *
4033          * We make it easy for IP to include our pseudo header
4034          * by putting our length (and any routing header adjustment)
4035          * in the ICMPv6 checksum field.
4036          */
4037         cksum = pktlen - ip_hdr_length;
4038 
4039         cksum += connp->conn_sum;
4040         cksum = (cksum >> 16) + (cksum & 0xFFFF);
4041         ASSERT(cksum < 0x10000);
4042 
4043         ipp = &connp->conn_xmit_ipp;
4044         if (ixa->ixa_flags & IXAF_IS_IPV4) {
4045                 ipha_t  *ipha = (ipha_t *)iph;
4046 
4047                 ipha->ipha_length = htons((uint16_t)pktlen);
4048 
4049                 /* if IP_PKTINFO specified an addres it wins over bind() */
4050                 if ((ipp->ipp_fields & IPPF_ADDR) &&
4051                     IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
4052                         ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
4053                         ipha->ipha_src = ipp->ipp_addr_v4;
4054                 } else {
4055                         IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
4056                 }
4057         } else {
4058                 ip6_t *ip6h = (ip6_t *)iph;
4059                 uint_t  cksum_offset = 0;
4060 
4061                 ip6h->ip6_plen =  htons((uint16_t)(pktlen - IPV6_HDR_LEN));
4062 
4063                 /* if IP_PKTINFO specified an addres it wins over bind() */
4064                 if ((ipp->ipp_fields & IPPF_ADDR) &&
4065                     !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
4066                         ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
4067                         ip6h->ip6_src = ipp->ipp_addr;
4068                 } else {
4069                         ip6h->ip6_src = *v6src;
4070                 }
4071                 ip6h->ip6_vcf =
4072                     (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
4073                     (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
4074                 if (ipp->ipp_fields & IPPF_TCLASS) {
4075                         /* Overrides the class part of flowinfo */
4076                         ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
4077                             ipp->ipp_tclass);
4078                 }
4079 
4080                 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) {
4081                         if (connp->conn_proto == IPPROTO_ICMPV6) {
4082                                 cksum_offset = ixa->ixa_ip_hdr_length +
4083                                     offsetof(icmp6_t, icmp6_cksum);
4084                         } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) {
4085                                 cksum_offset = ixa->ixa_ip_hdr_length +
4086                                     ixa->ixa_raw_cksum_offset;
4087                         }
4088                 }
4089                 if (cksum_offset != 0) {
4090                         uint16_t *ptr;
4091 
4092                         /* Make sure the checksum fits in the first mblk */
4093                         if (cksum_offset + sizeof (short) > MBLKL(mp)) {
4094                                 mblk_t *mp1;
4095 
4096                                 mp1 = msgpullup(mp,
4097                                     cksum_offset + sizeof (short));
4098                                 freemsg(mp);
4099                                 if (mp1 == NULL) {
4100                                         *errorp = ENOMEM;
4101                                         return (NULL);
4102                                 }
4103                                 mp = mp1;
4104                                 iph = mp->b_rptr;
4105                                 ip6h = (ip6_t *)iph;
4106                         }
4107                         ptr = (uint16_t *)(mp->b_rptr + cksum_offset);
4108                         *ptr = htons(cksum);
4109                 }
4110         }
4111 
4112         return (mp);
4113 }
4114 
4115 /*
4116  * This routine handles all messages passed downstream.  It either
4117  * consumes the message or passes it downstream; it never queues a
4118  * a message.
4119  */
4120 int
4121 icmp_wput(queue_t *q, mblk_t *mp)
4122 {
4123         sin6_t          *sin6;
4124         sin_t           *sin = NULL;
4125         uint_t          srcid;
4126         conn_t          *connp = Q_TO_CONN(q);
4127         icmp_t          *icmp = connp->conn_icmp;
4128         int             error = 0;
4129         struct sockaddr *addr = NULL;
4130         socklen_t       addrlen;
4131         icmp_stack_t    *is = icmp->icmp_is;
4132         struct T_unitdata_req *tudr;
4133         mblk_t          *data_mp;
4134         cred_t          *cr;
4135         pid_t           pid;
4136 
4137         /*
4138          * We directly handle several cases here: T_UNITDATA_REQ message
4139          * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
4140          * socket.
4141          */
4142         switch (DB_TYPE(mp)) {
4143         case M_DATA:
4144                 /* sockfs never sends down M_DATA */
4145                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4146                 freemsg(mp);
4147                 return (0);
4148 
4149         case M_PROTO:
4150         case M_PCPROTO:
4151                 tudr = (struct T_unitdata_req *)mp->b_rptr;
4152                 if (MBLKL(mp) < sizeof (*tudr) ||
4153                     ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
4154                         icmp_wput_other(q, mp);
4155                         return (0);
4156                 }
4157                 break;
4158 
4159         default:
4160                 icmp_wput_other(q, mp);
4161                 return (0);
4162         }
4163 
4164         /* Handle valid T_UNITDATA_REQ here */
4165         data_mp = mp->b_cont;
4166         if (data_mp == NULL) {
4167                 error = EPROTO;
4168                 goto ud_error2;
4169         }
4170         mp->b_cont = NULL;
4171 
4172         if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
4173                 error = EADDRNOTAVAIL;
4174                 goto ud_error2;
4175         }
4176 
4177         /*
4178          * All Solaris components should pass a db_credp
4179          * for this message, hence we ASSERT.
4180          * On production kernels we return an error to be robust against
4181          * random streams modules sitting on top of us.
4182          */
4183         cr = msg_getcred(mp, &pid);
4184         ASSERT(cr != NULL);
4185         if (cr == NULL) {
4186                 error = EINVAL;
4187                 goto ud_error2;
4188         }
4189 
4190         /*
4191          * If a port has not been bound to the stream, fail.
4192          * This is not a problem when sockfs is directly
4193          * above us, because it will ensure that the socket
4194          * is first bound before allowing data to be sent.
4195          */
4196         if (icmp->icmp_state == TS_UNBND) {
4197                 error = EPROTO;
4198                 goto ud_error2;
4199         }
4200         addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
4201         addrlen = tudr->DEST_length;
4202 
4203         switch (connp->conn_family) {
4204         case AF_INET6:
4205                 sin6 = (sin6_t *)addr;
4206                 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
4207                     (sin6->sin6_family != AF_INET6)) {
4208                         error = EADDRNOTAVAIL;
4209                         goto ud_error2;
4210                 }
4211 
4212                 /* No support for mapped addresses on raw sockets */
4213                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4214                         error = EADDRNOTAVAIL;
4215                         goto ud_error2;
4216                 }
4217                 srcid = sin6->__sin6_src_id;
4218 
4219                 /*
4220                  * If the local address is a mapped address return
4221                  * an error.
4222                  * It would be possible to send an IPv6 packet but the
4223                  * response would never make it back to the application
4224                  * since it is bound to a mapped address.
4225                  */
4226                 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
4227                         error = EADDRNOTAVAIL;
4228                         goto ud_error2;
4229                 }
4230 
4231                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
4232                         sin6->sin6_addr = ipv6_loopback;
4233 
4234                 if (tudr->OPT_length != 0) {
4235                         /*
4236                          * If we are connected then the destination needs to be
4237                          * the same as the connected one.
4238                          */
4239                         if (icmp->icmp_state == TS_DATA_XFER &&
4240                             !conn_same_as_last_v6(connp, sin6)) {
4241                                 error = EISCONN;
4242                                 goto ud_error2;
4243                         }
4244                         error = icmp_output_ancillary(connp, NULL, sin6,
4245                             data_mp, mp, NULL, cr, pid);
4246                 } else {
4247                         ip_xmit_attr_t *ixa;
4248 
4249                         /*
4250                          * We have to allocate an ip_xmit_attr_t before we grab
4251                          * conn_lock and we need to hold conn_lock once we've
4252                          * checked conn_same_as_last_v6 to handle concurrent
4253                          * send* calls on a socket.
4254                          */
4255                         ixa = conn_get_ixa(connp, B_FALSE);
4256                         if (ixa == NULL) {
4257                                 error = ENOMEM;
4258                                 goto ud_error2;
4259                         }
4260                         mutex_enter(&connp->conn_lock);
4261 
4262                         if (conn_same_as_last_v6(connp, sin6) &&
4263                             connp->conn_lastsrcid == srcid &&
4264                             ipsec_outbound_policy_current(ixa)) {
4265                                 /* icmp_output_lastdst drops conn_lock */
4266                                 error = icmp_output_lastdst(connp, data_mp, cr,
4267                                     pid, ixa);
4268                         } else {
4269                                 /* icmp_output_newdst drops conn_lock */
4270                                 error = icmp_output_newdst(connp, data_mp, NULL,
4271                                     sin6, cr, pid, ixa);
4272                         }
4273                         ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
4274                 }
4275                 if (error == 0) {
4276                         freeb(mp);
4277                         return (0);
4278                 }
4279                 break;
4280 
4281         case AF_INET:
4282                 sin = (sin_t *)addr;
4283                 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
4284                     (sin->sin_family != AF_INET)) {
4285                         error = EADDRNOTAVAIL;
4286                         goto ud_error2;
4287                 }
4288                 if (sin->sin_addr.s_addr == INADDR_ANY)
4289                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
4290 
4291                 /* Protocol 255 contains full IP headers */
4292                 /* Read without holding lock */
4293                 if (icmp->icmp_hdrincl) {
4294                         if (MBLKL(data_mp) < IP_SIMPLE_HDR_LENGTH) {
4295                                 if (!pullupmsg(data_mp, IP_SIMPLE_HDR_LENGTH)) {
4296                                         error = EINVAL;
4297                                         goto ud_error2;
4298                                 }
4299                         }
4300                         error = icmp_output_hdrincl(connp, data_mp, cr, pid);
4301                         if (error == 0) {
4302                                 freeb(mp);
4303                                 return (0);
4304                         }
4305                         /* data_mp consumed above */
4306                         data_mp = NULL;
4307                         goto ud_error2;
4308                 }
4309 
4310                 if (tudr->OPT_length != 0) {
4311                         /*
4312                          * If we are connected then the destination needs to be
4313                          * the same as the connected one.
4314                          */
4315                         if (icmp->icmp_state == TS_DATA_XFER &&
4316                             !conn_same_as_last_v4(connp, sin)) {
4317                                 error = EISCONN;
4318                                 goto ud_error2;
4319                         }
4320                         error = icmp_output_ancillary(connp, sin, NULL,
4321                             data_mp, mp, NULL, cr, pid);
4322                 } else {
4323                         ip_xmit_attr_t *ixa;
4324 
4325                         /*
4326                          * We have to allocate an ip_xmit_attr_t before we grab
4327                          * conn_lock and we need to hold conn_lock once we've
4328                          * checked conn_same_as_last_v4 to handle concurrent
4329                          * send* calls on a socket.
4330                          */
4331                         ixa = conn_get_ixa(connp, B_FALSE);
4332                         if (ixa == NULL) {
4333                                 error = ENOMEM;
4334                                 goto ud_error2;
4335                         }
4336                         mutex_enter(&connp->conn_lock);
4337 
4338                         if (conn_same_as_last_v4(connp, sin) &&
4339                             ipsec_outbound_policy_current(ixa)) {
4340                                 /* icmp_output_lastdst drops conn_lock */
4341                                 error = icmp_output_lastdst(connp, data_mp, cr,
4342                                     pid, ixa);
4343                         } else {
4344                                 /* icmp_output_newdst drops conn_lock */
4345                                 error = icmp_output_newdst(connp, data_mp, sin,
4346                                     NULL, cr, pid, ixa);
4347                         }
4348                         ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
4349                 }
4350                 if (error == 0) {
4351                         freeb(mp);
4352                         return (0);
4353                 }
4354                 break;
4355         }
4356         ASSERT(mp != NULL);
4357         /* mp is freed by the following routine */
4358         icmp_ud_err(q, mp, (t_scalar_t)error);
4359         return (0);
4360 
4361 ud_error2:
4362         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4363         freemsg(data_mp);
4364         ASSERT(mp != NULL);
4365         /* mp is freed by the following routine */
4366         icmp_ud_err(q, mp, (t_scalar_t)error);
4367         return (0);
4368 }
4369 
4370 /*
4371  * Handle the case of the IP address or flow label being different
4372  * for both IPv4 and IPv6.
4373  *
4374  * NOTE: The caller must hold conn_lock and we drop it here.
4375  */
4376 static int
4377 icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
4378     cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
4379 {
4380         icmp_t          *icmp = connp->conn_icmp;
4381         icmp_stack_t    *is = icmp->icmp_is;
4382         int             error;
4383         ip_xmit_attr_t  *oldixa;
4384         boolean_t       do_ipsec;
4385         uint_t          srcid;
4386         uint32_t        flowinfo;
4387         in6_addr_t      v6src;
4388         in6_addr_t      v6dst;
4389         in6_addr_t      v6nexthop;
4390         in_port_t       dstport;
4391 
4392         ASSERT(MUTEX_HELD(&connp->conn_lock));
4393         ASSERT(ixa != NULL);
4394 
4395         /*
4396          * We hold conn_lock across all the use and modifications of
4397          * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
4398          * stay consistent.
4399          */
4400 
4401         ASSERT(cr != NULL);
4402         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4403         ixa->ixa_cred = cr;
4404         ixa->ixa_cpid = pid;
4405         if (is_system_labeled()) {
4406                 /* We need to restart with a label based on the cred */
4407                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
4408         }
4409         /*
4410          * If we are connected then the destination needs to be the
4411          * same as the connected one, which is not the case here since we
4412          * checked for that above.
4413          */
4414         if (icmp->icmp_state == TS_DATA_XFER) {
4415                 mutex_exit(&connp->conn_lock);
4416                 error = EISCONN;
4417                 goto ud_error;
4418         }
4419 
4420         /* In case previous destination was multicast or multirt */
4421         ip_attr_newdst(ixa);
4422 
4423         /*
4424          * If laddr is unspecified then we look at sin6_src_id.
4425          * We will give precedence to a source address set with IPV6_PKTINFO
4426          * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
4427          * want ip_attr_connect to select a source (since it can fail) when
4428          * IPV6_PKTINFO is specified.
4429          * If this doesn't result in a source address then we get a source
4430          * from ip_attr_connect() below.
4431          */
4432         v6src = connp->conn_saddr_v6;
4433         if (sin != NULL) {
4434                 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
4435                 dstport = sin->sin_port;
4436                 flowinfo = 0;
4437                 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
4438                 srcid = 0;
4439                 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
4440                 ixa->ixa_flags |= IXAF_IS_IPV4;
4441         } else {
4442                 boolean_t v4mapped;
4443 
4444                 v6dst = sin6->sin6_addr;
4445                 dstport = sin6->sin6_port;
4446                 flowinfo = sin6->sin6_flowinfo;
4447                 srcid = sin6->__sin6_src_id;
4448                 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
4449                         ixa->ixa_scopeid = sin6->sin6_scope_id;
4450                         ixa->ixa_flags |= IXAF_SCOPEID_SET;
4451                 } else {
4452                         ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
4453                 }
4454                 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
4455                 if (v4mapped)
4456                         ixa->ixa_flags |= IXAF_IS_IPV4;
4457                 else
4458                         ixa->ixa_flags &= ~IXAF_IS_IPV4;
4459                 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
4460                         if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
4461                             v4mapped, connp->conn_netstack)) {
4462                                 /* Mismatched v4mapped/v6 specified by srcid. */
4463                                 mutex_exit(&connp->conn_lock);
4464                                 error = EADDRNOTAVAIL;
4465                                 goto ud_error;
4466                         }
4467                 }
4468         }
4469         /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
4470         if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
4471                 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
4472 
4473                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4474                         if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
4475                                 v6src = ipp->ipp_addr;
4476                 } else {
4477                         if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
4478                                 v6src = ipp->ipp_addr;
4479                 }
4480         }
4481 
4482         /* Defer IPsec if it might need to look at ICMP type/code */
4483         switch (ixa->ixa_protocol) {
4484         case IPPROTO_ICMP:
4485         case IPPROTO_ICMPV6:
4486                 do_ipsec = B_FALSE;
4487                 break;
4488         default:
4489                 do_ipsec = B_TRUE;
4490         }
4491 
4492         ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
4493         mutex_exit(&connp->conn_lock);
4494 
4495         error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
4496             &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
4497             (do_ipsec ? IPDF_IPSEC : 0));
4498         switch (error) {
4499         case 0:
4500                 break;
4501         case EADDRNOTAVAIL:
4502                 /*
4503                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
4504                  * Don't have the application see that errno
4505                  */
4506                 error = ENETUNREACH;
4507                 goto failed;
4508         case ENETDOWN:
4509                 /*
4510                  * Have !ipif_addr_ready address; drop packet silently
4511                  * until we can get applications to not send until we
4512                  * are ready.
4513                  */
4514                 error = 0;
4515                 goto failed;
4516         case EHOSTUNREACH:
4517         case ENETUNREACH:
4518                 if (ixa->ixa_ire != NULL) {
4519                         /*
4520                          * Let conn_ip_output/ire_send_noroute return
4521                          * the error and send any local ICMP error.
4522                          */
4523                         error = 0;
4524                         break;
4525                 }
4526                 /* FALLTHRU */
4527         default:
4528         failed:
4529                 goto ud_error;
4530         }
4531 
4532         mutex_enter(&connp->conn_lock);
4533         /*
4534          * While we dropped the lock some other thread might have connected
4535          * this socket. If so we bail out with EISCONN to ensure that the
4536          * connecting thread is the one that updates conn_ixa, conn_ht_*
4537          * and conn_*last*.
4538          */
4539         if (icmp->icmp_state == TS_DATA_XFER) {
4540                 mutex_exit(&connp->conn_lock);
4541                 error = EISCONN;
4542                 goto ud_error;
4543         }
4544 
4545         /*
4546          * We need to rebuild the headers if
4547          *  - we are labeling packets (could be different for different
4548          *    destinations)
4549          *  - we have a source route (or routing header) since we need to
4550          *    massage that to get the pseudo-header checksum
4551          *  - a socket option with COA_HEADER_CHANGED has been set which
4552          *    set conn_v6lastdst to zero.
4553          *
4554          * Otherwise the prepend function will just update the src, dst,
4555          * and flow label.
4556          */
4557         if (is_system_labeled()) {
4558                 /* TX MLP requires SCM_UCRED and don't have that here */
4559                 if (connp->conn_mlp_type != mlptSingle) {
4560                         mutex_exit(&connp->conn_lock);
4561                         error = ECONNREFUSED;
4562                         goto ud_error;
4563                 }
4564                 /*
4565                  * Check whether Trusted Solaris policy allows communication
4566                  * with this host, and pretend that the destination is
4567                  * unreachable if not.
4568                  * Compute any needed label and place it in ipp_label_v4/v6.
4569                  *
4570                  * Later conn_build_hdr_template/conn_prepend_hdr takes
4571                  * ipp_label_v4/v6 to form the packet.
4572                  *
4573                  * Tsol note: Since we hold conn_lock we know no other
4574                  * thread manipulates conn_xmit_ipp.
4575                  */
4576                 error = conn_update_label(connp, ixa, &v6dst,
4577                     &connp->conn_xmit_ipp);
4578                 if (error != 0) {
4579                         mutex_exit(&connp->conn_lock);
4580                         goto ud_error;
4581                 }
4582                 /* Rebuild the header template */
4583                 error = icmp_build_hdr_template(connp, &v6src, &v6dst,
4584                     flowinfo);
4585                 if (error != 0) {
4586                         mutex_exit(&connp->conn_lock);
4587                         goto ud_error;
4588                 }
4589         } else if (connp->conn_xmit_ipp.ipp_fields &
4590             (IPPF_IPV4_OPTIONS|IPPF_RTHDR) ||
4591             IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
4592                 /* Rebuild the header template */
4593                 error = icmp_build_hdr_template(connp, &v6src, &v6dst,
4594                     flowinfo);
4595                 if (error != 0) {
4596                         mutex_exit(&connp->conn_lock);
4597                         goto ud_error;
4598                 }
4599         } else {
4600                 /* Simply update the destination address if no source route */
4601                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4602                         ipha_t  *ipha = (ipha_t *)connp->conn_ht_iphc;
4603 
4604                         IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
4605                         if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
4606                                 ipha->ipha_fragment_offset_and_flags |=
4607                                     IPH_DF_HTONS;
4608                         } else {
4609                                 ipha->ipha_fragment_offset_and_flags &=
4610                                     ~IPH_DF_HTONS;
4611                         }
4612                 } else {
4613                         ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
4614                         ip6h->ip6_dst = v6dst;
4615                 }
4616         }
4617 
4618         /*
4619          * Remember the dst etc which corresponds to the built header
4620          * template and conn_ixa.
4621          */
4622         oldixa = conn_replace_ixa(connp, ixa);
4623         connp->conn_v6lastdst = v6dst;
4624         connp->conn_lastflowinfo = flowinfo;
4625         connp->conn_lastscopeid = ixa->ixa_scopeid;
4626         connp->conn_lastsrcid = srcid;
4627         /* Also remember a source to use together with lastdst */
4628         connp->conn_v6lastsrc = v6src;
4629 
4630         data_mp = icmp_prepend_header_template(connp, ixa, data_mp, &v6src,
4631             flowinfo, &error);
4632 
4633         /* Done with conn_t */
4634         mutex_exit(&connp->conn_lock);
4635         ixa_refrele(oldixa);
4636 
4637         if (data_mp == NULL) {
4638                 ASSERT(error != 0);
4639                 goto ud_error;
4640         }
4641 
4642         if (!do_ipsec) {
4643                 /* Policy might differ for different ICMP type/code */
4644                 data_mp = icmp_output_attach_policy(data_mp, connp, ixa);
4645                 if (data_mp == NULL) {
4646                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4647                         error = EHOSTUNREACH;   /* IPsec policy failure */
4648                         goto done;
4649                 }
4650         }
4651 
4652         /* We're done.  Pass the packet to ip. */
4653         BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
4654 
4655         error = conn_ip_output(data_mp, ixa);
4656         /* No rawipOutErrors if an error since IP increases its error counter */
4657         switch (error) {
4658         case 0:
4659                 break;
4660         case EWOULDBLOCK:
4661                 (void) ixa_check_drain_insert(connp, ixa);
4662                 error = 0;
4663                 break;
4664         case EADDRNOTAVAIL:
4665                 /*
4666                  * IXAF_VERIFY_SOURCE tells us to pick a better source.
4667                  * Don't have the application see that errno
4668                  */
4669                 error = ENETUNREACH;
4670                 /* FALLTHRU */
4671         default:
4672                 mutex_enter(&connp->conn_lock);
4673                 /*
4674                  * Clear the source and v6lastdst so we call ip_attr_connect
4675                  * for the next packet and try to pick a better source.
4676                  */
4677                 if (connp->conn_mcbc_bind)
4678                         connp->conn_saddr_v6 = ipv6_all_zeros;
4679                 else
4680                         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
4681                 connp->conn_v6lastdst = ipv6_all_zeros;
4682                 mutex_exit(&connp->conn_lock);
4683                 break;
4684         }
4685 done:
4686         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4687         ixa->ixa_cred = connp->conn_cred; /* Restore */
4688         ixa->ixa_cpid = connp->conn_cpid;
4689         ixa_refrele(ixa);
4690         return (error);
4691 
4692 ud_error:
4693         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4694         ixa->ixa_cred = connp->conn_cred; /* Restore */
4695         ixa->ixa_cpid = connp->conn_cpid;
4696         ixa_refrele(ixa);
4697 
4698         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4699         freemsg(data_mp);
4700         return (error);
4701 }
4702 
4703 /* ARGSUSED */
4704 static int
4705 icmp_wput_fallback(queue_t *q, mblk_t *mp)
4706 {
4707 #ifdef DEBUG
4708         cmn_err(CE_CONT, "icmp_wput_fallback: Message during fallback \n");
4709 #endif
4710         freemsg(mp);
4711         return (0);
4712 }
4713 
4714 static void
4715 icmp_wput_other(queue_t *q, mblk_t *mp)
4716 {
4717         uchar_t *rptr = mp->b_rptr;
4718         struct iocblk *iocp;
4719         conn_t  *connp = Q_TO_CONN(q);
4720         icmp_t  *icmp = connp->conn_icmp;
4721         cred_t *cr;
4722 
4723         switch (mp->b_datap->db_type) {
4724         case M_PROTO:
4725         case M_PCPROTO:
4726                 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4727                         /*
4728                          * If the message does not contain a PRIM_type,
4729                          * throw it away.
4730                          */
4731                         freemsg(mp);
4732                         return;
4733                 }
4734                 switch (((t_primp_t)rptr)->type) {
4735                 case T_ADDR_REQ:
4736                         icmp_addr_req(q, mp);
4737                         return;
4738                 case O_T_BIND_REQ:
4739                 case T_BIND_REQ:
4740                         icmp_tpi_bind(q, mp);
4741                         return;
4742                 case T_CONN_REQ:
4743                         icmp_tpi_connect(q, mp);
4744                         return;
4745                 case T_CAPABILITY_REQ:
4746                         icmp_capability_req(q, mp);
4747                         return;
4748                 case T_INFO_REQ:
4749                         icmp_info_req(q, mp);
4750                         return;
4751                 case T_UNITDATA_REQ:
4752                         /*
4753                          * If a T_UNITDATA_REQ gets here, the address must
4754                          * be bad.  Valid T_UNITDATA_REQs are handled
4755                          * in icmp_wput.
4756                          */
4757                         icmp_ud_err(q, mp, EADDRNOTAVAIL);
4758                         return;
4759                 case T_UNBIND_REQ:
4760                         icmp_tpi_unbind(q, mp);
4761                         return;
4762                 case T_SVR4_OPTMGMT_REQ:
4763                         /*
4764                          * All Solaris components should pass a db_credp
4765                          * for this TPI message, hence we ASSERT.
4766                          * But in case there is some other M_PROTO that looks
4767                          * like a TPI message sent by some other kernel
4768                          * component, we check and return an error.
4769                          */
4770                         cr = msg_getcred(mp, NULL);
4771                         ASSERT(cr != NULL);
4772                         if (cr == NULL) {
4773                                 icmp_err_ack(q, mp, TSYSERR, EINVAL);
4774                                 return;
4775                         }
4776 
4777                         if (!snmpcom_req(q, mp, icmp_snmp_set, ip_snmp_get,
4778                             cr)) {
4779                                 svr4_optcom_req(q, mp, cr, &icmp_opt_obj);
4780                         }
4781                         return;
4782 
4783                 case T_OPTMGMT_REQ:
4784                         /*
4785                          * All Solaris components should pass a db_credp
4786                          * for this TPI message, hence we ASSERT.
4787                          * But in case there is some other M_PROTO that looks
4788                          * like a TPI message sent by some other kernel
4789                          * component, we check and return an error.
4790                          */
4791                         cr = msg_getcred(mp, NULL);
4792                         ASSERT(cr != NULL);
4793                         if (cr == NULL) {
4794                                 icmp_err_ack(q, mp, TSYSERR, EINVAL);
4795                                 return;
4796                         }
4797                         tpi_optcom_req(q, mp, cr, &icmp_opt_obj);
4798                         return;
4799 
4800                 case T_DISCON_REQ:
4801                         icmp_tpi_disconnect(q, mp);
4802                         return;
4803 
4804                 /* The following TPI message is not supported by icmp. */
4805                 case O_T_CONN_RES:
4806                 case T_CONN_RES:
4807                         icmp_err_ack(q, mp, TNOTSUPPORT, 0);
4808                         return;
4809 
4810                 /* The following 3 TPI requests are illegal for icmp. */
4811                 case T_DATA_REQ:
4812                 case T_EXDATA_REQ:
4813                 case T_ORDREL_REQ:
4814                         icmp_err_ack(q, mp, TNOTSUPPORT, 0);
4815                         return;
4816                 default:
4817                         break;
4818                 }
4819                 break;
4820         case M_FLUSH:
4821                 if (*rptr & FLUSHW)
4822                         flushq(q, FLUSHDATA);
4823                 break;
4824         case M_IOCTL:
4825                 iocp = (struct iocblk *)mp->b_rptr;
4826                 switch (iocp->ioc_cmd) {
4827                 case TI_GETPEERNAME:
4828                         if (icmp->icmp_state != TS_DATA_XFER) {
4829                                 /*
4830                                  * If a default destination address has not
4831                                  * been associated with the stream, then we
4832                                  * don't know the peer's name.
4833                                  */
4834                                 iocp->ioc_error = ENOTCONN;
4835                                 iocp->ioc_count = 0;
4836                                 mp->b_datap->db_type = M_IOCACK;
4837                                 qreply(q, mp);
4838                                 return;
4839                         }
4840                         /* FALLTHRU */
4841                 case TI_GETMYNAME:
4842                         /*
4843                          * For TI_GETPEERNAME and TI_GETMYNAME, we first
4844                          * need to copyin the user's strbuf structure.
4845                          * Processing will continue in the M_IOCDATA case
4846                          * below.
4847                          */
4848                         mi_copyin(q, mp, NULL,
4849                             SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4850                         return;
4851                 default:
4852                         break;
4853                 }
4854                 break;
4855         case M_IOCDATA:
4856                 icmp_wput_iocdata(q, mp);
4857                 return;
4858         default:
4859                 /* Unrecognized messages are passed through without change. */
4860                 break;
4861         }
4862         ip_wput_nondata(q, mp);
4863 }
4864 
4865 /*
4866  * icmp_wput_iocdata is called by icmp_wput_other to handle all M_IOCDATA
4867  * messages.
4868  */
4869 static void
4870 icmp_wput_iocdata(queue_t *q, mblk_t *mp)
4871 {
4872         mblk_t          *mp1;
4873         STRUCT_HANDLE(strbuf, sb);
4874         uint_t          addrlen;
4875         conn_t          *connp = Q_TO_CONN(q);
4876         icmp_t          *icmp = connp->conn_icmp;
4877 
4878         /* Make sure it is one of ours. */
4879         switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4880         case TI_GETMYNAME:
4881         case TI_GETPEERNAME:
4882                 break;
4883         default:
4884                 ip_wput_nondata(q, mp);
4885                 return;
4886         }
4887 
4888         switch (mi_copy_state(q, mp, &mp1)) {
4889         case -1:
4890                 return;
4891         case MI_COPY_CASE(MI_COPY_IN, 1):
4892                 break;
4893         case MI_COPY_CASE(MI_COPY_OUT, 1):
4894                 /*
4895                  * The address has been copied out, so now
4896                  * copyout the strbuf.
4897                  */
4898                 mi_copyout(q, mp);
4899                 return;
4900         case MI_COPY_CASE(MI_COPY_OUT, 2):
4901                 /*
4902                  * The address and strbuf have been copied out.
4903                  * We're done, so just acknowledge the original
4904                  * M_IOCTL.
4905                  */
4906                 mi_copy_done(q, mp, 0);
4907                 return;
4908         default:
4909                 /*
4910                  * Something strange has happened, so acknowledge
4911                  * the original M_IOCTL with an EPROTO error.
4912                  */
4913                 mi_copy_done(q, mp, EPROTO);
4914                 return;
4915         }
4916 
4917         /*
4918          * Now we have the strbuf structure for TI_GETMYNAME
4919          * and TI_GETPEERNAME.  Next we copyout the requested
4920          * address and then we'll copyout the strbuf.
4921          */
4922         STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag,
4923             (void *)mp1->b_rptr);
4924 
4925         if (connp->conn_family == AF_INET)
4926                 addrlen = sizeof (sin_t);
4927         else
4928                 addrlen = sizeof (sin6_t);
4929 
4930         if (STRUCT_FGET(sb, maxlen) < addrlen) {
4931                 mi_copy_done(q, mp, EINVAL);
4932                 return;
4933         }
4934         switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4935         case TI_GETMYNAME:
4936                 break;
4937         case TI_GETPEERNAME:
4938                 if (icmp->icmp_state != TS_DATA_XFER) {
4939                         mi_copy_done(q, mp, ENOTCONN);
4940                         return;
4941                 }
4942                 break;
4943         default:
4944                 mi_copy_done(q, mp, EPROTO);
4945                 return;
4946         }
4947         mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4948         if (!mp1)
4949                 return;
4950 
4951         STRUCT_FSET(sb, len, addrlen);
4952         switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4953         case TI_GETMYNAME:
4954                 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4955                     &addrlen);
4956                 break;
4957         case TI_GETPEERNAME:
4958                 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4959                     &addrlen);
4960                 break;
4961         }
4962         mp1->b_wptr += addrlen;
4963         /* Copy out the address */
4964         mi_copyout(q, mp);
4965 }
4966 
4967 void
4968 icmp_ddi_g_init(void)
4969 {
4970         icmp_max_optsize = optcom_max_optsize(icmp_opt_obj.odb_opt_des_arr,
4971             icmp_opt_obj.odb_opt_arr_cnt);
4972 
4973         /*
4974          * We want to be informed each time a stack is created or
4975          * destroyed in the kernel, so we can maintain the
4976          * set of icmp_stack_t's.
4977          */
4978         netstack_register(NS_ICMP, rawip_stack_init, NULL, rawip_stack_fini);
4979 }
4980 
4981 void
4982 icmp_ddi_g_destroy(void)
4983 {
4984         netstack_unregister(NS_ICMP);
4985 }
4986 
4987 #define INET_NAME       "ip"
4988 
4989 /*
4990  * Initialize the ICMP stack instance.
4991  */
4992 static void *
4993 rawip_stack_init(netstackid_t stackid, netstack_t *ns)
4994 {
4995         icmp_stack_t    *is;
4996         int             error = 0;
4997         size_t          arrsz;
4998         major_t         major;
4999 
5000         is = (icmp_stack_t *)kmem_zalloc(sizeof (*is), KM_SLEEP);
5001         is->is_netstack = ns;
5002 
5003         arrsz = sizeof (icmp_propinfo_tbl);
5004         is->is_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP);
5005         bcopy(icmp_propinfo_tbl, is->is_propinfo_tbl, arrsz);
5006 
5007         is->is_ksp = rawip_kstat_init(stackid);
5008 
5009         major = mod_name_to_major(INET_NAME);
5010         error = ldi_ident_from_major(major, &is->is_ldi_ident);
5011         ASSERT(error == 0);
5012         return (is);
5013 }
5014 
5015 /*
5016  * Free the ICMP stack instance.
5017  */
5018 static void
5019 rawip_stack_fini(netstackid_t stackid, void *arg)
5020 {
5021         icmp_stack_t *is = (icmp_stack_t *)arg;
5022 
5023         kmem_free(is->is_propinfo_tbl, sizeof (icmp_propinfo_tbl));
5024         is->is_propinfo_tbl = NULL;
5025 
5026         rawip_kstat_fini(stackid, is->is_ksp);
5027         is->is_ksp = NULL;
5028         ldi_ident_release(is->is_ldi_ident);
5029         kmem_free(is, sizeof (*is));
5030 }
5031 
5032 static void *
5033 rawip_kstat_init(netstackid_t stackid)
5034 {
5035         kstat_t *ksp;
5036 
5037         rawip_named_kstat_t template = {
5038                 { "inDatagrams",        KSTAT_DATA_UINT32, 0 },
5039                 { "inCksumErrs",        KSTAT_DATA_UINT32, 0 },
5040                 { "inErrors",           KSTAT_DATA_UINT32, 0 },
5041                 { "outDatagrams",       KSTAT_DATA_UINT32, 0 },
5042                 { "outErrors",          KSTAT_DATA_UINT32, 0 },
5043         };
5044 
5045         ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2",
5046             KSTAT_TYPE_NAMED, NUM_OF_FIELDS(rawip_named_kstat_t), 0, stackid);
5047         if (ksp == NULL || ksp->ks_data == NULL)
5048                 return (NULL);
5049 
5050         bcopy(&template, ksp->ks_data, sizeof (template));
5051         ksp->ks_update = rawip_kstat_update;
5052         ksp->ks_private = (void *)(uintptr_t)stackid;
5053 
5054         kstat_install(ksp);
5055         return (ksp);
5056 }
5057 
5058 static void
5059 rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp)
5060 {
5061         if (ksp != NULL) {
5062                 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
5063                 kstat_delete_netstack(ksp, stackid);
5064         }
5065 }
5066 
5067 static int
5068 rawip_kstat_update(kstat_t *ksp, int rw)
5069 {
5070         rawip_named_kstat_t *rawipkp;
5071         netstackid_t    stackid = (netstackid_t)(uintptr_t)ksp->ks_private;
5072         netstack_t      *ns;
5073         icmp_stack_t    *is;
5074 
5075         if ((ksp == NULL) || (ksp->ks_data == NULL))
5076                 return (EIO);
5077 
5078         if (rw == KSTAT_WRITE)
5079                 return (EACCES);
5080 
5081         rawipkp = (rawip_named_kstat_t *)ksp->ks_data;
5082 
5083         ns = netstack_find_by_stackid(stackid);
5084         if (ns == NULL)
5085                 return (-1);
5086         is = ns->netstack_icmp;
5087         if (is == NULL) {
5088                 netstack_rele(ns);
5089                 return (-1);
5090         }
5091         rawipkp->inDatagrams.value.ui32 =  is->is_rawip_mib.rawipInDatagrams;
5092         rawipkp->inCksumErrs.value.ui32 =  is->is_rawip_mib.rawipInCksumErrs;
5093         rawipkp->inErrors.value.ui32 =          is->is_rawip_mib.rawipInErrors;
5094         rawipkp->outDatagrams.value.ui32 = is->is_rawip_mib.rawipOutDatagrams;
5095         rawipkp->outErrors.value.ui32 =         is->is_rawip_mib.rawipOutErrors;
5096         netstack_rele(ns);
5097         return (0);
5098 }
5099 
5100 /* ARGSUSED */
5101 int
5102 rawip_accept(sock_lower_handle_t lproto_handle,
5103     sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
5104     cred_t *cr)
5105 {
5106         return (EOPNOTSUPP);
5107 }
5108 
5109 /* ARGSUSED */
5110 int
5111 rawip_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5112     socklen_t len, cred_t *cr)
5113 {
5114         conn_t  *connp = (conn_t *)proto_handle;
5115         int     error;
5116 
5117         /* All Solaris components should pass a cred for this operation. */
5118         ASSERT(cr != NULL);
5119 
5120         /* Binding to a NULL address really means unbind */
5121         if (sa == NULL)
5122                 error = rawip_do_unbind(connp);
5123         else
5124                 error = rawip_do_bind(connp, sa, len);
5125 
5126         if (error < 0) {
5127                 if (error == -TOUTSTATE)
5128                         error = EINVAL;
5129                 else
5130                         error = proto_tlitosyserr(-error);
5131         }
5132         return (error);
5133 }
5134 
5135 static int
5136 rawip_implicit_bind(conn_t *connp)
5137 {
5138         sin6_t sin6addr;
5139         sin_t *sin;
5140         sin6_t *sin6;
5141         socklen_t len;
5142         int error;
5143 
5144         if (connp->conn_family == AF_INET) {
5145                 len = sizeof (struct sockaddr_in);
5146                 sin = (sin_t *)&sin6addr;
5147                 *sin = sin_null;
5148                 sin->sin_family = AF_INET;
5149                 sin->sin_addr.s_addr = INADDR_ANY;
5150         } else {
5151                 ASSERT(connp->conn_family == AF_INET6);
5152                 len = sizeof (sin6_t);
5153                 sin6 = (sin6_t *)&sin6addr;
5154                 *sin6 = sin6_null;
5155                 sin6->sin6_family = AF_INET6;
5156                 V6_SET_ZERO(sin6->sin6_addr);
5157         }
5158 
5159         error = rawip_do_bind(connp, (struct sockaddr *)&sin6addr, len);
5160 
5161         return ((error < 0) ? proto_tlitosyserr(-error) : error);
5162 }
5163 
5164 static int
5165 rawip_unbind(conn_t *connp)
5166 {
5167         int error;
5168 
5169         error = rawip_do_unbind(connp);
5170         if (error < 0) {
5171                 error = proto_tlitosyserr(-error);
5172         }
5173         return (error);
5174 }
5175 
5176 /* ARGSUSED */
5177 int
5178 rawip_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
5179 {
5180         return (EOPNOTSUPP);
5181 }
5182 
5183 int
5184 rawip_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5185     socklen_t len, sock_connid_t *id, cred_t *cr)
5186 {
5187         conn_t  *connp = (conn_t *)proto_handle;
5188         icmp_t *icmp = connp->conn_icmp;
5189         int     error;
5190         boolean_t did_bind = B_FALSE;
5191         pid_t   pid = curproc->p_pid;
5192 
5193         /* All Solaris components should pass a cred for this operation. */
5194         ASSERT(cr != NULL);
5195 
5196         if (sa == NULL) {
5197                 /*
5198                  * Disconnect
5199                  * Make sure we are connected
5200                  */
5201                 if (icmp->icmp_state != TS_DATA_XFER)
5202                         return (EINVAL);
5203 
5204                 error = icmp_disconnect(connp);
5205                 return (error);
5206         }
5207 
5208         error = proto_verify_ip_addr(connp->conn_family, sa, len);
5209         if (error != 0)
5210                 return (error);
5211 
5212         /* do an implicit bind if necessary */
5213         if (icmp->icmp_state == TS_UNBND) {
5214                 error = rawip_implicit_bind(connp);
5215                 /*
5216                  * We could be racing with an actual bind, in which case
5217                  * we would see EPROTO. We cross our fingers and try
5218                  * to connect.
5219                  */
5220                 if (!(error == 0 || error == EPROTO))
5221                         return (error);
5222                 did_bind = B_TRUE;
5223         }
5224 
5225         /*
5226          * set SO_DGRAM_ERRIND
5227          */
5228         connp->conn_dgram_errind = B_TRUE;
5229 
5230         error = rawip_do_connect(connp, sa, len, cr, pid);
5231         if (error != 0 && did_bind) {
5232                 int unbind_err;
5233 
5234                 unbind_err = rawip_unbind(connp);
5235                 ASSERT(unbind_err == 0);
5236         }
5237 
5238         if (error == 0) {
5239                 *id = 0;
5240                 (*connp->conn_upcalls->su_connected)(connp->conn_upper_handle,
5241                     0, NULL, -1);
5242         } else if (error < 0) {
5243                 error = proto_tlitosyserr(-error);
5244         }
5245         return (error);
5246 }
5247 
5248 /* ARGSUSED2 */
5249 int
5250 rawip_fallback(sock_lower_handle_t proto_handle, queue_t *q,
5251     boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb,
5252     sock_quiesce_arg_t *arg)
5253 {
5254         conn_t  *connp = (conn_t *)proto_handle;
5255         icmp_t  *icmp;
5256         struct T_capability_ack tca;
5257         struct sockaddr_in6 laddr, faddr;
5258         socklen_t laddrlen, faddrlen;
5259         short opts;
5260         struct stroptions *stropt;
5261         mblk_t *mp, *stropt_mp;
5262         int error;
5263 
5264         icmp = connp->conn_icmp;
5265 
5266         stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
5267 
5268         /*
5269          * setup the fallback stream that was allocated
5270          */
5271         connp->conn_dev = (dev_t)RD(q)->q_ptr;
5272         connp->conn_minor_arena = WR(q)->q_ptr;
5273 
5274         RD(q)->q_ptr = WR(q)->q_ptr = connp;
5275 
5276         WR(q)->q_qinfo = &icmpwinit;
5277 
5278         connp->conn_rq = RD(q);
5279         connp->conn_wq = WR(q);
5280 
5281         /* Notify stream head about options before sending up data */
5282         stropt_mp->b_datap->db_type = M_SETOPTS;
5283         stropt_mp->b_wptr += sizeof (*stropt);
5284         stropt = (struct stroptions *)stropt_mp->b_rptr;
5285         stropt->so_flags = SO_WROFF | SO_HIWAT;
5286         stropt->so_wroff = connp->conn_wroff;
5287         stropt->so_hiwat = connp->conn_rcvbuf;
5288         putnext(RD(q), stropt_mp);
5289 
5290         /*
5291          * free helper stream
5292          */
5293         ip_free_helper_stream(connp);
5294 
5295         /*
5296          * Collect the information needed to sync with the sonode
5297          */
5298         icmp_do_capability_ack(icmp, &tca, TC1_INFO);
5299 
5300         laddrlen = faddrlen = sizeof (sin6_t);
5301         (void) rawip_getsockname((sock_lower_handle_t)connp,
5302             (struct sockaddr *)&laddr, &laddrlen, CRED());
5303         error = rawip_getpeername((sock_lower_handle_t)connp,
5304             (struct sockaddr *)&faddr, &faddrlen, CRED());
5305         if (error != 0)
5306                 faddrlen = 0;
5307         opts = 0;
5308         if (connp->conn_dgram_errind)
5309                 opts |= SO_DGRAM_ERRIND;
5310         if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
5311                 opts |= SO_DONTROUTE;
5312 
5313         mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
5314             (struct sockaddr *)&laddr, laddrlen,
5315             (struct sockaddr *)&faddr, faddrlen, opts);
5316 
5317         /*
5318          * Attempts to send data up during fallback will result in it being
5319          * queued in icmp_t. Now we push up any queued packets.
5320          */
5321         mutex_enter(&icmp->icmp_recv_lock);
5322         if (mp != NULL) {
5323                 mp->b_next = icmp->icmp_fallback_queue_head;
5324                 icmp->icmp_fallback_queue_head = mp;
5325         }
5326         while (icmp->icmp_fallback_queue_head != NULL) {
5327                 mp = icmp->icmp_fallback_queue_head;
5328                 icmp->icmp_fallback_queue_head = mp->b_next;
5329                 mp->b_next = NULL;
5330                 mutex_exit(&icmp->icmp_recv_lock);
5331                 putnext(RD(q), mp);
5332                 mutex_enter(&icmp->icmp_recv_lock);
5333         }
5334         icmp->icmp_fallback_queue_tail = icmp->icmp_fallback_queue_head;
5335 
5336         /*
5337          * No longer a streams less socket
5338          */
5339         mutex_enter(&connp->conn_lock);
5340         connp->conn_flags &= ~IPCL_NONSTR;
5341         mutex_exit(&connp->conn_lock);
5342 
5343         mutex_exit(&icmp->icmp_recv_lock);
5344 
5345         ASSERT(icmp->icmp_fallback_queue_head == NULL &&
5346             icmp->icmp_fallback_queue_tail == NULL);
5347 
5348         ASSERT(connp->conn_ref >= 1);
5349 
5350         return (0);
5351 }
5352 
5353 /* ARGSUSED2 */
5354 sock_lower_handle_t
5355 rawip_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
5356     uint_t *smodep, int *errorp, int flags, cred_t *credp)
5357 {
5358         conn_t *connp;
5359 
5360         if (type != SOCK_RAW || (family != AF_INET && family != AF_INET6)) {
5361                 *errorp = EPROTONOSUPPORT;
5362                 return (NULL);
5363         }
5364 
5365         connp = rawip_do_open(family, credp, errorp, flags);
5366         if (connp != NULL) {
5367                 connp->conn_flags |= IPCL_NONSTR;
5368 
5369                 mutex_enter(&connp->conn_lock);
5370                 connp->conn_state_flags &= ~CONN_INCIPIENT;
5371                 mutex_exit(&connp->conn_lock);
5372                 *sock_downcalls = &sock_rawip_downcalls;
5373                 *smodep = SM_ATOMIC;
5374         } else {
5375                 ASSERT(*errorp != 0);
5376         }
5377 
5378         return ((sock_lower_handle_t)connp);
5379 }
5380 
5381 /* ARGSUSED3 */
5382 void
5383 rawip_activate(sock_lower_handle_t proto_handle,
5384     sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls, int flags,
5385     cred_t *cr)
5386 {
5387         conn_t *connp = (conn_t *)proto_handle;
5388         struct sock_proto_props sopp;
5389 
5390         /* All Solaris components should pass a cred for this operation. */
5391         ASSERT(cr != NULL);
5392 
5393         connp->conn_upcalls = sock_upcalls;
5394         connp->conn_upper_handle = sock_handle;
5395 
5396         sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
5397             SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
5398         sopp.sopp_wroff = connp->conn_wroff;
5399         sopp.sopp_rxhiwat = connp->conn_rcvbuf;
5400         sopp.sopp_rxlowat = connp->conn_rcvlowat;
5401         sopp.sopp_maxblk = INFPSZ;
5402         sopp.sopp_maxpsz = IP_MAXPACKET;
5403         sopp.sopp_minpsz = (icmp_mod_info.mi_minpsz == 1) ? 0 :
5404             icmp_mod_info.mi_minpsz;
5405 
5406         (*connp->conn_upcalls->su_set_proto_props)
5407             (connp->conn_upper_handle, &sopp);
5408 
5409         icmp_bind_proto(connp->conn_icmp);
5410 }
5411 
5412 /* ARGSUSED3 */
5413 int
5414 rawip_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5415     socklen_t *salenp, cred_t *cr)
5416 {
5417         conn_t  *connp = (conn_t *)proto_handle;
5418         icmp_t  *icmp = connp->conn_icmp;
5419         int     error;
5420 
5421         /* All Solaris components should pass a cred for this operation. */
5422         ASSERT(cr != NULL);
5423 
5424         mutex_enter(&connp->conn_lock);
5425         if (icmp->icmp_state != TS_DATA_XFER)
5426                 error = ENOTCONN;
5427         else
5428                 error = conn_getpeername(connp, sa, salenp);
5429         mutex_exit(&connp->conn_lock);
5430         return (error);
5431 }
5432 
5433 /* ARGSUSED3 */
5434 int
5435 rawip_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5436     socklen_t *salenp, cred_t *cr)
5437 {
5438         conn_t  *connp = (conn_t *)proto_handle;
5439         int     error;
5440 
5441         /* All Solaris components should pass a cred for this operation. */
5442         ASSERT(cr != NULL);
5443 
5444         mutex_enter(&connp->conn_lock);
5445         error = conn_getsockname(connp, sa, salenp);
5446         mutex_exit(&connp->conn_lock);
5447         return (error);
5448 }
5449 
5450 int
5451 rawip_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
5452     const void *optvalp, socklen_t optlen, cred_t *cr)
5453 {
5454         conn_t  *connp = (conn_t *)proto_handle;
5455         int error;
5456 
5457         /* All Solaris components should pass a cred for this operation. */
5458         ASSERT(cr != NULL);
5459 
5460         error = proto_opt_check(level, option_name, optlen, NULL,
5461             icmp_opt_obj.odb_opt_des_arr,
5462             icmp_opt_obj.odb_opt_arr_cnt,
5463             B_TRUE, B_FALSE, cr);
5464 
5465         if (error != 0) {
5466                 /*
5467                  * option not recognized
5468                  */
5469                 if (error < 0) {
5470                         error = proto_tlitosyserr(-error);
5471                 }
5472                 return (error);
5473         }
5474 
5475         error = icmp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level,
5476             option_name, optlen, (uchar_t *)optvalp, (uint_t *)&optlen,
5477             (uchar_t *)optvalp, NULL, cr);
5478 
5479         ASSERT(error >= 0);
5480 
5481         return (error);
5482 }
5483 
5484 int
5485 rawip_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
5486     void *optvalp, socklen_t *optlen, cred_t *cr)
5487 {
5488         int             error;
5489         conn_t          *connp = (conn_t *)proto_handle;
5490         t_uscalar_t     max_optbuf_len;
5491         void            *optvalp_buf;
5492         int             len;
5493 
5494         /* All Solaris components should pass a cred for this operation. */
5495         ASSERT(cr != NULL);
5496 
5497         error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
5498             icmp_opt_obj.odb_opt_des_arr,
5499             icmp_opt_obj.odb_opt_arr_cnt,
5500             B_FALSE, B_TRUE, cr);
5501 
5502         if (error != 0) {
5503                 if (error < 0) {
5504                         error = proto_tlitosyserr(-error);
5505                 }
5506                 return (error);
5507         }
5508 
5509         optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
5510         len = icmp_opt_get(connp, level, option_name, optvalp_buf);
5511         if (len == -1) {
5512                 kmem_free(optvalp_buf, max_optbuf_len);
5513                 return (EINVAL);
5514         }
5515 
5516         /*
5517          * update optlen and copy option value
5518          */
5519         t_uscalar_t size = MIN(len, *optlen);
5520 
5521         bcopy(optvalp_buf, optvalp, size);
5522         bcopy(&size, optlen, sizeof (size));
5523 
5524         kmem_free(optvalp_buf, max_optbuf_len);
5525         return (0);
5526 }
5527 
5528 /* ARGSUSED1 */
5529 int
5530 rawip_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
5531 {
5532         conn_t  *connp = (conn_t *)proto_handle;
5533 
5534         /* All Solaris components should pass a cred for this operation. */
5535         ASSERT(cr != NULL);
5536 
5537         (void) rawip_do_close(connp);
5538         return (0);
5539 }
5540 
5541 /* ARGSUSED2 */
5542 int
5543 rawip_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
5544 {
5545         conn_t  *connp = (conn_t *)proto_handle;
5546 
5547         /* All Solaris components should pass a cred for this operation. */
5548         ASSERT(cr != NULL);
5549 
5550         /* shut down the send side */
5551         if (how != SHUT_RD)
5552                 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
5553                     SOCK_OPCTL_SHUT_SEND, 0);
5554         /* shut down the recv side */
5555         if (how != SHUT_WR)
5556                 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
5557                     SOCK_OPCTL_SHUT_RECV, 0);
5558         return (0);
5559 }
5560 
5561 void
5562 rawip_clr_flowctrl(sock_lower_handle_t proto_handle)
5563 {
5564         conn_t  *connp = (conn_t *)proto_handle;
5565         icmp_t  *icmp = connp->conn_icmp;
5566 
5567         mutex_enter(&icmp->icmp_recv_lock);
5568         connp->conn_flow_cntrld = B_FALSE;
5569         mutex_exit(&icmp->icmp_recv_lock);
5570 }
5571 
5572 int
5573 rawip_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
5574     int mode, int32_t *rvalp, cred_t *cr)
5575 {
5576         conn_t          *connp = (conn_t *)proto_handle;
5577         int             error;
5578 
5579         /* All Solaris components should pass a cred for this operation. */
5580         ASSERT(cr != NULL);
5581 
5582         /*
5583          * If we don't have a helper stream then create one.
5584          * ip_create_helper_stream takes care of locking the conn_t,
5585          * so this check for NULL is just a performance optimization.
5586          */
5587         if (connp->conn_helper_info == NULL) {
5588                 icmp_stack_t *is = connp->conn_icmp->icmp_is;
5589 
5590                 ASSERT(is->is_ldi_ident != NULL);
5591 
5592                 /*
5593                  * Create a helper stream for non-STREAMS socket.
5594                  */
5595                 error = ip_create_helper_stream(connp, is->is_ldi_ident);
5596                 if (error != 0) {
5597                         ip0dbg(("rawip_ioctl: create of IP helper stream "
5598                             "failed %d\n", error));
5599                         return (error);
5600                 }
5601         }
5602 
5603         switch (cmd) {
5604         case _SIOCSOCKFALLBACK:
5605         case TI_GETPEERNAME:
5606         case TI_GETMYNAME:
5607 #ifdef DEBUG
5608                 cmn_err(CE_CONT, "icmp_ioctl cmd 0x%x on non streams"
5609                     " socket", cmd);
5610 #endif
5611                 error = EINVAL;
5612                 break;
5613         default:
5614                 /*
5615                  * Pass on to IP using helper stream
5616                  */
5617                 error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
5618                     cmd, arg, mode, cr, rvalp);
5619                 break;
5620         }
5621         return (error);
5622 }
5623 
5624 int
5625 rawip_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
5626     cred_t *cr)
5627 {
5628         sin6_t          *sin6;
5629         sin_t           *sin = NULL;
5630         uint_t          srcid;
5631         conn_t          *connp = (conn_t *)proto_handle;
5632         icmp_t          *icmp = connp->conn_icmp;
5633         int             error = 0;
5634         icmp_stack_t    *is = icmp->icmp_is;
5635         pid_t           pid = curproc->p_pid;
5636         ip_xmit_attr_t  *ixa;
5637 
5638         ASSERT(DB_TYPE(mp) == M_DATA);
5639 
5640         /* All Solaris components should pass a cred for this operation. */
5641         ASSERT(cr != NULL);
5642 
5643         /* do an implicit bind if necessary */
5644         if (icmp->icmp_state == TS_UNBND) {
5645                 error = rawip_implicit_bind(connp);
5646                 /*
5647                  * We could be racing with an actual bind, in which case
5648                  * we would see EPROTO. We cross our fingers and try
5649                  * to connect.
5650                  */
5651                 if (!(error == 0 || error == EPROTO)) {
5652                         freemsg(mp);
5653                         return (error);
5654                 }
5655         }
5656 
5657         /* Protocol 255 contains full IP headers */
5658         /* Read without holding lock */
5659         if (icmp->icmp_hdrincl) {
5660                 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5661                 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) {
5662                         if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) {
5663                                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5664                                 freemsg(mp);
5665                                 return (EINVAL);
5666                         }
5667                 }
5668                 error = icmp_output_hdrincl(connp, mp, cr, pid);
5669                 if (is->is_sendto_ignerr)
5670                         return (0);
5671                 else
5672                         return (error);
5673         }
5674 
5675         /* Connected? */
5676         if (msg->msg_name == NULL) {
5677                 if (icmp->icmp_state != TS_DATA_XFER) {
5678                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5679                         return (EDESTADDRREQ);
5680                 }
5681                 if (msg->msg_controllen != 0) {
5682                         error = icmp_output_ancillary(connp, NULL, NULL, mp,
5683                             NULL, msg, cr, pid);
5684                 } else {
5685                         error = icmp_output_connected(connp, mp, cr, pid);
5686                 }
5687                 if (is->is_sendto_ignerr)
5688                         return (0);
5689                 else
5690                         return (error);
5691         }
5692         if (icmp->icmp_state == TS_DATA_XFER) {
5693                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5694                 return (EISCONN);
5695         }
5696         error = proto_verify_ip_addr(connp->conn_family,
5697             (struct sockaddr *)msg->msg_name, msg->msg_namelen);
5698         if (error != 0) {
5699                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5700                 return (error);
5701         }
5702         switch (connp->conn_family) {
5703         case AF_INET6:
5704                 sin6 = (sin6_t *)msg->msg_name;
5705 
5706                 /* No support for mapped addresses on raw sockets */
5707                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
5708                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5709                         return (EADDRNOTAVAIL);
5710                 }
5711                 srcid = sin6->__sin6_src_id;
5712 
5713                 /*
5714                  * If the local address is a mapped address return
5715                  * an error.
5716                  * It would be possible to send an IPv6 packet but the
5717                  * response would never make it back to the application
5718                  * since it is bound to a mapped address.
5719                  */
5720                 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
5721                         BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5722                         return (EADDRNOTAVAIL);
5723                 }
5724 
5725                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
5726                         sin6->sin6_addr = ipv6_loopback;
5727 
5728                 /*
5729                  * We have to allocate an ip_xmit_attr_t before we grab
5730                  * conn_lock and we need to hold conn_lock once we've check
5731                  * conn_same_as_last_v6 to handle concurrent send* calls on a
5732                  * socket.
5733                  */
5734                 if (msg->msg_controllen == 0) {
5735                         ixa = conn_get_ixa(connp, B_FALSE);
5736                         if (ixa == NULL) {
5737                                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5738                                 return (ENOMEM);
5739                         }
5740                 } else {
5741                         ixa = NULL;
5742                 }
5743                 mutex_enter(&connp->conn_lock);
5744                 if (icmp->icmp_delayed_error != 0) {
5745                         sin6_t  *sin2 = (sin6_t *)&icmp->icmp_delayed_addr;
5746 
5747                         error = icmp->icmp_delayed_error;
5748                         icmp->icmp_delayed_error = 0;
5749 
5750                         /* Compare IP address and family */
5751 
5752                         if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
5753                             &sin2->sin6_addr) &&
5754                             sin6->sin6_family == sin2->sin6_family) {
5755                                 mutex_exit(&connp->conn_lock);
5756                                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5757                                 if (ixa != NULL)
5758                                         ixa_refrele(ixa);
5759                                 return (error);
5760                         }
5761                 }
5762                 if (msg->msg_controllen != 0) {
5763                         mutex_exit(&connp->conn_lock);
5764                         ASSERT(ixa == NULL);
5765                         error = icmp_output_ancillary(connp, NULL, sin6, mp,
5766                             NULL, msg, cr, pid);
5767                 } else if (conn_same_as_last_v6(connp, sin6) &&
5768                     connp->conn_lastsrcid == srcid &&
5769                     ipsec_outbound_policy_current(ixa)) {
5770                         /* icmp_output_lastdst drops conn_lock */
5771                         error = icmp_output_lastdst(connp, mp, cr, pid, ixa);
5772                 } else {
5773                         /* icmp_output_newdst drops conn_lock */
5774                         error = icmp_output_newdst(connp, mp, NULL, sin6, cr,
5775                             pid, ixa);
5776                 }
5777                 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
5778                 if (is->is_sendto_ignerr)
5779                         return (0);
5780                 else
5781                         return (error);
5782         case AF_INET:
5783                 sin = (sin_t *)msg->msg_name;
5784 
5785                 if (sin->sin_addr.s_addr == INADDR_ANY)
5786                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
5787 
5788                 /*
5789                  * We have to allocate an ip_xmit_attr_t before we grab
5790                  * conn_lock and we need to hold conn_lock once we've check
5791                  * conn_same_as_last_v6 to handle concurrent send* on a socket.
5792                  */
5793                 if (msg->msg_controllen == 0) {
5794                         ixa = conn_get_ixa(connp, B_FALSE);
5795                         if (ixa == NULL) {
5796                                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5797                                 return (ENOMEM);
5798                         }
5799                 } else {
5800                         ixa = NULL;
5801                 }
5802                 mutex_enter(&connp->conn_lock);
5803                 if (icmp->icmp_delayed_error != 0) {
5804                         sin_t  *sin2 = (sin_t *)&icmp->icmp_delayed_addr;
5805 
5806                         error = icmp->icmp_delayed_error;
5807                         icmp->icmp_delayed_error = 0;
5808 
5809                         /* Compare IP address */
5810 
5811                         if (sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
5812                                 mutex_exit(&connp->conn_lock);
5813                                 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5814                                 if (ixa != NULL)
5815                                         ixa_refrele(ixa);
5816                                 return (error);
5817                         }
5818                 }
5819 
5820                 if (msg->msg_controllen != 0) {
5821                         mutex_exit(&connp->conn_lock);
5822                         ASSERT(ixa == NULL);
5823                         error = icmp_output_ancillary(connp, sin, NULL, mp,
5824                             NULL, msg, cr, pid);
5825                 } else if (conn_same_as_last_v4(connp, sin) &&
5826                     ipsec_outbound_policy_current(ixa)) {
5827                         /* icmp_output_lastdst drops conn_lock */
5828                         error = icmp_output_lastdst(connp, mp, cr, pid, ixa);
5829                 } else {
5830                         /* icmp_output_newdst drops conn_lock */
5831                         error = icmp_output_newdst(connp, mp, sin, NULL, cr,
5832                             pid, ixa);
5833                 }
5834                 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
5835                 if (is->is_sendto_ignerr)
5836                         return (0);
5837                 else
5838                         return (error);
5839         default:
5840                 return (EINVAL);
5841         }
5842 }
5843 
5844 sock_downcalls_t sock_rawip_downcalls = {
5845         rawip_activate,
5846         rawip_accept,
5847         rawip_bind,
5848         rawip_listen,
5849         rawip_connect,
5850         rawip_getpeername,
5851         rawip_getsockname,
5852         rawip_getsockopt,
5853         rawip_setsockopt,
5854         rawip_send,
5855         NULL,
5856         NULL,
5857         NULL,
5858         rawip_shutdown,
5859         rawip_clr_flowctrl,
5860         rawip_ioctl,
5861         rawip_close
5862 };