1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright (c) 1990 Mentat Inc. 25 * Copyright (c) 2011 Joyent, Inc. All rights reserved. 26 */ 27 28 #include <sys/types.h> 29 #include <sys/stream.h> 30 #include <sys/dlpi.h> 31 #include <sys/stropts.h> 32 #include <sys/sysmacros.h> 33 #include <sys/strsubr.h> 34 #include <sys/strlog.h> 35 #include <sys/strsun.h> 36 #include <sys/zone.h> 37 #define _SUN_TPI_VERSION 2 38 #include <sys/tihdr.h> 39 #include <sys/xti_inet.h> 40 #include <sys/ddi.h> 41 #include <sys/suntpi.h> 42 #include <sys/cmn_err.h> 43 #include <sys/debug.h> 44 #include <sys/kobj.h> 45 #include <sys/modctl.h> 46 #include <sys/atomic.h> 47 #include <sys/policy.h> 48 #include <sys/priv.h> 49 #include <sys/taskq.h> 50 51 #include <sys/systm.h> 52 #include <sys/param.h> 53 #include <sys/kmem.h> 54 #include <sys/sdt.h> 55 #include <sys/socket.h> 56 #include <sys/vtrace.h> 57 #include <sys/isa_defs.h> 58 #include <sys/mac.h> 59 #include <net/if.h> 60 #include <net/if_arp.h> 61 #include <net/route.h> 62 #include <sys/sockio.h> 63 #include <netinet/in.h> 64 #include <net/if_dl.h> 65 66 #include <inet/common.h> 67 #include <inet/mi.h> 68 #include <inet/mib2.h> 69 #include <inet/nd.h> 70 #include <inet/arp.h> 71 #include <inet/snmpcom.h> 72 #include <inet/optcom.h> 73 #include <inet/kstatcom.h> 74 75 #include <netinet/igmp_var.h> 76 #include <netinet/ip6.h> 77 #include <netinet/icmp6.h> 78 #include <netinet/sctp.h> 79 80 #include <inet/ip.h> 81 #include <inet/ip_impl.h> 82 #include <inet/ip6.h> 83 #include <inet/ip6_asp.h> 84 #include <inet/tcp.h> 85 #include <inet/tcp_impl.h> 86 #include <inet/ip_multi.h> 87 #include <inet/ip_if.h> 88 #include <inet/ip_ire.h> 89 #include <inet/ip_ftable.h> 90 #include <inet/ip_rts.h> 91 #include <inet/ip_ndp.h> 92 #include <inet/ip_listutils.h> 93 #include <netinet/igmp.h> 94 #include <netinet/ip_mroute.h> 95 #include <inet/ipp_common.h> 96 97 #include <net/pfkeyv2.h> 98 #include <inet/sadb.h> 99 #include <inet/ipsec_impl.h> 100 #include <inet/iptun/iptun_impl.h> 101 #include <inet/ipdrop.h> 102 #include <inet/ip_netinfo.h> 103 #include <inet/ilb_ip.h> 104 105 #include <sys/ethernet.h> 106 #include <net/if_types.h> 107 #include <sys/cpuvar.h> 108 109 #include <ipp/ipp.h> 110 #include <ipp/ipp_impl.h> 111 #include <ipp/ipgpc/ipgpc.h> 112 113 #include <sys/pattr.h> 114 #include <inet/ipclassifier.h> 115 #include <inet/sctp_ip.h> 116 #include <inet/sctp/sctp_impl.h> 117 #include <inet/udp_impl.h> 118 #include <inet/rawip_impl.h> 119 #include <inet/rts_impl.h> 120 121 #include <sys/tsol/label.h> 122 #include <sys/tsol/tnet.h> 123 124 #include <sys/squeue_impl.h> 125 #include <inet/ip_arp.h> 126 127 #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */ 128 129 /* 130 * Values for squeue switch: 131 * IP_SQUEUE_ENTER_NODRAIN: SQ_NODRAIN 132 * IP_SQUEUE_ENTER: SQ_PROCESS 133 * IP_SQUEUE_FILL: SQ_FILL 134 */ 135 int ip_squeue_enter = IP_SQUEUE_ENTER; /* Setable in /etc/system */ 136 137 int ip_squeue_flag; 138 139 /* 140 * Setable in /etc/system 141 */ 142 int ip_poll_normal_ms = 100; 143 int ip_poll_normal_ticks = 0; 144 int ip_modclose_ackwait_ms = 3000; 145 146 /* 147 * It would be nice to have these present only in DEBUG systems, but the 148 * current design of the global symbol checking logic requires them to be 149 * unconditionally present. 150 */ 151 uint_t ip_thread_data; /* TSD key for debug support */ 152 krwlock_t ip_thread_rwlock; 153 list_t ip_thread_list; 154 155 /* 156 * Structure to represent a linked list of msgblks. Used by ip_snmp_ functions. 157 */ 158 159 struct listptr_s { 160 mblk_t *lp_head; /* pointer to the head of the list */ 161 mblk_t *lp_tail; /* pointer to the tail of the list */ 162 }; 163 164 typedef struct listptr_s listptr_t; 165 166 /* 167 * This is used by ip_snmp_get_mib2_ip_route_media and 168 * ip_snmp_get_mib2_ip6_route_media to carry the lists of return data. 169 */ 170 typedef struct iproutedata_s { 171 uint_t ird_idx; 172 uint_t ird_flags; /* see below */ 173 listptr_t ird_route; /* ipRouteEntryTable */ 174 listptr_t ird_netmedia; /* ipNetToMediaEntryTable */ 175 listptr_t ird_attrs; /* ipRouteAttributeTable */ 176 } iproutedata_t; 177 178 /* Include ire_testhidden and IRE_IF_CLONE routes */ 179 #define IRD_REPORT_ALL 0x01 180 181 /* 182 * Cluster specific hooks. These should be NULL when booted as a non-cluster 183 */ 184 185 /* 186 * Hook functions to enable cluster networking 187 * On non-clustered systems these vectors must always be NULL. 188 * 189 * Hook function to Check ip specified ip address is a shared ip address 190 * in the cluster 191 * 192 */ 193 int (*cl_inet_isclusterwide)(netstackid_t stack_id, uint8_t protocol, 194 sa_family_t addr_family, uint8_t *laddrp, void *args) = NULL; 195 196 /* 197 * Hook function to generate cluster wide ip fragment identifier 198 */ 199 uint32_t (*cl_inet_ipident)(netstackid_t stack_id, uint8_t protocol, 200 sa_family_t addr_family, uint8_t *laddrp, uint8_t *faddrp, 201 void *args) = NULL; 202 203 /* 204 * Hook function to generate cluster wide SPI. 205 */ 206 void (*cl_inet_getspi)(netstackid_t, uint8_t, uint8_t *, size_t, 207 void *) = NULL; 208 209 /* 210 * Hook function to verify if the SPI is already utlized. 211 */ 212 213 int (*cl_inet_checkspi)(netstackid_t, uint8_t, uint32_t, void *) = NULL; 214 215 /* 216 * Hook function to delete the SPI from the cluster wide repository. 217 */ 218 219 void (*cl_inet_deletespi)(netstackid_t, uint8_t, uint32_t, void *) = NULL; 220 221 /* 222 * Hook function to inform the cluster when packet received on an IDLE SA 223 */ 224 225 void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, sa_family_t, 226 in6_addr_t, in6_addr_t, void *) = NULL; 227 228 /* 229 * Synchronization notes: 230 * 231 * IP is a fully D_MP STREAMS module/driver. Thus it does not depend on any 232 * MT level protection given by STREAMS. IP uses a combination of its own 233 * internal serialization mechanism and standard Solaris locking techniques. 234 * The internal serialization is per phyint. This is used to serialize 235 * plumbing operations, IPMP operations, most set ioctls, etc. 236 * 237 * Plumbing is a long sequence of operations involving message 238 * exchanges between IP, ARP and device drivers. Many set ioctls are typically 239 * involved in plumbing operations. A natural model is to serialize these 240 * ioctls one per ill. For example plumbing of hme0 and qfe0 can go on in 241 * parallel without any interference. But various set ioctls on hme0 are best 242 * serialized, along with IPMP operations and processing of DLPI control 243 * messages received from drivers on a per phyint basis. This serialization is 244 * provided by the ipsq_t and primitives operating on this. Details can 245 * be found in ip_if.c above the core primitives operating on ipsq_t. 246 * 247 * Lookups of an ipif or ill by a thread return a refheld ipif / ill. 248 * Simiarly lookup of an ire by a thread also returns a refheld ire. 249 * In addition ipif's and ill's referenced by the ire are also indirectly 250 * refheld. Thus no ipif or ill can vanish as long as an ipif is refheld 251 * directly or indirectly. For example an SIOCSLIFADDR ioctl that changes the 252 * address of an ipif has to go through the ipsq_t. This ensures that only 253 * one such exclusive operation proceeds at any time on the ipif. It then 254 * waits for all refcnts 255 * associated with this ipif to come down to zero. The address is changed 256 * only after the ipif has been quiesced. Then the ipif is brought up again. 257 * More details are described above the comment in ip_sioctl_flags. 258 * 259 * Packet processing is based mostly on IREs and are fully multi-threaded 260 * using standard Solaris MT techniques. 261 * 262 * There are explicit locks in IP to handle: 263 * - The ip_g_head list maintained by mi_open_link() and friends. 264 * 265 * - The reassembly data structures (one lock per hash bucket) 266 * 267 * - conn_lock is meant to protect conn_t fields. The fields actually 268 * protected by conn_lock are documented in the conn_t definition. 269 * 270 * - ire_lock to protect some of the fields of the ire, IRE tables 271 * (one lock per hash bucket). Refer to ip_ire.c for details. 272 * 273 * - ndp_g_lock and ncec_lock for protecting NCEs. 274 * 275 * - ill_lock protects fields of the ill and ipif. Details in ip.h 276 * 277 * - ill_g_lock: This is a global reader/writer lock. Protects the following 278 * * The AVL tree based global multi list of all ills. 279 * * The linked list of all ipifs of an ill 280 * * The <ipsq-xop> mapping 281 * * <ill-phyint> association 282 * Insertion/deletion of an ill in the system, insertion/deletion of an ipif 283 * into an ill, changing the <ipsq-xop> mapping of an ill, changing the 284 * <ill-phyint> assoc of an ill will all have to hold the ill_g_lock as 285 * writer for the actual duration of the insertion/deletion/change. 286 * 287 * - ill_lock: This is a per ill mutex. 288 * It protects some members of the ill_t struct; see ip.h for details. 289 * It also protects the <ill-phyint> assoc. 290 * It also protects the list of ipifs hanging off the ill. 291 * 292 * - ipsq_lock: This is a per ipsq_t mutex lock. 293 * This protects some members of the ipsq_t struct; see ip.h for details. 294 * It also protects the <ipsq-ipxop> mapping 295 * 296 * - ipx_lock: This is a per ipxop_t mutex lock. 297 * This protects some members of the ipxop_t struct; see ip.h for details. 298 * 299 * - phyint_lock: This is a per phyint mutex lock. Protects just the 300 * phyint_flags 301 * 302 * - ip_addr_avail_lock: This is used to ensure the uniqueness of IP addresses. 303 * This lock is held in ipif_up_done and the ipif is marked IPIF_UP and the 304 * uniqueness check also done atomically. 305 * 306 * - ill_g_usesrc_lock: This readers/writer lock protects the usesrc 307 * group list linked by ill_usesrc_grp_next. It also protects the 308 * ill_usesrc_ifindex field. It is taken as a writer when a member of the 309 * group is being added or deleted. This lock is taken as a reader when 310 * walking the list/group(eg: to get the number of members in a usesrc group). 311 * Note, it is only necessary to take this lock if the ill_usesrc_grp_next 312 * field is changing state i.e from NULL to non-NULL or vice-versa. For 313 * example, it is not necessary to take this lock in the initial portion 314 * of ip_sioctl_slifusesrc or at all in ip_sioctl_flags since these 315 * operations are executed exclusively and that ensures that the "usesrc 316 * group state" cannot change. The "usesrc group state" change can happen 317 * only in the latter part of ip_sioctl_slifusesrc and in ill_delete. 318 * 319 * Changing <ill-phyint>, <ipsq-xop> assocications: 320 * 321 * To change the <ill-phyint> association, the ill_g_lock must be held 322 * as writer, and the ill_locks of both the v4 and v6 instance of the ill 323 * must be held. 324 * 325 * To change the <ipsq-xop> association, the ill_g_lock must be held as 326 * writer, the ipsq_lock must be held, and one must be writer on the ipsq. 327 * This is only done when ills are added or removed from IPMP groups. 328 * 329 * To add or delete an ipif from the list of ipifs hanging off the ill, 330 * ill_g_lock (writer) and ill_lock must be held and the thread must be 331 * a writer on the associated ipsq. 332 * 333 * To add or delete an ill to the system, the ill_g_lock must be held as 334 * writer and the thread must be a writer on the associated ipsq. 335 * 336 * To add or delete an ilm to an ill, the ill_lock must be held and the thread 337 * must be a writer on the associated ipsq. 338 * 339 * Lock hierarchy 340 * 341 * Some lock hierarchy scenarios are listed below. 342 * 343 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock 344 * ill_g_lock -> ill_lock(s) -> phyint_lock 345 * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock 346 * ill_g_lock -> ip_addr_avail_lock 347 * conn_lock -> irb_lock -> ill_lock -> ire_lock 348 * ill_g_lock -> ip_g_nd_lock 349 * ill_g_lock -> ips_ipmp_lock -> ill_lock -> nce_lock 350 * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock -> nce_lock 351 * arl_lock -> ill_lock 352 * ips_ire_dep_lock -> irb_lock 353 * 354 * When more than 1 ill lock is needed to be held, all ill lock addresses 355 * are sorted on address and locked starting from highest addressed lock 356 * downward. 357 * 358 * Multicast scenarios 359 * ips_ill_g_lock -> ill_mcast_lock 360 * conn_ilg_lock -> ips_ill_g_lock -> ill_lock 361 * ill_mcast_serializer -> ill_mcast_lock -> ips_ipmp_lock -> ill_lock 362 * ill_mcast_serializer -> ill_mcast_lock -> connf_lock -> conn_lock 363 * ill_mcast_serializer -> ill_mcast_lock -> conn_ilg_lock 364 * ill_mcast_serializer -> ill_mcast_lock -> ips_igmp_timer_lock 365 * 366 * IPsec scenarios 367 * 368 * ipsa_lock -> ill_g_lock -> ill_lock 369 * ill_g_usesrc_lock -> ill_g_lock -> ill_lock 370 * 371 * Trusted Solaris scenarios 372 * 373 * igsa_lock -> gcgrp_rwlock -> gcgrp_lock 374 * igsa_lock -> gcdb_lock 375 * gcgrp_rwlock -> ire_lock 376 * gcgrp_rwlock -> gcdb_lock 377 * 378 * squeue(sq_lock), flow related (ft_lock, fe_lock) locking 379 * 380 * cpu_lock --> ill_lock --> sqset_lock --> sq_lock 381 * sq_lock -> conn_lock -> QLOCK(q) 382 * ill_lock -> ft_lock -> fe_lock 383 * 384 * Routing/forwarding table locking notes: 385 * 386 * Lock acquisition order: Radix tree lock, irb_lock. 387 * Requirements: 388 * i. Walker must not hold any locks during the walker callback. 389 * ii Walker must not see a truncated tree during the walk because of any node 390 * deletion. 391 * iii Existing code assumes ire_bucket is valid if it is non-null and is used 392 * in many places in the code to walk the irb list. Thus even if all the 393 * ires in a bucket have been deleted, we still can't free the radix node 394 * until the ires have actually been inactive'd (freed). 395 * 396 * Tree traversal - Need to hold the global tree lock in read mode. 397 * Before dropping the global tree lock, need to either increment the ire_refcnt 398 * to ensure that the radix node can't be deleted. 399 * 400 * Tree add - Need to hold the global tree lock in write mode to add a 401 * radix node. To prevent the node from being deleted, increment the 402 * irb_refcnt, after the node is added to the tree. The ire itself is 403 * added later while holding the irb_lock, but not the tree lock. 404 * 405 * Tree delete - Need to hold the global tree lock and irb_lock in write mode. 406 * All associated ires must be inactive (i.e. freed), and irb_refcnt 407 * must be zero. 408 * 409 * Walker - Increment irb_refcnt before calling the walker callback. Hold the 410 * global tree lock (read mode) for traversal. 411 * 412 * IRE dependencies - In some cases we hold ips_ire_dep_lock across ire_refrele 413 * hence we will acquire irb_lock while holding ips_ire_dep_lock. 414 * 415 * IPsec notes : 416 * 417 * IP interacts with the IPsec code (AH/ESP) by storing IPsec attributes 418 * in the ip_xmit_attr_t ip_recv_attr_t. For outbound datagrams, the 419 * ip_xmit_attr_t has the 420 * information used by the IPsec code for applying the right level of 421 * protection. The information initialized by IP in the ip_xmit_attr_t 422 * is determined by the per-socket policy or global policy in the system. 423 * For inbound datagrams, the ip_recv_attr_t 424 * starts out with nothing in it. It gets filled 425 * with the right information if it goes through the AH/ESP code, which 426 * happens if the incoming packet is secure. The information initialized 427 * by AH/ESP, is later used by IP (during fanouts to ULP) to see whether 428 * the policy requirements needed by per-socket policy or global policy 429 * is met or not. 430 * 431 * For fully connected sockets i.e dst, src [addr, port] is known, 432 * conn_policy_cached is set indicating that policy has been cached. 433 * conn_in_enforce_policy may or may not be set depending on whether 434 * there is a global policy match or per-socket policy match. 435 * Policy inheriting happpens in ip_policy_set once the destination is known. 436 * Once the right policy is set on the conn_t, policy cannot change for 437 * this socket. This makes life simpler for TCP (UDP ?) where 438 * re-transmissions go out with the same policy. For symmetry, policy 439 * is cached for fully connected UDP sockets also. Thus if policy is cached, 440 * it also implies that policy is latched i.e policy cannot change 441 * on these sockets. As we have the right policy on the conn, we don't 442 * have to lookup global policy for every outbound and inbound datagram 443 * and thus serving as an optimization. Note that a global policy change 444 * does not affect fully connected sockets if they have policy. If fully 445 * connected sockets did not have any policy associated with it, global 446 * policy change may affect them. 447 * 448 * IP Flow control notes: 449 * --------------------- 450 * Non-TCP streams are flow controlled by IP. The way this is accomplished 451 * differs when ILL_CAPAB_DLD_DIRECT is enabled for that IP instance. When 452 * ILL_DIRECT_CAPABLE(ill) is TRUE, IP can do direct function calls into 453 * GLDv3. Otherwise packets are sent down to lower layers using STREAMS 454 * functions. 455 * 456 * Per Tx ring udp flow control: 457 * This is applicable only when ILL_CAPAB_DLD_DIRECT capability is set in 458 * the ill (i.e. ILL_DIRECT_CAPABLE(ill) is true). 459 * 460 * The underlying link can expose multiple Tx rings to the GLDv3 mac layer. 461 * To achieve best performance, outgoing traffic need to be fanned out among 462 * these Tx ring. mac_tx() is called (via str_mdata_fastpath_put()) to send 463 * traffic out of the NIC and it takes a fanout hint. UDP connections pass 464 * the address of connp as fanout hint to mac_tx(). Under flow controlled 465 * condition, mac_tx() returns a non-NULL cookie (ip_mac_tx_cookie_t). This 466 * cookie points to a specific Tx ring that is blocked. The cookie is used to 467 * hash into an idl_tx_list[] entry in idl_tx_list[] array. Each idl_tx_list_t 468 * point to drain_lists (idl_t's). These drain list will store the blocked UDP 469 * connp's. The drain list is not a single list but a configurable number of 470 * lists. 471 * 472 * The diagram below shows idl_tx_list_t's and their drain_lists. ip_stack_t 473 * has an array of idl_tx_list_t. The size of the array is TX_FANOUT_SIZE 474 * which is equal to 128. This array in turn contains a pointer to idl_t[], 475 * the ip drain list. The idl_t[] array size is MIN(max_ncpus, 8). The drain 476 * list will point to the list of connp's that are flow controlled. 477 * 478 * --------------- ------- ------- ------- 479 * |->|drain_list[0]|-->|connp|-->|connp|-->|connp|--> 480 * | --------------- ------- ------- ------- 481 * | --------------- ------- ------- ------- 482 * |->|drain_list[1]|-->|connp|-->|connp|-->|connp|--> 483 * ---------------- | --------------- ------- ------- ------- 484 * |idl_tx_list[0]|->| --------------- ------- ------- ------- 485 * ---------------- |->|drain_list[2]|-->|connp|-->|connp|-->|connp|--> 486 * | --------------- ------- ------- ------- 487 * . . . . . 488 * | --------------- ------- ------- ------- 489 * |->|drain_list[n]|-->|connp|-->|connp|-->|connp|--> 490 * --------------- ------- ------- ------- 491 * --------------- ------- ------- ------- 492 * |->|drain_list[0]|-->|connp|-->|connp|-->|connp|--> 493 * | --------------- ------- ------- ------- 494 * | --------------- ------- ------- ------- 495 * ---------------- |->|drain_list[1]|-->|connp|-->|connp|-->|connp|--> 496 * |idl_tx_list[1]|->| --------------- ------- ------- ------- 497 * ---------------- | . . . . 498 * | --------------- ------- ------- ------- 499 * |->|drain_list[n]|-->|connp|-->|connp|-->|connp|--> 500 * --------------- ------- ------- ------- 501 * ..... 502 * ---------------- 503 * |idl_tx_list[n]|-> ... 504 * ---------------- 505 * 506 * When mac_tx() returns a cookie, the cookie is hashed into an index into 507 * ips_idl_tx_list[], and conn_drain_insert() is called with the idl_tx_list 508 * to insert the conn onto. conn_drain_insert() asserts flow control for the 509 * sockets via su_txq_full() (non-STREAMS) or QFULL on conn_wq (STREAMS). 510 * Further, conn_blocked is set to indicate that the conn is blocked. 511 * 512 * GLDv3 calls ill_flow_enable() when flow control is relieved. The cookie 513 * passed in the call to ill_flow_enable() identifies the blocked Tx ring and 514 * is again hashed to locate the appropriate idl_tx_list, which is then 515 * drained via conn_walk_drain(). conn_walk_drain() goes through each conn in 516 * the drain list and calls conn_drain_remove() to clear flow control (via 517 * calling su_txq_full() or clearing QFULL), and remove the conn from the 518 * drain list. 519 * 520 * Note that the drain list is not a single list but a (configurable) array of 521 * lists (8 elements by default). Synchronization between drain insertion and 522 * flow control wakeup is handled by using idl_txl->txl_lock, and only 523 * conn_drain_insert() and conn_drain_remove() manipulate the drain list. 524 * 525 * Flow control via STREAMS is used when ILL_DIRECT_CAPABLE() returns FALSE. 526 * On the send side, if the packet cannot be sent down to the driver by IP 527 * (canput() fails), ip_xmit() drops the packet and returns EWOULDBLOCK to the 528 * caller, who may then invoke ixa_check_drain_insert() to insert the conn on 529 * the 0'th drain list. When ip_wsrv() runs on the ill_wq because flow 530 * control has been relieved, the blocked conns in the 0'th drain list are 531 * drained as in the non-STREAMS case. 532 * 533 * In both the STREAMS and non-STREAMS cases, the sockfs upcall to set QFULL 534 * is done when the conn is inserted into the drain list (conn_drain_insert()) 535 * and cleared when the conn is removed from the it (conn_drain_remove()). 536 * 537 * IPQOS notes: 538 * 539 * IPQoS Policies are applied to packets using IPPF (IP Policy framework) 540 * and IPQoS modules. IPPF includes hooks in IP at different control points 541 * (callout positions) which direct packets to IPQoS modules for policy 542 * processing. Policies, if present, are global. 543 * 544 * The callout positions are located in the following paths: 545 * o local_in (packets destined for this host) 546 * o local_out (packets orginating from this host ) 547 * o fwd_in (packets forwarded by this m/c - inbound) 548 * o fwd_out (packets forwarded by this m/c - outbound) 549 * Hooks at these callout points can be enabled/disabled using the ndd variable 550 * ip_policy_mask (a bit mask with the 4 LSB indicating the callout positions). 551 * By default all the callout positions are enabled. 552 * 553 * Outbound (local_out) 554 * Hooks are placed in ire_send_wire_v4 and ire_send_wire_v6. 555 * 556 * Inbound (local_in) 557 * Hooks are placed in ip_fanout_v4 and ip_fanout_v6. 558 * 559 * Forwarding (in and out) 560 * Hooks are placed in ire_recv_forward_v4/v6. 561 * 562 * IP Policy Framework processing (IPPF processing) 563 * Policy processing for a packet is initiated by ip_process, which ascertains 564 * that the classifier (ipgpc) is loaded and configured, failing which the 565 * packet resumes normal processing in IP. If the clasifier is present, the 566 * packet is acted upon by one or more IPQoS modules (action instances), per 567 * filters configured in ipgpc and resumes normal IP processing thereafter. 568 * An action instance can drop a packet in course of its processing. 569 * 570 * Zones notes: 571 * 572 * The partitioning rules for networking are as follows: 573 * 1) Packets coming from a zone must have a source address belonging to that 574 * zone. 575 * 2) Packets coming from a zone can only be sent on a physical interface on 576 * which the zone has an IP address. 577 * 3) Between two zones on the same machine, packet delivery is only allowed if 578 * there's a matching route for the destination and zone in the forwarding 579 * table. 580 * 4) The TCP and UDP port spaces are per-zone; that is, two processes in 581 * different zones can bind to the same port with the wildcard address 582 * (INADDR_ANY). 583 * 584 * The granularity of interface partitioning is at the logical interface level. 585 * Therefore, every zone has its own IP addresses, and incoming packets can be 586 * attributed to a zone unambiguously. A logical interface is placed into a zone 587 * using the SIOCSLIFZONE ioctl; this sets the ipif_zoneid field in the ipif_t 588 * structure. Rule (1) is implemented by modifying the source address selection 589 * algorithm so that the list of eligible addresses is filtered based on the 590 * sending process zone. 591 * 592 * The Internet Routing Entries (IREs) are either exclusive to a zone or shared 593 * across all zones, depending on their type. Here is the break-up: 594 * 595 * IRE type Shared/exclusive 596 * -------- ---------------- 597 * IRE_BROADCAST Exclusive 598 * IRE_DEFAULT (default routes) Shared (*) 599 * IRE_LOCAL Exclusive (x) 600 * IRE_LOOPBACK Exclusive 601 * IRE_PREFIX (net routes) Shared (*) 602 * IRE_IF_NORESOLVER (interface routes) Exclusive 603 * IRE_IF_RESOLVER (interface routes) Exclusive 604 * IRE_IF_CLONE (interface routes) Exclusive 605 * IRE_HOST (host routes) Shared (*) 606 * 607 * (*) A zone can only use a default or off-subnet route if the gateway is 608 * directly reachable from the zone, that is, if the gateway's address matches 609 * one of the zone's logical interfaces. 610 * 611 * (x) IRE_LOCAL are handled a bit differently. 612 * When ip_restrict_interzone_loopback is set (the default), 613 * ire_route_recursive restricts loopback using an IRE_LOCAL 614 * between zone to the case when L2 would have conceptually looped the packet 615 * back, i.e. the loopback which is required since neither Ethernet drivers 616 * nor Ethernet hardware loops them back. This is the case when the normal 617 * routes (ignoring IREs with different zoneids) would send out the packet on 618 * the same ill as the ill with which is IRE_LOCAL is associated. 619 * 620 * Multiple zones can share a common broadcast address; typically all zones 621 * share the 255.255.255.255 address. Incoming as well as locally originated 622 * broadcast packets must be dispatched to all the zones on the broadcast 623 * network. For directed broadcasts (e.g. 10.16.72.255) this is not trivial 624 * since some zones may not be on the 10.16.72/24 network. To handle this, each 625 * zone has its own set of IRE_BROADCAST entries; then, broadcast packets are 626 * sent to every zone that has an IRE_BROADCAST entry for the destination 627 * address on the input ill, see ip_input_broadcast(). 628 * 629 * Applications in different zones can join the same multicast group address. 630 * The same logic applies for multicast as for broadcast. ip_input_multicast 631 * dispatches packets to all zones that have members on the physical interface. 632 */ 633 634 /* 635 * Squeue Fanout flags: 636 * 0: No fanout. 637 * 1: Fanout across all squeues 638 */ 639 boolean_t ip_squeue_fanout = 0; 640 641 /* 642 * Maximum dups allowed per packet. 643 */ 644 uint_t ip_max_frag_dups = 10; 645 646 static int ip_open(queue_t *q, dev_t *devp, int flag, int sflag, 647 cred_t *credp, boolean_t isv6); 648 static mblk_t *ip_xmit_attach_llhdr(mblk_t *, nce_t *); 649 650 static boolean_t icmp_inbound_verify_v4(mblk_t *, icmph_t *, ip_recv_attr_t *); 651 static void icmp_inbound_too_big_v4(icmph_t *, ip_recv_attr_t *); 652 static void icmp_inbound_error_fanout_v4(mblk_t *, icmph_t *, 653 ip_recv_attr_t *); 654 static void icmp_options_update(ipha_t *); 655 static void icmp_param_problem(mblk_t *, uint8_t, ip_recv_attr_t *); 656 static void icmp_pkt(mblk_t *, void *, size_t, ip_recv_attr_t *); 657 static mblk_t *icmp_pkt_err_ok(mblk_t *, ip_recv_attr_t *); 658 static void icmp_redirect_v4(mblk_t *mp, ipha_t *, icmph_t *, 659 ip_recv_attr_t *); 660 static void icmp_send_redirect(mblk_t *, ipaddr_t, ip_recv_attr_t *); 661 static void icmp_send_reply_v4(mblk_t *, ipha_t *, icmph_t *, 662 ip_recv_attr_t *); 663 664 mblk_t *ip_dlpi_alloc(size_t, t_uscalar_t); 665 char *ip_dot_addr(ipaddr_t, char *); 666 mblk_t *ip_carve_mp(mblk_t **, ssize_t); 667 int ip_close(queue_t *, int); 668 static char *ip_dot_saddr(uchar_t *, char *); 669 static void ip_lrput(queue_t *, mblk_t *); 670 ipaddr_t ip_net_mask(ipaddr_t); 671 char *ip_nv_lookup(nv_t *, int); 672 void ip_rput(queue_t *, mblk_t *); 673 static void ip_rput_dlpi_writer(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp, 674 void *dummy_arg); 675 int ip_snmp_get(queue_t *, mblk_t *, int, boolean_t); 676 static mblk_t *ip_snmp_get_mib2_ip(queue_t *, mblk_t *, 677 mib2_ipIfStatsEntry_t *, ip_stack_t *, boolean_t); 678 static mblk_t *ip_snmp_get_mib2_ip_traffic_stats(queue_t *, mblk_t *, 679 ip_stack_t *, boolean_t); 680 static mblk_t *ip_snmp_get_mib2_ip6(queue_t *, mblk_t *, ip_stack_t *, 681 boolean_t); 682 static mblk_t *ip_snmp_get_mib2_icmp(queue_t *, mblk_t *, ip_stack_t *ipst); 683 static mblk_t *ip_snmp_get_mib2_icmp6(queue_t *, mblk_t *, ip_stack_t *ipst); 684 static mblk_t *ip_snmp_get_mib2_igmp(queue_t *, mblk_t *, ip_stack_t *ipst); 685 static mblk_t *ip_snmp_get_mib2_multi(queue_t *, mblk_t *, ip_stack_t *ipst); 686 static mblk_t *ip_snmp_get_mib2_ip_addr(queue_t *, mblk_t *, 687 ip_stack_t *ipst, boolean_t); 688 static mblk_t *ip_snmp_get_mib2_ip6_addr(queue_t *, mblk_t *, 689 ip_stack_t *ipst, boolean_t); 690 static mblk_t *ip_snmp_get_mib2_ip_group_src(queue_t *, mblk_t *, 691 ip_stack_t *ipst); 692 static mblk_t *ip_snmp_get_mib2_ip6_group_src(queue_t *, mblk_t *, 693 ip_stack_t *ipst); 694 static mblk_t *ip_snmp_get_mib2_ip_group_mem(queue_t *, mblk_t *, 695 ip_stack_t *ipst); 696 static mblk_t *ip_snmp_get_mib2_ip6_group_mem(queue_t *, mblk_t *, 697 ip_stack_t *ipst); 698 static mblk_t *ip_snmp_get_mib2_virt_multi(queue_t *, mblk_t *, 699 ip_stack_t *ipst); 700 static mblk_t *ip_snmp_get_mib2_multi_rtable(queue_t *, mblk_t *, 701 ip_stack_t *ipst); 702 static mblk_t *ip_snmp_get_mib2_ip_route_media(queue_t *, mblk_t *, int, 703 ip_stack_t *ipst); 704 static mblk_t *ip_snmp_get_mib2_ip6_route_media(queue_t *, mblk_t *, int, 705 ip_stack_t *ipst); 706 static void ip_snmp_get2_v4(ire_t *, iproutedata_t *); 707 static void ip_snmp_get2_v6_route(ire_t *, iproutedata_t *); 708 static int ip_snmp_get2_v4_media(ncec_t *, iproutedata_t *); 709 static int ip_snmp_get2_v6_media(ncec_t *, iproutedata_t *); 710 int ip_snmp_set(queue_t *, int, int, uchar_t *, int); 711 712 static mblk_t *ip_fragment_copyhdr(uchar_t *, int, int, ip_stack_t *, 713 mblk_t *); 714 715 static void conn_drain_init(ip_stack_t *); 716 static void conn_drain_fini(ip_stack_t *); 717 static void conn_drain(conn_t *connp, boolean_t closing); 718 719 static void conn_walk_drain(ip_stack_t *, idl_tx_list_t *); 720 static void conn_walk_sctp(pfv_t, void *, zoneid_t, netstack_t *); 721 722 static void *ip_stack_init(netstackid_t stackid, netstack_t *ns); 723 static void ip_stack_shutdown(netstackid_t stackid, void *arg); 724 static void ip_stack_fini(netstackid_t stackid, void *arg); 725 726 static int ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t, 727 const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *), 728 ire_t *, conn_t *, boolean_t, const in6_addr_t *, mcast_record_t, 729 const in6_addr_t *); 730 731 static int ip_squeue_switch(int); 732 733 static void *ip_kstat_init(netstackid_t, ip_stack_t *); 734 static void ip_kstat_fini(netstackid_t, kstat_t *); 735 static int ip_kstat_update(kstat_t *kp, int rw); 736 static void *icmp_kstat_init(netstackid_t); 737 static void icmp_kstat_fini(netstackid_t, kstat_t *); 738 static int icmp_kstat_update(kstat_t *kp, int rw); 739 static void *ip_kstat2_init(netstackid_t, ip_stat_t *); 740 static void ip_kstat2_fini(netstackid_t, kstat_t *); 741 742 static void ipobs_init(ip_stack_t *); 743 static void ipobs_fini(ip_stack_t *); 744 745 static int ip_tp_cpu_update(cpu_setup_t, int, void *); 746 747 ipaddr_t ip_g_all_ones = IP_HOST_MASK; 748 749 static long ip_rput_pullups; 750 int dohwcksum = 1; /* use h/w cksum if supported by the hardware */ 751 752 vmem_t *ip_minor_arena_sa; /* for minor nos. from INET_MIN_DEV+2 thru 2^^18-1 */ 753 vmem_t *ip_minor_arena_la; /* for minor nos. from 2^^18 thru 2^^32-1 */ 754 755 int ip_debug; 756 757 /* 758 * Multirouting/CGTP stuff 759 */ 760 int ip_cgtp_filter_rev = CGTP_FILTER_REV; /* CGTP hooks version */ 761 762 /* 763 * IP tunables related declarations. Definitions are in ip_tunables.c 764 */ 765 extern mod_prop_info_t ip_propinfo_tbl[]; 766 extern int ip_propinfo_count; 767 768 /* 769 * Table of IP ioctls encoding the various properties of the ioctl and 770 * indexed based on the last byte of the ioctl command. Occasionally there 771 * is a clash, and there is more than 1 ioctl with the same last byte. 772 * In such a case 1 ioctl is encoded in the ndx table and the remaining 773 * ioctls are encoded in the misc table. An entry in the ndx table is 774 * retrieved by indexing on the last byte of the ioctl command and comparing 775 * the ioctl command with the value in the ndx table. In the event of a 776 * mismatch the misc table is then searched sequentially for the desired 777 * ioctl command. 778 * 779 * Entry: <command> <copyin_size> <flags> <cmd_type> <function> <restart_func> 780 */ 781 ip_ioctl_cmd_t ip_ndx_ioctl_table[] = { 782 /* 000 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 783 /* 001 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 784 /* 002 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 785 /* 003 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 786 /* 004 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 787 /* 005 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 788 /* 006 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 789 /* 007 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 790 /* 008 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 791 /* 009 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 792 793 /* 010 */ { SIOCADDRT, sizeof (struct rtentry), IPI_PRIV, 794 MISC_CMD, ip_siocaddrt, NULL }, 795 /* 011 */ { SIOCDELRT, sizeof (struct rtentry), IPI_PRIV, 796 MISC_CMD, ip_siocdelrt, NULL }, 797 798 /* 012 */ { SIOCSIFADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 799 IF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart }, 800 /* 013 */ { SIOCGIFADDR, sizeof (struct ifreq), IPI_GET_CMD, 801 IF_CMD, ip_sioctl_get_addr, NULL }, 802 803 /* 014 */ { SIOCSIFDSTADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 804 IF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart }, 805 /* 015 */ { SIOCGIFDSTADDR, sizeof (struct ifreq), 806 IPI_GET_CMD, IF_CMD, ip_sioctl_get_dstaddr, NULL }, 807 808 /* 016 */ { SIOCSIFFLAGS, sizeof (struct ifreq), 809 IPI_PRIV | IPI_WR, 810 IF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart }, 811 /* 017 */ { SIOCGIFFLAGS, sizeof (struct ifreq), 812 IPI_MODOK | IPI_GET_CMD, 813 IF_CMD, ip_sioctl_get_flags, NULL }, 814 815 /* 018 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 816 /* 019 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 817 818 /* copyin size cannot be coded for SIOCGIFCONF */ 819 /* 020 */ { O_SIOCGIFCONF, 0, IPI_GET_CMD, 820 MISC_CMD, ip_sioctl_get_ifconf, NULL }, 821 822 /* 021 */ { SIOCSIFMTU, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 823 IF_CMD, ip_sioctl_mtu, NULL }, 824 /* 022 */ { SIOCGIFMTU, sizeof (struct ifreq), IPI_GET_CMD, 825 IF_CMD, ip_sioctl_get_mtu, NULL }, 826 /* 023 */ { SIOCGIFBRDADDR, sizeof (struct ifreq), 827 IPI_GET_CMD, IF_CMD, ip_sioctl_get_brdaddr, NULL }, 828 /* 024 */ { SIOCSIFBRDADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 829 IF_CMD, ip_sioctl_brdaddr, NULL }, 830 /* 025 */ { SIOCGIFNETMASK, sizeof (struct ifreq), 831 IPI_GET_CMD, IF_CMD, ip_sioctl_get_netmask, NULL }, 832 /* 026 */ { SIOCSIFNETMASK, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 833 IF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart }, 834 /* 027 */ { SIOCGIFMETRIC, sizeof (struct ifreq), 835 IPI_GET_CMD, IF_CMD, ip_sioctl_get_metric, NULL }, 836 /* 028 */ { SIOCSIFMETRIC, sizeof (struct ifreq), IPI_PRIV, 837 IF_CMD, ip_sioctl_metric, NULL }, 838 /* 029 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 839 840 /* See 166-168 below for extended SIOC*XARP ioctls */ 841 /* 030 */ { SIOCSARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR, 842 ARP_CMD, ip_sioctl_arp, NULL }, 843 /* 031 */ { SIOCGARP, sizeof (struct arpreq), IPI_GET_CMD, 844 ARP_CMD, ip_sioctl_arp, NULL }, 845 /* 032 */ { SIOCDARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR, 846 ARP_CMD, ip_sioctl_arp, NULL }, 847 848 /* 033 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 849 /* 034 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 850 /* 035 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 851 /* 036 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 852 /* 037 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 853 /* 038 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 854 /* 039 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 855 /* 040 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 856 /* 041 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 857 /* 042 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 858 /* 043 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 859 /* 044 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 860 /* 045 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 861 /* 046 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 862 /* 047 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 863 /* 048 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 864 /* 049 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 865 /* 050 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 866 /* 051 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 867 /* 052 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 868 /* 053 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 869 870 /* 054 */ { IF_UNITSEL, sizeof (int), IPI_PRIV | IPI_WR | IPI_MODOK, 871 MISC_CMD, if_unitsel, if_unitsel_restart }, 872 873 /* 055 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 874 /* 056 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 875 /* 057 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 876 /* 058 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 877 /* 059 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 878 /* 060 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 879 /* 061 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 880 /* 062 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 881 /* 063 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 882 /* 064 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 883 /* 065 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 884 /* 066 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 885 /* 067 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 886 /* 068 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 887 /* 069 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 888 /* 070 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 889 /* 071 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 890 /* 072 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 891 892 /* 073 */ { SIOCSIFNAME, sizeof (struct ifreq), 893 IPI_PRIV | IPI_WR | IPI_MODOK, 894 IF_CMD, ip_sioctl_sifname, NULL }, 895 896 /* 074 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 897 /* 075 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 898 /* 076 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 899 /* 077 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 900 /* 078 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 901 /* 079 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 902 /* 080 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 903 /* 081 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 904 /* 082 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 905 /* 083 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 906 /* 084 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 907 /* 085 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 908 /* 086 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 909 910 /* 087 */ { SIOCGIFNUM, sizeof (int), IPI_GET_CMD, 911 MISC_CMD, ip_sioctl_get_ifnum, NULL }, 912 /* 088 */ { SIOCGIFMUXID, sizeof (struct ifreq), IPI_GET_CMD, 913 IF_CMD, ip_sioctl_get_muxid, NULL }, 914 /* 089 */ { SIOCSIFMUXID, sizeof (struct ifreq), 915 IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_muxid, NULL }, 916 917 /* Both if and lif variants share same func */ 918 /* 090 */ { SIOCGIFINDEX, sizeof (struct ifreq), IPI_GET_CMD, 919 IF_CMD, ip_sioctl_get_lifindex, NULL }, 920 /* Both if and lif variants share same func */ 921 /* 091 */ { SIOCSIFINDEX, sizeof (struct ifreq), 922 IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_slifindex, NULL }, 923 924 /* copyin size cannot be coded for SIOCGIFCONF */ 925 /* 092 */ { SIOCGIFCONF, 0, IPI_GET_CMD, 926 MISC_CMD, ip_sioctl_get_ifconf, NULL }, 927 /* 093 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 928 /* 094 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 929 /* 095 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 930 /* 096 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 931 /* 097 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 932 /* 098 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 933 /* 099 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 934 /* 100 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 935 /* 101 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 936 /* 102 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 937 /* 103 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 938 /* 104 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 939 /* 105 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 940 /* 106 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 941 /* 107 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 942 /* 108 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 943 /* 109 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 944 945 /* 110 */ { SIOCLIFREMOVEIF, sizeof (struct lifreq), 946 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_removeif, 947 ip_sioctl_removeif_restart }, 948 /* 111 */ { SIOCLIFADDIF, sizeof (struct lifreq), 949 IPI_GET_CMD | IPI_PRIV | IPI_WR, 950 LIF_CMD, ip_sioctl_addif, NULL }, 951 #define SIOCLIFADDR_NDX 112 952 /* 112 */ { SIOCSLIFADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 953 LIF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart }, 954 /* 113 */ { SIOCGLIFADDR, sizeof (struct lifreq), 955 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_addr, NULL }, 956 /* 114 */ { SIOCSLIFDSTADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 957 LIF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart }, 958 /* 115 */ { SIOCGLIFDSTADDR, sizeof (struct lifreq), 959 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dstaddr, NULL }, 960 /* 116 */ { SIOCSLIFFLAGS, sizeof (struct lifreq), 961 IPI_PRIV | IPI_WR, 962 LIF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart }, 963 /* 117 */ { SIOCGLIFFLAGS, sizeof (struct lifreq), 964 IPI_GET_CMD | IPI_MODOK, 965 LIF_CMD, ip_sioctl_get_flags, NULL }, 966 967 /* 118 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 968 /* 119 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 969 970 /* 120 */ { O_SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD, 971 ip_sioctl_get_lifconf, NULL }, 972 /* 121 */ { SIOCSLIFMTU, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 973 LIF_CMD, ip_sioctl_mtu, NULL }, 974 /* 122 */ { SIOCGLIFMTU, sizeof (struct lifreq), IPI_GET_CMD, 975 LIF_CMD, ip_sioctl_get_mtu, NULL }, 976 /* 123 */ { SIOCGLIFBRDADDR, sizeof (struct lifreq), 977 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_brdaddr, NULL }, 978 /* 124 */ { SIOCSLIFBRDADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 979 LIF_CMD, ip_sioctl_brdaddr, NULL }, 980 /* 125 */ { SIOCGLIFNETMASK, sizeof (struct lifreq), 981 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_netmask, NULL }, 982 /* 126 */ { SIOCSLIFNETMASK, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 983 LIF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart }, 984 /* 127 */ { SIOCGLIFMETRIC, sizeof (struct lifreq), 985 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_metric, NULL }, 986 /* 128 */ { SIOCSLIFMETRIC, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 987 LIF_CMD, ip_sioctl_metric, NULL }, 988 /* 129 */ { SIOCSLIFNAME, sizeof (struct lifreq), 989 IPI_PRIV | IPI_WR | IPI_MODOK, 990 LIF_CMD, ip_sioctl_slifname, 991 ip_sioctl_slifname_restart }, 992 993 /* 130 */ { SIOCGLIFNUM, sizeof (struct lifnum), IPI_GET_CMD, 994 MISC_CMD, ip_sioctl_get_lifnum, NULL }, 995 /* 131 */ { SIOCGLIFMUXID, sizeof (struct lifreq), 996 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_muxid, NULL }, 997 /* 132 */ { SIOCSLIFMUXID, sizeof (struct lifreq), 998 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_muxid, NULL }, 999 /* 133 */ { SIOCGLIFINDEX, sizeof (struct lifreq), 1000 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifindex, 0 }, 1001 /* 134 */ { SIOCSLIFINDEX, sizeof (struct lifreq), 1002 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifindex, 0 }, 1003 /* 135 */ { SIOCSLIFTOKEN, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1004 LIF_CMD, ip_sioctl_token, NULL }, 1005 /* 136 */ { SIOCGLIFTOKEN, sizeof (struct lifreq), 1006 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_token, NULL }, 1007 /* 137 */ { SIOCSLIFSUBNET, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1008 LIF_CMD, ip_sioctl_subnet, ip_sioctl_subnet_restart }, 1009 /* 138 */ { SIOCGLIFSUBNET, sizeof (struct lifreq), 1010 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_subnet, NULL }, 1011 /* 139 */ { SIOCSLIFLNKINFO, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1012 LIF_CMD, ip_sioctl_lnkinfo, NULL }, 1013 1014 /* 140 */ { SIOCGLIFLNKINFO, sizeof (struct lifreq), 1015 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lnkinfo, NULL }, 1016 /* 141 */ { SIOCLIFDELND, sizeof (struct lifreq), IPI_PRIV, 1017 LIF_CMD, ip_siocdelndp_v6, NULL }, 1018 /* 142 */ { SIOCLIFGETND, sizeof (struct lifreq), IPI_GET_CMD, 1019 LIF_CMD, ip_siocqueryndp_v6, NULL }, 1020 /* 143 */ { SIOCLIFSETND, sizeof (struct lifreq), IPI_PRIV, 1021 LIF_CMD, ip_siocsetndp_v6, NULL }, 1022 /* 144 */ { SIOCTMYADDR, sizeof (struct sioc_addrreq), IPI_GET_CMD, 1023 MISC_CMD, ip_sioctl_tmyaddr, NULL }, 1024 /* 145 */ { SIOCTONLINK, sizeof (struct sioc_addrreq), IPI_GET_CMD, 1025 MISC_CMD, ip_sioctl_tonlink, NULL }, 1026 /* 146 */ { SIOCTMYSITE, sizeof (struct sioc_addrreq), 0, 1027 MISC_CMD, ip_sioctl_tmysite, NULL }, 1028 /* 147 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1029 /* 148 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1030 /* IPSECioctls handled in ip_sioctl_copyin_setup itself */ 1031 /* 149 */ { SIOCFIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1032 /* 150 */ { SIOCSIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1033 /* 151 */ { SIOCDIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1034 /* 152 */ { SIOCLIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1035 1036 /* 153 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1037 1038 /* 154 */ { SIOCGLIFBINDING, sizeof (struct lifreq), IPI_GET_CMD, 1039 LIF_CMD, ip_sioctl_get_binding, NULL }, 1040 /* 155 */ { SIOCSLIFGROUPNAME, sizeof (struct lifreq), 1041 IPI_PRIV | IPI_WR, 1042 LIF_CMD, ip_sioctl_groupname, ip_sioctl_groupname }, 1043 /* 156 */ { SIOCGLIFGROUPNAME, sizeof (struct lifreq), 1044 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_groupname, NULL }, 1045 /* 157 */ { SIOCGLIFGROUPINFO, sizeof (lifgroupinfo_t), 1046 IPI_GET_CMD, MISC_CMD, ip_sioctl_groupinfo, NULL }, 1047 1048 /* Leave 158-160 unused; used to be SIOC*IFARP ioctls */ 1049 /* 158 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1050 /* 159 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1051 /* 160 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1052 1053 /* 161 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1054 1055 /* These are handled in ip_sioctl_copyin_setup itself */ 1056 /* 162 */ { SIOCGIP6ADDRPOLICY, 0, IPI_NULL_BCONT, 1057 MISC_CMD, NULL, NULL }, 1058 /* 163 */ { SIOCSIP6ADDRPOLICY, 0, IPI_PRIV | IPI_NULL_BCONT, 1059 MISC_CMD, NULL, NULL }, 1060 /* 164 */ { SIOCGDSTINFO, 0, IPI_GET_CMD, MISC_CMD, NULL, NULL }, 1061 1062 /* 165 */ { SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD, 1063 ip_sioctl_get_lifconf, NULL }, 1064 1065 /* 166 */ { SIOCSXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR, 1066 XARP_CMD, ip_sioctl_arp, NULL }, 1067 /* 167 */ { SIOCGXARP, sizeof (struct xarpreq), IPI_GET_CMD, 1068 XARP_CMD, ip_sioctl_arp, NULL }, 1069 /* 168 */ { SIOCDXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR, 1070 XARP_CMD, ip_sioctl_arp, NULL }, 1071 1072 /* SIOCPOPSOCKFS is not handled by IP */ 1073 /* 169 */ { IPI_DONTCARE /* SIOCPOPSOCKFS */, 0, 0, 0, NULL, NULL }, 1074 1075 /* 170 */ { SIOCGLIFZONE, sizeof (struct lifreq), 1076 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifzone, NULL }, 1077 /* 171 */ { SIOCSLIFZONE, sizeof (struct lifreq), 1078 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifzone, 1079 ip_sioctl_slifzone_restart }, 1080 /* 172-174 are SCTP ioctls and not handled by IP */ 1081 /* 172 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1082 /* 173 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1083 /* 174 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1084 /* 175 */ { SIOCGLIFUSESRC, sizeof (struct lifreq), 1085 IPI_GET_CMD, LIF_CMD, 1086 ip_sioctl_get_lifusesrc, 0 }, 1087 /* 176 */ { SIOCSLIFUSESRC, sizeof (struct lifreq), 1088 IPI_PRIV | IPI_WR, 1089 LIF_CMD, ip_sioctl_slifusesrc, 1090 NULL }, 1091 /* 177 */ { SIOCGLIFSRCOF, 0, IPI_GET_CMD, MISC_CMD, 1092 ip_sioctl_get_lifsrcof, NULL }, 1093 /* 178 */ { SIOCGMSFILTER, sizeof (struct group_filter), IPI_GET_CMD, 1094 MSFILT_CMD, ip_sioctl_msfilter, NULL }, 1095 /* 179 */ { SIOCSMSFILTER, sizeof (struct group_filter), 0, 1096 MSFILT_CMD, ip_sioctl_msfilter, NULL }, 1097 /* 180 */ { SIOCGIPMSFILTER, sizeof (struct ip_msfilter), IPI_GET_CMD, 1098 MSFILT_CMD, ip_sioctl_msfilter, NULL }, 1099 /* 181 */ { SIOCSIPMSFILTER, sizeof (struct ip_msfilter), 0, 1100 MSFILT_CMD, ip_sioctl_msfilter, NULL }, 1101 /* 182 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1102 /* SIOCSENABLESDP is handled by SDP */ 1103 /* 183 */ { IPI_DONTCARE /* SIOCSENABLESDP */, 0, 0, 0, NULL, NULL }, 1104 /* 184 */ { IPI_DONTCARE /* SIOCSQPTR */, 0, 0, 0, NULL, NULL }, 1105 /* 185 */ { SIOCGIFHWADDR, sizeof (struct ifreq), IPI_GET_CMD, 1106 IF_CMD, ip_sioctl_get_ifhwaddr, NULL }, 1107 /* 186 */ { IPI_DONTCARE /* SIOCGSTAMP */, 0, 0, 0, NULL, NULL }, 1108 /* 187 */ { SIOCILB, 0, IPI_PRIV | IPI_GET_CMD, MISC_CMD, 1109 ip_sioctl_ilb_cmd, NULL }, 1110 /* 188 */ { SIOCGETPROP, 0, IPI_GET_CMD, 0, NULL, NULL }, 1111 /* 189 */ { SIOCSETPROP, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL}, 1112 /* 190 */ { SIOCGLIFDADSTATE, sizeof (struct lifreq), 1113 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dadstate, NULL }, 1114 /* 191 */ { SIOCSLIFPREFIX, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1115 LIF_CMD, ip_sioctl_prefix, ip_sioctl_prefix_restart }, 1116 /* 192 */ { SIOCGLIFHWADDR, sizeof (struct lifreq), IPI_GET_CMD, 1117 LIF_CMD, ip_sioctl_get_lifhwaddr, NULL } 1118 }; 1119 1120 int ip_ndx_ioctl_count = sizeof (ip_ndx_ioctl_table) / sizeof (ip_ioctl_cmd_t); 1121 1122 ip_ioctl_cmd_t ip_misc_ioctl_table[] = { 1123 { I_LINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL }, 1124 { I_UNLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL }, 1125 { I_PLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL }, 1126 { I_PUNLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL }, 1127 { ND_GET, 0, 0, 0, NULL, NULL }, 1128 { ND_SET, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL }, 1129 { IP_IOCTL, 0, 0, 0, NULL, NULL }, 1130 { SIOCGETVIFCNT, sizeof (struct sioc_vif_req), IPI_GET_CMD, 1131 MISC_CMD, mrt_ioctl}, 1132 { SIOCGETSGCNT, sizeof (struct sioc_sg_req), IPI_GET_CMD, 1133 MISC_CMD, mrt_ioctl}, 1134 { SIOCGETLSGCNT, sizeof (struct sioc_lsg_req), IPI_GET_CMD, 1135 MISC_CMD, mrt_ioctl} 1136 }; 1137 1138 int ip_misc_ioctl_count = 1139 sizeof (ip_misc_ioctl_table) / sizeof (ip_ioctl_cmd_t); 1140 1141 int conn_drain_nthreads; /* Number of drainers reqd. */ 1142 /* Settable in /etc/system */ 1143 /* Defined in ip_ire.c */ 1144 extern uint32_t ip_ire_max_bucket_cnt, ip6_ire_max_bucket_cnt; 1145 extern uint32_t ip_ire_min_bucket_cnt, ip6_ire_min_bucket_cnt; 1146 extern uint32_t ip_ire_mem_ratio, ip_ire_cpu_ratio; 1147 1148 static nv_t ire_nv_arr[] = { 1149 { IRE_BROADCAST, "BROADCAST" }, 1150 { IRE_LOCAL, "LOCAL" }, 1151 { IRE_LOOPBACK, "LOOPBACK" }, 1152 { IRE_DEFAULT, "DEFAULT" }, 1153 { IRE_PREFIX, "PREFIX" }, 1154 { IRE_IF_NORESOLVER, "IF_NORESOL" }, 1155 { IRE_IF_RESOLVER, "IF_RESOLV" }, 1156 { IRE_IF_CLONE, "IF_CLONE" }, 1157 { IRE_HOST, "HOST" }, 1158 { IRE_MULTICAST, "MULTICAST" }, 1159 { IRE_NOROUTE, "NOROUTE" }, 1160 { 0 } 1161 }; 1162 1163 nv_t *ire_nv_tbl = ire_nv_arr; 1164 1165 /* Simple ICMP IP Header Template */ 1166 static ipha_t icmp_ipha = { 1167 IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP 1168 }; 1169 1170 struct module_info ip_mod_info = { 1171 IP_MOD_ID, IP_MOD_NAME, IP_MOD_MINPSZ, IP_MOD_MAXPSZ, IP_MOD_HIWAT, 1172 IP_MOD_LOWAT 1173 }; 1174 1175 /* 1176 * Duplicate static symbols within a module confuses mdb; so we avoid the 1177 * problem by making the symbols here distinct from those in udp.c. 1178 */ 1179 1180 /* 1181 * Entry points for IP as a device and as a module. 1182 * We have separate open functions for the /dev/ip and /dev/ip6 devices. 1183 */ 1184 static struct qinit iprinitv4 = { 1185 (pfi_t)ip_rput, NULL, ip_openv4, ip_close, NULL, 1186 &ip_mod_info 1187 }; 1188 1189 struct qinit iprinitv6 = { 1190 (pfi_t)ip_rput_v6, NULL, ip_openv6, ip_close, NULL, 1191 &ip_mod_info 1192 }; 1193 1194 static struct qinit ipwinit = { 1195 (pfi_t)ip_wput_nondata, (pfi_t)ip_wsrv, NULL, NULL, NULL, 1196 &ip_mod_info 1197 }; 1198 1199 static struct qinit iplrinit = { 1200 (pfi_t)ip_lrput, NULL, ip_openv4, ip_close, NULL, 1201 &ip_mod_info 1202 }; 1203 1204 static struct qinit iplwinit = { 1205 (pfi_t)ip_lwput, NULL, NULL, NULL, NULL, 1206 &ip_mod_info 1207 }; 1208 1209 /* For AF_INET aka /dev/ip */ 1210 struct streamtab ipinfov4 = { 1211 &iprinitv4, &ipwinit, &iplrinit, &iplwinit 1212 }; 1213 1214 /* For AF_INET6 aka /dev/ip6 */ 1215 struct streamtab ipinfov6 = { 1216 &iprinitv6, &ipwinit, &iplrinit, &iplwinit 1217 }; 1218 1219 #ifdef DEBUG 1220 boolean_t skip_sctp_cksum = B_FALSE; 1221 #endif 1222 1223 /* 1224 * Generate an ICMP fragmentation needed message. 1225 * When called from ip_output side a minimal ip_recv_attr_t needs to be 1226 * constructed by the caller. 1227 */ 1228 void 1229 icmp_frag_needed(mblk_t *mp, int mtu, ip_recv_attr_t *ira) 1230 { 1231 icmph_t icmph; 1232 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 1233 1234 mp = icmp_pkt_err_ok(mp, ira); 1235 if (mp == NULL) 1236 return; 1237 1238 bzero(&icmph, sizeof (icmph_t)); 1239 icmph.icmph_type = ICMP_DEST_UNREACHABLE; 1240 icmph.icmph_code = ICMP_FRAGMENTATION_NEEDED; 1241 icmph.icmph_du_mtu = htons((uint16_t)mtu); 1242 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutFragNeeded); 1243 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs); 1244 1245 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira); 1246 } 1247 1248 /* 1249 * icmp_inbound_v4 deals with ICMP messages that are handled by IP. 1250 * If the ICMP message is consumed by IP, i.e., it should not be delivered 1251 * to any IPPROTO_ICMP raw sockets, then it returns NULL. 1252 * Likewise, if the ICMP error is misformed (too short, etc), then it 1253 * returns NULL. The caller uses this to determine whether or not to send 1254 * to raw sockets. 1255 * 1256 * All error messages are passed to the matching transport stream. 1257 * 1258 * The following cases are handled by icmp_inbound: 1259 * 1) It needs to send a reply back and possibly delivering it 1260 * to the "interested" upper clients. 1261 * 2) Return the mblk so that the caller can pass it to the RAW socket clients. 1262 * 3) It needs to change some values in IP only. 1263 * 4) It needs to change some values in IP and upper layers e.g TCP 1264 * by delivering an error to the upper layers. 1265 * 1266 * We handle the above three cases in the context of IPsec in the 1267 * following way : 1268 * 1269 * 1) Send the reply back in the same way as the request came in. 1270 * If it came in encrypted, it goes out encrypted. If it came in 1271 * clear, it goes out in clear. Thus, this will prevent chosen 1272 * plain text attack. 1273 * 2) The client may or may not expect things to come in secure. 1274 * If it comes in secure, the policy constraints are checked 1275 * before delivering it to the upper layers. If it comes in 1276 * clear, ipsec_inbound_accept_clear will decide whether to 1277 * accept this in clear or not. In both the cases, if the returned 1278 * message (IP header + 8 bytes) that caused the icmp message has 1279 * AH/ESP headers, it is sent up to AH/ESP for validation before 1280 * sending up. If there are only 8 bytes of returned message, then 1281 * upper client will not be notified. 1282 * 3) Check with global policy to see whether it matches the constaints. 1283 * But this will be done only if icmp_accept_messages_in_clear is 1284 * zero. 1285 * 4) If we need to change both in IP and ULP, then the decision taken 1286 * while affecting the values in IP and while delivering up to TCP 1287 * should be the same. 1288 * 1289 * There are two cases. 1290 * 1291 * a) If we reject data at the IP layer (ipsec_check_global_policy() 1292 * failed), we will not deliver it to the ULP, even though they 1293 * are *willing* to accept in *clear*. This is fine as our global 1294 * disposition to icmp messages asks us reject the datagram. 1295 * 1296 * b) If we accept data at the IP layer (ipsec_check_global_policy() 1297 * succeeded or icmp_accept_messages_in_clear is 1), and not able 1298 * to deliver it to ULP (policy failed), it can lead to 1299 * consistency problems. The cases known at this time are 1300 * ICMP_DESTINATION_UNREACHABLE messages with following code 1301 * values : 1302 * 1303 * - ICMP_FRAGMENTATION_NEEDED : IP adapts to the new value 1304 * and Upper layer rejects. Then the communication will 1305 * come to a stop. This is solved by making similar decisions 1306 * at both levels. Currently, when we are unable to deliver 1307 * to the Upper Layer (due to policy failures) while IP has 1308 * adjusted dce_pmtu, the next outbound datagram would 1309 * generate a local ICMP_FRAGMENTATION_NEEDED message - which 1310 * will be with the right level of protection. Thus the right 1311 * value will be communicated even if we are not able to 1312 * communicate when we get from the wire initially. But this 1313 * assumes there would be at least one outbound datagram after 1314 * IP has adjusted its dce_pmtu value. To make things 1315 * simpler, we accept in clear after the validation of 1316 * AH/ESP headers. 1317 * 1318 * - Other ICMP ERRORS : We may not be able to deliver it to the 1319 * upper layer depending on the level of protection the upper 1320 * layer expects and the disposition in ipsec_inbound_accept_clear(). 1321 * ipsec_inbound_accept_clear() decides whether a given ICMP error 1322 * should be accepted in clear when the Upper layer expects secure. 1323 * Thus the communication may get aborted by some bad ICMP 1324 * packets. 1325 */ 1326 mblk_t * 1327 icmp_inbound_v4(mblk_t *mp, ip_recv_attr_t *ira) 1328 { 1329 icmph_t *icmph; 1330 ipha_t *ipha; /* Outer header */ 1331 int ip_hdr_length; /* Outer header length */ 1332 boolean_t interested; 1333 ipif_t *ipif; 1334 uint32_t ts; 1335 uint32_t *tsp; 1336 timestruc_t now; 1337 ill_t *ill = ira->ira_ill; 1338 ip_stack_t *ipst = ill->ill_ipst; 1339 zoneid_t zoneid = ira->ira_zoneid; 1340 int len_needed; 1341 mblk_t *mp_ret = NULL; 1342 1343 ipha = (ipha_t *)mp->b_rptr; 1344 1345 BUMP_MIB(&ipst->ips_icmp_mib, icmpInMsgs); 1346 1347 ip_hdr_length = ira->ira_ip_hdr_length; 1348 if ((mp->b_wptr - mp->b_rptr) < (ip_hdr_length + ICMPH_SIZE)) { 1349 if (ira->ira_pktlen < (ip_hdr_length + ICMPH_SIZE)) { 1350 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts); 1351 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill); 1352 freemsg(mp); 1353 return (NULL); 1354 } 1355 /* Last chance to get real. */ 1356 ipha = ip_pullup(mp, ip_hdr_length + ICMPH_SIZE, ira); 1357 if (ipha == NULL) { 1358 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 1359 freemsg(mp); 1360 return (NULL); 1361 } 1362 } 1363 1364 /* The IP header will always be a multiple of four bytes */ 1365 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1366 ip2dbg(("icmp_inbound_v4: type %d code %d\n", icmph->icmph_type, 1367 icmph->icmph_code)); 1368 1369 /* 1370 * We will set "interested" to "true" if we should pass a copy to 1371 * the transport or if we handle the packet locally. 1372 */ 1373 interested = B_FALSE; 1374 switch (icmph->icmph_type) { 1375 case ICMP_ECHO_REPLY: 1376 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchoReps); 1377 break; 1378 case ICMP_DEST_UNREACHABLE: 1379 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) 1380 BUMP_MIB(&ipst->ips_icmp_mib, icmpInFragNeeded); 1381 interested = B_TRUE; /* Pass up to transport */ 1382 BUMP_MIB(&ipst->ips_icmp_mib, icmpInDestUnreachs); 1383 break; 1384 case ICMP_SOURCE_QUENCH: 1385 interested = B_TRUE; /* Pass up to transport */ 1386 BUMP_MIB(&ipst->ips_icmp_mib, icmpInSrcQuenchs); 1387 break; 1388 case ICMP_REDIRECT: 1389 if (!ipst->ips_ip_ignore_redirect) 1390 interested = B_TRUE; 1391 BUMP_MIB(&ipst->ips_icmp_mib, icmpInRedirects); 1392 break; 1393 case ICMP_ECHO_REQUEST: 1394 /* 1395 * Whether to respond to echo requests that come in as IP 1396 * broadcasts or as IP multicast is subject to debate 1397 * (what isn't?). We aim to please, you pick it. 1398 * Default is do it. 1399 */ 1400 if (ira->ira_flags & IRAF_MULTICAST) { 1401 /* multicast: respond based on tunable */ 1402 interested = ipst->ips_ip_g_resp_to_echo_mcast; 1403 } else if (ira->ira_flags & IRAF_BROADCAST) { 1404 /* broadcast: respond based on tunable */ 1405 interested = ipst->ips_ip_g_resp_to_echo_bcast; 1406 } else { 1407 /* unicast: always respond */ 1408 interested = B_TRUE; 1409 } 1410 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchos); 1411 if (!interested) { 1412 /* We never pass these to RAW sockets */ 1413 freemsg(mp); 1414 return (NULL); 1415 } 1416 1417 /* Check db_ref to make sure we can modify the packet. */ 1418 if (mp->b_datap->db_ref > 1) { 1419 mblk_t *mp1; 1420 1421 mp1 = copymsg(mp); 1422 freemsg(mp); 1423 if (!mp1) { 1424 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 1425 return (NULL); 1426 } 1427 mp = mp1; 1428 ipha = (ipha_t *)mp->b_rptr; 1429 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1430 } 1431 icmph->icmph_type = ICMP_ECHO_REPLY; 1432 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutEchoReps); 1433 icmp_send_reply_v4(mp, ipha, icmph, ira); 1434 return (NULL); 1435 1436 case ICMP_ROUTER_ADVERTISEMENT: 1437 case ICMP_ROUTER_SOLICITATION: 1438 break; 1439 case ICMP_TIME_EXCEEDED: 1440 interested = B_TRUE; /* Pass up to transport */ 1441 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimeExcds); 1442 break; 1443 case ICMP_PARAM_PROBLEM: 1444 interested = B_TRUE; /* Pass up to transport */ 1445 BUMP_MIB(&ipst->ips_icmp_mib, icmpInParmProbs); 1446 break; 1447 case ICMP_TIME_STAMP_REQUEST: 1448 /* Response to Time Stamp Requests is local policy. */ 1449 if (ipst->ips_ip_g_resp_to_timestamp) { 1450 if (ira->ira_flags & IRAF_MULTIBROADCAST) 1451 interested = 1452 ipst->ips_ip_g_resp_to_timestamp_bcast; 1453 else 1454 interested = B_TRUE; 1455 } 1456 if (!interested) { 1457 /* We never pass these to RAW sockets */ 1458 freemsg(mp); 1459 return (NULL); 1460 } 1461 1462 /* Make sure we have enough of the packet */ 1463 len_needed = ip_hdr_length + ICMPH_SIZE + 1464 3 * sizeof (uint32_t); 1465 1466 if (mp->b_wptr - mp->b_rptr < len_needed) { 1467 ipha = ip_pullup(mp, len_needed, ira); 1468 if (ipha == NULL) { 1469 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1470 ip_drop_input("ipIfStatsInDiscards - ip_pullup", 1471 mp, ill); 1472 freemsg(mp); 1473 return (NULL); 1474 } 1475 /* Refresh following the pullup. */ 1476 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1477 } 1478 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestamps); 1479 /* Check db_ref to make sure we can modify the packet. */ 1480 if (mp->b_datap->db_ref > 1) { 1481 mblk_t *mp1; 1482 1483 mp1 = copymsg(mp); 1484 freemsg(mp); 1485 if (!mp1) { 1486 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 1487 return (NULL); 1488 } 1489 mp = mp1; 1490 ipha = (ipha_t *)mp->b_rptr; 1491 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1492 } 1493 icmph->icmph_type = ICMP_TIME_STAMP_REPLY; 1494 tsp = (uint32_t *)&icmph[1]; 1495 tsp++; /* Skip past 'originate time' */ 1496 /* Compute # of milliseconds since midnight */ 1497 gethrestime(&now); 1498 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 1499 now.tv_nsec / (NANOSEC / MILLISEC); 1500 *tsp++ = htonl(ts); /* Lay in 'receive time' */ 1501 *tsp++ = htonl(ts); /* Lay in 'send time' */ 1502 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimestampReps); 1503 icmp_send_reply_v4(mp, ipha, icmph, ira); 1504 return (NULL); 1505 1506 case ICMP_TIME_STAMP_REPLY: 1507 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestampReps); 1508 break; 1509 case ICMP_INFO_REQUEST: 1510 /* Per RFC 1122 3.2.2.7, ignore this. */ 1511 case ICMP_INFO_REPLY: 1512 break; 1513 case ICMP_ADDRESS_MASK_REQUEST: 1514 if (ira->ira_flags & IRAF_MULTIBROADCAST) { 1515 interested = 1516 ipst->ips_ip_respond_to_address_mask_broadcast; 1517 } else { 1518 interested = B_TRUE; 1519 } 1520 if (!interested) { 1521 /* We never pass these to RAW sockets */ 1522 freemsg(mp); 1523 return (NULL); 1524 } 1525 len_needed = ip_hdr_length + ICMPH_SIZE + IP_ADDR_LEN; 1526 if (mp->b_wptr - mp->b_rptr < len_needed) { 1527 ipha = ip_pullup(mp, len_needed, ira); 1528 if (ipha == NULL) { 1529 BUMP_MIB(ill->ill_ip_mib, 1530 ipIfStatsInTruncatedPkts); 1531 ip_drop_input("ipIfStatsInTruncatedPkts", mp, 1532 ill); 1533 freemsg(mp); 1534 return (NULL); 1535 } 1536 /* Refresh following the pullup. */ 1537 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1538 } 1539 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMasks); 1540 /* Check db_ref to make sure we can modify the packet. */ 1541 if (mp->b_datap->db_ref > 1) { 1542 mblk_t *mp1; 1543 1544 mp1 = copymsg(mp); 1545 freemsg(mp); 1546 if (!mp1) { 1547 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 1548 return (NULL); 1549 } 1550 mp = mp1; 1551 ipha = (ipha_t *)mp->b_rptr; 1552 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1553 } 1554 /* 1555 * Need the ipif with the mask be the same as the source 1556 * address of the mask reply. For unicast we have a specific 1557 * ipif. For multicast/broadcast we only handle onlink 1558 * senders, and use the source address to pick an ipif. 1559 */ 1560 ipif = ipif_lookup_addr(ipha->ipha_dst, ill, zoneid, ipst); 1561 if (ipif == NULL) { 1562 /* Broadcast or multicast */ 1563 ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid); 1564 if (ipif == NULL) { 1565 freemsg(mp); 1566 return (NULL); 1567 } 1568 } 1569 icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY; 1570 bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN); 1571 ipif_refrele(ipif); 1572 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutAddrMaskReps); 1573 icmp_send_reply_v4(mp, ipha, icmph, ira); 1574 return (NULL); 1575 1576 case ICMP_ADDRESS_MASK_REPLY: 1577 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMaskReps); 1578 break; 1579 default: 1580 interested = B_TRUE; /* Pass up to transport */ 1581 BUMP_MIB(&ipst->ips_icmp_mib, icmpInUnknowns); 1582 break; 1583 } 1584 /* 1585 * See if there is an ICMP client to avoid an extra copymsg/freemsg 1586 * if there isn't one. 1587 */ 1588 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_ICMP].connf_head != NULL) { 1589 /* If there is an ICMP client and we want one too, copy it. */ 1590 1591 if (!interested) { 1592 /* Caller will deliver to RAW sockets */ 1593 return (mp); 1594 } 1595 mp_ret = copymsg(mp); 1596 if (mp_ret == NULL) { 1597 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1598 ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill); 1599 } 1600 } else if (!interested) { 1601 /* Neither we nor raw sockets are interested. Drop packet now */ 1602 freemsg(mp); 1603 return (NULL); 1604 } 1605 1606 /* 1607 * ICMP error or redirect packet. Make sure we have enough of 1608 * the header and that db_ref == 1 since we might end up modifying 1609 * the packet. 1610 */ 1611 if (mp->b_cont != NULL) { 1612 if (ip_pullup(mp, -1, ira) == NULL) { 1613 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1614 ip_drop_input("ipIfStatsInDiscards - ip_pullup", 1615 mp, ill); 1616 freemsg(mp); 1617 return (mp_ret); 1618 } 1619 } 1620 1621 if (mp->b_datap->db_ref > 1) { 1622 mblk_t *mp1; 1623 1624 mp1 = copymsg(mp); 1625 if (mp1 == NULL) { 1626 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1627 ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill); 1628 freemsg(mp); 1629 return (mp_ret); 1630 } 1631 freemsg(mp); 1632 mp = mp1; 1633 } 1634 1635 /* 1636 * In case mp has changed, verify the message before any further 1637 * processes. 1638 */ 1639 ipha = (ipha_t *)mp->b_rptr; 1640 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length]; 1641 if (!icmp_inbound_verify_v4(mp, icmph, ira)) { 1642 freemsg(mp); 1643 return (mp_ret); 1644 } 1645 1646 switch (icmph->icmph_type) { 1647 case ICMP_REDIRECT: 1648 icmp_redirect_v4(mp, ipha, icmph, ira); 1649 break; 1650 case ICMP_DEST_UNREACHABLE: 1651 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) { 1652 /* Update DCE and adjust MTU is icmp header if needed */ 1653 icmp_inbound_too_big_v4(icmph, ira); 1654 } 1655 /* FALLTHRU */ 1656 default: 1657 icmp_inbound_error_fanout_v4(mp, icmph, ira); 1658 break; 1659 } 1660 return (mp_ret); 1661 } 1662 1663 /* 1664 * Send an ICMP echo, timestamp or address mask reply. 1665 * The caller has already updated the payload part of the packet. 1666 * We handle the ICMP checksum, IP source address selection and feed 1667 * the packet into ip_output_simple. 1668 */ 1669 static void 1670 icmp_send_reply_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph, 1671 ip_recv_attr_t *ira) 1672 { 1673 uint_t ip_hdr_length = ira->ira_ip_hdr_length; 1674 ill_t *ill = ira->ira_ill; 1675 ip_stack_t *ipst = ill->ill_ipst; 1676 ip_xmit_attr_t ixas; 1677 1678 /* Send out an ICMP packet */ 1679 icmph->icmph_checksum = 0; 1680 icmph->icmph_checksum = IP_CSUM(mp, ip_hdr_length, 0); 1681 /* Reset time to live. */ 1682 ipha->ipha_ttl = ipst->ips_ip_def_ttl; 1683 { 1684 /* Swap source and destination addresses */ 1685 ipaddr_t tmp; 1686 1687 tmp = ipha->ipha_src; 1688 ipha->ipha_src = ipha->ipha_dst; 1689 ipha->ipha_dst = tmp; 1690 } 1691 ipha->ipha_ident = 0; 1692 if (!IS_SIMPLE_IPH(ipha)) 1693 icmp_options_update(ipha); 1694 1695 bzero(&ixas, sizeof (ixas)); 1696 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4; 1697 ixas.ixa_zoneid = ira->ira_zoneid; 1698 ixas.ixa_cred = kcred; 1699 ixas.ixa_cpid = NOPID; 1700 ixas.ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */ 1701 ixas.ixa_ifindex = 0; 1702 ixas.ixa_ipst = ipst; 1703 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1704 1705 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) { 1706 /* 1707 * This packet should go out the same way as it 1708 * came in i.e in clear, independent of the IPsec policy 1709 * for transmitting packets. 1710 */ 1711 ixas.ixa_flags |= IXAF_NO_IPSEC; 1712 } else { 1713 if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) { 1714 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1715 /* Note: mp already consumed and ip_drop_packet done */ 1716 return; 1717 } 1718 } 1719 if (ira->ira_flags & IRAF_MULTIBROADCAST) { 1720 /* 1721 * Not one or our addresses (IRE_LOCALs), thus we let 1722 * ip_output_simple pick the source. 1723 */ 1724 ipha->ipha_src = INADDR_ANY; 1725 ixas.ixa_flags |= IXAF_SET_SOURCE; 1726 } 1727 /* Should we send with DF and use dce_pmtu? */ 1728 if (ipst->ips_ipv4_icmp_return_pmtu) { 1729 ixas.ixa_flags |= IXAF_PMTU_DISCOVERY; 1730 ipha->ipha_fragment_offset_and_flags |= IPH_DF_HTONS; 1731 } 1732 1733 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs); 1734 1735 (void) ip_output_simple(mp, &ixas); 1736 ixa_cleanup(&ixas); 1737 } 1738 1739 /* 1740 * Verify the ICMP messages for either for ICMP error or redirect packet. 1741 * The caller should have fully pulled up the message. If it's a redirect 1742 * packet, only basic checks on IP header will be done; otherwise, verify 1743 * the packet by looking at the included ULP header. 1744 * 1745 * Called before icmp_inbound_error_fanout_v4 is called. 1746 */ 1747 static boolean_t 1748 icmp_inbound_verify_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira) 1749 { 1750 ill_t *ill = ira->ira_ill; 1751 int hdr_length; 1752 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 1753 conn_t *connp; 1754 ipha_t *ipha; /* Inner IP header */ 1755 1756 ipha = (ipha_t *)&icmph[1]; 1757 if ((uchar_t *)ipha + IP_SIMPLE_HDR_LENGTH > mp->b_wptr) 1758 goto truncated; 1759 1760 hdr_length = IPH_HDR_LENGTH(ipha); 1761 1762 if ((IPH_HDR_VERSION(ipha) != IPV4_VERSION)) 1763 goto discard_pkt; 1764 1765 if (hdr_length < sizeof (ipha_t)) 1766 goto truncated; 1767 1768 if ((uchar_t *)ipha + hdr_length > mp->b_wptr) 1769 goto truncated; 1770 1771 /* 1772 * Stop here for ICMP_REDIRECT. 1773 */ 1774 if (icmph->icmph_type == ICMP_REDIRECT) 1775 return (B_TRUE); 1776 1777 /* 1778 * ICMP errors only. 1779 */ 1780 switch (ipha->ipha_protocol) { 1781 case IPPROTO_UDP: 1782 /* 1783 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of 1784 * transport header. 1785 */ 1786 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 1787 mp->b_wptr) 1788 goto truncated; 1789 break; 1790 case IPPROTO_TCP: { 1791 tcpha_t *tcpha; 1792 1793 /* 1794 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of 1795 * transport header. 1796 */ 1797 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 1798 mp->b_wptr) 1799 goto truncated; 1800 1801 tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length); 1802 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN, 1803 ipst); 1804 if (connp == NULL) 1805 goto discard_pkt; 1806 1807 if ((connp->conn_verifyicmp != NULL) && 1808 !connp->conn_verifyicmp(connp, tcpha, icmph, NULL, ira)) { 1809 CONN_DEC_REF(connp); 1810 goto discard_pkt; 1811 } 1812 CONN_DEC_REF(connp); 1813 break; 1814 } 1815 case IPPROTO_SCTP: 1816 /* 1817 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of 1818 * transport header. 1819 */ 1820 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 1821 mp->b_wptr) 1822 goto truncated; 1823 break; 1824 case IPPROTO_ESP: 1825 case IPPROTO_AH: 1826 break; 1827 case IPPROTO_ENCAP: 1828 if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) > 1829 mp->b_wptr) 1830 goto truncated; 1831 break; 1832 default: 1833 break; 1834 } 1835 1836 return (B_TRUE); 1837 1838 discard_pkt: 1839 /* Bogus ICMP error. */ 1840 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1841 return (B_FALSE); 1842 1843 truncated: 1844 /* We pulled up everthing already. Must be truncated */ 1845 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts); 1846 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill); 1847 return (B_FALSE); 1848 } 1849 1850 /* Table from RFC 1191 */ 1851 static int icmp_frag_size_table[] = 1852 { 32000, 17914, 8166, 4352, 2002, 1496, 1006, 508, 296, 68 }; 1853 1854 /* 1855 * Process received ICMP Packet too big. 1856 * Just handles the DCE create/update, including using the above table of 1857 * PMTU guesses. The caller is responsible for validating the packet before 1858 * passing it in and also to fanout the ICMP error to any matching transport 1859 * conns. Assumes the message has been fully pulled up and verified. 1860 * 1861 * Before getting here, the caller has called icmp_inbound_verify_v4() 1862 * that should have verified with ULP to prevent undoing the changes we're 1863 * going to make to DCE. For example, TCP might have verified that the packet 1864 * which generated error is in the send window. 1865 * 1866 * In some cases modified this MTU in the ICMP header packet; the caller 1867 * should pass to the matching ULP after this returns. 1868 */ 1869 static void 1870 icmp_inbound_too_big_v4(icmph_t *icmph, ip_recv_attr_t *ira) 1871 { 1872 dce_t *dce; 1873 int old_mtu; 1874 int mtu, orig_mtu; 1875 ipaddr_t dst; 1876 boolean_t disable_pmtud; 1877 ill_t *ill = ira->ira_ill; 1878 ip_stack_t *ipst = ill->ill_ipst; 1879 uint_t hdr_length; 1880 ipha_t *ipha; 1881 1882 /* Caller already pulled up everything. */ 1883 ipha = (ipha_t *)&icmph[1]; 1884 ASSERT(icmph->icmph_type == ICMP_DEST_UNREACHABLE && 1885 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED); 1886 ASSERT(ill != NULL); 1887 1888 hdr_length = IPH_HDR_LENGTH(ipha); 1889 1890 /* 1891 * We handle path MTU for source routed packets since the DCE 1892 * is looked up using the final destination. 1893 */ 1894 dst = ip_get_dst(ipha); 1895 1896 dce = dce_lookup_and_add_v4(dst, ipst); 1897 if (dce == NULL) { 1898 /* Couldn't add a unique one - ENOMEM */ 1899 ip1dbg(("icmp_inbound_too_big_v4: no dce for 0x%x\n", 1900 ntohl(dst))); 1901 return; 1902 } 1903 1904 /* Check for MTU discovery advice as described in RFC 1191 */ 1905 mtu = ntohs(icmph->icmph_du_mtu); 1906 orig_mtu = mtu; 1907 disable_pmtud = B_FALSE; 1908 1909 mutex_enter(&dce->dce_lock); 1910 if (dce->dce_flags & DCEF_PMTU) 1911 old_mtu = dce->dce_pmtu; 1912 else 1913 old_mtu = ill->ill_mtu; 1914 1915 if (icmph->icmph_du_zero != 0 || mtu < ipst->ips_ip_pmtu_min) { 1916 uint32_t length; 1917 int i; 1918 1919 /* 1920 * Use the table from RFC 1191 to figure out 1921 * the next "plateau" based on the length in 1922 * the original IP packet. 1923 */ 1924 length = ntohs(ipha->ipha_length); 1925 DTRACE_PROBE2(ip4__pmtu__guess, dce_t *, dce, 1926 uint32_t, length); 1927 if (old_mtu <= length && 1928 old_mtu >= length - hdr_length) { 1929 /* 1930 * Handle broken BSD 4.2 systems that 1931 * return the wrong ipha_length in ICMP 1932 * errors. 1933 */ 1934 ip1dbg(("Wrong mtu: sent %d, dce %d\n", 1935 length, old_mtu)); 1936 length -= hdr_length; 1937 } 1938 for (i = 0; i < A_CNT(icmp_frag_size_table); i++) { 1939 if (length > icmp_frag_size_table[i]) 1940 break; 1941 } 1942 if (i == A_CNT(icmp_frag_size_table)) { 1943 /* Smaller than IP_MIN_MTU! */ 1944 ip1dbg(("Too big for packet size %d\n", 1945 length)); 1946 disable_pmtud = B_TRUE; 1947 mtu = ipst->ips_ip_pmtu_min; 1948 } else { 1949 mtu = icmp_frag_size_table[i]; 1950 ip1dbg(("Calculated mtu %d, packet size %d, " 1951 "before %d\n", mtu, length, old_mtu)); 1952 if (mtu < ipst->ips_ip_pmtu_min) { 1953 mtu = ipst->ips_ip_pmtu_min; 1954 disable_pmtud = B_TRUE; 1955 } 1956 } 1957 } 1958 if (disable_pmtud) 1959 dce->dce_flags |= DCEF_TOO_SMALL_PMTU; 1960 else 1961 dce->dce_flags &= ~DCEF_TOO_SMALL_PMTU; 1962 1963 dce->dce_pmtu = MIN(old_mtu, mtu); 1964 /* Prepare to send the new max frag size for the ULP. */ 1965 icmph->icmph_du_zero = 0; 1966 icmph->icmph_du_mtu = htons((uint16_t)dce->dce_pmtu); 1967 DTRACE_PROBE4(ip4__pmtu__change, icmph_t *, icmph, dce_t *, 1968 dce, int, orig_mtu, int, mtu); 1969 1970 /* We now have a PMTU for sure */ 1971 dce->dce_flags |= DCEF_PMTU; 1972 dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64()); 1973 mutex_exit(&dce->dce_lock); 1974 /* 1975 * After dropping the lock the new value is visible to everyone. 1976 * Then we bump the generation number so any cached values reinspect 1977 * the dce_t. 1978 */ 1979 dce_increment_generation(dce); 1980 dce_refrele(dce); 1981 } 1982 1983 /* 1984 * If the packet in error is Self-Encapsulated, icmp_inbound_error_fanout_v4 1985 * calls this function. 1986 */ 1987 static mblk_t * 1988 icmp_inbound_self_encap_error_v4(mblk_t *mp, ipha_t *ipha, ipha_t *in_ipha) 1989 { 1990 int length; 1991 1992 ASSERT(mp->b_datap->db_type == M_DATA); 1993 1994 /* icmp_inbound_v4 has already pulled up the whole error packet */ 1995 ASSERT(mp->b_cont == NULL); 1996 1997 /* 1998 * The length that we want to overlay is the inner header 1999 * and what follows it. 2000 */ 2001 length = msgdsize(mp) - ((uchar_t *)in_ipha - mp->b_rptr); 2002 2003 /* 2004 * Overlay the inner header and whatever follows it over the 2005 * outer header. 2006 */ 2007 bcopy((uchar_t *)in_ipha, (uchar_t *)ipha, length); 2008 2009 /* Adjust for what we removed */ 2010 mp->b_wptr -= (uchar_t *)in_ipha - (uchar_t *)ipha; 2011 return (mp); 2012 } 2013 2014 /* 2015 * Try to pass the ICMP message upstream in case the ULP cares. 2016 * 2017 * If the packet that caused the ICMP error is secure, we send 2018 * it to AH/ESP to make sure that the attached packet has a 2019 * valid association. ipha in the code below points to the 2020 * IP header of the packet that caused the error. 2021 * 2022 * For IPsec cases, we let the next-layer-up (which has access to 2023 * cached policy on the conn_t, or can query the SPD directly) 2024 * subtract out any IPsec overhead if they must. We therefore make no 2025 * adjustments here for IPsec overhead. 2026 * 2027 * IFN could have been generated locally or by some router. 2028 * 2029 * LOCAL : ire_send_wire (before calling ipsec_out_process) can call 2030 * icmp_frag_needed/icmp_pkt2big_v6 to generated a local IFN. 2031 * This happens because IP adjusted its value of MTU on an 2032 * earlier IFN message and could not tell the upper layer, 2033 * the new adjusted value of MTU e.g. Packet was encrypted 2034 * or there was not enough information to fanout to upper 2035 * layers. Thus on the next outbound datagram, ire_send_wire 2036 * generates the IFN, where IPsec processing has *not* been 2037 * done. 2038 * 2039 * Note that we retain ixa_fragsize across IPsec thus once 2040 * we have picking ixa_fragsize and entered ipsec_out_process we do 2041 * no change the fragsize even if the path MTU changes before 2042 * we reach ip_output_post_ipsec. 2043 * 2044 * In the local case, IRAF_LOOPBACK will be set indicating 2045 * that IFN was generated locally. 2046 * 2047 * ROUTER : IFN could be secure or non-secure. 2048 * 2049 * * SECURE : We use the IPSEC_IN to fanout to AH/ESP if the 2050 * packet in error has AH/ESP headers to validate the AH/ESP 2051 * headers. AH/ESP will verify whether there is a valid SA or 2052 * not and send it back. We will fanout again if we have more 2053 * data in the packet. 2054 * 2055 * If the packet in error does not have AH/ESP, we handle it 2056 * like any other case. 2057 * 2058 * * NON_SECURE : If the packet in error has AH/ESP headers, we send it 2059 * up to AH/ESP for validation. AH/ESP will verify whether there is a 2060 * valid SA or not and send it back. We will fanout again if 2061 * we have more data in the packet. 2062 * 2063 * If the packet in error does not have AH/ESP, we handle it 2064 * like any other case. 2065 * 2066 * The caller must have called icmp_inbound_verify_v4. 2067 */ 2068 static void 2069 icmp_inbound_error_fanout_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira) 2070 { 2071 uint16_t *up; /* Pointer to ports in ULP header */ 2072 uint32_t ports; /* reversed ports for fanout */ 2073 ipha_t ripha; /* With reversed addresses */ 2074 ipha_t *ipha; /* Inner IP header */ 2075 uint_t hdr_length; /* Inner IP header length */ 2076 tcpha_t *tcpha; 2077 conn_t *connp; 2078 ill_t *ill = ira->ira_ill; 2079 ip_stack_t *ipst = ill->ill_ipst; 2080 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 2081 ill_t *rill = ira->ira_rill; 2082 2083 /* Caller already pulled up everything. */ 2084 ipha = (ipha_t *)&icmph[1]; 2085 ASSERT((uchar_t *)&ipha[1] <= mp->b_wptr); 2086 ASSERT(mp->b_cont == NULL); 2087 2088 hdr_length = IPH_HDR_LENGTH(ipha); 2089 ira->ira_protocol = ipha->ipha_protocol; 2090 2091 /* 2092 * We need a separate IP header with the source and destination 2093 * addresses reversed to do fanout/classification because the ipha in 2094 * the ICMP error is in the form we sent it out. 2095 */ 2096 ripha.ipha_src = ipha->ipha_dst; 2097 ripha.ipha_dst = ipha->ipha_src; 2098 ripha.ipha_protocol = ipha->ipha_protocol; 2099 ripha.ipha_version_and_hdr_length = ipha->ipha_version_and_hdr_length; 2100 2101 ip2dbg(("icmp_inbound_error_v4: proto %d %x to %x: %d/%d\n", 2102 ripha.ipha_protocol, ntohl(ipha->ipha_src), 2103 ntohl(ipha->ipha_dst), 2104 icmph->icmph_type, icmph->icmph_code)); 2105 2106 switch (ipha->ipha_protocol) { 2107 case IPPROTO_UDP: 2108 up = (uint16_t *)((uchar_t *)ipha + hdr_length); 2109 2110 /* Attempt to find a client stream based on port. */ 2111 ip2dbg(("icmp_inbound_error_v4: UDP ports %d to %d\n", 2112 ntohs(up[0]), ntohs(up[1]))); 2113 2114 /* Note that we send error to all matches. */ 2115 ira->ira_flags |= IRAF_ICMP_ERROR; 2116 ip_fanout_udp_multi_v4(mp, &ripha, up[0], up[1], ira); 2117 ira->ira_flags &= ~IRAF_ICMP_ERROR; 2118 return; 2119 2120 case IPPROTO_TCP: 2121 /* 2122 * Find a TCP client stream for this packet. 2123 * Note that we do a reverse lookup since the header is 2124 * in the form we sent it out. 2125 */ 2126 tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length); 2127 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN, 2128 ipst); 2129 if (connp == NULL) 2130 goto discard_pkt; 2131 2132 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || 2133 (ira->ira_flags & IRAF_IPSEC_SECURE)) { 2134 mp = ipsec_check_inbound_policy(mp, connp, 2135 ipha, NULL, ira); 2136 if (mp == NULL) { 2137 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2138 /* Note that mp is NULL */ 2139 ip_drop_input("ipIfStatsInDiscards", mp, ill); 2140 CONN_DEC_REF(connp); 2141 return; 2142 } 2143 } 2144 2145 ira->ira_flags |= IRAF_ICMP_ERROR; 2146 ira->ira_ill = ira->ira_rill = NULL; 2147 if (IPCL_IS_TCP(connp)) { 2148 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 2149 connp->conn_recvicmp, connp, ira, SQ_FILL, 2150 SQTAG_TCP_INPUT_ICMP_ERR); 2151 } else { 2152 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */ 2153 (connp->conn_recv)(connp, mp, NULL, ira); 2154 CONN_DEC_REF(connp); 2155 } 2156 ira->ira_ill = ill; 2157 ira->ira_rill = rill; 2158 ira->ira_flags &= ~IRAF_ICMP_ERROR; 2159 return; 2160 2161 case IPPROTO_SCTP: 2162 up = (uint16_t *)((uchar_t *)ipha + hdr_length); 2163 /* Find a SCTP client stream for this packet. */ 2164 ((uint16_t *)&ports)[0] = up[1]; 2165 ((uint16_t *)&ports)[1] = up[0]; 2166 2167 ira->ira_flags |= IRAF_ICMP_ERROR; 2168 ip_fanout_sctp(mp, &ripha, NULL, ports, ira); 2169 ira->ira_flags &= ~IRAF_ICMP_ERROR; 2170 return; 2171 2172 case IPPROTO_ESP: 2173 case IPPROTO_AH: 2174 if (!ipsec_loaded(ipss)) { 2175 ip_proto_not_sup(mp, ira); 2176 return; 2177 } 2178 2179 if (ipha->ipha_protocol == IPPROTO_ESP) 2180 mp = ipsecesp_icmp_error(mp, ira); 2181 else 2182 mp = ipsecah_icmp_error(mp, ira); 2183 if (mp == NULL) 2184 return; 2185 2186 /* Just in case ipsec didn't preserve the NULL b_cont */ 2187 if (mp->b_cont != NULL) { 2188 if (!pullupmsg(mp, -1)) 2189 goto discard_pkt; 2190 } 2191 2192 /* 2193 * Note that ira_pktlen and ira_ip_hdr_length are no longer 2194 * correct, but we don't use them any more here. 2195 * 2196 * If succesful, the mp has been modified to not include 2197 * the ESP/AH header so we can fanout to the ULP's icmp 2198 * error handler. 2199 */ 2200 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) 2201 goto truncated; 2202 2203 /* Verify the modified message before any further processes. */ 2204 ipha = (ipha_t *)mp->b_rptr; 2205 hdr_length = IPH_HDR_LENGTH(ipha); 2206 icmph = (icmph_t *)&mp->b_rptr[hdr_length]; 2207 if (!icmp_inbound_verify_v4(mp, icmph, ira)) { 2208 freemsg(mp); 2209 return; 2210 } 2211 2212 icmp_inbound_error_fanout_v4(mp, icmph, ira); 2213 return; 2214 2215 case IPPROTO_ENCAP: { 2216 /* Look for self-encapsulated packets that caused an error */ 2217 ipha_t *in_ipha; 2218 2219 /* 2220 * Caller has verified that length has to be 2221 * at least the size of IP header. 2222 */ 2223 ASSERT(hdr_length >= sizeof (ipha_t)); 2224 /* 2225 * Check the sanity of the inner IP header like 2226 * we did for the outer header. 2227 */ 2228 in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length); 2229 if ((IPH_HDR_VERSION(in_ipha) != IPV4_VERSION)) { 2230 goto discard_pkt; 2231 } 2232 if (IPH_HDR_LENGTH(in_ipha) < sizeof (ipha_t)) { 2233 goto discard_pkt; 2234 } 2235 /* Check for Self-encapsulated tunnels */ 2236 if (in_ipha->ipha_src == ipha->ipha_src && 2237 in_ipha->ipha_dst == ipha->ipha_dst) { 2238 2239 mp = icmp_inbound_self_encap_error_v4(mp, ipha, 2240 in_ipha); 2241 if (mp == NULL) 2242 goto discard_pkt; 2243 2244 /* 2245 * Just in case self_encap didn't preserve the NULL 2246 * b_cont 2247 */ 2248 if (mp->b_cont != NULL) { 2249 if (!pullupmsg(mp, -1)) 2250 goto discard_pkt; 2251 } 2252 /* 2253 * Note that ira_pktlen and ira_ip_hdr_length are no 2254 * longer correct, but we don't use them any more here. 2255 */ 2256 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) 2257 goto truncated; 2258 2259 /* 2260 * Verify the modified message before any further 2261 * processes. 2262 */ 2263 ipha = (ipha_t *)mp->b_rptr; 2264 hdr_length = IPH_HDR_LENGTH(ipha); 2265 icmph = (icmph_t *)&mp->b_rptr[hdr_length]; 2266 if (!icmp_inbound_verify_v4(mp, icmph, ira)) { 2267 freemsg(mp); 2268 return; 2269 } 2270 2271 /* 2272 * The packet in error is self-encapsualted. 2273 * And we are finding it further encapsulated 2274 * which we could not have possibly generated. 2275 */ 2276 if (ipha->ipha_protocol == IPPROTO_ENCAP) { 2277 goto discard_pkt; 2278 } 2279 icmp_inbound_error_fanout_v4(mp, icmph, ira); 2280 return; 2281 } 2282 /* No self-encapsulated */ 2283 /* FALLTHRU */ 2284 } 2285 case IPPROTO_IPV6: 2286 if ((connp = ipcl_iptun_classify_v4(&ripha.ipha_src, 2287 &ripha.ipha_dst, ipst)) != NULL) { 2288 ira->ira_flags |= IRAF_ICMP_ERROR; 2289 connp->conn_recvicmp(connp, mp, NULL, ira); 2290 CONN_DEC_REF(connp); 2291 ira->ira_flags &= ~IRAF_ICMP_ERROR; 2292 return; 2293 } 2294 /* 2295 * No IP tunnel is interested, fallthrough and see 2296 * if a raw socket will want it. 2297 */ 2298 /* FALLTHRU */ 2299 default: 2300 ira->ira_flags |= IRAF_ICMP_ERROR; 2301 ip_fanout_proto_v4(mp, &ripha, ira); 2302 ira->ira_flags &= ~IRAF_ICMP_ERROR; 2303 return; 2304 } 2305 /* NOTREACHED */ 2306 discard_pkt: 2307 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2308 ip1dbg(("icmp_inbound_error_fanout_v4: drop pkt\n")); 2309 ip_drop_input("ipIfStatsInDiscards", mp, ill); 2310 freemsg(mp); 2311 return; 2312 2313 truncated: 2314 /* We pulled up everthing already. Must be truncated */ 2315 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts); 2316 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill); 2317 freemsg(mp); 2318 } 2319 2320 /* 2321 * Common IP options parser. 2322 * 2323 * Setup routine: fill in *optp with options-parsing state, then 2324 * tail-call ipoptp_next to return the first option. 2325 */ 2326 uint8_t 2327 ipoptp_first(ipoptp_t *optp, ipha_t *ipha) 2328 { 2329 uint32_t totallen; /* total length of all options */ 2330 2331 totallen = ipha->ipha_version_and_hdr_length - 2332 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 2333 totallen <<= 2; 2334 optp->ipoptp_next = (uint8_t *)(&ipha[1]); 2335 optp->ipoptp_end = optp->ipoptp_next + totallen; 2336 optp->ipoptp_flags = 0; 2337 return (ipoptp_next(optp)); 2338 } 2339 2340 /* Like above but without an ipha_t */ 2341 uint8_t 2342 ipoptp_first2(ipoptp_t *optp, uint32_t totallen, uint8_t *opt) 2343 { 2344 optp->ipoptp_next = opt; 2345 optp->ipoptp_end = optp->ipoptp_next + totallen; 2346 optp->ipoptp_flags = 0; 2347 return (ipoptp_next(optp)); 2348 } 2349 2350 /* 2351 * Common IP options parser: extract next option. 2352 */ 2353 uint8_t 2354 ipoptp_next(ipoptp_t *optp) 2355 { 2356 uint8_t *end = optp->ipoptp_end; 2357 uint8_t *cur = optp->ipoptp_next; 2358 uint8_t opt, len, pointer; 2359 2360 /* 2361 * If cur > end already, then the ipoptp_end or ipoptp_next pointer 2362 * has been corrupted. 2363 */ 2364 ASSERT(cur <= end); 2365 2366 if (cur == end) 2367 return (IPOPT_EOL); 2368 2369 opt = cur[IPOPT_OPTVAL]; 2370 2371 /* 2372 * Skip any NOP options. 2373 */ 2374 while (opt == IPOPT_NOP) { 2375 cur++; 2376 if (cur == end) 2377 return (IPOPT_EOL); 2378 opt = cur[IPOPT_OPTVAL]; 2379 } 2380 2381 if (opt == IPOPT_EOL) 2382 return (IPOPT_EOL); 2383 2384 /* 2385 * Option requiring a length. 2386 */ 2387 if ((cur + 1) >= end) { 2388 optp->ipoptp_flags |= IPOPTP_ERROR; 2389 return (IPOPT_EOL); 2390 } 2391 len = cur[IPOPT_OLEN]; 2392 if (len < 2) { 2393 optp->ipoptp_flags |= IPOPTP_ERROR; 2394 return (IPOPT_EOL); 2395 } 2396 optp->ipoptp_cur = cur; 2397 optp->ipoptp_len = len; 2398 optp->ipoptp_next = cur + len; 2399 if (cur + len > end) { 2400 optp->ipoptp_flags |= IPOPTP_ERROR; 2401 return (IPOPT_EOL); 2402 } 2403 2404 /* 2405 * For the options which require a pointer field, make sure 2406 * its there, and make sure it points to either something 2407 * inside this option, or the end of the option. 2408 */ 2409 switch (opt) { 2410 case IPOPT_RR: 2411 case IPOPT_TS: 2412 case IPOPT_LSRR: 2413 case IPOPT_SSRR: 2414 if (len <= IPOPT_OFFSET) { 2415 optp->ipoptp_flags |= IPOPTP_ERROR; 2416 return (opt); 2417 } 2418 pointer = cur[IPOPT_OFFSET]; 2419 if (pointer - 1 > len) { 2420 optp->ipoptp_flags |= IPOPTP_ERROR; 2421 return (opt); 2422 } 2423 break; 2424 } 2425 2426 /* 2427 * Sanity check the pointer field based on the type of the 2428 * option. 2429 */ 2430 switch (opt) { 2431 case IPOPT_RR: 2432 case IPOPT_SSRR: 2433 case IPOPT_LSRR: 2434 if (pointer < IPOPT_MINOFF_SR) 2435 optp->ipoptp_flags |= IPOPTP_ERROR; 2436 break; 2437 case IPOPT_TS: 2438 if (pointer < IPOPT_MINOFF_IT) 2439 optp->ipoptp_flags |= IPOPTP_ERROR; 2440 /* 2441 * Note that the Internet Timestamp option also 2442 * contains two four bit fields (the Overflow field, 2443 * and the Flag field), which follow the pointer 2444 * field. We don't need to check that these fields 2445 * fall within the length of the option because this 2446 * was implicitely done above. We've checked that the 2447 * pointer value is at least IPOPT_MINOFF_IT, and that 2448 * it falls within the option. Since IPOPT_MINOFF_IT > 2449 * IPOPT_POS_OV_FLG, we don't need the explicit check. 2450 */ 2451 ASSERT(len > IPOPT_POS_OV_FLG); 2452 break; 2453 } 2454 2455 return (opt); 2456 } 2457 2458 /* 2459 * Use the outgoing IP header to create an IP_OPTIONS option the way 2460 * it was passed down from the application. 2461 * 2462 * This is compatible with BSD in that it returns 2463 * the reverse source route with the final destination 2464 * as the last entry. The first 4 bytes of the option 2465 * will contain the final destination. 2466 */ 2467 int 2468 ip_opt_get_user(conn_t *connp, uchar_t *buf) 2469 { 2470 ipoptp_t opts; 2471 uchar_t *opt; 2472 uint8_t optval; 2473 uint8_t optlen; 2474 uint32_t len = 0; 2475 uchar_t *buf1 = buf; 2476 uint32_t totallen; 2477 ipaddr_t dst; 2478 ip_pkt_t *ipp = &connp->conn_xmit_ipp; 2479 2480 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS)) 2481 return (0); 2482 2483 totallen = ipp->ipp_ipv4_options_len; 2484 if (totallen & 0x3) 2485 return (0); 2486 2487 buf += IP_ADDR_LEN; /* Leave room for final destination */ 2488 len += IP_ADDR_LEN; 2489 bzero(buf1, IP_ADDR_LEN); 2490 2491 dst = connp->conn_faddr_v4; 2492 2493 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options); 2494 optval != IPOPT_EOL; 2495 optval = ipoptp_next(&opts)) { 2496 int off; 2497 2498 opt = opts.ipoptp_cur; 2499 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 2500 break; 2501 } 2502 optlen = opts.ipoptp_len; 2503 2504 switch (optval) { 2505 case IPOPT_SSRR: 2506 case IPOPT_LSRR: 2507 2508 /* 2509 * Insert destination as the first entry in the source 2510 * route and move down the entries on step. 2511 * The last entry gets placed at buf1. 2512 */ 2513 buf[IPOPT_OPTVAL] = optval; 2514 buf[IPOPT_OLEN] = optlen; 2515 buf[IPOPT_OFFSET] = optlen; 2516 2517 off = optlen - IP_ADDR_LEN; 2518 if (off < 0) { 2519 /* No entries in source route */ 2520 break; 2521 } 2522 /* Last entry in source route if not already set */ 2523 if (dst == INADDR_ANY) 2524 bcopy(opt + off, buf1, IP_ADDR_LEN); 2525 off -= IP_ADDR_LEN; 2526 2527 while (off > 0) { 2528 bcopy(opt + off, 2529 buf + off + IP_ADDR_LEN, 2530 IP_ADDR_LEN); 2531 off -= IP_ADDR_LEN; 2532 } 2533 /* ipha_dst into first slot */ 2534 bcopy(&dst, buf + off + IP_ADDR_LEN, 2535 IP_ADDR_LEN); 2536 buf += optlen; 2537 len += optlen; 2538 break; 2539 2540 default: 2541 bcopy(opt, buf, optlen); 2542 buf += optlen; 2543 len += optlen; 2544 break; 2545 } 2546 } 2547 done: 2548 /* Pad the resulting options */ 2549 while (len & 0x3) { 2550 *buf++ = IPOPT_EOL; 2551 len++; 2552 } 2553 return (len); 2554 } 2555 2556 /* 2557 * Update any record route or timestamp options to include this host. 2558 * Reverse any source route option. 2559 * This routine assumes that the options are well formed i.e. that they 2560 * have already been checked. 2561 */ 2562 static void 2563 icmp_options_update(ipha_t *ipha) 2564 { 2565 ipoptp_t opts; 2566 uchar_t *opt; 2567 uint8_t optval; 2568 ipaddr_t src; /* Our local address */ 2569 ipaddr_t dst; 2570 2571 ip2dbg(("icmp_options_update\n")); 2572 src = ipha->ipha_src; 2573 dst = ipha->ipha_dst; 2574 2575 for (optval = ipoptp_first(&opts, ipha); 2576 optval != IPOPT_EOL; 2577 optval = ipoptp_next(&opts)) { 2578 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 2579 opt = opts.ipoptp_cur; 2580 ip2dbg(("icmp_options_update: opt %d, len %d\n", 2581 optval, opts.ipoptp_len)); 2582 switch (optval) { 2583 int off1, off2; 2584 case IPOPT_SSRR: 2585 case IPOPT_LSRR: 2586 /* 2587 * Reverse the source route. The first entry 2588 * should be the next to last one in the current 2589 * source route (the last entry is our address). 2590 * The last entry should be the final destination. 2591 */ 2592 off1 = IPOPT_MINOFF_SR - 1; 2593 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; 2594 if (off2 < 0) { 2595 /* No entries in source route */ 2596 ip1dbg(( 2597 "icmp_options_update: bad src route\n")); 2598 break; 2599 } 2600 bcopy((char *)opt + off2, &dst, IP_ADDR_LEN); 2601 bcopy(&ipha->ipha_dst, (char *)opt + off2, IP_ADDR_LEN); 2602 bcopy(&dst, &ipha->ipha_dst, IP_ADDR_LEN); 2603 off2 -= IP_ADDR_LEN; 2604 2605 while (off1 < off2) { 2606 bcopy((char *)opt + off1, &src, IP_ADDR_LEN); 2607 bcopy((char *)opt + off2, (char *)opt + off1, 2608 IP_ADDR_LEN); 2609 bcopy(&src, (char *)opt + off2, IP_ADDR_LEN); 2610 off1 += IP_ADDR_LEN; 2611 off2 -= IP_ADDR_LEN; 2612 } 2613 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR; 2614 break; 2615 } 2616 } 2617 } 2618 2619 /* 2620 * Process received ICMP Redirect messages. 2621 * Assumes the caller has verified that the headers are in the pulled up mblk. 2622 * Consumes mp. 2623 */ 2624 static void 2625 icmp_redirect_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph, ip_recv_attr_t *ira) 2626 { 2627 ire_t *ire, *nire; 2628 ire_t *prev_ire; 2629 ipaddr_t src, dst, gateway; 2630 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 2631 ipha_t *inner_ipha; /* Inner IP header */ 2632 2633 /* Caller already pulled up everything. */ 2634 inner_ipha = (ipha_t *)&icmph[1]; 2635 src = ipha->ipha_src; 2636 dst = inner_ipha->ipha_dst; 2637 gateway = icmph->icmph_rd_gateway; 2638 /* Make sure the new gateway is reachable somehow. */ 2639 ire = ire_ftable_lookup_v4(gateway, 0, 0, IRE_ONLINK, NULL, 2640 ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, NULL); 2641 /* 2642 * Make sure we had a route for the dest in question and that 2643 * that route was pointing to the old gateway (the source of the 2644 * redirect packet.) 2645 * We do longest match and then compare ire_gateway_addr below. 2646 */ 2647 prev_ire = ire_ftable_lookup_v4(dst, 0, 0, 0, NULL, ALL_ZONES, 2648 NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL); 2649 /* 2650 * Check that 2651 * the redirect was not from ourselves 2652 * the new gateway and the old gateway are directly reachable 2653 */ 2654 if (prev_ire == NULL || ire == NULL || 2655 (prev_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) || 2656 (prev_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || 2657 !(ire->ire_type & IRE_IF_ALL) || 2658 prev_ire->ire_gateway_addr != src) { 2659 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects); 2660 ip_drop_input("icmpInBadRedirects - ire", mp, ira->ira_ill); 2661 freemsg(mp); 2662 if (ire != NULL) 2663 ire_refrele(ire); 2664 if (prev_ire != NULL) 2665 ire_refrele(prev_ire); 2666 return; 2667 } 2668 2669 ire_refrele(prev_ire); 2670 ire_refrele(ire); 2671 2672 /* 2673 * TODO: more precise handling for cases 0, 2, 3, the latter two 2674 * require TOS routing 2675 */ 2676 switch (icmph->icmph_code) { 2677 case 0: 2678 case 1: 2679 /* TODO: TOS specificity for cases 2 and 3 */ 2680 case 2: 2681 case 3: 2682 break; 2683 default: 2684 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects); 2685 ip_drop_input("icmpInBadRedirects - code", mp, ira->ira_ill); 2686 freemsg(mp); 2687 return; 2688 } 2689 /* 2690 * Create a Route Association. This will allow us to remember that 2691 * someone we believe told us to use the particular gateway. 2692 */ 2693 ire = ire_create( 2694 (uchar_t *)&dst, /* dest addr */ 2695 (uchar_t *)&ip_g_all_ones, /* mask */ 2696 (uchar_t *)&gateway, /* gateway addr */ 2697 IRE_HOST, 2698 NULL, /* ill */ 2699 ALL_ZONES, 2700 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 2701 NULL, /* tsol_gc_t */ 2702 ipst); 2703 2704 if (ire == NULL) { 2705 freemsg(mp); 2706 return; 2707 } 2708 nire = ire_add(ire); 2709 /* Check if it was a duplicate entry */ 2710 if (nire != NULL && nire != ire) { 2711 ASSERT(nire->ire_identical_ref > 1); 2712 ire_delete(nire); 2713 ire_refrele(nire); 2714 nire = NULL; 2715 } 2716 ire = nire; 2717 if (ire != NULL) { 2718 ire_refrele(ire); /* Held in ire_add */ 2719 2720 /* tell routing sockets that we received a redirect */ 2721 ip_rts_change(RTM_REDIRECT, dst, gateway, IP_HOST_MASK, 0, src, 2722 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0, 2723 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR), ipst); 2724 } 2725 2726 /* 2727 * Delete any existing IRE_HOST type redirect ires for this destination. 2728 * This together with the added IRE has the effect of 2729 * modifying an existing redirect. 2730 */ 2731 prev_ire = ire_ftable_lookup_v4(dst, 0, src, IRE_HOST, NULL, 2732 ALL_ZONES, NULL, (MATCH_IRE_GW | MATCH_IRE_TYPE), 0, ipst, NULL); 2733 if (prev_ire != NULL) { 2734 if (prev_ire ->ire_flags & RTF_DYNAMIC) 2735 ire_delete(prev_ire); 2736 ire_refrele(prev_ire); 2737 } 2738 2739 freemsg(mp); 2740 } 2741 2742 /* 2743 * Generate an ICMP parameter problem message. 2744 * When called from ip_output side a minimal ip_recv_attr_t needs to be 2745 * constructed by the caller. 2746 */ 2747 static void 2748 icmp_param_problem(mblk_t *mp, uint8_t ptr, ip_recv_attr_t *ira) 2749 { 2750 icmph_t icmph; 2751 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 2752 2753 mp = icmp_pkt_err_ok(mp, ira); 2754 if (mp == NULL) 2755 return; 2756 2757 bzero(&icmph, sizeof (icmph_t)); 2758 icmph.icmph_type = ICMP_PARAM_PROBLEM; 2759 icmph.icmph_pp_ptr = ptr; 2760 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutParmProbs); 2761 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira); 2762 } 2763 2764 /* 2765 * Build and ship an IPv4 ICMP message using the packet data in mp, and 2766 * the ICMP header pointed to by "stuff". (May be called as writer.) 2767 * Note: assumes that icmp_pkt_err_ok has been called to verify that 2768 * an icmp error packet can be sent. 2769 * Assigns an appropriate source address to the packet. If ipha_dst is 2770 * one of our addresses use it for source. Otherwise let ip_output_simple 2771 * pick the source address. 2772 */ 2773 static void 2774 icmp_pkt(mblk_t *mp, void *stuff, size_t len, ip_recv_attr_t *ira) 2775 { 2776 ipaddr_t dst; 2777 icmph_t *icmph; 2778 ipha_t *ipha; 2779 uint_t len_needed; 2780 size_t msg_len; 2781 mblk_t *mp1; 2782 ipaddr_t src; 2783 ire_t *ire; 2784 ip_xmit_attr_t ixas; 2785 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 2786 2787 ipha = (ipha_t *)mp->b_rptr; 2788 2789 bzero(&ixas, sizeof (ixas)); 2790 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4; 2791 ixas.ixa_zoneid = ira->ira_zoneid; 2792 ixas.ixa_ifindex = 0; 2793 ixas.ixa_ipst = ipst; 2794 ixas.ixa_cred = kcred; 2795 ixas.ixa_cpid = NOPID; 2796 ixas.ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */ 2797 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 2798 2799 if (ira->ira_flags & IRAF_IPSEC_SECURE) { 2800 /* 2801 * Apply IPsec based on how IPsec was applied to 2802 * the packet that had the error. 2803 * 2804 * If it was an outbound packet that caused the ICMP 2805 * error, then the caller will have setup the IRA 2806 * appropriately. 2807 */ 2808 if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) { 2809 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 2810 /* Note: mp already consumed and ip_drop_packet done */ 2811 return; 2812 } 2813 } else { 2814 /* 2815 * This is in clear. The icmp message we are building 2816 * here should go out in clear, independent of our policy. 2817 */ 2818 ixas.ixa_flags |= IXAF_NO_IPSEC; 2819 } 2820 2821 /* Remember our eventual destination */ 2822 dst = ipha->ipha_src; 2823 2824 /* 2825 * If the packet was for one of our unicast addresses, make 2826 * sure we respond with that as the source. Otherwise 2827 * have ip_output_simple pick the source address. 2828 */ 2829 ire = ire_ftable_lookup_v4(ipha->ipha_dst, 0, 0, 2830 (IRE_LOCAL|IRE_LOOPBACK), NULL, ira->ira_zoneid, NULL, 2831 MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY, 0, ipst, NULL); 2832 if (ire != NULL) { 2833 ire_refrele(ire); 2834 src = ipha->ipha_dst; 2835 } else { 2836 src = INADDR_ANY; 2837 ixas.ixa_flags |= IXAF_SET_SOURCE; 2838 } 2839 2840 /* 2841 * Check if we can send back more then 8 bytes in addition to 2842 * the IP header. We try to send 64 bytes of data and the internal 2843 * header in the special cases of ipv4 encapsulated ipv4 or ipv6. 2844 */ 2845 len_needed = IPH_HDR_LENGTH(ipha); 2846 if (ipha->ipha_protocol == IPPROTO_ENCAP || 2847 ipha->ipha_protocol == IPPROTO_IPV6) { 2848 if (!pullupmsg(mp, -1)) { 2849 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 2850 ip_drop_output("ipIfStatsOutDiscards", mp, NULL); 2851 freemsg(mp); 2852 return; 2853 } 2854 ipha = (ipha_t *)mp->b_rptr; 2855 2856 if (ipha->ipha_protocol == IPPROTO_ENCAP) { 2857 len_needed += IPH_HDR_LENGTH(((uchar_t *)ipha + 2858 len_needed)); 2859 } else { 2860 ip6_t *ip6h = (ip6_t *)((uchar_t *)ipha + len_needed); 2861 2862 ASSERT(ipha->ipha_protocol == IPPROTO_IPV6); 2863 len_needed += ip_hdr_length_v6(mp, ip6h); 2864 } 2865 } 2866 len_needed += ipst->ips_ip_icmp_return; 2867 msg_len = msgdsize(mp); 2868 if (msg_len > len_needed) { 2869 (void) adjmsg(mp, len_needed - msg_len); 2870 msg_len = len_needed; 2871 } 2872 mp1 = allocb(sizeof (icmp_ipha) + len, BPRI_MED); 2873 if (mp1 == NULL) { 2874 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutErrors); 2875 freemsg(mp); 2876 return; 2877 } 2878 mp1->b_cont = mp; 2879 mp = mp1; 2880 2881 /* 2882 * Set IXAF_TRUSTED_ICMP so we can let the ICMP messages this 2883 * node generates be accepted in peace by all on-host destinations. 2884 * If we do NOT assume that all on-host destinations trust 2885 * self-generated ICMP messages, then rework here, ip6.c, and spd.c. 2886 * (Look for IXAF_TRUSTED_ICMP). 2887 */ 2888 ixas.ixa_flags |= IXAF_TRUSTED_ICMP; 2889 2890 ipha = (ipha_t *)mp->b_rptr; 2891 mp1->b_wptr = (uchar_t *)ipha + (sizeof (icmp_ipha) + len); 2892 *ipha = icmp_ipha; 2893 ipha->ipha_src = src; 2894 ipha->ipha_dst = dst; 2895 ipha->ipha_ttl = ipst->ips_ip_def_ttl; 2896 msg_len += sizeof (icmp_ipha) + len; 2897 if (msg_len > IP_MAXPACKET) { 2898 (void) adjmsg(mp, IP_MAXPACKET - msg_len); 2899 msg_len = IP_MAXPACKET; 2900 } 2901 ipha->ipha_length = htons((uint16_t)msg_len); 2902 icmph = (icmph_t *)&ipha[1]; 2903 bcopy(stuff, icmph, len); 2904 icmph->icmph_checksum = 0; 2905 icmph->icmph_checksum = IP_CSUM(mp, (int32_t)sizeof (ipha_t), 0); 2906 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs); 2907 2908 (void) ip_output_simple(mp, &ixas); 2909 ixa_cleanup(&ixas); 2910 } 2911 2912 /* 2913 * Determine if an ICMP error packet can be sent given the rate limit. 2914 * The limit consists of an average frequency (icmp_pkt_err_interval measured 2915 * in milliseconds) and a burst size. Burst size number of packets can 2916 * be sent arbitrarely closely spaced. 2917 * The state is tracked using two variables to implement an approximate 2918 * token bucket filter: 2919 * icmp_pkt_err_last - lbolt value when the last burst started 2920 * icmp_pkt_err_sent - number of packets sent in current burst 2921 */ 2922 boolean_t 2923 icmp_err_rate_limit(ip_stack_t *ipst) 2924 { 2925 clock_t now = TICK_TO_MSEC(ddi_get_lbolt()); 2926 uint_t refilled; /* Number of packets refilled in tbf since last */ 2927 /* Guard against changes by loading into local variable */ 2928 uint_t err_interval = ipst->ips_ip_icmp_err_interval; 2929 2930 if (err_interval == 0) 2931 return (B_FALSE); 2932 2933 if (ipst->ips_icmp_pkt_err_last > now) { 2934 /* 100HZ lbolt in ms for 32bit arch wraps every 49.7 days */ 2935 ipst->ips_icmp_pkt_err_last = 0; 2936 ipst->ips_icmp_pkt_err_sent = 0; 2937 } 2938 /* 2939 * If we are in a burst update the token bucket filter. 2940 * Update the "last" time to be close to "now" but make sure 2941 * we don't loose precision. 2942 */ 2943 if (ipst->ips_icmp_pkt_err_sent != 0) { 2944 refilled = (now - ipst->ips_icmp_pkt_err_last)/err_interval; 2945 if (refilled > ipst->ips_icmp_pkt_err_sent) { 2946 ipst->ips_icmp_pkt_err_sent = 0; 2947 } else { 2948 ipst->ips_icmp_pkt_err_sent -= refilled; 2949 ipst->ips_icmp_pkt_err_last += refilled * err_interval; 2950 } 2951 } 2952 if (ipst->ips_icmp_pkt_err_sent == 0) { 2953 /* Start of new burst */ 2954 ipst->ips_icmp_pkt_err_last = now; 2955 } 2956 if (ipst->ips_icmp_pkt_err_sent < ipst->ips_ip_icmp_err_burst) { 2957 ipst->ips_icmp_pkt_err_sent++; 2958 ip1dbg(("icmp_err_rate_limit: %d sent in burst\n", 2959 ipst->ips_icmp_pkt_err_sent)); 2960 return (B_FALSE); 2961 } 2962 ip1dbg(("icmp_err_rate_limit: dropped\n")); 2963 return (B_TRUE); 2964 } 2965 2966 /* 2967 * Check if it is ok to send an IPv4 ICMP error packet in 2968 * response to the IPv4 packet in mp. 2969 * Free the message and return null if no 2970 * ICMP error packet should be sent. 2971 */ 2972 static mblk_t * 2973 icmp_pkt_err_ok(mblk_t *mp, ip_recv_attr_t *ira) 2974 { 2975 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 2976 icmph_t *icmph; 2977 ipha_t *ipha; 2978 uint_t len_needed; 2979 2980 if (!mp) 2981 return (NULL); 2982 ipha = (ipha_t *)mp->b_rptr; 2983 if (ip_csum_hdr(ipha)) { 2984 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInCksumErrs); 2985 ip_drop_input("ipIfStatsInCksumErrs", mp, NULL); 2986 freemsg(mp); 2987 return (NULL); 2988 } 2989 if (ip_type_v4(ipha->ipha_dst, ipst) == IRE_BROADCAST || 2990 ip_type_v4(ipha->ipha_src, ipst) == IRE_BROADCAST || 2991 CLASSD(ipha->ipha_dst) || 2992 CLASSD(ipha->ipha_src) || 2993 (ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET)) { 2994 /* Note: only errors to the fragment with offset 0 */ 2995 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 2996 freemsg(mp); 2997 return (NULL); 2998 } 2999 if (ipha->ipha_protocol == IPPROTO_ICMP) { 3000 /* 3001 * Check the ICMP type. RFC 1122 sez: don't send ICMP 3002 * errors in response to any ICMP errors. 3003 */ 3004 len_needed = IPH_HDR_LENGTH(ipha) + ICMPH_SIZE; 3005 if (mp->b_wptr - mp->b_rptr < len_needed) { 3006 if (!pullupmsg(mp, len_needed)) { 3007 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 3008 freemsg(mp); 3009 return (NULL); 3010 } 3011 ipha = (ipha_t *)mp->b_rptr; 3012 } 3013 icmph = (icmph_t *) 3014 (&((char *)ipha)[IPH_HDR_LENGTH(ipha)]); 3015 switch (icmph->icmph_type) { 3016 case ICMP_DEST_UNREACHABLE: 3017 case ICMP_SOURCE_QUENCH: 3018 case ICMP_TIME_EXCEEDED: 3019 case ICMP_PARAM_PROBLEM: 3020 case ICMP_REDIRECT: 3021 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 3022 freemsg(mp); 3023 return (NULL); 3024 default: 3025 break; 3026 } 3027 } 3028 /* 3029 * If this is a labeled system, then check to see if we're allowed to 3030 * send a response to this particular sender. If not, then just drop. 3031 */ 3032 if (is_system_labeled() && !tsol_can_reply_error(mp, ira)) { 3033 ip2dbg(("icmp_pkt_err_ok: can't respond to packet\n")); 3034 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 3035 freemsg(mp); 3036 return (NULL); 3037 } 3038 if (icmp_err_rate_limit(ipst)) { 3039 /* 3040 * Only send ICMP error packets every so often. 3041 * This should be done on a per port/source basis, 3042 * but for now this will suffice. 3043 */ 3044 freemsg(mp); 3045 return (NULL); 3046 } 3047 return (mp); 3048 } 3049 3050 /* 3051 * Called when a packet was sent out the same link that it arrived on. 3052 * Check if it is ok to send a redirect and then send it. 3053 */ 3054 void 3055 ip_send_potential_redirect_v4(mblk_t *mp, ipha_t *ipha, ire_t *ire, 3056 ip_recv_attr_t *ira) 3057 { 3058 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 3059 ipaddr_t src, nhop; 3060 mblk_t *mp1; 3061 ire_t *nhop_ire; 3062 3063 /* 3064 * Check the source address to see if it originated 3065 * on the same logical subnet it is going back out on. 3066 * If so, we should be able to send it a redirect. 3067 * Avoid sending a redirect if the destination 3068 * is directly connected (i.e., we matched an IRE_ONLINK), 3069 * or if the packet was source routed out this interface. 3070 * 3071 * We avoid sending a redirect if the 3072 * destination is directly connected 3073 * because it is possible that multiple 3074 * IP subnets may have been configured on 3075 * the link, and the source may not 3076 * be on the same subnet as ip destination, 3077 * even though they are on the same 3078 * physical link. 3079 */ 3080 if ((ire->ire_type & IRE_ONLINK) || 3081 ip_source_routed(ipha, ipst)) 3082 return; 3083 3084 nhop_ire = ire_nexthop(ire); 3085 if (nhop_ire == NULL) 3086 return; 3087 3088 nhop = nhop_ire->ire_addr; 3089 3090 if (nhop_ire->ire_type & IRE_IF_CLONE) { 3091 ire_t *ire2; 3092 3093 /* Follow ire_dep_parent to find non-clone IRE_INTERFACE */ 3094 mutex_enter(&nhop_ire->ire_lock); 3095 ire2 = nhop_ire->ire_dep_parent; 3096 if (ire2 != NULL) 3097 ire_refhold(ire2); 3098 mutex_exit(&nhop_ire->ire_lock); 3099 ire_refrele(nhop_ire); 3100 nhop_ire = ire2; 3101 } 3102 if (nhop_ire == NULL) 3103 return; 3104 3105 ASSERT(!(nhop_ire->ire_type & IRE_IF_CLONE)); 3106 3107 src = ipha->ipha_src; 3108 3109 /* 3110 * We look at the interface ire for the nexthop, 3111 * to see if ipha_src is in the same subnet 3112 * as the nexthop. 3113 */ 3114 if ((src & nhop_ire->ire_mask) == (nhop & nhop_ire->ire_mask)) { 3115 /* 3116 * The source is directly connected. 3117 */ 3118 mp1 = copymsg(mp); 3119 if (mp1 != NULL) { 3120 icmp_send_redirect(mp1, nhop, ira); 3121 } 3122 } 3123 ire_refrele(nhop_ire); 3124 } 3125 3126 /* 3127 * Generate an ICMP redirect message. 3128 */ 3129 static void 3130 icmp_send_redirect(mblk_t *mp, ipaddr_t gateway, ip_recv_attr_t *ira) 3131 { 3132 icmph_t icmph; 3133 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 3134 3135 mp = icmp_pkt_err_ok(mp, ira); 3136 if (mp == NULL) 3137 return; 3138 3139 bzero(&icmph, sizeof (icmph_t)); 3140 icmph.icmph_type = ICMP_REDIRECT; 3141 icmph.icmph_code = 1; 3142 icmph.icmph_rd_gateway = gateway; 3143 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutRedirects); 3144 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira); 3145 } 3146 3147 /* 3148 * Generate an ICMP time exceeded message. 3149 */ 3150 void 3151 icmp_time_exceeded(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira) 3152 { 3153 icmph_t icmph; 3154 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 3155 3156 mp = icmp_pkt_err_ok(mp, ira); 3157 if (mp == NULL) 3158 return; 3159 3160 bzero(&icmph, sizeof (icmph_t)); 3161 icmph.icmph_type = ICMP_TIME_EXCEEDED; 3162 icmph.icmph_code = code; 3163 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimeExcds); 3164 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira); 3165 } 3166 3167 /* 3168 * Generate an ICMP unreachable message. 3169 * When called from ip_output side a minimal ip_recv_attr_t needs to be 3170 * constructed by the caller. 3171 */ 3172 void 3173 icmp_unreachable(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira) 3174 { 3175 icmph_t icmph; 3176 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 3177 3178 mp = icmp_pkt_err_ok(mp, ira); 3179 if (mp == NULL) 3180 return; 3181 3182 bzero(&icmph, sizeof (icmph_t)); 3183 icmph.icmph_type = ICMP_DEST_UNREACHABLE; 3184 icmph.icmph_code = code; 3185 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs); 3186 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira); 3187 } 3188 3189 /* 3190 * Latch in the IPsec state for a stream based the policy in the listener 3191 * and the actions in the ip_recv_attr_t. 3192 * Called directly from TCP and SCTP. 3193 */ 3194 boolean_t 3195 ip_ipsec_policy_inherit(conn_t *connp, conn_t *lconnp, ip_recv_attr_t *ira) 3196 { 3197 ASSERT(lconnp->conn_policy != NULL); 3198 ASSERT(connp->conn_policy == NULL); 3199 3200 IPPH_REFHOLD(lconnp->conn_policy); 3201 connp->conn_policy = lconnp->conn_policy; 3202 3203 if (ira->ira_ipsec_action != NULL) { 3204 if (connp->conn_latch == NULL) { 3205 connp->conn_latch = iplatch_create(); 3206 if (connp->conn_latch == NULL) 3207 return (B_FALSE); 3208 } 3209 ipsec_latch_inbound(connp, ira); 3210 } 3211 return (B_TRUE); 3212 } 3213 3214 /* 3215 * Verify whether or not the IP address is a valid local address. 3216 * Could be a unicast, including one for a down interface. 3217 * If allow_mcbc then a multicast or broadcast address is also 3218 * acceptable. 3219 * 3220 * In the case of a broadcast/multicast address, however, the 3221 * upper protocol is expected to reset the src address 3222 * to zero when we return IPVL_MCAST/IPVL_BCAST so that 3223 * no packets are emitted with broadcast/multicast address as 3224 * source address (that violates hosts requirements RFC 1122) 3225 * The addresses valid for bind are: 3226 * (1) - INADDR_ANY (0) 3227 * (2) - IP address of an UP interface 3228 * (3) - IP address of a DOWN interface 3229 * (4) - valid local IP broadcast addresses. In this case 3230 * the conn will only receive packets destined to 3231 * the specified broadcast address. 3232 * (5) - a multicast address. In this case 3233 * the conn will only receive packets destined to 3234 * the specified multicast address. Note: the 3235 * application still has to issue an 3236 * IP_ADD_MEMBERSHIP socket option. 3237 * 3238 * In all the above cases, the bound address must be valid in the current zone. 3239 * When the address is loopback, multicast or broadcast, there might be many 3240 * matching IREs so bind has to look up based on the zone. 3241 */ 3242 ip_laddr_t 3243 ip_laddr_verify_v4(ipaddr_t src_addr, zoneid_t zoneid, 3244 ip_stack_t *ipst, boolean_t allow_mcbc) 3245 { 3246 ire_t *src_ire; 3247 3248 ASSERT(src_addr != INADDR_ANY); 3249 3250 src_ire = ire_ftable_lookup_v4(src_addr, 0, 0, 0, 3251 NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, 0, ipst, NULL); 3252 3253 /* 3254 * If an address other than in6addr_any is requested, 3255 * we verify that it is a valid address for bind 3256 * Note: Following code is in if-else-if form for 3257 * readability compared to a condition check. 3258 */ 3259 if (src_ire != NULL && (src_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK))) { 3260 /* 3261 * (2) Bind to address of local UP interface 3262 */ 3263 ire_refrele(src_ire); 3264 return (IPVL_UNICAST_UP); 3265 } else if (src_ire != NULL && src_ire->ire_type & IRE_BROADCAST) { 3266 /* 3267 * (4) Bind to broadcast address 3268 */ 3269 ire_refrele(src_ire); 3270 if (allow_mcbc) 3271 return (IPVL_BCAST); 3272 else 3273 return (IPVL_BAD); 3274 } else if (CLASSD(src_addr)) { 3275 /* (5) bind to multicast address. */ 3276 if (src_ire != NULL) 3277 ire_refrele(src_ire); 3278 3279 if (allow_mcbc) 3280 return (IPVL_MCAST); 3281 else 3282 return (IPVL_BAD); 3283 } else { 3284 ipif_t *ipif; 3285 3286 /* 3287 * (3) Bind to address of local DOWN interface? 3288 * (ipif_lookup_addr() looks up all interfaces 3289 * but we do not get here for UP interfaces 3290 * - case (2) above) 3291 */ 3292 if (src_ire != NULL) 3293 ire_refrele(src_ire); 3294 3295 ipif = ipif_lookup_addr(src_addr, NULL, zoneid, ipst); 3296 if (ipif == NULL) 3297 return (IPVL_BAD); 3298 3299 /* Not a useful source? */ 3300 if (ipif->ipif_flags & (IPIF_NOLOCAL | IPIF_ANYCAST)) { 3301 ipif_refrele(ipif); 3302 return (IPVL_BAD); 3303 } 3304 ipif_refrele(ipif); 3305 return (IPVL_UNICAST_DOWN); 3306 } 3307 } 3308 3309 /* 3310 * Insert in the bind fanout for IPv4 and IPv6. 3311 * The caller should already have used ip_laddr_verify_v*() before calling 3312 * this. 3313 */ 3314 int 3315 ip_laddr_fanout_insert(conn_t *connp) 3316 { 3317 int error; 3318 3319 /* 3320 * Allow setting new policies. For example, disconnects result 3321 * in us being called. As we would have set conn_policy_cached 3322 * to B_TRUE before, we should set it to B_FALSE, so that policy 3323 * can change after the disconnect. 3324 */ 3325 connp->conn_policy_cached = B_FALSE; 3326 3327 error = ipcl_bind_insert(connp); 3328 if (error != 0) { 3329 if (connp->conn_anon_port) { 3330 (void) tsol_mlp_anon(crgetzone(connp->conn_cred), 3331 connp->conn_mlp_type, connp->conn_proto, 3332 ntohs(connp->conn_lport), B_FALSE); 3333 } 3334 connp->conn_mlp_type = mlptSingle; 3335 } 3336 return (error); 3337 } 3338 3339 /* 3340 * Verify that both the source and destination addresses are valid. If 3341 * IPDF_VERIFY_DST is not set, then the destination address may be unreachable, 3342 * i.e. have no route to it. Protocols like TCP want to verify destination 3343 * reachability, while tunnels do not. 3344 * 3345 * Determine the route, the interface, and (optionally) the source address 3346 * to use to reach a given destination. 3347 * Note that we allow connect to broadcast and multicast addresses when 3348 * IPDF_ALLOW_MCBC is set. 3349 * first_hop and dst_addr are normally the same, but if source routing 3350 * they will differ; in that case the first_hop is what we'll use for the 3351 * routing lookup but the dce and label checks will be done on dst_addr, 3352 * 3353 * If uinfo is set, then we fill in the best available information 3354 * we have for the destination. This is based on (in priority order) any 3355 * metrics and path MTU stored in a dce_t, route metrics, and finally the 3356 * ill_mtu/ill_mc_mtu. 3357 * 3358 * Tsol note: If we have a source route then dst_addr != firsthop. But we 3359 * always do the label check on dst_addr. 3360 */ 3361 int 3362 ip_set_destination_v4(ipaddr_t *src_addrp, ipaddr_t dst_addr, ipaddr_t firsthop, 3363 ip_xmit_attr_t *ixa, iulp_t *uinfo, uint32_t flags, uint_t mac_mode) 3364 { 3365 ire_t *ire = NULL; 3366 int error = 0; 3367 ipaddr_t setsrc; /* RTF_SETSRC */ 3368 zoneid_t zoneid = ixa->ixa_zoneid; /* Honors SO_ALLZONES */ 3369 ip_stack_t *ipst = ixa->ixa_ipst; 3370 dce_t *dce; 3371 uint_t pmtu; 3372 uint_t generation; 3373 nce_t *nce; 3374 ill_t *ill = NULL; 3375 boolean_t multirt = B_FALSE; 3376 3377 ASSERT(ixa->ixa_flags & IXAF_IS_IPV4); 3378 3379 /* 3380 * We never send to zero; the ULPs map it to the loopback address. 3381 * We can't allow it since we use zero to mean unitialized in some 3382 * places. 3383 */ 3384 ASSERT(dst_addr != INADDR_ANY); 3385 3386 if (is_system_labeled()) { 3387 ts_label_t *tsl = NULL; 3388 3389 error = tsol_check_dest(ixa->ixa_tsl, &dst_addr, IPV4_VERSION, 3390 mac_mode, (flags & IPDF_ZONE_IS_GLOBAL) != 0, &tsl); 3391 if (error != 0) 3392 return (error); 3393 if (tsl != NULL) { 3394 /* Update the label */ 3395 ip_xmit_attr_replace_tsl(ixa, tsl); 3396 } 3397 } 3398 3399 setsrc = INADDR_ANY; 3400 /* 3401 * Select a route; For IPMP interfaces, we would only select 3402 * a "hidden" route (i.e., going through a specific under_ill) 3403 * if ixa_ifindex has been specified. 3404 */ 3405 ire = ip_select_route_v4(firsthop, *src_addrp, ixa, 3406 &generation, &setsrc, &error, &multirt); 3407 ASSERT(ire != NULL); /* IRE_NOROUTE if none found */ 3408 if (error != 0) 3409 goto bad_addr; 3410 3411 /* 3412 * ire can't be a broadcast or multicast unless IPDF_ALLOW_MCBC is set. 3413 * If IPDF_VERIFY_DST is set, the destination must be reachable; 3414 * Otherwise the destination needn't be reachable. 3415 * 3416 * If we match on a reject or black hole, then we've got a 3417 * local failure. May as well fail out the connect() attempt, 3418 * since it's never going to succeed. 3419 */ 3420 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 3421 /* 3422 * If we're verifying destination reachability, we always want 3423 * to complain here. 3424 * 3425 * If we're not verifying destination reachability but the 3426 * destination has a route, we still want to fail on the 3427 * temporary address and broadcast address tests. 3428 * 3429 * In both cases do we let the code continue so some reasonable 3430 * information is returned to the caller. That enables the 3431 * caller to use (and even cache) the IRE. conn_ip_ouput will 3432 * use the generation mismatch path to check for the unreachable 3433 * case thereby avoiding any specific check in the main path. 3434 */ 3435 ASSERT(generation == IRE_GENERATION_VERIFY); 3436 if (flags & IPDF_VERIFY_DST) { 3437 /* 3438 * Set errno but continue to set up ixa_ire to be 3439 * the RTF_REJECT|RTF_BLACKHOLE IRE. 3440 * That allows callers to use ip_output to get an 3441 * ICMP error back. 3442 */ 3443 if (!(ire->ire_type & IRE_HOST)) 3444 error = ENETUNREACH; 3445 else 3446 error = EHOSTUNREACH; 3447 } 3448 } 3449 3450 if ((ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST)) && 3451 !(flags & IPDF_ALLOW_MCBC)) { 3452 ire_refrele(ire); 3453 ire = ire_reject(ipst, B_FALSE); 3454 generation = IRE_GENERATION_VERIFY; 3455 error = ENETUNREACH; 3456 } 3457 3458 /* Cache things */ 3459 if (ixa->ixa_ire != NULL) 3460 ire_refrele_notr(ixa->ixa_ire); 3461 #ifdef DEBUG 3462 ire_refhold_notr(ire); 3463 ire_refrele(ire); 3464 #endif 3465 ixa->ixa_ire = ire; 3466 ixa->ixa_ire_generation = generation; 3467 3468 /* 3469 * Ensure that ixa_dce is always set any time that ixa_ire is set, 3470 * since some callers will send a packet to conn_ip_output() even if 3471 * there's an error. 3472 */ 3473 if (flags & IPDF_UNIQUE_DCE) { 3474 /* Fallback to the default dce if allocation fails */ 3475 dce = dce_lookup_and_add_v4(dst_addr, ipst); 3476 if (dce != NULL) 3477 generation = dce->dce_generation; 3478 else 3479 dce = dce_lookup_v4(dst_addr, ipst, &generation); 3480 } else { 3481 dce = dce_lookup_v4(dst_addr, ipst, &generation); 3482 } 3483 ASSERT(dce != NULL); 3484 if (ixa->ixa_dce != NULL) 3485 dce_refrele_notr(ixa->ixa_dce); 3486 #ifdef DEBUG 3487 dce_refhold_notr(dce); 3488 dce_refrele(dce); 3489 #endif 3490 ixa->ixa_dce = dce; 3491 ixa->ixa_dce_generation = generation; 3492 3493 /* 3494 * For multicast with multirt we have a flag passed back from 3495 * ire_lookup_multi_ill_v4 since we don't have an IRE for each 3496 * possible multicast address. 3497 * We also need a flag for multicast since we can't check 3498 * whether RTF_MULTIRT is set in ixa_ire for multicast. 3499 */ 3500 if (multirt) { 3501 ixa->ixa_postfragfn = ip_postfrag_multirt_v4; 3502 ixa->ixa_flags |= IXAF_MULTIRT_MULTICAST; 3503 } else { 3504 ixa->ixa_postfragfn = ire->ire_postfragfn; 3505 ixa->ixa_flags &= ~IXAF_MULTIRT_MULTICAST; 3506 } 3507 if (!(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) { 3508 /* Get an nce to cache. */ 3509 nce = ire_to_nce(ire, firsthop, NULL); 3510 if (nce == NULL) { 3511 /* Allocation failure? */ 3512 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY; 3513 } else { 3514 if (ixa->ixa_nce != NULL) 3515 nce_refrele(ixa->ixa_nce); 3516 ixa->ixa_nce = nce; 3517 } 3518 } 3519 3520 /* 3521 * If the source address is a loopback address, the 3522 * destination had best be local or multicast. 3523 * If we are sending to an IRE_LOCAL using a loopback source then 3524 * it had better be the same zoneid. 3525 */ 3526 if (*src_addrp == htonl(INADDR_LOOPBACK)) { 3527 if ((ire->ire_type & IRE_LOCAL) && ire->ire_zoneid != zoneid) { 3528 ire = NULL; /* Stored in ixa_ire */ 3529 error = EADDRNOTAVAIL; 3530 goto bad_addr; 3531 } 3532 if (!(ire->ire_type & (IRE_LOOPBACK|IRE_LOCAL|IRE_MULTICAST))) { 3533 ire = NULL; /* Stored in ixa_ire */ 3534 error = EADDRNOTAVAIL; 3535 goto bad_addr; 3536 } 3537 } 3538 if (ire->ire_type & IRE_BROADCAST) { 3539 /* 3540 * If the ULP didn't have a specified source, then we 3541 * make sure we reselect the source when sending 3542 * broadcasts out different interfaces. 3543 */ 3544 if (flags & IPDF_SELECT_SRC) 3545 ixa->ixa_flags |= IXAF_SET_SOURCE; 3546 else 3547 ixa->ixa_flags &= ~IXAF_SET_SOURCE; 3548 } 3549 3550 /* 3551 * Does the caller want us to pick a source address? 3552 */ 3553 if (flags & IPDF_SELECT_SRC) { 3554 ipaddr_t src_addr; 3555 3556 /* 3557 * We use use ire_nexthop_ill to avoid the under ipmp 3558 * interface for source address selection. Note that for ipmp 3559 * probe packets, ixa_ifindex would have been specified, and 3560 * the ip_select_route() invocation would have picked an ire 3561 * will ire_ill pointing at an under interface. 3562 */ 3563 ill = ire_nexthop_ill(ire); 3564 3565 /* If unreachable we have no ill but need some source */ 3566 if (ill == NULL) { 3567 src_addr = htonl(INADDR_LOOPBACK); 3568 /* Make sure we look for a better source address */ 3569 generation = SRC_GENERATION_VERIFY; 3570 } else { 3571 error = ip_select_source_v4(ill, setsrc, dst_addr, 3572 ixa->ixa_multicast_ifaddr, zoneid, 3573 ipst, &src_addr, &generation, NULL); 3574 if (error != 0) { 3575 ire = NULL; /* Stored in ixa_ire */ 3576 goto bad_addr; 3577 } 3578 } 3579 3580 /* 3581 * We allow the source address to to down. 3582 * However, we check that we don't use the loopback address 3583 * as a source when sending out on the wire. 3584 */ 3585 if ((src_addr == htonl(INADDR_LOOPBACK)) && 3586 !(ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK|IRE_MULTICAST)) && 3587 !(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) { 3588 ire = NULL; /* Stored in ixa_ire */ 3589 error = EADDRNOTAVAIL; 3590 goto bad_addr; 3591 } 3592 3593 *src_addrp = src_addr; 3594 ixa->ixa_src_generation = generation; 3595 } 3596 3597 /* 3598 * Make sure we don't leave an unreachable ixa_nce in place 3599 * since ip_select_route is used when we unplumb i.e., remove 3600 * references on ixa_ire, ixa_nce, and ixa_dce. 3601 */ 3602 nce = ixa->ixa_nce; 3603 if (nce != NULL && nce->nce_is_condemned) { 3604 nce_refrele(nce); 3605 ixa->ixa_nce = NULL; 3606 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY; 3607 } 3608 3609 /* 3610 * The caller has set IXAF_PMTU_DISCOVERY if path MTU is desired. 3611 * However, we can't do it for IPv4 multicast or broadcast. 3612 */ 3613 if (ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST)) 3614 ixa->ixa_flags &= ~IXAF_PMTU_DISCOVERY; 3615 3616 /* 3617 * Set initial value for fragmentation limit. Either conn_ip_output 3618 * or ULP might updates it when there are routing changes. 3619 * Handles a NULL ixa_ire->ire_ill or a NULL ixa_nce for RTF_REJECT. 3620 */ 3621 pmtu = ip_get_pmtu(ixa); 3622 ixa->ixa_fragsize = pmtu; 3623 /* Make sure ixa_fragsize and ixa_pmtu remain identical */ 3624 if (ixa->ixa_flags & IXAF_VERIFY_PMTU) 3625 ixa->ixa_pmtu = pmtu; 3626 3627 /* 3628 * Extract information useful for some transports. 3629 * First we look for DCE metrics. Then we take what we have in 3630 * the metrics in the route, where the offlink is used if we have 3631 * one. 3632 */ 3633 if (uinfo != NULL) { 3634 bzero(uinfo, sizeof (*uinfo)); 3635 3636 if (dce->dce_flags & DCEF_UINFO) 3637 *uinfo = dce->dce_uinfo; 3638 3639 rts_merge_metrics(uinfo, &ire->ire_metrics); 3640 3641 /* Allow ire_metrics to decrease the path MTU from above */ 3642 if (uinfo->iulp_mtu == 0 || uinfo->iulp_mtu > pmtu) 3643 uinfo->iulp_mtu = pmtu; 3644 3645 uinfo->iulp_localnet = (ire->ire_type & IRE_ONLINK) != 0; 3646 uinfo->iulp_loopback = (ire->ire_type & IRE_LOOPBACK) != 0; 3647 uinfo->iulp_local = (ire->ire_type & IRE_LOCAL) != 0; 3648 } 3649 3650 if (ill != NULL) 3651 ill_refrele(ill); 3652 3653 return (error); 3654 3655 bad_addr: 3656 if (ire != NULL) 3657 ire_refrele(ire); 3658 3659 if (ill != NULL) 3660 ill_refrele(ill); 3661 3662 /* 3663 * Make sure we don't leave an unreachable ixa_nce in place 3664 * since ip_select_route is used when we unplumb i.e., remove 3665 * references on ixa_ire, ixa_nce, and ixa_dce. 3666 */ 3667 nce = ixa->ixa_nce; 3668 if (nce != NULL && nce->nce_is_condemned) { 3669 nce_refrele(nce); 3670 ixa->ixa_nce = NULL; 3671 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY; 3672 } 3673 3674 return (error); 3675 } 3676 3677 3678 /* 3679 * Get the base MTU for the case when path MTU discovery is not used. 3680 * Takes the MTU of the IRE into account. 3681 */ 3682 uint_t 3683 ip_get_base_mtu(ill_t *ill, ire_t *ire) 3684 { 3685 uint_t mtu; 3686 uint_t iremtu = ire->ire_metrics.iulp_mtu; 3687 3688 if (ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST)) 3689 mtu = ill->ill_mc_mtu; 3690 else 3691 mtu = ill->ill_mtu; 3692 3693 if (iremtu != 0 && iremtu < mtu) 3694 mtu = iremtu; 3695 3696 return (mtu); 3697 } 3698 3699 /* 3700 * Get the PMTU for the attributes. Handles both IPv4 and IPv6. 3701 * Assumes that ixa_ire, dce, and nce have already been set up. 3702 * 3703 * The caller has set IXAF_PMTU_DISCOVERY if path MTU discovery is desired. 3704 * We avoid path MTU discovery if it is disabled with ndd. 3705 * Furtermore, if the path MTU is too small, then we don't set DF for IPv4. 3706 * 3707 * NOTE: We also used to turn it off for source routed packets. That 3708 * is no longer required since the dce is per final destination. 3709 */ 3710 uint_t 3711 ip_get_pmtu(ip_xmit_attr_t *ixa) 3712 { 3713 ip_stack_t *ipst = ixa->ixa_ipst; 3714 dce_t *dce; 3715 nce_t *nce; 3716 ire_t *ire; 3717 uint_t pmtu; 3718 3719 ire = ixa->ixa_ire; 3720 dce = ixa->ixa_dce; 3721 nce = ixa->ixa_nce; 3722 3723 /* 3724 * If path MTU discovery has been turned off by ndd, then we ignore 3725 * any dce_pmtu and for IPv4 we will not set DF. 3726 */ 3727 if (!ipst->ips_ip_path_mtu_discovery) 3728 ixa->ixa_flags &= ~IXAF_PMTU_DISCOVERY; 3729 3730 pmtu = IP_MAXPACKET; 3731 /* 3732 * Decide whether whether IPv4 sets DF 3733 * For IPv6 "no DF" means to use the 1280 mtu 3734 */ 3735 if (ixa->ixa_flags & IXAF_PMTU_DISCOVERY) { 3736 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF; 3737 } else { 3738 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF; 3739 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) 3740 pmtu = IPV6_MIN_MTU; 3741 } 3742 3743 /* Check if the PMTU is to old before we use it */ 3744 if ((dce->dce_flags & DCEF_PMTU) && 3745 TICK_TO_SEC(ddi_get_lbolt64()) - dce->dce_last_change_time > 3746 ipst->ips_ip_pathmtu_interval) { 3747 /* 3748 * Older than 20 minutes. Drop the path MTU information. 3749 */ 3750 mutex_enter(&dce->dce_lock); 3751 dce->dce_flags &= ~(DCEF_PMTU|DCEF_TOO_SMALL_PMTU); 3752 dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64()); 3753 mutex_exit(&dce->dce_lock); 3754 dce_increment_generation(dce); 3755 } 3756 3757 /* The metrics on the route can lower the path MTU */ 3758 if (ire->ire_metrics.iulp_mtu != 0 && 3759 ire->ire_metrics.iulp_mtu < pmtu) 3760 pmtu = ire->ire_metrics.iulp_mtu; 3761 3762 /* 3763 * If the path MTU is smaller than some minimum, we still use dce_pmtu 3764 * above (would be 576 for IPv4 and 1280 for IPv6), but we clear 3765 * IXAF_PMTU_IPV4_DF so that we avoid setting DF for IPv4. 3766 */ 3767 if (ixa->ixa_flags & IXAF_PMTU_DISCOVERY) { 3768 if (dce->dce_flags & DCEF_PMTU) { 3769 if (dce->dce_pmtu < pmtu) 3770 pmtu = dce->dce_pmtu; 3771 3772 if (dce->dce_flags & DCEF_TOO_SMALL_PMTU) { 3773 ixa->ixa_flags |= IXAF_PMTU_TOO_SMALL; 3774 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF; 3775 } else { 3776 ixa->ixa_flags &= ~IXAF_PMTU_TOO_SMALL; 3777 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF; 3778 } 3779 } else { 3780 ixa->ixa_flags &= ~IXAF_PMTU_TOO_SMALL; 3781 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF; 3782 } 3783 } 3784 3785 /* 3786 * If we have an IRE_LOCAL we use the loopback mtu instead of 3787 * the ill for going out the wire i.e., IRE_LOCAL gets the same 3788 * mtu as IRE_LOOPBACK. 3789 */ 3790 if (ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) { 3791 uint_t loopback_mtu; 3792 3793 loopback_mtu = (ire->ire_ipversion == IPV6_VERSION) ? 3794 ip_loopback_mtu_v6plus : ip_loopback_mtuplus; 3795 3796 if (loopback_mtu < pmtu) 3797 pmtu = loopback_mtu; 3798 } else if (nce != NULL) { 3799 /* 3800 * Make sure we don't exceed the interface MTU. 3801 * In the case of RTF_REJECT or RTF_BLACKHOLE we might not have 3802 * an ill. We'd use the above IP_MAXPACKET in that case just 3803 * to tell the transport something larger than zero. 3804 */ 3805 if (ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST)) { 3806 if (nce->nce_common->ncec_ill->ill_mc_mtu < pmtu) 3807 pmtu = nce->nce_common->ncec_ill->ill_mc_mtu; 3808 if (nce->nce_common->ncec_ill != nce->nce_ill && 3809 nce->nce_ill->ill_mc_mtu < pmtu) { 3810 /* 3811 * for interfaces in an IPMP group, the mtu of 3812 * the nce_ill (under_ill) could be different 3813 * from the mtu of the ncec_ill, so we take the 3814 * min of the two. 3815 */ 3816 pmtu = nce->nce_ill->ill_mc_mtu; 3817 } 3818 } else { 3819 if (nce->nce_common->ncec_ill->ill_mtu < pmtu) 3820 pmtu = nce->nce_common->ncec_ill->ill_mtu; 3821 if (nce->nce_common->ncec_ill != nce->nce_ill && 3822 nce->nce_ill->ill_mtu < pmtu) { 3823 /* 3824 * for interfaces in an IPMP group, the mtu of 3825 * the nce_ill (under_ill) could be different 3826 * from the mtu of the ncec_ill, so we take the 3827 * min of the two. 3828 */ 3829 pmtu = nce->nce_ill->ill_mtu; 3830 } 3831 } 3832 } 3833 3834 /* 3835 * Handle the IPV6_USE_MIN_MTU socket option or ancillary data. 3836 * Only applies to IPv6. 3837 */ 3838 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) { 3839 if (ixa->ixa_flags & IXAF_USE_MIN_MTU) { 3840 switch (ixa->ixa_use_min_mtu) { 3841 case IPV6_USE_MIN_MTU_MULTICAST: 3842 if (ire->ire_type & IRE_MULTICAST) 3843 pmtu = IPV6_MIN_MTU; 3844 break; 3845 case IPV6_USE_MIN_MTU_ALWAYS: 3846 pmtu = IPV6_MIN_MTU; 3847 break; 3848 case IPV6_USE_MIN_MTU_NEVER: 3849 break; 3850 } 3851 } else { 3852 /* Default is IPV6_USE_MIN_MTU_MULTICAST */ 3853 if (ire->ire_type & IRE_MULTICAST) 3854 pmtu = IPV6_MIN_MTU; 3855 } 3856 } 3857 3858 /* 3859 * After receiving an ICMPv6 "packet too big" message with a 3860 * MTU < 1280, and for multirouted IPv6 packets, the IP layer 3861 * will insert a 8-byte fragment header in every packet. We compensate 3862 * for those cases by returning a smaller path MTU to the ULP. 3863 * 3864 * In the case of CGTP then ip_output will add a fragment header. 3865 * Make sure there is room for it by telling a smaller number 3866 * to the transport. 3867 * 3868 * When IXAF_IPV6_ADDR_FRAGHDR we subtract the frag hdr here 3869 * so the ULPs consistently see a iulp_pmtu and ip_get_pmtu() 3870 * which is the size of the packets it can send. 3871 */ 3872 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) { 3873 if ((dce->dce_flags & DCEF_TOO_SMALL_PMTU) || 3874 (ire->ire_flags & RTF_MULTIRT) || 3875 (ixa->ixa_flags & IXAF_MULTIRT_MULTICAST)) { 3876 pmtu -= sizeof (ip6_frag_t); 3877 ixa->ixa_flags |= IXAF_IPV6_ADD_FRAGHDR; 3878 } 3879 } 3880 3881 return (pmtu); 3882 } 3883 3884 /* 3885 * Carve "len" bytes out of an mblk chain, consuming any we empty, and duping 3886 * the final piece where we don't. Return a pointer to the first mblk in the 3887 * result, and update the pointer to the next mblk to chew on. If anything 3888 * goes wrong (i.e., dupb fails), we waste everything in sight and return a 3889 * NULL pointer. 3890 */ 3891 mblk_t * 3892 ip_carve_mp(mblk_t **mpp, ssize_t len) 3893 { 3894 mblk_t *mp0; 3895 mblk_t *mp1; 3896 mblk_t *mp2; 3897 3898 if (!len || !mpp || !(mp0 = *mpp)) 3899 return (NULL); 3900 /* If we aren't going to consume the first mblk, we need a dup. */ 3901 if (mp0->b_wptr - mp0->b_rptr > len) { 3902 mp1 = dupb(mp0); 3903 if (mp1) { 3904 /* Partition the data between the two mblks. */ 3905 mp1->b_wptr = mp1->b_rptr + len; 3906 mp0->b_rptr = mp1->b_wptr; 3907 /* 3908 * after adjustments if mblk not consumed is now 3909 * unaligned, try to align it. If this fails free 3910 * all messages and let upper layer recover. 3911 */ 3912 if (!OK_32PTR(mp0->b_rptr)) { 3913 if (!pullupmsg(mp0, -1)) { 3914 freemsg(mp0); 3915 freemsg(mp1); 3916 *mpp = NULL; 3917 return (NULL); 3918 } 3919 } 3920 } 3921 return (mp1); 3922 } 3923 /* Eat through as many mblks as we need to get len bytes. */ 3924 len -= mp0->b_wptr - mp0->b_rptr; 3925 for (mp2 = mp1 = mp0; (mp2 = mp2->b_cont) != 0 && len; mp1 = mp2) { 3926 if (mp2->b_wptr - mp2->b_rptr > len) { 3927 /* 3928 * We won't consume the entire last mblk. Like 3929 * above, dup and partition it. 3930 */ 3931 mp1->b_cont = dupb(mp2); 3932 mp1 = mp1->b_cont; 3933 if (!mp1) { 3934 /* 3935 * Trouble. Rather than go to a lot of 3936 * trouble to clean up, we free the messages. 3937 * This won't be any worse than losing it on 3938 * the wire. 3939 */ 3940 freemsg(mp0); 3941 freemsg(mp2); 3942 *mpp = NULL; 3943 return (NULL); 3944 } 3945 mp1->b_wptr = mp1->b_rptr + len; 3946 mp2->b_rptr = mp1->b_wptr; 3947 /* 3948 * after adjustments if mblk not consumed is now 3949 * unaligned, try to align it. If this fails free 3950 * all messages and let upper layer recover. 3951 */ 3952 if (!OK_32PTR(mp2->b_rptr)) { 3953 if (!pullupmsg(mp2, -1)) { 3954 freemsg(mp0); 3955 freemsg(mp2); 3956 *mpp = NULL; 3957 return (NULL); 3958 } 3959 } 3960 *mpp = mp2; 3961 return (mp0); 3962 } 3963 /* Decrement len by the amount we just got. */ 3964 len -= mp2->b_wptr - mp2->b_rptr; 3965 } 3966 /* 3967 * len should be reduced to zero now. If not our caller has 3968 * screwed up. 3969 */ 3970 if (len) { 3971 /* Shouldn't happen! */ 3972 freemsg(mp0); 3973 *mpp = NULL; 3974 return (NULL); 3975 } 3976 /* 3977 * We consumed up to exactly the end of an mblk. Detach the part 3978 * we are returning from the rest of the chain. 3979 */ 3980 mp1->b_cont = NULL; 3981 *mpp = mp2; 3982 return (mp0); 3983 } 3984 3985 /* The ill stream is being unplumbed. Called from ip_close */ 3986 int 3987 ip_modclose(ill_t *ill) 3988 { 3989 boolean_t success; 3990 ipsq_t *ipsq; 3991 ipif_t *ipif; 3992 queue_t *q = ill->ill_rq; 3993 ip_stack_t *ipst = ill->ill_ipst; 3994 int i; 3995 arl_ill_common_t *ai = ill->ill_common; 3996 3997 /* 3998 * The punlink prior to this may have initiated a capability 3999 * negotiation. But ipsq_enter will block until that finishes or 4000 * times out. 4001 */ 4002 success = ipsq_enter(ill, B_FALSE, NEW_OP); 4003 4004 /* 4005 * Open/close/push/pop is guaranteed to be single threaded 4006 * per stream by STREAMS. FS guarantees that all references 4007 * from top are gone before close is called. So there can't 4008 * be another close thread that has set CONDEMNED on this ill. 4009 * and cause ipsq_enter to return failure. 4010 */ 4011 ASSERT(success); 4012 ipsq = ill->ill_phyint->phyint_ipsq; 4013 4014 /* 4015 * Mark it condemned. No new reference will be made to this ill. 4016 * Lookup functions will return an error. Threads that try to 4017 * increment the refcnt must check for ILL_CAN_LOOKUP. This ensures 4018 * that the refcnt will drop down to zero. 4019 */ 4020 mutex_enter(&ill->ill_lock); 4021 ill->ill_state_flags |= ILL_CONDEMNED; 4022 for (ipif = ill->ill_ipif; ipif != NULL; 4023 ipif = ipif->ipif_next) { 4024 ipif->ipif_state_flags |= IPIF_CONDEMNED; 4025 } 4026 /* 4027 * Wake up anybody waiting to enter the ipsq. ipsq_enter 4028 * returns error if ILL_CONDEMNED is set 4029 */ 4030 cv_broadcast(&ill->ill_cv); 4031 mutex_exit(&ill->ill_lock); 4032 4033 /* 4034 * Send all the deferred DLPI messages downstream which came in 4035 * during the small window right before ipsq_enter(). We do this 4036 * without waiting for the ACKs because all the ACKs for M_PROTO 4037 * messages are ignored in ip_rput() when ILL_CONDEMNED is set. 4038 */ 4039 ill_dlpi_send_deferred(ill); 4040 4041 /* 4042 * Shut down fragmentation reassembly. 4043 * ill_frag_timer won't start a timer again. 4044 * Now cancel any existing timer 4045 */ 4046 (void) untimeout(ill->ill_frag_timer_id); 4047 (void) ill_frag_timeout(ill, 0); 4048 4049 /* 4050 * Call ill_delete to bring down the ipifs, ilms and ill on 4051 * this ill. Then wait for the refcnts to drop to zero. 4052 * ill_is_freeable checks whether the ill is really quiescent. 4053 * Then make sure that threads that are waiting to enter the 4054 * ipsq have seen the error returned by ipsq_enter and have 4055 * gone away. Then we call ill_delete_tail which does the 4056 * DL_UNBIND_REQ with the driver and then qprocsoff. 4057 */ 4058 ill_delete(ill); 4059 mutex_enter(&ill->ill_lock); 4060 while (!ill_is_freeable(ill)) 4061 cv_wait(&ill->ill_cv, &ill->ill_lock); 4062 4063 while (ill->ill_waiters) 4064 cv_wait(&ill->ill_cv, &ill->ill_lock); 4065 4066 mutex_exit(&ill->ill_lock); 4067 4068 /* 4069 * ill_delete_tail drops reference on ill_ipst, but we need to keep 4070 * it held until the end of the function since the cleanup 4071 * below needs to be able to use the ip_stack_t. 4072 */ 4073 netstack_hold(ipst->ips_netstack); 4074 4075 /* qprocsoff is done via ill_delete_tail */ 4076 ill_delete_tail(ill); 4077 /* 4078 * synchronously wait for arp stream to unbind. After this, we 4079 * cannot get any data packets up from the driver. 4080 */ 4081 arp_unbind_complete(ill); 4082 ASSERT(ill->ill_ipst == NULL); 4083 4084 /* 4085 * Walk through all conns and qenable those that have queued data. 4086 * Close synchronization needs this to 4087 * be done to ensure that all upper layers blocked 4088 * due to flow control to the closing device 4089 * get unblocked. 4090 */ 4091 ip1dbg(("ip_wsrv: walking\n")); 4092 for (i = 0; i < TX_FANOUT_SIZE; i++) { 4093 conn_walk_drain(ipst, &ipst->ips_idl_tx_list[i]); 4094 } 4095 4096 /* 4097 * ai can be null if this is an IPv6 ill, or if the IPv4 4098 * stream is being torn down before ARP was plumbed (e.g., 4099 * /sbin/ifconfig plumbing a stream twice, and encountering 4100 * an error 4101 */ 4102 if (ai != NULL) { 4103 ASSERT(!ill->ill_isv6); 4104 mutex_enter(&ai->ai_lock); 4105 ai->ai_ill = NULL; 4106 if (ai->ai_arl == NULL) { 4107 mutex_destroy(&ai->ai_lock); 4108 kmem_free(ai, sizeof (*ai)); 4109 } else { 4110 cv_signal(&ai->ai_ill_unplumb_done); 4111 mutex_exit(&ai->ai_lock); 4112 } 4113 } 4114 4115 mutex_enter(&ipst->ips_ip_mi_lock); 4116 mi_close_unlink(&ipst->ips_ip_g_head, (IDP)ill); 4117 mutex_exit(&ipst->ips_ip_mi_lock); 4118 4119 /* 4120 * credp could be null if the open didn't succeed and ip_modopen 4121 * itself calls ip_close. 4122 */ 4123 if (ill->ill_credp != NULL) 4124 crfree(ill->ill_credp); 4125 4126 mutex_destroy(&ill->ill_saved_ire_lock); 4127 mutex_destroy(&ill->ill_lock); 4128 rw_destroy(&ill->ill_mcast_lock); 4129 mutex_destroy(&ill->ill_mcast_serializer); 4130 list_destroy(&ill->ill_nce); 4131 4132 /* 4133 * Now we are done with the module close pieces that 4134 * need the netstack_t. 4135 */ 4136 netstack_rele(ipst->ips_netstack); 4137 4138 mi_close_free((IDP)ill); 4139 q->q_ptr = WR(q)->q_ptr = NULL; 4140 4141 ipsq_exit(ipsq); 4142 4143 return (0); 4144 } 4145 4146 /* 4147 * This is called as part of close() for IP, UDP, ICMP, and RTS 4148 * in order to quiesce the conn. 4149 */ 4150 void 4151 ip_quiesce_conn(conn_t *connp) 4152 { 4153 boolean_t drain_cleanup_reqd = B_FALSE; 4154 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 4155 boolean_t ilg_cleanup_reqd = B_FALSE; 4156 ip_stack_t *ipst; 4157 4158 ASSERT(!IPCL_IS_TCP(connp)); 4159 ipst = connp->conn_netstack->netstack_ip; 4160 4161 /* 4162 * Mark the conn as closing, and this conn must not be 4163 * inserted in future into any list. Eg. conn_drain_insert(), 4164 * won't insert this conn into the conn_drain_list. 4165 * 4166 * conn_idl, and conn_ilg cannot get set henceforth. 4167 */ 4168 mutex_enter(&connp->conn_lock); 4169 ASSERT(!(connp->conn_state_flags & CONN_QUIESCED)); 4170 connp->conn_state_flags |= CONN_CLOSING; 4171 if (connp->conn_idl != NULL) 4172 drain_cleanup_reqd = B_TRUE; 4173 if (connp->conn_oper_pending_ill != NULL) 4174 conn_ioctl_cleanup_reqd = B_TRUE; 4175 if (connp->conn_dhcpinit_ill != NULL) { 4176 ASSERT(connp->conn_dhcpinit_ill->ill_dhcpinit != 0); 4177 atomic_dec_32(&connp->conn_dhcpinit_ill->ill_dhcpinit); 4178 ill_set_inputfn(connp->conn_dhcpinit_ill); 4179 connp->conn_dhcpinit_ill = NULL; 4180 } 4181 if (connp->conn_ilg != NULL) 4182 ilg_cleanup_reqd = B_TRUE; 4183 mutex_exit(&connp->conn_lock); 4184 4185 if (conn_ioctl_cleanup_reqd) 4186 conn_ioctl_cleanup(connp); 4187 4188 if (is_system_labeled() && connp->conn_anon_port) { 4189 (void) tsol_mlp_anon(crgetzone(connp->conn_cred), 4190 connp->conn_mlp_type, connp->conn_proto, 4191 ntohs(connp->conn_lport), B_FALSE); 4192 connp->conn_anon_port = 0; 4193 } 4194 connp->conn_mlp_type = mlptSingle; 4195 4196 /* 4197 * Remove this conn from any fanout list it is on. 4198 * and then wait for any threads currently operating 4199 * on this endpoint to finish 4200 */ 4201 ipcl_hash_remove(connp); 4202 4203 /* 4204 * Remove this conn from the drain list, and do any other cleanup that 4205 * may be required. (TCP conns are never flow controlled, and 4206 * conn_idl will be NULL.) 4207 */ 4208 if (drain_cleanup_reqd && connp->conn_idl != NULL) { 4209 idl_t *idl = connp->conn_idl; 4210 4211 mutex_enter(&idl->idl_lock); 4212 conn_drain(connp, B_TRUE); 4213 mutex_exit(&idl->idl_lock); 4214 } 4215 4216 if (connp == ipst->ips_ip_g_mrouter) 4217 (void) ip_mrouter_done(ipst); 4218 4219 if (ilg_cleanup_reqd) 4220 ilg_delete_all(connp); 4221 4222 /* 4223 * Now conn refcnt can increase only thru CONN_INC_REF_LOCKED. 4224 * callers from write side can't be there now because close 4225 * is in progress. The only other caller is ipcl_walk 4226 * which checks for the condemned flag. 4227 */ 4228 mutex_enter(&connp->conn_lock); 4229 connp->conn_state_flags |= CONN_CONDEMNED; 4230 while (connp->conn_ref != 1) 4231 cv_wait(&connp->conn_cv, &connp->conn_lock); 4232 connp->conn_state_flags |= CONN_QUIESCED; 4233 mutex_exit(&connp->conn_lock); 4234 } 4235 4236 /* ARGSUSED */ 4237 int 4238 ip_close(queue_t *q, int flags) 4239 { 4240 conn_t *connp; 4241 4242 /* 4243 * Call the appropriate delete routine depending on whether this is 4244 * a module or device. 4245 */ 4246 if (WR(q)->q_next != NULL) { 4247 /* This is a module close */ 4248 return (ip_modclose((ill_t *)q->q_ptr)); 4249 } 4250 4251 connp = q->q_ptr; 4252 ip_quiesce_conn(connp); 4253 4254 qprocsoff(q); 4255 4256 /* 4257 * Now we are truly single threaded on this stream, and can 4258 * delete the things hanging off the connp, and finally the connp. 4259 * We removed this connp from the fanout list, it cannot be 4260 * accessed thru the fanouts, and we already waited for the 4261 * conn_ref to drop to 0. We are already in close, so 4262 * there cannot be any other thread from the top. qprocsoff 4263 * has completed, and service has completed or won't run in 4264 * future. 4265 */ 4266 ASSERT(connp->conn_ref == 1); 4267 4268 inet_minor_free(connp->conn_minor_arena, connp->conn_dev); 4269 4270 connp->conn_ref--; 4271 ipcl_conn_destroy(connp); 4272 4273 q->q_ptr = WR(q)->q_ptr = NULL; 4274 return (0); 4275 } 4276 4277 /* 4278 * Wapper around putnext() so that ip_rts_request can merely use 4279 * conn_recv. 4280 */ 4281 /*ARGSUSED2*/ 4282 static void 4283 ip_conn_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 4284 { 4285 conn_t *connp = (conn_t *)arg1; 4286 4287 putnext(connp->conn_rq, mp); 4288 } 4289 4290 /* Dummy in case ICMP error delivery is attempted to a /dev/ip instance */ 4291 /* ARGSUSED */ 4292 static void 4293 ip_conn_input_icmp(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 4294 { 4295 freemsg(mp); 4296 } 4297 4298 /* 4299 * Called when the module is about to be unloaded 4300 */ 4301 void 4302 ip_ddi_destroy(void) 4303 { 4304 /* This needs to be called before destroying any transports. */ 4305 mutex_enter(&cpu_lock); 4306 unregister_cpu_setup_func(ip_tp_cpu_update, NULL); 4307 mutex_exit(&cpu_lock); 4308 4309 tnet_fini(); 4310 4311 icmp_ddi_g_destroy(); 4312 rts_ddi_g_destroy(); 4313 udp_ddi_g_destroy(); 4314 sctp_ddi_g_destroy(); 4315 tcp_ddi_g_destroy(); 4316 ilb_ddi_g_destroy(); 4317 dce_g_destroy(); 4318 ipsec_policy_g_destroy(); 4319 ipcl_g_destroy(); 4320 ip_net_g_destroy(); 4321 ip_ire_g_fini(); 4322 inet_minor_destroy(ip_minor_arena_sa); 4323 #if defined(_LP64) 4324 inet_minor_destroy(ip_minor_arena_la); 4325 #endif 4326 4327 #ifdef DEBUG 4328 list_destroy(&ip_thread_list); 4329 rw_destroy(&ip_thread_rwlock); 4330 tsd_destroy(&ip_thread_data); 4331 #endif 4332 4333 netstack_unregister(NS_IP); 4334 } 4335 4336 /* 4337 * First step in cleanup. 4338 */ 4339 /* ARGSUSED */ 4340 static void 4341 ip_stack_shutdown(netstackid_t stackid, void *arg) 4342 { 4343 ip_stack_t *ipst = (ip_stack_t *)arg; 4344 4345 #ifdef NS_DEBUG 4346 printf("ip_stack_shutdown(%p, stack %d)\n", (void *)ipst, stackid); 4347 #endif 4348 4349 /* 4350 * Perform cleanup for special interfaces (loopback and IPMP). 4351 */ 4352 ip_interface_cleanup(ipst); 4353 4354 /* 4355 * The *_hook_shutdown()s start the process of notifying any 4356 * consumers that things are going away.... nothing is destroyed. 4357 */ 4358 ipv4_hook_shutdown(ipst); 4359 ipv6_hook_shutdown(ipst); 4360 arp_hook_shutdown(ipst); 4361 4362 mutex_enter(&ipst->ips_capab_taskq_lock); 4363 ipst->ips_capab_taskq_quit = B_TRUE; 4364 cv_signal(&ipst->ips_capab_taskq_cv); 4365 mutex_exit(&ipst->ips_capab_taskq_lock); 4366 } 4367 4368 /* 4369 * Free the IP stack instance. 4370 */ 4371 static void 4372 ip_stack_fini(netstackid_t stackid, void *arg) 4373 { 4374 ip_stack_t *ipst = (ip_stack_t *)arg; 4375 int ret; 4376 4377 #ifdef NS_DEBUG 4378 printf("ip_stack_fini(%p, stack %d)\n", (void *)ipst, stackid); 4379 #endif 4380 /* 4381 * At this point, all of the notifications that the events and 4382 * protocols are going away have been run, meaning that we can 4383 * now set about starting to clean things up. 4384 */ 4385 ipobs_fini(ipst); 4386 ipv4_hook_destroy(ipst); 4387 ipv6_hook_destroy(ipst); 4388 arp_hook_destroy(ipst); 4389 ip_net_destroy(ipst); 4390 4391 ipmp_destroy(ipst); 4392 4393 ip_kstat_fini(stackid, ipst->ips_ip_mibkp); 4394 ipst->ips_ip_mibkp = NULL; 4395 icmp_kstat_fini(stackid, ipst->ips_icmp_mibkp); 4396 ipst->ips_icmp_mibkp = NULL; 4397 ip_kstat2_fini(stackid, ipst->ips_ip_kstat); 4398 ipst->ips_ip_kstat = NULL; 4399 bzero(&ipst->ips_ip_statistics, sizeof (ipst->ips_ip_statistics)); 4400 ip6_kstat_fini(stackid, ipst->ips_ip6_kstat); 4401 ipst->ips_ip6_kstat = NULL; 4402 bzero(&ipst->ips_ip6_statistics, sizeof (ipst->ips_ip6_statistics)); 4403 4404 kmem_free(ipst->ips_propinfo_tbl, 4405 ip_propinfo_count * sizeof (mod_prop_info_t)); 4406 ipst->ips_propinfo_tbl = NULL; 4407 4408 dce_stack_destroy(ipst); 4409 ip_mrouter_stack_destroy(ipst); 4410 4411 ret = untimeout(ipst->ips_igmp_timeout_id); 4412 if (ret == -1) { 4413 ASSERT(ipst->ips_igmp_timeout_id == 0); 4414 } else { 4415 ASSERT(ipst->ips_igmp_timeout_id != 0); 4416 ipst->ips_igmp_timeout_id = 0; 4417 } 4418 ret = untimeout(ipst->ips_igmp_slowtimeout_id); 4419 if (ret == -1) { 4420 ASSERT(ipst->ips_igmp_slowtimeout_id == 0); 4421 } else { 4422 ASSERT(ipst->ips_igmp_slowtimeout_id != 0); 4423 ipst->ips_igmp_slowtimeout_id = 0; 4424 } 4425 ret = untimeout(ipst->ips_mld_timeout_id); 4426 if (ret == -1) { 4427 ASSERT(ipst->ips_mld_timeout_id == 0); 4428 } else { 4429 ASSERT(ipst->ips_mld_timeout_id != 0); 4430 ipst->ips_mld_timeout_id = 0; 4431 } 4432 ret = untimeout(ipst->ips_mld_slowtimeout_id); 4433 if (ret == -1) { 4434 ASSERT(ipst->ips_mld_slowtimeout_id == 0); 4435 } else { 4436 ASSERT(ipst->ips_mld_slowtimeout_id != 0); 4437 ipst->ips_mld_slowtimeout_id = 0; 4438 } 4439 4440 ip_ire_fini(ipst); 4441 ip6_asp_free(ipst); 4442 conn_drain_fini(ipst); 4443 ipcl_destroy(ipst); 4444 4445 mutex_destroy(&ipst->ips_ndp4->ndp_g_lock); 4446 mutex_destroy(&ipst->ips_ndp6->ndp_g_lock); 4447 kmem_free(ipst->ips_ndp4, sizeof (ndp_g_t)); 4448 ipst->ips_ndp4 = NULL; 4449 kmem_free(ipst->ips_ndp6, sizeof (ndp_g_t)); 4450 ipst->ips_ndp6 = NULL; 4451 4452 if (ipst->ips_loopback_ksp != NULL) { 4453 kstat_delete_netstack(ipst->ips_loopback_ksp, stackid); 4454 ipst->ips_loopback_ksp = NULL; 4455 } 4456 4457 mutex_destroy(&ipst->ips_capab_taskq_lock); 4458 cv_destroy(&ipst->ips_capab_taskq_cv); 4459 4460 rw_destroy(&ipst->ips_srcid_lock); 4461 4462 mutex_destroy(&ipst->ips_ip_mi_lock); 4463 rw_destroy(&ipst->ips_ill_g_usesrc_lock); 4464 4465 mutex_destroy(&ipst->ips_igmp_timer_lock); 4466 mutex_destroy(&ipst->ips_mld_timer_lock); 4467 mutex_destroy(&ipst->ips_igmp_slowtimeout_lock); 4468 mutex_destroy(&ipst->ips_mld_slowtimeout_lock); 4469 mutex_destroy(&ipst->ips_ip_addr_avail_lock); 4470 rw_destroy(&ipst->ips_ill_g_lock); 4471 4472 kmem_free(ipst->ips_phyint_g_list, sizeof (phyint_list_t)); 4473 ipst->ips_phyint_g_list = NULL; 4474 kmem_free(ipst->ips_ill_g_heads, sizeof (ill_g_head_t) * MAX_G_HEADS); 4475 ipst->ips_ill_g_heads = NULL; 4476 4477 ldi_ident_release(ipst->ips_ldi_ident); 4478 kmem_free(ipst, sizeof (*ipst)); 4479 } 4480 4481 /* 4482 * This function is called from the TSD destructor, and is used to debug 4483 * reference count issues in IP. See block comment in <inet/ip_if.h> for 4484 * details. 4485 */ 4486 static void 4487 ip_thread_exit(void *phash) 4488 { 4489 th_hash_t *thh = phash; 4490 4491 rw_enter(&ip_thread_rwlock, RW_WRITER); 4492 list_remove(&ip_thread_list, thh); 4493 rw_exit(&ip_thread_rwlock); 4494 mod_hash_destroy_hash(thh->thh_hash); 4495 kmem_free(thh, sizeof (*thh)); 4496 } 4497 4498 /* 4499 * Called when the IP kernel module is loaded into the kernel 4500 */ 4501 void 4502 ip_ddi_init(void) 4503 { 4504 ip_squeue_flag = ip_squeue_switch(ip_squeue_enter); 4505 4506 /* 4507 * For IP and TCP the minor numbers should start from 2 since we have 4 4508 * initial devices: ip, ip6, tcp, tcp6. 4509 */ 4510 /* 4511 * If this is a 64-bit kernel, then create two separate arenas - 4512 * one for TLIs in the range of INET_MIN_DEV+2 through 2^^18-1, and the 4513 * other for socket apps in the range 2^^18 through 2^^32-1. 4514 */ 4515 ip_minor_arena_la = NULL; 4516 ip_minor_arena_sa = NULL; 4517 #if defined(_LP64) 4518 if ((ip_minor_arena_sa = inet_minor_create("ip_minor_arena_sa", 4519 INET_MIN_DEV + 2, MAXMIN32, KM_SLEEP)) == NULL) { 4520 cmn_err(CE_PANIC, 4521 "ip_ddi_init: ip_minor_arena_sa creation failed\n"); 4522 } 4523 if ((ip_minor_arena_la = inet_minor_create("ip_minor_arena_la", 4524 MAXMIN32 + 1, MAXMIN64, KM_SLEEP)) == NULL) { 4525 cmn_err(CE_PANIC, 4526 "ip_ddi_init: ip_minor_arena_la creation failed\n"); 4527 } 4528 #else 4529 if ((ip_minor_arena_sa = inet_minor_create("ip_minor_arena_sa", 4530 INET_MIN_DEV + 2, MAXMIN, KM_SLEEP)) == NULL) { 4531 cmn_err(CE_PANIC, 4532 "ip_ddi_init: ip_minor_arena_sa creation failed\n"); 4533 } 4534 #endif 4535 ip_poll_normal_ticks = MSEC_TO_TICK_ROUNDUP(ip_poll_normal_ms); 4536 4537 ipcl_g_init(); 4538 ip_ire_g_init(); 4539 ip_net_g_init(); 4540 4541 #ifdef DEBUG 4542 tsd_create(&ip_thread_data, ip_thread_exit); 4543 rw_init(&ip_thread_rwlock, NULL, RW_DEFAULT, NULL); 4544 list_create(&ip_thread_list, sizeof (th_hash_t), 4545 offsetof(th_hash_t, thh_link)); 4546 #endif 4547 ipsec_policy_g_init(); 4548 tcp_ddi_g_init(); 4549 sctp_ddi_g_init(); 4550 dce_g_init(); 4551 4552 /* 4553 * We want to be informed each time a stack is created or 4554 * destroyed in the kernel, so we can maintain the 4555 * set of udp_stack_t's. 4556 */ 4557 netstack_register(NS_IP, ip_stack_init, ip_stack_shutdown, 4558 ip_stack_fini); 4559 4560 tnet_init(); 4561 4562 udp_ddi_g_init(); 4563 rts_ddi_g_init(); 4564 icmp_ddi_g_init(); 4565 ilb_ddi_g_init(); 4566 4567 /* This needs to be called after all transports are initialized. */ 4568 mutex_enter(&cpu_lock); 4569 register_cpu_setup_func(ip_tp_cpu_update, NULL); 4570 mutex_exit(&cpu_lock); 4571 } 4572 4573 /* 4574 * Initialize the IP stack instance. 4575 */ 4576 static void * 4577 ip_stack_init(netstackid_t stackid, netstack_t *ns) 4578 { 4579 ip_stack_t *ipst; 4580 size_t arrsz; 4581 major_t major; 4582 4583 #ifdef NS_DEBUG 4584 printf("ip_stack_init(stack %d)\n", stackid); 4585 #endif 4586 4587 ipst = (ip_stack_t *)kmem_zalloc(sizeof (*ipst), KM_SLEEP); 4588 ipst->ips_netstack = ns; 4589 4590 ipst->ips_ill_g_heads = kmem_zalloc(sizeof (ill_g_head_t) * MAX_G_HEADS, 4591 KM_SLEEP); 4592 ipst->ips_phyint_g_list = kmem_zalloc(sizeof (phyint_list_t), 4593 KM_SLEEP); 4594 ipst->ips_ndp4 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP); 4595 ipst->ips_ndp6 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP); 4596 mutex_init(&ipst->ips_ndp4->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL); 4597 mutex_init(&ipst->ips_ndp6->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL); 4598 4599 mutex_init(&ipst->ips_igmp_timer_lock, NULL, MUTEX_DEFAULT, NULL); 4600 ipst->ips_igmp_deferred_next = INFINITY; 4601 mutex_init(&ipst->ips_mld_timer_lock, NULL, MUTEX_DEFAULT, NULL); 4602 ipst->ips_mld_deferred_next = INFINITY; 4603 mutex_init(&ipst->ips_igmp_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL); 4604 mutex_init(&ipst->ips_mld_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL); 4605 mutex_init(&ipst->ips_ip_mi_lock, NULL, MUTEX_DEFAULT, NULL); 4606 mutex_init(&ipst->ips_ip_addr_avail_lock, NULL, MUTEX_DEFAULT, NULL); 4607 rw_init(&ipst->ips_ill_g_lock, NULL, RW_DEFAULT, NULL); 4608 rw_init(&ipst->ips_ill_g_usesrc_lock, NULL, RW_DEFAULT, NULL); 4609 4610 ipcl_init(ipst); 4611 ip_ire_init(ipst); 4612 ip6_asp_init(ipst); 4613 ipif_init(ipst); 4614 conn_drain_init(ipst); 4615 ip_mrouter_stack_init(ipst); 4616 dce_stack_init(ipst); 4617 4618 ipst->ips_ip_multirt_log_interval = 1000; 4619 4620 ipst->ips_ill_index = 1; 4621 4622 ipst->ips_saved_ip_forwarding = -1; 4623 ipst->ips_reg_vif_num = ALL_VIFS; /* Index to Register vif */ 4624 4625 arrsz = ip_propinfo_count * sizeof (mod_prop_info_t); 4626 ipst->ips_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP); 4627 bcopy(ip_propinfo_tbl, ipst->ips_propinfo_tbl, arrsz); 4628 4629 ipst->ips_ip_mibkp = ip_kstat_init(stackid, ipst); 4630 ipst->ips_icmp_mibkp = icmp_kstat_init(stackid); 4631 ipst->ips_ip_kstat = ip_kstat2_init(stackid, &ipst->ips_ip_statistics); 4632 ipst->ips_ip6_kstat = 4633 ip6_kstat_init(stackid, &ipst->ips_ip6_statistics); 4634 4635 ipst->ips_ip_src_id = 1; 4636 rw_init(&ipst->ips_srcid_lock, NULL, RW_DEFAULT, NULL); 4637 4638 ipst->ips_src_generation = SRC_GENERATION_INITIAL; 4639 4640 ip_net_init(ipst, ns); 4641 ipv4_hook_init(ipst); 4642 ipv6_hook_init(ipst); 4643 arp_hook_init(ipst); 4644 ipmp_init(ipst); 4645 ipobs_init(ipst); 4646 4647 /* 4648 * Create the taskq dispatcher thread and initialize related stuff. 4649 */ 4650 mutex_init(&ipst->ips_capab_taskq_lock, NULL, MUTEX_DEFAULT, NULL); 4651 cv_init(&ipst->ips_capab_taskq_cv, NULL, CV_DEFAULT, NULL); 4652 ipst->ips_capab_taskq_thread = thread_create(NULL, 0, 4653 ill_taskq_dispatch, ipst, 0, &p0, TS_RUN, minclsyspri); 4654 4655 major = mod_name_to_major(INET_NAME); 4656 (void) ldi_ident_from_major(major, &ipst->ips_ldi_ident); 4657 return (ipst); 4658 } 4659 4660 /* 4661 * Allocate and initialize a DLPI template of the specified length. (May be 4662 * called as writer.) 4663 */ 4664 mblk_t * 4665 ip_dlpi_alloc(size_t len, t_uscalar_t prim) 4666 { 4667 mblk_t *mp; 4668 4669 mp = allocb(len, BPRI_MED); 4670 if (!mp) 4671 return (NULL); 4672 4673 /* 4674 * DLPIv2 says that DL_INFO_REQ and DL_TOKEN_REQ (the latter 4675 * of which we don't seem to use) are sent with M_PCPROTO, and 4676 * that other DLPI are M_PROTO. 4677 */ 4678 if (prim == DL_INFO_REQ) { 4679 mp->b_datap->db_type = M_PCPROTO; 4680 } else { 4681 mp->b_datap->db_type = M_PROTO; 4682 } 4683 4684 mp->b_wptr = mp->b_rptr + len; 4685 bzero(mp->b_rptr, len); 4686 ((dl_unitdata_req_t *)mp->b_rptr)->dl_primitive = prim; 4687 return (mp); 4688 } 4689 4690 /* 4691 * Allocate and initialize a DLPI notification. (May be called as writer.) 4692 */ 4693 mblk_t * 4694 ip_dlnotify_alloc(uint_t notification, uint_t data) 4695 { 4696 dl_notify_ind_t *notifyp; 4697 mblk_t *mp; 4698 4699 if ((mp = ip_dlpi_alloc(DL_NOTIFY_IND_SIZE, DL_NOTIFY_IND)) == NULL) 4700 return (NULL); 4701 4702 notifyp = (dl_notify_ind_t *)mp->b_rptr; 4703 notifyp->dl_notification = notification; 4704 notifyp->dl_data = data; 4705 return (mp); 4706 } 4707 4708 mblk_t * 4709 ip_dlnotify_alloc2(uint_t notification, uint_t data1, uint_t data2) 4710 { 4711 dl_notify_ind_t *notifyp; 4712 mblk_t *mp; 4713 4714 if ((mp = ip_dlpi_alloc(DL_NOTIFY_IND_SIZE, DL_NOTIFY_IND)) == NULL) 4715 return (NULL); 4716 4717 notifyp = (dl_notify_ind_t *)mp->b_rptr; 4718 notifyp->dl_notification = notification; 4719 notifyp->dl_data1 = data1; 4720 notifyp->dl_data2 = data2; 4721 return (mp); 4722 } 4723 4724 /* 4725 * Debug formatting routine. Returns a character string representation of the 4726 * addr in buf, of the form xxx.xxx.xxx.xxx. This routine takes the address 4727 * in the form of a ipaddr_t and calls ip_dot_saddr with a pointer. 4728 * 4729 * Once the ndd table-printing interfaces are removed, this can be changed to 4730 * standard dotted-decimal form. 4731 */ 4732 char * 4733 ip_dot_addr(ipaddr_t addr, char *buf) 4734 { 4735 uint8_t *ap = (uint8_t *)&addr; 4736 4737 (void) mi_sprintf(buf, "%03d.%03d.%03d.%03d", 4738 ap[0] & 0xFF, ap[1] & 0xFF, ap[2] & 0xFF, ap[3] & 0xFF); 4739 return (buf); 4740 } 4741 4742 /* 4743 * Write the given MAC address as a printable string in the usual colon- 4744 * separated format. 4745 */ 4746 const char * 4747 mac_colon_addr(const uint8_t *addr, size_t alen, char *buf, size_t buflen) 4748 { 4749 char *bp; 4750 4751 if (alen == 0 || buflen < 4) 4752 return ("?"); 4753 bp = buf; 4754 for (;;) { 4755 /* 4756 * If there are more MAC address bytes available, but we won't 4757 * have any room to print them, then add "..." to the string 4758 * instead. See below for the 'magic number' explanation. 4759 */ 4760 if ((alen == 2 && buflen < 6) || (alen > 2 && buflen < 7)) { 4761 (void) strcpy(bp, "..."); 4762 break; 4763 } 4764 (void) sprintf(bp, "%02x", *addr++); 4765 bp += 2; 4766 if (--alen == 0) 4767 break; 4768 *bp++ = ':'; 4769 buflen -= 3; 4770 /* 4771 * At this point, based on the first 'if' statement above, 4772 * either alen == 1 and buflen >= 3, or alen > 1 and 4773 * buflen >= 4. The first case leaves room for the final "xx" 4774 * number and trailing NUL byte. The second leaves room for at 4775 * least "...". Thus the apparently 'magic' numbers chosen for 4776 * that statement. 4777 */ 4778 } 4779 return (buf); 4780 } 4781 4782 /* 4783 * Called when it is conceptually a ULP that would sent the packet 4784 * e.g., port unreachable and protocol unreachable. Check that the packet 4785 * would have passed the IPsec global policy before sending the error. 4786 * 4787 * Send an ICMP error after patching up the packet appropriately. 4788 * Uses ip_drop_input and bumps the appropriate MIB. 4789 */ 4790 void 4791 ip_fanout_send_icmp_v4(mblk_t *mp, uint_t icmp_type, uint_t icmp_code, 4792 ip_recv_attr_t *ira) 4793 { 4794 ipha_t *ipha; 4795 boolean_t secure; 4796 ill_t *ill = ira->ira_ill; 4797 ip_stack_t *ipst = ill->ill_ipst; 4798 netstack_t *ns = ipst->ips_netstack; 4799 ipsec_stack_t *ipss = ns->netstack_ipsec; 4800 4801 secure = ira->ira_flags & IRAF_IPSEC_SECURE; 4802 4803 /* 4804 * We are generating an icmp error for some inbound packet. 4805 * Called from all ip_fanout_(udp, tcp, proto) functions. 4806 * Before we generate an error, check with global policy 4807 * to see whether this is allowed to enter the system. As 4808 * there is no "conn", we are checking with global policy. 4809 */ 4810 ipha = (ipha_t *)mp->b_rptr; 4811 if (secure || ipss->ipsec_inbound_v4_policy_present) { 4812 mp = ipsec_check_global_policy(mp, NULL, ipha, NULL, ira, ns); 4813 if (mp == NULL) 4814 return; 4815 } 4816 4817 /* We never send errors for protocols that we do implement */ 4818 if (ira->ira_protocol == IPPROTO_ICMP || 4819 ira->ira_protocol == IPPROTO_IGMP) { 4820 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 4821 ip_drop_input("ip_fanout_send_icmp_v4", mp, ill); 4822 freemsg(mp); 4823 return; 4824 } 4825 /* 4826 * Have to correct checksum since 4827 * the packet might have been 4828 * fragmented and the reassembly code in ip_rput 4829 * does not restore the IP checksum. 4830 */ 4831 ipha->ipha_hdr_checksum = 0; 4832 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 4833 4834 switch (icmp_type) { 4835 case ICMP_DEST_UNREACHABLE: 4836 switch (icmp_code) { 4837 case ICMP_PROTOCOL_UNREACHABLE: 4838 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInUnknownProtos); 4839 ip_drop_input("ipIfStatsInUnknownProtos", mp, ill); 4840 break; 4841 case ICMP_PORT_UNREACHABLE: 4842 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts); 4843 ip_drop_input("ipIfStatsNoPorts", mp, ill); 4844 break; 4845 } 4846 4847 icmp_unreachable(mp, icmp_code, ira); 4848 break; 4849 default: 4850 #ifdef DEBUG 4851 panic("ip_fanout_send_icmp_v4: wrong type"); 4852 /*NOTREACHED*/ 4853 #else 4854 freemsg(mp); 4855 break; 4856 #endif 4857 } 4858 } 4859 4860 /* 4861 * Used to send an ICMP error message when a packet is received for 4862 * a protocol that is not supported. The mblk passed as argument 4863 * is consumed by this function. 4864 */ 4865 void 4866 ip_proto_not_sup(mblk_t *mp, ip_recv_attr_t *ira) 4867 { 4868 ipha_t *ipha; 4869 4870 ipha = (ipha_t *)mp->b_rptr; 4871 if (ira->ira_flags & IRAF_IS_IPV4) { 4872 ASSERT(IPH_HDR_VERSION(ipha) == IP_VERSION); 4873 ip_fanout_send_icmp_v4(mp, ICMP_DEST_UNREACHABLE, 4874 ICMP_PROTOCOL_UNREACHABLE, ira); 4875 } else { 4876 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 4877 ip_fanout_send_icmp_v6(mp, ICMP6_PARAM_PROB, 4878 ICMP6_PARAMPROB_NEXTHEADER, ira); 4879 } 4880 } 4881 4882 /* 4883 * Deliver a rawip packet to the given conn, possibly applying ipsec policy. 4884 * Handles IPv4 and IPv6. 4885 * We are responsible for disposing of mp, such as by freemsg() or putnext() 4886 * Caller is responsible for dropping references to the conn. 4887 */ 4888 void 4889 ip_fanout_proto_conn(conn_t *connp, mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, 4890 ip_recv_attr_t *ira) 4891 { 4892 ill_t *ill = ira->ira_ill; 4893 ip_stack_t *ipst = ill->ill_ipst; 4894 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 4895 boolean_t secure; 4896 uint_t protocol = ira->ira_protocol; 4897 iaflags_t iraflags = ira->ira_flags; 4898 queue_t *rq; 4899 4900 secure = iraflags & IRAF_IPSEC_SECURE; 4901 4902 rq = connp->conn_rq; 4903 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : !canputnext(rq)) { 4904 switch (protocol) { 4905 case IPPROTO_ICMPV6: 4906 BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInOverflows); 4907 break; 4908 case IPPROTO_ICMP: 4909 BUMP_MIB(&ipst->ips_icmp_mib, icmpInOverflows); 4910 break; 4911 default: 4912 BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows); 4913 break; 4914 } 4915 freemsg(mp); 4916 return; 4917 } 4918 4919 ASSERT(!(IPCL_IS_IPTUN(connp))); 4920 4921 if (((iraflags & IRAF_IS_IPV4) ? 4922 CONN_INBOUND_POLICY_PRESENT(connp, ipss) : 4923 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) || 4924 secure) { 4925 mp = ipsec_check_inbound_policy(mp, connp, ipha, 4926 ip6h, ira); 4927 if (mp == NULL) { 4928 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 4929 /* Note that mp is NULL */ 4930 ip_drop_input("ipIfStatsInDiscards", mp, ill); 4931 return; 4932 } 4933 } 4934 4935 if (iraflags & IRAF_ICMP_ERROR) { 4936 (connp->conn_recvicmp)(connp, mp, NULL, ira); 4937 } else { 4938 ill_t *rill = ira->ira_rill; 4939 4940 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 4941 ira->ira_ill = ira->ira_rill = NULL; 4942 /* Send it upstream */ 4943 (connp->conn_recv)(connp, mp, NULL, ira); 4944 ira->ira_ill = ill; 4945 ira->ira_rill = rill; 4946 } 4947 } 4948 4949 /* 4950 * Handle protocols with which IP is less intimate. There 4951 * can be more than one stream bound to a particular 4952 * protocol. When this is the case, normally each one gets a copy 4953 * of any incoming packets. 4954 * 4955 * IPsec NOTE : 4956 * 4957 * Don't allow a secure packet going up a non-secure connection. 4958 * We don't allow this because 4959 * 4960 * 1) Reply might go out in clear which will be dropped at 4961 * the sending side. 4962 * 2) If the reply goes out in clear it will give the 4963 * adversary enough information for getting the key in 4964 * most of the cases. 4965 * 4966 * Moreover getting a secure packet when we expect clear 4967 * implies that SA's were added without checking for 4968 * policy on both ends. This should not happen once ISAKMP 4969 * is used to negotiate SAs as SAs will be added only after 4970 * verifying the policy. 4971 * 4972 * Zones notes: 4973 * Earlier in ip_input on a system with multiple shared-IP zones we 4974 * duplicate the multicast and broadcast packets and send them up 4975 * with each explicit zoneid that exists on that ill. 4976 * This means that here we can match the zoneid with SO_ALLZONES being special. 4977 */ 4978 void 4979 ip_fanout_proto_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira) 4980 { 4981 mblk_t *mp1; 4982 ipaddr_t laddr; 4983 conn_t *connp, *first_connp, *next_connp; 4984 connf_t *connfp; 4985 ill_t *ill = ira->ira_ill; 4986 ip_stack_t *ipst = ill->ill_ipst; 4987 4988 laddr = ipha->ipha_dst; 4989 4990 connfp = &ipst->ips_ipcl_proto_fanout_v4[ira->ira_protocol]; 4991 mutex_enter(&connfp->connf_lock); 4992 connp = connfp->connf_head; 4993 for (connp = connfp->connf_head; connp != NULL; 4994 connp = connp->conn_next) { 4995 /* Note: IPCL_PROTO_MATCH includes conn_wantpacket */ 4996 if (IPCL_PROTO_MATCH(connp, ira, ipha) && 4997 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) || 4998 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp))) { 4999 break; 5000 } 5001 } 5002 5003 if (connp == NULL) { 5004 /* 5005 * No one bound to these addresses. Is 5006 * there a client that wants all 5007 * unclaimed datagrams? 5008 */ 5009 mutex_exit(&connfp->connf_lock); 5010 ip_fanout_send_icmp_v4(mp, ICMP_DEST_UNREACHABLE, 5011 ICMP_PROTOCOL_UNREACHABLE, ira); 5012 return; 5013 } 5014 5015 ASSERT(IPCL_IS_NONSTR(connp) || connp->conn_rq != NULL); 5016 5017 CONN_INC_REF(connp); 5018 first_connp = connp; 5019 connp = connp->conn_next; 5020 5021 for (;;) { 5022 while (connp != NULL) { 5023 /* Note: IPCL_PROTO_MATCH includes conn_wantpacket */ 5024 if (IPCL_PROTO_MATCH(connp, ira, ipha) && 5025 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) || 5026 tsol_receive_local(mp, &laddr, IPV4_VERSION, 5027 ira, connp))) 5028 break; 5029 connp = connp->conn_next; 5030 } 5031 5032 if (connp == NULL) { 5033 /* No more interested clients */ 5034 connp = first_connp; 5035 break; 5036 } 5037 if (((mp1 = dupmsg(mp)) == NULL) && 5038 ((mp1 = copymsg(mp)) == NULL)) { 5039 /* Memory allocation failed */ 5040 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 5041 ip_drop_input("ipIfStatsInDiscards", mp, ill); 5042 connp = first_connp; 5043 break; 5044 } 5045 5046 CONN_INC_REF(connp); 5047 mutex_exit(&connfp->connf_lock); 5048 5049 ip_fanout_proto_conn(connp, mp1, (ipha_t *)mp1->b_rptr, NULL, 5050 ira); 5051 5052 mutex_enter(&connfp->connf_lock); 5053 /* Follow the next pointer before releasing the conn. */ 5054 next_connp = connp->conn_next; 5055 CONN_DEC_REF(connp); 5056 connp = next_connp; 5057 } 5058 5059 /* Last one. Send it upstream. */ 5060 mutex_exit(&connfp->connf_lock); 5061 5062 ip_fanout_proto_conn(connp, mp, ipha, NULL, ira); 5063 5064 CONN_DEC_REF(connp); 5065 } 5066 5067 /* 5068 * If we have a IPsec NAT-Traversal packet, strip the zero-SPI or 5069 * pass it along to ESP if the SPI is non-zero. Returns the mblk if the mblk 5070 * is not consumed. 5071 * 5072 * One of three things can happen, all of which affect the passed-in mblk: 5073 * 5074 * 1.) The packet is stock UDP and gets its zero-SPI stripped. Return mblk.. 5075 * 5076 * 2.) The packet is ESP-in-UDP, gets transformed into an equivalent 5077 * ESP packet, and is passed along to ESP for consumption. Return NULL. 5078 * 5079 * 3.) The packet is an ESP-in-UDP Keepalive. Drop it and return NULL. 5080 */ 5081 mblk_t * 5082 zero_spi_check(mblk_t *mp, ip_recv_attr_t *ira) 5083 { 5084 int shift, plen, iph_len; 5085 ipha_t *ipha; 5086 udpha_t *udpha; 5087 uint32_t *spi; 5088 uint32_t esp_ports; 5089 uint8_t *orptr; 5090 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 5091 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 5092 5093 ipha = (ipha_t *)mp->b_rptr; 5094 iph_len = ira->ira_ip_hdr_length; 5095 plen = ira->ira_pktlen; 5096 5097 if (plen - iph_len - sizeof (udpha_t) < sizeof (uint32_t)) { 5098 /* 5099 * Most likely a keepalive for the benefit of an intervening 5100 * NAT. These aren't for us, per se, so drop it. 5101 * 5102 * RFC 3947/8 doesn't say for sure what to do for 2-3 5103 * byte packets (keepalives are 1-byte), but we'll drop them 5104 * also. 5105 */ 5106 ip_drop_packet(mp, B_TRUE, ira->ira_ill, 5107 DROPPER(ipss, ipds_esp_nat_t_ka), &ipss->ipsec_dropper); 5108 return (NULL); 5109 } 5110 5111 if (MBLKL(mp) < iph_len + sizeof (udpha_t) + sizeof (*spi)) { 5112 /* might as well pull it all up - it might be ESP. */ 5113 if (!pullupmsg(mp, -1)) { 5114 ip_drop_packet(mp, B_TRUE, ira->ira_ill, 5115 DROPPER(ipss, ipds_esp_nomem), 5116 &ipss->ipsec_dropper); 5117 return (NULL); 5118 } 5119 5120 ipha = (ipha_t *)mp->b_rptr; 5121 } 5122 spi = (uint32_t *)(mp->b_rptr + iph_len + sizeof (udpha_t)); 5123 if (*spi == 0) { 5124 /* UDP packet - remove 0-spi. */ 5125 shift = sizeof (uint32_t); 5126 } else { 5127 /* ESP-in-UDP packet - reduce to ESP. */ 5128 ipha->ipha_protocol = IPPROTO_ESP; 5129 shift = sizeof (udpha_t); 5130 } 5131 5132 /* Fix IP header */ 5133 ira->ira_pktlen = (plen - shift); 5134 ipha->ipha_length = htons(ira->ira_pktlen); 5135 ipha->ipha_hdr_checksum = 0; 5136 5137 orptr = mp->b_rptr; 5138 mp->b_rptr += shift; 5139 5140 udpha = (udpha_t *)(orptr + iph_len); 5141 if (*spi == 0) { 5142 ASSERT((uint8_t *)ipha == orptr); 5143 udpha->uha_length = htons(plen - shift - iph_len); 5144 iph_len += sizeof (udpha_t); /* For the call to ovbcopy(). */ 5145 esp_ports = 0; 5146 } else { 5147 esp_ports = *((uint32_t *)udpha); 5148 ASSERT(esp_ports != 0); 5149 } 5150 ovbcopy(orptr, orptr + shift, iph_len); 5151 if (esp_ports != 0) /* Punt up for ESP processing. */ { 5152 ipha = (ipha_t *)(orptr + shift); 5153 5154 ira->ira_flags |= IRAF_ESP_UDP_PORTS; 5155 ira->ira_esp_udp_ports = esp_ports; 5156 ip_fanout_v4(mp, ipha, ira); 5157 return (NULL); 5158 } 5159 return (mp); 5160 } 5161 5162 /* 5163 * Deliver a udp packet to the given conn, possibly applying ipsec policy. 5164 * Handles IPv4 and IPv6. 5165 * We are responsible for disposing of mp, such as by freemsg() or putnext() 5166 * Caller is responsible for dropping references to the conn. 5167 */ 5168 void 5169 ip_fanout_udp_conn(conn_t *connp, mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, 5170 ip_recv_attr_t *ira) 5171 { 5172 ill_t *ill = ira->ira_ill; 5173 ip_stack_t *ipst = ill->ill_ipst; 5174 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 5175 boolean_t secure; 5176 iaflags_t iraflags = ira->ira_flags; 5177 5178 secure = iraflags & IRAF_IPSEC_SECURE; 5179 5180 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : 5181 !canputnext(connp->conn_rq)) { 5182 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows); 5183 freemsg(mp); 5184 return; 5185 } 5186 5187 if (((iraflags & IRAF_IS_IPV4) ? 5188 CONN_INBOUND_POLICY_PRESENT(connp, ipss) : 5189 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) || 5190 secure) { 5191 mp = ipsec_check_inbound_policy(mp, connp, ipha, 5192 ip6h, ira); 5193 if (mp == NULL) { 5194 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 5195 /* Note that mp is NULL */ 5196 ip_drop_input("ipIfStatsInDiscards", mp, ill); 5197 return; 5198 } 5199 } 5200 5201 /* 5202 * Since this code is not used for UDP unicast we don't need a NAT_T 5203 * check. Only ip_fanout_v4 has that check. 5204 */ 5205 if (ira->ira_flags & IRAF_ICMP_ERROR) { 5206 (connp->conn_recvicmp)(connp, mp, NULL, ira); 5207 } else { 5208 ill_t *rill = ira->ira_rill; 5209 5210 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 5211 ira->ira_ill = ira->ira_rill = NULL; 5212 /* Send it upstream */ 5213 (connp->conn_recv)(connp, mp, NULL, ira); 5214 ira->ira_ill = ill; 5215 ira->ira_rill = rill; 5216 } 5217 } 5218 5219 /* 5220 * Fanout for UDP packets that are multicast or broadcast, and ICMP errors. 5221 * (Unicast fanout is handled in ip_input_v4.) 5222 * 5223 * If SO_REUSEADDR is set all multicast and broadcast packets 5224 * will be delivered to all conns bound to the same port. 5225 * 5226 * If there is at least one matching AF_INET receiver, then we will 5227 * ignore any AF_INET6 receivers. 5228 * In the special case where an AF_INET socket binds to 0.0.0.0/<port> and an 5229 * AF_INET6 socket binds to ::/<port>, only the AF_INET socket receives the IPv4 5230 * packets. 5231 * 5232 * Zones notes: 5233 * Earlier in ip_input on a system with multiple shared-IP zones we 5234 * duplicate the multicast and broadcast packets and send them up 5235 * with each explicit zoneid that exists on that ill. 5236 * This means that here we can match the zoneid with SO_ALLZONES being special. 5237 */ 5238 void 5239 ip_fanout_udp_multi_v4(mblk_t *mp, ipha_t *ipha, uint16_t lport, uint16_t fport, 5240 ip_recv_attr_t *ira) 5241 { 5242 ipaddr_t laddr; 5243 in6_addr_t v6faddr; 5244 conn_t *connp; 5245 connf_t *connfp; 5246 ipaddr_t faddr; 5247 ill_t *ill = ira->ira_ill; 5248 ip_stack_t *ipst = ill->ill_ipst; 5249 5250 ASSERT(ira->ira_flags & (IRAF_MULTIBROADCAST|IRAF_ICMP_ERROR)); 5251 5252 laddr = ipha->ipha_dst; 5253 faddr = ipha->ipha_src; 5254 5255 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)]; 5256 mutex_enter(&connfp->connf_lock); 5257 connp = connfp->connf_head; 5258 5259 /* 5260 * If SO_REUSEADDR has been set on the first we send the 5261 * packet to all clients that have joined the group and 5262 * match the port. 5263 */ 5264 while (connp != NULL) { 5265 if ((IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)) && 5266 conn_wantpacket(connp, ira, ipha) && 5267 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) || 5268 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp))) 5269 break; 5270 connp = connp->conn_next; 5271 } 5272 5273 if (connp == NULL) 5274 goto notfound; 5275 5276 CONN_INC_REF(connp); 5277 5278 if (connp->conn_reuseaddr) { 5279 conn_t *first_connp = connp; 5280 conn_t *next_connp; 5281 mblk_t *mp1; 5282 5283 connp = connp->conn_next; 5284 for (;;) { 5285 while (connp != NULL) { 5286 if (IPCL_UDP_MATCH(connp, lport, laddr, 5287 fport, faddr) && 5288 conn_wantpacket(connp, ira, ipha) && 5289 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) || 5290 tsol_receive_local(mp, &laddr, IPV4_VERSION, 5291 ira, connp))) 5292 break; 5293 connp = connp->conn_next; 5294 } 5295 if (connp == NULL) { 5296 /* No more interested clients */ 5297 connp = first_connp; 5298 break; 5299 } 5300 if (((mp1 = dupmsg(mp)) == NULL) && 5301 ((mp1 = copymsg(mp)) == NULL)) { 5302 /* Memory allocation failed */ 5303 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 5304 ip_drop_input("ipIfStatsInDiscards", mp, ill); 5305 connp = first_connp; 5306 break; 5307 } 5308 CONN_INC_REF(connp); 5309 mutex_exit(&connfp->connf_lock); 5310 5311 IP_STAT(ipst, ip_udp_fanmb); 5312 ip_fanout_udp_conn(connp, mp1, (ipha_t *)mp1->b_rptr, 5313 NULL, ira); 5314 mutex_enter(&connfp->connf_lock); 5315 /* Follow the next pointer before releasing the conn */ 5316 next_connp = connp->conn_next; 5317 CONN_DEC_REF(connp); 5318 connp = next_connp; 5319 } 5320 } 5321 5322 /* Last one. Send it upstream. */ 5323 mutex_exit(&connfp->connf_lock); 5324 IP_STAT(ipst, ip_udp_fanmb); 5325 ip_fanout_udp_conn(connp, mp, ipha, NULL, ira); 5326 CONN_DEC_REF(connp); 5327 return; 5328 5329 notfound: 5330 mutex_exit(&connfp->connf_lock); 5331 /* 5332 * IPv6 endpoints bound to multicast IPv4-mapped addresses 5333 * have already been matched above, since they live in the IPv4 5334 * fanout tables. This implies we only need to 5335 * check for IPv6 in6addr_any endpoints here. 5336 * Thus we compare using ipv6_all_zeros instead of the destination 5337 * address, except for the multicast group membership lookup which 5338 * uses the IPv4 destination. 5339 */ 5340 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6faddr); 5341 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)]; 5342 mutex_enter(&connfp->connf_lock); 5343 connp = connfp->connf_head; 5344 /* 5345 * IPv4 multicast packet being delivered to an AF_INET6 5346 * in6addr_any endpoint. 5347 * Need to check conn_wantpacket(). Note that we use conn_wantpacket() 5348 * and not conn_wantpacket_v6() since any multicast membership is 5349 * for an IPv4-mapped multicast address. 5350 */ 5351 while (connp != NULL) { 5352 if (IPCL_UDP_MATCH_V6(connp, lport, ipv6_all_zeros, 5353 fport, v6faddr) && 5354 conn_wantpacket(connp, ira, ipha) && 5355 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) || 5356 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp))) 5357 break; 5358 connp = connp->conn_next; 5359 } 5360 5361 if (connp == NULL) { 5362 /* 5363 * No one bound to this port. Is 5364 * there a client that wants all 5365 * unclaimed datagrams? 5366 */ 5367 mutex_exit(&connfp->connf_lock); 5368 5369 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].connf_head != 5370 NULL) { 5371 ASSERT(ira->ira_protocol == IPPROTO_UDP); 5372 ip_fanout_proto_v4(mp, ipha, ira); 5373 } else { 5374 /* 5375 * We used to attempt to send an icmp error here, but 5376 * since this is known to be a multicast packet 5377 * and we don't send icmp errors in response to 5378 * multicast, just drop the packet and give up sooner. 5379 */ 5380 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts); 5381 freemsg(mp); 5382 } 5383 return; 5384 } 5385 ASSERT(IPCL_IS_NONSTR(connp) || connp->conn_rq != NULL); 5386 5387 /* 5388 * If SO_REUSEADDR has been set on the first we send the 5389 * packet to all clients that have joined the group and 5390 * match the port. 5391 */ 5392 if (connp->conn_reuseaddr) { 5393 conn_t *first_connp = connp; 5394 conn_t *next_connp; 5395 mblk_t *mp1; 5396 5397 CONN_INC_REF(connp); 5398 connp = connp->conn_next; 5399 for (;;) { 5400 while (connp != NULL) { 5401 if (IPCL_UDP_MATCH_V6(connp, lport, 5402 ipv6_all_zeros, fport, v6faddr) && 5403 conn_wantpacket(connp, ira, ipha) && 5404 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) || 5405 tsol_receive_local(mp, &laddr, IPV4_VERSION, 5406 ira, connp))) 5407 break; 5408 connp = connp->conn_next; 5409 } 5410 if (connp == NULL) { 5411 /* No more interested clients */ 5412 connp = first_connp; 5413 break; 5414 } 5415 if (((mp1 = dupmsg(mp)) == NULL) && 5416 ((mp1 = copymsg(mp)) == NULL)) { 5417 /* Memory allocation failed */ 5418 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 5419 ip_drop_input("ipIfStatsInDiscards", mp, ill); 5420 connp = first_connp; 5421 break; 5422 } 5423 CONN_INC_REF(connp); 5424 mutex_exit(&connfp->connf_lock); 5425 5426 IP_STAT(ipst, ip_udp_fanmb); 5427 ip_fanout_udp_conn(connp, mp1, (ipha_t *)mp1->b_rptr, 5428 NULL, ira); 5429 mutex_enter(&connfp->connf_lock); 5430 /* Follow the next pointer before releasing the conn */ 5431 next_connp = connp->conn_next; 5432 CONN_DEC_REF(connp); 5433 connp = next_connp; 5434 } 5435 } 5436 5437 /* Last one. Send it upstream. */ 5438 mutex_exit(&connfp->connf_lock); 5439 IP_STAT(ipst, ip_udp_fanmb); 5440 ip_fanout_udp_conn(connp, mp, ipha, NULL, ira); 5441 CONN_DEC_REF(connp); 5442 } 5443 5444 /* 5445 * Split an incoming packet's IPv4 options into the label and the other options. 5446 * If 'allocate' is set it does memory allocation for the ip_pkt_t, including 5447 * clearing out any leftover label or options. 5448 * Otherwise it just makes ipp point into the packet. 5449 * 5450 * Returns zero if ok; ENOMEM if the buffer couldn't be allocated. 5451 */ 5452 int 5453 ip_find_hdr_v4(ipha_t *ipha, ip_pkt_t *ipp, boolean_t allocate) 5454 { 5455 uchar_t *opt; 5456 uint32_t totallen; 5457 uint32_t optval; 5458 uint32_t optlen; 5459 5460 ipp->ipp_fields |= IPPF_HOPLIMIT | IPPF_TCLASS | IPPF_ADDR; 5461 ipp->ipp_hoplimit = ipha->ipha_ttl; 5462 ipp->ipp_type_of_service = ipha->ipha_type_of_service; 5463 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &ipp->ipp_addr); 5464 5465 /* 5466 * Get length (in 4 byte octets) of IP header options. 5467 */ 5468 totallen = ipha->ipha_version_and_hdr_length - 5469 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 5470 5471 if (totallen == 0) { 5472 if (!allocate) 5473 return (0); 5474 5475 /* Clear out anything from a previous packet */ 5476 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) { 5477 kmem_free(ipp->ipp_ipv4_options, 5478 ipp->ipp_ipv4_options_len); 5479 ipp->ipp_ipv4_options = NULL; 5480 ipp->ipp_ipv4_options_len = 0; 5481 ipp->ipp_fields &= ~IPPF_IPV4_OPTIONS; 5482 } 5483 if (ipp->ipp_fields & IPPF_LABEL_V4) { 5484 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4); 5485 ipp->ipp_label_v4 = NULL; 5486 ipp->ipp_label_len_v4 = 0; 5487 ipp->ipp_fields &= ~IPPF_LABEL_V4; 5488 } 5489 return (0); 5490 } 5491 5492 totallen <<= 2; 5493 opt = (uchar_t *)&ipha[1]; 5494 if (!is_system_labeled()) { 5495 5496 copyall: 5497 if (!allocate) { 5498 if (totallen != 0) { 5499 ipp->ipp_ipv4_options = opt; 5500 ipp->ipp_ipv4_options_len = totallen; 5501 ipp->ipp_fields |= IPPF_IPV4_OPTIONS; 5502 } 5503 return (0); 5504 } 5505 /* Just copy all of options */ 5506 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) { 5507 if (totallen == ipp->ipp_ipv4_options_len) { 5508 bcopy(opt, ipp->ipp_ipv4_options, totallen); 5509 return (0); 5510 } 5511 kmem_free(ipp->ipp_ipv4_options, 5512 ipp->ipp_ipv4_options_len); 5513 ipp->ipp_ipv4_options = NULL; 5514 ipp->ipp_ipv4_options_len = 0; 5515 ipp->ipp_fields &= ~IPPF_IPV4_OPTIONS; 5516 } 5517 if (totallen == 0) 5518 return (0); 5519 5520 ipp->ipp_ipv4_options = kmem_alloc(totallen, KM_NOSLEEP); 5521 if (ipp->ipp_ipv4_options == NULL) 5522 return (ENOMEM); 5523 ipp->ipp_ipv4_options_len = totallen; 5524 ipp->ipp_fields |= IPPF_IPV4_OPTIONS; 5525 bcopy(opt, ipp->ipp_ipv4_options, totallen); 5526 return (0); 5527 } 5528 5529 if (allocate && (ipp->ipp_fields & IPPF_LABEL_V4)) { 5530 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4); 5531 ipp->ipp_label_v4 = NULL; 5532 ipp->ipp_label_len_v4 = 0; 5533 ipp->ipp_fields &= ~IPPF_LABEL_V4; 5534 } 5535 5536 /* 5537 * Search for CIPSO option. 5538 * We assume CIPSO is first in options if it is present. 5539 * If it isn't, then ipp_opt_ipv4_options will not include the options 5540 * prior to the CIPSO option. 5541 */ 5542 while (totallen != 0) { 5543 switch (optval = opt[IPOPT_OPTVAL]) { 5544 case IPOPT_EOL: 5545 return (0); 5546 case IPOPT_NOP: 5547 optlen = 1; 5548 break; 5549 default: 5550 if (totallen <= IPOPT_OLEN) 5551 return (EINVAL); 5552 optlen = opt[IPOPT_OLEN]; 5553 if (optlen < 2) 5554 return (EINVAL); 5555 } 5556 if (optlen > totallen) 5557 return (EINVAL); 5558 5559 switch (optval) { 5560 case IPOPT_COMSEC: 5561 if (!allocate) { 5562 ipp->ipp_label_v4 = opt; 5563 ipp->ipp_label_len_v4 = optlen; 5564 ipp->ipp_fields |= IPPF_LABEL_V4; 5565 } else { 5566 ipp->ipp_label_v4 = kmem_alloc(optlen, 5567 KM_NOSLEEP); 5568 if (ipp->ipp_label_v4 == NULL) 5569 return (ENOMEM); 5570 ipp->ipp_label_len_v4 = optlen; 5571 ipp->ipp_fields |= IPPF_LABEL_V4; 5572 bcopy(opt, ipp->ipp_label_v4, optlen); 5573 } 5574 totallen -= optlen; 5575 opt += optlen; 5576 5577 /* Skip padding bytes until we get to a multiple of 4 */ 5578 while ((totallen & 3) != 0 && opt[0] == IPOPT_NOP) { 5579 totallen--; 5580 opt++; 5581 } 5582 /* Remaining as ipp_ipv4_options */ 5583 goto copyall; 5584 } 5585 totallen -= optlen; 5586 opt += optlen; 5587 } 5588 /* No CIPSO found; return everything as ipp_ipv4_options */ 5589 totallen = ipha->ipha_version_and_hdr_length - 5590 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 5591 totallen <<= 2; 5592 opt = (uchar_t *)&ipha[1]; 5593 goto copyall; 5594 } 5595 5596 /* 5597 * Efficient versions of lookup for an IRE when we only 5598 * match the address. 5599 * For RTF_REJECT or BLACKHOLE we return IRE_NOROUTE. 5600 * Does not handle multicast addresses. 5601 */ 5602 uint_t 5603 ip_type_v4(ipaddr_t addr, ip_stack_t *ipst) 5604 { 5605 ire_t *ire; 5606 uint_t result; 5607 5608 ire = ire_ftable_lookup_simple_v4(addr, 0, ipst, NULL); 5609 ASSERT(ire != NULL); 5610 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) 5611 result = IRE_NOROUTE; 5612 else 5613 result = ire->ire_type; 5614 ire_refrele(ire); 5615 return (result); 5616 } 5617 5618 /* 5619 * Efficient versions of lookup for an IRE when we only 5620 * match the address. 5621 * For RTF_REJECT or BLACKHOLE we return IRE_NOROUTE. 5622 * Does not handle multicast addresses. 5623 */ 5624 uint_t 5625 ip_type_v6(const in6_addr_t *addr, ip_stack_t *ipst) 5626 { 5627 ire_t *ire; 5628 uint_t result; 5629 5630 ire = ire_ftable_lookup_simple_v6(addr, 0, ipst, NULL); 5631 ASSERT(ire != NULL); 5632 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) 5633 result = IRE_NOROUTE; 5634 else 5635 result = ire->ire_type; 5636 ire_refrele(ire); 5637 return (result); 5638 } 5639 5640 /* 5641 * Nobody should be sending 5642 * packets up this stream 5643 */ 5644 static void 5645 ip_lrput(queue_t *q, mblk_t *mp) 5646 { 5647 switch (mp->b_datap->db_type) { 5648 case M_FLUSH: 5649 /* Turn around */ 5650 if (*mp->b_rptr & FLUSHW) { 5651 *mp->b_rptr &= ~FLUSHR; 5652 qreply(q, mp); 5653 return; 5654 } 5655 break; 5656 } 5657 freemsg(mp); 5658 } 5659 5660 /* Nobody should be sending packets down this stream */ 5661 /* ARGSUSED */ 5662 void 5663 ip_lwput(queue_t *q, mblk_t *mp) 5664 { 5665 freemsg(mp); 5666 } 5667 5668 /* 5669 * Move the first hop in any source route to ipha_dst and remove that part of 5670 * the source route. Called by other protocols. Errors in option formatting 5671 * are ignored - will be handled by ip_output_options. Return the final 5672 * destination (either ipha_dst or the last entry in a source route.) 5673 */ 5674 ipaddr_t 5675 ip_massage_options(ipha_t *ipha, netstack_t *ns) 5676 { 5677 ipoptp_t opts; 5678 uchar_t *opt; 5679 uint8_t optval; 5680 uint8_t optlen; 5681 ipaddr_t dst; 5682 int i; 5683 ip_stack_t *ipst = ns->netstack_ip; 5684 5685 ip2dbg(("ip_massage_options\n")); 5686 dst = ipha->ipha_dst; 5687 for (optval = ipoptp_first(&opts, ipha); 5688 optval != IPOPT_EOL; 5689 optval = ipoptp_next(&opts)) { 5690 opt = opts.ipoptp_cur; 5691 switch (optval) { 5692 uint8_t off; 5693 case IPOPT_SSRR: 5694 case IPOPT_LSRR: 5695 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 5696 ip1dbg(("ip_massage_options: bad src route\n")); 5697 break; 5698 } 5699 optlen = opts.ipoptp_len; 5700 off = opt[IPOPT_OFFSET]; 5701 off--; 5702 redo_srr: 5703 if (optlen < IP_ADDR_LEN || 5704 off > optlen - IP_ADDR_LEN) { 5705 /* End of source route */ 5706 ip1dbg(("ip_massage_options: end of SR\n")); 5707 break; 5708 } 5709 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 5710 ip1dbg(("ip_massage_options: next hop 0x%x\n", 5711 ntohl(dst))); 5712 /* 5713 * Check if our address is present more than 5714 * once as consecutive hops in source route. 5715 * XXX verify per-interface ip_forwarding 5716 * for source route? 5717 */ 5718 if (ip_type_v4(dst, ipst) == IRE_LOCAL) { 5719 off += IP_ADDR_LEN; 5720 goto redo_srr; 5721 } 5722 if (dst == htonl(INADDR_LOOPBACK)) { 5723 ip1dbg(("ip_massage_options: loopback addr in " 5724 "source route!\n")); 5725 break; 5726 } 5727 /* 5728 * Update ipha_dst to be the first hop and remove the 5729 * first hop from the source route (by overwriting 5730 * part of the option with NOP options). 5731 */ 5732 ipha->ipha_dst = dst; 5733 /* Put the last entry in dst */ 5734 off = ((optlen - IP_ADDR_LEN - 3) & ~(IP_ADDR_LEN-1)) + 5735 3; 5736 bcopy(&opt[off], &dst, IP_ADDR_LEN); 5737 5738 ip1dbg(("ip_massage_options: last hop 0x%x\n", 5739 ntohl(dst))); 5740 /* Move down and overwrite */ 5741 opt[IP_ADDR_LEN] = opt[0]; 5742 opt[IP_ADDR_LEN+1] = opt[IPOPT_OLEN] - IP_ADDR_LEN; 5743 opt[IP_ADDR_LEN+2] = opt[IPOPT_OFFSET]; 5744 for (i = 0; i < IP_ADDR_LEN; i++) 5745 opt[i] = IPOPT_NOP; 5746 break; 5747 } 5748 } 5749 return (dst); 5750 } 5751 5752 /* 5753 * Return the network mask 5754 * associated with the specified address. 5755 */ 5756 ipaddr_t 5757 ip_net_mask(ipaddr_t addr) 5758 { 5759 uchar_t *up = (uchar_t *)&addr; 5760 ipaddr_t mask = 0; 5761 uchar_t *maskp = (uchar_t *)&mask; 5762 5763 #if defined(__i386) || defined(__amd64) 5764 #define TOTALLY_BRAIN_DAMAGED_C_COMPILER 5765 #endif 5766 #ifdef TOTALLY_BRAIN_DAMAGED_C_COMPILER 5767 maskp[0] = maskp[1] = maskp[2] = maskp[3] = 0; 5768 #endif 5769 if (CLASSD(addr)) { 5770 maskp[0] = 0xF0; 5771 return (mask); 5772 } 5773 5774 /* We assume Class E default netmask to be 32 */ 5775 if (CLASSE(addr)) 5776 return (0xffffffffU); 5777 5778 if (addr == 0) 5779 return (0); 5780 maskp[0] = 0xFF; 5781 if ((up[0] & 0x80) == 0) 5782 return (mask); 5783 5784 maskp[1] = 0xFF; 5785 if ((up[0] & 0xC0) == 0x80) 5786 return (mask); 5787 5788 maskp[2] = 0xFF; 5789 if ((up[0] & 0xE0) == 0xC0) 5790 return (mask); 5791 5792 /* Otherwise return no mask */ 5793 return ((ipaddr_t)0); 5794 } 5795 5796 /* Name/Value Table Lookup Routine */ 5797 char * 5798 ip_nv_lookup(nv_t *nv, int value) 5799 { 5800 if (!nv) 5801 return (NULL); 5802 for (; nv->nv_name; nv++) { 5803 if (nv->nv_value == value) 5804 return (nv->nv_name); 5805 } 5806 return ("unknown"); 5807 } 5808 5809 static int 5810 ip_wait_for_info_ack(ill_t *ill) 5811 { 5812 int err; 5813 5814 mutex_enter(&ill->ill_lock); 5815 while (ill->ill_state_flags & ILL_LL_SUBNET_PENDING) { 5816 /* 5817 * Return value of 0 indicates a pending signal. 5818 */ 5819 err = cv_wait_sig(&ill->ill_cv, &ill->ill_lock); 5820 if (err == 0) { 5821 mutex_exit(&ill->ill_lock); 5822 return (EINTR); 5823 } 5824 } 5825 mutex_exit(&ill->ill_lock); 5826 /* 5827 * ip_rput_other could have set an error in ill_error on 5828 * receipt of M_ERROR. 5829 */ 5830 return (ill->ill_error); 5831 } 5832 5833 /* 5834 * This is a module open, i.e. this is a control stream for access 5835 * to a DLPI device. We allocate an ill_t as the instance data in 5836 * this case. 5837 */ 5838 static int 5839 ip_modopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 5840 { 5841 ill_t *ill; 5842 int err; 5843 zoneid_t zoneid; 5844 netstack_t *ns; 5845 ip_stack_t *ipst; 5846 5847 /* 5848 * Prevent unprivileged processes from pushing IP so that 5849 * they can't send raw IP. 5850 */ 5851 if (secpolicy_net_rawaccess(credp) != 0) 5852 return (EPERM); 5853 5854 ns = netstack_find_by_cred(credp); 5855 ASSERT(ns != NULL); 5856 ipst = ns->netstack_ip; 5857 ASSERT(ipst != NULL); 5858 5859 /* 5860 * For exclusive stacks we set the zoneid to zero 5861 * to make IP operate as if in the global zone. 5862 */ 5863 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID) 5864 zoneid = GLOBAL_ZONEID; 5865 else 5866 zoneid = crgetzoneid(credp); 5867 5868 ill = (ill_t *)mi_open_alloc_sleep(sizeof (ill_t)); 5869 q->q_ptr = WR(q)->q_ptr = ill; 5870 ill->ill_ipst = ipst; 5871 ill->ill_zoneid = zoneid; 5872 5873 /* 5874 * ill_init initializes the ill fields and then sends down 5875 * down a DL_INFO_REQ after calling qprocson. 5876 */ 5877 err = ill_init(q, ill); 5878 5879 if (err != 0) { 5880 mi_free(ill); 5881 netstack_rele(ipst->ips_netstack); 5882 q->q_ptr = NULL; 5883 WR(q)->q_ptr = NULL; 5884 return (err); 5885 } 5886 5887 /* 5888 * Wait for the DL_INFO_ACK if a DL_INFO_REQ was sent. 5889 * 5890 * ill_init initializes the ipsq marking this thread as 5891 * writer 5892 */ 5893 ipsq_exit(ill->ill_phyint->phyint_ipsq); 5894 err = ip_wait_for_info_ack(ill); 5895 if (err == 0) 5896 ill->ill_credp = credp; 5897 else 5898 goto fail; 5899 5900 crhold(credp); 5901 5902 mutex_enter(&ipst->ips_ip_mi_lock); 5903 err = mi_open_link(&ipst->ips_ip_g_head, (IDP)q->q_ptr, devp, flag, 5904 sflag, credp); 5905 mutex_exit(&ipst->ips_ip_mi_lock); 5906 fail: 5907 if (err) { 5908 (void) ip_close(q, 0); 5909 return (err); 5910 } 5911 return (0); 5912 } 5913 5914 /* For /dev/ip aka AF_INET open */ 5915 int 5916 ip_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 5917 { 5918 return (ip_open(q, devp, flag, sflag, credp, B_FALSE)); 5919 } 5920 5921 /* For /dev/ip6 aka AF_INET6 open */ 5922 int 5923 ip_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 5924 { 5925 return (ip_open(q, devp, flag, sflag, credp, B_TRUE)); 5926 } 5927 5928 /* IP open routine. */ 5929 int 5930 ip_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 5931 boolean_t isv6) 5932 { 5933 conn_t *connp; 5934 major_t maj; 5935 zoneid_t zoneid; 5936 netstack_t *ns; 5937 ip_stack_t *ipst; 5938 5939 /* Allow reopen. */ 5940 if (q->q_ptr != NULL) 5941 return (0); 5942 5943 if (sflag & MODOPEN) { 5944 /* This is a module open */ 5945 return (ip_modopen(q, devp, flag, sflag, credp)); 5946 } 5947 5948 if ((flag & ~(FKLYR)) == IP_HELPER_STR) { 5949 /* 5950 * Non streams based socket looking for a stream 5951 * to access IP 5952 */ 5953 return (ip_helper_stream_setup(q, devp, flag, sflag, 5954 credp, isv6)); 5955 } 5956 5957 ns = netstack_find_by_cred(credp); 5958 ASSERT(ns != NULL); 5959 ipst = ns->netstack_ip; 5960 ASSERT(ipst != NULL); 5961 5962 /* 5963 * For exclusive stacks we set the zoneid to zero 5964 * to make IP operate as if in the global zone. 5965 */ 5966 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID) 5967 zoneid = GLOBAL_ZONEID; 5968 else 5969 zoneid = crgetzoneid(credp); 5970 5971 /* 5972 * We are opening as a device. This is an IP client stream, and we 5973 * allocate an conn_t as the instance data. 5974 */ 5975 connp = ipcl_conn_create(IPCL_IPCCONN, KM_SLEEP, ipst->ips_netstack); 5976 5977 /* 5978 * ipcl_conn_create did a netstack_hold. Undo the hold that was 5979 * done by netstack_find_by_cred() 5980 */ 5981 netstack_rele(ipst->ips_netstack); 5982 5983 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM; 5984 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 5985 connp->conn_ixa->ixa_zoneid = zoneid; 5986 connp->conn_zoneid = zoneid; 5987 5988 connp->conn_rq = q; 5989 q->q_ptr = WR(q)->q_ptr = connp; 5990 5991 /* Minor tells us which /dev entry was opened */ 5992 if (isv6) { 5993 connp->conn_family = AF_INET6; 5994 connp->conn_ipversion = IPV6_VERSION; 5995 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4; 5996 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT; 5997 } else { 5998 connp->conn_family = AF_INET; 5999 connp->conn_ipversion = IPV4_VERSION; 6000 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4; 6001 } 6002 6003 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && 6004 ((connp->conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { 6005 connp->conn_minor_arena = ip_minor_arena_la; 6006 } else { 6007 /* 6008 * Either minor numbers in the large arena were exhausted 6009 * or a non socket application is doing the open. 6010 * Try to allocate from the small arena. 6011 */ 6012 if ((connp->conn_dev = 6013 inet_minor_alloc(ip_minor_arena_sa)) == 0) { 6014 /* CONN_DEC_REF takes care of netstack_rele() */ 6015 q->q_ptr = WR(q)->q_ptr = NULL; 6016 CONN_DEC_REF(connp); 6017 return (EBUSY); 6018 } 6019 connp->conn_minor_arena = ip_minor_arena_sa; 6020 } 6021 6022 maj = getemajor(*devp); 6023 *devp = makedevice(maj, (minor_t)connp->conn_dev); 6024 6025 /* 6026 * connp->conn_cred is crfree()ed in ipcl_conn_destroy() 6027 */ 6028 connp->conn_cred = credp; 6029 connp->conn_cpid = curproc->p_pid; 6030 /* Cache things in ixa without an extra refhold */ 6031 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 6032 connp->conn_ixa->ixa_cred = connp->conn_cred; 6033 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 6034 if (is_system_labeled()) 6035 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 6036 6037 /* 6038 * Handle IP_IOC_RTS_REQUEST and other ioctls which use conn_recv 6039 */ 6040 connp->conn_recv = ip_conn_input; 6041 connp->conn_recvicmp = ip_conn_input_icmp; 6042 6043 crhold(connp->conn_cred); 6044 6045 /* 6046 * If the caller has the process-wide flag set, then default to MAC 6047 * exempt mode. This allows read-down to unlabeled hosts. 6048 */ 6049 if (getpflags(NET_MAC_AWARE, credp) != 0) 6050 connp->conn_mac_mode = CONN_MAC_AWARE; 6051 6052 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 6053 6054 connp->conn_rq = q; 6055 connp->conn_wq = WR(q); 6056 6057 /* Non-zero default values */ 6058 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP; 6059 6060 /* 6061 * Make the conn globally visible to walkers 6062 */ 6063 ASSERT(connp->conn_ref == 1); 6064 mutex_enter(&connp->conn_lock); 6065 connp->conn_state_flags &= ~CONN_INCIPIENT; 6066 mutex_exit(&connp->conn_lock); 6067 6068 qprocson(q); 6069 6070 return (0); 6071 } 6072 6073 /* 6074 * Set IPsec policy from an ipsec_req_t. If the req is not "zero" and valid, 6075 * all of them are copied to the conn_t. If the req is "zero", the policy is 6076 * zeroed out. A "zero" policy has zero ipsr_{ah,req,self_encap}_req 6077 * fields. 6078 * We keep only the latest setting of the policy and thus policy setting 6079 * is not incremental/cumulative. 6080 * 6081 * Requests to set policies with multiple alternative actions will 6082 * go through a different API. 6083 */ 6084 int 6085 ipsec_set_req(cred_t *cr, conn_t *connp, ipsec_req_t *req) 6086 { 6087 uint_t ah_req = 0; 6088 uint_t esp_req = 0; 6089 uint_t se_req = 0; 6090 ipsec_act_t *actp = NULL; 6091 uint_t nact; 6092 ipsec_policy_head_t *ph; 6093 boolean_t is_pol_reset, is_pol_inserted = B_FALSE; 6094 int error = 0; 6095 netstack_t *ns = connp->conn_netstack; 6096 ip_stack_t *ipst = ns->netstack_ip; 6097 ipsec_stack_t *ipss = ns->netstack_ipsec; 6098 6099 #define REQ_MASK (IPSEC_PREF_REQUIRED|IPSEC_PREF_NEVER) 6100 6101 /* 6102 * The IP_SEC_OPT option does not allow variable length parameters, 6103 * hence a request cannot be NULL. 6104 */ 6105 if (req == NULL) 6106 return (EINVAL); 6107 6108 ah_req = req->ipsr_ah_req; 6109 esp_req = req->ipsr_esp_req; 6110 se_req = req->ipsr_self_encap_req; 6111 6112 /* Don't allow setting self-encap without one or more of AH/ESP. */ 6113 if (se_req != 0 && esp_req == 0 && ah_req == 0) 6114 return (EINVAL); 6115 6116 /* 6117 * Are we dealing with a request to reset the policy (i.e. 6118 * zero requests). 6119 */ 6120 is_pol_reset = ((ah_req & REQ_MASK) == 0 && 6121 (esp_req & REQ_MASK) == 0 && 6122 (se_req & REQ_MASK) == 0); 6123 6124 if (!is_pol_reset) { 6125 /* 6126 * If we couldn't load IPsec, fail with "protocol 6127 * not supported". 6128 * IPsec may not have been loaded for a request with zero 6129 * policies, so we don't fail in this case. 6130 */ 6131 mutex_enter(&ipss->ipsec_loader_lock); 6132 if (ipss->ipsec_loader_state != IPSEC_LOADER_SUCCEEDED) { 6133 mutex_exit(&ipss->ipsec_loader_lock); 6134 return (EPROTONOSUPPORT); 6135 } 6136 mutex_exit(&ipss->ipsec_loader_lock); 6137 6138 /* 6139 * Test for valid requests. Invalid algorithms 6140 * need to be tested by IPsec code because new 6141 * algorithms can be added dynamically. 6142 */ 6143 if ((ah_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 || 6144 (esp_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 || 6145 (se_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0) { 6146 return (EINVAL); 6147 } 6148 6149 /* 6150 * Only privileged users can issue these 6151 * requests. 6152 */ 6153 if (((ah_req & IPSEC_PREF_NEVER) || 6154 (esp_req & IPSEC_PREF_NEVER) || 6155 (se_req & IPSEC_PREF_NEVER)) && 6156 secpolicy_ip_config(cr, B_FALSE) != 0) { 6157 return (EPERM); 6158 } 6159 6160 /* 6161 * The IPSEC_PREF_REQUIRED and IPSEC_PREF_NEVER 6162 * are mutually exclusive. 6163 */ 6164 if (((ah_req & REQ_MASK) == REQ_MASK) || 6165 ((esp_req & REQ_MASK) == REQ_MASK) || 6166 ((se_req & REQ_MASK) == REQ_MASK)) { 6167 /* Both of them are set */ 6168 return (EINVAL); 6169 } 6170 } 6171 6172 ASSERT(MUTEX_HELD(&connp->conn_lock)); 6173 6174 /* 6175 * If we have already cached policies in conn_connect(), don't 6176 * let them change now. We cache policies for connections 6177 * whose src,dst [addr, port] is known. 6178 */ 6179 if (connp->conn_policy_cached) { 6180 return (EINVAL); 6181 } 6182 6183 /* 6184 * We have a zero policies, reset the connection policy if already 6185 * set. This will cause the connection to inherit the 6186 * global policy, if any. 6187 */ 6188 if (is_pol_reset) { 6189 if (connp->conn_policy != NULL) { 6190 IPPH_REFRELE(connp->conn_policy, ipst->ips_netstack); 6191 connp->conn_policy = NULL; 6192 } 6193 connp->conn_in_enforce_policy = B_FALSE; 6194 connp->conn_out_enforce_policy = B_FALSE; 6195 return (0); 6196 } 6197 6198 ph = connp->conn_policy = ipsec_polhead_split(connp->conn_policy, 6199 ipst->ips_netstack); 6200 if (ph == NULL) 6201 goto enomem; 6202 6203 ipsec_actvec_from_req(req, &actp, &nact, ipst->ips_netstack); 6204 if (actp == NULL) 6205 goto enomem; 6206 6207 /* 6208 * Always insert IPv4 policy entries, since they can also apply to 6209 * ipv6 sockets being used in ipv4-compat mode. 6210 */ 6211 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V4, 6212 IPSEC_TYPE_INBOUND, ns)) 6213 goto enomem; 6214 is_pol_inserted = B_TRUE; 6215 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V4, 6216 IPSEC_TYPE_OUTBOUND, ns)) 6217 goto enomem; 6218 6219 /* 6220 * We're looking at a v6 socket, also insert the v6-specific 6221 * entries. 6222 */ 6223 if (connp->conn_family == AF_INET6) { 6224 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V6, 6225 IPSEC_TYPE_INBOUND, ns)) 6226 goto enomem; 6227 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V6, 6228 IPSEC_TYPE_OUTBOUND, ns)) 6229 goto enomem; 6230 } 6231 6232 ipsec_actvec_free(actp, nact); 6233 6234 /* 6235 * If the requests need security, set enforce_policy. 6236 * If the requests are IPSEC_PREF_NEVER, one should 6237 * still set conn_out_enforce_policy so that ip_set_destination 6238 * marks the ip_xmit_attr_t appropriatly. This is needed so that 6239 * for connections that we don't cache policy in at connect time, 6240 * if global policy matches in ip_output_attach_policy, we 6241 * don't wrongly inherit global policy. Similarly, we need 6242 * to set conn_in_enforce_policy also so that we don't verify 6243 * policy wrongly. 6244 */ 6245 if ((ah_req & REQ_MASK) != 0 || 6246 (esp_req & REQ_MASK) != 0 || 6247 (se_req & REQ_MASK) != 0) { 6248 connp->conn_in_enforce_policy = B_TRUE; 6249 connp->conn_out_enforce_policy = B_TRUE; 6250 } 6251 6252 return (error); 6253 #undef REQ_MASK 6254 6255 /* 6256 * Common memory-allocation-failure exit path. 6257 */ 6258 enomem: 6259 if (actp != NULL) 6260 ipsec_actvec_free(actp, nact); 6261 if (is_pol_inserted) 6262 ipsec_polhead_flush(ph, ns); 6263 return (ENOMEM); 6264 } 6265 6266 /* 6267 * Set socket options for joining and leaving multicast groups. 6268 * Common to IPv4 and IPv6; inet6 indicates the type of socket. 6269 * The caller has already check that the option name is consistent with 6270 * the address family of the socket. 6271 */ 6272 int 6273 ip_opt_set_multicast_group(conn_t *connp, t_scalar_t name, 6274 uchar_t *invalp, boolean_t inet6, boolean_t checkonly) 6275 { 6276 int *i1 = (int *)invalp; 6277 int error = 0; 6278 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 6279 struct ip_mreq *v4_mreqp; 6280 struct ipv6_mreq *v6_mreqp; 6281 struct group_req *greqp; 6282 ire_t *ire; 6283 boolean_t done = B_FALSE; 6284 ipaddr_t ifaddr; 6285 in6_addr_t v6group; 6286 uint_t ifindex; 6287 boolean_t mcast_opt = B_TRUE; 6288 mcast_record_t fmode; 6289 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *, 6290 ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *); 6291 6292 switch (name) { 6293 case IP_ADD_MEMBERSHIP: 6294 case IPV6_JOIN_GROUP: 6295 mcast_opt = B_FALSE; 6296 /* FALLTHRU */ 6297 case MCAST_JOIN_GROUP: 6298 fmode = MODE_IS_EXCLUDE; 6299 optfn = ip_opt_add_group; 6300 break; 6301 6302 case IP_DROP_MEMBERSHIP: 6303 case IPV6_LEAVE_GROUP: 6304 mcast_opt = B_FALSE; 6305 /* FALLTHRU */ 6306 case MCAST_LEAVE_GROUP: 6307 fmode = MODE_IS_INCLUDE; 6308 optfn = ip_opt_delete_group; 6309 break; 6310 default: 6311 ASSERT(0); 6312 } 6313 6314 if (mcast_opt) { 6315 struct sockaddr_in *sin; 6316 struct sockaddr_in6 *sin6; 6317 6318 greqp = (struct group_req *)i1; 6319 if (greqp->gr_group.ss_family == AF_INET) { 6320 sin = (struct sockaddr_in *)&(greqp->gr_group); 6321 IN6_INADDR_TO_V4MAPPED(&sin->sin_addr, &v6group); 6322 } else { 6323 if (!inet6) 6324 return (EINVAL); /* Not on INET socket */ 6325 6326 sin6 = (struct sockaddr_in6 *)&(greqp->gr_group); 6327 v6group = sin6->sin6_addr; 6328 } 6329 ifaddr = INADDR_ANY; 6330 ifindex = greqp->gr_interface; 6331 } else if (inet6) { 6332 v6_mreqp = (struct ipv6_mreq *)i1; 6333 v6group = v6_mreqp->ipv6mr_multiaddr; 6334 ifaddr = INADDR_ANY; 6335 ifindex = v6_mreqp->ipv6mr_interface; 6336 } else { 6337 v4_mreqp = (struct ip_mreq *)i1; 6338 IN6_INADDR_TO_V4MAPPED(&v4_mreqp->imr_multiaddr, &v6group); 6339 ifaddr = (ipaddr_t)v4_mreqp->imr_interface.s_addr; 6340 ifindex = 0; 6341 } 6342 6343 /* 6344 * In the multirouting case, we need to replicate 6345 * the request on all interfaces that will take part 6346 * in replication. We do so because multirouting is 6347 * reflective, thus we will probably receive multi- 6348 * casts on those interfaces. 6349 * The ip_multirt_apply_membership() succeeds if 6350 * the operation succeeds on at least one interface. 6351 */ 6352 if (IN6_IS_ADDR_V4MAPPED(&v6group)) { 6353 ipaddr_t group; 6354 6355 IN6_V4MAPPED_TO_IPADDR(&v6group, group); 6356 6357 ire = ire_ftable_lookup_v4(group, IP_HOST_MASK, 0, 6358 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL, 6359 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL); 6360 } else { 6361 ire = ire_ftable_lookup_v6(&v6group, &ipv6_all_ones, 0, 6362 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL, 6363 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL); 6364 } 6365 if (ire != NULL) { 6366 if (ire->ire_flags & RTF_MULTIRT) { 6367 error = ip_multirt_apply_membership(optfn, ire, connp, 6368 checkonly, &v6group, fmode, &ipv6_all_zeros); 6369 done = B_TRUE; 6370 } 6371 ire_refrele(ire); 6372 } 6373 6374 if (!done) { 6375 error = optfn(connp, checkonly, &v6group, ifaddr, ifindex, 6376 fmode, &ipv6_all_zeros); 6377 } 6378 return (error); 6379 } 6380 6381 /* 6382 * Set socket options for joining and leaving multicast groups 6383 * for specific sources. 6384 * Common to IPv4 and IPv6; inet6 indicates the type of socket. 6385 * The caller has already check that the option name is consistent with 6386 * the address family of the socket. 6387 */ 6388 int 6389 ip_opt_set_multicast_sources(conn_t *connp, t_scalar_t name, 6390 uchar_t *invalp, boolean_t inet6, boolean_t checkonly) 6391 { 6392 int *i1 = (int *)invalp; 6393 int error = 0; 6394 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 6395 struct ip_mreq_source *imreqp; 6396 struct group_source_req *gsreqp; 6397 in6_addr_t v6group, v6src; 6398 uint32_t ifindex; 6399 ipaddr_t ifaddr; 6400 boolean_t mcast_opt = B_TRUE; 6401 mcast_record_t fmode; 6402 ire_t *ire; 6403 boolean_t done = B_FALSE; 6404 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *, 6405 ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *); 6406 6407 switch (name) { 6408 case IP_BLOCK_SOURCE: 6409 mcast_opt = B_FALSE; 6410 /* FALLTHRU */ 6411 case MCAST_BLOCK_SOURCE: 6412 fmode = MODE_IS_EXCLUDE; 6413 optfn = ip_opt_add_group; 6414 break; 6415 6416 case IP_UNBLOCK_SOURCE: 6417 mcast_opt = B_FALSE; 6418 /* FALLTHRU */ 6419 case MCAST_UNBLOCK_SOURCE: 6420 fmode = MODE_IS_EXCLUDE; 6421 optfn = ip_opt_delete_group; 6422 break; 6423 6424 case IP_ADD_SOURCE_MEMBERSHIP: 6425 mcast_opt = B_FALSE; 6426 /* FALLTHRU */ 6427 case MCAST_JOIN_SOURCE_GROUP: 6428 fmode = MODE_IS_INCLUDE; 6429 optfn = ip_opt_add_group; 6430 break; 6431 6432 case IP_DROP_SOURCE_MEMBERSHIP: 6433 mcast_opt = B_FALSE; 6434 /* FALLTHRU */ 6435 case MCAST_LEAVE_SOURCE_GROUP: 6436 fmode = MODE_IS_INCLUDE; 6437 optfn = ip_opt_delete_group; 6438 break; 6439 default: 6440 ASSERT(0); 6441 } 6442 6443 if (mcast_opt) { 6444 gsreqp = (struct group_source_req *)i1; 6445 ifindex = gsreqp->gsr_interface; 6446 if (gsreqp->gsr_group.ss_family == AF_INET) { 6447 struct sockaddr_in *s; 6448 s = (struct sockaddr_in *)&gsreqp->gsr_group; 6449 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6group); 6450 s = (struct sockaddr_in *)&gsreqp->gsr_source; 6451 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6src); 6452 } else { 6453 struct sockaddr_in6 *s6; 6454 6455 if (!inet6) 6456 return (EINVAL); /* Not on INET socket */ 6457 6458 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_group; 6459 v6group = s6->sin6_addr; 6460 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_source; 6461 v6src = s6->sin6_addr; 6462 } 6463 ifaddr = INADDR_ANY; 6464 } else { 6465 imreqp = (struct ip_mreq_source *)i1; 6466 IN6_INADDR_TO_V4MAPPED(&imreqp->imr_multiaddr, &v6group); 6467 IN6_INADDR_TO_V4MAPPED(&imreqp->imr_sourceaddr, &v6src); 6468 ifaddr = (ipaddr_t)imreqp->imr_interface.s_addr; 6469 ifindex = 0; 6470 } 6471 6472 /* 6473 * Handle src being mapped INADDR_ANY by changing it to unspecified. 6474 */ 6475 if (IN6_IS_ADDR_V4MAPPED_ANY(&v6src)) 6476 v6src = ipv6_all_zeros; 6477 6478 /* 6479 * In the multirouting case, we need to replicate 6480 * the request as noted in the mcast cases above. 6481 */ 6482 if (IN6_IS_ADDR_V4MAPPED(&v6group)) { 6483 ipaddr_t group; 6484 6485 IN6_V4MAPPED_TO_IPADDR(&v6group, group); 6486 6487 ire = ire_ftable_lookup_v4(group, IP_HOST_MASK, 0, 6488 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL, 6489 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL); 6490 } else { 6491 ire = ire_ftable_lookup_v6(&v6group, &ipv6_all_ones, 0, 6492 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL, 6493 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL); 6494 } 6495 if (ire != NULL) { 6496 if (ire->ire_flags & RTF_MULTIRT) { 6497 error = ip_multirt_apply_membership(optfn, ire, connp, 6498 checkonly, &v6group, fmode, &v6src); 6499 done = B_TRUE; 6500 } 6501 ire_refrele(ire); 6502 } 6503 if (!done) { 6504 error = optfn(connp, checkonly, &v6group, ifaddr, ifindex, 6505 fmode, &v6src); 6506 } 6507 return (error); 6508 } 6509 6510 /* 6511 * Given a destination address and a pointer to where to put the information 6512 * this routine fills in the mtuinfo. 6513 * The socket must be connected. 6514 * For sctp conn_faddr is the primary address. 6515 */ 6516 int 6517 ip_fill_mtuinfo(conn_t *connp, ip_xmit_attr_t *ixa, struct ip6_mtuinfo *mtuinfo) 6518 { 6519 uint32_t pmtu = IP_MAXPACKET; 6520 uint_t scopeid; 6521 6522 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6)) 6523 return (-1); 6524 6525 /* In case we never sent or called ip_set_destination_v4/v6 */ 6526 if (ixa->ixa_ire != NULL) 6527 pmtu = ip_get_pmtu(ixa); 6528 6529 if (ixa->ixa_flags & IXAF_SCOPEID_SET) 6530 scopeid = ixa->ixa_scopeid; 6531 else 6532 scopeid = 0; 6533 6534 bzero(mtuinfo, sizeof (*mtuinfo)); 6535 mtuinfo->ip6m_addr.sin6_family = AF_INET6; 6536 mtuinfo->ip6m_addr.sin6_port = connp->conn_fport; 6537 mtuinfo->ip6m_addr.sin6_addr = connp->conn_faddr_v6; 6538 mtuinfo->ip6m_addr.sin6_scope_id = scopeid; 6539 mtuinfo->ip6m_mtu = pmtu; 6540 6541 return (sizeof (struct ip6_mtuinfo)); 6542 } 6543 6544 /* 6545 * When the src multihoming is changed from weak to [strong, preferred] 6546 * ip_ire_rebind_walker is called to walk the list of all ire_t entries 6547 * and identify routes that were created by user-applications in the 6548 * unbound state (i.e., without RTA_IFP), and for which an ire_ill is not 6549 * currently defined. These routes are then 'rebound', i.e., their ire_ill 6550 * is selected by finding an interface route for the gateway. 6551 */ 6552 /* ARGSUSED */ 6553 void 6554 ip_ire_rebind_walker(ire_t *ire, void *notused) 6555 { 6556 if (!ire->ire_unbound || ire->ire_ill != NULL) 6557 return; 6558 ire_rebind(ire); 6559 ire_delete(ire); 6560 } 6561 6562 /* 6563 * When the src multihoming is changed from [strong, preferred] to weak, 6564 * ip_ire_unbind_walker is called to walk the list of all ire_t entries, and 6565 * set any entries that were created by user-applications in the unbound state 6566 * (i.e., without RTA_IFP) back to having a NULL ire_ill. 6567 */ 6568 /* ARGSUSED */ 6569 void 6570 ip_ire_unbind_walker(ire_t *ire, void *notused) 6571 { 6572 ire_t *new_ire; 6573 6574 if (!ire->ire_unbound || ire->ire_ill == NULL) 6575 return; 6576 if (ire->ire_ipversion == IPV6_VERSION) { 6577 new_ire = ire_create_v6(&ire->ire_addr_v6, &ire->ire_mask_v6, 6578 &ire->ire_gateway_addr_v6, ire->ire_type, NULL, 6579 ire->ire_zoneid, ire->ire_flags, NULL, ire->ire_ipst); 6580 } else { 6581 new_ire = ire_create((uchar_t *)&ire->ire_addr, 6582 (uchar_t *)&ire->ire_mask, 6583 (uchar_t *)&ire->ire_gateway_addr, ire->ire_type, NULL, 6584 ire->ire_zoneid, ire->ire_flags, NULL, ire->ire_ipst); 6585 } 6586 if (new_ire == NULL) 6587 return; 6588 new_ire->ire_unbound = B_TRUE; 6589 /* 6590 * The bound ire must first be deleted so that we don't return 6591 * the existing one on the attempt to add the unbound new_ire. 6592 */ 6593 ire_delete(ire); 6594 new_ire = ire_add(new_ire); 6595 if (new_ire != NULL) 6596 ire_refrele(new_ire); 6597 } 6598 6599 /* 6600 * When the settings of ip*_strict_src_multihoming tunables are changed, 6601 * all cached routes need to be recomputed. This recomputation needs to be 6602 * done when going from weaker to stronger modes so that the cached ire 6603 * for the connection does not violate the current ip*_strict_src_multihoming 6604 * setting. It also needs to be done when going from stronger to weaker modes, 6605 * so that we fall back to matching on the longest-matching-route (as opposed 6606 * to a shorter match that may have been selected in the strong mode 6607 * to satisfy src_multihoming settings). 6608 * 6609 * The cached ixa_ire entires for all conn_t entries are marked as 6610 * "verify" so that they will be recomputed for the next packet. 6611 */ 6612 void 6613 conn_ire_revalidate(conn_t *connp, void *arg) 6614 { 6615 boolean_t isv6 = (boolean_t)arg; 6616 6617 if ((isv6 && connp->conn_ipversion != IPV6_VERSION) || 6618 (!isv6 && connp->conn_ipversion != IPV4_VERSION)) 6619 return; 6620 connp->conn_ixa->ixa_ire_generation = IRE_GENERATION_VERIFY; 6621 } 6622 6623 /* 6624 * Handles both IPv4 and IPv6 reassembly - doing the out-of-order cases, 6625 * When an ipf is passed here for the first time, if 6626 * we already have in-order fragments on the queue, we convert from the fast- 6627 * path reassembly scheme to the hard-case scheme. From then on, additional 6628 * fragments are reassembled here. We keep track of the start and end offsets 6629 * of each piece, and the number of holes in the chain. When the hole count 6630 * goes to zero, we are done! 6631 * 6632 * The ipf_count will be updated to account for any mblk(s) added (pointed to 6633 * by mp) or subtracted (freeb()ed dups), upon return the caller must update 6634 * ipfb_count and ill_frag_count by the difference of ipf_count before and 6635 * after the call to ip_reassemble(). 6636 */ 6637 int 6638 ip_reassemble(mblk_t *mp, ipf_t *ipf, uint_t start, boolean_t more, ill_t *ill, 6639 size_t msg_len) 6640 { 6641 uint_t end; 6642 mblk_t *next_mp; 6643 mblk_t *mp1; 6644 uint_t offset; 6645 boolean_t incr_dups = B_TRUE; 6646 boolean_t offset_zero_seen = B_FALSE; 6647 boolean_t pkt_boundary_checked = B_FALSE; 6648 6649 /* If start == 0 then ipf_nf_hdr_len has to be set. */ 6650 ASSERT(start != 0 || ipf->ipf_nf_hdr_len != 0); 6651 6652 /* Add in byte count */ 6653 ipf->ipf_count += msg_len; 6654 if (ipf->ipf_end) { 6655 /* 6656 * We were part way through in-order reassembly, but now there 6657 * is a hole. We walk through messages already queued, and 6658 * mark them for hard case reassembly. We know that up till 6659 * now they were in order starting from offset zero. 6660 */ 6661 offset = 0; 6662 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) { 6663 IP_REASS_SET_START(mp1, offset); 6664 if (offset == 0) { 6665 ASSERT(ipf->ipf_nf_hdr_len != 0); 6666 offset = -ipf->ipf_nf_hdr_len; 6667 } 6668 offset += mp1->b_wptr - mp1->b_rptr; 6669 IP_REASS_SET_END(mp1, offset); 6670 } 6671 /* One hole at the end. */ 6672 ipf->ipf_hole_cnt = 1; 6673 /* Brand it as a hard case, forever. */ 6674 ipf->ipf_end = 0; 6675 } 6676 /* Walk through all the new pieces. */ 6677 do { 6678 end = start + (mp->b_wptr - mp->b_rptr); 6679 /* 6680 * If start is 0, decrease 'end' only for the first mblk of 6681 * the fragment. Otherwise 'end' can get wrong value in the 6682 * second pass of the loop if first mblk is exactly the 6683 * size of ipf_nf_hdr_len. 6684 */ 6685 if (start == 0 && !offset_zero_seen) { 6686 /* First segment */ 6687 ASSERT(ipf->ipf_nf_hdr_len != 0); 6688 end -= ipf->ipf_nf_hdr_len; 6689 offset_zero_seen = B_TRUE; 6690 } 6691 next_mp = mp->b_cont; 6692 /* 6693 * We are checking to see if there is any interesing data 6694 * to process. If there isn't and the mblk isn't the 6695 * one which carries the unfragmentable header then we 6696 * drop it. It's possible to have just the unfragmentable 6697 * header come through without any data. That needs to be 6698 * saved. 6699 * 6700 * If the assert at the top of this function holds then the 6701 * term "ipf->ipf_nf_hdr_len != 0" isn't needed. This code 6702 * is infrequently traveled enough that the test is left in 6703 * to protect against future code changes which break that 6704 * invariant. 6705 */ 6706 if (start == end && start != 0 && ipf->ipf_nf_hdr_len != 0) { 6707 /* Empty. Blast it. */ 6708 IP_REASS_SET_START(mp, 0); 6709 IP_REASS_SET_END(mp, 0); 6710 /* 6711 * If the ipf points to the mblk we are about to free, 6712 * update ipf to point to the next mblk (or NULL 6713 * if none). 6714 */ 6715 if (ipf->ipf_mp->b_cont == mp) 6716 ipf->ipf_mp->b_cont = next_mp; 6717 freeb(mp); 6718 continue; 6719 } 6720 mp->b_cont = NULL; 6721 IP_REASS_SET_START(mp, start); 6722 IP_REASS_SET_END(mp, end); 6723 if (!ipf->ipf_tail_mp) { 6724 ipf->ipf_tail_mp = mp; 6725 ipf->ipf_mp->b_cont = mp; 6726 if (start == 0 || !more) { 6727 ipf->ipf_hole_cnt = 1; 6728 /* 6729 * if the first fragment comes in more than one 6730 * mblk, this loop will be executed for each 6731 * mblk. Need to adjust hole count so exiting 6732 * this routine will leave hole count at 1. 6733 */ 6734 if (next_mp) 6735 ipf->ipf_hole_cnt++; 6736 } else 6737 ipf->ipf_hole_cnt = 2; 6738 continue; 6739 } else if (ipf->ipf_last_frag_seen && !more && 6740 !pkt_boundary_checked) { 6741 /* 6742 * We check datagram boundary only if this fragment 6743 * claims to be the last fragment and we have seen a 6744 * last fragment in the past too. We do this only 6745 * once for a given fragment. 6746 * 6747 * start cannot be 0 here as fragments with start=0 6748 * and MF=0 gets handled as a complete packet. These 6749 * fragments should not reach here. 6750 */ 6751 6752 if (start + msgdsize(mp) != 6753 IP_REASS_END(ipf->ipf_tail_mp)) { 6754 /* 6755 * We have two fragments both of which claim 6756 * to be the last fragment but gives conflicting 6757 * information about the whole datagram size. 6758 * Something fishy is going on. Drop the 6759 * fragment and free up the reassembly list. 6760 */ 6761 return (IP_REASS_FAILED); 6762 } 6763 6764 /* 6765 * We shouldn't come to this code block again for this 6766 * particular fragment. 6767 */ 6768 pkt_boundary_checked = B_TRUE; 6769 } 6770 6771 /* New stuff at or beyond tail? */ 6772 offset = IP_REASS_END(ipf->ipf_tail_mp); 6773 if (start >= offset) { 6774 if (ipf->ipf_last_frag_seen) { 6775 /* current fragment is beyond last fragment */ 6776 return (IP_REASS_FAILED); 6777 } 6778 /* Link it on end. */ 6779 ipf->ipf_tail_mp->b_cont = mp; 6780 ipf->ipf_tail_mp = mp; 6781 if (more) { 6782 if (start != offset) 6783 ipf->ipf_hole_cnt++; 6784 } else if (start == offset && next_mp == NULL) 6785 ipf->ipf_hole_cnt--; 6786 continue; 6787 } 6788 mp1 = ipf->ipf_mp->b_cont; 6789 offset = IP_REASS_START(mp1); 6790 /* New stuff at the front? */ 6791 if (start < offset) { 6792 if (start == 0) { 6793 if (end >= offset) { 6794 /* Nailed the hole at the begining. */ 6795 ipf->ipf_hole_cnt--; 6796 } 6797 } else if (end < offset) { 6798 /* 6799 * A hole, stuff, and a hole where there used 6800 * to be just a hole. 6801 */ 6802 ipf->ipf_hole_cnt++; 6803 } 6804 mp->b_cont = mp1; 6805 /* Check for overlap. */ 6806 while (end > offset) { 6807 if (end < IP_REASS_END(mp1)) { 6808 mp->b_wptr -= end - offset; 6809 IP_REASS_SET_END(mp, offset); 6810 BUMP_MIB(ill->ill_ip_mib, 6811 ipIfStatsReasmPartDups); 6812 break; 6813 } 6814 /* Did we cover another hole? */ 6815 if ((mp1->b_cont && 6816 IP_REASS_END(mp1) != 6817 IP_REASS_START(mp1->b_cont) && 6818 end >= IP_REASS_START(mp1->b_cont)) || 6819 (!ipf->ipf_last_frag_seen && !more)) { 6820 ipf->ipf_hole_cnt--; 6821 } 6822 /* Clip out mp1. */ 6823 if ((mp->b_cont = mp1->b_cont) == NULL) { 6824 /* 6825 * After clipping out mp1, this guy 6826 * is now hanging off the end. 6827 */ 6828 ipf->ipf_tail_mp = mp; 6829 } 6830 IP_REASS_SET_START(mp1, 0); 6831 IP_REASS_SET_END(mp1, 0); 6832 /* Subtract byte count */ 6833 ipf->ipf_count -= mp1->b_datap->db_lim - 6834 mp1->b_datap->db_base; 6835 freeb(mp1); 6836 BUMP_MIB(ill->ill_ip_mib, 6837 ipIfStatsReasmPartDups); 6838 mp1 = mp->b_cont; 6839 if (!mp1) 6840 break; 6841 offset = IP_REASS_START(mp1); 6842 } 6843 ipf->ipf_mp->b_cont = mp; 6844 continue; 6845 } 6846 /* 6847 * The new piece starts somewhere between the start of the head 6848 * and before the end of the tail. 6849 */ 6850 for (; mp1; mp1 = mp1->b_cont) { 6851 offset = IP_REASS_END(mp1); 6852 if (start < offset) { 6853 if (end <= offset) { 6854 /* Nothing new. */ 6855 IP_REASS_SET_START(mp, 0); 6856 IP_REASS_SET_END(mp, 0); 6857 /* Subtract byte count */ 6858 ipf->ipf_count -= mp->b_datap->db_lim - 6859 mp->b_datap->db_base; 6860 if (incr_dups) { 6861 ipf->ipf_num_dups++; 6862 incr_dups = B_FALSE; 6863 } 6864 freeb(mp); 6865 BUMP_MIB(ill->ill_ip_mib, 6866 ipIfStatsReasmDuplicates); 6867 break; 6868 } 6869 /* 6870 * Trim redundant stuff off beginning of new 6871 * piece. 6872 */ 6873 IP_REASS_SET_START(mp, offset); 6874 mp->b_rptr += offset - start; 6875 BUMP_MIB(ill->ill_ip_mib, 6876 ipIfStatsReasmPartDups); 6877 start = offset; 6878 if (!mp1->b_cont) { 6879 /* 6880 * After trimming, this guy is now 6881 * hanging off the end. 6882 */ 6883 mp1->b_cont = mp; 6884 ipf->ipf_tail_mp = mp; 6885 if (!more) { 6886 ipf->ipf_hole_cnt--; 6887 } 6888 break; 6889 } 6890 } 6891 if (start >= IP_REASS_START(mp1->b_cont)) 6892 continue; 6893 /* Fill a hole */ 6894 if (start > offset) 6895 ipf->ipf_hole_cnt++; 6896 mp->b_cont = mp1->b_cont; 6897 mp1->b_cont = mp; 6898 mp1 = mp->b_cont; 6899 offset = IP_REASS_START(mp1); 6900 if (end >= offset) { 6901 ipf->ipf_hole_cnt--; 6902 /* Check for overlap. */ 6903 while (end > offset) { 6904 if (end < IP_REASS_END(mp1)) { 6905 mp->b_wptr -= end - offset; 6906 IP_REASS_SET_END(mp, offset); 6907 /* 6908 * TODO we might bump 6909 * this up twice if there is 6910 * overlap at both ends. 6911 */ 6912 BUMP_MIB(ill->ill_ip_mib, 6913 ipIfStatsReasmPartDups); 6914 break; 6915 } 6916 /* Did we cover another hole? */ 6917 if ((mp1->b_cont && 6918 IP_REASS_END(mp1) 6919 != IP_REASS_START(mp1->b_cont) && 6920 end >= 6921 IP_REASS_START(mp1->b_cont)) || 6922 (!ipf->ipf_last_frag_seen && 6923 !more)) { 6924 ipf->ipf_hole_cnt--; 6925 } 6926 /* Clip out mp1. */ 6927 if ((mp->b_cont = mp1->b_cont) == 6928 NULL) { 6929 /* 6930 * After clipping out mp1, 6931 * this guy is now hanging 6932 * off the end. 6933 */ 6934 ipf->ipf_tail_mp = mp; 6935 } 6936 IP_REASS_SET_START(mp1, 0); 6937 IP_REASS_SET_END(mp1, 0); 6938 /* Subtract byte count */ 6939 ipf->ipf_count -= 6940 mp1->b_datap->db_lim - 6941 mp1->b_datap->db_base; 6942 freeb(mp1); 6943 BUMP_MIB(ill->ill_ip_mib, 6944 ipIfStatsReasmPartDups); 6945 mp1 = mp->b_cont; 6946 if (!mp1) 6947 break; 6948 offset = IP_REASS_START(mp1); 6949 } 6950 } 6951 break; 6952 } 6953 } while (start = end, mp = next_mp); 6954 6955 /* Fragment just processed could be the last one. Remember this fact */ 6956 if (!more) 6957 ipf->ipf_last_frag_seen = B_TRUE; 6958 6959 /* Still got holes? */ 6960 if (ipf->ipf_hole_cnt) 6961 return (IP_REASS_PARTIAL); 6962 /* Clean up overloaded fields to avoid upstream disasters. */ 6963 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) { 6964 IP_REASS_SET_START(mp1, 0); 6965 IP_REASS_SET_END(mp1, 0); 6966 } 6967 return (IP_REASS_COMPLETE); 6968 } 6969 6970 /* 6971 * Fragmentation reassembly. Each ILL has a hash table for 6972 * queuing packets undergoing reassembly for all IPIFs 6973 * associated with the ILL. The hash is based on the packet 6974 * IP ident field. The ILL frag hash table was allocated 6975 * as a timer block at the time the ILL was created. Whenever 6976 * there is anything on the reassembly queue, the timer will 6977 * be running. Returns the reassembled packet if reassembly completes. 6978 */ 6979 mblk_t * 6980 ip_input_fragment(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira) 6981 { 6982 uint32_t frag_offset_flags; 6983 mblk_t *t_mp; 6984 ipaddr_t dst; 6985 uint8_t proto = ipha->ipha_protocol; 6986 uint32_t sum_val; 6987 uint16_t sum_flags; 6988 ipf_t *ipf; 6989 ipf_t **ipfp; 6990 ipfb_t *ipfb; 6991 uint16_t ident; 6992 uint32_t offset; 6993 ipaddr_t src; 6994 uint_t hdr_length; 6995 uint32_t end; 6996 mblk_t *mp1; 6997 mblk_t *tail_mp; 6998 size_t count; 6999 size_t msg_len; 7000 uint8_t ecn_info = 0; 7001 uint32_t packet_size; 7002 boolean_t pruned = B_FALSE; 7003 ill_t *ill = ira->ira_ill; 7004 ip_stack_t *ipst = ill->ill_ipst; 7005 7006 /* 7007 * Drop the fragmented as early as possible, if 7008 * we don't have resource(s) to re-assemble. 7009 */ 7010 if (ipst->ips_ip_reass_queue_bytes == 0) { 7011 freemsg(mp); 7012 return (NULL); 7013 } 7014 7015 /* Check for fragmentation offset; return if there's none */ 7016 if ((frag_offset_flags = ntohs(ipha->ipha_fragment_offset_and_flags) & 7017 (IPH_MF | IPH_OFFSET)) == 0) 7018 return (mp); 7019 7020 /* 7021 * We utilize hardware computed checksum info only for UDP since 7022 * IP fragmentation is a normal occurrence for the protocol. In 7023 * addition, checksum offload support for IP fragments carrying 7024 * UDP payload is commonly implemented across network adapters. 7025 */ 7026 ASSERT(ira->ira_rill != NULL); 7027 if (proto == IPPROTO_UDP && dohwcksum && 7028 ILL_HCKSUM_CAPABLE(ira->ira_rill) && 7029 (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) { 7030 mblk_t *mp1 = mp->b_cont; 7031 int32_t len; 7032 7033 /* Record checksum information from the packet */ 7034 sum_val = (uint32_t)DB_CKSUM16(mp); 7035 sum_flags = DB_CKSUMFLAGS(mp); 7036 7037 /* IP payload offset from beginning of mblk */ 7038 offset = ((uchar_t *)ipha + IPH_HDR_LENGTH(ipha)) - mp->b_rptr; 7039 7040 if ((sum_flags & HCK_PARTIALCKSUM) && 7041 (mp1 == NULL || mp1->b_cont == NULL) && 7042 offset >= DB_CKSUMSTART(mp) && 7043 ((len = offset - DB_CKSUMSTART(mp)) & 1) == 0) { 7044 uint32_t adj; 7045 /* 7046 * Partial checksum has been calculated by hardware 7047 * and attached to the packet; in addition, any 7048 * prepended extraneous data is even byte aligned. 7049 * If any such data exists, we adjust the checksum; 7050 * this would also handle any postpended data. 7051 */ 7052 IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp), 7053 mp, mp1, len, adj); 7054 7055 /* One's complement subtract extraneous checksum */ 7056 if (adj >= sum_val) 7057 sum_val = ~(adj - sum_val) & 0xFFFF; 7058 else 7059 sum_val -= adj; 7060 } 7061 } else { 7062 sum_val = 0; 7063 sum_flags = 0; 7064 } 7065 7066 /* Clear hardware checksumming flag */ 7067 DB_CKSUMFLAGS(mp) = 0; 7068 7069 ident = ipha->ipha_ident; 7070 offset = (frag_offset_flags << 3) & 0xFFFF; 7071 src = ipha->ipha_src; 7072 dst = ipha->ipha_dst; 7073 hdr_length = IPH_HDR_LENGTH(ipha); 7074 end = ntohs(ipha->ipha_length) - hdr_length; 7075 7076 /* If end == 0 then we have a packet with no data, so just free it */ 7077 if (end == 0) { 7078 freemsg(mp); 7079 return (NULL); 7080 } 7081 7082 /* Record the ECN field info. */ 7083 ecn_info = (ipha->ipha_type_of_service & 0x3); 7084 if (offset != 0) { 7085 /* 7086 * If this isn't the first piece, strip the header, and 7087 * add the offset to the end value. 7088 */ 7089 mp->b_rptr += hdr_length; 7090 end += offset; 7091 } 7092 7093 /* Handle vnic loopback of fragments */ 7094 if (mp->b_datap->db_ref > 2) 7095 msg_len = 0; 7096 else 7097 msg_len = MBLKSIZE(mp); 7098 7099 tail_mp = mp; 7100 while (tail_mp->b_cont != NULL) { 7101 tail_mp = tail_mp->b_cont; 7102 if (tail_mp->b_datap->db_ref <= 2) 7103 msg_len += MBLKSIZE(tail_mp); 7104 } 7105 7106 /* If the reassembly list for this ILL will get too big, prune it */ 7107 if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >= 7108 ipst->ips_ip_reass_queue_bytes) { 7109 DTRACE_PROBE3(ip_reass_queue_bytes, uint_t, msg_len, 7110 uint_t, ill->ill_frag_count, 7111 uint_t, ipst->ips_ip_reass_queue_bytes); 7112 ill_frag_prune(ill, 7113 (ipst->ips_ip_reass_queue_bytes < msg_len) ? 0 : 7114 (ipst->ips_ip_reass_queue_bytes - msg_len)); 7115 pruned = B_TRUE; 7116 } 7117 7118 ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH(src, ident)]; 7119 mutex_enter(&ipfb->ipfb_lock); 7120 7121 ipfp = &ipfb->ipfb_ipf; 7122 /* Try to find an existing fragment queue for this packet. */ 7123 for (;;) { 7124 ipf = ipfp[0]; 7125 if (ipf != NULL) { 7126 /* 7127 * It has to match on ident and src/dst address. 7128 */ 7129 if (ipf->ipf_ident == ident && 7130 ipf->ipf_src == src && 7131 ipf->ipf_dst == dst && 7132 ipf->ipf_protocol == proto) { 7133 /* 7134 * If we have received too many 7135 * duplicate fragments for this packet 7136 * free it. 7137 */ 7138 if (ipf->ipf_num_dups > ip_max_frag_dups) { 7139 ill_frag_free_pkts(ill, ipfb, ipf, 1); 7140 freemsg(mp); 7141 mutex_exit(&ipfb->ipfb_lock); 7142 return (NULL); 7143 } 7144 /* Found it. */ 7145 break; 7146 } 7147 ipfp = &ipf->ipf_hash_next; 7148 continue; 7149 } 7150 7151 /* 7152 * If we pruned the list, do we want to store this new 7153 * fragment?. We apply an optimization here based on the 7154 * fact that most fragments will be received in order. 7155 * So if the offset of this incoming fragment is zero, 7156 * it is the first fragment of a new packet. We will 7157 * keep it. Otherwise drop the fragment, as we have 7158 * probably pruned the packet already (since the 7159 * packet cannot be found). 7160 */ 7161 if (pruned && offset != 0) { 7162 mutex_exit(&ipfb->ipfb_lock); 7163 freemsg(mp); 7164 return (NULL); 7165 } 7166 7167 if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS(ipst)) { 7168 /* 7169 * Too many fragmented packets in this hash 7170 * bucket. Free the oldest. 7171 */ 7172 ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1); 7173 } 7174 7175 /* New guy. Allocate a frag message. */ 7176 mp1 = allocb(sizeof (*ipf), BPRI_MED); 7177 if (mp1 == NULL) { 7178 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 7179 ip_drop_input("ipIfStatsInDiscards", mp, ill); 7180 freemsg(mp); 7181 reass_done: 7182 mutex_exit(&ipfb->ipfb_lock); 7183 return (NULL); 7184 } 7185 7186 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmReqds); 7187 mp1->b_cont = mp; 7188 7189 /* Initialize the fragment header. */ 7190 ipf = (ipf_t *)mp1->b_rptr; 7191 ipf->ipf_mp = mp1; 7192 ipf->ipf_ptphn = ipfp; 7193 ipfp[0] = ipf; 7194 ipf->ipf_hash_next = NULL; 7195 ipf->ipf_ident = ident; 7196 ipf->ipf_protocol = proto; 7197 ipf->ipf_src = src; 7198 ipf->ipf_dst = dst; 7199 ipf->ipf_nf_hdr_len = 0; 7200 /* Record reassembly start time. */ 7201 ipf->ipf_timestamp = gethrestime_sec(); 7202 /* Record ipf generation and account for frag header */ 7203 ipf->ipf_gen = ill->ill_ipf_gen++; 7204 ipf->ipf_count = MBLKSIZE(mp1); 7205 ipf->ipf_last_frag_seen = B_FALSE; 7206 ipf->ipf_ecn = ecn_info; 7207 ipf->ipf_num_dups = 0; 7208 ipfb->ipfb_frag_pkts++; 7209 ipf->ipf_checksum = 0; 7210 ipf->ipf_checksum_flags = 0; 7211 7212 /* Store checksum value in fragment header */ 7213 if (sum_flags != 0) { 7214 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 7215 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 7216 ipf->ipf_checksum = sum_val; 7217 ipf->ipf_checksum_flags = sum_flags; 7218 } 7219 7220 /* 7221 * We handle reassembly two ways. In the easy case, 7222 * where all the fragments show up in order, we do 7223 * minimal bookkeeping, and just clip new pieces on 7224 * the end. If we ever see a hole, then we go off 7225 * to ip_reassemble which has to mark the pieces and 7226 * keep track of the number of holes, etc. Obviously, 7227 * the point of having both mechanisms is so we can 7228 * handle the easy case as efficiently as possible. 7229 */ 7230 if (offset == 0) { 7231 /* Easy case, in-order reassembly so far. */ 7232 ipf->ipf_count += msg_len; 7233 ipf->ipf_tail_mp = tail_mp; 7234 /* 7235 * Keep track of next expected offset in 7236 * ipf_end. 7237 */ 7238 ipf->ipf_end = end; 7239 ipf->ipf_nf_hdr_len = hdr_length; 7240 } else { 7241 /* Hard case, hole at the beginning. */ 7242 ipf->ipf_tail_mp = NULL; 7243 /* 7244 * ipf_end == 0 means that we have given up 7245 * on easy reassembly. 7246 */ 7247 ipf->ipf_end = 0; 7248 7249 /* Forget checksum offload from now on */ 7250 ipf->ipf_checksum_flags = 0; 7251 7252 /* 7253 * ipf_hole_cnt is set by ip_reassemble. 7254 * ipf_count is updated by ip_reassemble. 7255 * No need to check for return value here 7256 * as we don't expect reassembly to complete 7257 * or fail for the first fragment itself. 7258 */ 7259 (void) ip_reassemble(mp, ipf, 7260 (frag_offset_flags & IPH_OFFSET) << 3, 7261 (frag_offset_flags & IPH_MF), ill, msg_len); 7262 } 7263 /* Update per ipfb and ill byte counts */ 7264 ipfb->ipfb_count += ipf->ipf_count; 7265 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */ 7266 atomic_add_32(&ill->ill_frag_count, ipf->ipf_count); 7267 /* If the frag timer wasn't already going, start it. */ 7268 mutex_enter(&ill->ill_lock); 7269 ill_frag_timer_start(ill); 7270 mutex_exit(&ill->ill_lock); 7271 goto reass_done; 7272 } 7273 7274 /* 7275 * If the packet's flag has changed (it could be coming up 7276 * from an interface different than the previous, therefore 7277 * possibly different checksum capability), then forget about 7278 * any stored checksum states. Otherwise add the value to 7279 * the existing one stored in the fragment header. 7280 */ 7281 if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) { 7282 sum_val += ipf->ipf_checksum; 7283 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 7284 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 7285 ipf->ipf_checksum = sum_val; 7286 } else if (ipf->ipf_checksum_flags != 0) { 7287 /* Forget checksum offload from now on */ 7288 ipf->ipf_checksum_flags = 0; 7289 } 7290 7291 /* 7292 * We have a new piece of a datagram which is already being 7293 * reassembled. Update the ECN info if all IP fragments 7294 * are ECN capable. If there is one which is not, clear 7295 * all the info. If there is at least one which has CE 7296 * code point, IP needs to report that up to transport. 7297 */ 7298 if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) { 7299 if (ecn_info == IPH_ECN_CE) 7300 ipf->ipf_ecn = IPH_ECN_CE; 7301 } else { 7302 ipf->ipf_ecn = IPH_ECN_NECT; 7303 } 7304 if (offset && ipf->ipf_end == offset) { 7305 /* The new fragment fits at the end */ 7306 ipf->ipf_tail_mp->b_cont = mp; 7307 /* Update the byte count */ 7308 ipf->ipf_count += msg_len; 7309 /* Update per ipfb and ill byte counts */ 7310 ipfb->ipfb_count += msg_len; 7311 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */ 7312 atomic_add_32(&ill->ill_frag_count, msg_len); 7313 if (frag_offset_flags & IPH_MF) { 7314 /* More to come. */ 7315 ipf->ipf_end = end; 7316 ipf->ipf_tail_mp = tail_mp; 7317 goto reass_done; 7318 } 7319 } else { 7320 /* Go do the hard cases. */ 7321 int ret; 7322 7323 if (offset == 0) 7324 ipf->ipf_nf_hdr_len = hdr_length; 7325 7326 /* Save current byte count */ 7327 count = ipf->ipf_count; 7328 ret = ip_reassemble(mp, ipf, 7329 (frag_offset_flags & IPH_OFFSET) << 3, 7330 (frag_offset_flags & IPH_MF), ill, msg_len); 7331 /* Count of bytes added and subtracted (freeb()ed) */ 7332 count = ipf->ipf_count - count; 7333 if (count) { 7334 /* Update per ipfb and ill byte counts */ 7335 ipfb->ipfb_count += count; 7336 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */ 7337 atomic_add_32(&ill->ill_frag_count, count); 7338 } 7339 if (ret == IP_REASS_PARTIAL) { 7340 goto reass_done; 7341 } else if (ret == IP_REASS_FAILED) { 7342 /* Reassembly failed. Free up all resources */ 7343 ill_frag_free_pkts(ill, ipfb, ipf, 1); 7344 for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) { 7345 IP_REASS_SET_START(t_mp, 0); 7346 IP_REASS_SET_END(t_mp, 0); 7347 } 7348 freemsg(mp); 7349 goto reass_done; 7350 } 7351 /* We will reach here iff 'ret' is IP_REASS_COMPLETE */ 7352 } 7353 /* 7354 * We have completed reassembly. Unhook the frag header from 7355 * the reassembly list. 7356 * 7357 * Before we free the frag header, record the ECN info 7358 * to report back to the transport. 7359 */ 7360 ecn_info = ipf->ipf_ecn; 7361 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmOKs); 7362 ipfp = ipf->ipf_ptphn; 7363 7364 /* We need to supply these to caller */ 7365 if ((sum_flags = ipf->ipf_checksum_flags) != 0) 7366 sum_val = ipf->ipf_checksum; 7367 else 7368 sum_val = 0; 7369 7370 mp1 = ipf->ipf_mp; 7371 count = ipf->ipf_count; 7372 ipf = ipf->ipf_hash_next; 7373 if (ipf != NULL) 7374 ipf->ipf_ptphn = ipfp; 7375 ipfp[0] = ipf; 7376 atomic_add_32(&ill->ill_frag_count, -count); 7377 ASSERT(ipfb->ipfb_count >= count); 7378 ipfb->ipfb_count -= count; 7379 ipfb->ipfb_frag_pkts--; 7380 mutex_exit(&ipfb->ipfb_lock); 7381 /* Ditch the frag header. */ 7382 mp = mp1->b_cont; 7383 7384 freeb(mp1); 7385 7386 /* Restore original IP length in header. */ 7387 packet_size = (uint32_t)msgdsize(mp); 7388 if (packet_size > IP_MAXPACKET) { 7389 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7390 ip_drop_input("Reassembled packet too large", mp, ill); 7391 freemsg(mp); 7392 return (NULL); 7393 } 7394 7395 if (DB_REF(mp) > 1) { 7396 mblk_t *mp2 = copymsg(mp); 7397 7398 if (mp2 == NULL) { 7399 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 7400 ip_drop_input("ipIfStatsInDiscards", mp, ill); 7401 freemsg(mp); 7402 return (NULL); 7403 } 7404 freemsg(mp); 7405 mp = mp2; 7406 } 7407 ipha = (ipha_t *)mp->b_rptr; 7408 7409 ipha->ipha_length = htons((uint16_t)packet_size); 7410 /* We're now complete, zip the frag state */ 7411 ipha->ipha_fragment_offset_and_flags = 0; 7412 /* Record the ECN info. */ 7413 ipha->ipha_type_of_service &= 0xFC; 7414 ipha->ipha_type_of_service |= ecn_info; 7415 7416 /* Update the receive attributes */ 7417 ira->ira_pktlen = packet_size; 7418 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha); 7419 7420 /* Reassembly is successful; set checksum information in packet */ 7421 DB_CKSUM16(mp) = (uint16_t)sum_val; 7422 DB_CKSUMFLAGS(mp) = sum_flags; 7423 DB_CKSUMSTART(mp) = ira->ira_ip_hdr_length; 7424 7425 return (mp); 7426 } 7427 7428 /* 7429 * Pullup function that should be used for IP input in order to 7430 * ensure we do not loose the L2 source address; we need the l2 source 7431 * address for IP_RECVSLLA and for ndp_input. 7432 * 7433 * We return either NULL or b_rptr. 7434 */ 7435 void * 7436 ip_pullup(mblk_t *mp, ssize_t len, ip_recv_attr_t *ira) 7437 { 7438 ill_t *ill = ira->ira_ill; 7439 7440 if (ip_rput_pullups++ == 0) { 7441 (void) mi_strlog(ill->ill_rq, 1, SL_ERROR|SL_TRACE, 7442 "ip_pullup: %s forced us to " 7443 " pullup pkt, hdr len %ld, hdr addr %p", 7444 ill->ill_name, len, (void *)mp->b_rptr); 7445 } 7446 if (!(ira->ira_flags & IRAF_L2SRC_SET)) 7447 ip_setl2src(mp, ira, ira->ira_rill); 7448 ASSERT(ira->ira_flags & IRAF_L2SRC_SET); 7449 if (!pullupmsg(mp, len)) 7450 return (NULL); 7451 else 7452 return (mp->b_rptr); 7453 } 7454 7455 /* 7456 * Make sure ira_l2src has an address. If we don't have one fill with zeros. 7457 * When called from the ULP ira_rill will be NULL hence the caller has to 7458 * pass in the ill. 7459 */ 7460 /* ARGSUSED */ 7461 void 7462 ip_setl2src(mblk_t *mp, ip_recv_attr_t *ira, ill_t *ill) 7463 { 7464 const uchar_t *addr; 7465 int alen; 7466 7467 if (ira->ira_flags & IRAF_L2SRC_SET) 7468 return; 7469 7470 ASSERT(ill != NULL); 7471 alen = ill->ill_phys_addr_length; 7472 ASSERT(alen <= sizeof (ira->ira_l2src)); 7473 if (ira->ira_mhip != NULL && 7474 (addr = ira->ira_mhip->mhi_saddr) != NULL) { 7475 bcopy(addr, ira->ira_l2src, alen); 7476 } else if ((ira->ira_flags & IRAF_L2SRC_LOOPBACK) && 7477 (addr = ill->ill_phys_addr) != NULL) { 7478 bcopy(addr, ira->ira_l2src, alen); 7479 } else { 7480 bzero(ira->ira_l2src, alen); 7481 } 7482 ira->ira_flags |= IRAF_L2SRC_SET; 7483 } 7484 7485 /* 7486 * check ip header length and align it. 7487 */ 7488 mblk_t * 7489 ip_check_and_align_header(mblk_t *mp, uint_t min_size, ip_recv_attr_t *ira) 7490 { 7491 ill_t *ill = ira->ira_ill; 7492 ssize_t len; 7493 7494 len = MBLKL(mp); 7495 7496 if (!OK_32PTR(mp->b_rptr)) 7497 IP_STAT(ill->ill_ipst, ip_notaligned); 7498 else 7499 IP_STAT(ill->ill_ipst, ip_recv_pullup); 7500 7501 /* Guard against bogus device drivers */ 7502 if (len < 0) { 7503 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7504 ip_drop_input("ipIfStatsInHdrErrors", mp, ill); 7505 freemsg(mp); 7506 return (NULL); 7507 } 7508 7509 if (len == 0) { 7510 /* GLD sometimes sends up mblk with b_rptr == b_wptr! */ 7511 mblk_t *mp1 = mp->b_cont; 7512 7513 if (!(ira->ira_flags & IRAF_L2SRC_SET)) 7514 ip_setl2src(mp, ira, ira->ira_rill); 7515 ASSERT(ira->ira_flags & IRAF_L2SRC_SET); 7516 7517 freeb(mp); 7518 mp = mp1; 7519 if (mp == NULL) 7520 return (NULL); 7521 7522 if (OK_32PTR(mp->b_rptr) && MBLKL(mp) >= min_size) 7523 return (mp); 7524 } 7525 if (ip_pullup(mp, min_size, ira) == NULL) { 7526 if (msgdsize(mp) < min_size) { 7527 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7528 ip_drop_input("ipIfStatsInHdrErrors", mp, ill); 7529 } else { 7530 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 7531 ip_drop_input("ipIfStatsInDiscards", mp, ill); 7532 } 7533 freemsg(mp); 7534 return (NULL); 7535 } 7536 return (mp); 7537 } 7538 7539 /* 7540 * Common code for IPv4 and IPv6 to check and pullup multi-mblks 7541 */ 7542 mblk_t * 7543 ip_check_length(mblk_t *mp, uchar_t *rptr, ssize_t len, uint_t pkt_len, 7544 uint_t min_size, ip_recv_attr_t *ira) 7545 { 7546 ill_t *ill = ira->ira_ill; 7547 7548 /* 7549 * Make sure we have data length consistent 7550 * with the IP header. 7551 */ 7552 if (mp->b_cont == NULL) { 7553 /* pkt_len is based on ipha_len, not the mblk length */ 7554 if (pkt_len < min_size) { 7555 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7556 ip_drop_input("ipIfStatsInHdrErrors", mp, ill); 7557 freemsg(mp); 7558 return (NULL); 7559 } 7560 if (len < 0) { 7561 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts); 7562 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill); 7563 freemsg(mp); 7564 return (NULL); 7565 } 7566 /* Drop any pad */ 7567 mp->b_wptr = rptr + pkt_len; 7568 } else if ((len += msgdsize(mp->b_cont)) != 0) { 7569 ASSERT(pkt_len >= min_size); 7570 if (pkt_len < min_size) { 7571 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7572 ip_drop_input("ipIfStatsInHdrErrors", mp, ill); 7573 freemsg(mp); 7574 return (NULL); 7575 } 7576 if (len < 0) { 7577 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts); 7578 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill); 7579 freemsg(mp); 7580 return (NULL); 7581 } 7582 /* Drop any pad */ 7583 (void) adjmsg(mp, -len); 7584 /* 7585 * adjmsg may have freed an mblk from the chain, hence 7586 * invalidate any hw checksum here. This will force IP to 7587 * calculate the checksum in sw, but only for this packet. 7588 */ 7589 DB_CKSUMFLAGS(mp) = 0; 7590 IP_STAT(ill->ill_ipst, ip_multimblk); 7591 } 7592 return (mp); 7593 } 7594 7595 /* 7596 * Check that the IPv4 opt_len is consistent with the packet and pullup 7597 * the options. 7598 */ 7599 mblk_t * 7600 ip_check_optlen(mblk_t *mp, ipha_t *ipha, uint_t opt_len, uint_t pkt_len, 7601 ip_recv_attr_t *ira) 7602 { 7603 ill_t *ill = ira->ira_ill; 7604 ssize_t len; 7605 7606 /* Assume no IPv6 packets arrive over the IPv4 queue */ 7607 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) { 7608 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7609 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInWrongIPVersion); 7610 ip_drop_input("IPvN packet on IPv4 ill", mp, ill); 7611 freemsg(mp); 7612 return (NULL); 7613 } 7614 7615 if (opt_len > (15 - IP_SIMPLE_HDR_LENGTH_IN_WORDS)) { 7616 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7617 ip_drop_input("ipIfStatsInHdrErrors", mp, ill); 7618 freemsg(mp); 7619 return (NULL); 7620 } 7621 /* 7622 * Recompute complete header length and make sure we 7623 * have access to all of it. 7624 */ 7625 len = ((size_t)opt_len + IP_SIMPLE_HDR_LENGTH_IN_WORDS) << 2; 7626 if (len > (mp->b_wptr - mp->b_rptr)) { 7627 if (len > pkt_len) { 7628 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 7629 ip_drop_input("ipIfStatsInHdrErrors", mp, ill); 7630 freemsg(mp); 7631 return (NULL); 7632 } 7633 if (ip_pullup(mp, len, ira) == NULL) { 7634 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 7635 ip_drop_input("ipIfStatsInDiscards", mp, ill); 7636 freemsg(mp); 7637 return (NULL); 7638 } 7639 } 7640 return (mp); 7641 } 7642 7643 /* 7644 * Returns a new ire, or the same ire, or NULL. 7645 * If a different IRE is returned, then it is held; the caller 7646 * needs to release it. 7647 * In no case is there any hold/release on the ire argument. 7648 */ 7649 ire_t * 7650 ip_check_multihome(void *addr, ire_t *ire, ill_t *ill) 7651 { 7652 ire_t *new_ire; 7653 ill_t *ire_ill; 7654 uint_t ifindex; 7655 ip_stack_t *ipst = ill->ill_ipst; 7656 boolean_t strict_check = B_FALSE; 7657 7658 /* 7659 * IPMP common case: if IRE and ILL are in the same group, there's no 7660 * issue (e.g. packet received on an underlying interface matched an 7661 * IRE_LOCAL on its associated group interface). 7662 */ 7663 ASSERT(ire->ire_ill != NULL); 7664 if (IS_IN_SAME_ILLGRP(ill, ire->ire_ill)) 7665 return (ire); 7666 7667 /* 7668 * Do another ire lookup here, using the ingress ill, to see if the 7669 * interface is in a usesrc group. 7670 * As long as the ills belong to the same group, we don't consider 7671 * them to be arriving on the wrong interface. Thus, if the switch 7672 * is doing inbound load spreading, we won't drop packets when the 7673 * ip*_strict_dst_multihoming switch is on. 7674 * We also need to check for IPIF_UNNUMBERED point2point interfaces 7675 * where the local address may not be unique. In this case we were 7676 * at the mercy of the initial ire lookup and the IRE_LOCAL it 7677 * actually returned. The new lookup, which is more specific, should 7678 * only find the IRE_LOCAL associated with the ingress ill if one 7679 * exists. 7680 */ 7681 if (ire->ire_ipversion == IPV4_VERSION) { 7682 if (ipst->ips_ip_strict_dst_multihoming) 7683 strict_check = B_TRUE; 7684 new_ire = ire_ftable_lookup_v4(*((ipaddr_t *)addr), 0, 0, 7685 IRE_LOCAL, ill, ALL_ZONES, NULL, 7686 (MATCH_IRE_TYPE|MATCH_IRE_ILL), 0, ipst, NULL); 7687 } else { 7688 ASSERT(!IN6_IS_ADDR_MULTICAST((in6_addr_t *)addr)); 7689 if (ipst->ips_ipv6_strict_dst_multihoming) 7690 strict_check = B_TRUE; 7691 new_ire = ire_ftable_lookup_v6((in6_addr_t *)addr, NULL, NULL, 7692 IRE_LOCAL, ill, ALL_ZONES, NULL, 7693 (MATCH_IRE_TYPE|MATCH_IRE_ILL), 0, ipst, NULL); 7694 } 7695 /* 7696 * If the same ire that was returned in ip_input() is found then this 7697 * is an indication that usesrc groups are in use. The packet 7698 * arrived on a different ill in the group than the one associated with 7699 * the destination address. If a different ire was found then the same 7700 * IP address must be hosted on multiple ills. This is possible with 7701 * unnumbered point2point interfaces. We switch to use this new ire in 7702 * order to have accurate interface statistics. 7703 */ 7704 if (new_ire != NULL) { 7705 /* Note: held in one case but not the other? Caller handles */ 7706 if (new_ire != ire) 7707 return (new_ire); 7708 /* Unchanged */ 7709 ire_refrele(new_ire); 7710 return (ire); 7711 } 7712 7713 /* 7714 * Chase pointers once and store locally. 7715 */ 7716 ASSERT(ire->ire_ill != NULL); 7717 ire_ill = ire->ire_ill; 7718 ifindex = ill->ill_usesrc_ifindex; 7719 7720 /* 7721 * Check if it's a legal address on the 'usesrc' interface. 7722 * For IPMP data addresses the IRE_LOCAL is the upper, hence we 7723 * can just check phyint_ifindex. 7724 */ 7725 if (ifindex != 0 && ifindex == ire_ill->ill_phyint->phyint_ifindex) { 7726 return (ire); 7727 } 7728 7729 /* 7730 * If the ip*_strict_dst_multihoming switch is on then we can 7731 * only accept this packet if the interface is marked as routing. 7732 */ 7733 if (!(strict_check)) 7734 return (ire); 7735 7736 if ((ill->ill_flags & ire->ire_ill->ill_flags & ILLF_ROUTER) != 0) { 7737 return (ire); 7738 } 7739 return (NULL); 7740 } 7741 7742 /* 7743 * This function is used to construct a mac_header_info_s from a 7744 * DL_UNITDATA_IND message. 7745 * The address fields in the mhi structure points into the message, 7746 * thus the caller can't use those fields after freeing the message. 7747 * 7748 * We determine whether the packet received is a non-unicast packet 7749 * and in doing so, determine whether or not it is broadcast vs multicast. 7750 * For it to be a broadcast packet, we must have the appropriate mblk_t 7751 * hanging off the ill_t. If this is either not present or doesn't match 7752 * the destination mac address in the DL_UNITDATA_IND, the packet is deemed 7753 * to be multicast. Thus NICs that have no broadcast address (or no 7754 * capability for one, such as point to point links) cannot return as 7755 * the packet being broadcast. 7756 */ 7757 void 7758 ip_dlur_to_mhi(ill_t *ill, mblk_t *mb, struct mac_header_info_s *mhip) 7759 { 7760 dl_unitdata_ind_t *ind = (dl_unitdata_ind_t *)mb->b_rptr; 7761 mblk_t *bmp; 7762 uint_t extra_offset; 7763 7764 bzero(mhip, sizeof (struct mac_header_info_s)); 7765 7766 mhip->mhi_dsttype = MAC_ADDRTYPE_UNICAST; 7767 7768 if (ill->ill_sap_length < 0) 7769 extra_offset = 0; 7770 else 7771 extra_offset = ill->ill_sap_length; 7772 7773 mhip->mhi_daddr = (uchar_t *)ind + ind->dl_dest_addr_offset + 7774 extra_offset; 7775 mhip->mhi_saddr = (uchar_t *)ind + ind->dl_src_addr_offset + 7776 extra_offset; 7777 7778 if (!ind->dl_group_address) 7779 return; 7780 7781 /* Multicast or broadcast */ 7782 mhip->mhi_dsttype = MAC_ADDRTYPE_MULTICAST; 7783 7784 if (ind->dl_dest_addr_offset > sizeof (*ind) && 7785 ind->dl_dest_addr_offset + ind->dl_dest_addr_length < MBLKL(mb) && 7786 (bmp = ill->ill_bcast_mp) != NULL) { 7787 dl_unitdata_req_t *dlur; 7788 uint8_t *bphys_addr; 7789 7790 dlur = (dl_unitdata_req_t *)bmp->b_rptr; 7791 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset + 7792 extra_offset; 7793 7794 if (bcmp(mhip->mhi_daddr, bphys_addr, 7795 ind->dl_dest_addr_length) == 0) 7796 mhip->mhi_dsttype = MAC_ADDRTYPE_BROADCAST; 7797 } 7798 } 7799 7800 /* 7801 * This function is used to construct a mac_header_info_s from a 7802 * M_DATA fastpath message from a DLPI driver. 7803 * The address fields in the mhi structure points into the message, 7804 * thus the caller can't use those fields after freeing the message. 7805 * 7806 * We determine whether the packet received is a non-unicast packet 7807 * and in doing so, determine whether or not it is broadcast vs multicast. 7808 * For it to be a broadcast packet, we must have the appropriate mblk_t 7809 * hanging off the ill_t. If this is either not present or doesn't match 7810 * the destination mac address in the DL_UNITDATA_IND, the packet is deemed 7811 * to be multicast. Thus NICs that have no broadcast address (or no 7812 * capability for one, such as point to point links) cannot return as 7813 * the packet being broadcast. 7814 */ 7815 void 7816 ip_mdata_to_mhi(ill_t *ill, mblk_t *mp, struct mac_header_info_s *mhip) 7817 { 7818 mblk_t *bmp; 7819 struct ether_header *pether; 7820 7821 bzero(mhip, sizeof (struct mac_header_info_s)); 7822 7823 mhip->mhi_dsttype = MAC_ADDRTYPE_UNICAST; 7824 7825 pether = (struct ether_header *)((char *)mp->b_rptr 7826 - sizeof (struct ether_header)); 7827 7828 /* 7829 * Make sure the interface is an ethernet type, since we don't 7830 * know the header format for anything but Ethernet. Also make 7831 * sure we are pointing correctly above db_base. 7832 */ 7833 if (ill->ill_type != IFT_ETHER) 7834 return; 7835 7836 retry: 7837 if ((uchar_t *)pether < mp->b_datap->db_base) 7838 return; 7839 7840 /* Is there a VLAN tag? */ 7841 if (ill->ill_isv6) { 7842 if (pether->ether_type != htons(ETHERTYPE_IPV6)) { 7843 pether = (struct ether_header *)((char *)pether - 4); 7844 goto retry; 7845 } 7846 } else { 7847 if (pether->ether_type != htons(ETHERTYPE_IP)) { 7848 pether = (struct ether_header *)((char *)pether - 4); 7849 goto retry; 7850 } 7851 } 7852 mhip->mhi_daddr = (uchar_t *)&pether->ether_dhost; 7853 mhip->mhi_saddr = (uchar_t *)&pether->ether_shost; 7854 7855 if (!(mhip->mhi_daddr[0] & 0x01)) 7856 return; 7857 7858 /* Multicast or broadcast */ 7859 mhip->mhi_dsttype = MAC_ADDRTYPE_MULTICAST; 7860 7861 if ((bmp = ill->ill_bcast_mp) != NULL) { 7862 dl_unitdata_req_t *dlur; 7863 uint8_t *bphys_addr; 7864 uint_t addrlen; 7865 7866 dlur = (dl_unitdata_req_t *)bmp->b_rptr; 7867 addrlen = dlur->dl_dest_addr_length; 7868 if (ill->ill_sap_length < 0) { 7869 bphys_addr = (uchar_t *)dlur + 7870 dlur->dl_dest_addr_offset; 7871 addrlen += ill->ill_sap_length; 7872 } else { 7873 bphys_addr = (uchar_t *)dlur + 7874 dlur->dl_dest_addr_offset + 7875 ill->ill_sap_length; 7876 addrlen -= ill->ill_sap_length; 7877 } 7878 if (bcmp(mhip->mhi_daddr, bphys_addr, addrlen) == 0) 7879 mhip->mhi_dsttype = MAC_ADDRTYPE_BROADCAST; 7880 } 7881 } 7882 7883 /* 7884 * Handle anything but M_DATA messages 7885 * We see the DL_UNITDATA_IND which are part 7886 * of the data path, and also the other messages from the driver. 7887 */ 7888 void 7889 ip_rput_notdata(ill_t *ill, mblk_t *mp) 7890 { 7891 mblk_t *first_mp; 7892 struct iocblk *iocp; 7893 struct mac_header_info_s mhi; 7894 7895 switch (DB_TYPE(mp)) { 7896 case M_PROTO: 7897 case M_PCPROTO: { 7898 if (((dl_unitdata_ind_t *)mp->b_rptr)->dl_primitive != 7899 DL_UNITDATA_IND) { 7900 /* Go handle anything other than data elsewhere. */ 7901 ip_rput_dlpi(ill, mp); 7902 return; 7903 } 7904 7905 first_mp = mp; 7906 mp = first_mp->b_cont; 7907 first_mp->b_cont = NULL; 7908 7909 if (mp == NULL) { 7910 freeb(first_mp); 7911 return; 7912 } 7913 ip_dlur_to_mhi(ill, first_mp, &mhi); 7914 if (ill->ill_isv6) 7915 ip_input_v6(ill, NULL, mp, &mhi); 7916 else 7917 ip_input(ill, NULL, mp, &mhi); 7918 7919 /* Ditch the DLPI header. */ 7920 freeb(first_mp); 7921 return; 7922 } 7923 case M_IOCACK: 7924 iocp = (struct iocblk *)mp->b_rptr; 7925 switch (iocp->ioc_cmd) { 7926 case DL_IOC_HDR_INFO: 7927 ill_fastpath_ack(ill, mp); 7928 return; 7929 default: 7930 putnext(ill->ill_rq, mp); 7931 return; 7932 } 7933 /* FALLTHRU */ 7934 case M_ERROR: 7935 case M_HANGUP: 7936 mutex_enter(&ill->ill_lock); 7937 if (ill->ill_state_flags & ILL_CONDEMNED) { 7938 mutex_exit(&ill->ill_lock); 7939 freemsg(mp); 7940 return; 7941 } 7942 ill_refhold_locked(ill); 7943 mutex_exit(&ill->ill_lock); 7944 qwriter_ip(ill, ill->ill_rq, mp, ip_rput_other, CUR_OP, 7945 B_FALSE); 7946 return; 7947 case M_CTL: 7948 putnext(ill->ill_rq, mp); 7949 return; 7950 case M_IOCNAK: 7951 ip1dbg(("got iocnak ")); 7952 iocp = (struct iocblk *)mp->b_rptr; 7953 switch (iocp->ioc_cmd) { 7954 case DL_IOC_HDR_INFO: 7955 ip_rput_other(NULL, ill->ill_rq, mp, NULL); 7956 return; 7957 default: 7958 break; 7959 } 7960 /* FALLTHRU */ 7961 default: 7962 putnext(ill->ill_rq, mp); 7963 return; 7964 } 7965 } 7966 7967 /* Read side put procedure. Packets coming from the wire arrive here. */ 7968 void 7969 ip_rput(queue_t *q, mblk_t *mp) 7970 { 7971 ill_t *ill; 7972 union DL_primitives *dl; 7973 7974 ill = (ill_t *)q->q_ptr; 7975 7976 if (ill->ill_state_flags & (ILL_CONDEMNED | ILL_LL_SUBNET_PENDING)) { 7977 /* 7978 * If things are opening or closing, only accept high-priority 7979 * DLPI messages. (On open ill->ill_ipif has not yet been 7980 * created; on close, things hanging off the ill may have been 7981 * freed already.) 7982 */ 7983 dl = (union DL_primitives *)mp->b_rptr; 7984 if (DB_TYPE(mp) != M_PCPROTO || 7985 dl->dl_primitive == DL_UNITDATA_IND) { 7986 inet_freemsg(mp); 7987 return; 7988 } 7989 } 7990 if (DB_TYPE(mp) == M_DATA) { 7991 struct mac_header_info_s mhi; 7992 7993 ip_mdata_to_mhi(ill, mp, &mhi); 7994 ip_input(ill, NULL, mp, &mhi); 7995 } else { 7996 ip_rput_notdata(ill, mp); 7997 } 7998 } 7999 8000 /* 8001 * Move the information to a copy. 8002 */ 8003 mblk_t * 8004 ip_fix_dbref(mblk_t *mp, ip_recv_attr_t *ira) 8005 { 8006 mblk_t *mp1; 8007 ill_t *ill = ira->ira_ill; 8008 ip_stack_t *ipst = ill->ill_ipst; 8009 8010 IP_STAT(ipst, ip_db_ref); 8011 8012 /* Make sure we have ira_l2src before we loose the original mblk */ 8013 if (!(ira->ira_flags & IRAF_L2SRC_SET)) 8014 ip_setl2src(mp, ira, ira->ira_rill); 8015 8016 mp1 = copymsg(mp); 8017 if (mp1 == NULL) { 8018 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 8019 ip_drop_input("ipIfStatsInDiscards", mp, ill); 8020 freemsg(mp); 8021 return (NULL); 8022 } 8023 /* preserve the hardware checksum flags and data, if present */ 8024 if (DB_CKSUMFLAGS(mp) != 0) { 8025 DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp); 8026 DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp); 8027 DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp); 8028 DB_CKSUMEND(mp1) = DB_CKSUMEND(mp); 8029 DB_CKSUM16(mp1) = DB_CKSUM16(mp); 8030 } 8031 freemsg(mp); 8032 return (mp1); 8033 } 8034 8035 static void 8036 ip_dlpi_error(ill_t *ill, t_uscalar_t prim, t_uscalar_t dl_err, 8037 t_uscalar_t err) 8038 { 8039 if (dl_err == DL_SYSERR) { 8040 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE, 8041 "%s: %s failed: DL_SYSERR (errno %u)\n", 8042 ill->ill_name, dl_primstr(prim), err); 8043 return; 8044 } 8045 8046 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE, 8047 "%s: %s failed: %s\n", ill->ill_name, dl_primstr(prim), 8048 dl_errstr(dl_err)); 8049 } 8050 8051 /* 8052 * ip_rput_dlpi is called by ip_rput to handle all DLPI messages other 8053 * than DL_UNITDATA_IND messages. If we need to process this message 8054 * exclusively, we call qwriter_ip, in which case we also need to call 8055 * ill_refhold before that, since qwriter_ip does an ill_refrele. 8056 */ 8057 void 8058 ip_rput_dlpi(ill_t *ill, mblk_t *mp) 8059 { 8060 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr; 8061 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa; 8062 queue_t *q = ill->ill_rq; 8063 t_uscalar_t prim = dloa->dl_primitive; 8064 t_uscalar_t reqprim = DL_PRIM_INVAL; 8065 8066 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi", 8067 char *, dl_primstr(prim), ill_t *, ill); 8068 ip1dbg(("ip_rput_dlpi")); 8069 8070 /* 8071 * If we received an ACK but didn't send a request for it, then it 8072 * can't be part of any pending operation; discard up-front. 8073 */ 8074 switch (prim) { 8075 case DL_ERROR_ACK: 8076 reqprim = dlea->dl_error_primitive; 8077 ip2dbg(("ip_rput_dlpi(%s): DL_ERROR_ACK for %s (0x%x): %s " 8078 "(0x%x), unix %u\n", ill->ill_name, dl_primstr(reqprim), 8079 reqprim, dl_errstr(dlea->dl_errno), dlea->dl_errno, 8080 dlea->dl_unix_errno)); 8081 break; 8082 case DL_OK_ACK: 8083 reqprim = dloa->dl_correct_primitive; 8084 break; 8085 case DL_INFO_ACK: 8086 reqprim = DL_INFO_REQ; 8087 break; 8088 case DL_BIND_ACK: 8089 reqprim = DL_BIND_REQ; 8090 break; 8091 case DL_PHYS_ADDR_ACK: 8092 reqprim = DL_PHYS_ADDR_REQ; 8093 break; 8094 case DL_NOTIFY_ACK: 8095 reqprim = DL_NOTIFY_REQ; 8096 break; 8097 case DL_CAPABILITY_ACK: 8098 reqprim = DL_CAPABILITY_REQ; 8099 break; 8100 } 8101 8102 if (prim != DL_NOTIFY_IND) { 8103 if (reqprim == DL_PRIM_INVAL || 8104 !ill_dlpi_pending(ill, reqprim)) { 8105 /* Not a DLPI message we support or expected */ 8106 freemsg(mp); 8107 return; 8108 } 8109 ip1dbg(("ip_rput: received %s for %s\n", dl_primstr(prim), 8110 dl_primstr(reqprim))); 8111 } 8112 8113 switch (reqprim) { 8114 case DL_UNBIND_REQ: 8115 /* 8116 * NOTE: we mark the unbind as complete even if we got a 8117 * DL_ERROR_ACK, since there's not much else we can do. 8118 */ 8119 mutex_enter(&ill->ill_lock); 8120 ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS; 8121 cv_signal(&ill->ill_cv); 8122 mutex_exit(&ill->ill_lock); 8123 break; 8124 8125 case DL_ENABMULTI_REQ: 8126 if (prim == DL_OK_ACK) { 8127 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS) 8128 ill->ill_dlpi_multicast_state = IDS_OK; 8129 } 8130 break; 8131 } 8132 8133 /* 8134 * The message is one we're waiting for (or DL_NOTIFY_IND), but we 8135 * need to become writer to continue to process it. Because an 8136 * exclusive operation doesn't complete until replies to all queued 8137 * DLPI messages have been received, we know we're in the middle of an 8138 * exclusive operation and pass CUR_OP (except for DL_NOTIFY_IND). 8139 * 8140 * As required by qwriter_ip(), we refhold the ill; it will refrele. 8141 * Since this is on the ill stream we unconditionally bump up the 8142 * refcount without doing ILL_CAN_LOOKUP(). 8143 */ 8144 ill_refhold(ill); 8145 if (prim == DL_NOTIFY_IND) 8146 qwriter_ip(ill, q, mp, ip_rput_dlpi_writer, NEW_OP, B_FALSE); 8147 else 8148 qwriter_ip(ill, q, mp, ip_rput_dlpi_writer, CUR_OP, B_FALSE); 8149 } 8150 8151 /* 8152 * Handling of DLPI messages that require exclusive access to the ipsq. 8153 * 8154 * Need to do ipsq_pending_mp_get on ioctl completion, which could 8155 * happen here. (along with mi_copy_done) 8156 */ 8157 /* ARGSUSED */ 8158 static void 8159 ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 8160 { 8161 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr; 8162 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa; 8163 int err = 0; 8164 ill_t *ill = (ill_t *)q->q_ptr; 8165 ipif_t *ipif = NULL; 8166 mblk_t *mp1 = NULL; 8167 conn_t *connp = NULL; 8168 t_uscalar_t paddrreq; 8169 mblk_t *mp_hw; 8170 boolean_t success; 8171 boolean_t ioctl_aborted = B_FALSE; 8172 boolean_t log = B_TRUE; 8173 8174 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer", 8175 char *, dl_primstr(dloa->dl_primitive), ill_t *, ill); 8176 8177 ip1dbg(("ip_rput_dlpi_writer ..")); 8178 ASSERT(ipsq->ipsq_xop == ill->ill_phyint->phyint_ipsq->ipsq_xop); 8179 ASSERT(IAM_WRITER_ILL(ill)); 8180 8181 ipif = ipsq->ipsq_xop->ipx_pending_ipif; 8182 /* 8183 * The current ioctl could have been aborted by the user and a new 8184 * ioctl to bring up another ill could have started. We could still 8185 * get a response from the driver later. 8186 */ 8187 if (ipif != NULL && ipif->ipif_ill != ill) 8188 ioctl_aborted = B_TRUE; 8189 8190 switch (dloa->dl_primitive) { 8191 case DL_ERROR_ACK: 8192 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for %s\n", 8193 dl_primstr(dlea->dl_error_primitive))); 8194 8195 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer error", 8196 char *, dl_primstr(dlea->dl_error_primitive), 8197 ill_t *, ill); 8198 8199 switch (dlea->dl_error_primitive) { 8200 case DL_DISABMULTI_REQ: 8201 ill_dlpi_done(ill, dlea->dl_error_primitive); 8202 break; 8203 case DL_PROMISCON_REQ: 8204 case DL_PROMISCOFF_REQ: 8205 case DL_UNBIND_REQ: 8206 case DL_ATTACH_REQ: 8207 case DL_INFO_REQ: 8208 ill_dlpi_done(ill, dlea->dl_error_primitive); 8209 break; 8210 case DL_NOTIFY_REQ: 8211 ill_dlpi_done(ill, DL_NOTIFY_REQ); 8212 log = B_FALSE; 8213 break; 8214 case DL_PHYS_ADDR_REQ: 8215 /* 8216 * For IPv6 only, there are two additional 8217 * phys_addr_req's sent to the driver to get the 8218 * IPv6 token and lla. This allows IP to acquire 8219 * the hardware address format for a given interface 8220 * without having built in knowledge of the hardware 8221 * address. ill_phys_addr_pend keeps track of the last 8222 * DL_PAR sent so we know which response we are 8223 * dealing with. ill_dlpi_done will update 8224 * ill_phys_addr_pend when it sends the next req. 8225 * We don't complete the IOCTL until all three DL_PARs 8226 * have been attempted, so set *_len to 0 and break. 8227 */ 8228 paddrreq = ill->ill_phys_addr_pend; 8229 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ); 8230 if (paddrreq == DL_IPV6_TOKEN) { 8231 ill->ill_token_length = 0; 8232 log = B_FALSE; 8233 break; 8234 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) { 8235 ill->ill_nd_lla_len = 0; 8236 log = B_FALSE; 8237 break; 8238 } 8239 /* 8240 * Something went wrong with the DL_PHYS_ADDR_REQ. 8241 * We presumably have an IOCTL hanging out waiting 8242 * for completion. Find it and complete the IOCTL 8243 * with the error noted. 8244 * However, ill_dl_phys was called on an ill queue 8245 * (from SIOCSLIFNAME), thus conn_pending_ill is not 8246 * set. But the ioctl is known to be pending on ill_wq. 8247 */ 8248 if (!ill->ill_ifname_pending) 8249 break; 8250 ill->ill_ifname_pending = 0; 8251 if (!ioctl_aborted) 8252 mp1 = ipsq_pending_mp_get(ipsq, &connp); 8253 if (mp1 != NULL) { 8254 /* 8255 * This operation (SIOCSLIFNAME) must have 8256 * happened on the ill. Assert there is no conn 8257 */ 8258 ASSERT(connp == NULL); 8259 q = ill->ill_wq; 8260 } 8261 break; 8262 case DL_BIND_REQ: 8263 ill_dlpi_done(ill, DL_BIND_REQ); 8264 if (ill->ill_ifname_pending) 8265 break; 8266 mutex_enter(&ill->ill_lock); 8267 ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS; 8268 mutex_exit(&ill->ill_lock); 8269 /* 8270 * Something went wrong with the bind. We presumably 8271 * have an IOCTL hanging out waiting for completion. 8272 * Find it, take down the interface that was coming 8273 * up, and complete the IOCTL with the error noted. 8274 */ 8275 if (!ioctl_aborted) 8276 mp1 = ipsq_pending_mp_get(ipsq, &connp); 8277 if (mp1 != NULL) { 8278 /* 8279 * This might be a result of a DL_NOTE_REPLUMB 8280 * notification. In that case, connp is NULL. 8281 */ 8282 if (connp != NULL) 8283 q = CONNP_TO_WQ(connp); 8284 8285 (void) ipif_down(ipif, NULL, NULL); 8286 /* error is set below the switch */ 8287 } 8288 break; 8289 case DL_ENABMULTI_REQ: 8290 ill_dlpi_done(ill, DL_ENABMULTI_REQ); 8291 8292 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS) 8293 ill->ill_dlpi_multicast_state = IDS_FAILED; 8294 if (ill->ill_dlpi_multicast_state == IDS_FAILED) { 8295 8296 printf("ip: joining multicasts failed (%d)" 8297 " on %s - will use link layer " 8298 "broadcasts for multicast\n", 8299 dlea->dl_errno, ill->ill_name); 8300 8301 /* 8302 * Set up for multi_bcast; We are the 8303 * writer, so ok to access ill->ill_ipif 8304 * without any lock. 8305 */ 8306 mutex_enter(&ill->ill_phyint->phyint_lock); 8307 ill->ill_phyint->phyint_flags |= 8308 PHYI_MULTI_BCAST; 8309 mutex_exit(&ill->ill_phyint->phyint_lock); 8310 8311 } 8312 freemsg(mp); /* Don't want to pass this up */ 8313 return; 8314 case DL_CAPABILITY_REQ: 8315 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for " 8316 "DL_CAPABILITY REQ\n")); 8317 if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT) 8318 ill->ill_dlpi_capab_state = IDCS_FAILED; 8319 ill_capability_done(ill); 8320 freemsg(mp); 8321 return; 8322 } 8323 /* 8324 * Note the error for IOCTL completion (mp1 is set when 8325 * ready to complete ioctl). If ill_ifname_pending_err is 8326 * set, an error occured during plumbing (ill_ifname_pending), 8327 * so we want to report that error. 8328 * 8329 * NOTE: there are two addtional DL_PHYS_ADDR_REQ's 8330 * (DL_IPV6_TOKEN and DL_IPV6_LINK_LAYER_ADDR) that are 8331 * expected to get errack'd if the driver doesn't support 8332 * these flags (e.g. ethernet). log will be set to B_FALSE 8333 * if these error conditions are encountered. 8334 */ 8335 if (mp1 != NULL) { 8336 if (ill->ill_ifname_pending_err != 0) { 8337 err = ill->ill_ifname_pending_err; 8338 ill->ill_ifname_pending_err = 0; 8339 } else { 8340 err = dlea->dl_unix_errno ? 8341 dlea->dl_unix_errno : ENXIO; 8342 } 8343 /* 8344 * If we're plumbing an interface and an error hasn't already 8345 * been saved, set ill_ifname_pending_err to the error passed 8346 * up. Ignore the error if log is B_FALSE (see comment above). 8347 */ 8348 } else if (log && ill->ill_ifname_pending && 8349 ill->ill_ifname_pending_err == 0) { 8350 ill->ill_ifname_pending_err = dlea->dl_unix_errno ? 8351 dlea->dl_unix_errno : ENXIO; 8352 } 8353 8354 if (log) 8355 ip_dlpi_error(ill, dlea->dl_error_primitive, 8356 dlea->dl_errno, dlea->dl_unix_errno); 8357 break; 8358 case DL_CAPABILITY_ACK: 8359 ill_capability_ack(ill, mp); 8360 /* 8361 * The message has been handed off to ill_capability_ack 8362 * and must not be freed below 8363 */ 8364 mp = NULL; 8365 break; 8366 8367 case DL_INFO_ACK: 8368 /* Call a routine to handle this one. */ 8369 ill_dlpi_done(ill, DL_INFO_REQ); 8370 ip_ll_subnet_defaults(ill, mp); 8371 ASSERT(!MUTEX_HELD(&ill->ill_phyint->phyint_ipsq->ipsq_lock)); 8372 return; 8373 case DL_BIND_ACK: 8374 /* 8375 * We should have an IOCTL waiting on this unless 8376 * sent by ill_dl_phys, in which case just return 8377 */ 8378 ill_dlpi_done(ill, DL_BIND_REQ); 8379 8380 if (ill->ill_ifname_pending) { 8381 DTRACE_PROBE2(ip__rput__dlpi__ifname__pending, 8382 ill_t *, ill, mblk_t *, mp); 8383 break; 8384 } 8385 mutex_enter(&ill->ill_lock); 8386 ill->ill_dl_up = 1; 8387 ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS; 8388 mutex_exit(&ill->ill_lock); 8389 8390 if (!ioctl_aborted) 8391 mp1 = ipsq_pending_mp_get(ipsq, &connp); 8392 if (mp1 == NULL) { 8393 DTRACE_PROBE1(ip__rput__dlpi__no__mblk, ill_t *, ill); 8394 break; 8395 } 8396 /* 8397 * mp1 was added by ill_dl_up(). if that is a result of 8398 * a DL_NOTE_REPLUMB notification, connp could be NULL. 8399 */ 8400 if (connp != NULL) 8401 q = CONNP_TO_WQ(connp); 8402 /* 8403 * We are exclusive. So nothing can change even after 8404 * we get the pending mp. 8405 */ 8406 ip1dbg(("ip_rput_dlpi: bind_ack %s\n", ill->ill_name)); 8407 DTRACE_PROBE1(ip__rput__dlpi__bind__ack, ill_t *, ill); 8408 ill_nic_event_dispatch(ill, 0, NE_UP, NULL, 0); 8409 8410 /* 8411 * Now bring up the resolver; when that is complete, we'll 8412 * create IREs. Note that we intentionally mirror what 8413 * ipif_up() would have done, because we got here by way of 8414 * ill_dl_up(), which stopped ipif_up()'s processing. 8415 */ 8416 if (ill->ill_isv6) { 8417 /* 8418 * v6 interfaces. 8419 * Unlike ARP which has to do another bind 8420 * and attach, once we get here we are 8421 * done with NDP 8422 */ 8423 (void) ipif_resolver_up(ipif, Res_act_initial); 8424 if ((err = ipif_ndp_up(ipif, B_TRUE)) == 0) 8425 err = ipif_up_done_v6(ipif); 8426 } else if (ill->ill_net_type == IRE_IF_RESOLVER) { 8427 /* 8428 * ARP and other v4 external resolvers. 8429 * Leave the pending mblk intact so that 8430 * the ioctl completes in ip_rput(). 8431 */ 8432 if (connp != NULL) 8433 mutex_enter(&connp->conn_lock); 8434 mutex_enter(&ill->ill_lock); 8435 success = ipsq_pending_mp_add(connp, ipif, q, mp1, 0); 8436 mutex_exit(&ill->ill_lock); 8437 if (connp != NULL) 8438 mutex_exit(&connp->conn_lock); 8439 if (success) { 8440 err = ipif_resolver_up(ipif, Res_act_initial); 8441 if (err == EINPROGRESS) { 8442 freemsg(mp); 8443 return; 8444 } 8445 mp1 = ipsq_pending_mp_get(ipsq, &connp); 8446 } else { 8447 /* The conn has started closing */ 8448 err = EINTR; 8449 } 8450 } else { 8451 /* 8452 * This one is complete. Reply to pending ioctl. 8453 */ 8454 (void) ipif_resolver_up(ipif, Res_act_initial); 8455 err = ipif_up_done(ipif); 8456 } 8457 8458 if ((err == 0) && (ill->ill_up_ipifs)) { 8459 err = ill_up_ipifs(ill, q, mp1); 8460 if (err == EINPROGRESS) { 8461 freemsg(mp); 8462 return; 8463 } 8464 } 8465 8466 /* 8467 * If we have a moved ipif to bring up, and everything has 8468 * succeeded to this point, bring it up on the IPMP ill. 8469 * Otherwise, leave it down -- the admin can try to bring it 8470 * up by hand if need be. 8471 */ 8472 if (ill->ill_move_ipif != NULL) { 8473 if (err != 0) { 8474 ill->ill_move_ipif = NULL; 8475 } else { 8476 ipif = ill->ill_move_ipif; 8477 ill->ill_move_ipif = NULL; 8478 err = ipif_up(ipif, q, mp1); 8479 if (err == EINPROGRESS) { 8480 freemsg(mp); 8481 return; 8482 } 8483 } 8484 } 8485 break; 8486 8487 case DL_NOTIFY_IND: { 8488 dl_notify_ind_t *notify = (dl_notify_ind_t *)mp->b_rptr; 8489 uint_t orig_mtu, orig_mc_mtu; 8490 8491 switch (notify->dl_notification) { 8492 case DL_NOTE_PHYS_ADDR: 8493 err = ill_set_phys_addr(ill, mp); 8494 break; 8495 8496 case DL_NOTE_REPLUMB: 8497 /* 8498 * Directly return after calling ill_replumb(). 8499 * Note that we should not free mp as it is reused 8500 * in the ill_replumb() function. 8501 */ 8502 err = ill_replumb(ill, mp); 8503 return; 8504 8505 case DL_NOTE_FASTPATH_FLUSH: 8506 nce_flush(ill, B_FALSE); 8507 break; 8508 8509 case DL_NOTE_SDU_SIZE: 8510 case DL_NOTE_SDU_SIZE2: 8511 /* 8512 * The dce and fragmentation code can cope with 8513 * this changing while packets are being sent. 8514 * When packets are sent ip_output will discover 8515 * a change. 8516 * 8517 * Change the MTU size of the interface. 8518 */ 8519 mutex_enter(&ill->ill_lock); 8520 orig_mtu = ill->ill_mtu; 8521 orig_mc_mtu = ill->ill_mc_mtu; 8522 switch (notify->dl_notification) { 8523 case DL_NOTE_SDU_SIZE: 8524 ill->ill_current_frag = 8525 (uint_t)notify->dl_data; 8526 ill->ill_mc_mtu = (uint_t)notify->dl_data; 8527 break; 8528 case DL_NOTE_SDU_SIZE2: 8529 ill->ill_current_frag = 8530 (uint_t)notify->dl_data1; 8531 ill->ill_mc_mtu = (uint_t)notify->dl_data2; 8532 break; 8533 } 8534 if (ill->ill_current_frag > ill->ill_max_frag) 8535 ill->ill_max_frag = ill->ill_current_frag; 8536 8537 if (!(ill->ill_flags & ILLF_FIXEDMTU)) { 8538 ill->ill_mtu = ill->ill_current_frag; 8539 8540 /* 8541 * If ill_user_mtu was set (via 8542 * SIOCSLIFLNKINFO), clamp ill_mtu at it. 8543 */ 8544 if (ill->ill_user_mtu != 0 && 8545 ill->ill_user_mtu < ill->ill_mtu) 8546 ill->ill_mtu = ill->ill_user_mtu; 8547 8548 if (ill->ill_user_mtu != 0 && 8549 ill->ill_user_mtu < ill->ill_mc_mtu) 8550 ill->ill_mc_mtu = ill->ill_user_mtu; 8551 8552 if (ill->ill_isv6) { 8553 if (ill->ill_mtu < IPV6_MIN_MTU) 8554 ill->ill_mtu = IPV6_MIN_MTU; 8555 if (ill->ill_mc_mtu < IPV6_MIN_MTU) 8556 ill->ill_mc_mtu = IPV6_MIN_MTU; 8557 } else { 8558 if (ill->ill_mtu < IP_MIN_MTU) 8559 ill->ill_mtu = IP_MIN_MTU; 8560 if (ill->ill_mc_mtu < IP_MIN_MTU) 8561 ill->ill_mc_mtu = IP_MIN_MTU; 8562 } 8563 } else if (ill->ill_mc_mtu > ill->ill_mtu) { 8564 ill->ill_mc_mtu = ill->ill_mtu; 8565 } 8566 8567 mutex_exit(&ill->ill_lock); 8568 /* 8569 * Make sure all dce_generation checks find out 8570 * that ill_mtu/ill_mc_mtu has changed. 8571 */ 8572 if (orig_mtu != ill->ill_mtu || 8573 orig_mc_mtu != ill->ill_mc_mtu) { 8574 dce_increment_all_generations(ill->ill_isv6, 8575 ill->ill_ipst); 8576 } 8577 8578 /* 8579 * Refresh IPMP meta-interface MTU if necessary. 8580 */ 8581 if (IS_UNDER_IPMP(ill)) 8582 ipmp_illgrp_refresh_mtu(ill->ill_grp); 8583 break; 8584 8585 case DL_NOTE_LINK_UP: 8586 case DL_NOTE_LINK_DOWN: { 8587 /* 8588 * We are writer. ill / phyint / ipsq assocs stable. 8589 * The RUNNING flag reflects the state of the link. 8590 */ 8591 phyint_t *phyint = ill->ill_phyint; 8592 uint64_t new_phyint_flags; 8593 boolean_t changed = B_FALSE; 8594 boolean_t went_up; 8595 8596 went_up = notify->dl_notification == DL_NOTE_LINK_UP; 8597 mutex_enter(&phyint->phyint_lock); 8598 8599 new_phyint_flags = went_up ? 8600 phyint->phyint_flags | PHYI_RUNNING : 8601 phyint->phyint_flags & ~PHYI_RUNNING; 8602 8603 if (IS_IPMP(ill)) { 8604 new_phyint_flags = went_up ? 8605 new_phyint_flags & ~PHYI_FAILED : 8606 new_phyint_flags | PHYI_FAILED; 8607 } 8608 8609 if (new_phyint_flags != phyint->phyint_flags) { 8610 phyint->phyint_flags = new_phyint_flags; 8611 changed = B_TRUE; 8612 } 8613 mutex_exit(&phyint->phyint_lock); 8614 /* 8615 * ill_restart_dad handles the DAD restart and routing 8616 * socket notification logic. 8617 */ 8618 if (changed) { 8619 ill_restart_dad(phyint->phyint_illv4, went_up); 8620 ill_restart_dad(phyint->phyint_illv6, went_up); 8621 } 8622 break; 8623 } 8624 case DL_NOTE_PROMISC_ON_PHYS: { 8625 phyint_t *phyint = ill->ill_phyint; 8626 8627 mutex_enter(&phyint->phyint_lock); 8628 phyint->phyint_flags |= PHYI_PROMISC; 8629 mutex_exit(&phyint->phyint_lock); 8630 break; 8631 } 8632 case DL_NOTE_PROMISC_OFF_PHYS: { 8633 phyint_t *phyint = ill->ill_phyint; 8634 8635 mutex_enter(&phyint->phyint_lock); 8636 phyint->phyint_flags &= ~PHYI_PROMISC; 8637 mutex_exit(&phyint->phyint_lock); 8638 break; 8639 } 8640 case DL_NOTE_CAPAB_RENEG: 8641 /* 8642 * Something changed on the driver side. 8643 * It wants us to renegotiate the capabilities 8644 * on this ill. One possible cause is the aggregation 8645 * interface under us where a port got added or 8646 * went away. 8647 * 8648 * If the capability negotiation is already done 8649 * or is in progress, reset the capabilities and 8650 * mark the ill's ill_capab_reneg to be B_TRUE, 8651 * so that when the ack comes back, we can start 8652 * the renegotiation process. 8653 * 8654 * Note that if ill_capab_reneg is already B_TRUE 8655 * (ill_dlpi_capab_state is IDS_UNKNOWN in this case), 8656 * the capability resetting request has been sent 8657 * and the renegotiation has not been started yet; 8658 * nothing needs to be done in this case. 8659 */ 8660 ipsq_current_start(ipsq, ill->ill_ipif, 0); 8661 ill_capability_reset(ill, B_TRUE); 8662 ipsq_current_finish(ipsq); 8663 break; 8664 8665 case DL_NOTE_ALLOWED_IPS: 8666 ill_set_allowed_ips(ill, mp); 8667 break; 8668 default: 8669 ip0dbg(("ip_rput_dlpi_writer: unknown notification " 8670 "type 0x%x for DL_NOTIFY_IND\n", 8671 notify->dl_notification)); 8672 break; 8673 } 8674 8675 /* 8676 * As this is an asynchronous operation, we 8677 * should not call ill_dlpi_done 8678 */ 8679 break; 8680 } 8681 case DL_NOTIFY_ACK: { 8682 dl_notify_ack_t *noteack = (dl_notify_ack_t *)mp->b_rptr; 8683 8684 if (noteack->dl_notifications & DL_NOTE_LINK_UP) 8685 ill->ill_note_link = 1; 8686 ill_dlpi_done(ill, DL_NOTIFY_REQ); 8687 break; 8688 } 8689 case DL_PHYS_ADDR_ACK: { 8690 /* 8691 * As part of plumbing the interface via SIOCSLIFNAME, 8692 * ill_dl_phys() will queue a series of DL_PHYS_ADDR_REQs, 8693 * whose answers we receive here. As each answer is received, 8694 * we call ill_dlpi_done() to dispatch the next request as 8695 * we're processing the current one. Once all answers have 8696 * been received, we use ipsq_pending_mp_get() to dequeue the 8697 * outstanding IOCTL and reply to it. (Because ill_dl_phys() 8698 * is invoked from an ill queue, conn_oper_pending_ill is not 8699 * available, but we know the ioctl is pending on ill_wq.) 8700 */ 8701 uint_t paddrlen, paddroff; 8702 uint8_t *addr; 8703 8704 paddrreq = ill->ill_phys_addr_pend; 8705 paddrlen = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_length; 8706 paddroff = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_offset; 8707 addr = mp->b_rptr + paddroff; 8708 8709 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ); 8710 if (paddrreq == DL_IPV6_TOKEN) { 8711 /* 8712 * bcopy to low-order bits of ill_token 8713 * 8714 * XXX Temporary hack - currently, all known tokens 8715 * are 64 bits, so I'll cheat for the moment. 8716 */ 8717 bcopy(addr, &ill->ill_token.s6_addr32[2], paddrlen); 8718 ill->ill_token_length = paddrlen; 8719 break; 8720 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) { 8721 ASSERT(ill->ill_nd_lla_mp == NULL); 8722 ill_set_ndmp(ill, mp, paddroff, paddrlen); 8723 mp = NULL; 8724 break; 8725 } else if (paddrreq == DL_CURR_DEST_ADDR) { 8726 ASSERT(ill->ill_dest_addr_mp == NULL); 8727 ill->ill_dest_addr_mp = mp; 8728 ill->ill_dest_addr = addr; 8729 mp = NULL; 8730 if (ill->ill_isv6) { 8731 ill_setdesttoken(ill); 8732 ipif_setdestlinklocal(ill->ill_ipif); 8733 } 8734 break; 8735 } 8736 8737 ASSERT(paddrreq == DL_CURR_PHYS_ADDR); 8738 ASSERT(ill->ill_phys_addr_mp == NULL); 8739 if (!ill->ill_ifname_pending) 8740 break; 8741 ill->ill_ifname_pending = 0; 8742 if (!ioctl_aborted) 8743 mp1 = ipsq_pending_mp_get(ipsq, &connp); 8744 if (mp1 != NULL) { 8745 ASSERT(connp == NULL); 8746 q = ill->ill_wq; 8747 } 8748 /* 8749 * If any error acks received during the plumbing sequence, 8750 * ill_ifname_pending_err will be set. Break out and send up 8751 * the error to the pending ioctl. 8752 */ 8753 if (ill->ill_ifname_pending_err != 0) { 8754 err = ill->ill_ifname_pending_err; 8755 ill->ill_ifname_pending_err = 0; 8756 break; 8757 } 8758 8759 ill->ill_phys_addr_mp = mp; 8760 ill->ill_phys_addr = (paddrlen == 0 ? NULL : addr); 8761 mp = NULL; 8762 8763 /* 8764 * If paddrlen or ill_phys_addr_length is zero, the DLPI 8765 * provider doesn't support physical addresses. We check both 8766 * paddrlen and ill_phys_addr_length because sppp (PPP) does 8767 * not have physical addresses, but historically adversises a 8768 * physical address length of 0 in its DL_INFO_ACK, but 6 in 8769 * its DL_PHYS_ADDR_ACK. 8770 */ 8771 if (paddrlen == 0 || ill->ill_phys_addr_length == 0) { 8772 ill->ill_phys_addr = NULL; 8773 } else if (paddrlen != ill->ill_phys_addr_length) { 8774 ip0dbg(("DL_PHYS_ADDR_ACK: got addrlen %d, expected %d", 8775 paddrlen, ill->ill_phys_addr_length)); 8776 err = EINVAL; 8777 break; 8778 } 8779 8780 if (ill->ill_nd_lla_mp == NULL) { 8781 if ((mp_hw = copyb(ill->ill_phys_addr_mp)) == NULL) { 8782 err = ENOMEM; 8783 break; 8784 } 8785 ill_set_ndmp(ill, mp_hw, paddroff, paddrlen); 8786 } 8787 8788 if (ill->ill_isv6) { 8789 ill_setdefaulttoken(ill); 8790 ipif_setlinklocal(ill->ill_ipif); 8791 } 8792 break; 8793 } 8794 case DL_OK_ACK: 8795 ip2dbg(("DL_OK_ACK %s (0x%x)\n", 8796 dl_primstr((int)dloa->dl_correct_primitive), 8797 dloa->dl_correct_primitive)); 8798 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer ok", 8799 char *, dl_primstr(dloa->dl_correct_primitive), 8800 ill_t *, ill); 8801 8802 switch (dloa->dl_correct_primitive) { 8803 case DL_ENABMULTI_REQ: 8804 case DL_DISABMULTI_REQ: 8805 ill_dlpi_done(ill, dloa->dl_correct_primitive); 8806 break; 8807 case DL_PROMISCON_REQ: 8808 case DL_PROMISCOFF_REQ: 8809 case DL_UNBIND_REQ: 8810 case DL_ATTACH_REQ: 8811 ill_dlpi_done(ill, dloa->dl_correct_primitive); 8812 break; 8813 } 8814 break; 8815 default: 8816 break; 8817 } 8818 8819 freemsg(mp); 8820 if (mp1 == NULL) 8821 return; 8822 8823 /* 8824 * The operation must complete without EINPROGRESS since 8825 * ipsq_pending_mp_get() has removed the mblk (mp1). Otherwise, 8826 * the operation will be stuck forever inside the IPSQ. 8827 */ 8828 ASSERT(err != EINPROGRESS); 8829 8830 DTRACE_PROBE4(ipif__ioctl, char *, "ip_rput_dlpi_writer finish", 8831 int, ipsq->ipsq_xop->ipx_current_ioctl, ill_t *, ill, 8832 ipif_t *, NULL); 8833 8834 switch (ipsq->ipsq_xop->ipx_current_ioctl) { 8835 case 0: 8836 ipsq_current_finish(ipsq); 8837 break; 8838 8839 case SIOCSLIFNAME: 8840 case IF_UNITSEL: { 8841 ill_t *ill_other = ILL_OTHER(ill); 8842 8843 /* 8844 * If SIOCSLIFNAME or IF_UNITSEL is about to succeed, and the 8845 * ill has a peer which is in an IPMP group, then place ill 8846 * into the same group. One catch: although ifconfig plumbs 8847 * the appropriate IPMP meta-interface prior to plumbing this 8848 * ill, it is possible for multiple ifconfig applications to 8849 * race (or for another application to adjust plumbing), in 8850 * which case the IPMP meta-interface we need will be missing. 8851 * If so, kick the phyint out of the group. 8852 */ 8853 if (err == 0 && ill_other != NULL && IS_UNDER_IPMP(ill_other)) { 8854 ipmp_grp_t *grp = ill->ill_phyint->phyint_grp; 8855 ipmp_illgrp_t *illg; 8856 8857 illg = ill->ill_isv6 ? grp->gr_v6 : grp->gr_v4; 8858 if (illg == NULL) 8859 ipmp_phyint_leave_grp(ill->ill_phyint); 8860 else 8861 ipmp_ill_join_illgrp(ill, illg); 8862 } 8863 8864 if (ipsq->ipsq_xop->ipx_current_ioctl == IF_UNITSEL) 8865 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq); 8866 else 8867 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq); 8868 break; 8869 } 8870 case SIOCLIFADDIF: 8871 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq); 8872 break; 8873 8874 default: 8875 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq); 8876 break; 8877 } 8878 } 8879 8880 /* 8881 * ip_rput_other is called by ip_rput to handle messages modifying the global 8882 * state in IP. If 'ipsq' is non-NULL, caller is writer on it. 8883 */ 8884 /* ARGSUSED */ 8885 void 8886 ip_rput_other(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 8887 { 8888 ill_t *ill = q->q_ptr; 8889 struct iocblk *iocp; 8890 8891 ip1dbg(("ip_rput_other ")); 8892 if (ipsq != NULL) { 8893 ASSERT(IAM_WRITER_IPSQ(ipsq)); 8894 ASSERT(ipsq->ipsq_xop == 8895 ill->ill_phyint->phyint_ipsq->ipsq_xop); 8896 } 8897 8898 switch (mp->b_datap->db_type) { 8899 case M_ERROR: 8900 case M_HANGUP: 8901 /* 8902 * The device has a problem. We force the ILL down. It can 8903 * be brought up again manually using SIOCSIFFLAGS (via 8904 * ifconfig or equivalent). 8905 */ 8906 ASSERT(ipsq != NULL); 8907 if (mp->b_rptr < mp->b_wptr) 8908 ill->ill_error = (int)(*mp->b_rptr & 0xFF); 8909 if (ill->ill_error == 0) 8910 ill->ill_error = ENXIO; 8911 if (!ill_down_start(q, mp)) 8912 return; 8913 ipif_all_down_tail(ipsq, q, mp, NULL); 8914 break; 8915 case M_IOCNAK: { 8916 iocp = (struct iocblk *)mp->b_rptr; 8917 8918 ASSERT(iocp->ioc_cmd == DL_IOC_HDR_INFO); 8919 /* 8920 * If this was the first attempt, turn off the fastpath 8921 * probing. 8922 */ 8923 mutex_enter(&ill->ill_lock); 8924 if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS) { 8925 ill->ill_dlpi_fastpath_state = IDS_FAILED; 8926 mutex_exit(&ill->ill_lock); 8927 /* 8928 * don't flush the nce_t entries: we use them 8929 * as an index to the ncec itself. 8930 */ 8931 ip1dbg(("ip_rput: DLPI fastpath off on interface %s\n", 8932 ill->ill_name)); 8933 } else { 8934 mutex_exit(&ill->ill_lock); 8935 } 8936 freemsg(mp); 8937 break; 8938 } 8939 default: 8940 ASSERT(0); 8941 break; 8942 } 8943 } 8944 8945 /* 8946 * Update any source route, record route or timestamp options 8947 * When it fails it has consumed the message and BUMPed the MIB. 8948 */ 8949 boolean_t 8950 ip_forward_options(mblk_t *mp, ipha_t *ipha, ill_t *dst_ill, 8951 ip_recv_attr_t *ira) 8952 { 8953 ipoptp_t opts; 8954 uchar_t *opt; 8955 uint8_t optval; 8956 uint8_t optlen; 8957 ipaddr_t dst; 8958 ipaddr_t ifaddr; 8959 uint32_t ts; 8960 timestruc_t now; 8961 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 8962 8963 ip2dbg(("ip_forward_options\n")); 8964 dst = ipha->ipha_dst; 8965 for (optval = ipoptp_first(&opts, ipha); 8966 optval != IPOPT_EOL; 8967 optval = ipoptp_next(&opts)) { 8968 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 8969 opt = opts.ipoptp_cur; 8970 optlen = opts.ipoptp_len; 8971 ip2dbg(("ip_forward_options: opt %d, len %d\n", 8972 optval, opts.ipoptp_len)); 8973 switch (optval) { 8974 uint32_t off; 8975 case IPOPT_SSRR: 8976 case IPOPT_LSRR: 8977 /* Check if adminstratively disabled */ 8978 if (!ipst->ips_ip_forward_src_routed) { 8979 BUMP_MIB(dst_ill->ill_ip_mib, 8980 ipIfStatsForwProhibits); 8981 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", 8982 mp, dst_ill); 8983 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, 8984 ira); 8985 return (B_FALSE); 8986 } 8987 if (ip_type_v4(dst, ipst) != IRE_LOCAL) { 8988 /* 8989 * Must be partial since ip_input_options 8990 * checked for strict. 8991 */ 8992 break; 8993 } 8994 off = opt[IPOPT_OFFSET]; 8995 off--; 8996 redo_srr: 8997 if (optlen < IP_ADDR_LEN || 8998 off > optlen - IP_ADDR_LEN) { 8999 /* End of source route */ 9000 ip1dbg(( 9001 "ip_forward_options: end of SR\n")); 9002 break; 9003 } 9004 /* Pick a reasonable address on the outbound if */ 9005 ASSERT(dst_ill != NULL); 9006 if (ip_select_source_v4(dst_ill, INADDR_ANY, dst, 9007 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL, 9008 NULL) != 0) { 9009 /* No source! Shouldn't happen */ 9010 ifaddr = INADDR_ANY; 9011 } 9012 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 9013 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN); 9014 ip1dbg(("ip_forward_options: next hop 0x%x\n", 9015 ntohl(dst))); 9016 9017 /* 9018 * Check if our address is present more than 9019 * once as consecutive hops in source route. 9020 */ 9021 if (ip_type_v4(dst, ipst) == IRE_LOCAL) { 9022 off += IP_ADDR_LEN; 9023 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 9024 goto redo_srr; 9025 } 9026 ipha->ipha_dst = dst; 9027 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 9028 break; 9029 case IPOPT_RR: 9030 off = opt[IPOPT_OFFSET]; 9031 off--; 9032 if (optlen < IP_ADDR_LEN || 9033 off > optlen - IP_ADDR_LEN) { 9034 /* No more room - ignore */ 9035 ip1dbg(( 9036 "ip_forward_options: end of RR\n")); 9037 break; 9038 } 9039 /* Pick a reasonable address on the outbound if */ 9040 ASSERT(dst_ill != NULL); 9041 if (ip_select_source_v4(dst_ill, INADDR_ANY, dst, 9042 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL, 9043 NULL) != 0) { 9044 /* No source! Shouldn't happen */ 9045 ifaddr = INADDR_ANY; 9046 } 9047 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN); 9048 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 9049 break; 9050 case IPOPT_TS: 9051 /* Insert timestamp if there is room */ 9052 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 9053 case IPOPT_TS_TSONLY: 9054 off = IPOPT_TS_TIMELEN; 9055 break; 9056 case IPOPT_TS_PRESPEC: 9057 case IPOPT_TS_PRESPEC_RFC791: 9058 /* Verify that the address matched */ 9059 off = opt[IPOPT_OFFSET] - 1; 9060 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 9061 if (ip_type_v4(dst, ipst) != IRE_LOCAL) { 9062 /* Not for us */ 9063 break; 9064 } 9065 /* FALLTHRU */ 9066 case IPOPT_TS_TSANDADDR: 9067 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 9068 break; 9069 default: 9070 /* 9071 * ip_*put_options should have already 9072 * dropped this packet. 9073 */ 9074 cmn_err(CE_PANIC, "ip_forward_options: " 9075 "unknown IT - bug in ip_input_options?\n"); 9076 return (B_TRUE); /* Keep "lint" happy */ 9077 } 9078 if (opt[IPOPT_OFFSET] - 1 + off > optlen) { 9079 /* Increase overflow counter */ 9080 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1; 9081 opt[IPOPT_POS_OV_FLG] = 9082 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) | 9083 (off << 4)); 9084 break; 9085 } 9086 off = opt[IPOPT_OFFSET] - 1; 9087 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 9088 case IPOPT_TS_PRESPEC: 9089 case IPOPT_TS_PRESPEC_RFC791: 9090 case IPOPT_TS_TSANDADDR: 9091 /* Pick a reasonable addr on the outbound if */ 9092 ASSERT(dst_ill != NULL); 9093 if (ip_select_source_v4(dst_ill, INADDR_ANY, 9094 dst, INADDR_ANY, ALL_ZONES, ipst, &ifaddr, 9095 NULL, NULL) != 0) { 9096 /* No source! Shouldn't happen */ 9097 ifaddr = INADDR_ANY; 9098 } 9099 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN); 9100 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 9101 /* FALLTHRU */ 9102 case IPOPT_TS_TSONLY: 9103 off = opt[IPOPT_OFFSET] - 1; 9104 /* Compute # of milliseconds since midnight */ 9105 gethrestime(&now); 9106 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 9107 now.tv_nsec / (NANOSEC / MILLISEC); 9108 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN); 9109 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN; 9110 break; 9111 } 9112 break; 9113 } 9114 } 9115 return (B_TRUE); 9116 } 9117 9118 /* 9119 * Call ill_frag_timeout to do garbage collection. ill_frag_timeout 9120 * returns 'true' if there are still fragments left on the queue, in 9121 * which case we restart the timer. 9122 */ 9123 void 9124 ill_frag_timer(void *arg) 9125 { 9126 ill_t *ill = (ill_t *)arg; 9127 boolean_t frag_pending; 9128 ip_stack_t *ipst = ill->ill_ipst; 9129 time_t timeout; 9130 9131 mutex_enter(&ill->ill_lock); 9132 ASSERT(!ill->ill_fragtimer_executing); 9133 if (ill->ill_state_flags & ILL_CONDEMNED) { 9134 ill->ill_frag_timer_id = 0; 9135 mutex_exit(&ill->ill_lock); 9136 return; 9137 } 9138 ill->ill_fragtimer_executing = 1; 9139 mutex_exit(&ill->ill_lock); 9140 9141 timeout = (ill->ill_isv6 ? ipst->ips_ipv6_reassembly_timeout : 9142 ipst->ips_ip_reassembly_timeout); 9143 9144 frag_pending = ill_frag_timeout(ill, timeout); 9145 9146 /* 9147 * Restart the timer, if we have fragments pending or if someone 9148 * wanted us to be scheduled again. 9149 */ 9150 mutex_enter(&ill->ill_lock); 9151 ill->ill_fragtimer_executing = 0; 9152 ill->ill_frag_timer_id = 0; 9153 if (frag_pending || ill->ill_fragtimer_needrestart) 9154 ill_frag_timer_start(ill); 9155 mutex_exit(&ill->ill_lock); 9156 } 9157 9158 void 9159 ill_frag_timer_start(ill_t *ill) 9160 { 9161 ip_stack_t *ipst = ill->ill_ipst; 9162 clock_t timeo_ms; 9163 9164 ASSERT(MUTEX_HELD(&ill->ill_lock)); 9165 9166 /* If the ill is closing or opening don't proceed */ 9167 if (ill->ill_state_flags & ILL_CONDEMNED) 9168 return; 9169 9170 if (ill->ill_fragtimer_executing) { 9171 /* 9172 * ill_frag_timer is currently executing. Just record the 9173 * the fact that we want the timer to be restarted. 9174 * ill_frag_timer will post a timeout before it returns, 9175 * ensuring it will be called again. 9176 */ 9177 ill->ill_fragtimer_needrestart = 1; 9178 return; 9179 } 9180 9181 if (ill->ill_frag_timer_id == 0) { 9182 timeo_ms = (ill->ill_isv6 ? ipst->ips_ipv6_reassembly_timeout : 9183 ipst->ips_ip_reassembly_timeout) * SECONDS; 9184 9185 /* 9186 * The timer is neither running nor is the timeout handler 9187 * executing. Post a timeout so that ill_frag_timer will be 9188 * called 9189 */ 9190 ill->ill_frag_timer_id = timeout(ill_frag_timer, ill, 9191 MSEC_TO_TICK(timeo_ms >> 1)); 9192 ill->ill_fragtimer_needrestart = 0; 9193 } 9194 } 9195 9196 /* 9197 * Update any source route, record route or timestamp options. 9198 * Check that we are at end of strict source route. 9199 * The options have already been checked for sanity in ip_input_options(). 9200 */ 9201 boolean_t 9202 ip_input_local_options(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira) 9203 { 9204 ipoptp_t opts; 9205 uchar_t *opt; 9206 uint8_t optval; 9207 uint8_t optlen; 9208 ipaddr_t dst; 9209 ipaddr_t ifaddr; 9210 uint32_t ts; 9211 timestruc_t now; 9212 ill_t *ill = ira->ira_ill; 9213 ip_stack_t *ipst = ill->ill_ipst; 9214 9215 ip2dbg(("ip_input_local_options\n")); 9216 9217 for (optval = ipoptp_first(&opts, ipha); 9218 optval != IPOPT_EOL; 9219 optval = ipoptp_next(&opts)) { 9220 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 9221 opt = opts.ipoptp_cur; 9222 optlen = opts.ipoptp_len; 9223 ip2dbg(("ip_input_local_options: opt %d, len %d\n", 9224 optval, optlen)); 9225 switch (optval) { 9226 uint32_t off; 9227 case IPOPT_SSRR: 9228 case IPOPT_LSRR: 9229 off = opt[IPOPT_OFFSET]; 9230 off--; 9231 if (optlen < IP_ADDR_LEN || 9232 off > optlen - IP_ADDR_LEN) { 9233 /* End of source route */ 9234 ip1dbg(("ip_input_local_options: end of SR\n")); 9235 break; 9236 } 9237 /* 9238 * This will only happen if two consecutive entries 9239 * in the source route contains our address or if 9240 * it is a packet with a loose source route which 9241 * reaches us before consuming the whole source route 9242 */ 9243 ip1dbg(("ip_input_local_options: not end of SR\n")); 9244 if (optval == IPOPT_SSRR) { 9245 goto bad_src_route; 9246 } 9247 /* 9248 * Hack: instead of dropping the packet truncate the 9249 * source route to what has been used by filling the 9250 * rest with IPOPT_NOP. 9251 */ 9252 opt[IPOPT_OLEN] = (uint8_t)off; 9253 while (off < optlen) { 9254 opt[off++] = IPOPT_NOP; 9255 } 9256 break; 9257 case IPOPT_RR: 9258 off = opt[IPOPT_OFFSET]; 9259 off--; 9260 if (optlen < IP_ADDR_LEN || 9261 off > optlen - IP_ADDR_LEN) { 9262 /* No more room - ignore */ 9263 ip1dbg(( 9264 "ip_input_local_options: end of RR\n")); 9265 break; 9266 } 9267 /* Pick a reasonable address on the outbound if */ 9268 if (ip_select_source_v4(ill, INADDR_ANY, ipha->ipha_dst, 9269 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL, 9270 NULL) != 0) { 9271 /* No source! Shouldn't happen */ 9272 ifaddr = INADDR_ANY; 9273 } 9274 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN); 9275 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 9276 break; 9277 case IPOPT_TS: 9278 /* Insert timestamp if there is romm */ 9279 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 9280 case IPOPT_TS_TSONLY: 9281 off = IPOPT_TS_TIMELEN; 9282 break; 9283 case IPOPT_TS_PRESPEC: 9284 case IPOPT_TS_PRESPEC_RFC791: 9285 /* Verify that the address matched */ 9286 off = opt[IPOPT_OFFSET] - 1; 9287 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 9288 if (ip_type_v4(dst, ipst) != IRE_LOCAL) { 9289 /* Not for us */ 9290 break; 9291 } 9292 /* FALLTHRU */ 9293 case IPOPT_TS_TSANDADDR: 9294 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 9295 break; 9296 default: 9297 /* 9298 * ip_*put_options should have already 9299 * dropped this packet. 9300 */ 9301 cmn_err(CE_PANIC, "ip_input_local_options: " 9302 "unknown IT - bug in ip_input_options?\n"); 9303 return (B_TRUE); /* Keep "lint" happy */ 9304 } 9305 if (opt[IPOPT_OFFSET] - 1 + off > optlen) { 9306 /* Increase overflow counter */ 9307 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1; 9308 opt[IPOPT_POS_OV_FLG] = 9309 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) | 9310 (off << 4)); 9311 break; 9312 } 9313 off = opt[IPOPT_OFFSET] - 1; 9314 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 9315 case IPOPT_TS_PRESPEC: 9316 case IPOPT_TS_PRESPEC_RFC791: 9317 case IPOPT_TS_TSANDADDR: 9318 /* Pick a reasonable addr on the outbound if */ 9319 if (ip_select_source_v4(ill, INADDR_ANY, 9320 ipha->ipha_dst, INADDR_ANY, ALL_ZONES, ipst, 9321 &ifaddr, NULL, NULL) != 0) { 9322 /* No source! Shouldn't happen */ 9323 ifaddr = INADDR_ANY; 9324 } 9325 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN); 9326 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 9327 /* FALLTHRU */ 9328 case IPOPT_TS_TSONLY: 9329 off = opt[IPOPT_OFFSET] - 1; 9330 /* Compute # of milliseconds since midnight */ 9331 gethrestime(&now); 9332 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 9333 now.tv_nsec / (NANOSEC / MILLISEC); 9334 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN); 9335 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN; 9336 break; 9337 } 9338 break; 9339 } 9340 } 9341 return (B_TRUE); 9342 9343 bad_src_route: 9344 /* make sure we clear any indication of a hardware checksum */ 9345 DB_CKSUMFLAGS(mp) = 0; 9346 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill); 9347 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira); 9348 return (B_FALSE); 9349 9350 } 9351 9352 /* 9353 * Process IP options in an inbound packet. Always returns the nexthop. 9354 * Normally this is the passed in nexthop, but if there is an option 9355 * that effects the nexthop (such as a source route) that will be returned. 9356 * Sets *errorp if there is an error, in which case an ICMP error has been sent 9357 * and mp freed. 9358 */ 9359 ipaddr_t 9360 ip_input_options(ipha_t *ipha, ipaddr_t dst, mblk_t *mp, 9361 ip_recv_attr_t *ira, int *errorp) 9362 { 9363 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 9364 ipoptp_t opts; 9365 uchar_t *opt; 9366 uint8_t optval; 9367 uint8_t optlen; 9368 intptr_t code = 0; 9369 ire_t *ire; 9370 9371 ip2dbg(("ip_input_options\n")); 9372 *errorp = 0; 9373 for (optval = ipoptp_first(&opts, ipha); 9374 optval != IPOPT_EOL; 9375 optval = ipoptp_next(&opts)) { 9376 opt = opts.ipoptp_cur; 9377 optlen = opts.ipoptp_len; 9378 ip2dbg(("ip_input_options: opt %d, len %d\n", 9379 optval, optlen)); 9380 /* 9381 * Note: we need to verify the checksum before we 9382 * modify anything thus this routine only extracts the next 9383 * hop dst from any source route. 9384 */ 9385 switch (optval) { 9386 uint32_t off; 9387 case IPOPT_SSRR: 9388 case IPOPT_LSRR: 9389 if (ip_type_v4(dst, ipst) != IRE_LOCAL) { 9390 if (optval == IPOPT_SSRR) { 9391 ip1dbg(("ip_input_options: not next" 9392 " strict source route 0x%x\n", 9393 ntohl(dst))); 9394 code = (char *)&ipha->ipha_dst - 9395 (char *)ipha; 9396 goto param_prob; /* RouterReq's */ 9397 } 9398 ip2dbg(("ip_input_options: " 9399 "not next source route 0x%x\n", 9400 ntohl(dst))); 9401 break; 9402 } 9403 9404 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 9405 ip1dbg(( 9406 "ip_input_options: bad option offset\n")); 9407 code = (char *)&opt[IPOPT_OLEN] - 9408 (char *)ipha; 9409 goto param_prob; 9410 } 9411 off = opt[IPOPT_OFFSET]; 9412 off--; 9413 redo_srr: 9414 if (optlen < IP_ADDR_LEN || 9415 off > optlen - IP_ADDR_LEN) { 9416 /* End of source route */ 9417 ip1dbg(("ip_input_options: end of SR\n")); 9418 break; 9419 } 9420 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 9421 ip1dbg(("ip_input_options: next hop 0x%x\n", 9422 ntohl(dst))); 9423 9424 /* 9425 * Check if our address is present more than 9426 * once as consecutive hops in source route. 9427 * XXX verify per-interface ip_forwarding 9428 * for source route? 9429 */ 9430 if (ip_type_v4(dst, ipst) == IRE_LOCAL) { 9431 off += IP_ADDR_LEN; 9432 goto redo_srr; 9433 } 9434 9435 if (dst == htonl(INADDR_LOOPBACK)) { 9436 ip1dbg(("ip_input_options: loopback addr in " 9437 "source route!\n")); 9438 goto bad_src_route; 9439 } 9440 /* 9441 * For strict: verify that dst is directly 9442 * reachable. 9443 */ 9444 if (optval == IPOPT_SSRR) { 9445 ire = ire_ftable_lookup_v4(dst, 0, 0, 9446 IRE_INTERFACE, NULL, ALL_ZONES, 9447 ira->ira_tsl, 9448 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst, 9449 NULL); 9450 if (ire == NULL) { 9451 ip1dbg(("ip_input_options: SSRR not " 9452 "directly reachable: 0x%x\n", 9453 ntohl(dst))); 9454 goto bad_src_route; 9455 } 9456 ire_refrele(ire); 9457 } 9458 /* 9459 * Defer update of the offset and the record route 9460 * until the packet is forwarded. 9461 */ 9462 break; 9463 case IPOPT_RR: 9464 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 9465 ip1dbg(( 9466 "ip_input_options: bad option offset\n")); 9467 code = (char *)&opt[IPOPT_OLEN] - 9468 (char *)ipha; 9469 goto param_prob; 9470 } 9471 break; 9472 case IPOPT_TS: 9473 /* 9474 * Verify that length >= 5 and that there is either 9475 * room for another timestamp or that the overflow 9476 * counter is not maxed out. 9477 */ 9478 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha; 9479 if (optlen < IPOPT_MINLEN_IT) { 9480 goto param_prob; 9481 } 9482 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 9483 ip1dbg(( 9484 "ip_input_options: bad option offset\n")); 9485 code = (char *)&opt[IPOPT_OFFSET] - 9486 (char *)ipha; 9487 goto param_prob; 9488 } 9489 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 9490 case IPOPT_TS_TSONLY: 9491 off = IPOPT_TS_TIMELEN; 9492 break; 9493 case IPOPT_TS_TSANDADDR: 9494 case IPOPT_TS_PRESPEC: 9495 case IPOPT_TS_PRESPEC_RFC791: 9496 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 9497 break; 9498 default: 9499 code = (char *)&opt[IPOPT_POS_OV_FLG] - 9500 (char *)ipha; 9501 goto param_prob; 9502 } 9503 if (opt[IPOPT_OFFSET] - 1 + off > optlen && 9504 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) { 9505 /* 9506 * No room and the overflow counter is 15 9507 * already. 9508 */ 9509 goto param_prob; 9510 } 9511 break; 9512 } 9513 } 9514 9515 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) { 9516 return (dst); 9517 } 9518 9519 ip1dbg(("ip_input_options: error processing IP options.")); 9520 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha; 9521 9522 param_prob: 9523 /* make sure we clear any indication of a hardware checksum */ 9524 DB_CKSUMFLAGS(mp) = 0; 9525 ip_drop_input("ICMP_PARAM_PROBLEM", mp, ira->ira_ill); 9526 icmp_param_problem(mp, (uint8_t)code, ira); 9527 *errorp = -1; 9528 return (dst); 9529 9530 bad_src_route: 9531 /* make sure we clear any indication of a hardware checksum */ 9532 DB_CKSUMFLAGS(mp) = 0; 9533 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ira->ira_ill); 9534 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira); 9535 *errorp = -1; 9536 return (dst); 9537 } 9538 9539 /* 9540 * IP & ICMP info in >=14 msg's ... 9541 * - ip fixed part (mib2_ip_t) 9542 * - icmp fixed part (mib2_icmp_t) 9543 * - ipAddrEntryTable (ip 20) all IPv4 ipifs 9544 * - ipRouteEntryTable (ip 21) all IPv4 IREs 9545 * - ipNetToMediaEntryTable (ip 22) all IPv4 Neighbor Cache entries 9546 * - ipRouteAttributeTable (ip 102) labeled routes 9547 * - ip multicast membership (ip_member_t) 9548 * - ip multicast source filtering (ip_grpsrc_t) 9549 * - igmp fixed part (struct igmpstat) 9550 * - multicast routing stats (struct mrtstat) 9551 * - multicast routing vifs (array of struct vifctl) 9552 * - multicast routing routes (array of struct mfcctl) 9553 * - ip6 fixed part (mib2_ipv6IfStatsEntry_t) 9554 * One per ill plus one generic 9555 * - icmp6 fixed part (mib2_ipv6IfIcmpEntry_t) 9556 * One per ill plus one generic 9557 * - ipv6RouteEntry all IPv6 IREs 9558 * - ipv6RouteAttributeTable (ip6 102) labeled routes 9559 * - ipv6NetToMediaEntry all IPv6 Neighbor Cache entries 9560 * - ipv6AddrEntry all IPv6 ipifs 9561 * - ipv6 multicast membership (ipv6_member_t) 9562 * - ipv6 multicast source filtering (ipv6_grpsrc_t) 9563 * 9564 * NOTE: original mpctl is copied for msg's 2..N, since its ctl part is 9565 * already filled in by the caller. 9566 * If legacy_req is true then MIB structures needs to be truncated to their 9567 * legacy sizes before being returned. 9568 * Return value of 0 indicates that no messages were sent and caller 9569 * should free mpctl. 9570 */ 9571 int 9572 ip_snmp_get(queue_t *q, mblk_t *mpctl, int level, boolean_t legacy_req) 9573 { 9574 ip_stack_t *ipst; 9575 sctp_stack_t *sctps; 9576 9577 if (q->q_next != NULL) { 9578 ipst = ILLQ_TO_IPST(q); 9579 } else { 9580 ipst = CONNQ_TO_IPST(q); 9581 } 9582 ASSERT(ipst != NULL); 9583 sctps = ipst->ips_netstack->netstack_sctp; 9584 9585 if (mpctl == NULL || mpctl->b_cont == NULL) { 9586 return (0); 9587 } 9588 9589 /* 9590 * For the purposes of the (broken) packet shell use 9591 * of the level we make sure MIB2_TCP/MIB2_UDP can be used 9592 * to make TCP and UDP appear first in the list of mib items. 9593 * TBD: We could expand this and use it in netstat so that 9594 * the kernel doesn't have to produce large tables (connections, 9595 * routes, etc) when netstat only wants the statistics or a particular 9596 * table. 9597 */ 9598 if (!(level == MIB2_TCP || level == MIB2_UDP)) { 9599 if ((mpctl = icmp_snmp_get(q, mpctl)) == NULL) { 9600 return (1); 9601 } 9602 } 9603 9604 if (level != MIB2_TCP) { 9605 if ((mpctl = udp_snmp_get(q, mpctl, legacy_req)) == NULL) { 9606 return (1); 9607 } 9608 } 9609 9610 if (level != MIB2_UDP) { 9611 if ((mpctl = tcp_snmp_get(q, mpctl, legacy_req)) == NULL) { 9612 return (1); 9613 } 9614 } 9615 9616 if ((mpctl = ip_snmp_get_mib2_ip_traffic_stats(q, mpctl, 9617 ipst, legacy_req)) == NULL) { 9618 return (1); 9619 } 9620 9621 if ((mpctl = ip_snmp_get_mib2_ip6(q, mpctl, ipst, 9622 legacy_req)) == NULL) { 9623 return (1); 9624 } 9625 9626 if ((mpctl = ip_snmp_get_mib2_icmp(q, mpctl, ipst)) == NULL) { 9627 return (1); 9628 } 9629 9630 if ((mpctl = ip_snmp_get_mib2_icmp6(q, mpctl, ipst)) == NULL) { 9631 return (1); 9632 } 9633 9634 if ((mpctl = ip_snmp_get_mib2_igmp(q, mpctl, ipst)) == NULL) { 9635 return (1); 9636 } 9637 9638 if ((mpctl = ip_snmp_get_mib2_multi(q, mpctl, ipst)) == NULL) { 9639 return (1); 9640 } 9641 9642 if ((mpctl = ip_snmp_get_mib2_ip_addr(q, mpctl, ipst, 9643 legacy_req)) == NULL) { 9644 return (1); 9645 } 9646 9647 if ((mpctl = ip_snmp_get_mib2_ip6_addr(q, mpctl, ipst, 9648 legacy_req)) == NULL) { 9649 return (1); 9650 } 9651 9652 if ((mpctl = ip_snmp_get_mib2_ip_group_mem(q, mpctl, ipst)) == NULL) { 9653 return (1); 9654 } 9655 9656 if ((mpctl = ip_snmp_get_mib2_ip6_group_mem(q, mpctl, ipst)) == NULL) { 9657 return (1); 9658 } 9659 9660 if ((mpctl = ip_snmp_get_mib2_ip_group_src(q, mpctl, ipst)) == NULL) { 9661 return (1); 9662 } 9663 9664 if ((mpctl = ip_snmp_get_mib2_ip6_group_src(q, mpctl, ipst)) == NULL) { 9665 return (1); 9666 } 9667 9668 if ((mpctl = ip_snmp_get_mib2_virt_multi(q, mpctl, ipst)) == NULL) { 9669 return (1); 9670 } 9671 9672 if ((mpctl = ip_snmp_get_mib2_multi_rtable(q, mpctl, ipst)) == NULL) { 9673 return (1); 9674 } 9675 9676 mpctl = ip_snmp_get_mib2_ip_route_media(q, mpctl, level, ipst); 9677 if (mpctl == NULL) 9678 return (1); 9679 9680 mpctl = ip_snmp_get_mib2_ip6_route_media(q, mpctl, level, ipst); 9681 if (mpctl == NULL) 9682 return (1); 9683 9684 if ((mpctl = sctp_snmp_get_mib2(q, mpctl, sctps)) == NULL) { 9685 return (1); 9686 } 9687 if ((mpctl = ip_snmp_get_mib2_ip_dce(q, mpctl, ipst)) == NULL) { 9688 return (1); 9689 } 9690 freemsg(mpctl); 9691 return (1); 9692 } 9693 9694 /* Get global (legacy) IPv4 statistics */ 9695 static mblk_t * 9696 ip_snmp_get_mib2_ip(queue_t *q, mblk_t *mpctl, mib2_ipIfStatsEntry_t *ipmib, 9697 ip_stack_t *ipst, boolean_t legacy_req) 9698 { 9699 mib2_ip_t old_ip_mib; 9700 struct opthdr *optp; 9701 mblk_t *mp2ctl; 9702 mib2_ipAddrEntry_t mae; 9703 9704 /* 9705 * make a copy of the original message 9706 */ 9707 mp2ctl = copymsg(mpctl); 9708 9709 /* fixed length IP structure... */ 9710 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 9711 optp->level = MIB2_IP; 9712 optp->name = 0; 9713 SET_MIB(old_ip_mib.ipForwarding, 9714 (WE_ARE_FORWARDING(ipst) ? 1 : 2)); 9715 SET_MIB(old_ip_mib.ipDefaultTTL, 9716 (uint32_t)ipst->ips_ip_def_ttl); 9717 SET_MIB(old_ip_mib.ipReasmTimeout, 9718 ipst->ips_ip_reassembly_timeout); 9719 SET_MIB(old_ip_mib.ipAddrEntrySize, 9720 (legacy_req) ? LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t) : 9721 sizeof (mib2_ipAddrEntry_t)); 9722 SET_MIB(old_ip_mib.ipRouteEntrySize, 9723 sizeof (mib2_ipRouteEntry_t)); 9724 SET_MIB(old_ip_mib.ipNetToMediaEntrySize, 9725 sizeof (mib2_ipNetToMediaEntry_t)); 9726 SET_MIB(old_ip_mib.ipMemberEntrySize, sizeof (ip_member_t)); 9727 SET_MIB(old_ip_mib.ipGroupSourceEntrySize, sizeof (ip_grpsrc_t)); 9728 SET_MIB(old_ip_mib.ipRouteAttributeSize, 9729 sizeof (mib2_ipAttributeEntry_t)); 9730 SET_MIB(old_ip_mib.transportMLPSize, sizeof (mib2_transportMLPEntry_t)); 9731 SET_MIB(old_ip_mib.ipDestEntrySize, sizeof (dest_cache_entry_t)); 9732 9733 /* 9734 * Grab the statistics from the new IP MIB 9735 */ 9736 SET_MIB(old_ip_mib.ipInReceives, 9737 (uint32_t)ipmib->ipIfStatsHCInReceives); 9738 SET_MIB(old_ip_mib.ipInHdrErrors, ipmib->ipIfStatsInHdrErrors); 9739 SET_MIB(old_ip_mib.ipInAddrErrors, ipmib->ipIfStatsInAddrErrors); 9740 SET_MIB(old_ip_mib.ipForwDatagrams, 9741 (uint32_t)ipmib->ipIfStatsHCOutForwDatagrams); 9742 SET_MIB(old_ip_mib.ipInUnknownProtos, 9743 ipmib->ipIfStatsInUnknownProtos); 9744 SET_MIB(old_ip_mib.ipInDiscards, ipmib->ipIfStatsInDiscards); 9745 SET_MIB(old_ip_mib.ipInDelivers, 9746 (uint32_t)ipmib->ipIfStatsHCInDelivers); 9747 SET_MIB(old_ip_mib.ipOutRequests, 9748 (uint32_t)ipmib->ipIfStatsHCOutRequests); 9749 SET_MIB(old_ip_mib.ipOutDiscards, ipmib->ipIfStatsOutDiscards); 9750 SET_MIB(old_ip_mib.ipOutNoRoutes, ipmib->ipIfStatsOutNoRoutes); 9751 SET_MIB(old_ip_mib.ipReasmReqds, ipmib->ipIfStatsReasmReqds); 9752 SET_MIB(old_ip_mib.ipReasmOKs, ipmib->ipIfStatsReasmOKs); 9753 SET_MIB(old_ip_mib.ipReasmFails, ipmib->ipIfStatsReasmFails); 9754 SET_MIB(old_ip_mib.ipFragOKs, ipmib->ipIfStatsOutFragOKs); 9755 SET_MIB(old_ip_mib.ipFragFails, ipmib->ipIfStatsOutFragFails); 9756 SET_MIB(old_ip_mib.ipFragCreates, ipmib->ipIfStatsOutFragCreates); 9757 9758 /* ipRoutingDiscards is not being used */ 9759 SET_MIB(old_ip_mib.ipRoutingDiscards, 0); 9760 SET_MIB(old_ip_mib.tcpInErrs, ipmib->tcpIfStatsInErrs); 9761 SET_MIB(old_ip_mib.udpNoPorts, ipmib->udpIfStatsNoPorts); 9762 SET_MIB(old_ip_mib.ipInCksumErrs, ipmib->ipIfStatsInCksumErrs); 9763 SET_MIB(old_ip_mib.ipReasmDuplicates, 9764 ipmib->ipIfStatsReasmDuplicates); 9765 SET_MIB(old_ip_mib.ipReasmPartDups, ipmib->ipIfStatsReasmPartDups); 9766 SET_MIB(old_ip_mib.ipForwProhibits, ipmib->ipIfStatsForwProhibits); 9767 SET_MIB(old_ip_mib.udpInCksumErrs, ipmib->udpIfStatsInCksumErrs); 9768 SET_MIB(old_ip_mib.udpInOverflows, ipmib->udpIfStatsInOverflows); 9769 SET_MIB(old_ip_mib.rawipInOverflows, 9770 ipmib->rawipIfStatsInOverflows); 9771 9772 SET_MIB(old_ip_mib.ipsecInSucceeded, ipmib->ipsecIfStatsInSucceeded); 9773 SET_MIB(old_ip_mib.ipsecInFailed, ipmib->ipsecIfStatsInFailed); 9774 SET_MIB(old_ip_mib.ipInIPv6, ipmib->ipIfStatsInWrongIPVersion); 9775 SET_MIB(old_ip_mib.ipOutIPv6, ipmib->ipIfStatsOutWrongIPVersion); 9776 SET_MIB(old_ip_mib.ipOutSwitchIPv6, 9777 ipmib->ipIfStatsOutSwitchIPVersion); 9778 9779 if (!snmp_append_data(mpctl->b_cont, (char *)&old_ip_mib, 9780 (int)sizeof (old_ip_mib))) { 9781 ip1dbg(("ip_snmp_get_mib2_ip: failed to allocate %u bytes\n", 9782 (uint_t)sizeof (old_ip_mib))); 9783 } 9784 9785 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 9786 ip3dbg(("ip_snmp_get_mib2_ip: level %d, name %d, len %d\n", 9787 (int)optp->level, (int)optp->name, (int)optp->len)); 9788 qreply(q, mpctl); 9789 return (mp2ctl); 9790 } 9791 9792 /* Per interface IPv4 statistics */ 9793 static mblk_t * 9794 ip_snmp_get_mib2_ip_traffic_stats(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst, 9795 boolean_t legacy_req) 9796 { 9797 struct opthdr *optp; 9798 mblk_t *mp2ctl; 9799 ill_t *ill; 9800 ill_walk_context_t ctx; 9801 mblk_t *mp_tail = NULL; 9802 mib2_ipIfStatsEntry_t global_ip_mib; 9803 mib2_ipAddrEntry_t mae; 9804 9805 /* 9806 * Make a copy of the original message 9807 */ 9808 mp2ctl = copymsg(mpctl); 9809 9810 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 9811 optp->level = MIB2_IP; 9812 optp->name = MIB2_IP_TRAFFIC_STATS; 9813 /* Include "unknown interface" ip_mib */ 9814 ipst->ips_ip_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4; 9815 ipst->ips_ip_mib.ipIfStatsIfIndex = 9816 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */ 9817 SET_MIB(ipst->ips_ip_mib.ipIfStatsForwarding, 9818 (ipst->ips_ip_forwarding ? 1 : 2)); 9819 SET_MIB(ipst->ips_ip_mib.ipIfStatsDefaultTTL, 9820 (uint32_t)ipst->ips_ip_def_ttl); 9821 SET_MIB(ipst->ips_ip_mib.ipIfStatsEntrySize, 9822 sizeof (mib2_ipIfStatsEntry_t)); 9823 SET_MIB(ipst->ips_ip_mib.ipIfStatsAddrEntrySize, 9824 sizeof (mib2_ipAddrEntry_t)); 9825 SET_MIB(ipst->ips_ip_mib.ipIfStatsRouteEntrySize, 9826 sizeof (mib2_ipRouteEntry_t)); 9827 SET_MIB(ipst->ips_ip_mib.ipIfStatsNetToMediaEntrySize, 9828 sizeof (mib2_ipNetToMediaEntry_t)); 9829 SET_MIB(ipst->ips_ip_mib.ipIfStatsMemberEntrySize, 9830 sizeof (ip_member_t)); 9831 SET_MIB(ipst->ips_ip_mib.ipIfStatsGroupSourceEntrySize, 9832 sizeof (ip_grpsrc_t)); 9833 9834 bcopy(&ipst->ips_ip_mib, &global_ip_mib, sizeof (global_ip_mib)); 9835 9836 if (legacy_req) { 9837 SET_MIB(global_ip_mib.ipIfStatsAddrEntrySize, 9838 LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t)); 9839 } 9840 9841 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 9842 (char *)&global_ip_mib, (int)sizeof (global_ip_mib))) { 9843 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: " 9844 "failed to allocate %u bytes\n", 9845 (uint_t)sizeof (global_ip_mib))); 9846 } 9847 9848 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 9849 ill = ILL_START_WALK_V4(&ctx, ipst); 9850 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 9851 ill->ill_ip_mib->ipIfStatsIfIndex = 9852 ill->ill_phyint->phyint_ifindex; 9853 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding, 9854 (ipst->ips_ip_forwarding ? 1 : 2)); 9855 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultTTL, 9856 (uint32_t)ipst->ips_ip_def_ttl); 9857 9858 ip_mib2_add_ip_stats(&global_ip_mib, ill->ill_ip_mib); 9859 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 9860 (char *)ill->ill_ip_mib, 9861 (int)sizeof (*ill->ill_ip_mib))) { 9862 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: " 9863 "failed to allocate %u bytes\n", 9864 (uint_t)sizeof (*ill->ill_ip_mib))); 9865 } 9866 } 9867 rw_exit(&ipst->ips_ill_g_lock); 9868 9869 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 9870 ip3dbg(("ip_snmp_get_mib2_ip_traffic_stats: " 9871 "level %d, name %d, len %d\n", 9872 (int)optp->level, (int)optp->name, (int)optp->len)); 9873 qreply(q, mpctl); 9874 9875 if (mp2ctl == NULL) 9876 return (NULL); 9877 9878 return (ip_snmp_get_mib2_ip(q, mp2ctl, &global_ip_mib, ipst, 9879 legacy_req)); 9880 } 9881 9882 /* Global IPv4 ICMP statistics */ 9883 static mblk_t * 9884 ip_snmp_get_mib2_icmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 9885 { 9886 struct opthdr *optp; 9887 mblk_t *mp2ctl; 9888 9889 /* 9890 * Make a copy of the original message 9891 */ 9892 mp2ctl = copymsg(mpctl); 9893 9894 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 9895 optp->level = MIB2_ICMP; 9896 optp->name = 0; 9897 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_icmp_mib, 9898 (int)sizeof (ipst->ips_icmp_mib))) { 9899 ip1dbg(("ip_snmp_get_mib2_icmp: failed to allocate %u bytes\n", 9900 (uint_t)sizeof (ipst->ips_icmp_mib))); 9901 } 9902 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 9903 ip3dbg(("ip_snmp_get_mib2_icmp: level %d, name %d, len %d\n", 9904 (int)optp->level, (int)optp->name, (int)optp->len)); 9905 qreply(q, mpctl); 9906 return (mp2ctl); 9907 } 9908 9909 /* Global IPv4 IGMP statistics */ 9910 static mblk_t * 9911 ip_snmp_get_mib2_igmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 9912 { 9913 struct opthdr *optp; 9914 mblk_t *mp2ctl; 9915 9916 /* 9917 * make a copy of the original message 9918 */ 9919 mp2ctl = copymsg(mpctl); 9920 9921 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 9922 optp->level = EXPER_IGMP; 9923 optp->name = 0; 9924 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_igmpstat, 9925 (int)sizeof (ipst->ips_igmpstat))) { 9926 ip1dbg(("ip_snmp_get_mib2_igmp: failed to allocate %u bytes\n", 9927 (uint_t)sizeof (ipst->ips_igmpstat))); 9928 } 9929 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 9930 ip3dbg(("ip_snmp_get_mib2_igmp: level %d, name %d, len %d\n", 9931 (int)optp->level, (int)optp->name, (int)optp->len)); 9932 qreply(q, mpctl); 9933 return (mp2ctl); 9934 } 9935 9936 /* Global IPv4 Multicast Routing statistics */ 9937 static mblk_t * 9938 ip_snmp_get_mib2_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 9939 { 9940 struct opthdr *optp; 9941 mblk_t *mp2ctl; 9942 9943 /* 9944 * make a copy of the original message 9945 */ 9946 mp2ctl = copymsg(mpctl); 9947 9948 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 9949 optp->level = EXPER_DVMRP; 9950 optp->name = 0; 9951 if (!ip_mroute_stats(mpctl->b_cont, ipst)) { 9952 ip0dbg(("ip_mroute_stats: failed\n")); 9953 } 9954 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 9955 ip3dbg(("ip_snmp_get_mib2_multi: level %d, name %d, len %d\n", 9956 (int)optp->level, (int)optp->name, (int)optp->len)); 9957 qreply(q, mpctl); 9958 return (mp2ctl); 9959 } 9960 9961 /* IPv4 address information */ 9962 static mblk_t * 9963 ip_snmp_get_mib2_ip_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst, 9964 boolean_t legacy_req) 9965 { 9966 struct opthdr *optp; 9967 mblk_t *mp2ctl; 9968 mblk_t *mp_tail = NULL; 9969 ill_t *ill; 9970 ipif_t *ipif; 9971 uint_t bitval; 9972 mib2_ipAddrEntry_t mae; 9973 size_t mae_size; 9974 zoneid_t zoneid; 9975 ill_walk_context_t ctx; 9976 9977 /* 9978 * make a copy of the original message 9979 */ 9980 mp2ctl = copymsg(mpctl); 9981 9982 mae_size = (legacy_req) ? LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t) : 9983 sizeof (mib2_ipAddrEntry_t); 9984 9985 /* ipAddrEntryTable */ 9986 9987 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 9988 optp->level = MIB2_IP; 9989 optp->name = MIB2_IP_ADDR; 9990 zoneid = Q_TO_CONN(q)->conn_zoneid; 9991 9992 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 9993 ill = ILL_START_WALK_V4(&ctx, ipst); 9994 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 9995 for (ipif = ill->ill_ipif; ipif != NULL; 9996 ipif = ipif->ipif_next) { 9997 if (ipif->ipif_zoneid != zoneid && 9998 ipif->ipif_zoneid != ALL_ZONES) 9999 continue; 10000 /* Sum of count from dead IRE_LO* and our current */ 10001 mae.ipAdEntInfo.ae_ibcnt = ipif->ipif_ib_pkt_count; 10002 if (ipif->ipif_ire_local != NULL) { 10003 mae.ipAdEntInfo.ae_ibcnt += 10004 ipif->ipif_ire_local->ire_ib_pkt_count; 10005 } 10006 mae.ipAdEntInfo.ae_obcnt = 0; 10007 mae.ipAdEntInfo.ae_focnt = 0; 10008 10009 ipif_get_name(ipif, mae.ipAdEntIfIndex.o_bytes, 10010 OCTET_LENGTH); 10011 mae.ipAdEntIfIndex.o_length = 10012 mi_strlen(mae.ipAdEntIfIndex.o_bytes); 10013 mae.ipAdEntAddr = ipif->ipif_lcl_addr; 10014 mae.ipAdEntNetMask = ipif->ipif_net_mask; 10015 mae.ipAdEntInfo.ae_subnet = ipif->ipif_subnet; 10016 mae.ipAdEntInfo.ae_subnet_len = 10017 ip_mask_to_plen(ipif->ipif_net_mask); 10018 mae.ipAdEntInfo.ae_src_addr = ipif->ipif_lcl_addr; 10019 for (bitval = 1; 10020 bitval && 10021 !(bitval & ipif->ipif_brd_addr); 10022 bitval <<= 1) 10023 noop; 10024 mae.ipAdEntBcastAddr = bitval; 10025 mae.ipAdEntReasmMaxSize = IP_MAXPACKET; 10026 mae.ipAdEntInfo.ae_mtu = ipif->ipif_ill->ill_mtu; 10027 mae.ipAdEntInfo.ae_metric = ipif->ipif_ill->ill_metric; 10028 mae.ipAdEntInfo.ae_broadcast_addr = 10029 ipif->ipif_brd_addr; 10030 mae.ipAdEntInfo.ae_pp_dst_addr = 10031 ipif->ipif_pp_dst_addr; 10032 mae.ipAdEntInfo.ae_flags = ipif->ipif_flags | 10033 ill->ill_flags | ill->ill_phyint->phyint_flags; 10034 mae.ipAdEntRetransmitTime = 10035 ill->ill_reachable_retrans_time; 10036 10037 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10038 (char *)&mae, (int)mae_size)) { 10039 ip1dbg(("ip_snmp_get_mib2_ip_addr: failed to " 10040 "allocate %u bytes\n", (uint_t)mae_size)); 10041 } 10042 } 10043 } 10044 rw_exit(&ipst->ips_ill_g_lock); 10045 10046 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10047 ip3dbg(("ip_snmp_get_mib2_ip_addr: level %d, name %d, len %d\n", 10048 (int)optp->level, (int)optp->name, (int)optp->len)); 10049 qreply(q, mpctl); 10050 return (mp2ctl); 10051 } 10052 10053 /* IPv6 address information */ 10054 static mblk_t * 10055 ip_snmp_get_mib2_ip6_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst, 10056 boolean_t legacy_req) 10057 { 10058 struct opthdr *optp; 10059 mblk_t *mp2ctl; 10060 mblk_t *mp_tail = NULL; 10061 ill_t *ill; 10062 ipif_t *ipif; 10063 mib2_ipv6AddrEntry_t mae6; 10064 size_t mae6_size; 10065 zoneid_t zoneid; 10066 ill_walk_context_t ctx; 10067 10068 /* 10069 * make a copy of the original message 10070 */ 10071 mp2ctl = copymsg(mpctl); 10072 10073 mae6_size = (legacy_req) ? 10074 LEGACY_MIB_SIZE(&mae6, mib2_ipv6AddrEntry_t) : 10075 sizeof (mib2_ipv6AddrEntry_t); 10076 10077 /* ipv6AddrEntryTable */ 10078 10079 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10080 optp->level = MIB2_IP6; 10081 optp->name = MIB2_IP6_ADDR; 10082 zoneid = Q_TO_CONN(q)->conn_zoneid; 10083 10084 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10085 ill = ILL_START_WALK_V6(&ctx, ipst); 10086 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10087 for (ipif = ill->ill_ipif; ipif != NULL; 10088 ipif = ipif->ipif_next) { 10089 if (ipif->ipif_zoneid != zoneid && 10090 ipif->ipif_zoneid != ALL_ZONES) 10091 continue; 10092 /* Sum of count from dead IRE_LO* and our current */ 10093 mae6.ipv6AddrInfo.ae_ibcnt = ipif->ipif_ib_pkt_count; 10094 if (ipif->ipif_ire_local != NULL) { 10095 mae6.ipv6AddrInfo.ae_ibcnt += 10096 ipif->ipif_ire_local->ire_ib_pkt_count; 10097 } 10098 mae6.ipv6AddrInfo.ae_obcnt = 0; 10099 mae6.ipv6AddrInfo.ae_focnt = 0; 10100 10101 ipif_get_name(ipif, mae6.ipv6AddrIfIndex.o_bytes, 10102 OCTET_LENGTH); 10103 mae6.ipv6AddrIfIndex.o_length = 10104 mi_strlen(mae6.ipv6AddrIfIndex.o_bytes); 10105 mae6.ipv6AddrAddress = ipif->ipif_v6lcl_addr; 10106 mae6.ipv6AddrPfxLength = 10107 ip_mask_to_plen_v6(&ipif->ipif_v6net_mask); 10108 mae6.ipv6AddrInfo.ae_subnet = ipif->ipif_v6subnet; 10109 mae6.ipv6AddrInfo.ae_subnet_len = 10110 mae6.ipv6AddrPfxLength; 10111 mae6.ipv6AddrInfo.ae_src_addr = ipif->ipif_v6lcl_addr; 10112 10113 /* Type: stateless(1), stateful(2), unknown(3) */ 10114 if (ipif->ipif_flags & IPIF_ADDRCONF) 10115 mae6.ipv6AddrType = 1; 10116 else 10117 mae6.ipv6AddrType = 2; 10118 /* Anycast: true(1), false(2) */ 10119 if (ipif->ipif_flags & IPIF_ANYCAST) 10120 mae6.ipv6AddrAnycastFlag = 1; 10121 else 10122 mae6.ipv6AddrAnycastFlag = 2; 10123 10124 /* 10125 * Address status: preferred(1), deprecated(2), 10126 * invalid(3), inaccessible(4), unknown(5) 10127 */ 10128 if (ipif->ipif_flags & IPIF_NOLOCAL) 10129 mae6.ipv6AddrStatus = 3; 10130 else if (ipif->ipif_flags & IPIF_DEPRECATED) 10131 mae6.ipv6AddrStatus = 2; 10132 else 10133 mae6.ipv6AddrStatus = 1; 10134 mae6.ipv6AddrInfo.ae_mtu = ipif->ipif_ill->ill_mtu; 10135 mae6.ipv6AddrInfo.ae_metric = 10136 ipif->ipif_ill->ill_metric; 10137 mae6.ipv6AddrInfo.ae_pp_dst_addr = 10138 ipif->ipif_v6pp_dst_addr; 10139 mae6.ipv6AddrInfo.ae_flags = ipif->ipif_flags | 10140 ill->ill_flags | ill->ill_phyint->phyint_flags; 10141 mae6.ipv6AddrReasmMaxSize = IP_MAXPACKET; 10142 mae6.ipv6AddrIdentifier = ill->ill_token; 10143 mae6.ipv6AddrIdentifierLen = ill->ill_token_length; 10144 mae6.ipv6AddrReachableTime = ill->ill_reachable_time; 10145 mae6.ipv6AddrRetransmitTime = 10146 ill->ill_reachable_retrans_time; 10147 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10148 (char *)&mae6, (int)mae6_size)) { 10149 ip1dbg(("ip_snmp_get_mib2_ip6_addr: failed to " 10150 "allocate %u bytes\n", 10151 (uint_t)mae6_size)); 10152 } 10153 } 10154 } 10155 rw_exit(&ipst->ips_ill_g_lock); 10156 10157 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10158 ip3dbg(("ip_snmp_get_mib2_ip6_addr: level %d, name %d, len %d\n", 10159 (int)optp->level, (int)optp->name, (int)optp->len)); 10160 qreply(q, mpctl); 10161 return (mp2ctl); 10162 } 10163 10164 /* IPv4 multicast group membership. */ 10165 static mblk_t * 10166 ip_snmp_get_mib2_ip_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10167 { 10168 struct opthdr *optp; 10169 mblk_t *mp2ctl; 10170 ill_t *ill; 10171 ipif_t *ipif; 10172 ilm_t *ilm; 10173 ip_member_t ipm; 10174 mblk_t *mp_tail = NULL; 10175 ill_walk_context_t ctx; 10176 zoneid_t zoneid; 10177 10178 /* 10179 * make a copy of the original message 10180 */ 10181 mp2ctl = copymsg(mpctl); 10182 zoneid = Q_TO_CONN(q)->conn_zoneid; 10183 10184 /* ipGroupMember table */ 10185 optp = (struct opthdr *)&mpctl->b_rptr[ 10186 sizeof (struct T_optmgmt_ack)]; 10187 optp->level = MIB2_IP; 10188 optp->name = EXPER_IP_GROUP_MEMBERSHIP; 10189 10190 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10191 ill = ILL_START_WALK_V4(&ctx, ipst); 10192 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10193 /* Make sure the ill isn't going away. */ 10194 if (!ill_check_and_refhold(ill)) 10195 continue; 10196 rw_exit(&ipst->ips_ill_g_lock); 10197 rw_enter(&ill->ill_mcast_lock, RW_READER); 10198 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 10199 if (ilm->ilm_zoneid != zoneid && 10200 ilm->ilm_zoneid != ALL_ZONES) 10201 continue; 10202 10203 /* Is there an ipif for ilm_ifaddr? */ 10204 for (ipif = ill->ill_ipif; ipif != NULL; 10205 ipif = ipif->ipif_next) { 10206 if (!IPIF_IS_CONDEMNED(ipif) && 10207 ipif->ipif_lcl_addr == ilm->ilm_ifaddr && 10208 ilm->ilm_ifaddr != INADDR_ANY) 10209 break; 10210 } 10211 if (ipif != NULL) { 10212 ipif_get_name(ipif, 10213 ipm.ipGroupMemberIfIndex.o_bytes, 10214 OCTET_LENGTH); 10215 } else { 10216 ill_get_name(ill, 10217 ipm.ipGroupMemberIfIndex.o_bytes, 10218 OCTET_LENGTH); 10219 } 10220 ipm.ipGroupMemberIfIndex.o_length = 10221 mi_strlen(ipm.ipGroupMemberIfIndex.o_bytes); 10222 10223 ipm.ipGroupMemberAddress = ilm->ilm_addr; 10224 ipm.ipGroupMemberRefCnt = ilm->ilm_refcnt; 10225 ipm.ipGroupMemberFilterMode = ilm->ilm_fmode; 10226 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10227 (char *)&ipm, (int)sizeof (ipm))) { 10228 ip1dbg(("ip_snmp_get_mib2_ip_group: " 10229 "failed to allocate %u bytes\n", 10230 (uint_t)sizeof (ipm))); 10231 } 10232 } 10233 rw_exit(&ill->ill_mcast_lock); 10234 ill_refrele(ill); 10235 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10236 } 10237 rw_exit(&ipst->ips_ill_g_lock); 10238 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10239 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 10240 (int)optp->level, (int)optp->name, (int)optp->len)); 10241 qreply(q, mpctl); 10242 return (mp2ctl); 10243 } 10244 10245 /* IPv6 multicast group membership. */ 10246 static mblk_t * 10247 ip_snmp_get_mib2_ip6_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10248 { 10249 struct opthdr *optp; 10250 mblk_t *mp2ctl; 10251 ill_t *ill; 10252 ilm_t *ilm; 10253 ipv6_member_t ipm6; 10254 mblk_t *mp_tail = NULL; 10255 ill_walk_context_t ctx; 10256 zoneid_t zoneid; 10257 10258 /* 10259 * make a copy of the original message 10260 */ 10261 mp2ctl = copymsg(mpctl); 10262 zoneid = Q_TO_CONN(q)->conn_zoneid; 10263 10264 /* ip6GroupMember table */ 10265 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10266 optp->level = MIB2_IP6; 10267 optp->name = EXPER_IP6_GROUP_MEMBERSHIP; 10268 10269 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10270 ill = ILL_START_WALK_V6(&ctx, ipst); 10271 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10272 /* Make sure the ill isn't going away. */ 10273 if (!ill_check_and_refhold(ill)) 10274 continue; 10275 rw_exit(&ipst->ips_ill_g_lock); 10276 /* 10277 * Normally we don't have any members on under IPMP interfaces. 10278 * We report them as a debugging aid. 10279 */ 10280 rw_enter(&ill->ill_mcast_lock, RW_READER); 10281 ipm6.ipv6GroupMemberIfIndex = ill->ill_phyint->phyint_ifindex; 10282 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 10283 if (ilm->ilm_zoneid != zoneid && 10284 ilm->ilm_zoneid != ALL_ZONES) 10285 continue; /* not this zone */ 10286 ipm6.ipv6GroupMemberAddress = ilm->ilm_v6addr; 10287 ipm6.ipv6GroupMemberRefCnt = ilm->ilm_refcnt; 10288 ipm6.ipv6GroupMemberFilterMode = ilm->ilm_fmode; 10289 if (!snmp_append_data2(mpctl->b_cont, 10290 &mp_tail, 10291 (char *)&ipm6, (int)sizeof (ipm6))) { 10292 ip1dbg(("ip_snmp_get_mib2_ip6_group: " 10293 "failed to allocate %u bytes\n", 10294 (uint_t)sizeof (ipm6))); 10295 } 10296 } 10297 rw_exit(&ill->ill_mcast_lock); 10298 ill_refrele(ill); 10299 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10300 } 10301 rw_exit(&ipst->ips_ill_g_lock); 10302 10303 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10304 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 10305 (int)optp->level, (int)optp->name, (int)optp->len)); 10306 qreply(q, mpctl); 10307 return (mp2ctl); 10308 } 10309 10310 /* IP multicast filtered sources */ 10311 static mblk_t * 10312 ip_snmp_get_mib2_ip_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10313 { 10314 struct opthdr *optp; 10315 mblk_t *mp2ctl; 10316 ill_t *ill; 10317 ipif_t *ipif; 10318 ilm_t *ilm; 10319 ip_grpsrc_t ips; 10320 mblk_t *mp_tail = NULL; 10321 ill_walk_context_t ctx; 10322 zoneid_t zoneid; 10323 int i; 10324 slist_t *sl; 10325 10326 /* 10327 * make a copy of the original message 10328 */ 10329 mp2ctl = copymsg(mpctl); 10330 zoneid = Q_TO_CONN(q)->conn_zoneid; 10331 10332 /* ipGroupSource table */ 10333 optp = (struct opthdr *)&mpctl->b_rptr[ 10334 sizeof (struct T_optmgmt_ack)]; 10335 optp->level = MIB2_IP; 10336 optp->name = EXPER_IP_GROUP_SOURCES; 10337 10338 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10339 ill = ILL_START_WALK_V4(&ctx, ipst); 10340 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10341 /* Make sure the ill isn't going away. */ 10342 if (!ill_check_and_refhold(ill)) 10343 continue; 10344 rw_exit(&ipst->ips_ill_g_lock); 10345 rw_enter(&ill->ill_mcast_lock, RW_READER); 10346 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 10347 sl = ilm->ilm_filter; 10348 if (ilm->ilm_zoneid != zoneid && 10349 ilm->ilm_zoneid != ALL_ZONES) 10350 continue; 10351 if (SLIST_IS_EMPTY(sl)) 10352 continue; 10353 10354 /* Is there an ipif for ilm_ifaddr? */ 10355 for (ipif = ill->ill_ipif; ipif != NULL; 10356 ipif = ipif->ipif_next) { 10357 if (!IPIF_IS_CONDEMNED(ipif) && 10358 ipif->ipif_lcl_addr == ilm->ilm_ifaddr && 10359 ilm->ilm_ifaddr != INADDR_ANY) 10360 break; 10361 } 10362 if (ipif != NULL) { 10363 ipif_get_name(ipif, 10364 ips.ipGroupSourceIfIndex.o_bytes, 10365 OCTET_LENGTH); 10366 } else { 10367 ill_get_name(ill, 10368 ips.ipGroupSourceIfIndex.o_bytes, 10369 OCTET_LENGTH); 10370 } 10371 ips.ipGroupSourceIfIndex.o_length = 10372 mi_strlen(ips.ipGroupSourceIfIndex.o_bytes); 10373 10374 ips.ipGroupSourceGroup = ilm->ilm_addr; 10375 for (i = 0; i < sl->sl_numsrc; i++) { 10376 if (!IN6_IS_ADDR_V4MAPPED(&sl->sl_addr[i])) 10377 continue; 10378 IN6_V4MAPPED_TO_IPADDR(&sl->sl_addr[i], 10379 ips.ipGroupSourceAddress); 10380 if (snmp_append_data2(mpctl->b_cont, &mp_tail, 10381 (char *)&ips, (int)sizeof (ips)) == 0) { 10382 ip1dbg(("ip_snmp_get_mib2_ip_group_src:" 10383 " failed to allocate %u bytes\n", 10384 (uint_t)sizeof (ips))); 10385 } 10386 } 10387 } 10388 rw_exit(&ill->ill_mcast_lock); 10389 ill_refrele(ill); 10390 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10391 } 10392 rw_exit(&ipst->ips_ill_g_lock); 10393 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10394 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 10395 (int)optp->level, (int)optp->name, (int)optp->len)); 10396 qreply(q, mpctl); 10397 return (mp2ctl); 10398 } 10399 10400 /* IPv6 multicast filtered sources. */ 10401 static mblk_t * 10402 ip_snmp_get_mib2_ip6_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10403 { 10404 struct opthdr *optp; 10405 mblk_t *mp2ctl; 10406 ill_t *ill; 10407 ilm_t *ilm; 10408 ipv6_grpsrc_t ips6; 10409 mblk_t *mp_tail = NULL; 10410 ill_walk_context_t ctx; 10411 zoneid_t zoneid; 10412 int i; 10413 slist_t *sl; 10414 10415 /* 10416 * make a copy of the original message 10417 */ 10418 mp2ctl = copymsg(mpctl); 10419 zoneid = Q_TO_CONN(q)->conn_zoneid; 10420 10421 /* ip6GroupMember table */ 10422 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10423 optp->level = MIB2_IP6; 10424 optp->name = EXPER_IP6_GROUP_SOURCES; 10425 10426 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10427 ill = ILL_START_WALK_V6(&ctx, ipst); 10428 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10429 /* Make sure the ill isn't going away. */ 10430 if (!ill_check_and_refhold(ill)) 10431 continue; 10432 rw_exit(&ipst->ips_ill_g_lock); 10433 /* 10434 * Normally we don't have any members on under IPMP interfaces. 10435 * We report them as a debugging aid. 10436 */ 10437 rw_enter(&ill->ill_mcast_lock, RW_READER); 10438 ips6.ipv6GroupSourceIfIndex = ill->ill_phyint->phyint_ifindex; 10439 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 10440 sl = ilm->ilm_filter; 10441 if (ilm->ilm_zoneid != zoneid && 10442 ilm->ilm_zoneid != ALL_ZONES) 10443 continue; 10444 if (SLIST_IS_EMPTY(sl)) 10445 continue; 10446 ips6.ipv6GroupSourceGroup = ilm->ilm_v6addr; 10447 for (i = 0; i < sl->sl_numsrc; i++) { 10448 ips6.ipv6GroupSourceAddress = sl->sl_addr[i]; 10449 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10450 (char *)&ips6, (int)sizeof (ips6))) { 10451 ip1dbg(("ip_snmp_get_mib2_ip6_" 10452 "group_src: failed to allocate " 10453 "%u bytes\n", 10454 (uint_t)sizeof (ips6))); 10455 } 10456 } 10457 } 10458 rw_exit(&ill->ill_mcast_lock); 10459 ill_refrele(ill); 10460 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10461 } 10462 rw_exit(&ipst->ips_ill_g_lock); 10463 10464 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10465 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 10466 (int)optp->level, (int)optp->name, (int)optp->len)); 10467 qreply(q, mpctl); 10468 return (mp2ctl); 10469 } 10470 10471 /* Multicast routing virtual interface table. */ 10472 static mblk_t * 10473 ip_snmp_get_mib2_virt_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10474 { 10475 struct opthdr *optp; 10476 mblk_t *mp2ctl; 10477 10478 /* 10479 * make a copy of the original message 10480 */ 10481 mp2ctl = copymsg(mpctl); 10482 10483 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10484 optp->level = EXPER_DVMRP; 10485 optp->name = EXPER_DVMRP_VIF; 10486 if (!ip_mroute_vif(mpctl->b_cont, ipst)) { 10487 ip0dbg(("ip_mroute_vif: failed\n")); 10488 } 10489 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10490 ip3dbg(("ip_snmp_get_mib2_virt_multi: level %d, name %d, len %d\n", 10491 (int)optp->level, (int)optp->name, (int)optp->len)); 10492 qreply(q, mpctl); 10493 return (mp2ctl); 10494 } 10495 10496 /* Multicast routing table. */ 10497 static mblk_t * 10498 ip_snmp_get_mib2_multi_rtable(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10499 { 10500 struct opthdr *optp; 10501 mblk_t *mp2ctl; 10502 10503 /* 10504 * make a copy of the original message 10505 */ 10506 mp2ctl = copymsg(mpctl); 10507 10508 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10509 optp->level = EXPER_DVMRP; 10510 optp->name = EXPER_DVMRP_MRT; 10511 if (!ip_mroute_mrt(mpctl->b_cont, ipst)) { 10512 ip0dbg(("ip_mroute_mrt: failed\n")); 10513 } 10514 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10515 ip3dbg(("ip_snmp_get_mib2_multi_rtable: level %d, name %d, len %d\n", 10516 (int)optp->level, (int)optp->name, (int)optp->len)); 10517 qreply(q, mpctl); 10518 return (mp2ctl); 10519 } 10520 10521 /* 10522 * Return ipRouteEntryTable, ipNetToMediaEntryTable, and ipRouteAttributeTable 10523 * in one IRE walk. 10524 */ 10525 static mblk_t * 10526 ip_snmp_get_mib2_ip_route_media(queue_t *q, mblk_t *mpctl, int level, 10527 ip_stack_t *ipst) 10528 { 10529 struct opthdr *optp; 10530 mblk_t *mp2ctl; /* Returned */ 10531 mblk_t *mp3ctl; /* nettomedia */ 10532 mblk_t *mp4ctl; /* routeattrs */ 10533 iproutedata_t ird; 10534 zoneid_t zoneid; 10535 10536 /* 10537 * make copies of the original message 10538 * - mp2ctl is returned unchanged to the caller for his use 10539 * - mpctl is sent upstream as ipRouteEntryTable 10540 * - mp3ctl is sent upstream as ipNetToMediaEntryTable 10541 * - mp4ctl is sent upstream as ipRouteAttributeTable 10542 */ 10543 mp2ctl = copymsg(mpctl); 10544 mp3ctl = copymsg(mpctl); 10545 mp4ctl = copymsg(mpctl); 10546 if (mp3ctl == NULL || mp4ctl == NULL) { 10547 freemsg(mp4ctl); 10548 freemsg(mp3ctl); 10549 freemsg(mp2ctl); 10550 freemsg(mpctl); 10551 return (NULL); 10552 } 10553 10554 bzero(&ird, sizeof (ird)); 10555 10556 ird.ird_route.lp_head = mpctl->b_cont; 10557 ird.ird_netmedia.lp_head = mp3ctl->b_cont; 10558 ird.ird_attrs.lp_head = mp4ctl->b_cont; 10559 /* 10560 * If the level has been set the special EXPER_IP_AND_ALL_IRES value, 10561 * then also include ire_testhidden IREs and IRE_IF_CLONE. This is 10562 * intended a temporary solution until a proper MIB API is provided 10563 * that provides complete filtering/caller-opt-in. 10564 */ 10565 if (level == EXPER_IP_AND_ALL_IRES) 10566 ird.ird_flags |= IRD_REPORT_ALL; 10567 10568 zoneid = Q_TO_CONN(q)->conn_zoneid; 10569 ire_walk_v4(ip_snmp_get2_v4, &ird, zoneid, ipst); 10570 10571 /* ipRouteEntryTable in mpctl */ 10572 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10573 optp->level = MIB2_IP; 10574 optp->name = MIB2_IP_ROUTE; 10575 optp->len = msgdsize(ird.ird_route.lp_head); 10576 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n", 10577 (int)optp->level, (int)optp->name, (int)optp->len)); 10578 qreply(q, mpctl); 10579 10580 /* ipNetToMediaEntryTable in mp3ctl */ 10581 ncec_walk(NULL, ip_snmp_get2_v4_media, &ird, ipst); 10582 10583 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10584 optp->level = MIB2_IP; 10585 optp->name = MIB2_IP_MEDIA; 10586 optp->len = msgdsize(ird.ird_netmedia.lp_head); 10587 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n", 10588 (int)optp->level, (int)optp->name, (int)optp->len)); 10589 qreply(q, mp3ctl); 10590 10591 /* ipRouteAttributeTable in mp4ctl */ 10592 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10593 optp->level = MIB2_IP; 10594 optp->name = EXPER_IP_RTATTR; 10595 optp->len = msgdsize(ird.ird_attrs.lp_head); 10596 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n", 10597 (int)optp->level, (int)optp->name, (int)optp->len)); 10598 if (optp->len == 0) 10599 freemsg(mp4ctl); 10600 else 10601 qreply(q, mp4ctl); 10602 10603 return (mp2ctl); 10604 } 10605 10606 /* 10607 * Return ipv6RouteEntryTable and ipv6RouteAttributeTable in one IRE walk, and 10608 * ipv6NetToMediaEntryTable in an NDP walk. 10609 */ 10610 static mblk_t * 10611 ip_snmp_get_mib2_ip6_route_media(queue_t *q, mblk_t *mpctl, int level, 10612 ip_stack_t *ipst) 10613 { 10614 struct opthdr *optp; 10615 mblk_t *mp2ctl; /* Returned */ 10616 mblk_t *mp3ctl; /* nettomedia */ 10617 mblk_t *mp4ctl; /* routeattrs */ 10618 iproutedata_t ird; 10619 zoneid_t zoneid; 10620 10621 /* 10622 * make copies of the original message 10623 * - mp2ctl is returned unchanged to the caller for his use 10624 * - mpctl is sent upstream as ipv6RouteEntryTable 10625 * - mp3ctl is sent upstream as ipv6NetToMediaEntryTable 10626 * - mp4ctl is sent upstream as ipv6RouteAttributeTable 10627 */ 10628 mp2ctl = copymsg(mpctl); 10629 mp3ctl = copymsg(mpctl); 10630 mp4ctl = copymsg(mpctl); 10631 if (mp3ctl == NULL || mp4ctl == NULL) { 10632 freemsg(mp4ctl); 10633 freemsg(mp3ctl); 10634 freemsg(mp2ctl); 10635 freemsg(mpctl); 10636 return (NULL); 10637 } 10638 10639 bzero(&ird, sizeof (ird)); 10640 10641 ird.ird_route.lp_head = mpctl->b_cont; 10642 ird.ird_netmedia.lp_head = mp3ctl->b_cont; 10643 ird.ird_attrs.lp_head = mp4ctl->b_cont; 10644 /* 10645 * If the level has been set the special EXPER_IP_AND_ALL_IRES value, 10646 * then also include ire_testhidden IREs and IRE_IF_CLONE. This is 10647 * intended a temporary solution until a proper MIB API is provided 10648 * that provides complete filtering/caller-opt-in. 10649 */ 10650 if (level == EXPER_IP_AND_ALL_IRES) 10651 ird.ird_flags |= IRD_REPORT_ALL; 10652 10653 zoneid = Q_TO_CONN(q)->conn_zoneid; 10654 ire_walk_v6(ip_snmp_get2_v6_route, &ird, zoneid, ipst); 10655 10656 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10657 optp->level = MIB2_IP6; 10658 optp->name = MIB2_IP6_ROUTE; 10659 optp->len = msgdsize(ird.ird_route.lp_head); 10660 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n", 10661 (int)optp->level, (int)optp->name, (int)optp->len)); 10662 qreply(q, mpctl); 10663 10664 /* ipv6NetToMediaEntryTable in mp3ctl */ 10665 ncec_walk(NULL, ip_snmp_get2_v6_media, &ird, ipst); 10666 10667 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10668 optp->level = MIB2_IP6; 10669 optp->name = MIB2_IP6_MEDIA; 10670 optp->len = msgdsize(ird.ird_netmedia.lp_head); 10671 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n", 10672 (int)optp->level, (int)optp->name, (int)optp->len)); 10673 qreply(q, mp3ctl); 10674 10675 /* ipv6RouteAttributeTable in mp4ctl */ 10676 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10677 optp->level = MIB2_IP6; 10678 optp->name = EXPER_IP_RTATTR; 10679 optp->len = msgdsize(ird.ird_attrs.lp_head); 10680 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n", 10681 (int)optp->level, (int)optp->name, (int)optp->len)); 10682 if (optp->len == 0) 10683 freemsg(mp4ctl); 10684 else 10685 qreply(q, mp4ctl); 10686 10687 return (mp2ctl); 10688 } 10689 10690 /* 10691 * IPv6 mib: One per ill 10692 */ 10693 static mblk_t * 10694 ip_snmp_get_mib2_ip6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst, 10695 boolean_t legacy_req) 10696 { 10697 struct opthdr *optp; 10698 mblk_t *mp2ctl; 10699 ill_t *ill; 10700 ill_walk_context_t ctx; 10701 mblk_t *mp_tail = NULL; 10702 mib2_ipv6AddrEntry_t mae6; 10703 mib2_ipIfStatsEntry_t *ise; 10704 size_t ise_size, iae_size; 10705 10706 /* 10707 * Make a copy of the original message 10708 */ 10709 mp2ctl = copymsg(mpctl); 10710 10711 /* fixed length IPv6 structure ... */ 10712 10713 if (legacy_req) { 10714 ise_size = LEGACY_MIB_SIZE(&ipst->ips_ip6_mib, 10715 mib2_ipIfStatsEntry_t); 10716 iae_size = LEGACY_MIB_SIZE(&mae6, mib2_ipv6AddrEntry_t); 10717 } else { 10718 ise_size = sizeof (mib2_ipIfStatsEntry_t); 10719 iae_size = sizeof (mib2_ipv6AddrEntry_t); 10720 } 10721 10722 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10723 optp->level = MIB2_IP6; 10724 optp->name = 0; 10725 /* Include "unknown interface" ip6_mib */ 10726 ipst->ips_ip6_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6; 10727 ipst->ips_ip6_mib.ipIfStatsIfIndex = 10728 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */ 10729 SET_MIB(ipst->ips_ip6_mib.ipIfStatsForwarding, 10730 ipst->ips_ipv6_forwarding ? 1 : 2); 10731 SET_MIB(ipst->ips_ip6_mib.ipIfStatsDefaultHopLimit, 10732 ipst->ips_ipv6_def_hops); 10733 SET_MIB(ipst->ips_ip6_mib.ipIfStatsEntrySize, 10734 sizeof (mib2_ipIfStatsEntry_t)); 10735 SET_MIB(ipst->ips_ip6_mib.ipIfStatsAddrEntrySize, 10736 sizeof (mib2_ipv6AddrEntry_t)); 10737 SET_MIB(ipst->ips_ip6_mib.ipIfStatsRouteEntrySize, 10738 sizeof (mib2_ipv6RouteEntry_t)); 10739 SET_MIB(ipst->ips_ip6_mib.ipIfStatsNetToMediaEntrySize, 10740 sizeof (mib2_ipv6NetToMediaEntry_t)); 10741 SET_MIB(ipst->ips_ip6_mib.ipIfStatsMemberEntrySize, 10742 sizeof (ipv6_member_t)); 10743 SET_MIB(ipst->ips_ip6_mib.ipIfStatsGroupSourceEntrySize, 10744 sizeof (ipv6_grpsrc_t)); 10745 10746 /* 10747 * Synchronize 64- and 32-bit counters 10748 */ 10749 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInReceives, 10750 ipIfStatsHCInReceives); 10751 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInDelivers, 10752 ipIfStatsHCInDelivers); 10753 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutRequests, 10754 ipIfStatsHCOutRequests); 10755 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutForwDatagrams, 10756 ipIfStatsHCOutForwDatagrams); 10757 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutMcastPkts, 10758 ipIfStatsHCOutMcastPkts); 10759 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInMcastPkts, 10760 ipIfStatsHCInMcastPkts); 10761 10762 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10763 (char *)&ipst->ips_ip6_mib, (int)ise_size)) { 10764 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate %u bytes\n", 10765 (uint_t)ise_size)); 10766 } else if (legacy_req) { 10767 /* Adjust the EntrySize fields for legacy requests. */ 10768 ise = 10769 (mib2_ipIfStatsEntry_t *)(mp_tail->b_wptr - (int)ise_size); 10770 SET_MIB(ise->ipIfStatsEntrySize, ise_size); 10771 SET_MIB(ise->ipIfStatsAddrEntrySize, iae_size); 10772 } 10773 10774 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10775 ill = ILL_START_WALK_V6(&ctx, ipst); 10776 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10777 ill->ill_ip_mib->ipIfStatsIfIndex = 10778 ill->ill_phyint->phyint_ifindex; 10779 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding, 10780 ipst->ips_ipv6_forwarding ? 1 : 2); 10781 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultHopLimit, 10782 ill->ill_max_hops); 10783 10784 /* 10785 * Synchronize 64- and 32-bit counters 10786 */ 10787 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInReceives, 10788 ipIfStatsHCInReceives); 10789 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInDelivers, 10790 ipIfStatsHCInDelivers); 10791 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutRequests, 10792 ipIfStatsHCOutRequests); 10793 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutForwDatagrams, 10794 ipIfStatsHCOutForwDatagrams); 10795 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutMcastPkts, 10796 ipIfStatsHCOutMcastPkts); 10797 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInMcastPkts, 10798 ipIfStatsHCInMcastPkts); 10799 10800 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10801 (char *)ill->ill_ip_mib, (int)ise_size)) { 10802 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate " 10803 "%u bytes\n", (uint_t)ise_size)); 10804 } else if (legacy_req) { 10805 /* Adjust the EntrySize fields for legacy requests. */ 10806 ise = (mib2_ipIfStatsEntry_t *)(mp_tail->b_wptr - 10807 (int)ise_size); 10808 SET_MIB(ise->ipIfStatsEntrySize, ise_size); 10809 SET_MIB(ise->ipIfStatsAddrEntrySize, iae_size); 10810 } 10811 } 10812 rw_exit(&ipst->ips_ill_g_lock); 10813 10814 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10815 ip3dbg(("ip_snmp_get_mib2_ip6: level %d, name %d, len %d\n", 10816 (int)optp->level, (int)optp->name, (int)optp->len)); 10817 qreply(q, mpctl); 10818 return (mp2ctl); 10819 } 10820 10821 /* 10822 * ICMPv6 mib: One per ill 10823 */ 10824 static mblk_t * 10825 ip_snmp_get_mib2_icmp6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 10826 { 10827 struct opthdr *optp; 10828 mblk_t *mp2ctl; 10829 ill_t *ill; 10830 ill_walk_context_t ctx; 10831 mblk_t *mp_tail = NULL; 10832 /* 10833 * Make a copy of the original message 10834 */ 10835 mp2ctl = copymsg(mpctl); 10836 10837 /* fixed length ICMPv6 structure ... */ 10838 10839 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 10840 optp->level = MIB2_ICMP6; 10841 optp->name = 0; 10842 /* Include "unknown interface" icmp6_mib */ 10843 ipst->ips_icmp6_mib.ipv6IfIcmpIfIndex = 10844 MIB2_UNKNOWN_INTERFACE; /* netstat flag */ 10845 ipst->ips_icmp6_mib.ipv6IfIcmpEntrySize = 10846 sizeof (mib2_ipv6IfIcmpEntry_t); 10847 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10848 (char *)&ipst->ips_icmp6_mib, 10849 (int)sizeof (ipst->ips_icmp6_mib))) { 10850 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate %u bytes\n", 10851 (uint_t)sizeof (ipst->ips_icmp6_mib))); 10852 } 10853 10854 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 10855 ill = ILL_START_WALK_V6(&ctx, ipst); 10856 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 10857 ill->ill_icmp6_mib->ipv6IfIcmpIfIndex = 10858 ill->ill_phyint->phyint_ifindex; 10859 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 10860 (char *)ill->ill_icmp6_mib, 10861 (int)sizeof (*ill->ill_icmp6_mib))) { 10862 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate " 10863 "%u bytes\n", 10864 (uint_t)sizeof (*ill->ill_icmp6_mib))); 10865 } 10866 } 10867 rw_exit(&ipst->ips_ill_g_lock); 10868 10869 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 10870 ip3dbg(("ip_snmp_get_mib2_icmp6: level %d, name %d, len %d\n", 10871 (int)optp->level, (int)optp->name, (int)optp->len)); 10872 qreply(q, mpctl); 10873 return (mp2ctl); 10874 } 10875 10876 /* 10877 * ire_walk routine to create both ipRouteEntryTable and 10878 * ipRouteAttributeTable in one IRE walk 10879 */ 10880 static void 10881 ip_snmp_get2_v4(ire_t *ire, iproutedata_t *ird) 10882 { 10883 ill_t *ill; 10884 mib2_ipRouteEntry_t *re; 10885 mib2_ipAttributeEntry_t iaes; 10886 tsol_ire_gw_secattr_t *attrp; 10887 tsol_gc_t *gc = NULL; 10888 tsol_gcgrp_t *gcgrp = NULL; 10889 ip_stack_t *ipst = ire->ire_ipst; 10890 10891 ASSERT(ire->ire_ipversion == IPV4_VERSION); 10892 10893 if (!(ird->ird_flags & IRD_REPORT_ALL)) { 10894 if (ire->ire_testhidden) 10895 return; 10896 if (ire->ire_type & IRE_IF_CLONE) 10897 return; 10898 } 10899 10900 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL) 10901 return; 10902 10903 if ((attrp = ire->ire_gw_secattr) != NULL) { 10904 mutex_enter(&attrp->igsa_lock); 10905 if ((gc = attrp->igsa_gc) != NULL) { 10906 gcgrp = gc->gc_grp; 10907 ASSERT(gcgrp != NULL); 10908 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER); 10909 } 10910 mutex_exit(&attrp->igsa_lock); 10911 } 10912 /* 10913 * Return all IRE types for route table... let caller pick and choose 10914 */ 10915 re->ipRouteDest = ire->ire_addr; 10916 ill = ire->ire_ill; 10917 re->ipRouteIfIndex.o_length = 0; 10918 if (ill != NULL) { 10919 ill_get_name(ill, re->ipRouteIfIndex.o_bytes, OCTET_LENGTH); 10920 re->ipRouteIfIndex.o_length = 10921 mi_strlen(re->ipRouteIfIndex.o_bytes); 10922 } 10923 re->ipRouteMetric1 = -1; 10924 re->ipRouteMetric2 = -1; 10925 re->ipRouteMetric3 = -1; 10926 re->ipRouteMetric4 = -1; 10927 10928 re->ipRouteNextHop = ire->ire_gateway_addr; 10929 /* indirect(4), direct(3), or invalid(2) */ 10930 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) 10931 re->ipRouteType = 2; 10932 else if (ire->ire_type & IRE_ONLINK) 10933 re->ipRouteType = 3; 10934 else 10935 re->ipRouteType = 4; 10936 10937 re->ipRouteProto = -1; 10938 re->ipRouteAge = gethrestime_sec() - ire->ire_create_time; 10939 re->ipRouteMask = ire->ire_mask; 10940 re->ipRouteMetric5 = -1; 10941 re->ipRouteInfo.re_max_frag = ire->ire_metrics.iulp_mtu; 10942 if (ire->ire_ill != NULL && re->ipRouteInfo.re_max_frag == 0) 10943 re->ipRouteInfo.re_max_frag = ire->ire_ill->ill_mtu; 10944 10945 re->ipRouteInfo.re_frag_flag = 0; 10946 re->ipRouteInfo.re_rtt = 0; 10947 re->ipRouteInfo.re_src_addr = 0; 10948 re->ipRouteInfo.re_ref = ire->ire_refcnt; 10949 re->ipRouteInfo.re_obpkt = ire->ire_ob_pkt_count; 10950 re->ipRouteInfo.re_ibpkt = ire->ire_ib_pkt_count; 10951 re->ipRouteInfo.re_flags = ire->ire_flags; 10952 10953 /* Add the IRE_IF_CLONE's counters to their parent IRE_INTERFACE */ 10954 if (ire->ire_type & IRE_INTERFACE) { 10955 ire_t *child; 10956 10957 rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 10958 child = ire->ire_dep_children; 10959 while (child != NULL) { 10960 re->ipRouteInfo.re_obpkt += child->ire_ob_pkt_count; 10961 re->ipRouteInfo.re_ibpkt += child->ire_ib_pkt_count; 10962 child = child->ire_dep_sib_next; 10963 } 10964 rw_exit(&ipst->ips_ire_dep_lock); 10965 } 10966 10967 if (ire->ire_flags & RTF_DYNAMIC) { 10968 re->ipRouteInfo.re_ire_type = IRE_HOST_REDIRECT; 10969 } else { 10970 re->ipRouteInfo.re_ire_type = ire->ire_type; 10971 } 10972 10973 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail, 10974 (char *)re, (int)sizeof (*re))) { 10975 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n", 10976 (uint_t)sizeof (*re))); 10977 } 10978 10979 if (gc != NULL) { 10980 iaes.iae_routeidx = ird->ird_idx; 10981 iaes.iae_doi = gc->gc_db->gcdb_doi; 10982 iaes.iae_slrange = gc->gc_db->gcdb_slrange; 10983 10984 if (!snmp_append_data2(ird->ird_attrs.lp_head, 10985 &ird->ird_attrs.lp_tail, (char *)&iaes, sizeof (iaes))) { 10986 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u " 10987 "bytes\n", (uint_t)sizeof (iaes))); 10988 } 10989 } 10990 10991 /* bump route index for next pass */ 10992 ird->ird_idx++; 10993 10994 kmem_free(re, sizeof (*re)); 10995 if (gcgrp != NULL) 10996 rw_exit(&gcgrp->gcgrp_rwlock); 10997 } 10998 10999 /* 11000 * ire_walk routine to create ipv6RouteEntryTable and ipRouteEntryTable. 11001 */ 11002 static void 11003 ip_snmp_get2_v6_route(ire_t *ire, iproutedata_t *ird) 11004 { 11005 ill_t *ill; 11006 mib2_ipv6RouteEntry_t *re; 11007 mib2_ipAttributeEntry_t iaes; 11008 tsol_ire_gw_secattr_t *attrp; 11009 tsol_gc_t *gc = NULL; 11010 tsol_gcgrp_t *gcgrp = NULL; 11011 ip_stack_t *ipst = ire->ire_ipst; 11012 11013 ASSERT(ire->ire_ipversion == IPV6_VERSION); 11014 11015 if (!(ird->ird_flags & IRD_REPORT_ALL)) { 11016 if (ire->ire_testhidden) 11017 return; 11018 if (ire->ire_type & IRE_IF_CLONE) 11019 return; 11020 } 11021 11022 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL) 11023 return; 11024 11025 if ((attrp = ire->ire_gw_secattr) != NULL) { 11026 mutex_enter(&attrp->igsa_lock); 11027 if ((gc = attrp->igsa_gc) != NULL) { 11028 gcgrp = gc->gc_grp; 11029 ASSERT(gcgrp != NULL); 11030 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER); 11031 } 11032 mutex_exit(&attrp->igsa_lock); 11033 } 11034 /* 11035 * Return all IRE types for route table... let caller pick and choose 11036 */ 11037 re->ipv6RouteDest = ire->ire_addr_v6; 11038 re->ipv6RoutePfxLength = ip_mask_to_plen_v6(&ire->ire_mask_v6); 11039 re->ipv6RouteIndex = 0; /* Unique when multiple with same dest/plen */ 11040 re->ipv6RouteIfIndex.o_length = 0; 11041 ill = ire->ire_ill; 11042 if (ill != NULL) { 11043 ill_get_name(ill, re->ipv6RouteIfIndex.o_bytes, OCTET_LENGTH); 11044 re->ipv6RouteIfIndex.o_length = 11045 mi_strlen(re->ipv6RouteIfIndex.o_bytes); 11046 } 11047 11048 ASSERT(!(ire->ire_type & IRE_BROADCAST)); 11049 11050 mutex_enter(&ire->ire_lock); 11051 re->ipv6RouteNextHop = ire->ire_gateway_addr_v6; 11052 mutex_exit(&ire->ire_lock); 11053 11054 /* remote(4), local(3), or discard(2) */ 11055 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) 11056 re->ipv6RouteType = 2; 11057 else if (ire->ire_type & IRE_ONLINK) 11058 re->ipv6RouteType = 3; 11059 else 11060 re->ipv6RouteType = 4; 11061 11062 re->ipv6RouteProtocol = -1; 11063 re->ipv6RoutePolicy = 0; 11064 re->ipv6RouteAge = gethrestime_sec() - ire->ire_create_time; 11065 re->ipv6RouteNextHopRDI = 0; 11066 re->ipv6RouteWeight = 0; 11067 re->ipv6RouteMetric = 0; 11068 re->ipv6RouteInfo.re_max_frag = ire->ire_metrics.iulp_mtu; 11069 if (ire->ire_ill != NULL && re->ipv6RouteInfo.re_max_frag == 0) 11070 re->ipv6RouteInfo.re_max_frag = ire->ire_ill->ill_mtu; 11071 11072 re->ipv6RouteInfo.re_frag_flag = 0; 11073 re->ipv6RouteInfo.re_rtt = 0; 11074 re->ipv6RouteInfo.re_src_addr = ipv6_all_zeros; 11075 re->ipv6RouteInfo.re_obpkt = ire->ire_ob_pkt_count; 11076 re->ipv6RouteInfo.re_ibpkt = ire->ire_ib_pkt_count; 11077 re->ipv6RouteInfo.re_ref = ire->ire_refcnt; 11078 re->ipv6RouteInfo.re_flags = ire->ire_flags; 11079 11080 /* Add the IRE_IF_CLONE's counters to their parent IRE_INTERFACE */ 11081 if (ire->ire_type & IRE_INTERFACE) { 11082 ire_t *child; 11083 11084 rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 11085 child = ire->ire_dep_children; 11086 while (child != NULL) { 11087 re->ipv6RouteInfo.re_obpkt += child->ire_ob_pkt_count; 11088 re->ipv6RouteInfo.re_ibpkt += child->ire_ib_pkt_count; 11089 child = child->ire_dep_sib_next; 11090 } 11091 rw_exit(&ipst->ips_ire_dep_lock); 11092 } 11093 if (ire->ire_flags & RTF_DYNAMIC) { 11094 re->ipv6RouteInfo.re_ire_type = IRE_HOST_REDIRECT; 11095 } else { 11096 re->ipv6RouteInfo.re_ire_type = ire->ire_type; 11097 } 11098 11099 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail, 11100 (char *)re, (int)sizeof (*re))) { 11101 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u bytes\n", 11102 (uint_t)sizeof (*re))); 11103 } 11104 11105 if (gc != NULL) { 11106 iaes.iae_routeidx = ird->ird_idx; 11107 iaes.iae_doi = gc->gc_db->gcdb_doi; 11108 iaes.iae_slrange = gc->gc_db->gcdb_slrange; 11109 11110 if (!snmp_append_data2(ird->ird_attrs.lp_head, 11111 &ird->ird_attrs.lp_tail, (char *)&iaes, sizeof (iaes))) { 11112 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u " 11113 "bytes\n", (uint_t)sizeof (iaes))); 11114 } 11115 } 11116 11117 /* bump route index for next pass */ 11118 ird->ird_idx++; 11119 11120 kmem_free(re, sizeof (*re)); 11121 if (gcgrp != NULL) 11122 rw_exit(&gcgrp->gcgrp_rwlock); 11123 } 11124 11125 /* 11126 * ncec_walk routine to create ipv6NetToMediaEntryTable 11127 */ 11128 static int 11129 ip_snmp_get2_v6_media(ncec_t *ncec, iproutedata_t *ird) 11130 { 11131 ill_t *ill; 11132 mib2_ipv6NetToMediaEntry_t ntme; 11133 11134 ill = ncec->ncec_ill; 11135 /* skip arpce entries, and loopback ncec entries */ 11136 if (ill->ill_isv6 == B_FALSE || ill->ill_net_type == IRE_LOOPBACK) 11137 return (0); 11138 /* 11139 * Neighbor cache entry attached to IRE with on-link 11140 * destination. 11141 * We report all IPMP groups on ncec_ill which is normally the upper. 11142 */ 11143 ntme.ipv6NetToMediaIfIndex = ill->ill_phyint->phyint_ifindex; 11144 ntme.ipv6NetToMediaNetAddress = ncec->ncec_addr; 11145 ntme.ipv6NetToMediaPhysAddress.o_length = ill->ill_phys_addr_length; 11146 if (ncec->ncec_lladdr != NULL) { 11147 bcopy(ncec->ncec_lladdr, ntme.ipv6NetToMediaPhysAddress.o_bytes, 11148 ntme.ipv6NetToMediaPhysAddress.o_length); 11149 } 11150 /* 11151 * Note: Returns ND_* states. Should be: 11152 * reachable(1), stale(2), delay(3), probe(4), 11153 * invalid(5), unknown(6) 11154 */ 11155 ntme.ipv6NetToMediaState = ncec->ncec_state; 11156 ntme.ipv6NetToMediaLastUpdated = 0; 11157 11158 /* other(1), dynamic(2), static(3), local(4) */ 11159 if (NCE_MYADDR(ncec)) { 11160 ntme.ipv6NetToMediaType = 4; 11161 } else if (ncec->ncec_flags & NCE_F_PUBLISH) { 11162 ntme.ipv6NetToMediaType = 1; /* proxy */ 11163 } else if (ncec->ncec_flags & NCE_F_STATIC) { 11164 ntme.ipv6NetToMediaType = 3; 11165 } else if (ncec->ncec_flags & (NCE_F_MCAST|NCE_F_BCAST)) { 11166 ntme.ipv6NetToMediaType = 1; 11167 } else { 11168 ntme.ipv6NetToMediaType = 2; 11169 } 11170 11171 if (!snmp_append_data2(ird->ird_netmedia.lp_head, 11172 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) { 11173 ip1dbg(("ip_snmp_get2_v6_media: failed to allocate %u bytes\n", 11174 (uint_t)sizeof (ntme))); 11175 } 11176 return (0); 11177 } 11178 11179 int 11180 nce2ace(ncec_t *ncec) 11181 { 11182 int flags = 0; 11183 11184 if (NCE_ISREACHABLE(ncec)) 11185 flags |= ACE_F_RESOLVED; 11186 if (ncec->ncec_flags & NCE_F_AUTHORITY) 11187 flags |= ACE_F_AUTHORITY; 11188 if (ncec->ncec_flags & NCE_F_PUBLISH) 11189 flags |= ACE_F_PUBLISH; 11190 if ((ncec->ncec_flags & NCE_F_NONUD) != 0) 11191 flags |= ACE_F_PERMANENT; 11192 if (NCE_MYADDR(ncec)) 11193 flags |= (ACE_F_MYADDR | ACE_F_AUTHORITY); 11194 if (ncec->ncec_flags & NCE_F_UNVERIFIED) 11195 flags |= ACE_F_UNVERIFIED; 11196 if (ncec->ncec_flags & NCE_F_AUTHORITY) 11197 flags |= ACE_F_AUTHORITY; 11198 if (ncec->ncec_flags & NCE_F_DELAYED) 11199 flags |= ACE_F_DELAYED; 11200 return (flags); 11201 } 11202 11203 /* 11204 * ncec_walk routine to create ipNetToMediaEntryTable 11205 */ 11206 static int 11207 ip_snmp_get2_v4_media(ncec_t *ncec, iproutedata_t *ird) 11208 { 11209 ill_t *ill; 11210 mib2_ipNetToMediaEntry_t ntme; 11211 const char *name = "unknown"; 11212 ipaddr_t ncec_addr; 11213 11214 ill = ncec->ncec_ill; 11215 if (ill->ill_isv6 || (ncec->ncec_flags & NCE_F_BCAST) || 11216 ill->ill_net_type == IRE_LOOPBACK) 11217 return (0); 11218 11219 /* We report all IPMP groups on ncec_ill which is normally the upper. */ 11220 name = ill->ill_name; 11221 /* Based on RFC 4293: other(1), inval(2), dyn(3), stat(4) */ 11222 if (NCE_MYADDR(ncec)) { 11223 ntme.ipNetToMediaType = 4; 11224 } else if (ncec->ncec_flags & (NCE_F_MCAST|NCE_F_BCAST|NCE_F_PUBLISH)) { 11225 ntme.ipNetToMediaType = 1; 11226 } else { 11227 ntme.ipNetToMediaType = 3; 11228 } 11229 ntme.ipNetToMediaIfIndex.o_length = MIN(OCTET_LENGTH, strlen(name)); 11230 bcopy(name, ntme.ipNetToMediaIfIndex.o_bytes, 11231 ntme.ipNetToMediaIfIndex.o_length); 11232 11233 IN6_V4MAPPED_TO_IPADDR(&ncec->ncec_addr, ncec_addr); 11234 bcopy(&ncec_addr, &ntme.ipNetToMediaNetAddress, sizeof (ncec_addr)); 11235 11236 ntme.ipNetToMediaInfo.ntm_mask.o_length = sizeof (ipaddr_t); 11237 ncec_addr = INADDR_BROADCAST; 11238 bcopy(&ncec_addr, ntme.ipNetToMediaInfo.ntm_mask.o_bytes, 11239 sizeof (ncec_addr)); 11240 /* 11241 * map all the flags to the ACE counterpart. 11242 */ 11243 ntme.ipNetToMediaInfo.ntm_flags = nce2ace(ncec); 11244 11245 ntme.ipNetToMediaPhysAddress.o_length = 11246 MIN(OCTET_LENGTH, ill->ill_phys_addr_length); 11247 11248 if (!NCE_ISREACHABLE(ncec)) 11249 ntme.ipNetToMediaPhysAddress.o_length = 0; 11250 else { 11251 if (ncec->ncec_lladdr != NULL) { 11252 bcopy(ncec->ncec_lladdr, 11253 ntme.ipNetToMediaPhysAddress.o_bytes, 11254 ntme.ipNetToMediaPhysAddress.o_length); 11255 } 11256 } 11257 11258 if (!snmp_append_data2(ird->ird_netmedia.lp_head, 11259 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) { 11260 ip1dbg(("ip_snmp_get2_v4_media: failed to allocate %u bytes\n", 11261 (uint_t)sizeof (ntme))); 11262 } 11263 return (0); 11264 } 11265 11266 /* 11267 * return (0) if invalid set request, 1 otherwise, including non-tcp requests 11268 */ 11269 /* ARGSUSED */ 11270 int 11271 ip_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) 11272 { 11273 switch (level) { 11274 case MIB2_IP: 11275 case MIB2_ICMP: 11276 switch (name) { 11277 default: 11278 break; 11279 } 11280 return (1); 11281 default: 11282 return (1); 11283 } 11284 } 11285 11286 /* 11287 * When there exists both a 64- and 32-bit counter of a particular type 11288 * (i.e., InReceives), only the 64-bit counters are added. 11289 */ 11290 void 11291 ip_mib2_add_ip_stats(mib2_ipIfStatsEntry_t *o1, mib2_ipIfStatsEntry_t *o2) 11292 { 11293 UPDATE_MIB(o1, ipIfStatsInHdrErrors, o2->ipIfStatsInHdrErrors); 11294 UPDATE_MIB(o1, ipIfStatsInTooBigErrors, o2->ipIfStatsInTooBigErrors); 11295 UPDATE_MIB(o1, ipIfStatsInNoRoutes, o2->ipIfStatsInNoRoutes); 11296 UPDATE_MIB(o1, ipIfStatsInAddrErrors, o2->ipIfStatsInAddrErrors); 11297 UPDATE_MIB(o1, ipIfStatsInUnknownProtos, o2->ipIfStatsInUnknownProtos); 11298 UPDATE_MIB(o1, ipIfStatsInTruncatedPkts, o2->ipIfStatsInTruncatedPkts); 11299 UPDATE_MIB(o1, ipIfStatsInDiscards, o2->ipIfStatsInDiscards); 11300 UPDATE_MIB(o1, ipIfStatsOutDiscards, o2->ipIfStatsOutDiscards); 11301 UPDATE_MIB(o1, ipIfStatsOutFragOKs, o2->ipIfStatsOutFragOKs); 11302 UPDATE_MIB(o1, ipIfStatsOutFragFails, o2->ipIfStatsOutFragFails); 11303 UPDATE_MIB(o1, ipIfStatsOutFragCreates, o2->ipIfStatsOutFragCreates); 11304 UPDATE_MIB(o1, ipIfStatsReasmReqds, o2->ipIfStatsReasmReqds); 11305 UPDATE_MIB(o1, ipIfStatsReasmOKs, o2->ipIfStatsReasmOKs); 11306 UPDATE_MIB(o1, ipIfStatsReasmFails, o2->ipIfStatsReasmFails); 11307 UPDATE_MIB(o1, ipIfStatsOutNoRoutes, o2->ipIfStatsOutNoRoutes); 11308 UPDATE_MIB(o1, ipIfStatsReasmDuplicates, o2->ipIfStatsReasmDuplicates); 11309 UPDATE_MIB(o1, ipIfStatsReasmPartDups, o2->ipIfStatsReasmPartDups); 11310 UPDATE_MIB(o1, ipIfStatsForwProhibits, o2->ipIfStatsForwProhibits); 11311 UPDATE_MIB(o1, udpInCksumErrs, o2->udpInCksumErrs); 11312 UPDATE_MIB(o1, udpInOverflows, o2->udpInOverflows); 11313 UPDATE_MIB(o1, rawipInOverflows, o2->rawipInOverflows); 11314 UPDATE_MIB(o1, ipIfStatsInWrongIPVersion, 11315 o2->ipIfStatsInWrongIPVersion); 11316 UPDATE_MIB(o1, ipIfStatsOutWrongIPVersion, 11317 o2->ipIfStatsInWrongIPVersion); 11318 UPDATE_MIB(o1, ipIfStatsOutSwitchIPVersion, 11319 o2->ipIfStatsOutSwitchIPVersion); 11320 UPDATE_MIB(o1, ipIfStatsHCInReceives, o2->ipIfStatsHCInReceives); 11321 UPDATE_MIB(o1, ipIfStatsHCInOctets, o2->ipIfStatsHCInOctets); 11322 UPDATE_MIB(o1, ipIfStatsHCInForwDatagrams, 11323 o2->ipIfStatsHCInForwDatagrams); 11324 UPDATE_MIB(o1, ipIfStatsHCInDelivers, o2->ipIfStatsHCInDelivers); 11325 UPDATE_MIB(o1, ipIfStatsHCOutRequests, o2->ipIfStatsHCOutRequests); 11326 UPDATE_MIB(o1, ipIfStatsHCOutForwDatagrams, 11327 o2->ipIfStatsHCOutForwDatagrams); 11328 UPDATE_MIB(o1, ipIfStatsOutFragReqds, o2->ipIfStatsOutFragReqds); 11329 UPDATE_MIB(o1, ipIfStatsHCOutTransmits, o2->ipIfStatsHCOutTransmits); 11330 UPDATE_MIB(o1, ipIfStatsHCOutOctets, o2->ipIfStatsHCOutOctets); 11331 UPDATE_MIB(o1, ipIfStatsHCInMcastPkts, o2->ipIfStatsHCInMcastPkts); 11332 UPDATE_MIB(o1, ipIfStatsHCInMcastOctets, o2->ipIfStatsHCInMcastOctets); 11333 UPDATE_MIB(o1, ipIfStatsHCOutMcastPkts, o2->ipIfStatsHCOutMcastPkts); 11334 UPDATE_MIB(o1, ipIfStatsHCOutMcastOctets, 11335 o2->ipIfStatsHCOutMcastOctets); 11336 UPDATE_MIB(o1, ipIfStatsHCInBcastPkts, o2->ipIfStatsHCInBcastPkts); 11337 UPDATE_MIB(o1, ipIfStatsHCOutBcastPkts, o2->ipIfStatsHCOutBcastPkts); 11338 UPDATE_MIB(o1, ipsecInSucceeded, o2->ipsecInSucceeded); 11339 UPDATE_MIB(o1, ipsecInFailed, o2->ipsecInFailed); 11340 UPDATE_MIB(o1, ipInCksumErrs, o2->ipInCksumErrs); 11341 UPDATE_MIB(o1, tcpInErrs, o2->tcpInErrs); 11342 UPDATE_MIB(o1, udpNoPorts, o2->udpNoPorts); 11343 } 11344 11345 void 11346 ip_mib2_add_icmp6_stats(mib2_ipv6IfIcmpEntry_t *o1, mib2_ipv6IfIcmpEntry_t *o2) 11347 { 11348 UPDATE_MIB(o1, ipv6IfIcmpInMsgs, o2->ipv6IfIcmpInMsgs); 11349 UPDATE_MIB(o1, ipv6IfIcmpInErrors, o2->ipv6IfIcmpInErrors); 11350 UPDATE_MIB(o1, ipv6IfIcmpInDestUnreachs, o2->ipv6IfIcmpInDestUnreachs); 11351 UPDATE_MIB(o1, ipv6IfIcmpInAdminProhibs, o2->ipv6IfIcmpInAdminProhibs); 11352 UPDATE_MIB(o1, ipv6IfIcmpInTimeExcds, o2->ipv6IfIcmpInTimeExcds); 11353 UPDATE_MIB(o1, ipv6IfIcmpInParmProblems, o2->ipv6IfIcmpInParmProblems); 11354 UPDATE_MIB(o1, ipv6IfIcmpInPktTooBigs, o2->ipv6IfIcmpInPktTooBigs); 11355 UPDATE_MIB(o1, ipv6IfIcmpInEchos, o2->ipv6IfIcmpInEchos); 11356 UPDATE_MIB(o1, ipv6IfIcmpInEchoReplies, o2->ipv6IfIcmpInEchoReplies); 11357 UPDATE_MIB(o1, ipv6IfIcmpInRouterSolicits, 11358 o2->ipv6IfIcmpInRouterSolicits); 11359 UPDATE_MIB(o1, ipv6IfIcmpInRouterAdvertisements, 11360 o2->ipv6IfIcmpInRouterAdvertisements); 11361 UPDATE_MIB(o1, ipv6IfIcmpInNeighborSolicits, 11362 o2->ipv6IfIcmpInNeighborSolicits); 11363 UPDATE_MIB(o1, ipv6IfIcmpInNeighborAdvertisements, 11364 o2->ipv6IfIcmpInNeighborAdvertisements); 11365 UPDATE_MIB(o1, ipv6IfIcmpInRedirects, o2->ipv6IfIcmpInRedirects); 11366 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembQueries, 11367 o2->ipv6IfIcmpInGroupMembQueries); 11368 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembResponses, 11369 o2->ipv6IfIcmpInGroupMembResponses); 11370 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembReductions, 11371 o2->ipv6IfIcmpInGroupMembReductions); 11372 UPDATE_MIB(o1, ipv6IfIcmpOutMsgs, o2->ipv6IfIcmpOutMsgs); 11373 UPDATE_MIB(o1, ipv6IfIcmpOutErrors, o2->ipv6IfIcmpOutErrors); 11374 UPDATE_MIB(o1, ipv6IfIcmpOutDestUnreachs, 11375 o2->ipv6IfIcmpOutDestUnreachs); 11376 UPDATE_MIB(o1, ipv6IfIcmpOutAdminProhibs, 11377 o2->ipv6IfIcmpOutAdminProhibs); 11378 UPDATE_MIB(o1, ipv6IfIcmpOutTimeExcds, o2->ipv6IfIcmpOutTimeExcds); 11379 UPDATE_MIB(o1, ipv6IfIcmpOutParmProblems, 11380 o2->ipv6IfIcmpOutParmProblems); 11381 UPDATE_MIB(o1, ipv6IfIcmpOutPktTooBigs, o2->ipv6IfIcmpOutPktTooBigs); 11382 UPDATE_MIB(o1, ipv6IfIcmpOutEchos, o2->ipv6IfIcmpOutEchos); 11383 UPDATE_MIB(o1, ipv6IfIcmpOutEchoReplies, o2->ipv6IfIcmpOutEchoReplies); 11384 UPDATE_MIB(o1, ipv6IfIcmpOutRouterSolicits, 11385 o2->ipv6IfIcmpOutRouterSolicits); 11386 UPDATE_MIB(o1, ipv6IfIcmpOutRouterAdvertisements, 11387 o2->ipv6IfIcmpOutRouterAdvertisements); 11388 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborSolicits, 11389 o2->ipv6IfIcmpOutNeighborSolicits); 11390 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborAdvertisements, 11391 o2->ipv6IfIcmpOutNeighborAdvertisements); 11392 UPDATE_MIB(o1, ipv6IfIcmpOutRedirects, o2->ipv6IfIcmpOutRedirects); 11393 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembQueries, 11394 o2->ipv6IfIcmpOutGroupMembQueries); 11395 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembResponses, 11396 o2->ipv6IfIcmpOutGroupMembResponses); 11397 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembReductions, 11398 o2->ipv6IfIcmpOutGroupMembReductions); 11399 UPDATE_MIB(o1, ipv6IfIcmpInOverflows, o2->ipv6IfIcmpInOverflows); 11400 UPDATE_MIB(o1, ipv6IfIcmpBadHoplimit, o2->ipv6IfIcmpBadHoplimit); 11401 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborAdvertisements, 11402 o2->ipv6IfIcmpInBadNeighborAdvertisements); 11403 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborSolicitations, 11404 o2->ipv6IfIcmpInBadNeighborSolicitations); 11405 UPDATE_MIB(o1, ipv6IfIcmpInBadRedirects, o2->ipv6IfIcmpInBadRedirects); 11406 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembTotal, 11407 o2->ipv6IfIcmpInGroupMembTotal); 11408 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadQueries, 11409 o2->ipv6IfIcmpInGroupMembBadQueries); 11410 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadReports, 11411 o2->ipv6IfIcmpInGroupMembBadReports); 11412 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembOurReports, 11413 o2->ipv6IfIcmpInGroupMembOurReports); 11414 } 11415 11416 /* 11417 * Called before the options are updated to check if this packet will 11418 * be source routed from here. 11419 * This routine assumes that the options are well formed i.e. that they 11420 * have already been checked. 11421 */ 11422 boolean_t 11423 ip_source_routed(ipha_t *ipha, ip_stack_t *ipst) 11424 { 11425 ipoptp_t opts; 11426 uchar_t *opt; 11427 uint8_t optval; 11428 uint8_t optlen; 11429 ipaddr_t dst; 11430 11431 if (IS_SIMPLE_IPH(ipha)) { 11432 ip2dbg(("not source routed\n")); 11433 return (B_FALSE); 11434 } 11435 dst = ipha->ipha_dst; 11436 for (optval = ipoptp_first(&opts, ipha); 11437 optval != IPOPT_EOL; 11438 optval = ipoptp_next(&opts)) { 11439 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 11440 opt = opts.ipoptp_cur; 11441 optlen = opts.ipoptp_len; 11442 ip2dbg(("ip_source_routed: opt %d, len %d\n", 11443 optval, optlen)); 11444 switch (optval) { 11445 uint32_t off; 11446 case IPOPT_SSRR: 11447 case IPOPT_LSRR: 11448 /* 11449 * If dst is one of our addresses and there are some 11450 * entries left in the source route return (true). 11451 */ 11452 if (ip_type_v4(dst, ipst) != IRE_LOCAL) { 11453 ip2dbg(("ip_source_routed: not next" 11454 " source route 0x%x\n", 11455 ntohl(dst))); 11456 return (B_FALSE); 11457 } 11458 off = opt[IPOPT_OFFSET]; 11459 off--; 11460 if (optlen < IP_ADDR_LEN || 11461 off > optlen - IP_ADDR_LEN) { 11462 /* End of source route */ 11463 ip1dbg(("ip_source_routed: end of SR\n")); 11464 return (B_FALSE); 11465 } 11466 return (B_TRUE); 11467 } 11468 } 11469 ip2dbg(("not source routed\n")); 11470 return (B_FALSE); 11471 } 11472 11473 /* 11474 * ip_unbind is called by the transports to remove a conn from 11475 * the fanout table. 11476 */ 11477 void 11478 ip_unbind(conn_t *connp) 11479 { 11480 11481 ASSERT(!MUTEX_HELD(&connp->conn_lock)); 11482 11483 if (is_system_labeled() && connp->conn_anon_port) { 11484 (void) tsol_mlp_anon(crgetzone(connp->conn_cred), 11485 connp->conn_mlp_type, connp->conn_proto, 11486 ntohs(connp->conn_lport), B_FALSE); 11487 connp->conn_anon_port = 0; 11488 } 11489 connp->conn_mlp_type = mlptSingle; 11490 11491 ipcl_hash_remove(connp); 11492 } 11493 11494 /* 11495 * Used for deciding the MSS size for the upper layer. Thus 11496 * we need to check the outbound policy values in the conn. 11497 */ 11498 int 11499 conn_ipsec_length(conn_t *connp) 11500 { 11501 ipsec_latch_t *ipl; 11502 11503 ipl = connp->conn_latch; 11504 if (ipl == NULL) 11505 return (0); 11506 11507 if (connp->conn_ixa->ixa_ipsec_policy == NULL) 11508 return (0); 11509 11510 return (connp->conn_ixa->ixa_ipsec_policy->ipsp_act->ipa_ovhd); 11511 } 11512 11513 /* 11514 * Returns an estimate of the IPsec headers size. This is used if 11515 * we don't want to call into IPsec to get the exact size. 11516 */ 11517 int 11518 ipsec_out_extra_length(ip_xmit_attr_t *ixa) 11519 { 11520 ipsec_action_t *a; 11521 11522 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE)) 11523 return (0); 11524 11525 a = ixa->ixa_ipsec_action; 11526 if (a == NULL) { 11527 ASSERT(ixa->ixa_ipsec_policy != NULL); 11528 a = ixa->ixa_ipsec_policy->ipsp_act; 11529 } 11530 ASSERT(a != NULL); 11531 11532 return (a->ipa_ovhd); 11533 } 11534 11535 /* 11536 * If there are any source route options, return the true final 11537 * destination. Otherwise, return the destination. 11538 */ 11539 ipaddr_t 11540 ip_get_dst(ipha_t *ipha) 11541 { 11542 ipoptp_t opts; 11543 uchar_t *opt; 11544 uint8_t optval; 11545 uint8_t optlen; 11546 ipaddr_t dst; 11547 uint32_t off; 11548 11549 dst = ipha->ipha_dst; 11550 11551 if (IS_SIMPLE_IPH(ipha)) 11552 return (dst); 11553 11554 for (optval = ipoptp_first(&opts, ipha); 11555 optval != IPOPT_EOL; 11556 optval = ipoptp_next(&opts)) { 11557 opt = opts.ipoptp_cur; 11558 optlen = opts.ipoptp_len; 11559 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 11560 switch (optval) { 11561 case IPOPT_SSRR: 11562 case IPOPT_LSRR: 11563 off = opt[IPOPT_OFFSET]; 11564 /* 11565 * If one of the conditions is true, it means 11566 * end of options and dst already has the right 11567 * value. 11568 */ 11569 if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) { 11570 off = optlen - IP_ADDR_LEN; 11571 bcopy(&opt[off], &dst, IP_ADDR_LEN); 11572 } 11573 return (dst); 11574 default: 11575 break; 11576 } 11577 } 11578 11579 return (dst); 11580 } 11581 11582 /* 11583 * Outbound IP fragmentation routine. 11584 * Assumes the caller has checked whether or not fragmentation should 11585 * be allowed. Here we copy the DF bit from the header to all the generated 11586 * fragments. 11587 */ 11588 int 11589 ip_fragment_v4(mblk_t *mp_orig, nce_t *nce, iaflags_t ixaflags, 11590 uint_t pkt_len, uint32_t max_frag, uint32_t xmit_hint, zoneid_t szone, 11591 zoneid_t nolzid, pfirepostfrag_t postfragfn, uintptr_t *ixa_cookie) 11592 { 11593 int i1; 11594 int hdr_len; 11595 mblk_t *hdr_mp; 11596 ipha_t *ipha; 11597 int ip_data_end; 11598 int len; 11599 mblk_t *mp = mp_orig; 11600 int offset; 11601 ill_t *ill = nce->nce_ill; 11602 ip_stack_t *ipst = ill->ill_ipst; 11603 mblk_t *carve_mp; 11604 uint32_t frag_flag; 11605 uint_t priority = mp->b_band; 11606 int error = 0; 11607 11608 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragReqds); 11609 11610 if (pkt_len != msgdsize(mp)) { 11611 ip0dbg(("Packet length mismatch: %d, %ld\n", 11612 pkt_len, msgdsize(mp))); 11613 freemsg(mp); 11614 return (EINVAL); 11615 } 11616 11617 if (max_frag == 0) { 11618 ip1dbg(("ip_fragment_v4: max_frag is zero. Dropping packet\n")); 11619 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 11620 ip_drop_output("FragFails: zero max_frag", mp, ill); 11621 freemsg(mp); 11622 return (EINVAL); 11623 } 11624 11625 ASSERT(MBLKL(mp) >= sizeof (ipha_t)); 11626 ipha = (ipha_t *)mp->b_rptr; 11627 ASSERT(ntohs(ipha->ipha_length) == pkt_len); 11628 frag_flag = ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_DF; 11629 11630 /* 11631 * Establish the starting offset. May not be zero if we are fragging 11632 * a fragment that is being forwarded. 11633 */ 11634 offset = ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET; 11635 11636 /* TODO why is this test needed? */ 11637 if (((max_frag - ntohs(ipha->ipha_length)) & ~7) < 8) { 11638 /* TODO: notify ulp somehow */ 11639 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 11640 ip_drop_output("FragFails: bad starting offset", mp, ill); 11641 freemsg(mp); 11642 return (EINVAL); 11643 } 11644 11645 hdr_len = IPH_HDR_LENGTH(ipha); 11646 ipha->ipha_hdr_checksum = 0; 11647 11648 /* 11649 * Establish the number of bytes maximum per frag, after putting 11650 * in the header. 11651 */ 11652 len = (max_frag - hdr_len) & ~7; 11653 11654 /* Get a copy of the header for the trailing frags */ 11655 hdr_mp = ip_fragment_copyhdr((uchar_t *)ipha, hdr_len, offset, ipst, 11656 mp); 11657 if (hdr_mp == NULL) { 11658 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 11659 ip_drop_output("FragFails: no hdr_mp", mp, ill); 11660 freemsg(mp); 11661 return (ENOBUFS); 11662 } 11663 11664 /* Store the starting offset, with the MoreFrags flag. */ 11665 i1 = offset | IPH_MF | frag_flag; 11666 ipha->ipha_fragment_offset_and_flags = htons((uint16_t)i1); 11667 11668 /* Establish the ending byte offset, based on the starting offset. */ 11669 offset <<= 3; 11670 ip_data_end = offset + ntohs(ipha->ipha_length) - hdr_len; 11671 11672 /* Store the length of the first fragment in the IP header. */ 11673 i1 = len + hdr_len; 11674 ASSERT(i1 <= IP_MAXPACKET); 11675 ipha->ipha_length = htons((uint16_t)i1); 11676 11677 /* 11678 * Compute the IP header checksum for the first frag. We have to 11679 * watch out that we stop at the end of the header. 11680 */ 11681 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 11682 11683 /* 11684 * Now carve off the first frag. Note that this will include the 11685 * original IP header. 11686 */ 11687 if (!(mp = ip_carve_mp(&mp_orig, i1))) { 11688 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 11689 ip_drop_output("FragFails: could not carve mp", mp_orig, ill); 11690 freeb(hdr_mp); 11691 freemsg(mp_orig); 11692 return (ENOBUFS); 11693 } 11694 11695 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates); 11696 11697 error = postfragfn(mp, nce, ixaflags, i1, xmit_hint, szone, nolzid, 11698 ixa_cookie); 11699 if (error != 0 && error != EWOULDBLOCK) { 11700 /* No point in sending the other fragments */ 11701 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 11702 ip_drop_output("FragFails: postfragfn failed", mp_orig, ill); 11703 freeb(hdr_mp); 11704 freemsg(mp_orig); 11705 return (error); 11706 } 11707 11708 /* No need to redo state machine in loop */ 11709 ixaflags &= ~IXAF_REACH_CONF; 11710 11711 /* Advance the offset to the second frag starting point. */ 11712 offset += len; 11713 /* 11714 * Update hdr_len from the copied header - there might be less options 11715 * in the later fragments. 11716 */ 11717 hdr_len = IPH_HDR_LENGTH(hdr_mp->b_rptr); 11718 /* Loop until done. */ 11719 for (;;) { 11720 uint16_t offset_and_flags; 11721 uint16_t ip_len; 11722 11723 if (ip_data_end - offset > len) { 11724 /* 11725 * Carve off the appropriate amount from the original 11726 * datagram. 11727 */ 11728 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) { 11729 mp = NULL; 11730 break; 11731 } 11732 /* 11733 * More frags after this one. Get another copy 11734 * of the header. 11735 */ 11736 if (carve_mp->b_datap->db_ref == 1 && 11737 hdr_mp->b_wptr - hdr_mp->b_rptr < 11738 carve_mp->b_rptr - carve_mp->b_datap->db_base) { 11739 /* Inline IP header */ 11740 carve_mp->b_rptr -= hdr_mp->b_wptr - 11741 hdr_mp->b_rptr; 11742 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr, 11743 hdr_mp->b_wptr - hdr_mp->b_rptr); 11744 mp = carve_mp; 11745 } else { 11746 if (!(mp = copyb(hdr_mp))) { 11747 freemsg(carve_mp); 11748 break; 11749 } 11750 /* Get priority marking, if any. */ 11751 mp->b_band = priority; 11752 mp->b_cont = carve_mp; 11753 } 11754 ipha = (ipha_t *)mp->b_rptr; 11755 offset_and_flags = IPH_MF; 11756 } else { 11757 /* 11758 * Last frag. Consume the header. Set len to 11759 * the length of this last piece. 11760 */ 11761 len = ip_data_end - offset; 11762 11763 /* 11764 * Carve off the appropriate amount from the original 11765 * datagram. 11766 */ 11767 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) { 11768 mp = NULL; 11769 break; 11770 } 11771 if (carve_mp->b_datap->db_ref == 1 && 11772 hdr_mp->b_wptr - hdr_mp->b_rptr < 11773 carve_mp->b_rptr - carve_mp->b_datap->db_base) { 11774 /* Inline IP header */ 11775 carve_mp->b_rptr -= hdr_mp->b_wptr - 11776 hdr_mp->b_rptr; 11777 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr, 11778 hdr_mp->b_wptr - hdr_mp->b_rptr); 11779 mp = carve_mp; 11780 freeb(hdr_mp); 11781 hdr_mp = mp; 11782 } else { 11783 mp = hdr_mp; 11784 /* Get priority marking, if any. */ 11785 mp->b_band = priority; 11786 mp->b_cont = carve_mp; 11787 } 11788 ipha = (ipha_t *)mp->b_rptr; 11789 /* A frag of a frag might have IPH_MF non-zero */ 11790 offset_and_flags = 11791 ntohs(ipha->ipha_fragment_offset_and_flags) & 11792 IPH_MF; 11793 } 11794 offset_and_flags |= (uint16_t)(offset >> 3); 11795 offset_and_flags |= (uint16_t)frag_flag; 11796 /* Store the offset and flags in the IP header. */ 11797 ipha->ipha_fragment_offset_and_flags = htons(offset_and_flags); 11798 11799 /* Store the length in the IP header. */ 11800 ip_len = (uint16_t)(len + hdr_len); 11801 ipha->ipha_length = htons(ip_len); 11802 11803 /* 11804 * Set the IP header checksum. Note that mp is just 11805 * the header, so this is easy to pass to ip_csum. 11806 */ 11807 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 11808 11809 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates); 11810 11811 error = postfragfn(mp, nce, ixaflags, ip_len, xmit_hint, szone, 11812 nolzid, ixa_cookie); 11813 /* All done if we just consumed the hdr_mp. */ 11814 if (mp == hdr_mp) { 11815 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragOKs); 11816 return (error); 11817 } 11818 if (error != 0 && error != EWOULDBLOCK) { 11819 DTRACE_PROBE2(ip__xmit__frag__fail, ill_t *, ill, 11820 mblk_t *, hdr_mp); 11821 /* No point in sending the other fragments */ 11822 break; 11823 } 11824 11825 /* Otherwise, advance and loop. */ 11826 offset += len; 11827 } 11828 /* Clean up following allocation failure. */ 11829 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 11830 ip_drop_output("FragFails: loop ended", NULL, ill); 11831 if (mp != hdr_mp) 11832 freeb(hdr_mp); 11833 if (mp != mp_orig) 11834 freemsg(mp_orig); 11835 return (error); 11836 } 11837 11838 /* 11839 * Copy the header plus those options which have the copy bit set 11840 */ 11841 static mblk_t * 11842 ip_fragment_copyhdr(uchar_t *rptr, int hdr_len, int offset, ip_stack_t *ipst, 11843 mblk_t *src) 11844 { 11845 mblk_t *mp; 11846 uchar_t *up; 11847 11848 /* 11849 * Quick check if we need to look for options without the copy bit 11850 * set 11851 */ 11852 mp = allocb_tmpl(ipst->ips_ip_wroff_extra + hdr_len, src); 11853 if (!mp) 11854 return (mp); 11855 mp->b_rptr += ipst->ips_ip_wroff_extra; 11856 if (hdr_len == IP_SIMPLE_HDR_LENGTH || offset != 0) { 11857 bcopy(rptr, mp->b_rptr, hdr_len); 11858 mp->b_wptr += hdr_len + ipst->ips_ip_wroff_extra; 11859 return (mp); 11860 } 11861 up = mp->b_rptr; 11862 bcopy(rptr, up, IP_SIMPLE_HDR_LENGTH); 11863 up += IP_SIMPLE_HDR_LENGTH; 11864 rptr += IP_SIMPLE_HDR_LENGTH; 11865 hdr_len -= IP_SIMPLE_HDR_LENGTH; 11866 while (hdr_len > 0) { 11867 uint32_t optval; 11868 uint32_t optlen; 11869 11870 optval = *rptr; 11871 if (optval == IPOPT_EOL) 11872 break; 11873 if (optval == IPOPT_NOP) 11874 optlen = 1; 11875 else 11876 optlen = rptr[1]; 11877 if (optval & IPOPT_COPY) { 11878 bcopy(rptr, up, optlen); 11879 up += optlen; 11880 } 11881 rptr += optlen; 11882 hdr_len -= optlen; 11883 } 11884 /* 11885 * Make sure that we drop an even number of words by filling 11886 * with EOL to the next word boundary. 11887 */ 11888 for (hdr_len = up - (mp->b_rptr + IP_SIMPLE_HDR_LENGTH); 11889 hdr_len & 0x3; hdr_len++) 11890 *up++ = IPOPT_EOL; 11891 mp->b_wptr = up; 11892 /* Update header length */ 11893 mp->b_rptr[0] = (uint8_t)((IP_VERSION << 4) | ((up - mp->b_rptr) >> 2)); 11894 return (mp); 11895 } 11896 11897 /* 11898 * Update any source route, record route, or timestamp options when 11899 * sending a packet back to ourselves. 11900 * Check that we are at end of strict source route. 11901 * The options have been sanity checked by ip_output_options(). 11902 */ 11903 void 11904 ip_output_local_options(ipha_t *ipha, ip_stack_t *ipst) 11905 { 11906 ipoptp_t opts; 11907 uchar_t *opt; 11908 uint8_t optval; 11909 uint8_t optlen; 11910 ipaddr_t dst; 11911 uint32_t ts; 11912 timestruc_t now; 11913 11914 for (optval = ipoptp_first(&opts, ipha); 11915 optval != IPOPT_EOL; 11916 optval = ipoptp_next(&opts)) { 11917 opt = opts.ipoptp_cur; 11918 optlen = opts.ipoptp_len; 11919 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 11920 switch (optval) { 11921 uint32_t off; 11922 case IPOPT_SSRR: 11923 case IPOPT_LSRR: 11924 off = opt[IPOPT_OFFSET]; 11925 off--; 11926 if (optlen < IP_ADDR_LEN || 11927 off > optlen - IP_ADDR_LEN) { 11928 /* End of source route */ 11929 break; 11930 } 11931 /* 11932 * This will only happen if two consecutive entries 11933 * in the source route contains our address or if 11934 * it is a packet with a loose source route which 11935 * reaches us before consuming the whole source route 11936 */ 11937 11938 if (optval == IPOPT_SSRR) { 11939 return; 11940 } 11941 /* 11942 * Hack: instead of dropping the packet truncate the 11943 * source route to what has been used by filling the 11944 * rest with IPOPT_NOP. 11945 */ 11946 opt[IPOPT_OLEN] = (uint8_t)off; 11947 while (off < optlen) { 11948 opt[off++] = IPOPT_NOP; 11949 } 11950 break; 11951 case IPOPT_RR: 11952 off = opt[IPOPT_OFFSET]; 11953 off--; 11954 if (optlen < IP_ADDR_LEN || 11955 off > optlen - IP_ADDR_LEN) { 11956 /* No more room - ignore */ 11957 ip1dbg(( 11958 "ip_output_local_options: end of RR\n")); 11959 break; 11960 } 11961 dst = htonl(INADDR_LOOPBACK); 11962 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN); 11963 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 11964 break; 11965 case IPOPT_TS: 11966 /* Insert timestamp if there is romm */ 11967 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 11968 case IPOPT_TS_TSONLY: 11969 off = IPOPT_TS_TIMELEN; 11970 break; 11971 case IPOPT_TS_PRESPEC: 11972 case IPOPT_TS_PRESPEC_RFC791: 11973 /* Verify that the address matched */ 11974 off = opt[IPOPT_OFFSET] - 1; 11975 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 11976 if (ip_type_v4(dst, ipst) != IRE_LOCAL) { 11977 /* Not for us */ 11978 break; 11979 } 11980 /* FALLTHRU */ 11981 case IPOPT_TS_TSANDADDR: 11982 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 11983 break; 11984 default: 11985 /* 11986 * ip_*put_options should have already 11987 * dropped this packet. 11988 */ 11989 cmn_err(CE_PANIC, "ip_output_local_options: " 11990 "unknown IT - bug in ip_output_options?\n"); 11991 return; /* Keep "lint" happy */ 11992 } 11993 if (opt[IPOPT_OFFSET] - 1 + off > optlen) { 11994 /* Increase overflow counter */ 11995 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1; 11996 opt[IPOPT_POS_OV_FLG] = (uint8_t) 11997 (opt[IPOPT_POS_OV_FLG] & 0x0F) | 11998 (off << 4); 11999 break; 12000 } 12001 off = opt[IPOPT_OFFSET] - 1; 12002 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 12003 case IPOPT_TS_PRESPEC: 12004 case IPOPT_TS_PRESPEC_RFC791: 12005 case IPOPT_TS_TSANDADDR: 12006 dst = htonl(INADDR_LOOPBACK); 12007 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN); 12008 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 12009 /* FALLTHRU */ 12010 case IPOPT_TS_TSONLY: 12011 off = opt[IPOPT_OFFSET] - 1; 12012 /* Compute # of milliseconds since midnight */ 12013 gethrestime(&now); 12014 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 12015 now.tv_nsec / (NANOSEC / MILLISEC); 12016 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN); 12017 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN; 12018 break; 12019 } 12020 break; 12021 } 12022 } 12023 } 12024 12025 /* 12026 * Prepend an M_DATA fastpath header, and if none present prepend a 12027 * DL_UNITDATA_REQ. Frees the mblk on failure. 12028 * 12029 * nce_dlur_mp and nce_fp_mp can not disappear once they have been set. 12030 * If there is a change to them, the nce will be deleted (condemned) and 12031 * a new nce_t will be created when packets are sent. Thus we need no locks 12032 * to access those fields. 12033 * 12034 * We preserve b_band to support IPQoS. If a DL_UNITDATA_REQ is prepended 12035 * we place b_band in dl_priority.dl_max. 12036 */ 12037 static mblk_t * 12038 ip_xmit_attach_llhdr(mblk_t *mp, nce_t *nce) 12039 { 12040 uint_t hlen; 12041 mblk_t *mp1; 12042 uint_t priority; 12043 uchar_t *rptr; 12044 12045 rptr = mp->b_rptr; 12046 12047 ASSERT(DB_TYPE(mp) == M_DATA); 12048 priority = mp->b_band; 12049 12050 ASSERT(nce != NULL); 12051 if ((mp1 = nce->nce_fp_mp) != NULL) { 12052 hlen = MBLKL(mp1); 12053 /* 12054 * Check if we have enough room to prepend fastpath 12055 * header 12056 */ 12057 if (hlen != 0 && (rptr - mp->b_datap->db_base) >= hlen) { 12058 rptr -= hlen; 12059 bcopy(mp1->b_rptr, rptr, hlen); 12060 /* 12061 * Set the b_rptr to the start of the link layer 12062 * header 12063 */ 12064 mp->b_rptr = rptr; 12065 return (mp); 12066 } 12067 mp1 = copyb(mp1); 12068 if (mp1 == NULL) { 12069 ill_t *ill = nce->nce_ill; 12070 12071 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 12072 ip_drop_output("ipIfStatsOutDiscards", mp, ill); 12073 freemsg(mp); 12074 return (NULL); 12075 } 12076 mp1->b_band = priority; 12077 mp1->b_cont = mp; 12078 DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp); 12079 DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp); 12080 DB_CKSUMEND(mp1) = DB_CKSUMEND(mp); 12081 DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp); 12082 DB_LSOMSS(mp1) = DB_LSOMSS(mp); 12083 DTRACE_PROBE1(ip__xmit__copyb, (mblk_t *), mp1); 12084 /* 12085 * XXX disable ICK_VALID and compute checksum 12086 * here; can happen if nce_fp_mp changes and 12087 * it can't be copied now due to insufficient 12088 * space. (unlikely, fp mp can change, but it 12089 * does not increase in length) 12090 */ 12091 return (mp1); 12092 } 12093 mp1 = copyb(nce->nce_dlur_mp); 12094 12095 if (mp1 == NULL) { 12096 ill_t *ill = nce->nce_ill; 12097 12098 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 12099 ip_drop_output("ipIfStatsOutDiscards", mp, ill); 12100 freemsg(mp); 12101 return (NULL); 12102 } 12103 mp1->b_cont = mp; 12104 if (priority != 0) { 12105 mp1->b_band = priority; 12106 ((dl_unitdata_req_t *)(mp1->b_rptr))->dl_priority.dl_max = 12107 priority; 12108 } 12109 return (mp1); 12110 #undef rptr 12111 } 12112 12113 /* 12114 * Finish the outbound IPsec processing. This function is called from 12115 * ipsec_out_process() if the IPsec packet was processed 12116 * synchronously, or from {ah,esp}_kcf_callback_outbound() if it was processed 12117 * asynchronously. 12118 * 12119 * This is common to IPv4 and IPv6. 12120 */ 12121 int 12122 ip_output_post_ipsec(mblk_t *mp, ip_xmit_attr_t *ixa) 12123 { 12124 iaflags_t ixaflags = ixa->ixa_flags; 12125 uint_t pktlen; 12126 12127 12128 /* AH/ESP don't update ixa_pktlen when they modify the packet */ 12129 if (ixaflags & IXAF_IS_IPV4) { 12130 ipha_t *ipha = (ipha_t *)mp->b_rptr; 12131 12132 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 12133 pktlen = ntohs(ipha->ipha_length); 12134 } else { 12135 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 12136 12137 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION); 12138 pktlen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN; 12139 } 12140 12141 /* 12142 * We release any hard reference on the SAs here to make 12143 * sure the SAs can be garbage collected. ipsr_sa has a soft reference 12144 * on the SAs. 12145 * If in the future we want the hard latching of the SAs in the 12146 * ip_xmit_attr_t then we should remove this. 12147 */ 12148 if (ixa->ixa_ipsec_esp_sa != NULL) { 12149 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa); 12150 ixa->ixa_ipsec_esp_sa = NULL; 12151 } 12152 if (ixa->ixa_ipsec_ah_sa != NULL) { 12153 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa); 12154 ixa->ixa_ipsec_ah_sa = NULL; 12155 } 12156 12157 /* Do we need to fragment? */ 12158 if ((ixa->ixa_flags & IXAF_IPV6_ADD_FRAGHDR) || 12159 pktlen > ixa->ixa_fragsize) { 12160 if (ixaflags & IXAF_IS_IPV4) { 12161 ASSERT(!(ixa->ixa_flags & IXAF_IPV6_ADD_FRAGHDR)); 12162 /* 12163 * We check for the DF case in ipsec_out_process 12164 * hence this only handles the non-DF case. 12165 */ 12166 return (ip_fragment_v4(mp, ixa->ixa_nce, ixa->ixa_flags, 12167 pktlen, ixa->ixa_fragsize, 12168 ixa->ixa_xmit_hint, ixa->ixa_zoneid, 12169 ixa->ixa_no_loop_zoneid, ixa->ixa_postfragfn, 12170 &ixa->ixa_cookie)); 12171 } else { 12172 mp = ip_fraghdr_add_v6(mp, ixa->ixa_ident, ixa); 12173 if (mp == NULL) { 12174 /* MIB and ip_drop_output already done */ 12175 return (ENOMEM); 12176 } 12177 pktlen += sizeof (ip6_frag_t); 12178 if (pktlen > ixa->ixa_fragsize) { 12179 return (ip_fragment_v6(mp, ixa->ixa_nce, 12180 ixa->ixa_flags, pktlen, 12181 ixa->ixa_fragsize, ixa->ixa_xmit_hint, 12182 ixa->ixa_zoneid, ixa->ixa_no_loop_zoneid, 12183 ixa->ixa_postfragfn, &ixa->ixa_cookie)); 12184 } 12185 } 12186 } 12187 return ((ixa->ixa_postfragfn)(mp, ixa->ixa_nce, ixa->ixa_flags, 12188 pktlen, ixa->ixa_xmit_hint, ixa->ixa_zoneid, 12189 ixa->ixa_no_loop_zoneid, NULL)); 12190 } 12191 12192 /* 12193 * Finish the inbound IPsec processing. This function is called from 12194 * ipsec_out_process() if the IPsec packet was processed 12195 * synchronously, or from {ah,esp}_kcf_callback_outbound() if it was processed 12196 * asynchronously. 12197 * 12198 * This is common to IPv4 and IPv6. 12199 */ 12200 void 12201 ip_input_post_ipsec(mblk_t *mp, ip_recv_attr_t *ira) 12202 { 12203 iaflags_t iraflags = ira->ira_flags; 12204 12205 /* Length might have changed */ 12206 if (iraflags & IRAF_IS_IPV4) { 12207 ipha_t *ipha = (ipha_t *)mp->b_rptr; 12208 12209 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 12210 ira->ira_pktlen = ntohs(ipha->ipha_length); 12211 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha); 12212 ira->ira_protocol = ipha->ipha_protocol; 12213 12214 ip_fanout_v4(mp, ipha, ira); 12215 } else { 12216 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 12217 uint8_t *nexthdrp; 12218 12219 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION); 12220 ira->ira_pktlen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN; 12221 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ira->ira_ip_hdr_length, 12222 &nexthdrp)) { 12223 /* Malformed packet */ 12224 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards); 12225 ip_drop_input("ipIfStatsInDiscards", mp, ira->ira_ill); 12226 freemsg(mp); 12227 return; 12228 } 12229 ira->ira_protocol = *nexthdrp; 12230 ip_fanout_v6(mp, ip6h, ira); 12231 } 12232 } 12233 12234 /* 12235 * Select which AH & ESP SA's to use (if any) for the outbound packet. 12236 * 12237 * If this function returns B_TRUE, the requested SA's have been filled 12238 * into the ixa_ipsec_*_sa pointers. 12239 * 12240 * If the function returns B_FALSE, the packet has been "consumed", most 12241 * likely by an ACQUIRE sent up via PF_KEY to a key management daemon. 12242 * 12243 * The SA references created by the protocol-specific "select" 12244 * function will be released in ip_output_post_ipsec. 12245 */ 12246 static boolean_t 12247 ipsec_out_select_sa(mblk_t *mp, ip_xmit_attr_t *ixa) 12248 { 12249 boolean_t need_ah_acquire = B_FALSE, need_esp_acquire = B_FALSE; 12250 ipsec_policy_t *pp; 12251 ipsec_action_t *ap; 12252 12253 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE); 12254 ASSERT((ixa->ixa_ipsec_policy != NULL) || 12255 (ixa->ixa_ipsec_action != NULL)); 12256 12257 ap = ixa->ixa_ipsec_action; 12258 if (ap == NULL) { 12259 pp = ixa->ixa_ipsec_policy; 12260 ASSERT(pp != NULL); 12261 ap = pp->ipsp_act; 12262 ASSERT(ap != NULL); 12263 } 12264 12265 /* 12266 * We have an action. now, let's select SA's. 12267 * A side effect of setting ixa_ipsec_*_sa is that it will 12268 * be cached in the conn_t. 12269 */ 12270 if (ap->ipa_want_esp) { 12271 if (ixa->ixa_ipsec_esp_sa == NULL) { 12272 need_esp_acquire = !ipsec_outbound_sa(mp, ixa, 12273 IPPROTO_ESP); 12274 } 12275 ASSERT(need_esp_acquire || ixa->ixa_ipsec_esp_sa != NULL); 12276 } 12277 12278 if (ap->ipa_want_ah) { 12279 if (ixa->ixa_ipsec_ah_sa == NULL) { 12280 need_ah_acquire = !ipsec_outbound_sa(mp, ixa, 12281 IPPROTO_AH); 12282 } 12283 ASSERT(need_ah_acquire || ixa->ixa_ipsec_ah_sa != NULL); 12284 /* 12285 * The ESP and AH processing order needs to be preserved 12286 * when both protocols are required (ESP should be applied 12287 * before AH for an outbound packet). Force an ESP ACQUIRE 12288 * when both ESP and AH are required, and an AH ACQUIRE 12289 * is needed. 12290 */ 12291 if (ap->ipa_want_esp && need_ah_acquire) 12292 need_esp_acquire = B_TRUE; 12293 } 12294 12295 /* 12296 * Send an ACQUIRE (extended, regular, or both) if we need one. 12297 * Release SAs that got referenced, but will not be used until we 12298 * acquire _all_ of the SAs we need. 12299 */ 12300 if (need_ah_acquire || need_esp_acquire) { 12301 if (ixa->ixa_ipsec_ah_sa != NULL) { 12302 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa); 12303 ixa->ixa_ipsec_ah_sa = NULL; 12304 } 12305 if (ixa->ixa_ipsec_esp_sa != NULL) { 12306 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa); 12307 ixa->ixa_ipsec_esp_sa = NULL; 12308 } 12309 12310 sadb_acquire(mp, ixa, need_ah_acquire, need_esp_acquire); 12311 return (B_FALSE); 12312 } 12313 12314 return (B_TRUE); 12315 } 12316 12317 /* 12318 * Handle IPsec output processing. 12319 * This function is only entered once for a given packet. 12320 * We try to do things synchronously, but if we need to have user-level 12321 * set up SAs, or ESP or AH uses asynchronous kEF, then the operation 12322 * will be completed 12323 * - when the SAs are added in esp_add_sa_finish/ah_add_sa_finish 12324 * - when asynchronous ESP is done it will do AH 12325 * 12326 * In all cases we come back in ip_output_post_ipsec() to fragment and 12327 * send out the packet. 12328 */ 12329 int 12330 ipsec_out_process(mblk_t *mp, ip_xmit_attr_t *ixa) 12331 { 12332 ill_t *ill = ixa->ixa_nce->nce_ill; 12333 ip_stack_t *ipst = ixa->ixa_ipst; 12334 ipsec_stack_t *ipss; 12335 ipsec_policy_t *pp; 12336 ipsec_action_t *ap; 12337 12338 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE); 12339 12340 ASSERT((ixa->ixa_ipsec_policy != NULL) || 12341 (ixa->ixa_ipsec_action != NULL)); 12342 12343 ipss = ipst->ips_netstack->netstack_ipsec; 12344 if (!ipsec_loaded(ipss)) { 12345 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 12346 ip_drop_packet(mp, B_TRUE, ill, 12347 DROPPER(ipss, ipds_ip_ipsec_not_loaded), 12348 &ipss->ipsec_dropper); 12349 return (ENOTSUP); 12350 } 12351 12352 ap = ixa->ixa_ipsec_action; 12353 if (ap == NULL) { 12354 pp = ixa->ixa_ipsec_policy; 12355 ASSERT(pp != NULL); 12356 ap = pp->ipsp_act; 12357 ASSERT(ap != NULL); 12358 } 12359 12360 /* Handle explicit drop action and bypass. */ 12361 switch (ap->ipa_act.ipa_type) { 12362 case IPSEC_ACT_DISCARD: 12363 case IPSEC_ACT_REJECT: 12364 ip_drop_packet(mp, B_FALSE, ill, 12365 DROPPER(ipss, ipds_spd_explicit), &ipss->ipsec_spd_dropper); 12366 return (EHOSTUNREACH); /* IPsec policy failure */ 12367 case IPSEC_ACT_BYPASS: 12368 return (ip_output_post_ipsec(mp, ixa)); 12369 } 12370 12371 /* 12372 * The order of processing is first insert a IP header if needed. 12373 * Then insert the ESP header and then the AH header. 12374 */ 12375 if ((ixa->ixa_flags & IXAF_IS_IPV4) && ap->ipa_want_se) { 12376 /* 12377 * First get the outer IP header before sending 12378 * it to ESP. 12379 */ 12380 ipha_t *oipha, *iipha; 12381 mblk_t *outer_mp, *inner_mp; 12382 12383 if ((outer_mp = allocb(sizeof (ipha_t), BPRI_HI)) == NULL) { 12384 (void) mi_strlog(ill->ill_rq, 0, 12385 SL_ERROR|SL_TRACE|SL_CONSOLE, 12386 "ipsec_out_process: " 12387 "Self-Encapsulation failed: Out of memory\n"); 12388 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 12389 ip_drop_output("ipIfStatsOutDiscards", mp, ill); 12390 freemsg(mp); 12391 return (ENOBUFS); 12392 } 12393 inner_mp = mp; 12394 ASSERT(inner_mp->b_datap->db_type == M_DATA); 12395 oipha = (ipha_t *)outer_mp->b_rptr; 12396 iipha = (ipha_t *)inner_mp->b_rptr; 12397 *oipha = *iipha; 12398 outer_mp->b_wptr += sizeof (ipha_t); 12399 oipha->ipha_length = htons(ntohs(iipha->ipha_length) + 12400 sizeof (ipha_t)); 12401 oipha->ipha_protocol = IPPROTO_ENCAP; 12402 oipha->ipha_version_and_hdr_length = 12403 IP_SIMPLE_HDR_VERSION; 12404 oipha->ipha_hdr_checksum = 0; 12405 oipha->ipha_hdr_checksum = ip_csum_hdr(oipha); 12406 outer_mp->b_cont = inner_mp; 12407 mp = outer_mp; 12408 12409 ixa->ixa_flags |= IXAF_IPSEC_TUNNEL; 12410 } 12411 12412 /* If we need to wait for a SA then we can't return any errno */ 12413 if (((ap->ipa_want_ah && (ixa->ixa_ipsec_ah_sa == NULL)) || 12414 (ap->ipa_want_esp && (ixa->ixa_ipsec_esp_sa == NULL))) && 12415 !ipsec_out_select_sa(mp, ixa)) 12416 return (0); 12417 12418 /* 12419 * By now, we know what SA's to use. Toss over to ESP & AH 12420 * to do the heavy lifting. 12421 */ 12422 if (ap->ipa_want_esp) { 12423 ASSERT(ixa->ixa_ipsec_esp_sa != NULL); 12424 12425 mp = ixa->ixa_ipsec_esp_sa->ipsa_output_func(mp, ixa); 12426 if (mp == NULL) { 12427 /* 12428 * Either it failed or is pending. In the former case 12429 * ipIfStatsInDiscards was increased. 12430 */ 12431 return (0); 12432 } 12433 } 12434 12435 if (ap->ipa_want_ah) { 12436 ASSERT(ixa->ixa_ipsec_ah_sa != NULL); 12437 12438 mp = ixa->ixa_ipsec_ah_sa->ipsa_output_func(mp, ixa); 12439 if (mp == NULL) { 12440 /* 12441 * Either it failed or is pending. In the former case 12442 * ipIfStatsInDiscards was increased. 12443 */ 12444 return (0); 12445 } 12446 } 12447 /* 12448 * We are done with IPsec processing. Send it over 12449 * the wire. 12450 */ 12451 return (ip_output_post_ipsec(mp, ixa)); 12452 } 12453 12454 /* 12455 * ioctls that go through a down/up sequence may need to wait for the down 12456 * to complete. This involves waiting for the ire and ipif refcnts to go down 12457 * to zero. Subsequently the ioctl is restarted from ipif_ill_refrele_tail. 12458 */ 12459 /* ARGSUSED */ 12460 void 12461 ip_reprocess_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 12462 { 12463 struct iocblk *iocp; 12464 mblk_t *mp1; 12465 ip_ioctl_cmd_t *ipip; 12466 int err; 12467 sin_t *sin; 12468 struct lifreq *lifr; 12469 struct ifreq *ifr; 12470 12471 iocp = (struct iocblk *)mp->b_rptr; 12472 ASSERT(ipsq != NULL); 12473 /* Existence of mp1 verified in ip_wput_nondata */ 12474 mp1 = mp->b_cont->b_cont; 12475 ipip = ip_sioctl_lookup(iocp->ioc_cmd); 12476 if (ipip->ipi_cmd == SIOCSLIFNAME || ipip->ipi_cmd == IF_UNITSEL) { 12477 /* 12478 * Special case where ipx_current_ipif is not set: 12479 * ill_phyint_reinit merged the v4 and v6 into a single ipsq. 12480 * We are here as were not able to complete the operation in 12481 * ipif_set_values because we could not become exclusive on 12482 * the new ipsq. 12483 */ 12484 ill_t *ill = q->q_ptr; 12485 ipsq_current_start(ipsq, ill->ill_ipif, ipip->ipi_cmd); 12486 } 12487 ASSERT(ipsq->ipsq_xop->ipx_current_ipif != NULL); 12488 12489 if (ipip->ipi_cmd_type == IF_CMD) { 12490 /* This a old style SIOC[GS]IF* command */ 12491 ifr = (struct ifreq *)mp1->b_rptr; 12492 sin = (sin_t *)&ifr->ifr_addr; 12493 } else if (ipip->ipi_cmd_type == LIF_CMD) { 12494 /* This a new style SIOC[GS]LIF* command */ 12495 lifr = (struct lifreq *)mp1->b_rptr; 12496 sin = (sin_t *)&lifr->lifr_addr; 12497 } else { 12498 sin = NULL; 12499 } 12500 12501 err = (*ipip->ipi_func_restart)(ipsq->ipsq_xop->ipx_current_ipif, sin, 12502 q, mp, ipip, mp1->b_rptr); 12503 12504 DTRACE_PROBE4(ipif__ioctl, char *, "ip_reprocess_ioctl finish", 12505 int, ipip->ipi_cmd, 12506 ill_t *, ipsq->ipsq_xop->ipx_current_ipif->ipif_ill, 12507 ipif_t *, ipsq->ipsq_xop->ipx_current_ipif); 12508 12509 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq); 12510 } 12511 12512 /* 12513 * ioctl processing 12514 * 12515 * ioctl processing starts with ip_sioctl_copyin_setup(), which looks up 12516 * the ioctl command in the ioctl tables, determines the copyin data size 12517 * from the ipi_copyin_size field, and does an mi_copyin() of that size. 12518 * 12519 * ioctl processing then continues when the M_IOCDATA makes its way down to 12520 * ip_wput_nondata(). The ioctl is looked up again in the ioctl table, its 12521 * associated 'conn' is refheld till the end of the ioctl and the general 12522 * ioctl processing function ip_process_ioctl() is called to extract the 12523 * arguments and process the ioctl. To simplify extraction, ioctl commands 12524 * are "typed" based on the arguments they take (e.g., LIF_CMD which takes a 12525 * `struct lifreq'), and a common extract function (e.g., ip_extract_lifreq()) 12526 * is used to extract the ioctl's arguments. 12527 * 12528 * ip_process_ioctl determines if the ioctl needs to be serialized, and if 12529 * so goes thru the serialization primitive ipsq_try_enter. Then the 12530 * appropriate function to handle the ioctl is called based on the entry in 12531 * the ioctl table. ioctl completion is encapsulated in ip_ioctl_finish 12532 * which also refreleases the 'conn' that was refheld at the start of the 12533 * ioctl. Finally ipsq_exit is called if needed to exit the ipsq. 12534 * 12535 * Many exclusive ioctls go thru an internal down up sequence as part of 12536 * the operation. For example an attempt to change the IP address of an 12537 * ipif entails ipif_down, set address, ipif_up. Bringing down the interface 12538 * does all the cleanup such as deleting all ires that use this address. 12539 * Then we need to wait till all references to the interface go away. 12540 */ 12541 void 12542 ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg) 12543 { 12544 struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 12545 ip_ioctl_cmd_t *ipip = arg; 12546 ip_extract_func_t *extract_funcp; 12547 cmd_info_t ci; 12548 int err; 12549 boolean_t entered_ipsq = B_FALSE; 12550 12551 ip3dbg(("ip_process_ioctl: ioctl %X\n", iocp->ioc_cmd)); 12552 12553 if (ipip == NULL) 12554 ipip = ip_sioctl_lookup(iocp->ioc_cmd); 12555 12556 /* 12557 * SIOCLIFADDIF needs to go thru a special path since the 12558 * ill may not exist yet. This happens in the case of lo0 12559 * which is created using this ioctl. 12560 */ 12561 if (ipip->ipi_cmd == SIOCLIFADDIF) { 12562 err = ip_sioctl_addif(NULL, NULL, q, mp, NULL, NULL); 12563 DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish", 12564 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL); 12565 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 12566 return; 12567 } 12568 12569 ci.ci_ipif = NULL; 12570 switch (ipip->ipi_cmd_type) { 12571 case MISC_CMD: 12572 case MSFILT_CMD: 12573 /* 12574 * All MISC_CMD ioctls come in here -- e.g. SIOCGLIFCONF. 12575 */ 12576 if (ipip->ipi_cmd == IF_UNITSEL) { 12577 /* ioctl comes down the ill */ 12578 ci.ci_ipif = ((ill_t *)q->q_ptr)->ill_ipif; 12579 ipif_refhold(ci.ci_ipif); 12580 } 12581 err = 0; 12582 ci.ci_sin = NULL; 12583 ci.ci_sin6 = NULL; 12584 ci.ci_lifr = NULL; 12585 extract_funcp = NULL; 12586 break; 12587 12588 case IF_CMD: 12589 case LIF_CMD: 12590 extract_funcp = ip_extract_lifreq; 12591 break; 12592 12593 case ARP_CMD: 12594 case XARP_CMD: 12595 extract_funcp = ip_extract_arpreq; 12596 break; 12597 12598 default: 12599 ASSERT(0); 12600 } 12601 12602 if (extract_funcp != NULL) { 12603 err = (*extract_funcp)(q, mp, ipip, &ci); 12604 if (err != 0) { 12605 DTRACE_PROBE4(ipif__ioctl, 12606 char *, "ip_process_ioctl finish err", 12607 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL); 12608 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 12609 return; 12610 } 12611 12612 /* 12613 * All of the extraction functions return a refheld ipif. 12614 */ 12615 ASSERT(ci.ci_ipif != NULL); 12616 } 12617 12618 if (!(ipip->ipi_flags & IPI_WR)) { 12619 /* 12620 * A return value of EINPROGRESS means the ioctl is 12621 * either queued and waiting for some reason or has 12622 * already completed. 12623 */ 12624 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, 12625 ci.ci_lifr); 12626 if (ci.ci_ipif != NULL) { 12627 DTRACE_PROBE4(ipif__ioctl, 12628 char *, "ip_process_ioctl finish RD", 12629 int, ipip->ipi_cmd, ill_t *, ci.ci_ipif->ipif_ill, 12630 ipif_t *, ci.ci_ipif); 12631 ipif_refrele(ci.ci_ipif); 12632 } else { 12633 DTRACE_PROBE4(ipif__ioctl, 12634 char *, "ip_process_ioctl finish RD", 12635 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL); 12636 } 12637 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 12638 return; 12639 } 12640 12641 ASSERT(ci.ci_ipif != NULL); 12642 12643 /* 12644 * If ipsq is non-NULL, we are already being called exclusively 12645 */ 12646 ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq)); 12647 if (ipsq == NULL) { 12648 ipsq = ipsq_try_enter(ci.ci_ipif, NULL, q, mp, ip_process_ioctl, 12649 NEW_OP, B_TRUE); 12650 if (ipsq == NULL) { 12651 ipif_refrele(ci.ci_ipif); 12652 return; 12653 } 12654 entered_ipsq = B_TRUE; 12655 } 12656 /* 12657 * Release the ipif so that ipif_down and friends that wait for 12658 * references to go away are not misled about the current ipif_refcnt 12659 * values. We are writer so we can access the ipif even after releasing 12660 * the ipif. 12661 */ 12662 ipif_refrele(ci.ci_ipif); 12663 12664 ipsq_current_start(ipsq, ci.ci_ipif, ipip->ipi_cmd); 12665 12666 /* 12667 * A return value of EINPROGRESS means the ioctl is 12668 * either queued and waiting for some reason or has 12669 * already completed. 12670 */ 12671 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, ci.ci_lifr); 12672 12673 DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish WR", 12674 int, ipip->ipi_cmd, 12675 ill_t *, ci.ci_ipif == NULL ? NULL : ci.ci_ipif->ipif_ill, 12676 ipif_t *, ci.ci_ipif); 12677 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq); 12678 12679 if (entered_ipsq) 12680 ipsq_exit(ipsq); 12681 } 12682 12683 /* 12684 * Complete the ioctl. Typically ioctls use the mi package and need to 12685 * do mi_copyout/mi_copy_done. 12686 */ 12687 void 12688 ip_ioctl_finish(queue_t *q, mblk_t *mp, int err, int mode, ipsq_t *ipsq) 12689 { 12690 conn_t *connp = NULL; 12691 12692 if (err == EINPROGRESS) 12693 return; 12694 12695 if (CONN_Q(q)) { 12696 connp = Q_TO_CONN(q); 12697 ASSERT(connp->conn_ref >= 2); 12698 } 12699 12700 switch (mode) { 12701 case COPYOUT: 12702 if (err == 0) 12703 mi_copyout(q, mp); 12704 else 12705 mi_copy_done(q, mp, err); 12706 break; 12707 12708 case NO_COPYOUT: 12709 mi_copy_done(q, mp, err); 12710 break; 12711 12712 default: 12713 ASSERT(mode == CONN_CLOSE); /* aborted through CONN_CLOSE */ 12714 break; 12715 } 12716 12717 /* 12718 * The conn refhold and ioctlref placed on the conn at the start of the 12719 * ioctl are released here. 12720 */ 12721 if (connp != NULL) { 12722 CONN_DEC_IOCTLREF(connp); 12723 CONN_OPER_PENDING_DONE(connp); 12724 } 12725 12726 if (ipsq != NULL) 12727 ipsq_current_finish(ipsq); 12728 } 12729 12730 /* Handles all non data messages */ 12731 void 12732 ip_wput_nondata(queue_t *q, mblk_t *mp) 12733 { 12734 mblk_t *mp1; 12735 struct iocblk *iocp; 12736 ip_ioctl_cmd_t *ipip; 12737 conn_t *connp; 12738 cred_t *cr; 12739 char *proto_str; 12740 12741 if (CONN_Q(q)) 12742 connp = Q_TO_CONN(q); 12743 else 12744 connp = NULL; 12745 12746 switch (DB_TYPE(mp)) { 12747 case M_IOCTL: 12748 /* 12749 * IOCTL processing begins in ip_sioctl_copyin_setup which 12750 * will arrange to copy in associated control structures. 12751 */ 12752 ip_sioctl_copyin_setup(q, mp); 12753 return; 12754 case M_IOCDATA: 12755 /* 12756 * Ensure that this is associated with one of our trans- 12757 * parent ioctls. If it's not ours, discard it if we're 12758 * running as a driver, or pass it on if we're a module. 12759 */ 12760 iocp = (struct iocblk *)mp->b_rptr; 12761 ipip = ip_sioctl_lookup(iocp->ioc_cmd); 12762 if (ipip == NULL) { 12763 if (q->q_next == NULL) { 12764 goto nak; 12765 } else { 12766 putnext(q, mp); 12767 } 12768 return; 12769 } 12770 if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) { 12771 /* 12772 * The ioctl is one we recognise, but is not consumed 12773 * by IP as a module and we are a module, so we drop 12774 */ 12775 goto nak; 12776 } 12777 12778 /* IOCTL continuation following copyin or copyout. */ 12779 if (mi_copy_state(q, mp, NULL) == -1) { 12780 /* 12781 * The copy operation failed. mi_copy_state already 12782 * cleaned up, so we're out of here. 12783 */ 12784 return; 12785 } 12786 /* 12787 * If we just completed a copy in, we become writer and 12788 * continue processing in ip_sioctl_copyin_done. If it 12789 * was a copy out, we call mi_copyout again. If there is 12790 * nothing more to copy out, it will complete the IOCTL. 12791 */ 12792 if (MI_COPY_DIRECTION(mp) == MI_COPY_IN) { 12793 if (!(mp1 = mp->b_cont) || !(mp1 = mp1->b_cont)) { 12794 mi_copy_done(q, mp, EPROTO); 12795 return; 12796 } 12797 /* 12798 * Check for cases that need more copying. A return 12799 * value of 0 means a second copyin has been started, 12800 * so we return; a return value of 1 means no more 12801 * copying is needed, so we continue. 12802 */ 12803 if (ipip->ipi_cmd_type == MSFILT_CMD && 12804 MI_COPY_COUNT(mp) == 1) { 12805 if (ip_copyin_msfilter(q, mp) == 0) 12806 return; 12807 } 12808 /* 12809 * Refhold the conn, till the ioctl completes. This is 12810 * needed in case the ioctl ends up in the pending mp 12811 * list. Every mp in the ipx_pending_mp list must have 12812 * a refhold on the conn to resume processing. The 12813 * refhold is released when the ioctl completes 12814 * (whether normally or abnormally). An ioctlref is also 12815 * placed on the conn to prevent TCP from removing the 12816 * queue needed to send the ioctl reply back. 12817 * In all cases ip_ioctl_finish is called to finish 12818 * the ioctl and release the refholds. 12819 */ 12820 if (connp != NULL) { 12821 /* This is not a reentry */ 12822 CONN_INC_REF(connp); 12823 CONN_INC_IOCTLREF(connp); 12824 } else { 12825 if (!(ipip->ipi_flags & IPI_MODOK)) { 12826 mi_copy_done(q, mp, EINVAL); 12827 return; 12828 } 12829 } 12830 12831 ip_process_ioctl(NULL, q, mp, ipip); 12832 12833 } else { 12834 mi_copyout(q, mp); 12835 } 12836 return; 12837 12838 case M_IOCNAK: 12839 /* 12840 * The only way we could get here is if a resolver didn't like 12841 * an IOCTL we sent it. This shouldn't happen. 12842 */ 12843 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 12844 "ip_wput_nondata: unexpected M_IOCNAK, ioc_cmd 0x%x", 12845 ((struct iocblk *)mp->b_rptr)->ioc_cmd); 12846 freemsg(mp); 12847 return; 12848 case M_IOCACK: 12849 /* /dev/ip shouldn't see this */ 12850 goto nak; 12851 case M_FLUSH: 12852 if (*mp->b_rptr & FLUSHW) 12853 flushq(q, FLUSHALL); 12854 if (q->q_next) { 12855 putnext(q, mp); 12856 return; 12857 } 12858 if (*mp->b_rptr & FLUSHR) { 12859 *mp->b_rptr &= ~FLUSHW; 12860 qreply(q, mp); 12861 return; 12862 } 12863 freemsg(mp); 12864 return; 12865 case M_CTL: 12866 break; 12867 case M_PROTO: 12868 case M_PCPROTO: 12869 /* 12870 * The only PROTO messages we expect are SNMP-related. 12871 */ 12872 switch (((union T_primitives *)mp->b_rptr)->type) { 12873 case T_SVR4_OPTMGMT_REQ: 12874 ip2dbg(("ip_wput_nondata: T_SVR4_OPTMGMT_REQ " 12875 "flags %x\n", 12876 ((struct T_optmgmt_req *)mp->b_rptr)->MGMT_flags)); 12877 12878 if (connp == NULL) { 12879 proto_str = "T_SVR4_OPTMGMT_REQ"; 12880 goto protonak; 12881 } 12882 12883 /* 12884 * All Solaris components should pass a db_credp 12885 * for this TPI message, hence we ASSERT. 12886 * But in case there is some other M_PROTO that looks 12887 * like a TPI message sent by some other kernel 12888 * component, we check and return an error. 12889 */ 12890 cr = msg_getcred(mp, NULL); 12891 ASSERT(cr != NULL); 12892 if (cr == NULL) { 12893 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, EINVAL); 12894 if (mp != NULL) 12895 qreply(q, mp); 12896 return; 12897 } 12898 12899 if (!snmpcom_req(q, mp, ip_snmp_set, ip_snmp_get, cr)) { 12900 proto_str = "Bad SNMPCOM request?"; 12901 goto protonak; 12902 } 12903 return; 12904 default: 12905 ip1dbg(("ip_wput_nondata: dropping M_PROTO prim %u\n", 12906 (int)*(uint_t *)mp->b_rptr)); 12907 freemsg(mp); 12908 return; 12909 } 12910 default: 12911 break; 12912 } 12913 if (q->q_next) { 12914 putnext(q, mp); 12915 } else 12916 freemsg(mp); 12917 return; 12918 12919 nak: 12920 iocp->ioc_error = EINVAL; 12921 mp->b_datap->db_type = M_IOCNAK; 12922 iocp->ioc_count = 0; 12923 qreply(q, mp); 12924 return; 12925 12926 protonak: 12927 cmn_err(CE_NOTE, "IP doesn't process %s as a module", proto_str); 12928 if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, EINVAL)) != NULL) 12929 qreply(q, mp); 12930 } 12931 12932 /* 12933 * Process IP options in an outbound packet. Verify that the nexthop in a 12934 * strict source route is onlink. 12935 * Returns non-zero if something fails in which case an ICMP error has been 12936 * sent and mp freed. 12937 * 12938 * Assumes the ULP has called ip_massage_options to move nexthop into ipha_dst. 12939 */ 12940 int 12941 ip_output_options(mblk_t *mp, ipha_t *ipha, ip_xmit_attr_t *ixa, ill_t *ill) 12942 { 12943 ipoptp_t opts; 12944 uchar_t *opt; 12945 uint8_t optval; 12946 uint8_t optlen; 12947 ipaddr_t dst; 12948 intptr_t code = 0; 12949 ire_t *ire; 12950 ip_stack_t *ipst = ixa->ixa_ipst; 12951 ip_recv_attr_t iras; 12952 12953 ip2dbg(("ip_output_options\n")); 12954 12955 dst = ipha->ipha_dst; 12956 for (optval = ipoptp_first(&opts, ipha); 12957 optval != IPOPT_EOL; 12958 optval = ipoptp_next(&opts)) { 12959 opt = opts.ipoptp_cur; 12960 optlen = opts.ipoptp_len; 12961 ip2dbg(("ip_output_options: opt %d, len %d\n", 12962 optval, optlen)); 12963 switch (optval) { 12964 uint32_t off; 12965 case IPOPT_SSRR: 12966 case IPOPT_LSRR: 12967 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 12968 ip1dbg(( 12969 "ip_output_options: bad option offset\n")); 12970 code = (char *)&opt[IPOPT_OLEN] - 12971 (char *)ipha; 12972 goto param_prob; 12973 } 12974 off = opt[IPOPT_OFFSET]; 12975 ip1dbg(("ip_output_options: next hop 0x%x\n", 12976 ntohl(dst))); 12977 /* 12978 * For strict: verify that dst is directly 12979 * reachable. 12980 */ 12981 if (optval == IPOPT_SSRR) { 12982 ire = ire_ftable_lookup_v4(dst, 0, 0, 12983 IRE_INTERFACE, NULL, ALL_ZONES, 12984 ixa->ixa_tsl, 12985 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst, 12986 NULL); 12987 if (ire == NULL) { 12988 ip1dbg(("ip_output_options: SSRR not" 12989 " directly reachable: 0x%x\n", 12990 ntohl(dst))); 12991 goto bad_src_route; 12992 } 12993 ire_refrele(ire); 12994 } 12995 break; 12996 case IPOPT_RR: 12997 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 12998 ip1dbg(( 12999 "ip_output_options: bad option offset\n")); 13000 code = (char *)&opt[IPOPT_OLEN] - 13001 (char *)ipha; 13002 goto param_prob; 13003 } 13004 break; 13005 case IPOPT_TS: 13006 /* 13007 * Verify that length >=5 and that there is either 13008 * room for another timestamp or that the overflow 13009 * counter is not maxed out. 13010 */ 13011 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha; 13012 if (optlen < IPOPT_MINLEN_IT) { 13013 goto param_prob; 13014 } 13015 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 13016 ip1dbg(( 13017 "ip_output_options: bad option offset\n")); 13018 code = (char *)&opt[IPOPT_OFFSET] - 13019 (char *)ipha; 13020 goto param_prob; 13021 } 13022 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 13023 case IPOPT_TS_TSONLY: 13024 off = IPOPT_TS_TIMELEN; 13025 break; 13026 case IPOPT_TS_TSANDADDR: 13027 case IPOPT_TS_PRESPEC: 13028 case IPOPT_TS_PRESPEC_RFC791: 13029 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 13030 break; 13031 default: 13032 code = (char *)&opt[IPOPT_POS_OV_FLG] - 13033 (char *)ipha; 13034 goto param_prob; 13035 } 13036 if (opt[IPOPT_OFFSET] - 1 + off > optlen && 13037 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) { 13038 /* 13039 * No room and the overflow counter is 15 13040 * already. 13041 */ 13042 goto param_prob; 13043 } 13044 break; 13045 } 13046 } 13047 13048 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) 13049 return (0); 13050 13051 ip1dbg(("ip_output_options: error processing IP options.")); 13052 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha; 13053 13054 param_prob: 13055 bzero(&iras, sizeof (iras)); 13056 iras.ira_ill = iras.ira_rill = ill; 13057 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex; 13058 iras.ira_rifindex = iras.ira_ruifindex; 13059 iras.ira_flags = IRAF_IS_IPV4; 13060 13061 ip_drop_output("ip_output_options", mp, ill); 13062 icmp_param_problem(mp, (uint8_t)code, &iras); 13063 ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE)); 13064 return (-1); 13065 13066 bad_src_route: 13067 bzero(&iras, sizeof (iras)); 13068 iras.ira_ill = iras.ira_rill = ill; 13069 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex; 13070 iras.ira_rifindex = iras.ira_ruifindex; 13071 iras.ira_flags = IRAF_IS_IPV4; 13072 13073 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill); 13074 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, &iras); 13075 ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE)); 13076 return (-1); 13077 } 13078 13079 /* 13080 * The maximum value of conn_drain_list_cnt is CONN_MAXDRAINCNT. 13081 * conn_drain_list_cnt can be changed by setting conn_drain_nthreads 13082 * thru /etc/system. 13083 */ 13084 #define CONN_MAXDRAINCNT 64 13085 13086 static void 13087 conn_drain_init(ip_stack_t *ipst) 13088 { 13089 int i, j; 13090 idl_tx_list_t *itl_tx; 13091 13092 ipst->ips_conn_drain_list_cnt = conn_drain_nthreads; 13093 13094 if ((ipst->ips_conn_drain_list_cnt == 0) || 13095 (ipst->ips_conn_drain_list_cnt > CONN_MAXDRAINCNT)) { 13096 /* 13097 * Default value of the number of drainers is the 13098 * number of cpus, subject to maximum of 8 drainers. 13099 */ 13100 if (boot_max_ncpus != -1) 13101 ipst->ips_conn_drain_list_cnt = MIN(boot_max_ncpus, 8); 13102 else 13103 ipst->ips_conn_drain_list_cnt = MIN(max_ncpus, 8); 13104 } 13105 13106 ipst->ips_idl_tx_list = 13107 kmem_zalloc(TX_FANOUT_SIZE * sizeof (idl_tx_list_t), KM_SLEEP); 13108 for (i = 0; i < TX_FANOUT_SIZE; i++) { 13109 itl_tx = &ipst->ips_idl_tx_list[i]; 13110 itl_tx->txl_drain_list = 13111 kmem_zalloc(ipst->ips_conn_drain_list_cnt * 13112 sizeof (idl_t), KM_SLEEP); 13113 mutex_init(&itl_tx->txl_lock, NULL, MUTEX_DEFAULT, NULL); 13114 for (j = 0; j < ipst->ips_conn_drain_list_cnt; j++) { 13115 mutex_init(&itl_tx->txl_drain_list[j].idl_lock, NULL, 13116 MUTEX_DEFAULT, NULL); 13117 itl_tx->txl_drain_list[j].idl_itl = itl_tx; 13118 } 13119 } 13120 } 13121 13122 static void 13123 conn_drain_fini(ip_stack_t *ipst) 13124 { 13125 int i; 13126 idl_tx_list_t *itl_tx; 13127 13128 for (i = 0; i < TX_FANOUT_SIZE; i++) { 13129 itl_tx = &ipst->ips_idl_tx_list[i]; 13130 kmem_free(itl_tx->txl_drain_list, 13131 ipst->ips_conn_drain_list_cnt * sizeof (idl_t)); 13132 } 13133 kmem_free(ipst->ips_idl_tx_list, 13134 TX_FANOUT_SIZE * sizeof (idl_tx_list_t)); 13135 ipst->ips_idl_tx_list = NULL; 13136 } 13137 13138 /* 13139 * Flow control has blocked us from proceeding. Insert the given conn in one 13140 * of the conn drain lists. When flow control is unblocked, either ip_wsrv() 13141 * (STREAMS) or ill_flow_enable() (direct) will be called back, which in turn 13142 * will call conn_walk_drain(). See the flow control notes at the top of this 13143 * file for more details. 13144 */ 13145 void 13146 conn_drain_insert(conn_t *connp, idl_tx_list_t *tx_list) 13147 { 13148 idl_t *idl = tx_list->txl_drain_list; 13149 uint_t index; 13150 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 13151 13152 mutex_enter(&connp->conn_lock); 13153 if (connp->conn_state_flags & CONN_CLOSING) { 13154 /* 13155 * The conn is closing as a result of which CONN_CLOSING 13156 * is set. Return. 13157 */ 13158 mutex_exit(&connp->conn_lock); 13159 return; 13160 } else if (connp->conn_idl == NULL) { 13161 /* 13162 * Assign the next drain list round robin. We dont' use 13163 * a lock, and thus it may not be strictly round robin. 13164 * Atomicity of load/stores is enough to make sure that 13165 * conn_drain_list_index is always within bounds. 13166 */ 13167 index = tx_list->txl_drain_index; 13168 ASSERT(index < ipst->ips_conn_drain_list_cnt); 13169 connp->conn_idl = &tx_list->txl_drain_list[index]; 13170 index++; 13171 if (index == ipst->ips_conn_drain_list_cnt) 13172 index = 0; 13173 tx_list->txl_drain_index = index; 13174 } else { 13175 ASSERT(connp->conn_idl->idl_itl == tx_list); 13176 } 13177 mutex_exit(&connp->conn_lock); 13178 13179 idl = connp->conn_idl; 13180 mutex_enter(&idl->idl_lock); 13181 if ((connp->conn_drain_prev != NULL) || 13182 (connp->conn_state_flags & CONN_CLOSING)) { 13183 /* 13184 * The conn is either already in the drain list or closing. 13185 * (We needed to check for CONN_CLOSING again since close can 13186 * sneak in between dropping conn_lock and acquiring idl_lock.) 13187 */ 13188 mutex_exit(&idl->idl_lock); 13189 return; 13190 } 13191 13192 /* 13193 * The conn is not in the drain list. Insert it at the 13194 * tail of the drain list. The drain list is circular 13195 * and doubly linked. idl_conn points to the 1st element 13196 * in the list. 13197 */ 13198 if (idl->idl_conn == NULL) { 13199 idl->idl_conn = connp; 13200 connp->conn_drain_next = connp; 13201 connp->conn_drain_prev = connp; 13202 } else { 13203 conn_t *head = idl->idl_conn; 13204 13205 connp->conn_drain_next = head; 13206 connp->conn_drain_prev = head->conn_drain_prev; 13207 head->conn_drain_prev->conn_drain_next = connp; 13208 head->conn_drain_prev = connp; 13209 } 13210 /* 13211 * For non streams based sockets assert flow control. 13212 */ 13213 conn_setqfull(connp, NULL); 13214 mutex_exit(&idl->idl_lock); 13215 } 13216 13217 static void 13218 conn_drain_remove(conn_t *connp) 13219 { 13220 idl_t *idl = connp->conn_idl; 13221 13222 if (idl != NULL) { 13223 /* 13224 * Remove ourself from the drain list. 13225 */ 13226 if (connp->conn_drain_next == connp) { 13227 /* Singleton in the list */ 13228 ASSERT(connp->conn_drain_prev == connp); 13229 idl->idl_conn = NULL; 13230 } else { 13231 connp->conn_drain_prev->conn_drain_next = 13232 connp->conn_drain_next; 13233 connp->conn_drain_next->conn_drain_prev = 13234 connp->conn_drain_prev; 13235 if (idl->idl_conn == connp) 13236 idl->idl_conn = connp->conn_drain_next; 13237 } 13238 13239 /* 13240 * NOTE: because conn_idl is associated with a specific drain 13241 * list which in turn is tied to the index the TX ring 13242 * (txl_cookie) hashes to, and because the TX ring can change 13243 * over the lifetime of the conn_t, we must clear conn_idl so 13244 * a subsequent conn_drain_insert() will set conn_idl again 13245 * based on the latest txl_cookie. 13246 */ 13247 connp->conn_idl = NULL; 13248 } 13249 connp->conn_drain_next = NULL; 13250 connp->conn_drain_prev = NULL; 13251 13252 conn_clrqfull(connp, NULL); 13253 /* 13254 * For streams based sockets open up flow control. 13255 */ 13256 if (!IPCL_IS_NONSTR(connp)) 13257 enableok(connp->conn_wq); 13258 } 13259 13260 /* 13261 * This conn is closing, and we are called from ip_close. OR 13262 * this conn is draining because flow-control on the ill has been relieved. 13263 * 13264 * We must also need to remove conn's on this idl from the list, and also 13265 * inform the sockfs upcalls about the change in flow-control. 13266 */ 13267 static void 13268 conn_drain(conn_t *connp, boolean_t closing) 13269 { 13270 idl_t *idl; 13271 conn_t *next_connp; 13272 13273 /* 13274 * connp->conn_idl is stable at this point, and no lock is needed 13275 * to check it. If we are called from ip_close, close has already 13276 * set CONN_CLOSING, thus freezing the value of conn_idl, and 13277 * called us only because conn_idl is non-null. If we are called thru 13278 * service, conn_idl could be null, but it cannot change because 13279 * service is single-threaded per queue, and there cannot be another 13280 * instance of service trying to call conn_drain_insert on this conn 13281 * now. 13282 */ 13283 ASSERT(!closing || connp == NULL || connp->conn_idl != NULL); 13284 13285 /* 13286 * If the conn doesn't exist or is not on a drain list, bail. 13287 */ 13288 if (connp == NULL || connp->conn_idl == NULL || 13289 connp->conn_drain_prev == NULL) { 13290 return; 13291 } 13292 13293 idl = connp->conn_idl; 13294 ASSERT(MUTEX_HELD(&idl->idl_lock)); 13295 13296 if (!closing) { 13297 next_connp = connp->conn_drain_next; 13298 while (next_connp != connp) { 13299 conn_t *delconnp = next_connp; 13300 13301 next_connp = next_connp->conn_drain_next; 13302 conn_drain_remove(delconnp); 13303 } 13304 ASSERT(connp->conn_drain_next == idl->idl_conn); 13305 } 13306 conn_drain_remove(connp); 13307 } 13308 13309 /* 13310 * Write service routine. Shared perimeter entry point. 13311 * The device queue's messages has fallen below the low water mark and STREAMS 13312 * has backenabled the ill_wq. Send sockfs notification about flow-control on 13313 * each waiting conn. 13314 */ 13315 void 13316 ip_wsrv(queue_t *q) 13317 { 13318 ill_t *ill; 13319 13320 ill = (ill_t *)q->q_ptr; 13321 if (ill->ill_state_flags == 0) { 13322 ip_stack_t *ipst = ill->ill_ipst; 13323 13324 /* 13325 * The device flow control has opened up. 13326 * Walk through conn drain lists and qenable the 13327 * first conn in each list. This makes sense only 13328 * if the stream is fully plumbed and setup. 13329 * Hence the ill_state_flags check above. 13330 */ 13331 ip1dbg(("ip_wsrv: walking\n")); 13332 conn_walk_drain(ipst, &ipst->ips_idl_tx_list[0]); 13333 enableok(ill->ill_wq); 13334 } 13335 } 13336 13337 /* 13338 * Callback to disable flow control in IP. 13339 * 13340 * This is a mac client callback added when the DLD_CAPAB_DIRECT capability 13341 * is enabled. 13342 * 13343 * When MAC_TX() is not able to send any more packets, dld sets its queue 13344 * to QFULL and enable the STREAMS flow control. Later, when the underlying 13345 * driver is able to continue to send packets, it calls mac_tx_(ring_)update() 13346 * function and wakes up corresponding mac worker threads, which in turn 13347 * calls this callback function, and disables flow control. 13348 */ 13349 void 13350 ill_flow_enable(void *arg, ip_mac_tx_cookie_t cookie) 13351 { 13352 ill_t *ill = (ill_t *)arg; 13353 ip_stack_t *ipst = ill->ill_ipst; 13354 idl_tx_list_t *idl_txl; 13355 13356 idl_txl = &ipst->ips_idl_tx_list[IDLHASHINDEX(cookie)]; 13357 mutex_enter(&idl_txl->txl_lock); 13358 /* add code to to set a flag to indicate idl_txl is enabled */ 13359 conn_walk_drain(ipst, idl_txl); 13360 mutex_exit(&idl_txl->txl_lock); 13361 } 13362 13363 /* 13364 * Flow control has been relieved and STREAMS has backenabled us; drain 13365 * all the conn lists on `tx_list'. 13366 */ 13367 static void 13368 conn_walk_drain(ip_stack_t *ipst, idl_tx_list_t *tx_list) 13369 { 13370 int i; 13371 idl_t *idl; 13372 13373 IP_STAT(ipst, ip_conn_walk_drain); 13374 13375 for (i = 0; i < ipst->ips_conn_drain_list_cnt; i++) { 13376 idl = &tx_list->txl_drain_list[i]; 13377 mutex_enter(&idl->idl_lock); 13378 conn_drain(idl->idl_conn, B_FALSE); 13379 mutex_exit(&idl->idl_lock); 13380 } 13381 } 13382 13383 /* 13384 * Determine if the ill and multicast aspects of that packets 13385 * "matches" the conn. 13386 */ 13387 boolean_t 13388 conn_wantpacket(conn_t *connp, ip_recv_attr_t *ira, ipha_t *ipha) 13389 { 13390 ill_t *ill = ira->ira_rill; 13391 zoneid_t zoneid = ira->ira_zoneid; 13392 uint_t in_ifindex; 13393 ipaddr_t dst, src; 13394 13395 dst = ipha->ipha_dst; 13396 src = ipha->ipha_src; 13397 13398 /* 13399 * conn_incoming_ifindex is set by IP_BOUND_IF which limits 13400 * unicast, broadcast and multicast reception to 13401 * conn_incoming_ifindex. 13402 * conn_wantpacket is called for unicast, broadcast and 13403 * multicast packets. 13404 */ 13405 in_ifindex = connp->conn_incoming_ifindex; 13406 13407 /* mpathd can bind to the under IPMP interface, which we allow */ 13408 if (in_ifindex != 0 && in_ifindex != ill->ill_phyint->phyint_ifindex) { 13409 if (!IS_UNDER_IPMP(ill)) 13410 return (B_FALSE); 13411 13412 if (in_ifindex != ipmp_ill_get_ipmp_ifindex(ill)) 13413 return (B_FALSE); 13414 } 13415 13416 if (!IPCL_ZONE_MATCH(connp, zoneid)) 13417 return (B_FALSE); 13418 13419 if (!(ira->ira_flags & IRAF_MULTICAST)) 13420 return (B_TRUE); 13421 13422 if (connp->conn_multi_router) { 13423 /* multicast packet and multicast router socket: send up */ 13424 return (B_TRUE); 13425 } 13426 13427 if (ipha->ipha_protocol == IPPROTO_PIM || 13428 ipha->ipha_protocol == IPPROTO_RSVP) 13429 return (B_TRUE); 13430 13431 return (conn_hasmembers_ill_withsrc_v4(connp, dst, src, ira->ira_ill)); 13432 } 13433 13434 void 13435 conn_setqfull(conn_t *connp, boolean_t *flow_stopped) 13436 { 13437 if (IPCL_IS_NONSTR(connp)) { 13438 (*connp->conn_upcalls->su_txq_full) 13439 (connp->conn_upper_handle, B_TRUE); 13440 if (flow_stopped != NULL) 13441 *flow_stopped = B_TRUE; 13442 } else { 13443 queue_t *q = connp->conn_wq; 13444 13445 ASSERT(q != NULL); 13446 if (!(q->q_flag & QFULL)) { 13447 mutex_enter(QLOCK(q)); 13448 if (!(q->q_flag & QFULL)) { 13449 /* still need to set QFULL */ 13450 q->q_flag |= QFULL; 13451 /* set flow_stopped to true under QLOCK */ 13452 if (flow_stopped != NULL) 13453 *flow_stopped = B_TRUE; 13454 mutex_exit(QLOCK(q)); 13455 } else { 13456 /* flow_stopped is left unchanged */ 13457 mutex_exit(QLOCK(q)); 13458 } 13459 } 13460 } 13461 } 13462 13463 void 13464 conn_clrqfull(conn_t *connp, boolean_t *flow_stopped) 13465 { 13466 if (IPCL_IS_NONSTR(connp)) { 13467 (*connp->conn_upcalls->su_txq_full) 13468 (connp->conn_upper_handle, B_FALSE); 13469 if (flow_stopped != NULL) 13470 *flow_stopped = B_FALSE; 13471 } else { 13472 queue_t *q = connp->conn_wq; 13473 13474 ASSERT(q != NULL); 13475 if (q->q_flag & QFULL) { 13476 mutex_enter(QLOCK(q)); 13477 if (q->q_flag & QFULL) { 13478 q->q_flag &= ~QFULL; 13479 /* set flow_stopped to false under QLOCK */ 13480 if (flow_stopped != NULL) 13481 *flow_stopped = B_FALSE; 13482 mutex_exit(QLOCK(q)); 13483 if (q->q_flag & QWANTW) 13484 qbackenable(q, 0); 13485 } else { 13486 /* flow_stopped is left unchanged */ 13487 mutex_exit(QLOCK(q)); 13488 } 13489 } 13490 } 13491 13492 mutex_enter(&connp->conn_lock); 13493 connp->conn_blocked = B_FALSE; 13494 mutex_exit(&connp->conn_lock); 13495 } 13496 13497 /* 13498 * Return the length in bytes of the IPv4 headers (base header, label, and 13499 * other IP options) that will be needed based on the 13500 * ip_pkt_t structure passed by the caller. 13501 * 13502 * The returned length does not include the length of the upper level 13503 * protocol (ULP) header. 13504 * The caller needs to check that the length doesn't exceed the max for IPv4. 13505 */ 13506 int 13507 ip_total_hdrs_len_v4(const ip_pkt_t *ipp) 13508 { 13509 int len; 13510 13511 len = IP_SIMPLE_HDR_LENGTH; 13512 if (ipp->ipp_fields & IPPF_LABEL_V4) { 13513 ASSERT(ipp->ipp_label_len_v4 != 0); 13514 /* We need to round up here */ 13515 len += (ipp->ipp_label_len_v4 + 3) & ~3; 13516 } 13517 13518 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) { 13519 ASSERT(ipp->ipp_ipv4_options_len != 0); 13520 ASSERT((ipp->ipp_ipv4_options_len & 3) == 0); 13521 len += ipp->ipp_ipv4_options_len; 13522 } 13523 return (len); 13524 } 13525 13526 /* 13527 * All-purpose routine to build an IPv4 header with options based 13528 * on the abstract ip_pkt_t. 13529 * 13530 * The caller has to set the source and destination address as well as 13531 * ipha_length. The caller has to massage any source route and compensate 13532 * for the ULP pseudo-header checksum due to the source route. 13533 */ 13534 void 13535 ip_build_hdrs_v4(uchar_t *buf, uint_t buf_len, const ip_pkt_t *ipp, 13536 uint8_t protocol) 13537 { 13538 ipha_t *ipha = (ipha_t *)buf; 13539 uint8_t *cp; 13540 13541 /* Initialize IPv4 header */ 13542 ipha->ipha_type_of_service = ipp->ipp_type_of_service; 13543 ipha->ipha_length = 0; /* Caller will set later */ 13544 ipha->ipha_ident = 0; 13545 ipha->ipha_fragment_offset_and_flags = 0; 13546 ipha->ipha_ttl = ipp->ipp_unicast_hops; 13547 ipha->ipha_protocol = protocol; 13548 ipha->ipha_hdr_checksum = 0; 13549 13550 if ((ipp->ipp_fields & IPPF_ADDR) && 13551 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 13552 ipha->ipha_src = ipp->ipp_addr_v4; 13553 13554 cp = (uint8_t *)&ipha[1]; 13555 if (ipp->ipp_fields & IPPF_LABEL_V4) { 13556 ASSERT(ipp->ipp_label_len_v4 != 0); 13557 bcopy(ipp->ipp_label_v4, cp, ipp->ipp_label_len_v4); 13558 cp += ipp->ipp_label_len_v4; 13559 /* We need to round up here */ 13560 while ((uintptr_t)cp & 0x3) { 13561 *cp++ = IPOPT_NOP; 13562 } 13563 } 13564 13565 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) { 13566 ASSERT(ipp->ipp_ipv4_options_len != 0); 13567 ASSERT((ipp->ipp_ipv4_options_len & 3) == 0); 13568 bcopy(ipp->ipp_ipv4_options, cp, ipp->ipp_ipv4_options_len); 13569 cp += ipp->ipp_ipv4_options_len; 13570 } 13571 ipha->ipha_version_and_hdr_length = 13572 (uint8_t)((IP_VERSION << 4) + buf_len / 4); 13573 13574 ASSERT((int)(cp - buf) == buf_len); 13575 } 13576 13577 /* Allocate the private structure */ 13578 static int 13579 ip_priv_alloc(void **bufp) 13580 { 13581 void *buf; 13582 13583 if ((buf = kmem_alloc(sizeof (ip_priv_t), KM_NOSLEEP)) == NULL) 13584 return (ENOMEM); 13585 13586 *bufp = buf; 13587 return (0); 13588 } 13589 13590 /* Function to delete the private structure */ 13591 void 13592 ip_priv_free(void *buf) 13593 { 13594 ASSERT(buf != NULL); 13595 kmem_free(buf, sizeof (ip_priv_t)); 13596 } 13597 13598 /* 13599 * The entry point for IPPF processing. 13600 * If the classifier (IPGPC_CLASSIFY) is not loaded and configured, the 13601 * routine just returns. 13602 * 13603 * When called, ip_process generates an ipp_packet_t structure 13604 * which holds the state information for this packet and invokes the 13605 * the classifier (via ipp_packet_process). The classification, depending on 13606 * configured filters, results in a list of actions for this packet. Invoking 13607 * an action may cause the packet to be dropped, in which case we return NULL. 13608 * proc indicates the callout position for 13609 * this packet and ill is the interface this packet arrived on or will leave 13610 * on (inbound and outbound resp.). 13611 * 13612 * We do the processing on the rill (mapped to the upper if ipmp), but MIB 13613 * on the ill corrsponding to the destination IP address. 13614 */ 13615 mblk_t * 13616 ip_process(ip_proc_t proc, mblk_t *mp, ill_t *rill, ill_t *ill) 13617 { 13618 ip_priv_t *priv; 13619 ipp_action_id_t aid; 13620 int rc = 0; 13621 ipp_packet_t *pp; 13622 13623 /* If the classifier is not loaded, return */ 13624 if ((aid = ipp_action_lookup(IPGPC_CLASSIFY)) == IPP_ACTION_INVAL) { 13625 return (mp); 13626 } 13627 13628 ASSERT(mp != NULL); 13629 13630 /* Allocate the packet structure */ 13631 rc = ipp_packet_alloc(&pp, "ip", aid); 13632 if (rc != 0) 13633 goto drop; 13634 13635 /* Allocate the private structure */ 13636 rc = ip_priv_alloc((void **)&priv); 13637 if (rc != 0) { 13638 ipp_packet_free(pp); 13639 goto drop; 13640 } 13641 priv->proc = proc; 13642 priv->ill_index = ill_get_upper_ifindex(rill); 13643 13644 ipp_packet_set_private(pp, priv, ip_priv_free); 13645 ipp_packet_set_data(pp, mp); 13646 13647 /* Invoke the classifier */ 13648 rc = ipp_packet_process(&pp); 13649 if (pp != NULL) { 13650 mp = ipp_packet_get_data(pp); 13651 ipp_packet_free(pp); 13652 if (rc != 0) 13653 goto drop; 13654 return (mp); 13655 } else { 13656 /* No mp to trace in ip_drop_input/ip_drop_output */ 13657 mp = NULL; 13658 } 13659 drop: 13660 if (proc == IPP_LOCAL_IN || proc == IPP_FWD_IN) { 13661 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13662 ip_drop_input("ip_process", mp, ill); 13663 } else { 13664 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 13665 ip_drop_output("ip_process", mp, ill); 13666 } 13667 freemsg(mp); 13668 return (NULL); 13669 } 13670 13671 /* 13672 * Propagate a multicast group membership operation (add/drop) on 13673 * all the interfaces crossed by the related multirt routes. 13674 * The call is considered successful if the operation succeeds 13675 * on at least one interface. 13676 * 13677 * This assumes that a set of IRE_HOST/RTF_MULTIRT has been created for the 13678 * multicast addresses with the ire argument being the first one. 13679 * We walk the bucket to find all the of those. 13680 * 13681 * Common to IPv4 and IPv6. 13682 */ 13683 static int 13684 ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t, 13685 const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *), 13686 ire_t *ire, conn_t *connp, boolean_t checkonly, const in6_addr_t *v6group, 13687 mcast_record_t fmode, const in6_addr_t *v6src) 13688 { 13689 ire_t *ire_gw; 13690 irb_t *irb; 13691 int ifindex; 13692 int error = 0; 13693 int result; 13694 ip_stack_t *ipst = ire->ire_ipst; 13695 ipaddr_t group; 13696 boolean_t isv6; 13697 int match_flags; 13698 13699 if (IN6_IS_ADDR_V4MAPPED(v6group)) { 13700 IN6_V4MAPPED_TO_IPADDR(v6group, group); 13701 isv6 = B_FALSE; 13702 } else { 13703 isv6 = B_TRUE; 13704 } 13705 13706 irb = ire->ire_bucket; 13707 ASSERT(irb != NULL); 13708 13709 result = 0; 13710 irb_refhold(irb); 13711 for (; ire != NULL; ire = ire->ire_next) { 13712 if ((ire->ire_flags & RTF_MULTIRT) == 0) 13713 continue; 13714 13715 /* We handle -ifp routes by matching on the ill if set */ 13716 match_flags = MATCH_IRE_TYPE; 13717 if (ire->ire_ill != NULL) 13718 match_flags |= MATCH_IRE_ILL; 13719 13720 if (isv6) { 13721 if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6group)) 13722 continue; 13723 13724 ire_gw = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6, 13725 0, 0, IRE_INTERFACE, ire->ire_ill, ALL_ZONES, NULL, 13726 match_flags, 0, ipst, NULL); 13727 } else { 13728 if (ire->ire_addr != group) 13729 continue; 13730 13731 ire_gw = ire_ftable_lookup_v4(ire->ire_gateway_addr, 13732 0, 0, IRE_INTERFACE, ire->ire_ill, ALL_ZONES, NULL, 13733 match_flags, 0, ipst, NULL); 13734 } 13735 /* No interface route exists for the gateway; skip this ire. */ 13736 if (ire_gw == NULL) 13737 continue; 13738 if (ire_gw->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 13739 ire_refrele(ire_gw); 13740 continue; 13741 } 13742 ASSERT(ire_gw->ire_ill != NULL); /* IRE_INTERFACE */ 13743 ifindex = ire_gw->ire_ill->ill_phyint->phyint_ifindex; 13744 13745 /* 13746 * The operation is considered a success if 13747 * it succeeds at least once on any one interface. 13748 */ 13749 error = fn(connp, checkonly, v6group, INADDR_ANY, ifindex, 13750 fmode, v6src); 13751 if (error == 0) 13752 result = CGTP_MCAST_SUCCESS; 13753 13754 ire_refrele(ire_gw); 13755 } 13756 irb_refrele(irb); 13757 /* 13758 * Consider the call as successful if we succeeded on at least 13759 * one interface. Otherwise, return the last encountered error. 13760 */ 13761 return (result == CGTP_MCAST_SUCCESS ? 0 : error); 13762 } 13763 13764 /* 13765 * Return the expected CGTP hooks version number. 13766 */ 13767 int 13768 ip_cgtp_filter_supported(void) 13769 { 13770 return (ip_cgtp_filter_rev); 13771 } 13772 13773 /* 13774 * CGTP hooks can be registered by invoking this function. 13775 * Checks that the version number matches. 13776 */ 13777 int 13778 ip_cgtp_filter_register(netstackid_t stackid, cgtp_filter_ops_t *ops) 13779 { 13780 netstack_t *ns; 13781 ip_stack_t *ipst; 13782 13783 if (ops->cfo_filter_rev != CGTP_FILTER_REV) 13784 return (ENOTSUP); 13785 13786 ns = netstack_find_by_stackid(stackid); 13787 if (ns == NULL) 13788 return (EINVAL); 13789 ipst = ns->netstack_ip; 13790 ASSERT(ipst != NULL); 13791 13792 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 13793 netstack_rele(ns); 13794 return (EALREADY); 13795 } 13796 13797 ipst->ips_ip_cgtp_filter_ops = ops; 13798 13799 ill_set_inputfn_all(ipst); 13800 13801 netstack_rele(ns); 13802 return (0); 13803 } 13804 13805 /* 13806 * CGTP hooks can be unregistered by invoking this function. 13807 * Returns ENXIO if there was no registration. 13808 * Returns EBUSY if the ndd variable has not been turned off. 13809 */ 13810 int 13811 ip_cgtp_filter_unregister(netstackid_t stackid) 13812 { 13813 netstack_t *ns; 13814 ip_stack_t *ipst; 13815 13816 ns = netstack_find_by_stackid(stackid); 13817 if (ns == NULL) 13818 return (EINVAL); 13819 ipst = ns->netstack_ip; 13820 ASSERT(ipst != NULL); 13821 13822 if (ipst->ips_ip_cgtp_filter) { 13823 netstack_rele(ns); 13824 return (EBUSY); 13825 } 13826 13827 if (ipst->ips_ip_cgtp_filter_ops == NULL) { 13828 netstack_rele(ns); 13829 return (ENXIO); 13830 } 13831 ipst->ips_ip_cgtp_filter_ops = NULL; 13832 13833 ill_set_inputfn_all(ipst); 13834 13835 netstack_rele(ns); 13836 return (0); 13837 } 13838 13839 /* 13840 * Check whether there is a CGTP filter registration. 13841 * Returns non-zero if there is a registration, otherwise returns zero. 13842 * Note: returns zero if bad stackid. 13843 */ 13844 int 13845 ip_cgtp_filter_is_registered(netstackid_t stackid) 13846 { 13847 netstack_t *ns; 13848 ip_stack_t *ipst; 13849 int ret; 13850 13851 ns = netstack_find_by_stackid(stackid); 13852 if (ns == NULL) 13853 return (0); 13854 ipst = ns->netstack_ip; 13855 ASSERT(ipst != NULL); 13856 13857 if (ipst->ips_ip_cgtp_filter_ops != NULL) 13858 ret = 1; 13859 else 13860 ret = 0; 13861 13862 netstack_rele(ns); 13863 return (ret); 13864 } 13865 13866 static int 13867 ip_squeue_switch(int val) 13868 { 13869 int rval; 13870 13871 switch (val) { 13872 case IP_SQUEUE_ENTER_NODRAIN: 13873 rval = SQ_NODRAIN; 13874 break; 13875 case IP_SQUEUE_ENTER: 13876 rval = SQ_PROCESS; 13877 break; 13878 case IP_SQUEUE_FILL: 13879 default: 13880 rval = SQ_FILL; 13881 break; 13882 } 13883 return (rval); 13884 } 13885 13886 static void * 13887 ip_kstat2_init(netstackid_t stackid, ip_stat_t *ip_statisticsp) 13888 { 13889 kstat_t *ksp; 13890 13891 ip_stat_t template = { 13892 { "ip_udp_fannorm", KSTAT_DATA_UINT64 }, 13893 { "ip_udp_fanmb", KSTAT_DATA_UINT64 }, 13894 { "ip_recv_pullup", KSTAT_DATA_UINT64 }, 13895 { "ip_db_ref", KSTAT_DATA_UINT64 }, 13896 { "ip_notaligned", KSTAT_DATA_UINT64 }, 13897 { "ip_multimblk", KSTAT_DATA_UINT64 }, 13898 { "ip_opt", KSTAT_DATA_UINT64 }, 13899 { "ipsec_proto_ahesp", KSTAT_DATA_UINT64 }, 13900 { "ip_conn_flputbq", KSTAT_DATA_UINT64 }, 13901 { "ip_conn_walk_drain", KSTAT_DATA_UINT64 }, 13902 { "ip_out_sw_cksum", KSTAT_DATA_UINT64 }, 13903 { "ip_out_sw_cksum_bytes", KSTAT_DATA_UINT64 }, 13904 { "ip_in_sw_cksum", KSTAT_DATA_UINT64 }, 13905 { "ip_ire_reclaim_calls", KSTAT_DATA_UINT64 }, 13906 { "ip_ire_reclaim_deleted", KSTAT_DATA_UINT64 }, 13907 { "ip_nce_reclaim_calls", KSTAT_DATA_UINT64 }, 13908 { "ip_nce_reclaim_deleted", KSTAT_DATA_UINT64 }, 13909 { "ip_dce_reclaim_calls", KSTAT_DATA_UINT64 }, 13910 { "ip_dce_reclaim_deleted", KSTAT_DATA_UINT64 }, 13911 { "ip_tcp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 }, 13912 { "ip_tcp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 }, 13913 { "ip_tcp_in_sw_cksum_err", KSTAT_DATA_UINT64 }, 13914 { "ip_udp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 }, 13915 { "ip_udp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 }, 13916 { "ip_udp_in_sw_cksum_err", KSTAT_DATA_UINT64 }, 13917 { "conn_in_recvdstaddr", KSTAT_DATA_UINT64 }, 13918 { "conn_in_recvopts", KSTAT_DATA_UINT64 }, 13919 { "conn_in_recvif", KSTAT_DATA_UINT64 }, 13920 { "conn_in_recvslla", KSTAT_DATA_UINT64 }, 13921 { "conn_in_recvucred", KSTAT_DATA_UINT64 }, 13922 { "conn_in_recvttl", KSTAT_DATA_UINT64 }, 13923 { "conn_in_recvhopopts", KSTAT_DATA_UINT64 }, 13924 { "conn_in_recvhoplimit", KSTAT_DATA_UINT64 }, 13925 { "conn_in_recvdstopts", KSTAT_DATA_UINT64 }, 13926 { "conn_in_recvrthdrdstopts", KSTAT_DATA_UINT64 }, 13927 { "conn_in_recvrthdr", KSTAT_DATA_UINT64 }, 13928 { "conn_in_recvpktinfo", KSTAT_DATA_UINT64 }, 13929 { "conn_in_recvtclass", KSTAT_DATA_UINT64 }, 13930 { "conn_in_timestamp", KSTAT_DATA_UINT64 }, 13931 }; 13932 13933 ksp = kstat_create_netstack("ip", 0, "ipstat", "net", 13934 KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t), 13935 KSTAT_FLAG_VIRTUAL, stackid); 13936 13937 if (ksp == NULL) 13938 return (NULL); 13939 13940 bcopy(&template, ip_statisticsp, sizeof (template)); 13941 ksp->ks_data = (void *)ip_statisticsp; 13942 ksp->ks_private = (void *)(uintptr_t)stackid; 13943 13944 kstat_install(ksp); 13945 return (ksp); 13946 } 13947 13948 static void 13949 ip_kstat2_fini(netstackid_t stackid, kstat_t *ksp) 13950 { 13951 if (ksp != NULL) { 13952 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 13953 kstat_delete_netstack(ksp, stackid); 13954 } 13955 } 13956 13957 static void * 13958 ip_kstat_init(netstackid_t stackid, ip_stack_t *ipst) 13959 { 13960 kstat_t *ksp; 13961 13962 ip_named_kstat_t template = { 13963 { "forwarding", KSTAT_DATA_UINT32, 0 }, 13964 { "defaultTTL", KSTAT_DATA_UINT32, 0 }, 13965 { "inReceives", KSTAT_DATA_UINT64, 0 }, 13966 { "inHdrErrors", KSTAT_DATA_UINT32, 0 }, 13967 { "inAddrErrors", KSTAT_DATA_UINT32, 0 }, 13968 { "forwDatagrams", KSTAT_DATA_UINT64, 0 }, 13969 { "inUnknownProtos", KSTAT_DATA_UINT32, 0 }, 13970 { "inDiscards", KSTAT_DATA_UINT32, 0 }, 13971 { "inDelivers", KSTAT_DATA_UINT64, 0 }, 13972 { "outRequests", KSTAT_DATA_UINT64, 0 }, 13973 { "outDiscards", KSTAT_DATA_UINT32, 0 }, 13974 { "outNoRoutes", KSTAT_DATA_UINT32, 0 }, 13975 { "reasmTimeout", KSTAT_DATA_UINT32, 0 }, 13976 { "reasmReqds", KSTAT_DATA_UINT32, 0 }, 13977 { "reasmOKs", KSTAT_DATA_UINT32, 0 }, 13978 { "reasmFails", KSTAT_DATA_UINT32, 0 }, 13979 { "fragOKs", KSTAT_DATA_UINT32, 0 }, 13980 { "fragFails", KSTAT_DATA_UINT32, 0 }, 13981 { "fragCreates", KSTAT_DATA_UINT32, 0 }, 13982 { "addrEntrySize", KSTAT_DATA_INT32, 0 }, 13983 { "routeEntrySize", KSTAT_DATA_INT32, 0 }, 13984 { "netToMediaEntrySize", KSTAT_DATA_INT32, 0 }, 13985 { "routingDiscards", KSTAT_DATA_UINT32, 0 }, 13986 { "inErrs", KSTAT_DATA_UINT32, 0 }, 13987 { "noPorts", KSTAT_DATA_UINT32, 0 }, 13988 { "inCksumErrs", KSTAT_DATA_UINT32, 0 }, 13989 { "reasmDuplicates", KSTAT_DATA_UINT32, 0 }, 13990 { "reasmPartDups", KSTAT_DATA_UINT32, 0 }, 13991 { "forwProhibits", KSTAT_DATA_UINT32, 0 }, 13992 { "udpInCksumErrs", KSTAT_DATA_UINT32, 0 }, 13993 { "udpInOverflows", KSTAT_DATA_UINT32, 0 }, 13994 { "rawipInOverflows", KSTAT_DATA_UINT32, 0 }, 13995 { "ipsecInSucceeded", KSTAT_DATA_UINT32, 0 }, 13996 { "ipsecInFailed", KSTAT_DATA_INT32, 0 }, 13997 { "memberEntrySize", KSTAT_DATA_INT32, 0 }, 13998 { "inIPv6", KSTAT_DATA_UINT32, 0 }, 13999 { "outIPv6", KSTAT_DATA_UINT32, 0 }, 14000 { "outSwitchIPv6", KSTAT_DATA_UINT32, 0 }, 14001 }; 14002 14003 ksp = kstat_create_netstack("ip", 0, "ip", "mib2", KSTAT_TYPE_NAMED, 14004 NUM_OF_FIELDS(ip_named_kstat_t), 0, stackid); 14005 if (ksp == NULL || ksp->ks_data == NULL) 14006 return (NULL); 14007 14008 template.forwarding.value.ui32 = WE_ARE_FORWARDING(ipst) ? 1:2; 14009 template.defaultTTL.value.ui32 = (uint32_t)ipst->ips_ip_def_ttl; 14010 template.reasmTimeout.value.ui32 = ipst->ips_ip_reassembly_timeout; 14011 template.addrEntrySize.value.i32 = sizeof (mib2_ipAddrEntry_t); 14012 template.routeEntrySize.value.i32 = sizeof (mib2_ipRouteEntry_t); 14013 14014 template.netToMediaEntrySize.value.i32 = 14015 sizeof (mib2_ipNetToMediaEntry_t); 14016 14017 template.memberEntrySize.value.i32 = sizeof (ipv6_member_t); 14018 14019 bcopy(&template, ksp->ks_data, sizeof (template)); 14020 ksp->ks_update = ip_kstat_update; 14021 ksp->ks_private = (void *)(uintptr_t)stackid; 14022 14023 kstat_install(ksp); 14024 return (ksp); 14025 } 14026 14027 static void 14028 ip_kstat_fini(netstackid_t stackid, kstat_t *ksp) 14029 { 14030 if (ksp != NULL) { 14031 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 14032 kstat_delete_netstack(ksp, stackid); 14033 } 14034 } 14035 14036 static int 14037 ip_kstat_update(kstat_t *kp, int rw) 14038 { 14039 ip_named_kstat_t *ipkp; 14040 mib2_ipIfStatsEntry_t ipmib; 14041 ill_walk_context_t ctx; 14042 ill_t *ill; 14043 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private; 14044 netstack_t *ns; 14045 ip_stack_t *ipst; 14046 14047 if (kp == NULL || kp->ks_data == NULL) 14048 return (EIO); 14049 14050 if (rw == KSTAT_WRITE) 14051 return (EACCES); 14052 14053 ns = netstack_find_by_stackid(stackid); 14054 if (ns == NULL) 14055 return (-1); 14056 ipst = ns->netstack_ip; 14057 if (ipst == NULL) { 14058 netstack_rele(ns); 14059 return (-1); 14060 } 14061 ipkp = (ip_named_kstat_t *)kp->ks_data; 14062 14063 bcopy(&ipst->ips_ip_mib, &ipmib, sizeof (ipmib)); 14064 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 14065 ill = ILL_START_WALK_V4(&ctx, ipst); 14066 for (; ill != NULL; ill = ill_next(&ctx, ill)) 14067 ip_mib2_add_ip_stats(&ipmib, ill->ill_ip_mib); 14068 rw_exit(&ipst->ips_ill_g_lock); 14069 14070 ipkp->forwarding.value.ui32 = ipmib.ipIfStatsForwarding; 14071 ipkp->defaultTTL.value.ui32 = ipmib.ipIfStatsDefaultTTL; 14072 ipkp->inReceives.value.ui64 = ipmib.ipIfStatsHCInReceives; 14073 ipkp->inHdrErrors.value.ui32 = ipmib.ipIfStatsInHdrErrors; 14074 ipkp->inAddrErrors.value.ui32 = ipmib.ipIfStatsInAddrErrors; 14075 ipkp->forwDatagrams.value.ui64 = ipmib.ipIfStatsHCOutForwDatagrams; 14076 ipkp->inUnknownProtos.value.ui32 = ipmib.ipIfStatsInUnknownProtos; 14077 ipkp->inDiscards.value.ui32 = ipmib.ipIfStatsInDiscards; 14078 ipkp->inDelivers.value.ui64 = ipmib.ipIfStatsHCInDelivers; 14079 ipkp->outRequests.value.ui64 = ipmib.ipIfStatsHCOutRequests; 14080 ipkp->outDiscards.value.ui32 = ipmib.ipIfStatsOutDiscards; 14081 ipkp->outNoRoutes.value.ui32 = ipmib.ipIfStatsOutNoRoutes; 14082 ipkp->reasmTimeout.value.ui32 = ipst->ips_ip_reassembly_timeout; 14083 ipkp->reasmReqds.value.ui32 = ipmib.ipIfStatsReasmReqds; 14084 ipkp->reasmOKs.value.ui32 = ipmib.ipIfStatsReasmOKs; 14085 ipkp->reasmFails.value.ui32 = ipmib.ipIfStatsReasmFails; 14086 ipkp->fragOKs.value.ui32 = ipmib.ipIfStatsOutFragOKs; 14087 ipkp->fragFails.value.ui32 = ipmib.ipIfStatsOutFragFails; 14088 ipkp->fragCreates.value.ui32 = ipmib.ipIfStatsOutFragCreates; 14089 14090 ipkp->routingDiscards.value.ui32 = 0; 14091 ipkp->inErrs.value.ui32 = ipmib.tcpIfStatsInErrs; 14092 ipkp->noPorts.value.ui32 = ipmib.udpIfStatsNoPorts; 14093 ipkp->inCksumErrs.value.ui32 = ipmib.ipIfStatsInCksumErrs; 14094 ipkp->reasmDuplicates.value.ui32 = ipmib.ipIfStatsReasmDuplicates; 14095 ipkp->reasmPartDups.value.ui32 = ipmib.ipIfStatsReasmPartDups; 14096 ipkp->forwProhibits.value.ui32 = ipmib.ipIfStatsForwProhibits; 14097 ipkp->udpInCksumErrs.value.ui32 = ipmib.udpIfStatsInCksumErrs; 14098 ipkp->udpInOverflows.value.ui32 = ipmib.udpIfStatsInOverflows; 14099 ipkp->rawipInOverflows.value.ui32 = ipmib.rawipIfStatsInOverflows; 14100 ipkp->ipsecInSucceeded.value.ui32 = ipmib.ipsecIfStatsInSucceeded; 14101 ipkp->ipsecInFailed.value.i32 = ipmib.ipsecIfStatsInFailed; 14102 14103 ipkp->inIPv6.value.ui32 = ipmib.ipIfStatsInWrongIPVersion; 14104 ipkp->outIPv6.value.ui32 = ipmib.ipIfStatsOutWrongIPVersion; 14105 ipkp->outSwitchIPv6.value.ui32 = ipmib.ipIfStatsOutSwitchIPVersion; 14106 14107 netstack_rele(ns); 14108 14109 return (0); 14110 } 14111 14112 static void * 14113 icmp_kstat_init(netstackid_t stackid) 14114 { 14115 kstat_t *ksp; 14116 14117 icmp_named_kstat_t template = { 14118 { "inMsgs", KSTAT_DATA_UINT32 }, 14119 { "inErrors", KSTAT_DATA_UINT32 }, 14120 { "inDestUnreachs", KSTAT_DATA_UINT32 }, 14121 { "inTimeExcds", KSTAT_DATA_UINT32 }, 14122 { "inParmProbs", KSTAT_DATA_UINT32 }, 14123 { "inSrcQuenchs", KSTAT_DATA_UINT32 }, 14124 { "inRedirects", KSTAT_DATA_UINT32 }, 14125 { "inEchos", KSTAT_DATA_UINT32 }, 14126 { "inEchoReps", KSTAT_DATA_UINT32 }, 14127 { "inTimestamps", KSTAT_DATA_UINT32 }, 14128 { "inTimestampReps", KSTAT_DATA_UINT32 }, 14129 { "inAddrMasks", KSTAT_DATA_UINT32 }, 14130 { "inAddrMaskReps", KSTAT_DATA_UINT32 }, 14131 { "outMsgs", KSTAT_DATA_UINT32 }, 14132 { "outErrors", KSTAT_DATA_UINT32 }, 14133 { "outDestUnreachs", KSTAT_DATA_UINT32 }, 14134 { "outTimeExcds", KSTAT_DATA_UINT32 }, 14135 { "outParmProbs", KSTAT_DATA_UINT32 }, 14136 { "outSrcQuenchs", KSTAT_DATA_UINT32 }, 14137 { "outRedirects", KSTAT_DATA_UINT32 }, 14138 { "outEchos", KSTAT_DATA_UINT32 }, 14139 { "outEchoReps", KSTAT_DATA_UINT32 }, 14140 { "outTimestamps", KSTAT_DATA_UINT32 }, 14141 { "outTimestampReps", KSTAT_DATA_UINT32 }, 14142 { "outAddrMasks", KSTAT_DATA_UINT32 }, 14143 { "outAddrMaskReps", KSTAT_DATA_UINT32 }, 14144 { "inChksumErrs", KSTAT_DATA_UINT32 }, 14145 { "inUnknowns", KSTAT_DATA_UINT32 }, 14146 { "inFragNeeded", KSTAT_DATA_UINT32 }, 14147 { "outFragNeeded", KSTAT_DATA_UINT32 }, 14148 { "outDrops", KSTAT_DATA_UINT32 }, 14149 { "inOverFlows", KSTAT_DATA_UINT32 }, 14150 { "inBadRedirects", KSTAT_DATA_UINT32 }, 14151 }; 14152 14153 ksp = kstat_create_netstack("ip", 0, "icmp", "mib2", KSTAT_TYPE_NAMED, 14154 NUM_OF_FIELDS(icmp_named_kstat_t), 0, stackid); 14155 if (ksp == NULL || ksp->ks_data == NULL) 14156 return (NULL); 14157 14158 bcopy(&template, ksp->ks_data, sizeof (template)); 14159 14160 ksp->ks_update = icmp_kstat_update; 14161 ksp->ks_private = (void *)(uintptr_t)stackid; 14162 14163 kstat_install(ksp); 14164 return (ksp); 14165 } 14166 14167 static void 14168 icmp_kstat_fini(netstackid_t stackid, kstat_t *ksp) 14169 { 14170 if (ksp != NULL) { 14171 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 14172 kstat_delete_netstack(ksp, stackid); 14173 } 14174 } 14175 14176 static int 14177 icmp_kstat_update(kstat_t *kp, int rw) 14178 { 14179 icmp_named_kstat_t *icmpkp; 14180 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private; 14181 netstack_t *ns; 14182 ip_stack_t *ipst; 14183 14184 if ((kp == NULL) || (kp->ks_data == NULL)) 14185 return (EIO); 14186 14187 if (rw == KSTAT_WRITE) 14188 return (EACCES); 14189 14190 ns = netstack_find_by_stackid(stackid); 14191 if (ns == NULL) 14192 return (-1); 14193 ipst = ns->netstack_ip; 14194 if (ipst == NULL) { 14195 netstack_rele(ns); 14196 return (-1); 14197 } 14198 icmpkp = (icmp_named_kstat_t *)kp->ks_data; 14199 14200 icmpkp->inMsgs.value.ui32 = ipst->ips_icmp_mib.icmpInMsgs; 14201 icmpkp->inErrors.value.ui32 = ipst->ips_icmp_mib.icmpInErrors; 14202 icmpkp->inDestUnreachs.value.ui32 = 14203 ipst->ips_icmp_mib.icmpInDestUnreachs; 14204 icmpkp->inTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpInTimeExcds; 14205 icmpkp->inParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpInParmProbs; 14206 icmpkp->inSrcQuenchs.value.ui32 = ipst->ips_icmp_mib.icmpInSrcQuenchs; 14207 icmpkp->inRedirects.value.ui32 = ipst->ips_icmp_mib.icmpInRedirects; 14208 icmpkp->inEchos.value.ui32 = ipst->ips_icmp_mib.icmpInEchos; 14209 icmpkp->inEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpInEchoReps; 14210 icmpkp->inTimestamps.value.ui32 = ipst->ips_icmp_mib.icmpInTimestamps; 14211 icmpkp->inTimestampReps.value.ui32 = 14212 ipst->ips_icmp_mib.icmpInTimestampReps; 14213 icmpkp->inAddrMasks.value.ui32 = ipst->ips_icmp_mib.icmpInAddrMasks; 14214 icmpkp->inAddrMaskReps.value.ui32 = 14215 ipst->ips_icmp_mib.icmpInAddrMaskReps; 14216 icmpkp->outMsgs.value.ui32 = ipst->ips_icmp_mib.icmpOutMsgs; 14217 icmpkp->outErrors.value.ui32 = ipst->ips_icmp_mib.icmpOutErrors; 14218 icmpkp->outDestUnreachs.value.ui32 = 14219 ipst->ips_icmp_mib.icmpOutDestUnreachs; 14220 icmpkp->outTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpOutTimeExcds; 14221 icmpkp->outParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpOutParmProbs; 14222 icmpkp->outSrcQuenchs.value.ui32 = 14223 ipst->ips_icmp_mib.icmpOutSrcQuenchs; 14224 icmpkp->outRedirects.value.ui32 = ipst->ips_icmp_mib.icmpOutRedirects; 14225 icmpkp->outEchos.value.ui32 = ipst->ips_icmp_mib.icmpOutEchos; 14226 icmpkp->outEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpOutEchoReps; 14227 icmpkp->outTimestamps.value.ui32 = 14228 ipst->ips_icmp_mib.icmpOutTimestamps; 14229 icmpkp->outTimestampReps.value.ui32 = 14230 ipst->ips_icmp_mib.icmpOutTimestampReps; 14231 icmpkp->outAddrMasks.value.ui32 = 14232 ipst->ips_icmp_mib.icmpOutAddrMasks; 14233 icmpkp->outAddrMaskReps.value.ui32 = 14234 ipst->ips_icmp_mib.icmpOutAddrMaskReps; 14235 icmpkp->inCksumErrs.value.ui32 = ipst->ips_icmp_mib.icmpInCksumErrs; 14236 icmpkp->inUnknowns.value.ui32 = ipst->ips_icmp_mib.icmpInUnknowns; 14237 icmpkp->inFragNeeded.value.ui32 = ipst->ips_icmp_mib.icmpInFragNeeded; 14238 icmpkp->outFragNeeded.value.ui32 = 14239 ipst->ips_icmp_mib.icmpOutFragNeeded; 14240 icmpkp->outDrops.value.ui32 = ipst->ips_icmp_mib.icmpOutDrops; 14241 icmpkp->inOverflows.value.ui32 = ipst->ips_icmp_mib.icmpInOverflows; 14242 icmpkp->inBadRedirects.value.ui32 = 14243 ipst->ips_icmp_mib.icmpInBadRedirects; 14244 14245 netstack_rele(ns); 14246 return (0); 14247 } 14248 14249 /* 14250 * This is the fanout function for raw socket opened for SCTP. Note 14251 * that it is called after SCTP checks that there is no socket which 14252 * wants a packet. Then before SCTP handles this out of the blue packet, 14253 * this function is called to see if there is any raw socket for SCTP. 14254 * If there is and it is bound to the correct address, the packet will 14255 * be sent to that socket. Note that only one raw socket can be bound to 14256 * a port. This is assured in ipcl_sctp_hash_insert(); 14257 */ 14258 void 14259 ip_fanout_sctp_raw(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, uint32_t ports, 14260 ip_recv_attr_t *ira) 14261 { 14262 conn_t *connp; 14263 queue_t *rq; 14264 boolean_t secure; 14265 ill_t *ill = ira->ira_ill; 14266 ip_stack_t *ipst = ill->ill_ipst; 14267 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 14268 sctp_stack_t *sctps = ipst->ips_netstack->netstack_sctp; 14269 iaflags_t iraflags = ira->ira_flags; 14270 ill_t *rill = ira->ira_rill; 14271 14272 secure = iraflags & IRAF_IPSEC_SECURE; 14273 14274 connp = ipcl_classify_raw(mp, IPPROTO_SCTP, ports, ipha, ip6h, 14275 ira, ipst); 14276 if (connp == NULL) { 14277 /* 14278 * Although raw sctp is not summed, OOB chunks must be. 14279 * Drop the packet here if the sctp checksum failed. 14280 */ 14281 if (iraflags & IRAF_SCTP_CSUM_ERR) { 14282 SCTPS_BUMP_MIB(sctps, sctpChecksumError); 14283 freemsg(mp); 14284 return; 14285 } 14286 ira->ira_ill = ira->ira_rill = NULL; 14287 sctp_ootb_input(mp, ira, ipst); 14288 ira->ira_ill = ill; 14289 ira->ira_rill = rill; 14290 return; 14291 } 14292 rq = connp->conn_rq; 14293 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : !canputnext(rq)) { 14294 CONN_DEC_REF(connp); 14295 BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows); 14296 freemsg(mp); 14297 return; 14298 } 14299 if (((iraflags & IRAF_IS_IPV4) ? 14300 CONN_INBOUND_POLICY_PRESENT(connp, ipss) : 14301 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) || 14302 secure) { 14303 mp = ipsec_check_inbound_policy(mp, connp, ipha, 14304 ip6h, ira); 14305 if (mp == NULL) { 14306 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14307 /* Note that mp is NULL */ 14308 ip_drop_input("ipIfStatsInDiscards", mp, ill); 14309 CONN_DEC_REF(connp); 14310 return; 14311 } 14312 } 14313 14314 if (iraflags & IRAF_ICMP_ERROR) { 14315 (connp->conn_recvicmp)(connp, mp, NULL, ira); 14316 } else { 14317 ill_t *rill = ira->ira_rill; 14318 14319 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 14320 /* This is the SOCK_RAW, IPPROTO_SCTP case. */ 14321 ira->ira_ill = ira->ira_rill = NULL; 14322 (connp->conn_recv)(connp, mp, NULL, ira); 14323 ira->ira_ill = ill; 14324 ira->ira_rill = rill; 14325 } 14326 CONN_DEC_REF(connp); 14327 } 14328 14329 /* 14330 * Free a packet that has the link-layer dl_unitdata_req_t or fast-path 14331 * header before the ip payload. 14332 */ 14333 static void 14334 ip_xmit_flowctl_drop(ill_t *ill, mblk_t *mp, boolean_t is_fp_mp, int fp_mp_len) 14335 { 14336 int len = (mp->b_wptr - mp->b_rptr); 14337 mblk_t *ip_mp; 14338 14339 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 14340 if (is_fp_mp || len != fp_mp_len) { 14341 if (len > fp_mp_len) { 14342 /* 14343 * fastpath header and ip header in the first mblk 14344 */ 14345 mp->b_rptr += fp_mp_len; 14346 } else { 14347 /* 14348 * ip_xmit_attach_llhdr had to prepend an mblk to 14349 * attach the fastpath header before ip header. 14350 */ 14351 ip_mp = mp->b_cont; 14352 freeb(mp); 14353 mp = ip_mp; 14354 mp->b_rptr += (fp_mp_len - len); 14355 } 14356 } else { 14357 ip_mp = mp->b_cont; 14358 freeb(mp); 14359 mp = ip_mp; 14360 } 14361 ip_drop_output("ipIfStatsOutDiscards - flow ctl", mp, ill); 14362 freemsg(mp); 14363 } 14364 14365 /* 14366 * Normal post fragmentation function. 14367 * 14368 * Send a packet using the passed in nce. This handles both IPv4 and IPv6 14369 * using the same state machine. 14370 * 14371 * We return an error on failure. In particular we return EWOULDBLOCK 14372 * when the driver flow controls. In that case this ensures that ip_wsrv runs 14373 * (currently by canputnext failure resulting in backenabling from GLD.) 14374 * This allows the callers of conn_ip_output() to use EWOULDBLOCK as an 14375 * indication that they can flow control until ip_wsrv() tells then to restart. 14376 * 14377 * If the nce passed by caller is incomplete, this function 14378 * queues the packet and if necessary, sends ARP request and bails. 14379 * If the Neighbor Cache passed is fully resolved, we simply prepend 14380 * the link-layer header to the packet, do ipsec hw acceleration 14381 * work if necessary, and send the packet out on the wire. 14382 */ 14383 /* ARGSUSED6 */ 14384 int 14385 ip_xmit(mblk_t *mp, nce_t *nce, iaflags_t ixaflags, uint_t pkt_len, 14386 uint32_t xmit_hint, zoneid_t szone, zoneid_t nolzid, uintptr_t *ixacookie) 14387 { 14388 queue_t *wq; 14389 ill_t *ill = nce->nce_ill; 14390 ip_stack_t *ipst = ill->ill_ipst; 14391 uint64_t delta; 14392 boolean_t isv6 = ill->ill_isv6; 14393 boolean_t fp_mp; 14394 ncec_t *ncec = nce->nce_common; 14395 int64_t now = LBOLT_FASTPATH64; 14396 boolean_t is_probe; 14397 14398 DTRACE_PROBE1(ip__xmit, nce_t *, nce); 14399 14400 ASSERT(mp != NULL); 14401 ASSERT(mp->b_datap->db_type == M_DATA); 14402 ASSERT(pkt_len == msgdsize(mp)); 14403 14404 /* 14405 * If we have already been here and are coming back after ARP/ND. 14406 * the IXAF_NO_TRACE flag is set. We skip FW_HOOKS, DTRACE and ipobs 14407 * in that case since they have seen the packet when it came here 14408 * the first time. 14409 */ 14410 if (ixaflags & IXAF_NO_TRACE) 14411 goto sendit; 14412 14413 if (ixaflags & IXAF_IS_IPV4) { 14414 ipha_t *ipha = (ipha_t *)mp->b_rptr; 14415 14416 ASSERT(!isv6); 14417 ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length)); 14418 if (HOOKS4_INTERESTED_PHYSICAL_OUT(ipst) && 14419 !(ixaflags & IXAF_NO_PFHOOK)) { 14420 int error; 14421 14422 FW_HOOKS(ipst->ips_ip4_physical_out_event, 14423 ipst->ips_ipv4firewall_physical_out, 14424 NULL, ill, ipha, mp, mp, 0, ipst, error); 14425 DTRACE_PROBE1(ip4__physical__out__end, 14426 mblk_t *, mp); 14427 if (mp == NULL) 14428 return (error); 14429 14430 /* The length could have changed */ 14431 pkt_len = msgdsize(mp); 14432 } 14433 if (ipst->ips_ip4_observe.he_interested) { 14434 /* 14435 * Note that for TX the zoneid is the sending 14436 * zone, whether or not MLP is in play. 14437 * Since the szone argument is the IP zoneid (i.e., 14438 * zero for exclusive-IP zones) and ipobs wants 14439 * the system zoneid, we map it here. 14440 */ 14441 szone = IP_REAL_ZONEID(szone, ipst); 14442 14443 /* 14444 * On the outbound path the destination zone will be 14445 * unknown as we're sending this packet out on the 14446 * wire. 14447 */ 14448 ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone, ALL_ZONES, 14449 ill, ipst); 14450 } 14451 DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL, 14452 void_ip_t *, ipha, __dtrace_ipsr_ill_t *, ill, 14453 ipha_t *, ipha, ip6_t *, NULL, int, 0); 14454 } else { 14455 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 14456 14457 ASSERT(isv6); 14458 ASSERT(pkt_len == 14459 ntohs(((ip6_t *)mp->b_rptr)->ip6_plen) + IPV6_HDR_LEN); 14460 if (HOOKS6_INTERESTED_PHYSICAL_OUT(ipst) && 14461 !(ixaflags & IXAF_NO_PFHOOK)) { 14462 int error; 14463 14464 FW_HOOKS6(ipst->ips_ip6_physical_out_event, 14465 ipst->ips_ipv6firewall_physical_out, 14466 NULL, ill, ip6h, mp, mp, 0, ipst, error); 14467 DTRACE_PROBE1(ip6__physical__out__end, 14468 mblk_t *, mp); 14469 if (mp == NULL) 14470 return (error); 14471 14472 /* The length could have changed */ 14473 pkt_len = msgdsize(mp); 14474 } 14475 if (ipst->ips_ip6_observe.he_interested) { 14476 /* See above */ 14477 szone = IP_REAL_ZONEID(szone, ipst); 14478 14479 ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone, ALL_ZONES, 14480 ill, ipst); 14481 } 14482 DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL, 14483 void_ip_t *, ip6h, __dtrace_ipsr_ill_t *, ill, 14484 ipha_t *, NULL, ip6_t *, ip6h, int, 0); 14485 } 14486 14487 sendit: 14488 /* 14489 * We check the state without a lock because the state can never 14490 * move "backwards" to initial or incomplete. 14491 */ 14492 switch (ncec->ncec_state) { 14493 case ND_REACHABLE: 14494 case ND_STALE: 14495 case ND_DELAY: 14496 case ND_PROBE: 14497 mp = ip_xmit_attach_llhdr(mp, nce); 14498 if (mp == NULL) { 14499 /* 14500 * ip_xmit_attach_llhdr has increased 14501 * ipIfStatsOutDiscards and called ip_drop_output() 14502 */ 14503 return (ENOBUFS); 14504 } 14505 /* 14506 * check if nce_fastpath completed and we tagged on a 14507 * copy of nce_fp_mp in ip_xmit_attach_llhdr(). 14508 */ 14509 fp_mp = (mp->b_datap->db_type == M_DATA); 14510 14511 if (fp_mp && 14512 (ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT)) { 14513 ill_dld_direct_t *idd; 14514 14515 idd = &ill->ill_dld_capab->idc_direct; 14516 /* 14517 * Send the packet directly to DLD, where it 14518 * may be queued depending on the availability 14519 * of transmit resources at the media layer. 14520 * Return value should be taken into 14521 * account and flow control the TCP. 14522 */ 14523 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits); 14524 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets, 14525 pkt_len); 14526 14527 if (ixaflags & IXAF_NO_DEV_FLOW_CTL) { 14528 (void) idd->idd_tx_df(idd->idd_tx_dh, mp, 14529 (uintptr_t)xmit_hint, IP_DROP_ON_NO_DESC); 14530 } else { 14531 uintptr_t cookie; 14532 14533 if ((cookie = idd->idd_tx_df(idd->idd_tx_dh, 14534 mp, (uintptr_t)xmit_hint, 0)) != 0) { 14535 if (ixacookie != NULL) 14536 *ixacookie = cookie; 14537 return (EWOULDBLOCK); 14538 } 14539 } 14540 } else { 14541 wq = ill->ill_wq; 14542 14543 if (!(ixaflags & IXAF_NO_DEV_FLOW_CTL) && 14544 !canputnext(wq)) { 14545 if (ixacookie != NULL) 14546 *ixacookie = 0; 14547 ip_xmit_flowctl_drop(ill, mp, fp_mp, 14548 nce->nce_fp_mp != NULL ? 14549 MBLKL(nce->nce_fp_mp) : 0); 14550 return (EWOULDBLOCK); 14551 } 14552 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits); 14553 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets, 14554 pkt_len); 14555 putnext(wq, mp); 14556 } 14557 14558 /* 14559 * The rest of this function implements Neighbor Unreachability 14560 * detection. Determine if the ncec is eligible for NUD. 14561 */ 14562 if (ncec->ncec_flags & NCE_F_NONUD) 14563 return (0); 14564 14565 ASSERT(ncec->ncec_state != ND_INCOMPLETE); 14566 14567 /* 14568 * Check for upper layer advice 14569 */ 14570 if (ixaflags & IXAF_REACH_CONF) { 14571 timeout_id_t tid; 14572 14573 /* 14574 * It should be o.k. to check the state without 14575 * a lock here, at most we lose an advice. 14576 */ 14577 ncec->ncec_last = TICK_TO_MSEC(now); 14578 if (ncec->ncec_state != ND_REACHABLE) { 14579 mutex_enter(&ncec->ncec_lock); 14580 ncec->ncec_state = ND_REACHABLE; 14581 tid = ncec->ncec_timeout_id; 14582 ncec->ncec_timeout_id = 0; 14583 mutex_exit(&ncec->ncec_lock); 14584 (void) untimeout(tid); 14585 if (ip_debug > 2) { 14586 /* ip1dbg */ 14587 pr_addr_dbg("ip_xmit: state" 14588 " for %s changed to" 14589 " REACHABLE\n", AF_INET6, 14590 &ncec->ncec_addr); 14591 } 14592 } 14593 return (0); 14594 } 14595 14596 delta = TICK_TO_MSEC(now) - ncec->ncec_last; 14597 ip1dbg(("ip_xmit: delta = %" PRId64 14598 " ill_reachable_time = %d \n", delta, 14599 ill->ill_reachable_time)); 14600 if (delta > (uint64_t)ill->ill_reachable_time) { 14601 mutex_enter(&ncec->ncec_lock); 14602 switch (ncec->ncec_state) { 14603 case ND_REACHABLE: 14604 ASSERT((ncec->ncec_flags & NCE_F_NONUD) == 0); 14605 /* FALLTHROUGH */ 14606 case ND_STALE: 14607 /* 14608 * ND_REACHABLE is identical to 14609 * ND_STALE in this specific case. If 14610 * reachable time has expired for this 14611 * neighbor (delta is greater than 14612 * reachable time), conceptually, the 14613 * neighbor cache is no longer in 14614 * REACHABLE state, but already in 14615 * STALE state. So the correct 14616 * transition here is to ND_DELAY. 14617 */ 14618 ncec->ncec_state = ND_DELAY; 14619 mutex_exit(&ncec->ncec_lock); 14620 nce_restart_timer(ncec, 14621 ipst->ips_delay_first_probe_time); 14622 if (ip_debug > 3) { 14623 /* ip2dbg */ 14624 pr_addr_dbg("ip_xmit: state" 14625 " for %s changed to" 14626 " DELAY\n", AF_INET6, 14627 &ncec->ncec_addr); 14628 } 14629 break; 14630 case ND_DELAY: 14631 case ND_PROBE: 14632 mutex_exit(&ncec->ncec_lock); 14633 /* Timers have already started */ 14634 break; 14635 case ND_UNREACHABLE: 14636 /* 14637 * nce_timer has detected that this ncec 14638 * is unreachable and initiated deleting 14639 * this ncec. 14640 * This is a harmless race where we found the 14641 * ncec before it was deleted and have 14642 * just sent out a packet using this 14643 * unreachable ncec. 14644 */ 14645 mutex_exit(&ncec->ncec_lock); 14646 break; 14647 default: 14648 ASSERT(0); 14649 mutex_exit(&ncec->ncec_lock); 14650 } 14651 } 14652 return (0); 14653 14654 case ND_INCOMPLETE: 14655 /* 14656 * the state could have changed since we didn't hold the lock. 14657 * Re-verify state under lock. 14658 */ 14659 is_probe = ipmp_packet_is_probe(mp, nce->nce_ill); 14660 mutex_enter(&ncec->ncec_lock); 14661 if (NCE_ISREACHABLE(ncec)) { 14662 mutex_exit(&ncec->ncec_lock); 14663 goto sendit; 14664 } 14665 /* queue the packet */ 14666 nce_queue_mp(ncec, mp, is_probe); 14667 mutex_exit(&ncec->ncec_lock); 14668 DTRACE_PROBE2(ip__xmit__incomplete, 14669 (ncec_t *), ncec, (mblk_t *), mp); 14670 return (0); 14671 14672 case ND_INITIAL: 14673 /* 14674 * State could have changed since we didn't hold the lock, so 14675 * re-verify state. 14676 */ 14677 is_probe = ipmp_packet_is_probe(mp, nce->nce_ill); 14678 mutex_enter(&ncec->ncec_lock); 14679 if (NCE_ISREACHABLE(ncec)) { 14680 mutex_exit(&ncec->ncec_lock); 14681 goto sendit; 14682 } 14683 nce_queue_mp(ncec, mp, is_probe); 14684 if (ncec->ncec_state == ND_INITIAL) { 14685 ncec->ncec_state = ND_INCOMPLETE; 14686 mutex_exit(&ncec->ncec_lock); 14687 /* 14688 * figure out the source we want to use 14689 * and resolve it. 14690 */ 14691 ip_ndp_resolve(ncec); 14692 } else { 14693 mutex_exit(&ncec->ncec_lock); 14694 } 14695 return (0); 14696 14697 case ND_UNREACHABLE: 14698 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 14699 ip_drop_output("ipIfStatsOutDiscards - ND_UNREACHABLE", 14700 mp, ill); 14701 freemsg(mp); 14702 return (0); 14703 14704 default: 14705 ASSERT(0); 14706 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 14707 ip_drop_output("ipIfStatsOutDiscards - ND_other", 14708 mp, ill); 14709 freemsg(mp); 14710 return (ENETUNREACH); 14711 } 14712 } 14713 14714 /* 14715 * Return B_TRUE if the buffers differ in length or content. 14716 * This is used for comparing extension header buffers. 14717 * Note that an extension header would be declared different 14718 * even if all that changed was the next header value in that header i.e. 14719 * what really changed is the next extension header. 14720 */ 14721 boolean_t 14722 ip_cmpbuf(const void *abuf, uint_t alen, boolean_t b_valid, const void *bbuf, 14723 uint_t blen) 14724 { 14725 if (!b_valid) 14726 blen = 0; 14727 14728 if (alen != blen) 14729 return (B_TRUE); 14730 if (alen == 0) 14731 return (B_FALSE); /* Both zero length */ 14732 return (bcmp(abuf, bbuf, alen)); 14733 } 14734 14735 /* 14736 * Preallocate memory for ip_savebuf(). Returns B_TRUE if ok. 14737 * Return B_FALSE if memory allocation fails - don't change any state! 14738 */ 14739 boolean_t 14740 ip_allocbuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 14741 const void *src, uint_t srclen) 14742 { 14743 void *dst; 14744 14745 if (!src_valid) 14746 srclen = 0; 14747 14748 ASSERT(*dstlenp == 0); 14749 if (src != NULL && srclen != 0) { 14750 dst = mi_alloc(srclen, BPRI_MED); 14751 if (dst == NULL) 14752 return (B_FALSE); 14753 } else { 14754 dst = NULL; 14755 } 14756 if (*dstp != NULL) 14757 mi_free(*dstp); 14758 *dstp = dst; 14759 *dstlenp = dst == NULL ? 0 : srclen; 14760 return (B_TRUE); 14761 } 14762 14763 /* 14764 * Replace what is in *dst, *dstlen with the source. 14765 * Assumes ip_allocbuf has already been called. 14766 */ 14767 void 14768 ip_savebuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 14769 const void *src, uint_t srclen) 14770 { 14771 if (!src_valid) 14772 srclen = 0; 14773 14774 ASSERT(*dstlenp == srclen); 14775 if (src != NULL && srclen != 0) 14776 bcopy(src, *dstp, srclen); 14777 } 14778 14779 /* 14780 * Free the storage pointed to by the members of an ip_pkt_t. 14781 */ 14782 void 14783 ip_pkt_free(ip_pkt_t *ipp) 14784 { 14785 uint_t fields = ipp->ipp_fields; 14786 14787 if (fields & IPPF_HOPOPTS) { 14788 kmem_free(ipp->ipp_hopopts, ipp->ipp_hopoptslen); 14789 ipp->ipp_hopopts = NULL; 14790 ipp->ipp_hopoptslen = 0; 14791 } 14792 if (fields & IPPF_RTHDRDSTOPTS) { 14793 kmem_free(ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen); 14794 ipp->ipp_rthdrdstopts = NULL; 14795 ipp->ipp_rthdrdstoptslen = 0; 14796 } 14797 if (fields & IPPF_DSTOPTS) { 14798 kmem_free(ipp->ipp_dstopts, ipp->ipp_dstoptslen); 14799 ipp->ipp_dstopts = NULL; 14800 ipp->ipp_dstoptslen = 0; 14801 } 14802 if (fields & IPPF_RTHDR) { 14803 kmem_free(ipp->ipp_rthdr, ipp->ipp_rthdrlen); 14804 ipp->ipp_rthdr = NULL; 14805 ipp->ipp_rthdrlen = 0; 14806 } 14807 if (fields & IPPF_IPV4_OPTIONS) { 14808 kmem_free(ipp->ipp_ipv4_options, ipp->ipp_ipv4_options_len); 14809 ipp->ipp_ipv4_options = NULL; 14810 ipp->ipp_ipv4_options_len = 0; 14811 } 14812 if (fields & IPPF_LABEL_V4) { 14813 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4); 14814 ipp->ipp_label_v4 = NULL; 14815 ipp->ipp_label_len_v4 = 0; 14816 } 14817 if (fields & IPPF_LABEL_V6) { 14818 kmem_free(ipp->ipp_label_v6, ipp->ipp_label_len_v6); 14819 ipp->ipp_label_v6 = NULL; 14820 ipp->ipp_label_len_v6 = 0; 14821 } 14822 ipp->ipp_fields &= ~(IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS | 14823 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6); 14824 } 14825 14826 /* 14827 * Copy from src to dst and allocate as needed. 14828 * Returns zero or ENOMEM. 14829 * 14830 * The caller must initialize dst to zero. 14831 */ 14832 int 14833 ip_pkt_copy(ip_pkt_t *src, ip_pkt_t *dst, int kmflag) 14834 { 14835 uint_t fields = src->ipp_fields; 14836 14837 /* Start with fields that don't require memory allocation */ 14838 dst->ipp_fields = fields & 14839 ~(IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS | 14840 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6); 14841 14842 dst->ipp_addr = src->ipp_addr; 14843 dst->ipp_unicast_hops = src->ipp_unicast_hops; 14844 dst->ipp_hoplimit = src->ipp_hoplimit; 14845 dst->ipp_tclass = src->ipp_tclass; 14846 dst->ipp_type_of_service = src->ipp_type_of_service; 14847 14848 if (!(fields & (IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS | 14849 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6))) 14850 return (0); 14851 14852 if (fields & IPPF_HOPOPTS) { 14853 dst->ipp_hopopts = kmem_alloc(src->ipp_hopoptslen, kmflag); 14854 if (dst->ipp_hopopts == NULL) { 14855 ip_pkt_free(dst); 14856 return (ENOMEM); 14857 } 14858 dst->ipp_fields |= IPPF_HOPOPTS; 14859 bcopy(src->ipp_hopopts, dst->ipp_hopopts, 14860 src->ipp_hopoptslen); 14861 dst->ipp_hopoptslen = src->ipp_hopoptslen; 14862 } 14863 if (fields & IPPF_RTHDRDSTOPTS) { 14864 dst->ipp_rthdrdstopts = kmem_alloc(src->ipp_rthdrdstoptslen, 14865 kmflag); 14866 if (dst->ipp_rthdrdstopts == NULL) { 14867 ip_pkt_free(dst); 14868 return (ENOMEM); 14869 } 14870 dst->ipp_fields |= IPPF_RTHDRDSTOPTS; 14871 bcopy(src->ipp_rthdrdstopts, dst->ipp_rthdrdstopts, 14872 src->ipp_rthdrdstoptslen); 14873 dst->ipp_rthdrdstoptslen = src->ipp_rthdrdstoptslen; 14874 } 14875 if (fields & IPPF_DSTOPTS) { 14876 dst->ipp_dstopts = kmem_alloc(src->ipp_dstoptslen, kmflag); 14877 if (dst->ipp_dstopts == NULL) { 14878 ip_pkt_free(dst); 14879 return (ENOMEM); 14880 } 14881 dst->ipp_fields |= IPPF_DSTOPTS; 14882 bcopy(src->ipp_dstopts, dst->ipp_dstopts, 14883 src->ipp_dstoptslen); 14884 dst->ipp_dstoptslen = src->ipp_dstoptslen; 14885 } 14886 if (fields & IPPF_RTHDR) { 14887 dst->ipp_rthdr = kmem_alloc(src->ipp_rthdrlen, kmflag); 14888 if (dst->ipp_rthdr == NULL) { 14889 ip_pkt_free(dst); 14890 return (ENOMEM); 14891 } 14892 dst->ipp_fields |= IPPF_RTHDR; 14893 bcopy(src->ipp_rthdr, dst->ipp_rthdr, 14894 src->ipp_rthdrlen); 14895 dst->ipp_rthdrlen = src->ipp_rthdrlen; 14896 } 14897 if (fields & IPPF_IPV4_OPTIONS) { 14898 dst->ipp_ipv4_options = kmem_alloc(src->ipp_ipv4_options_len, 14899 kmflag); 14900 if (dst->ipp_ipv4_options == NULL) { 14901 ip_pkt_free(dst); 14902 return (ENOMEM); 14903 } 14904 dst->ipp_fields |= IPPF_IPV4_OPTIONS; 14905 bcopy(src->ipp_ipv4_options, dst->ipp_ipv4_options, 14906 src->ipp_ipv4_options_len); 14907 dst->ipp_ipv4_options_len = src->ipp_ipv4_options_len; 14908 } 14909 if (fields & IPPF_LABEL_V4) { 14910 dst->ipp_label_v4 = kmem_alloc(src->ipp_label_len_v4, kmflag); 14911 if (dst->ipp_label_v4 == NULL) { 14912 ip_pkt_free(dst); 14913 return (ENOMEM); 14914 } 14915 dst->ipp_fields |= IPPF_LABEL_V4; 14916 bcopy(src->ipp_label_v4, dst->ipp_label_v4, 14917 src->ipp_label_len_v4); 14918 dst->ipp_label_len_v4 = src->ipp_label_len_v4; 14919 } 14920 if (fields & IPPF_LABEL_V6) { 14921 dst->ipp_label_v6 = kmem_alloc(src->ipp_label_len_v6, kmflag); 14922 if (dst->ipp_label_v6 == NULL) { 14923 ip_pkt_free(dst); 14924 return (ENOMEM); 14925 } 14926 dst->ipp_fields |= IPPF_LABEL_V6; 14927 bcopy(src->ipp_label_v6, dst->ipp_label_v6, 14928 src->ipp_label_len_v6); 14929 dst->ipp_label_len_v6 = src->ipp_label_len_v6; 14930 } 14931 if (fields & IPPF_FRAGHDR) { 14932 dst->ipp_fraghdr = kmem_alloc(src->ipp_fraghdrlen, kmflag); 14933 if (dst->ipp_fraghdr == NULL) { 14934 ip_pkt_free(dst); 14935 return (ENOMEM); 14936 } 14937 dst->ipp_fields |= IPPF_FRAGHDR; 14938 bcopy(src->ipp_fraghdr, dst->ipp_fraghdr, 14939 src->ipp_fraghdrlen); 14940 dst->ipp_fraghdrlen = src->ipp_fraghdrlen; 14941 } 14942 return (0); 14943 } 14944 14945 /* 14946 * Returns INADDR_ANY if no source route 14947 */ 14948 ipaddr_t 14949 ip_pkt_source_route_v4(const ip_pkt_t *ipp) 14950 { 14951 ipaddr_t nexthop = INADDR_ANY; 14952 ipoptp_t opts; 14953 uchar_t *opt; 14954 uint8_t optval; 14955 uint8_t optlen; 14956 uint32_t totallen; 14957 14958 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS)) 14959 return (INADDR_ANY); 14960 14961 totallen = ipp->ipp_ipv4_options_len; 14962 if (totallen & 0x3) 14963 return (INADDR_ANY); 14964 14965 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options); 14966 optval != IPOPT_EOL; 14967 optval = ipoptp_next(&opts)) { 14968 opt = opts.ipoptp_cur; 14969 switch (optval) { 14970 uint8_t off; 14971 case IPOPT_SSRR: 14972 case IPOPT_LSRR: 14973 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 14974 break; 14975 } 14976 optlen = opts.ipoptp_len; 14977 off = opt[IPOPT_OFFSET]; 14978 off--; 14979 if (optlen < IP_ADDR_LEN || 14980 off > optlen - IP_ADDR_LEN) { 14981 /* End of source route */ 14982 break; 14983 } 14984 bcopy((char *)opt + off, &nexthop, IP_ADDR_LEN); 14985 if (nexthop == htonl(INADDR_LOOPBACK)) { 14986 /* Ignore */ 14987 nexthop = INADDR_ANY; 14988 break; 14989 } 14990 break; 14991 } 14992 } 14993 return (nexthop); 14994 } 14995 14996 /* 14997 * Reverse a source route. 14998 */ 14999 void 15000 ip_pkt_source_route_reverse_v4(ip_pkt_t *ipp) 15001 { 15002 ipaddr_t tmp; 15003 ipoptp_t opts; 15004 uchar_t *opt; 15005 uint8_t optval; 15006 uint32_t totallen; 15007 15008 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS)) 15009 return; 15010 15011 totallen = ipp->ipp_ipv4_options_len; 15012 if (totallen & 0x3) 15013 return; 15014 15015 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options); 15016 optval != IPOPT_EOL; 15017 optval = ipoptp_next(&opts)) { 15018 uint8_t off1, off2; 15019 15020 opt = opts.ipoptp_cur; 15021 switch (optval) { 15022 case IPOPT_SSRR: 15023 case IPOPT_LSRR: 15024 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 15025 break; 15026 } 15027 off1 = IPOPT_MINOFF_SR - 1; 15028 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; 15029 while (off2 > off1) { 15030 bcopy(opt + off2, &tmp, IP_ADDR_LEN); 15031 bcopy(opt + off1, opt + off2, IP_ADDR_LEN); 15032 bcopy(&tmp, opt + off2, IP_ADDR_LEN); 15033 off2 -= IP_ADDR_LEN; 15034 off1 += IP_ADDR_LEN; 15035 } 15036 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR; 15037 break; 15038 } 15039 } 15040 } 15041 15042 /* 15043 * Returns NULL if no routing header 15044 */ 15045 in6_addr_t * 15046 ip_pkt_source_route_v6(const ip_pkt_t *ipp) 15047 { 15048 in6_addr_t *nexthop = NULL; 15049 ip6_rthdr0_t *rthdr; 15050 15051 if (!(ipp->ipp_fields & IPPF_RTHDR)) 15052 return (NULL); 15053 15054 rthdr = (ip6_rthdr0_t *)ipp->ipp_rthdr; 15055 if (rthdr->ip6r0_segleft == 0) 15056 return (NULL); 15057 15058 nexthop = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr)); 15059 return (nexthop); 15060 } 15061 15062 zoneid_t 15063 ip_get_zoneid_v4(ipaddr_t addr, mblk_t *mp, ip_recv_attr_t *ira, 15064 zoneid_t lookup_zoneid) 15065 { 15066 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 15067 ire_t *ire; 15068 int ire_flags = MATCH_IRE_TYPE; 15069 zoneid_t zoneid = ALL_ZONES; 15070 15071 if (is_system_labeled() && !tsol_can_accept_raw(mp, ira, B_FALSE)) 15072 return (ALL_ZONES); 15073 15074 if (lookup_zoneid != ALL_ZONES) 15075 ire_flags |= MATCH_IRE_ZONEONLY; 15076 ire = ire_ftable_lookup_v4(addr, NULL, NULL, IRE_LOCAL | IRE_LOOPBACK, 15077 NULL, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL); 15078 if (ire != NULL) { 15079 zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst); 15080 ire_refrele(ire); 15081 } 15082 return (zoneid); 15083 } 15084 15085 zoneid_t 15086 ip_get_zoneid_v6(in6_addr_t *addr, mblk_t *mp, const ill_t *ill, 15087 ip_recv_attr_t *ira, zoneid_t lookup_zoneid) 15088 { 15089 ip_stack_t *ipst = ira->ira_ill->ill_ipst; 15090 ire_t *ire; 15091 int ire_flags = MATCH_IRE_TYPE; 15092 zoneid_t zoneid = ALL_ZONES; 15093 15094 if (is_system_labeled() && !tsol_can_accept_raw(mp, ira, B_FALSE)) 15095 return (ALL_ZONES); 15096 15097 if (IN6_IS_ADDR_LINKLOCAL(addr)) 15098 ire_flags |= MATCH_IRE_ILL; 15099 15100 if (lookup_zoneid != ALL_ZONES) 15101 ire_flags |= MATCH_IRE_ZONEONLY; 15102 ire = ire_ftable_lookup_v6(addr, NULL, NULL, IRE_LOCAL | IRE_LOOPBACK, 15103 ill, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL); 15104 if (ire != NULL) { 15105 zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst); 15106 ire_refrele(ire); 15107 } 15108 return (zoneid); 15109 } 15110 15111 /* 15112 * IP obserability hook support functions. 15113 */ 15114 static void 15115 ipobs_init(ip_stack_t *ipst) 15116 { 15117 netid_t id; 15118 15119 id = net_getnetidbynetstackid(ipst->ips_netstack->netstack_stackid); 15120 15121 ipst->ips_ip4_observe_pr = net_protocol_lookup(id, NHF_INET); 15122 VERIFY(ipst->ips_ip4_observe_pr != NULL); 15123 15124 ipst->ips_ip6_observe_pr = net_protocol_lookup(id, NHF_INET6); 15125 VERIFY(ipst->ips_ip6_observe_pr != NULL); 15126 } 15127 15128 static void 15129 ipobs_fini(ip_stack_t *ipst) 15130 { 15131 15132 VERIFY(net_protocol_release(ipst->ips_ip4_observe_pr) == 0); 15133 VERIFY(net_protocol_release(ipst->ips_ip6_observe_pr) == 0); 15134 } 15135 15136 /* 15137 * hook_pkt_observe_t is composed in network byte order so that the 15138 * entire mblk_t chain handed into hook_run can be used as-is. 15139 * The caveat is that use of the fields, such as the zone fields, 15140 * requires conversion into host byte order first. 15141 */ 15142 void 15143 ipobs_hook(mblk_t *mp, int htype, zoneid_t zsrc, zoneid_t zdst, 15144 const ill_t *ill, ip_stack_t *ipst) 15145 { 15146 hook_pkt_observe_t *hdr; 15147 uint64_t grifindex; 15148 mblk_t *imp; 15149 15150 imp = allocb(sizeof (*hdr), BPRI_HI); 15151 if (imp == NULL) 15152 return; 15153 15154 hdr = (hook_pkt_observe_t *)imp->b_rptr; 15155 /* 15156 * b_wptr is set to make the apparent size of the data in the mblk_t 15157 * to exclude the pointers at the end of hook_pkt_observer_t. 15158 */ 15159 imp->b_wptr = imp->b_rptr + sizeof (dl_ipnetinfo_t); 15160 imp->b_cont = mp; 15161 15162 ASSERT(DB_TYPE(mp) == M_DATA); 15163 15164 if (IS_UNDER_IPMP(ill)) 15165 grifindex = ipmp_ill_get_ipmp_ifindex(ill); 15166 else 15167 grifindex = 0; 15168 15169 hdr->hpo_version = 1; 15170 hdr->hpo_htype = htons(htype); 15171 hdr->hpo_pktlen = htonl((ulong_t)msgdsize(mp)); 15172 hdr->hpo_ifindex = htonl(ill->ill_phyint->phyint_ifindex); 15173 hdr->hpo_grifindex = htonl(grifindex); 15174 hdr->hpo_zsrc = htonl(zsrc); 15175 hdr->hpo_zdst = htonl(zdst); 15176 hdr->hpo_pkt = imp; 15177 hdr->hpo_ctx = ipst->ips_netstack; 15178 15179 if (ill->ill_isv6) { 15180 hdr->hpo_family = AF_INET6; 15181 (void) hook_run(ipst->ips_ipv6_net_data->netd_hooks, 15182 ipst->ips_ipv6observing, (hook_data_t)hdr); 15183 } else { 15184 hdr->hpo_family = AF_INET; 15185 (void) hook_run(ipst->ips_ipv4_net_data->netd_hooks, 15186 ipst->ips_ipv4observing, (hook_data_t)hdr); 15187 } 15188 15189 imp->b_cont = NULL; 15190 freemsg(imp); 15191 } 15192 15193 /* 15194 * Utility routine that checks if `v4srcp' is a valid address on underlying 15195 * interface `ill'. If `ipifp' is non-NULL, it's set to a held ipif 15196 * associated with `v4srcp' on success. NOTE: if this is not called from 15197 * inside the IPSQ (ill_g_lock is not held), `ill' may be removed from the 15198 * group during or after this lookup. 15199 */ 15200 boolean_t 15201 ipif_lookup_testaddr_v4(ill_t *ill, const in_addr_t *v4srcp, ipif_t **ipifp) 15202 { 15203 ipif_t *ipif; 15204 15205 ipif = ipif_lookup_addr_exact(*v4srcp, ill, ill->ill_ipst); 15206 if (ipif != NULL) { 15207 if (ipifp != NULL) 15208 *ipifp = ipif; 15209 else 15210 ipif_refrele(ipif); 15211 return (B_TRUE); 15212 } 15213 15214 ip1dbg(("ipif_lookup_testaddr_v4: cannot find ipif for src %x\n", 15215 *v4srcp)); 15216 return (B_FALSE); 15217 } 15218 15219 /* 15220 * Transport protocol call back function for CPU state change. 15221 */ 15222 /* ARGSUSED */ 15223 static int 15224 ip_tp_cpu_update(cpu_setup_t what, int id, void *arg) 15225 { 15226 processorid_t cpu_seqid; 15227 netstack_handle_t nh; 15228 netstack_t *ns; 15229 15230 ASSERT(MUTEX_HELD(&cpu_lock)); 15231 15232 switch (what) { 15233 case CPU_CONFIG: 15234 case CPU_ON: 15235 case CPU_INIT: 15236 case CPU_CPUPART_IN: 15237 cpu_seqid = cpu[id]->cpu_seqid; 15238 netstack_next_init(&nh); 15239 while ((ns = netstack_next(&nh)) != NULL) { 15240 tcp_stack_cpu_add(ns->netstack_tcp, cpu_seqid); 15241 sctp_stack_cpu_add(ns->netstack_sctp, cpu_seqid); 15242 udp_stack_cpu_add(ns->netstack_udp, cpu_seqid); 15243 netstack_rele(ns); 15244 } 15245 netstack_next_fini(&nh); 15246 break; 15247 case CPU_UNCONFIG: 15248 case CPU_OFF: 15249 case CPU_CPUPART_OUT: 15250 /* 15251 * Nothing to do. We don't remove the per CPU stats from 15252 * the IP stack even when the CPU goes offline. 15253 */ 15254 break; 15255 default: 15256 break; 15257 } 15258 return (0); 15259 }