1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 1990 Mentat Inc.
25 * Copyright (c) 2017 OmniTI Computer Consulting, Inc. All rights reserved.
26 * Copyright (c) 2016 by Delphix. All rights reserved.
27 * Copyright (c) 2019 Joyent, Inc. All rights reserved.
28 */
29
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/dlpi.h>
33 #include <sys/stropts.h>
34 #include <sys/sysmacros.h>
35 #include <sys/strsubr.h>
36 #include <sys/strlog.h>
37 #include <sys/strsun.h>
38 #include <sys/zone.h>
39 #define _SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/xti_inet.h>
42 #include <sys/ddi.h>
43 #include <sys/suntpi.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/kobj.h>
47 #include <sys/modctl.h>
48 #include <sys/atomic.h>
49 #include <sys/policy.h>
50 #include <sys/priv.h>
51 #include <sys/taskq.h>
52
53 #include <sys/systm.h>
54 #include <sys/param.h>
55 #include <sys/kmem.h>
56 #include <sys/sdt.h>
57 #include <sys/socket.h>
58 #include <sys/vtrace.h>
59 #include <sys/isa_defs.h>
60 #include <sys/mac.h>
61 #include <net/if.h>
62 #include <net/if_arp.h>
63 #include <net/route.h>
64 #include <sys/sockio.h>
65 #include <netinet/in.h>
66 #include <net/if_dl.h>
67
68 #include <inet/common.h>
69 #include <inet/mi.h>
70 #include <inet/mib2.h>
71 #include <inet/nd.h>
72 #include <inet/arp.h>
73 #include <inet/snmpcom.h>
74 #include <inet/optcom.h>
75 #include <inet/kstatcom.h>
76
77 #include <netinet/igmp_var.h>
78 #include <netinet/ip6.h>
79 #include <netinet/icmp6.h>
80 #include <netinet/sctp.h>
81
82 #include <inet/ip.h>
83 #include <inet/ip_impl.h>
84 #include <inet/ip6.h>
85 #include <inet/ip6_asp.h>
86 #include <inet/tcp.h>
87 #include <inet/tcp_impl.h>
88 #include <inet/ip_multi.h>
89 #include <inet/ip_if.h>
90 #include <inet/ip_ire.h>
91 #include <inet/ip_ftable.h>
92 #include <inet/ip_rts.h>
93 #include <inet/ip_ndp.h>
94 #include <inet/ip_listutils.h>
95 #include <netinet/igmp.h>
96 #include <netinet/ip_mroute.h>
97 #include <inet/ipp_common.h>
98 #include <inet/cc.h>
99
100 #include <net/pfkeyv2.h>
101 #include <inet/sadb.h>
102 #include <inet/ipsec_impl.h>
103 #include <inet/iptun/iptun_impl.h>
104 #include <inet/ipdrop.h>
105 #include <inet/ip_netinfo.h>
106 #include <inet/ilb_ip.h>
107
108 #include <sys/ethernet.h>
109 #include <net/if_types.h>
110 #include <sys/cpuvar.h>
111
112 #include <ipp/ipp.h>
113 #include <ipp/ipp_impl.h>
114 #include <ipp/ipgpc/ipgpc.h>
115
116 #include <sys/pattr.h>
117 #include <inet/ipclassifier.h>
118 #include <inet/sctp_ip.h>
119 #include <inet/sctp/sctp_impl.h>
120 #include <inet/udp_impl.h>
121 #include <inet/rawip_impl.h>
122 #include <inet/rts_impl.h>
123
124 #include <sys/tsol/label.h>
125 #include <sys/tsol/tnet.h>
126
127 #include <sys/squeue_impl.h>
128 #include <inet/ip_arp.h>
129
130 #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */
131
132 /*
133 * Values for squeue switch:
134 * IP_SQUEUE_ENTER_NODRAIN: SQ_NODRAIN
135 * IP_SQUEUE_ENTER: SQ_PROCESS
136 * IP_SQUEUE_FILL: SQ_FILL
137 */
138 int ip_squeue_enter = IP_SQUEUE_ENTER; /* Setable in /etc/system */
139
140 int ip_squeue_flag;
141
142 /*
143 * Setable in /etc/system
144 */
145 int ip_poll_normal_ms = 100;
146 int ip_poll_normal_ticks = 0;
147 int ip_modclose_ackwait_ms = 3000;
148
149 /*
150 * It would be nice to have these present only in DEBUG systems, but the
151 * current design of the global symbol checking logic requires them to be
152 * unconditionally present.
153 */
154 uint_t ip_thread_data; /* TSD key for debug support */
155 krwlock_t ip_thread_rwlock;
156 list_t ip_thread_list;
157
158 /*
159 * Structure to represent a linked list of msgblks. Used by ip_snmp_ functions.
160 */
161
162 struct listptr_s {
163 mblk_t *lp_head; /* pointer to the head of the list */
164 mblk_t *lp_tail; /* pointer to the tail of the list */
165 };
166
167 typedef struct listptr_s listptr_t;
168
169 /*
170 * This is used by ip_snmp_get_mib2_ip_route_media and
171 * ip_snmp_get_mib2_ip6_route_media to carry the lists of return data.
172 */
173 typedef struct iproutedata_s {
174 uint_t ird_idx;
175 uint_t ird_flags; /* see below */
176 listptr_t ird_route; /* ipRouteEntryTable */
177 listptr_t ird_netmedia; /* ipNetToMediaEntryTable */
178 listptr_t ird_attrs; /* ipRouteAttributeTable */
179 } iproutedata_t;
180
181 /* Include ire_testhidden and IRE_IF_CLONE routes */
182 #define IRD_REPORT_ALL 0x01
183
184 /*
185 * Cluster specific hooks. These should be NULL when booted as a non-cluster
186 */
187
188 /*
189 * Hook functions to enable cluster networking
190 * On non-clustered systems these vectors must always be NULL.
191 *
192 * Hook function to Check ip specified ip address is a shared ip address
193 * in the cluster
194 *
195 */
196 int (*cl_inet_isclusterwide)(netstackid_t stack_id, uint8_t protocol,
197 sa_family_t addr_family, uint8_t *laddrp, void *args) = NULL;
198
199 /*
200 * Hook function to generate cluster wide ip fragment identifier
201 */
202 uint32_t (*cl_inet_ipident)(netstackid_t stack_id, uint8_t protocol,
203 sa_family_t addr_family, uint8_t *laddrp, uint8_t *faddrp,
204 void *args) = NULL;
205
206 /*
207 * Hook function to generate cluster wide SPI.
208 */
209 void (*cl_inet_getspi)(netstackid_t, uint8_t, uint8_t *, size_t,
210 void *) = NULL;
211
212 /*
213 * Hook function to verify if the SPI is already utlized.
214 */
215
216 int (*cl_inet_checkspi)(netstackid_t, uint8_t, uint32_t, void *) = NULL;
217
218 /*
219 * Hook function to delete the SPI from the cluster wide repository.
220 */
221
222 void (*cl_inet_deletespi)(netstackid_t, uint8_t, uint32_t, void *) = NULL;
223
224 /*
225 * Hook function to inform the cluster when packet received on an IDLE SA
226 */
227
228 void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, sa_family_t,
229 in6_addr_t, in6_addr_t, void *) = NULL;
230
231 /*
232 * Synchronization notes:
233 *
234 * IP is a fully D_MP STREAMS module/driver. Thus it does not depend on any
235 * MT level protection given by STREAMS. IP uses a combination of its own
236 * internal serialization mechanism and standard Solaris locking techniques.
237 * The internal serialization is per phyint. This is used to serialize
238 * plumbing operations, IPMP operations, most set ioctls, etc.
239 *
240 * Plumbing is a long sequence of operations involving message
241 * exchanges between IP, ARP and device drivers. Many set ioctls are typically
242 * involved in plumbing operations. A natural model is to serialize these
243 * ioctls one per ill. For example plumbing of hme0 and qfe0 can go on in
244 * parallel without any interference. But various set ioctls on hme0 are best
245 * serialized, along with IPMP operations and processing of DLPI control
246 * messages received from drivers on a per phyint basis. This serialization is
247 * provided by the ipsq_t and primitives operating on this. Details can
248 * be found in ip_if.c above the core primitives operating on ipsq_t.
249 *
250 * Lookups of an ipif or ill by a thread return a refheld ipif / ill.
251 * Simiarly lookup of an ire by a thread also returns a refheld ire.
252 * In addition ipif's and ill's referenced by the ire are also indirectly
253 * refheld. Thus no ipif or ill can vanish as long as an ipif is refheld
254 * directly or indirectly. For example an SIOCSLIFADDR ioctl that changes the
255 * address of an ipif has to go through the ipsq_t. This ensures that only
256 * one such exclusive operation proceeds at any time on the ipif. It then
257 * waits for all refcnts
258 * associated with this ipif to come down to zero. The address is changed
259 * only after the ipif has been quiesced. Then the ipif is brought up again.
260 * More details are described above the comment in ip_sioctl_flags.
261 *
262 * Packet processing is based mostly on IREs and are fully multi-threaded
263 * using standard Solaris MT techniques.
264 *
265 * There are explicit locks in IP to handle:
266 * - The ip_g_head list maintained by mi_open_link() and friends.
267 *
268 * - The reassembly data structures (one lock per hash bucket)
269 *
270 * - conn_lock is meant to protect conn_t fields. The fields actually
271 * protected by conn_lock are documented in the conn_t definition.
272 *
273 * - ire_lock to protect some of the fields of the ire, IRE tables
274 * (one lock per hash bucket). Refer to ip_ire.c for details.
275 *
276 * - ndp_g_lock and ncec_lock for protecting NCEs.
277 *
278 * - ill_lock protects fields of the ill and ipif. Details in ip.h
279 *
280 * - ill_g_lock: This is a global reader/writer lock. Protects the following
281 * * The AVL tree based global multi list of all ills.
282 * * The linked list of all ipifs of an ill
283 * * The <ipsq-xop> mapping
284 * * <ill-phyint> association
285 * Insertion/deletion of an ill in the system, insertion/deletion of an ipif
286 * into an ill, changing the <ipsq-xop> mapping of an ill, changing the
287 * <ill-phyint> assoc of an ill will all have to hold the ill_g_lock as
288 * writer for the actual duration of the insertion/deletion/change.
289 *
290 * - ill_lock: This is a per ill mutex.
291 * It protects some members of the ill_t struct; see ip.h for details.
292 * It also protects the <ill-phyint> assoc.
293 * It also protects the list of ipifs hanging off the ill.
294 *
295 * - ipsq_lock: This is a per ipsq_t mutex lock.
296 * This protects some members of the ipsq_t struct; see ip.h for details.
297 * It also protects the <ipsq-ipxop> mapping
298 *
299 * - ipx_lock: This is a per ipxop_t mutex lock.
300 * This protects some members of the ipxop_t struct; see ip.h for details.
301 *
302 * - phyint_lock: This is a per phyint mutex lock. Protects just the
303 * phyint_flags
304 *
305 * - ip_addr_avail_lock: This is used to ensure the uniqueness of IP addresses.
306 * This lock is held in ipif_up_done and the ipif is marked IPIF_UP and the
307 * uniqueness check also done atomically.
308 *
309 * - ill_g_usesrc_lock: This readers/writer lock protects the usesrc
310 * group list linked by ill_usesrc_grp_next. It also protects the
311 * ill_usesrc_ifindex field. It is taken as a writer when a member of the
312 * group is being added or deleted. This lock is taken as a reader when
313 * walking the list/group(eg: to get the number of members in a usesrc group).
314 * Note, it is only necessary to take this lock if the ill_usesrc_grp_next
315 * field is changing state i.e from NULL to non-NULL or vice-versa. For
316 * example, it is not necessary to take this lock in the initial portion
317 * of ip_sioctl_slifusesrc or at all in ip_sioctl_flags since these
318 * operations are executed exclusively and that ensures that the "usesrc
319 * group state" cannot change. The "usesrc group state" change can happen
320 * only in the latter part of ip_sioctl_slifusesrc and in ill_delete.
321 *
322 * Changing <ill-phyint>, <ipsq-xop> assocications:
323 *
324 * To change the <ill-phyint> association, the ill_g_lock must be held
325 * as writer, and the ill_locks of both the v4 and v6 instance of the ill
326 * must be held.
327 *
328 * To change the <ipsq-xop> association, the ill_g_lock must be held as
329 * writer, the ipsq_lock must be held, and one must be writer on the ipsq.
330 * This is only done when ills are added or removed from IPMP groups.
331 *
332 * To add or delete an ipif from the list of ipifs hanging off the ill,
333 * ill_g_lock (writer) and ill_lock must be held and the thread must be
334 * a writer on the associated ipsq.
335 *
336 * To add or delete an ill to the system, the ill_g_lock must be held as
337 * writer and the thread must be a writer on the associated ipsq.
338 *
339 * To add or delete an ilm to an ill, the ill_lock must be held and the thread
340 * must be a writer on the associated ipsq.
341 *
342 * Lock hierarchy
343 *
344 * Some lock hierarchy scenarios are listed below.
345 *
346 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock
347 * ill_g_lock -> ill_lock(s) -> phyint_lock
348 * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock
349 * ill_g_lock -> ip_addr_avail_lock
350 * conn_lock -> irb_lock -> ill_lock -> ire_lock
351 * ill_g_lock -> ip_g_nd_lock
352 * ill_g_lock -> ips_ipmp_lock -> ill_lock -> nce_lock
353 * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock -> nce_lock
354 * arl_lock -> ill_lock
355 * ips_ire_dep_lock -> irb_lock
356 *
357 * When more than 1 ill lock is needed to be held, all ill lock addresses
358 * are sorted on address and locked starting from highest addressed lock
359 * downward.
360 *
361 * Multicast scenarios
362 * ips_ill_g_lock -> ill_mcast_lock
363 * conn_ilg_lock -> ips_ill_g_lock -> ill_lock
364 * ill_mcast_serializer -> ill_mcast_lock -> ips_ipmp_lock -> ill_lock
365 * ill_mcast_serializer -> ill_mcast_lock -> connf_lock -> conn_lock
366 * ill_mcast_serializer -> ill_mcast_lock -> conn_ilg_lock
367 * ill_mcast_serializer -> ill_mcast_lock -> ips_igmp_timer_lock
368 *
369 * IPsec scenarios
370 *
371 * ipsa_lock -> ill_g_lock -> ill_lock
372 * ill_g_usesrc_lock -> ill_g_lock -> ill_lock
373 *
374 * Trusted Solaris scenarios
375 *
376 * igsa_lock -> gcgrp_rwlock -> gcgrp_lock
377 * igsa_lock -> gcdb_lock
378 * gcgrp_rwlock -> ire_lock
379 * gcgrp_rwlock -> gcdb_lock
380 *
381 * squeue(sq_lock), flow related (ft_lock, fe_lock) locking
382 *
383 * cpu_lock --> ill_lock --> sqset_lock --> sq_lock
384 * sq_lock -> conn_lock -> QLOCK(q)
385 * ill_lock -> ft_lock -> fe_lock
386 *
387 * Routing/forwarding table locking notes:
388 *
389 * Lock acquisition order: Radix tree lock, irb_lock.
390 * Requirements:
391 * i. Walker must not hold any locks during the walker callback.
392 * ii Walker must not see a truncated tree during the walk because of any node
393 * deletion.
394 * iii Existing code assumes ire_bucket is valid if it is non-null and is used
395 * in many places in the code to walk the irb list. Thus even if all the
396 * ires in a bucket have been deleted, we still can't free the radix node
397 * until the ires have actually been inactive'd (freed).
398 *
399 * Tree traversal - Need to hold the global tree lock in read mode.
400 * Before dropping the global tree lock, need to either increment the ire_refcnt
401 * to ensure that the radix node can't be deleted.
402 *
403 * Tree add - Need to hold the global tree lock in write mode to add a
404 * radix node. To prevent the node from being deleted, increment the
405 * irb_refcnt, after the node is added to the tree. The ire itself is
406 * added later while holding the irb_lock, but not the tree lock.
407 *
408 * Tree delete - Need to hold the global tree lock and irb_lock in write mode.
409 * All associated ires must be inactive (i.e. freed), and irb_refcnt
410 * must be zero.
411 *
412 * Walker - Increment irb_refcnt before calling the walker callback. Hold the
413 * global tree lock (read mode) for traversal.
414 *
415 * IRE dependencies - In some cases we hold ips_ire_dep_lock across ire_refrele
416 * hence we will acquire irb_lock while holding ips_ire_dep_lock.
417 *
418 * IPsec notes :
419 *
420 * IP interacts with the IPsec code (AH/ESP) by storing IPsec attributes
421 * in the ip_xmit_attr_t ip_recv_attr_t. For outbound datagrams, the
422 * ip_xmit_attr_t has the
423 * information used by the IPsec code for applying the right level of
424 * protection. The information initialized by IP in the ip_xmit_attr_t
425 * is determined by the per-socket policy or global policy in the system.
426 * For inbound datagrams, the ip_recv_attr_t
427 * starts out with nothing in it. It gets filled
428 * with the right information if it goes through the AH/ESP code, which
429 * happens if the incoming packet is secure. The information initialized
430 * by AH/ESP, is later used by IP (during fanouts to ULP) to see whether
431 * the policy requirements needed by per-socket policy or global policy
432 * is met or not.
433 *
434 * For fully connected sockets i.e dst, src [addr, port] is known,
435 * conn_policy_cached is set indicating that policy has been cached.
436 * conn_in_enforce_policy may or may not be set depending on whether
437 * there is a global policy match or per-socket policy match.
438 * Policy inheriting happpens in ip_policy_set once the destination is known.
439 * Once the right policy is set on the conn_t, policy cannot change for
440 * this socket. This makes life simpler for TCP (UDP ?) where
441 * re-transmissions go out with the same policy. For symmetry, policy
442 * is cached for fully connected UDP sockets also. Thus if policy is cached,
443 * it also implies that policy is latched i.e policy cannot change
444 * on these sockets. As we have the right policy on the conn, we don't
445 * have to lookup global policy for every outbound and inbound datagram
446 * and thus serving as an optimization. Note that a global policy change
447 * does not affect fully connected sockets if they have policy. If fully
448 * connected sockets did not have any policy associated with it, global
449 * policy change may affect them.
450 *
451 * IP Flow control notes:
452 * ---------------------
453 * Non-TCP streams are flow controlled by IP. The way this is accomplished
454 * differs when ILL_CAPAB_DLD_DIRECT is enabled for that IP instance. When
455 * ILL_DIRECT_CAPABLE(ill) is TRUE, IP can do direct function calls into
456 * GLDv3. Otherwise packets are sent down to lower layers using STREAMS
457 * functions.
458 *
459 * Per Tx ring udp flow control:
460 * This is applicable only when ILL_CAPAB_DLD_DIRECT capability is set in
461 * the ill (i.e. ILL_DIRECT_CAPABLE(ill) is true).
462 *
463 * The underlying link can expose multiple Tx rings to the GLDv3 mac layer.
464 * To achieve best performance, outgoing traffic need to be fanned out among
465 * these Tx ring. mac_tx() is called (via str_mdata_fastpath_put()) to send
466 * traffic out of the NIC and it takes a fanout hint. UDP connections pass
467 * the address of connp as fanout hint to mac_tx(). Under flow controlled
468 * condition, mac_tx() returns a non-NULL cookie (ip_mac_tx_cookie_t). This
469 * cookie points to a specific Tx ring that is blocked. The cookie is used to
470 * hash into an idl_tx_list[] entry in idl_tx_list[] array. Each idl_tx_list_t
471 * point to drain_lists (idl_t's). These drain list will store the blocked UDP
472 * connp's. The drain list is not a single list but a configurable number of
473 * lists.
474 *
475 * The diagram below shows idl_tx_list_t's and their drain_lists. ip_stack_t
476 * has an array of idl_tx_list_t. The size of the array is TX_FANOUT_SIZE
477 * which is equal to 128. This array in turn contains a pointer to idl_t[],
478 * the ip drain list. The idl_t[] array size is MIN(max_ncpus, 8). The drain
479 * list will point to the list of connp's that are flow controlled.
480 *
481 * --------------- ------- ------- -------
482 * |->|drain_list[0]|-->|connp|-->|connp|-->|connp|-->
483 * | --------------- ------- ------- -------
484 * | --------------- ------- ------- -------
485 * |->|drain_list[1]|-->|connp|-->|connp|-->|connp|-->
486 * ---------------- | --------------- ------- ------- -------
487 * |idl_tx_list[0]|->| --------------- ------- ------- -------
488 * ---------------- |->|drain_list[2]|-->|connp|-->|connp|-->|connp|-->
489 * | --------------- ------- ------- -------
490 * . . . . .
491 * | --------------- ------- ------- -------
492 * |->|drain_list[n]|-->|connp|-->|connp|-->|connp|-->
493 * --------------- ------- ------- -------
494 * --------------- ------- ------- -------
495 * |->|drain_list[0]|-->|connp|-->|connp|-->|connp|-->
496 * | --------------- ------- ------- -------
497 * | --------------- ------- ------- -------
498 * ---------------- |->|drain_list[1]|-->|connp|-->|connp|-->|connp|-->
499 * |idl_tx_list[1]|->| --------------- ------- ------- -------
500 * ---------------- | . . . .
501 * | --------------- ------- ------- -------
502 * |->|drain_list[n]|-->|connp|-->|connp|-->|connp|-->
503 * --------------- ------- ------- -------
504 * .....
505 * ----------------
506 * |idl_tx_list[n]|-> ...
507 * ----------------
508 *
509 * When mac_tx() returns a cookie, the cookie is hashed into an index into
510 * ips_idl_tx_list[], and conn_drain_insert() is called with the idl_tx_list
511 * to insert the conn onto. conn_drain_insert() asserts flow control for the
512 * sockets via su_txq_full() (non-STREAMS) or QFULL on conn_wq (STREAMS).
513 * Further, conn_blocked is set to indicate that the conn is blocked.
514 *
515 * GLDv3 calls ill_flow_enable() when flow control is relieved. The cookie
516 * passed in the call to ill_flow_enable() identifies the blocked Tx ring and
517 * is again hashed to locate the appropriate idl_tx_list, which is then
518 * drained via conn_walk_drain(). conn_walk_drain() goes through each conn in
519 * the drain list and calls conn_drain_remove() to clear flow control (via
520 * calling su_txq_full() or clearing QFULL), and remove the conn from the
521 * drain list.
522 *
523 * Note that the drain list is not a single list but a (configurable) array of
524 * lists (8 elements by default). Synchronization between drain insertion and
525 * flow control wakeup is handled by using idl_txl->txl_lock, and only
526 * conn_drain_insert() and conn_drain_remove() manipulate the drain list.
527 *
528 * Flow control via STREAMS is used when ILL_DIRECT_CAPABLE() returns FALSE.
529 * On the send side, if the packet cannot be sent down to the driver by IP
530 * (canput() fails), ip_xmit() drops the packet and returns EWOULDBLOCK to the
531 * caller, who may then invoke ixa_check_drain_insert() to insert the conn on
532 * the 0'th drain list. When ip_wsrv() runs on the ill_wq because flow
533 * control has been relieved, the blocked conns in the 0'th drain list are
534 * drained as in the non-STREAMS case.
535 *
536 * In both the STREAMS and non-STREAMS cases, the sockfs upcall to set QFULL
537 * is done when the conn is inserted into the drain list (conn_drain_insert())
538 * and cleared when the conn is removed from the it (conn_drain_remove()).
539 *
540 * IPQOS notes:
541 *
542 * IPQoS Policies are applied to packets using IPPF (IP Policy framework)
543 * and IPQoS modules. IPPF includes hooks in IP at different control points
544 * (callout positions) which direct packets to IPQoS modules for policy
545 * processing. Policies, if present, are global.
546 *
547 * The callout positions are located in the following paths:
548 * o local_in (packets destined for this host)
549 * o local_out (packets orginating from this host )
550 * o fwd_in (packets forwarded by this m/c - inbound)
551 * o fwd_out (packets forwarded by this m/c - outbound)
552 * Hooks at these callout points can be enabled/disabled using the ndd variable
553 * ip_policy_mask (a bit mask with the 4 LSB indicating the callout positions).
554 * By default all the callout positions are enabled.
555 *
556 * Outbound (local_out)
557 * Hooks are placed in ire_send_wire_v4 and ire_send_wire_v6.
558 *
559 * Inbound (local_in)
560 * Hooks are placed in ip_fanout_v4 and ip_fanout_v6.
561 *
562 * Forwarding (in and out)
563 * Hooks are placed in ire_recv_forward_v4/v6.
564 *
565 * IP Policy Framework processing (IPPF processing)
566 * Policy processing for a packet is initiated by ip_process, which ascertains
567 * that the classifier (ipgpc) is loaded and configured, failing which the
568 * packet resumes normal processing in IP. If the clasifier is present, the
569 * packet is acted upon by one or more IPQoS modules (action instances), per
570 * filters configured in ipgpc and resumes normal IP processing thereafter.
571 * An action instance can drop a packet in course of its processing.
572 *
573 * Zones notes:
574 *
575 * The partitioning rules for networking are as follows:
576 * 1) Packets coming from a zone must have a source address belonging to that
577 * zone.
578 * 2) Packets coming from a zone can only be sent on a physical interface on
579 * which the zone has an IP address.
580 * 3) Between two zones on the same machine, packet delivery is only allowed if
581 * there's a matching route for the destination and zone in the forwarding
582 * table.
583 * 4) The TCP and UDP port spaces are per-zone; that is, two processes in
584 * different zones can bind to the same port with the wildcard address
585 * (INADDR_ANY).
586 *
587 * The granularity of interface partitioning is at the logical interface level.
588 * Therefore, every zone has its own IP addresses, and incoming packets can be
589 * attributed to a zone unambiguously. A logical interface is placed into a zone
590 * using the SIOCSLIFZONE ioctl; this sets the ipif_zoneid field in the ipif_t
591 * structure. Rule (1) is implemented by modifying the source address selection
592 * algorithm so that the list of eligible addresses is filtered based on the
593 * sending process zone.
594 *
595 * The Internet Routing Entries (IREs) are either exclusive to a zone or shared
596 * across all zones, depending on their type. Here is the break-up:
597 *
598 * IRE type Shared/exclusive
599 * -------- ----------------
600 * IRE_BROADCAST Exclusive
601 * IRE_DEFAULT (default routes) Shared (*)
602 * IRE_LOCAL Exclusive (x)
603 * IRE_LOOPBACK Exclusive
604 * IRE_PREFIX (net routes) Shared (*)
605 * IRE_IF_NORESOLVER (interface routes) Exclusive
606 * IRE_IF_RESOLVER (interface routes) Exclusive
607 * IRE_IF_CLONE (interface routes) Exclusive
608 * IRE_HOST (host routes) Shared (*)
609 *
610 * (*) A zone can only use a default or off-subnet route if the gateway is
611 * directly reachable from the zone, that is, if the gateway's address matches
612 * one of the zone's logical interfaces.
613 *
614 * (x) IRE_LOCAL are handled a bit differently.
615 * When ip_restrict_interzone_loopback is set (the default),
616 * ire_route_recursive restricts loopback using an IRE_LOCAL
617 * between zone to the case when L2 would have conceptually looped the packet
618 * back, i.e. the loopback which is required since neither Ethernet drivers
619 * nor Ethernet hardware loops them back. This is the case when the normal
620 * routes (ignoring IREs with different zoneids) would send out the packet on
621 * the same ill as the ill with which is IRE_LOCAL is associated.
622 *
623 * Multiple zones can share a common broadcast address; typically all zones
624 * share the 255.255.255.255 address. Incoming as well as locally originated
625 * broadcast packets must be dispatched to all the zones on the broadcast
626 * network. For directed broadcasts (e.g. 10.16.72.255) this is not trivial
627 * since some zones may not be on the 10.16.72/24 network. To handle this, each
628 * zone has its own set of IRE_BROADCAST entries; then, broadcast packets are
629 * sent to every zone that has an IRE_BROADCAST entry for the destination
630 * address on the input ill, see ip_input_broadcast().
631 *
632 * Applications in different zones can join the same multicast group address.
633 * The same logic applies for multicast as for broadcast. ip_input_multicast
634 * dispatches packets to all zones that have members on the physical interface.
635 */
636
637 /*
638 * Squeue Fanout flags:
639 * 0: No fanout.
640 * 1: Fanout across all squeues
641 */
642 boolean_t ip_squeue_fanout = 0;
643
644 /*
645 * Maximum dups allowed per packet.
646 */
647 uint_t ip_max_frag_dups = 10;
648
649 static int ip_open(queue_t *q, dev_t *devp, int flag, int sflag,
650 cred_t *credp, boolean_t isv6);
651 static mblk_t *ip_xmit_attach_llhdr(mblk_t *, nce_t *);
652
653 static boolean_t icmp_inbound_verify_v4(mblk_t *, icmph_t *, ip_recv_attr_t *);
654 static void icmp_inbound_too_big_v4(icmph_t *, ip_recv_attr_t *);
655 static void icmp_inbound_error_fanout_v4(mblk_t *, icmph_t *,
656 ip_recv_attr_t *);
657 static void icmp_options_update(ipha_t *);
658 static void icmp_param_problem(mblk_t *, uint8_t, ip_recv_attr_t *);
659 static void icmp_pkt(mblk_t *, void *, size_t, ip_recv_attr_t *);
660 static mblk_t *icmp_pkt_err_ok(mblk_t *, ip_recv_attr_t *);
661 static void icmp_redirect_v4(mblk_t *mp, ipha_t *, icmph_t *,
662 ip_recv_attr_t *);
663 static void icmp_send_redirect(mblk_t *, ipaddr_t, ip_recv_attr_t *);
664 static void icmp_send_reply_v4(mblk_t *, ipha_t *, icmph_t *,
665 ip_recv_attr_t *);
666
667 mblk_t *ip_dlpi_alloc(size_t, t_uscalar_t);
668 char *ip_dot_addr(ipaddr_t, char *);
669 mblk_t *ip_carve_mp(mblk_t **, ssize_t);
670 static char *ip_dot_saddr(uchar_t *, char *);
671 static int ip_lrput(queue_t *, mblk_t *);
672 ipaddr_t ip_net_mask(ipaddr_t);
673 char *ip_nv_lookup(nv_t *, int);
674 int ip_rput(queue_t *, mblk_t *);
675 static void ip_rput_dlpi_writer(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp,
676 void *dummy_arg);
677 int ip_snmp_get(queue_t *, mblk_t *, int, boolean_t);
678 static mblk_t *ip_snmp_get_mib2_ip(queue_t *, mblk_t *,
679 mib2_ipIfStatsEntry_t *, ip_stack_t *, boolean_t);
680 static mblk_t *ip_snmp_get_mib2_ip_traffic_stats(queue_t *, mblk_t *,
681 ip_stack_t *, boolean_t);
682 static mblk_t *ip_snmp_get_mib2_ip6(queue_t *, mblk_t *, ip_stack_t *,
683 boolean_t);
684 static mblk_t *ip_snmp_get_mib2_icmp(queue_t *, mblk_t *, ip_stack_t *ipst);
685 static mblk_t *ip_snmp_get_mib2_icmp6(queue_t *, mblk_t *, ip_stack_t *ipst);
686 static mblk_t *ip_snmp_get_mib2_igmp(queue_t *, mblk_t *, ip_stack_t *ipst);
687 static mblk_t *ip_snmp_get_mib2_multi(queue_t *, mblk_t *, ip_stack_t *ipst);
688 static mblk_t *ip_snmp_get_mib2_ip_addr(queue_t *, mblk_t *,
689 ip_stack_t *ipst, boolean_t);
690 static mblk_t *ip_snmp_get_mib2_ip6_addr(queue_t *, mblk_t *,
691 ip_stack_t *ipst, boolean_t);
692 static mblk_t *ip_snmp_get_mib2_ip_group_src(queue_t *, mblk_t *,
693 ip_stack_t *ipst);
694 static mblk_t *ip_snmp_get_mib2_ip6_group_src(queue_t *, mblk_t *,
695 ip_stack_t *ipst);
696 static mblk_t *ip_snmp_get_mib2_ip_group_mem(queue_t *, mblk_t *,
697 ip_stack_t *ipst);
698 static mblk_t *ip_snmp_get_mib2_ip6_group_mem(queue_t *, mblk_t *,
699 ip_stack_t *ipst);
700 static mblk_t *ip_snmp_get_mib2_virt_multi(queue_t *, mblk_t *,
701 ip_stack_t *ipst);
702 static mblk_t *ip_snmp_get_mib2_multi_rtable(queue_t *, mblk_t *,
703 ip_stack_t *ipst);
704 static mblk_t *ip_snmp_get_mib2_ip_route_media(queue_t *, mblk_t *, int,
705 ip_stack_t *ipst);
706 static mblk_t *ip_snmp_get_mib2_ip6_route_media(queue_t *, mblk_t *, int,
707 ip_stack_t *ipst);
708 static void ip_snmp_get2_v4(ire_t *, iproutedata_t *);
709 static void ip_snmp_get2_v6_route(ire_t *, iproutedata_t *);
710 static void ip_snmp_get2_v4_media(ncec_t *, void *);
711 static void ip_snmp_get2_v6_media(ncec_t *, void *);
712 int ip_snmp_set(queue_t *, int, int, uchar_t *, int);
713
714 static mblk_t *ip_fragment_copyhdr(uchar_t *, int, int, ip_stack_t *,
715 mblk_t *);
716
717 static void conn_drain_init(ip_stack_t *);
718 static void conn_drain_fini(ip_stack_t *);
719 static void conn_drain(conn_t *connp, boolean_t closing);
720
721 static void conn_walk_drain(ip_stack_t *, idl_tx_list_t *);
722 static void conn_walk_sctp(pfv_t, void *, zoneid_t, netstack_t *);
723
724 static void *ip_stack_init(netstackid_t stackid, netstack_t *ns);
725 static void ip_stack_shutdown(netstackid_t stackid, void *arg);
726 static void ip_stack_fini(netstackid_t stackid, void *arg);
727
728 static int ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t,
729 const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *),
730 ire_t *, conn_t *, boolean_t, const in6_addr_t *, mcast_record_t,
731 const in6_addr_t *);
732
733 static int ip_squeue_switch(int);
734
735 static void *ip_kstat_init(netstackid_t, ip_stack_t *);
736 static void ip_kstat_fini(netstackid_t, kstat_t *);
737 static int ip_kstat_update(kstat_t *kp, int rw);
738 static void *icmp_kstat_init(netstackid_t);
739 static void icmp_kstat_fini(netstackid_t, kstat_t *);
740 static int icmp_kstat_update(kstat_t *kp, int rw);
741 static void *ip_kstat2_init(netstackid_t, ip_stat_t *);
742 static void ip_kstat2_fini(netstackid_t, kstat_t *);
743
744 static void ipobs_init(ip_stack_t *);
745 static void ipobs_fini(ip_stack_t *);
746
747 static int ip_tp_cpu_update(cpu_setup_t, int, void *);
748
749 ipaddr_t ip_g_all_ones = IP_HOST_MASK;
750
751 static long ip_rput_pullups;
752 int dohwcksum = 1; /* use h/w cksum if supported by the hardware */
753
754 vmem_t *ip_minor_arena_sa; /* for minor nos. from INET_MIN_DEV+2 thru 2^^18-1 */
755 vmem_t *ip_minor_arena_la; /* for minor nos. from 2^^18 thru 2^^32-1 */
756
757 int ip_debug;
758
759 /*
760 * Multirouting/CGTP stuff
761 */
762 int ip_cgtp_filter_rev = CGTP_FILTER_REV; /* CGTP hooks version */
763
764 /*
765 * IP tunables related declarations. Definitions are in ip_tunables.c
766 */
767 extern mod_prop_info_t ip_propinfo_tbl[];
768 extern int ip_propinfo_count;
769
770 /*
771 * Table of IP ioctls encoding the various properties of the ioctl and
772 * indexed based on the last byte of the ioctl command. Occasionally there
773 * is a clash, and there is more than 1 ioctl with the same last byte.
774 * In such a case 1 ioctl is encoded in the ndx table and the remaining
775 * ioctls are encoded in the misc table. An entry in the ndx table is
776 * retrieved by indexing on the last byte of the ioctl command and comparing
777 * the ioctl command with the value in the ndx table. In the event of a
778 * mismatch the misc table is then searched sequentially for the desired
779 * ioctl command.
780 *
781 * Entry: <command> <copyin_size> <flags> <cmd_type> <function> <restart_func>
782 */
783 ip_ioctl_cmd_t ip_ndx_ioctl_table[] = {
784 /* 000 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
785 /* 001 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
786 /* 002 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
787 /* 003 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
788 /* 004 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
789 /* 005 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
790 /* 006 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
791 /* 007 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
792 /* 008 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
793 /* 009 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
794
795 /* 010 */ { SIOCADDRT, sizeof (struct rtentry), IPI_PRIV,
796 MISC_CMD, ip_siocaddrt, NULL },
797 /* 011 */ { SIOCDELRT, sizeof (struct rtentry), IPI_PRIV,
798 MISC_CMD, ip_siocdelrt, NULL },
799
800 /* 012 */ { SIOCSIFADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
801 IF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
802 /* 013 */ { SIOCGIFADDR, sizeof (struct ifreq), IPI_GET_CMD,
803 IF_CMD, ip_sioctl_get_addr, NULL },
804
805 /* 014 */ { SIOCSIFDSTADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
806 IF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
807 /* 015 */ { SIOCGIFDSTADDR, sizeof (struct ifreq),
808 IPI_GET_CMD, IF_CMD, ip_sioctl_get_dstaddr, NULL },
809
810 /* 016 */ { SIOCSIFFLAGS, sizeof (struct ifreq),
811 IPI_PRIV | IPI_WR,
812 IF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
813 /* 017 */ { SIOCGIFFLAGS, sizeof (struct ifreq),
814 IPI_MODOK | IPI_GET_CMD,
815 IF_CMD, ip_sioctl_get_flags, NULL },
816
817 /* 018 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
818 /* 019 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
819
820 /* copyin size cannot be coded for SIOCGIFCONF */
821 /* 020 */ { O_SIOCGIFCONF, 0, IPI_GET_CMD,
822 MISC_CMD, ip_sioctl_get_ifconf, NULL },
823
824 /* 021 */ { SIOCSIFMTU, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
825 IF_CMD, ip_sioctl_mtu, NULL },
826 /* 022 */ { SIOCGIFMTU, sizeof (struct ifreq), IPI_GET_CMD,
827 IF_CMD, ip_sioctl_get_mtu, NULL },
828 /* 023 */ { SIOCGIFBRDADDR, sizeof (struct ifreq),
829 IPI_GET_CMD, IF_CMD, ip_sioctl_get_brdaddr, NULL },
830 /* 024 */ { SIOCSIFBRDADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
831 IF_CMD, ip_sioctl_brdaddr, NULL },
832 /* 025 */ { SIOCGIFNETMASK, sizeof (struct ifreq),
833 IPI_GET_CMD, IF_CMD, ip_sioctl_get_netmask, NULL },
834 /* 026 */ { SIOCSIFNETMASK, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
835 IF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
836 /* 027 */ { SIOCGIFMETRIC, sizeof (struct ifreq),
837 IPI_GET_CMD, IF_CMD, ip_sioctl_get_metric, NULL },
838 /* 028 */ { SIOCSIFMETRIC, sizeof (struct ifreq), IPI_PRIV,
839 IF_CMD, ip_sioctl_metric, NULL },
840 /* 029 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
841
842 /* See 166-168 below for extended SIOC*XARP ioctls */
843 /* 030 */ { SIOCSARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR,
844 ARP_CMD, ip_sioctl_arp, NULL },
845 /* 031 */ { SIOCGARP, sizeof (struct arpreq), IPI_GET_CMD,
846 ARP_CMD, ip_sioctl_arp, NULL },
847 /* 032 */ { SIOCDARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR,
848 ARP_CMD, ip_sioctl_arp, NULL },
849
850 /* 033 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
851 /* 034 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
852 /* 035 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
853 /* 036 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
854 /* 037 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
855 /* 038 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
856 /* 039 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
857 /* 040 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
858 /* 041 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
859 /* 042 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
860 /* 043 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
861 /* 044 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
862 /* 045 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
863 /* 046 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
864 /* 047 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
865 /* 048 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
866 /* 049 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
867 /* 050 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
868 /* 051 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
869 /* 052 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
870 /* 053 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
871
872 /* 054 */ { IF_UNITSEL, sizeof (int), IPI_PRIV | IPI_WR | IPI_MODOK,
873 MISC_CMD, if_unitsel, if_unitsel_restart },
874
875 /* 055 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
876 /* 056 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
877 /* 057 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
878 /* 058 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
879 /* 059 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
880 /* 060 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
881 /* 061 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
882 /* 062 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
883 /* 063 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
884 /* 064 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
885 /* 065 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
886 /* 066 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
887 /* 067 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
888 /* 068 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
889 /* 069 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
890 /* 070 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
891 /* 071 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
892 /* 072 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
893
894 /* 073 */ { SIOCSIFNAME, sizeof (struct ifreq),
895 IPI_PRIV | IPI_WR | IPI_MODOK,
896 IF_CMD, ip_sioctl_sifname, NULL },
897
898 /* 074 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
899 /* 075 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
900 /* 076 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
901 /* 077 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
902 /* 078 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
903 /* 079 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
904 /* 080 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
905 /* 081 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
906 /* 082 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
907 /* 083 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
908 /* 084 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
909 /* 085 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
910 /* 086 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
911
912 /* 087 */ { SIOCGIFNUM, sizeof (int), IPI_GET_CMD,
913 MISC_CMD, ip_sioctl_get_ifnum, NULL },
914 /* 088 */ { SIOCGIFMUXID, sizeof (struct ifreq), IPI_GET_CMD,
915 IF_CMD, ip_sioctl_get_muxid, NULL },
916 /* 089 */ { SIOCSIFMUXID, sizeof (struct ifreq),
917 IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_muxid, NULL },
918
919 /* Both if and lif variants share same func */
920 /* 090 */ { SIOCGIFINDEX, sizeof (struct ifreq), IPI_GET_CMD,
921 IF_CMD, ip_sioctl_get_lifindex, NULL },
922 /* Both if and lif variants share same func */
923 /* 091 */ { SIOCSIFINDEX, sizeof (struct ifreq),
924 IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_slifindex, NULL },
925
926 /* copyin size cannot be coded for SIOCGIFCONF */
927 /* 092 */ { SIOCGIFCONF, 0, IPI_GET_CMD,
928 MISC_CMD, ip_sioctl_get_ifconf, NULL },
929 /* 093 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
930 /* 094 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
931 /* 095 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
932 /* 096 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
933 /* 097 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
934 /* 098 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
935 /* 099 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
936 /* 100 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
937 /* 101 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
938 /* 102 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
939 /* 103 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
940 /* 104 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
941 /* 105 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
942 /* 106 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
943 /* 107 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
944 /* 108 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
945 /* 109 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
946
947 /* 110 */ { SIOCLIFREMOVEIF, sizeof (struct lifreq),
948 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_removeif,
949 ip_sioctl_removeif_restart },
950 /* 111 */ { SIOCLIFADDIF, sizeof (struct lifreq),
951 IPI_GET_CMD | IPI_PRIV | IPI_WR,
952 LIF_CMD, ip_sioctl_addif, NULL },
953 #define SIOCLIFADDR_NDX 112
954 /* 112 */ { SIOCSLIFADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
955 LIF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
956 /* 113 */ { SIOCGLIFADDR, sizeof (struct lifreq),
957 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_addr, NULL },
958 /* 114 */ { SIOCSLIFDSTADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
959 LIF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
960 /* 115 */ { SIOCGLIFDSTADDR, sizeof (struct lifreq),
961 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dstaddr, NULL },
962 /* 116 */ { SIOCSLIFFLAGS, sizeof (struct lifreq),
963 IPI_PRIV | IPI_WR,
964 LIF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
965 /* 117 */ { SIOCGLIFFLAGS, sizeof (struct lifreq),
966 IPI_GET_CMD | IPI_MODOK,
967 LIF_CMD, ip_sioctl_get_flags, NULL },
968
969 /* 118 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
970 /* 119 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
971
972 /* 120 */ { O_SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD,
973 ip_sioctl_get_lifconf, NULL },
974 /* 121 */ { SIOCSLIFMTU, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
975 LIF_CMD, ip_sioctl_mtu, NULL },
976 /* 122 */ { SIOCGLIFMTU, sizeof (struct lifreq), IPI_GET_CMD,
977 LIF_CMD, ip_sioctl_get_mtu, NULL },
978 /* 123 */ { SIOCGLIFBRDADDR, sizeof (struct lifreq),
979 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_brdaddr, NULL },
980 /* 124 */ { SIOCSLIFBRDADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
981 LIF_CMD, ip_sioctl_brdaddr, NULL },
982 /* 125 */ { SIOCGLIFNETMASK, sizeof (struct lifreq),
983 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_netmask, NULL },
984 /* 126 */ { SIOCSLIFNETMASK, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
985 LIF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
986 /* 127 */ { SIOCGLIFMETRIC, sizeof (struct lifreq),
987 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_metric, NULL },
988 /* 128 */ { SIOCSLIFMETRIC, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
989 LIF_CMD, ip_sioctl_metric, NULL },
990 /* 129 */ { SIOCSLIFNAME, sizeof (struct lifreq),
991 IPI_PRIV | IPI_WR | IPI_MODOK,
992 LIF_CMD, ip_sioctl_slifname,
993 ip_sioctl_slifname_restart },
994
995 /* 130 */ { SIOCGLIFNUM, sizeof (struct lifnum), IPI_GET_CMD,
996 MISC_CMD, ip_sioctl_get_lifnum, NULL },
997 /* 131 */ { SIOCGLIFMUXID, sizeof (struct lifreq),
998 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_muxid, NULL },
999 /* 132 */ { SIOCSLIFMUXID, sizeof (struct lifreq),
1000 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_muxid, NULL },
1001 /* 133 */ { SIOCGLIFINDEX, sizeof (struct lifreq),
1002 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifindex, 0 },
1003 /* 134 */ { SIOCSLIFINDEX, sizeof (struct lifreq),
1004 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifindex, 0 },
1005 /* 135 */ { SIOCSLIFTOKEN, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1006 LIF_CMD, ip_sioctl_token, NULL },
1007 /* 136 */ { SIOCGLIFTOKEN, sizeof (struct lifreq),
1008 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_token, NULL },
1009 /* 137 */ { SIOCSLIFSUBNET, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1010 LIF_CMD, ip_sioctl_subnet, ip_sioctl_subnet_restart },
1011 /* 138 */ { SIOCGLIFSUBNET, sizeof (struct lifreq),
1012 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_subnet, NULL },
1013 /* 139 */ { SIOCSLIFLNKINFO, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1014 LIF_CMD, ip_sioctl_lnkinfo, NULL },
1015
1016 /* 140 */ { SIOCGLIFLNKINFO, sizeof (struct lifreq),
1017 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lnkinfo, NULL },
1018 /* 141 */ { SIOCLIFDELND, sizeof (struct lifreq), IPI_PRIV,
1019 LIF_CMD, ip_siocdelndp_v6, NULL },
1020 /* 142 */ { SIOCLIFGETND, sizeof (struct lifreq), IPI_GET_CMD,
1021 LIF_CMD, ip_siocqueryndp_v6, NULL },
1022 /* 143 */ { SIOCLIFSETND, sizeof (struct lifreq), IPI_PRIV,
1023 LIF_CMD, ip_siocsetndp_v6, NULL },
1024 /* 144 */ { SIOCTMYADDR, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1025 MISC_CMD, ip_sioctl_tmyaddr, NULL },
1026 /* 145 */ { SIOCTONLINK, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1027 MISC_CMD, ip_sioctl_tonlink, NULL },
1028 /* 146 */ { SIOCTMYSITE, sizeof (struct sioc_addrreq), 0,
1029 MISC_CMD, ip_sioctl_tmysite, NULL },
1030 /* 147 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1031 /* 148 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1032
1033 /* Old *IPSECONFIG ioctls are now deprecated, now see spdsock.c */
1034 /* 149 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1035 /* 150 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1036 /* 151 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1037 /* 152 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1038
1039 /* 153 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1040
1041 /* 154 */ { SIOCGLIFBINDING, sizeof (struct lifreq), IPI_GET_CMD,
1042 LIF_CMD, ip_sioctl_get_binding, NULL },
1043 /* 155 */ { SIOCSLIFGROUPNAME, sizeof (struct lifreq),
1044 IPI_PRIV | IPI_WR,
1045 LIF_CMD, ip_sioctl_groupname, ip_sioctl_groupname },
1046 /* 156 */ { SIOCGLIFGROUPNAME, sizeof (struct lifreq),
1047 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_groupname, NULL },
1048 /* 157 */ { SIOCGLIFGROUPINFO, sizeof (lifgroupinfo_t),
1049 IPI_GET_CMD, MISC_CMD, ip_sioctl_groupinfo, NULL },
1050
1051 /* Leave 158-160 unused; used to be SIOC*IFARP ioctls */
1052 /* 158 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1053 /* 159 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1054 /* 160 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1055
1056 /* 161 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1057
1058 /* These are handled in ip_sioctl_copyin_setup itself */
1059 /* 162 */ { SIOCGIP6ADDRPOLICY, 0, IPI_NULL_BCONT,
1060 MISC_CMD, NULL, NULL },
1061 /* 163 */ { SIOCSIP6ADDRPOLICY, 0, IPI_PRIV | IPI_NULL_BCONT,
1062 MISC_CMD, NULL, NULL },
1063 /* 164 */ { SIOCGDSTINFO, 0, IPI_GET_CMD, MISC_CMD, NULL, NULL },
1064
1065 /* 165 */ { SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD,
1066 ip_sioctl_get_lifconf, NULL },
1067
1068 /* 166 */ { SIOCSXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR,
1069 XARP_CMD, ip_sioctl_arp, NULL },
1070 /* 167 */ { SIOCGXARP, sizeof (struct xarpreq), IPI_GET_CMD,
1071 XARP_CMD, ip_sioctl_arp, NULL },
1072 /* 168 */ { SIOCDXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR,
1073 XARP_CMD, ip_sioctl_arp, NULL },
1074
1075 /* SIOCPOPSOCKFS is not handled by IP */
1076 /* 169 */ { IPI_DONTCARE /* SIOCPOPSOCKFS */, 0, 0, 0, NULL, NULL },
1077
1078 /* 170 */ { SIOCGLIFZONE, sizeof (struct lifreq),
1079 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifzone, NULL },
1080 /* 171 */ { SIOCSLIFZONE, sizeof (struct lifreq),
1081 IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifzone,
1082 ip_sioctl_slifzone_restart },
1083 /* 172-174 are SCTP ioctls and not handled by IP */
1084 /* 172 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1085 /* 173 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1086 /* 174 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1087 /* 175 */ { SIOCGLIFUSESRC, sizeof (struct lifreq),
1088 IPI_GET_CMD, LIF_CMD,
1089 ip_sioctl_get_lifusesrc, 0 },
1090 /* 176 */ { SIOCSLIFUSESRC, sizeof (struct lifreq),
1091 IPI_PRIV | IPI_WR,
1092 LIF_CMD, ip_sioctl_slifusesrc,
1093 NULL },
1094 /* 177 */ { SIOCGLIFSRCOF, 0, IPI_GET_CMD, MISC_CMD,
1095 ip_sioctl_get_lifsrcof, NULL },
1096 /* 178 */ { SIOCGMSFILTER, sizeof (struct group_filter), IPI_GET_CMD,
1097 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1098 /* 179 */ { SIOCSMSFILTER, sizeof (struct group_filter), 0,
1099 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1100 /* 180 */ { SIOCGIPMSFILTER, sizeof (struct ip_msfilter), IPI_GET_CMD,
1101 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1102 /* 181 */ { SIOCSIPMSFILTER, sizeof (struct ip_msfilter), 0,
1103 MSFILT_CMD, ip_sioctl_msfilter, NULL },
1104 /* 182 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1105 /* SIOCSENABLESDP is handled by SDP */
1106 /* 183 */ { IPI_DONTCARE /* SIOCSENABLESDP */, 0, 0, 0, NULL, NULL },
1107 /* 184 */ { IPI_DONTCARE /* SIOCSQPTR */, 0, 0, 0, NULL, NULL },
1108 /* 185 */ { SIOCGIFHWADDR, sizeof (struct ifreq), IPI_GET_CMD,
1109 IF_CMD, ip_sioctl_get_ifhwaddr, NULL },
1110 /* 186 */ { IPI_DONTCARE /* SIOCGSTAMP */, 0, 0, 0, NULL, NULL },
1111 /* 187 */ { SIOCILB, 0, IPI_PRIV | IPI_GET_CMD, MISC_CMD,
1112 ip_sioctl_ilb_cmd, NULL },
1113 /* 188 */ { SIOCGETPROP, 0, IPI_GET_CMD, 0, NULL, NULL },
1114 /* 189 */ { SIOCSETPROP, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL},
1115 /* 190 */ { SIOCGLIFDADSTATE, sizeof (struct lifreq),
1116 IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dadstate, NULL },
1117 /* 191 */ { SIOCSLIFPREFIX, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1118 LIF_CMD, ip_sioctl_prefix, ip_sioctl_prefix_restart },
1119 /* 192 */ { SIOCGLIFHWADDR, sizeof (struct lifreq), IPI_GET_CMD,
1120 LIF_CMD, ip_sioctl_get_lifhwaddr, NULL }
1121 };
1122
1123 int ip_ndx_ioctl_count = sizeof (ip_ndx_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1124
1125 ip_ioctl_cmd_t ip_misc_ioctl_table[] = {
1126 { I_LINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1127 { I_UNLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1128 { I_PLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1129 { I_PUNLINK, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1130 { ND_GET, 0, 0, 0, NULL, NULL },
1131 { ND_SET, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1132 { IP_IOCTL, 0, 0, 0, NULL, NULL },
1133 { SIOCGETVIFCNT, sizeof (struct sioc_vif_req), IPI_GET_CMD,
1134 MISC_CMD, mrt_ioctl},
1135 { SIOCGETSGCNT, sizeof (struct sioc_sg_req), IPI_GET_CMD,
1136 MISC_CMD, mrt_ioctl},
1137 { SIOCGETLSGCNT, sizeof (struct sioc_lsg_req), IPI_GET_CMD,
1138 MISC_CMD, mrt_ioctl}
1139 };
1140
1141 int ip_misc_ioctl_count =
1142 sizeof (ip_misc_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1143
1144 int conn_drain_nthreads; /* Number of drainers reqd. */
1145 /* Settable in /etc/system */
1146 /* Defined in ip_ire.c */
1147 extern uint32_t ip_ire_max_bucket_cnt, ip6_ire_max_bucket_cnt;
1148 extern uint32_t ip_ire_min_bucket_cnt, ip6_ire_min_bucket_cnt;
1149 extern uint32_t ip_ire_mem_ratio, ip_ire_cpu_ratio;
1150
1151 static nv_t ire_nv_arr[] = {
1152 { IRE_BROADCAST, "BROADCAST" },
1153 { IRE_LOCAL, "LOCAL" },
1154 { IRE_LOOPBACK, "LOOPBACK" },
1155 { IRE_DEFAULT, "DEFAULT" },
1156 { IRE_PREFIX, "PREFIX" },
1157 { IRE_IF_NORESOLVER, "IF_NORESOL" },
1158 { IRE_IF_RESOLVER, "IF_RESOLV" },
1159 { IRE_IF_CLONE, "IF_CLONE" },
1160 { IRE_HOST, "HOST" },
1161 { IRE_MULTICAST, "MULTICAST" },
1162 { IRE_NOROUTE, "NOROUTE" },
1163 { 0 }
1164 };
1165
1166 nv_t *ire_nv_tbl = ire_nv_arr;
1167
1168 /* Simple ICMP IP Header Template */
1169 static ipha_t icmp_ipha = {
1170 IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
1171 };
1172
1173 struct module_info ip_mod_info = {
1174 IP_MOD_ID, IP_MOD_NAME, IP_MOD_MINPSZ, IP_MOD_MAXPSZ, IP_MOD_HIWAT,
1175 IP_MOD_LOWAT
1176 };
1177
1178 /*
1179 * Duplicate static symbols within a module confuses mdb; so we avoid the
1180 * problem by making the symbols here distinct from those in udp.c.
1181 */
1182
1183 /*
1184 * Entry points for IP as a device and as a module.
1185 * We have separate open functions for the /dev/ip and /dev/ip6 devices.
1186 */
1187 static struct qinit iprinitv4 = {
1188 ip_rput, NULL, ip_openv4, ip_close, NULL, &ip_mod_info
1189 };
1190
1191 struct qinit iprinitv6 = {
1192 ip_rput_v6, NULL, ip_openv6, ip_close, NULL, &ip_mod_info
1193 };
1194
1195 static struct qinit ipwinit = {
1196 ip_wput_nondata, ip_wsrv, NULL, NULL, NULL, &ip_mod_info
1197 };
1198
1199 static struct qinit iplrinit = {
1200 ip_lrput, NULL, ip_openv4, ip_close, NULL, &ip_mod_info
1201 };
1202
1203 static struct qinit iplwinit = {
1204 ip_lwput, NULL, NULL, NULL, NULL, &ip_mod_info
1205 };
1206
1207 /* For AF_INET aka /dev/ip */
1208 struct streamtab ipinfov4 = {
1209 &iprinitv4, &ipwinit, &iplrinit, &iplwinit
1210 };
1211
1212 /* For AF_INET6 aka /dev/ip6 */
1213 struct streamtab ipinfov6 = {
1214 &iprinitv6, &ipwinit, &iplrinit, &iplwinit
1215 };
1216
1217 #ifdef DEBUG
1218 boolean_t skip_sctp_cksum = B_FALSE;
1219 #endif
1220
1221 /*
1222 * Generate an ICMP fragmentation needed message.
1223 * When called from ip_output side a minimal ip_recv_attr_t needs to be
1224 * constructed by the caller.
1225 */
1226 void
1227 icmp_frag_needed(mblk_t *mp, int mtu, ip_recv_attr_t *ira)
1228 {
1229 icmph_t icmph;
1230 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
1231
1232 mp = icmp_pkt_err_ok(mp, ira);
1233 if (mp == NULL)
1234 return;
1235
1236 bzero(&icmph, sizeof (icmph_t));
1237 icmph.icmph_type = ICMP_DEST_UNREACHABLE;
1238 icmph.icmph_code = ICMP_FRAGMENTATION_NEEDED;
1239 icmph.icmph_du_mtu = htons((uint16_t)mtu);
1240 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutFragNeeded);
1241 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs);
1242
1243 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
1244 }
1245
1246 /*
1247 * icmp_inbound_v4 deals with ICMP messages that are handled by IP.
1248 * If the ICMP message is consumed by IP, i.e., it should not be delivered
1249 * to any IPPROTO_ICMP raw sockets, then it returns NULL.
1250 * Likewise, if the ICMP error is misformed (too short, etc), then it
1251 * returns NULL. The caller uses this to determine whether or not to send
1252 * to raw sockets.
1253 *
1254 * All error messages are passed to the matching transport stream.
1255 *
1256 * The following cases are handled by icmp_inbound:
1257 * 1) It needs to send a reply back and possibly delivering it
1258 * to the "interested" upper clients.
1259 * 2) Return the mblk so that the caller can pass it to the RAW socket clients.
1260 * 3) It needs to change some values in IP only.
1261 * 4) It needs to change some values in IP and upper layers e.g TCP
1262 * by delivering an error to the upper layers.
1263 *
1264 * We handle the above three cases in the context of IPsec in the
1265 * following way :
1266 *
1267 * 1) Send the reply back in the same way as the request came in.
1268 * If it came in encrypted, it goes out encrypted. If it came in
1269 * clear, it goes out in clear. Thus, this will prevent chosen
1270 * plain text attack.
1271 * 2) The client may or may not expect things to come in secure.
1272 * If it comes in secure, the policy constraints are checked
1273 * before delivering it to the upper layers. If it comes in
1274 * clear, ipsec_inbound_accept_clear will decide whether to
1275 * accept this in clear or not. In both the cases, if the returned
1276 * message (IP header + 8 bytes) that caused the icmp message has
1277 * AH/ESP headers, it is sent up to AH/ESP for validation before
1278 * sending up. If there are only 8 bytes of returned message, then
1279 * upper client will not be notified.
1280 * 3) Check with global policy to see whether it matches the constaints.
1281 * But this will be done only if icmp_accept_messages_in_clear is
1282 * zero.
1283 * 4) If we need to change both in IP and ULP, then the decision taken
1284 * while affecting the values in IP and while delivering up to TCP
1285 * should be the same.
1286 *
1287 * There are two cases.
1288 *
1289 * a) If we reject data at the IP layer (ipsec_check_global_policy()
1290 * failed), we will not deliver it to the ULP, even though they
1291 * are *willing* to accept in *clear*. This is fine as our global
1292 * disposition to icmp messages asks us reject the datagram.
1293 *
1294 * b) If we accept data at the IP layer (ipsec_check_global_policy()
1295 * succeeded or icmp_accept_messages_in_clear is 1), and not able
1296 * to deliver it to ULP (policy failed), it can lead to
1297 * consistency problems. The cases known at this time are
1298 * ICMP_DESTINATION_UNREACHABLE messages with following code
1299 * values :
1300 *
1301 * - ICMP_FRAGMENTATION_NEEDED : IP adapts to the new value
1302 * and Upper layer rejects. Then the communication will
1303 * come to a stop. This is solved by making similar decisions
1304 * at both levels. Currently, when we are unable to deliver
1305 * to the Upper Layer (due to policy failures) while IP has
1306 * adjusted dce_pmtu, the next outbound datagram would
1307 * generate a local ICMP_FRAGMENTATION_NEEDED message - which
1308 * will be with the right level of protection. Thus the right
1309 * value will be communicated even if we are not able to
1310 * communicate when we get from the wire initially. But this
1311 * assumes there would be at least one outbound datagram after
1312 * IP has adjusted its dce_pmtu value. To make things
1313 * simpler, we accept in clear after the validation of
1314 * AH/ESP headers.
1315 *
1316 * - Other ICMP ERRORS : We may not be able to deliver it to the
1317 * upper layer depending on the level of protection the upper
1318 * layer expects and the disposition in ipsec_inbound_accept_clear().
1319 * ipsec_inbound_accept_clear() decides whether a given ICMP error
1320 * should be accepted in clear when the Upper layer expects secure.
1321 * Thus the communication may get aborted by some bad ICMP
1322 * packets.
1323 */
1324 mblk_t *
1325 icmp_inbound_v4(mblk_t *mp, ip_recv_attr_t *ira)
1326 {
1327 icmph_t *icmph;
1328 ipha_t *ipha; /* Outer header */
1329 int ip_hdr_length; /* Outer header length */
1330 boolean_t interested;
1331 ipif_t *ipif;
1332 uint32_t ts;
1333 uint32_t *tsp;
1334 timestruc_t now;
1335 ill_t *ill = ira->ira_ill;
1336 ip_stack_t *ipst = ill->ill_ipst;
1337 zoneid_t zoneid = ira->ira_zoneid;
1338 int len_needed;
1339 mblk_t *mp_ret = NULL;
1340
1341 ipha = (ipha_t *)mp->b_rptr;
1342
1343 BUMP_MIB(&ipst->ips_icmp_mib, icmpInMsgs);
1344
1345 ip_hdr_length = ira->ira_ip_hdr_length;
1346 if ((mp->b_wptr - mp->b_rptr) < (ip_hdr_length + ICMPH_SIZE)) {
1347 if (ira->ira_pktlen < (ip_hdr_length + ICMPH_SIZE)) {
1348 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
1349 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
1350 freemsg(mp);
1351 return (NULL);
1352 }
1353 /* Last chance to get real. */
1354 ipha = ip_pullup(mp, ip_hdr_length + ICMPH_SIZE, ira);
1355 if (ipha == NULL) {
1356 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
1357 freemsg(mp);
1358 return (NULL);
1359 }
1360 }
1361
1362 /* The IP header will always be a multiple of four bytes */
1363 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1364 ip2dbg(("icmp_inbound_v4: type %d code %d\n", icmph->icmph_type,
1365 icmph->icmph_code));
1366
1367 /*
1368 * We will set "interested" to "true" if we should pass a copy to
1369 * the transport or if we handle the packet locally.
1370 */
1371 interested = B_FALSE;
1372 switch (icmph->icmph_type) {
1373 case ICMP_ECHO_REPLY:
1374 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchoReps);
1375 break;
1376 case ICMP_DEST_UNREACHABLE:
1377 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED)
1378 BUMP_MIB(&ipst->ips_icmp_mib, icmpInFragNeeded);
1379 interested = B_TRUE; /* Pass up to transport */
1380 BUMP_MIB(&ipst->ips_icmp_mib, icmpInDestUnreachs);
1381 break;
1382 case ICMP_SOURCE_QUENCH:
1383 interested = B_TRUE; /* Pass up to transport */
1384 BUMP_MIB(&ipst->ips_icmp_mib, icmpInSrcQuenchs);
1385 break;
1386 case ICMP_REDIRECT:
1387 if (!ipst->ips_ip_ignore_redirect)
1388 interested = B_TRUE;
1389 BUMP_MIB(&ipst->ips_icmp_mib, icmpInRedirects);
1390 break;
1391 case ICMP_ECHO_REQUEST:
1392 /*
1393 * Whether to respond to echo requests that come in as IP
1394 * broadcasts or as IP multicast is subject to debate
1395 * (what isn't?). We aim to please, you pick it.
1396 * Default is do it.
1397 */
1398 if (ira->ira_flags & IRAF_MULTICAST) {
1399 /* multicast: respond based on tunable */
1400 interested = ipst->ips_ip_g_resp_to_echo_mcast;
1401 } else if (ira->ira_flags & IRAF_BROADCAST) {
1402 /* broadcast: respond based on tunable */
1403 interested = ipst->ips_ip_g_resp_to_echo_bcast;
1404 } else {
1405 /* unicast: always respond */
1406 interested = B_TRUE;
1407 }
1408 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchos);
1409 if (!interested) {
1410 /* We never pass these to RAW sockets */
1411 freemsg(mp);
1412 return (NULL);
1413 }
1414
1415 /* Check db_ref to make sure we can modify the packet. */
1416 if (mp->b_datap->db_ref > 1) {
1417 mblk_t *mp1;
1418
1419 mp1 = copymsg(mp);
1420 freemsg(mp);
1421 if (!mp1) {
1422 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1423 return (NULL);
1424 }
1425 mp = mp1;
1426 ipha = (ipha_t *)mp->b_rptr;
1427 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1428 }
1429 icmph->icmph_type = ICMP_ECHO_REPLY;
1430 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutEchoReps);
1431 icmp_send_reply_v4(mp, ipha, icmph, ira);
1432 return (NULL);
1433
1434 case ICMP_ROUTER_ADVERTISEMENT:
1435 case ICMP_ROUTER_SOLICITATION:
1436 break;
1437 case ICMP_TIME_EXCEEDED:
1438 interested = B_TRUE; /* Pass up to transport */
1439 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimeExcds);
1440 break;
1441 case ICMP_PARAM_PROBLEM:
1442 interested = B_TRUE; /* Pass up to transport */
1443 BUMP_MIB(&ipst->ips_icmp_mib, icmpInParmProbs);
1444 break;
1445 case ICMP_TIME_STAMP_REQUEST:
1446 /* Response to Time Stamp Requests is local policy. */
1447 if (ipst->ips_ip_g_resp_to_timestamp) {
1448 if (ira->ira_flags & IRAF_MULTIBROADCAST)
1449 interested =
1450 ipst->ips_ip_g_resp_to_timestamp_bcast;
1451 else
1452 interested = B_TRUE;
1453 }
1454 if (!interested) {
1455 /* We never pass these to RAW sockets */
1456 freemsg(mp);
1457 return (NULL);
1458 }
1459
1460 /* Make sure we have enough of the packet */
1461 len_needed = ip_hdr_length + ICMPH_SIZE +
1462 3 * sizeof (uint32_t);
1463
1464 if (mp->b_wptr - mp->b_rptr < len_needed) {
1465 ipha = ip_pullup(mp, len_needed, ira);
1466 if (ipha == NULL) {
1467 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1468 ip_drop_input("ipIfStatsInDiscards - ip_pullup",
1469 mp, ill);
1470 freemsg(mp);
1471 return (NULL);
1472 }
1473 /* Refresh following the pullup. */
1474 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1475 }
1476 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestamps);
1477 /* Check db_ref to make sure we can modify the packet. */
1478 if (mp->b_datap->db_ref > 1) {
1479 mblk_t *mp1;
1480
1481 mp1 = copymsg(mp);
1482 freemsg(mp);
1483 if (!mp1) {
1484 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1485 return (NULL);
1486 }
1487 mp = mp1;
1488 ipha = (ipha_t *)mp->b_rptr;
1489 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1490 }
1491 icmph->icmph_type = ICMP_TIME_STAMP_REPLY;
1492 tsp = (uint32_t *)&icmph[1];
1493 tsp++; /* Skip past 'originate time' */
1494 /* Compute # of milliseconds since midnight */
1495 gethrestime(&now);
1496 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
1497 NSEC2MSEC(now.tv_nsec);
1498 *tsp++ = htonl(ts); /* Lay in 'receive time' */
1499 *tsp++ = htonl(ts); /* Lay in 'send time' */
1500 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimestampReps);
1501 icmp_send_reply_v4(mp, ipha, icmph, ira);
1502 return (NULL);
1503
1504 case ICMP_TIME_STAMP_REPLY:
1505 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestampReps);
1506 break;
1507 case ICMP_INFO_REQUEST:
1508 /* Per RFC 1122 3.2.2.7, ignore this. */
1509 case ICMP_INFO_REPLY:
1510 break;
1511 case ICMP_ADDRESS_MASK_REQUEST:
1512 if (ira->ira_flags & IRAF_MULTIBROADCAST) {
1513 interested =
1514 ipst->ips_ip_respond_to_address_mask_broadcast;
1515 } else {
1516 interested = B_TRUE;
1517 }
1518 if (!interested) {
1519 /* We never pass these to RAW sockets */
1520 freemsg(mp);
1521 return (NULL);
1522 }
1523 len_needed = ip_hdr_length + ICMPH_SIZE + IP_ADDR_LEN;
1524 if (mp->b_wptr - mp->b_rptr < len_needed) {
1525 ipha = ip_pullup(mp, len_needed, ira);
1526 if (ipha == NULL) {
1527 BUMP_MIB(ill->ill_ip_mib,
1528 ipIfStatsInTruncatedPkts);
1529 ip_drop_input("ipIfStatsInTruncatedPkts", mp,
1530 ill);
1531 freemsg(mp);
1532 return (NULL);
1533 }
1534 /* Refresh following the pullup. */
1535 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1536 }
1537 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMasks);
1538 /* Check db_ref to make sure we can modify the packet. */
1539 if (mp->b_datap->db_ref > 1) {
1540 mblk_t *mp1;
1541
1542 mp1 = copymsg(mp);
1543 freemsg(mp);
1544 if (!mp1) {
1545 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1546 return (NULL);
1547 }
1548 mp = mp1;
1549 ipha = (ipha_t *)mp->b_rptr;
1550 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1551 }
1552 /*
1553 * Need the ipif with the mask be the same as the source
1554 * address of the mask reply. For unicast we have a specific
1555 * ipif. For multicast/broadcast we only handle onlink
1556 * senders, and use the source address to pick an ipif.
1557 */
1558 ipif = ipif_lookup_addr(ipha->ipha_dst, ill, zoneid, ipst);
1559 if (ipif == NULL) {
1560 /* Broadcast or multicast */
1561 ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid);
1562 if (ipif == NULL) {
1563 freemsg(mp);
1564 return (NULL);
1565 }
1566 }
1567 icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
1568 bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
1569 ipif_refrele(ipif);
1570 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutAddrMaskReps);
1571 icmp_send_reply_v4(mp, ipha, icmph, ira);
1572 return (NULL);
1573
1574 case ICMP_ADDRESS_MASK_REPLY:
1575 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMaskReps);
1576 break;
1577 default:
1578 interested = B_TRUE; /* Pass up to transport */
1579 BUMP_MIB(&ipst->ips_icmp_mib, icmpInUnknowns);
1580 break;
1581 }
1582 /*
1583 * See if there is an ICMP client to avoid an extra copymsg/freemsg
1584 * if there isn't one.
1585 */
1586 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_ICMP].connf_head != NULL) {
1587 /* If there is an ICMP client and we want one too, copy it. */
1588
1589 if (!interested) {
1590 /* Caller will deliver to RAW sockets */
1591 return (mp);
1592 }
1593 mp_ret = copymsg(mp);
1594 if (mp_ret == NULL) {
1595 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1596 ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill);
1597 }
1598 } else if (!interested) {
1599 /* Neither we nor raw sockets are interested. Drop packet now */
1600 freemsg(mp);
1601 return (NULL);
1602 }
1603
1604 /*
1605 * ICMP error or redirect packet. Make sure we have enough of
1606 * the header and that db_ref == 1 since we might end up modifying
1607 * the packet.
1608 */
1609 if (mp->b_cont != NULL) {
1610 if (ip_pullup(mp, -1, ira) == NULL) {
1611 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1612 ip_drop_input("ipIfStatsInDiscards - ip_pullup",
1613 mp, ill);
1614 freemsg(mp);
1615 return (mp_ret);
1616 }
1617 }
1618
1619 if (mp->b_datap->db_ref > 1) {
1620 mblk_t *mp1;
1621
1622 mp1 = copymsg(mp);
1623 if (mp1 == NULL) {
1624 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1625 ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill);
1626 freemsg(mp);
1627 return (mp_ret);
1628 }
1629 freemsg(mp);
1630 mp = mp1;
1631 }
1632
1633 /*
1634 * In case mp has changed, verify the message before any further
1635 * processes.
1636 */
1637 ipha = (ipha_t *)mp->b_rptr;
1638 icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1639 if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
1640 freemsg(mp);
1641 return (mp_ret);
1642 }
1643
1644 switch (icmph->icmph_type) {
1645 case ICMP_REDIRECT:
1646 icmp_redirect_v4(mp, ipha, icmph, ira);
1647 break;
1648 case ICMP_DEST_UNREACHABLE:
1649 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) {
1650 /* Update DCE and adjust MTU is icmp header if needed */
1651 icmp_inbound_too_big_v4(icmph, ira);
1652 }
1653 /* FALLTHROUGH */
1654 default:
1655 icmp_inbound_error_fanout_v4(mp, icmph, ira);
1656 break;
1657 }
1658 return (mp_ret);
1659 }
1660
1661 /*
1662 * Send an ICMP echo, timestamp or address mask reply.
1663 * The caller has already updated the payload part of the packet.
1664 * We handle the ICMP checksum, IP source address selection and feed
1665 * the packet into ip_output_simple.
1666 */
1667 static void
1668 icmp_send_reply_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph,
1669 ip_recv_attr_t *ira)
1670 {
1671 uint_t ip_hdr_length = ira->ira_ip_hdr_length;
1672 ill_t *ill = ira->ira_ill;
1673 ip_stack_t *ipst = ill->ill_ipst;
1674 ip_xmit_attr_t ixas;
1675
1676 /* Send out an ICMP packet */
1677 icmph->icmph_checksum = 0;
1678 icmph->icmph_checksum = IP_CSUM(mp, ip_hdr_length, 0);
1679 /* Reset time to live. */
1680 ipha->ipha_ttl = ipst->ips_ip_def_ttl;
1681 {
1682 /* Swap source and destination addresses */
1683 ipaddr_t tmp;
1684
1685 tmp = ipha->ipha_src;
1686 ipha->ipha_src = ipha->ipha_dst;
1687 ipha->ipha_dst = tmp;
1688 }
1689 ipha->ipha_ident = 0;
1690 if (!IS_SIMPLE_IPH(ipha))
1691 icmp_options_update(ipha);
1692
1693 bzero(&ixas, sizeof (ixas));
1694 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
1695 ixas.ixa_zoneid = ira->ira_zoneid;
1696 ixas.ixa_cred = kcred;
1697 ixas.ixa_cpid = NOPID;
1698 ixas.ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */
1699 ixas.ixa_ifindex = 0;
1700 ixas.ixa_ipst = ipst;
1701 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1702
1703 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
1704 /*
1705 * This packet should go out the same way as it
1706 * came in i.e in clear, independent of the IPsec policy
1707 * for transmitting packets.
1708 */
1709 ixas.ixa_flags |= IXAF_NO_IPSEC;
1710 } else {
1711 if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) {
1712 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1713 /* Note: mp already consumed and ip_drop_packet done */
1714 return;
1715 }
1716 }
1717 if (ira->ira_flags & IRAF_MULTIBROADCAST) {
1718 /*
1719 * Not one or our addresses (IRE_LOCALs), thus we let
1720 * ip_output_simple pick the source.
1721 */
1722 ipha->ipha_src = INADDR_ANY;
1723 ixas.ixa_flags |= IXAF_SET_SOURCE;
1724 }
1725 /* Should we send with DF and use dce_pmtu? */
1726 if (ipst->ips_ipv4_icmp_return_pmtu) {
1727 ixas.ixa_flags |= IXAF_PMTU_DISCOVERY;
1728 ipha->ipha_fragment_offset_and_flags |= IPH_DF_HTONS;
1729 }
1730
1731 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs);
1732
1733 (void) ip_output_simple(mp, &ixas);
1734 ixa_cleanup(&ixas);
1735 }
1736
1737 /*
1738 * Verify the ICMP messages for either for ICMP error or redirect packet.
1739 * The caller should have fully pulled up the message. If it's a redirect
1740 * packet, only basic checks on IP header will be done; otherwise, verify
1741 * the packet by looking at the included ULP header.
1742 *
1743 * Called before icmp_inbound_error_fanout_v4 is called.
1744 */
1745 static boolean_t
1746 icmp_inbound_verify_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira)
1747 {
1748 ill_t *ill = ira->ira_ill;
1749 int hdr_length;
1750 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
1751 conn_t *connp;
1752 ipha_t *ipha; /* Inner IP header */
1753
1754 ipha = (ipha_t *)&icmph[1];
1755 if ((uchar_t *)ipha + IP_SIMPLE_HDR_LENGTH > mp->b_wptr)
1756 goto truncated;
1757
1758 hdr_length = IPH_HDR_LENGTH(ipha);
1759
1760 if ((IPH_HDR_VERSION(ipha) != IPV4_VERSION))
1761 goto discard_pkt;
1762
1763 if (hdr_length < sizeof (ipha_t))
1764 goto truncated;
1765
1766 if ((uchar_t *)ipha + hdr_length > mp->b_wptr)
1767 goto truncated;
1768
1769 /*
1770 * Stop here for ICMP_REDIRECT.
1771 */
1772 if (icmph->icmph_type == ICMP_REDIRECT)
1773 return (B_TRUE);
1774
1775 /*
1776 * ICMP errors only.
1777 */
1778 switch (ipha->ipha_protocol) {
1779 case IPPROTO_UDP:
1780 /*
1781 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1782 * transport header.
1783 */
1784 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1785 mp->b_wptr)
1786 goto truncated;
1787 break;
1788 case IPPROTO_TCP: {
1789 tcpha_t *tcpha;
1790
1791 /*
1792 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1793 * transport header.
1794 */
1795 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1796 mp->b_wptr)
1797 goto truncated;
1798
1799 tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length);
1800 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN,
1801 ipst);
1802 if (connp == NULL)
1803 goto discard_pkt;
1804
1805 if ((connp->conn_verifyicmp != NULL) &&
1806 !connp->conn_verifyicmp(connp, tcpha, icmph, NULL, ira)) {
1807 CONN_DEC_REF(connp);
1808 goto discard_pkt;
1809 }
1810 CONN_DEC_REF(connp);
1811 break;
1812 }
1813 case IPPROTO_SCTP:
1814 /*
1815 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1816 * transport header.
1817 */
1818 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1819 mp->b_wptr)
1820 goto truncated;
1821 break;
1822 case IPPROTO_ESP:
1823 case IPPROTO_AH:
1824 break;
1825 case IPPROTO_ENCAP:
1826 if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) >
1827 mp->b_wptr)
1828 goto truncated;
1829 break;
1830 default:
1831 break;
1832 }
1833
1834 return (B_TRUE);
1835
1836 discard_pkt:
1837 /* Bogus ICMP error. */
1838 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1839 return (B_FALSE);
1840
1841 truncated:
1842 /* We pulled up everthing already. Must be truncated */
1843 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
1844 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
1845 return (B_FALSE);
1846 }
1847
1848 /* Table from RFC 1191 */
1849 static int icmp_frag_size_table[] =
1850 { 32000, 17914, 8166, 4352, 2002, 1496, 1006, 508, 296, 68 };
1851
1852 /*
1853 * Process received ICMP Packet too big.
1854 * Just handles the DCE create/update, including using the above table of
1855 * PMTU guesses. The caller is responsible for validating the packet before
1856 * passing it in and also to fanout the ICMP error to any matching transport
1857 * conns. Assumes the message has been fully pulled up and verified.
1858 *
1859 * Before getting here, the caller has called icmp_inbound_verify_v4()
1860 * that should have verified with ULP to prevent undoing the changes we're
1861 * going to make to DCE. For example, TCP might have verified that the packet
1862 * which generated error is in the send window.
1863 *
1864 * In some cases modified this MTU in the ICMP header packet; the caller
1865 * should pass to the matching ULP after this returns.
1866 */
1867 static void
1868 icmp_inbound_too_big_v4(icmph_t *icmph, ip_recv_attr_t *ira)
1869 {
1870 dce_t *dce;
1871 int old_mtu;
1872 int mtu, orig_mtu;
1873 ipaddr_t dst;
1874 boolean_t disable_pmtud;
1875 ill_t *ill = ira->ira_ill;
1876 ip_stack_t *ipst = ill->ill_ipst;
1877 uint_t hdr_length;
1878 ipha_t *ipha;
1879
1880 /* Caller already pulled up everything. */
1881 ipha = (ipha_t *)&icmph[1];
1882 ASSERT(icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
1883 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED);
1884 ASSERT(ill != NULL);
1885
1886 hdr_length = IPH_HDR_LENGTH(ipha);
1887
1888 /*
1889 * We handle path MTU for source routed packets since the DCE
1890 * is looked up using the final destination.
1891 */
1892 dst = ip_get_dst(ipha);
1893
1894 dce = dce_lookup_and_add_v4(dst, ipst);
1895 if (dce == NULL) {
1896 /* Couldn't add a unique one - ENOMEM */
1897 ip1dbg(("icmp_inbound_too_big_v4: no dce for 0x%x\n",
1898 ntohl(dst)));
1899 return;
1900 }
1901
1902 /* Check for MTU discovery advice as described in RFC 1191 */
1903 mtu = ntohs(icmph->icmph_du_mtu);
1904 orig_mtu = mtu;
1905 disable_pmtud = B_FALSE;
1906
1907 mutex_enter(&dce->dce_lock);
1908 if (dce->dce_flags & DCEF_PMTU)
1909 old_mtu = dce->dce_pmtu;
1910 else
1911 old_mtu = ill->ill_mtu;
1912
1913 if (icmph->icmph_du_zero != 0 || mtu < ipst->ips_ip_pmtu_min) {
1914 uint32_t length;
1915 int i;
1916
1917 /*
1918 * Use the table from RFC 1191 to figure out
1919 * the next "plateau" based on the length in
1920 * the original IP packet.
1921 */
1922 length = ntohs(ipha->ipha_length);
1923 DTRACE_PROBE2(ip4__pmtu__guess, dce_t *, dce,
1924 uint32_t, length);
1925 if (old_mtu <= length &&
1926 old_mtu >= length - hdr_length) {
1927 /*
1928 * Handle broken BSD 4.2 systems that
1929 * return the wrong ipha_length in ICMP
1930 * errors.
1931 */
1932 ip1dbg(("Wrong mtu: sent %d, dce %d\n",
1933 length, old_mtu));
1934 length -= hdr_length;
1935 }
1936 for (i = 0; i < A_CNT(icmp_frag_size_table); i++) {
1937 if (length > icmp_frag_size_table[i])
1938 break;
1939 }
1940 if (i == A_CNT(icmp_frag_size_table)) {
1941 /* Smaller than IP_MIN_MTU! */
1942 ip1dbg(("Too big for packet size %d\n",
1943 length));
1944 disable_pmtud = B_TRUE;
1945 mtu = ipst->ips_ip_pmtu_min;
1946 } else {
1947 mtu = icmp_frag_size_table[i];
1948 ip1dbg(("Calculated mtu %d, packet size %d, "
1949 "before %d\n", mtu, length, old_mtu));
1950 if (mtu < ipst->ips_ip_pmtu_min) {
1951 mtu = ipst->ips_ip_pmtu_min;
1952 disable_pmtud = B_TRUE;
1953 }
1954 }
1955 }
1956 if (disable_pmtud)
1957 dce->dce_flags |= DCEF_TOO_SMALL_PMTU;
1958 else
1959 dce->dce_flags &= ~DCEF_TOO_SMALL_PMTU;
1960
1961 dce->dce_pmtu = MIN(old_mtu, mtu);
1962 /* Prepare to send the new max frag size for the ULP. */
1963 icmph->icmph_du_zero = 0;
1964 icmph->icmph_du_mtu = htons((uint16_t)dce->dce_pmtu);
1965 DTRACE_PROBE4(ip4__pmtu__change, icmph_t *, icmph, dce_t *,
1966 dce, int, orig_mtu, int, mtu);
1967
1968 /* We now have a PMTU for sure */
1969 dce->dce_flags |= DCEF_PMTU;
1970 dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64());
1971 mutex_exit(&dce->dce_lock);
1972 /*
1973 * After dropping the lock the new value is visible to everyone.
1974 * Then we bump the generation number so any cached values reinspect
1975 * the dce_t.
1976 */
1977 dce_increment_generation(dce);
1978 dce_refrele(dce);
1979 }
1980
1981 /*
1982 * If the packet in error is Self-Encapsulated, icmp_inbound_error_fanout_v4
1983 * calls this function.
1984 */
1985 static mblk_t *
1986 icmp_inbound_self_encap_error_v4(mblk_t *mp, ipha_t *ipha, ipha_t *in_ipha)
1987 {
1988 int length;
1989
1990 ASSERT(mp->b_datap->db_type == M_DATA);
1991
1992 /* icmp_inbound_v4 has already pulled up the whole error packet */
1993 ASSERT(mp->b_cont == NULL);
1994
1995 /*
1996 * The length that we want to overlay is the inner header
1997 * and what follows it.
1998 */
1999 length = msgdsize(mp) - ((uchar_t *)in_ipha - mp->b_rptr);
2000
2001 /*
2002 * Overlay the inner header and whatever follows it over the
2003 * outer header.
2004 */
2005 bcopy((uchar_t *)in_ipha, (uchar_t *)ipha, length);
2006
2007 /* Adjust for what we removed */
2008 mp->b_wptr -= (uchar_t *)in_ipha - (uchar_t *)ipha;
2009 return (mp);
2010 }
2011
2012 /*
2013 * Try to pass the ICMP message upstream in case the ULP cares.
2014 *
2015 * If the packet that caused the ICMP error is secure, we send
2016 * it to AH/ESP to make sure that the attached packet has a
2017 * valid association. ipha in the code below points to the
2018 * IP header of the packet that caused the error.
2019 *
2020 * For IPsec cases, we let the next-layer-up (which has access to
2021 * cached policy on the conn_t, or can query the SPD directly)
2022 * subtract out any IPsec overhead if they must. We therefore make no
2023 * adjustments here for IPsec overhead.
2024 *
2025 * IFN could have been generated locally or by some router.
2026 *
2027 * LOCAL : ire_send_wire (before calling ipsec_out_process) can call
2028 * icmp_frag_needed/icmp_pkt2big_v6 to generated a local IFN.
2029 * This happens because IP adjusted its value of MTU on an
2030 * earlier IFN message and could not tell the upper layer,
2031 * the new adjusted value of MTU e.g. Packet was encrypted
2032 * or there was not enough information to fanout to upper
2033 * layers. Thus on the next outbound datagram, ire_send_wire
2034 * generates the IFN, where IPsec processing has *not* been
2035 * done.
2036 *
2037 * Note that we retain ixa_fragsize across IPsec thus once
2038 * we have picking ixa_fragsize and entered ipsec_out_process we do
2039 * no change the fragsize even if the path MTU changes before
2040 * we reach ip_output_post_ipsec.
2041 *
2042 * In the local case, IRAF_LOOPBACK will be set indicating
2043 * that IFN was generated locally.
2044 *
2045 * ROUTER : IFN could be secure or non-secure.
2046 *
2047 * * SECURE : We use the IPSEC_IN to fanout to AH/ESP if the
2048 * packet in error has AH/ESP headers to validate the AH/ESP
2049 * headers. AH/ESP will verify whether there is a valid SA or
2050 * not and send it back. We will fanout again if we have more
2051 * data in the packet.
2052 *
2053 * If the packet in error does not have AH/ESP, we handle it
2054 * like any other case.
2055 *
2056 * * NON_SECURE : If the packet in error has AH/ESP headers, we send it
2057 * up to AH/ESP for validation. AH/ESP will verify whether there is a
2058 * valid SA or not and send it back. We will fanout again if
2059 * we have more data in the packet.
2060 *
2061 * If the packet in error does not have AH/ESP, we handle it
2062 * like any other case.
2063 *
2064 * The caller must have called icmp_inbound_verify_v4.
2065 */
2066 static void
2067 icmp_inbound_error_fanout_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira)
2068 {
2069 uint16_t *up; /* Pointer to ports in ULP header */
2070 uint32_t ports; /* reversed ports for fanout */
2071 ipha_t ripha; /* With reversed addresses */
2072 ipha_t *ipha; /* Inner IP header */
2073 uint_t hdr_length; /* Inner IP header length */
2074 tcpha_t *tcpha;
2075 conn_t *connp;
2076 ill_t *ill = ira->ira_ill;
2077 ip_stack_t *ipst = ill->ill_ipst;
2078 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
2079 ill_t *rill = ira->ira_rill;
2080
2081 /* Caller already pulled up everything. */
2082 ipha = (ipha_t *)&icmph[1];
2083 ASSERT((uchar_t *)&ipha[1] <= mp->b_wptr);
2084 ASSERT(mp->b_cont == NULL);
2085
2086 hdr_length = IPH_HDR_LENGTH(ipha);
2087 ira->ira_protocol = ipha->ipha_protocol;
2088
2089 /*
2090 * We need a separate IP header with the source and destination
2091 * addresses reversed to do fanout/classification because the ipha in
2092 * the ICMP error is in the form we sent it out.
2093 */
2094 ripha.ipha_src = ipha->ipha_dst;
2095 ripha.ipha_dst = ipha->ipha_src;
2096 ripha.ipha_protocol = ipha->ipha_protocol;
2097 ripha.ipha_version_and_hdr_length = ipha->ipha_version_and_hdr_length;
2098
2099 ip2dbg(("icmp_inbound_error_v4: proto %d %x to %x: %d/%d\n",
2100 ripha.ipha_protocol, ntohl(ipha->ipha_src),
2101 ntohl(ipha->ipha_dst),
2102 icmph->icmph_type, icmph->icmph_code));
2103
2104 switch (ipha->ipha_protocol) {
2105 case IPPROTO_UDP:
2106 up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2107
2108 /* Attempt to find a client stream based on port. */
2109 ip2dbg(("icmp_inbound_error_v4: UDP ports %d to %d\n",
2110 ntohs(up[0]), ntohs(up[1])));
2111
2112 /* Note that we send error to all matches. */
2113 ira->ira_flags |= IRAF_ICMP_ERROR;
2114 ip_fanout_udp_multi_v4(mp, &ripha, up[0], up[1], ira);
2115 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2116 return;
2117
2118 case IPPROTO_TCP:
2119 /*
2120 * Find a TCP client stream for this packet.
2121 * Note that we do a reverse lookup since the header is
2122 * in the form we sent it out.
2123 */
2124 tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length);
2125 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN,
2126 ipst);
2127 if (connp == NULL)
2128 goto discard_pkt;
2129
2130 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2131 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
2132 mp = ipsec_check_inbound_policy(mp, connp,
2133 ipha, NULL, ira);
2134 if (mp == NULL) {
2135 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2136 /* Note that mp is NULL */
2137 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2138 CONN_DEC_REF(connp);
2139 return;
2140 }
2141 }
2142
2143 ira->ira_flags |= IRAF_ICMP_ERROR;
2144 ira->ira_ill = ira->ira_rill = NULL;
2145 if (IPCL_IS_TCP(connp)) {
2146 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2147 connp->conn_recvicmp, connp, ira, SQ_FILL,
2148 SQTAG_TCP_INPUT_ICMP_ERR);
2149 } else {
2150 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2151 (connp->conn_recv)(connp, mp, NULL, ira);
2152 CONN_DEC_REF(connp);
2153 }
2154 ira->ira_ill = ill;
2155 ira->ira_rill = rill;
2156 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2157 return;
2158
2159 case IPPROTO_SCTP:
2160 up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2161 /* Find a SCTP client stream for this packet. */
2162 ((uint16_t *)&ports)[0] = up[1];
2163 ((uint16_t *)&ports)[1] = up[0];
2164
2165 ira->ira_flags |= IRAF_ICMP_ERROR;
2166 ip_fanout_sctp(mp, &ripha, NULL, ports, ira);
2167 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2168 return;
2169
2170 case IPPROTO_ESP:
2171 case IPPROTO_AH:
2172 if (!ipsec_loaded(ipss)) {
2173 ip_proto_not_sup(mp, ira);
2174 return;
2175 }
2176
2177 if (ipha->ipha_protocol == IPPROTO_ESP)
2178 mp = ipsecesp_icmp_error(mp, ira);
2179 else
2180 mp = ipsecah_icmp_error(mp, ira);
2181 if (mp == NULL)
2182 return;
2183
2184 /* Just in case ipsec didn't preserve the NULL b_cont */
2185 if (mp->b_cont != NULL) {
2186 if (!pullupmsg(mp, -1))
2187 goto discard_pkt;
2188 }
2189
2190 /*
2191 * Note that ira_pktlen and ira_ip_hdr_length are no longer
2192 * correct, but we don't use them any more here.
2193 *
2194 * If succesful, the mp has been modified to not include
2195 * the ESP/AH header so we can fanout to the ULP's icmp
2196 * error handler.
2197 */
2198 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH)
2199 goto truncated;
2200
2201 /* Verify the modified message before any further processes. */
2202 ipha = (ipha_t *)mp->b_rptr;
2203 hdr_length = IPH_HDR_LENGTH(ipha);
2204 icmph = (icmph_t *)&mp->b_rptr[hdr_length];
2205 if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
2206 freemsg(mp);
2207 return;
2208 }
2209
2210 icmp_inbound_error_fanout_v4(mp, icmph, ira);
2211 return;
2212
2213 case IPPROTO_ENCAP: {
2214 /* Look for self-encapsulated packets that caused an error */
2215 ipha_t *in_ipha;
2216
2217 /*
2218 * Caller has verified that length has to be
2219 * at least the size of IP header.
2220 */
2221 ASSERT(hdr_length >= sizeof (ipha_t));
2222 /*
2223 * Check the sanity of the inner IP header like
2224 * we did for the outer header.
2225 */
2226 in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length);
2227 if ((IPH_HDR_VERSION(in_ipha) != IPV4_VERSION)) {
2228 goto discard_pkt;
2229 }
2230 if (IPH_HDR_LENGTH(in_ipha) < sizeof (ipha_t)) {
2231 goto discard_pkt;
2232 }
2233 /* Check for Self-encapsulated tunnels */
2234 if (in_ipha->ipha_src == ipha->ipha_src &&
2235 in_ipha->ipha_dst == ipha->ipha_dst) {
2236
2237 mp = icmp_inbound_self_encap_error_v4(mp, ipha,
2238 in_ipha);
2239 if (mp == NULL)
2240 goto discard_pkt;
2241
2242 /*
2243 * Just in case self_encap didn't preserve the NULL
2244 * b_cont
2245 */
2246 if (mp->b_cont != NULL) {
2247 if (!pullupmsg(mp, -1))
2248 goto discard_pkt;
2249 }
2250 /*
2251 * Note that ira_pktlen and ira_ip_hdr_length are no
2252 * longer correct, but we don't use them any more here.
2253 */
2254 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH)
2255 goto truncated;
2256
2257 /*
2258 * Verify the modified message before any further
2259 * processes.
2260 */
2261 ipha = (ipha_t *)mp->b_rptr;
2262 hdr_length = IPH_HDR_LENGTH(ipha);
2263 icmph = (icmph_t *)&mp->b_rptr[hdr_length];
2264 if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
2265 freemsg(mp);
2266 return;
2267 }
2268
2269 /*
2270 * The packet in error is self-encapsualted.
2271 * And we are finding it further encapsulated
2272 * which we could not have possibly generated.
2273 */
2274 if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2275 goto discard_pkt;
2276 }
2277 icmp_inbound_error_fanout_v4(mp, icmph, ira);
2278 return;
2279 }
2280 /* No self-encapsulated */
2281 }
2282 /* FALLTHROUGH */
2283 case IPPROTO_IPV6:
2284 if ((connp = ipcl_iptun_classify_v4(&ripha.ipha_src,
2285 &ripha.ipha_dst, ipst)) != NULL) {
2286 ira->ira_flags |= IRAF_ICMP_ERROR;
2287 connp->conn_recvicmp(connp, mp, NULL, ira);
2288 CONN_DEC_REF(connp);
2289 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2290 return;
2291 }
2292 /*
2293 * No IP tunnel is interested, fallthrough and see
2294 * if a raw socket will want it.
2295 */
2296 /* FALLTHROUGH */
2297 default:
2298 ira->ira_flags |= IRAF_ICMP_ERROR;
2299 ip_fanout_proto_v4(mp, &ripha, ira);
2300 ira->ira_flags &= ~IRAF_ICMP_ERROR;
2301 return;
2302 }
2303 /* NOTREACHED */
2304 discard_pkt:
2305 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2306 ip1dbg(("icmp_inbound_error_fanout_v4: drop pkt\n"));
2307 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2308 freemsg(mp);
2309 return;
2310
2311 truncated:
2312 /* We pulled up everthing already. Must be truncated */
2313 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2314 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2315 freemsg(mp);
2316 }
2317
2318 /*
2319 * Common IP options parser.
2320 *
2321 * Setup routine: fill in *optp with options-parsing state, then
2322 * tail-call ipoptp_next to return the first option.
2323 */
2324 uint8_t
2325 ipoptp_first(ipoptp_t *optp, ipha_t *ipha)
2326 {
2327 uint32_t totallen; /* total length of all options */
2328
2329 totallen = ipha->ipha_version_and_hdr_length -
2330 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
2331 totallen <<= 2;
2332 optp->ipoptp_next = (uint8_t *)(&ipha[1]);
2333 optp->ipoptp_end = optp->ipoptp_next + totallen;
2334 optp->ipoptp_flags = 0;
2335 return (ipoptp_next(optp));
2336 }
2337
2338 /* Like above but without an ipha_t */
2339 uint8_t
2340 ipoptp_first2(ipoptp_t *optp, uint32_t totallen, uint8_t *opt)
2341 {
2342 optp->ipoptp_next = opt;
2343 optp->ipoptp_end = optp->ipoptp_next + totallen;
2344 optp->ipoptp_flags = 0;
2345 return (ipoptp_next(optp));
2346 }
2347
2348 /*
2349 * Common IP options parser: extract next option.
2350 */
2351 uint8_t
2352 ipoptp_next(ipoptp_t *optp)
2353 {
2354 uint8_t *end = optp->ipoptp_end;
2355 uint8_t *cur = optp->ipoptp_next;
2356 uint8_t opt, len, pointer;
2357
2358 /*
2359 * If cur > end already, then the ipoptp_end or ipoptp_next pointer
2360 * has been corrupted.
2361 */
2362 ASSERT(cur <= end);
2363
2364 if (cur == end)
2365 return (IPOPT_EOL);
2366
2367 opt = cur[IPOPT_OPTVAL];
2368
2369 /*
2370 * Skip any NOP options.
2371 */
2372 while (opt == IPOPT_NOP) {
2373 cur++;
2374 if (cur == end)
2375 return (IPOPT_EOL);
2376 opt = cur[IPOPT_OPTVAL];
2377 }
2378
2379 if (opt == IPOPT_EOL)
2380 return (IPOPT_EOL);
2381
2382 /*
2383 * Option requiring a length.
2384 */
2385 if ((cur + 1) >= end) {
2386 optp->ipoptp_flags |= IPOPTP_ERROR;
2387 return (IPOPT_EOL);
2388 }
2389 len = cur[IPOPT_OLEN];
2390 if (len < 2) {
2391 optp->ipoptp_flags |= IPOPTP_ERROR;
2392 return (IPOPT_EOL);
2393 }
2394 optp->ipoptp_cur = cur;
2395 optp->ipoptp_len = len;
2396 optp->ipoptp_next = cur + len;
2397 if (cur + len > end) {
2398 optp->ipoptp_flags |= IPOPTP_ERROR;
2399 return (IPOPT_EOL);
2400 }
2401
2402 /*
2403 * For the options which require a pointer field, make sure
2404 * its there, and make sure it points to either something
2405 * inside this option, or the end of the option.
2406 */
2407 pointer = IPOPT_EOL;
2408 switch (opt) {
2409 case IPOPT_RR:
2410 case IPOPT_TS:
2411 case IPOPT_LSRR:
2412 case IPOPT_SSRR:
2413 if (len <= IPOPT_OFFSET) {
2414 optp->ipoptp_flags |= IPOPTP_ERROR;
2415 return (opt);
2416 }
2417 pointer = cur[IPOPT_OFFSET];
2418 if (pointer - 1 > len) {
2419 optp->ipoptp_flags |= IPOPTP_ERROR;
2420 return (opt);
2421 }
2422 break;
2423 }
2424
2425 /*
2426 * Sanity check the pointer field based on the type of the
2427 * option.
2428 */
2429 switch (opt) {
2430 case IPOPT_RR:
2431 case IPOPT_SSRR:
2432 case IPOPT_LSRR:
2433 if (pointer < IPOPT_MINOFF_SR)
2434 optp->ipoptp_flags |= IPOPTP_ERROR;
2435 break;
2436 case IPOPT_TS:
2437 if (pointer < IPOPT_MINOFF_IT)
2438 optp->ipoptp_flags |= IPOPTP_ERROR;
2439 /*
2440 * Note that the Internet Timestamp option also
2441 * contains two four bit fields (the Overflow field,
2442 * and the Flag field), which follow the pointer
2443 * field. We don't need to check that these fields
2444 * fall within the length of the option because this
2445 * was implicitely done above. We've checked that the
2446 * pointer value is at least IPOPT_MINOFF_IT, and that
2447 * it falls within the option. Since IPOPT_MINOFF_IT >
2448 * IPOPT_POS_OV_FLG, we don't need the explicit check.
2449 */
2450 ASSERT(len > IPOPT_POS_OV_FLG);
2451 break;
2452 }
2453
2454 return (opt);
2455 }
2456
2457 /*
2458 * Use the outgoing IP header to create an IP_OPTIONS option the way
2459 * it was passed down from the application.
2460 *
2461 * This is compatible with BSD in that it returns
2462 * the reverse source route with the final destination
2463 * as the last entry. The first 4 bytes of the option
2464 * will contain the final destination.
2465 */
2466 int
2467 ip_opt_get_user(conn_t *connp, uchar_t *buf)
2468 {
2469 ipoptp_t opts;
2470 uchar_t *opt;
2471 uint8_t optval;
2472 uint8_t optlen;
2473 uint32_t len = 0;
2474 uchar_t *buf1 = buf;
2475 uint32_t totallen;
2476 ipaddr_t dst;
2477 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
2478
2479 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
2480 return (0);
2481
2482 totallen = ipp->ipp_ipv4_options_len;
2483 if (totallen & 0x3)
2484 return (0);
2485
2486 buf += IP_ADDR_LEN; /* Leave room for final destination */
2487 len += IP_ADDR_LEN;
2488 bzero(buf1, IP_ADDR_LEN);
2489
2490 dst = connp->conn_faddr_v4;
2491
2492 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
2493 optval != IPOPT_EOL;
2494 optval = ipoptp_next(&opts)) {
2495 int off;
2496
2497 opt = opts.ipoptp_cur;
2498 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
2499 break;
2500 }
2501 optlen = opts.ipoptp_len;
2502
2503 switch (optval) {
2504 case IPOPT_SSRR:
2505 case IPOPT_LSRR:
2506
2507 /*
2508 * Insert destination as the first entry in the source
2509 * route and move down the entries on step.
2510 * The last entry gets placed at buf1.
2511 */
2512 buf[IPOPT_OPTVAL] = optval;
2513 buf[IPOPT_OLEN] = optlen;
2514 buf[IPOPT_OFFSET] = optlen;
2515
2516 off = optlen - IP_ADDR_LEN;
2517 if (off < 0) {
2518 /* No entries in source route */
2519 break;
2520 }
2521 /* Last entry in source route if not already set */
2522 if (dst == INADDR_ANY)
2523 bcopy(opt + off, buf1, IP_ADDR_LEN);
2524 off -= IP_ADDR_LEN;
2525
2526 while (off > 0) {
2527 bcopy(opt + off,
2528 buf + off + IP_ADDR_LEN,
2529 IP_ADDR_LEN);
2530 off -= IP_ADDR_LEN;
2531 }
2532 /* ipha_dst into first slot */
2533 bcopy(&dst, buf + off + IP_ADDR_LEN,
2534 IP_ADDR_LEN);
2535 buf += optlen;
2536 len += optlen;
2537 break;
2538
2539 default:
2540 bcopy(opt, buf, optlen);
2541 buf += optlen;
2542 len += optlen;
2543 break;
2544 }
2545 }
2546 done:
2547 /* Pad the resulting options */
2548 while (len & 0x3) {
2549 *buf++ = IPOPT_EOL;
2550 len++;
2551 }
2552 return (len);
2553 }
2554
2555 /*
2556 * Update any record route or timestamp options to include this host.
2557 * Reverse any source route option.
2558 * This routine assumes that the options are well formed i.e. that they
2559 * have already been checked.
2560 */
2561 static void
2562 icmp_options_update(ipha_t *ipha)
2563 {
2564 ipoptp_t opts;
2565 uchar_t *opt;
2566 uint8_t optval;
2567 ipaddr_t src; /* Our local address */
2568 ipaddr_t dst;
2569
2570 ip2dbg(("icmp_options_update\n"));
2571 src = ipha->ipha_src;
2572 dst = ipha->ipha_dst;
2573
2574 for (optval = ipoptp_first(&opts, ipha);
2575 optval != IPOPT_EOL;
2576 optval = ipoptp_next(&opts)) {
2577 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
2578 opt = opts.ipoptp_cur;
2579 ip2dbg(("icmp_options_update: opt %d, len %d\n",
2580 optval, opts.ipoptp_len));
2581 switch (optval) {
2582 int off1, off2;
2583 case IPOPT_SSRR:
2584 case IPOPT_LSRR:
2585 /*
2586 * Reverse the source route. The first entry
2587 * should be the next to last one in the current
2588 * source route (the last entry is our address).
2589 * The last entry should be the final destination.
2590 */
2591 off1 = IPOPT_MINOFF_SR - 1;
2592 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
2593 if (off2 < 0) {
2594 /* No entries in source route */
2595 ip1dbg((
2596 "icmp_options_update: bad src route\n"));
2597 break;
2598 }
2599 bcopy((char *)opt + off2, &dst, IP_ADDR_LEN);
2600 bcopy(&ipha->ipha_dst, (char *)opt + off2, IP_ADDR_LEN);
2601 bcopy(&dst, &ipha->ipha_dst, IP_ADDR_LEN);
2602 off2 -= IP_ADDR_LEN;
2603
2604 while (off1 < off2) {
2605 bcopy((char *)opt + off1, &src, IP_ADDR_LEN);
2606 bcopy((char *)opt + off2, (char *)opt + off1,
2607 IP_ADDR_LEN);
2608 bcopy(&src, (char *)opt + off2, IP_ADDR_LEN);
2609 off1 += IP_ADDR_LEN;
2610 off2 -= IP_ADDR_LEN;
2611 }
2612 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
2613 break;
2614 }
2615 }
2616 }
2617
2618 /*
2619 * Process received ICMP Redirect messages.
2620 * Assumes the caller has verified that the headers are in the pulled up mblk.
2621 * Consumes mp.
2622 */
2623 static void
2624 icmp_redirect_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph, ip_recv_attr_t *ira)
2625 {
2626 ire_t *ire, *nire;
2627 ire_t *prev_ire;
2628 ipaddr_t src, dst, gateway;
2629 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2630 ipha_t *inner_ipha; /* Inner IP header */
2631
2632 /* Caller already pulled up everything. */
2633 inner_ipha = (ipha_t *)&icmph[1];
2634 src = ipha->ipha_src;
2635 dst = inner_ipha->ipha_dst;
2636 gateway = icmph->icmph_rd_gateway;
2637 /* Make sure the new gateway is reachable somehow. */
2638 ire = ire_ftable_lookup_v4(gateway, 0, 0, IRE_ONLINK, NULL,
2639 ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
2640 /*
2641 * Make sure we had a route for the dest in question and that
2642 * that route was pointing to the old gateway (the source of the
2643 * redirect packet.)
2644 * We do longest match and then compare ire_gateway_addr below.
2645 */
2646 prev_ire = ire_ftable_lookup_v4(dst, 0, 0, 0, NULL, ALL_ZONES,
2647 NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
2648 /*
2649 * Check that
2650 * the redirect was not from ourselves
2651 * the new gateway and the old gateway are directly reachable
2652 */
2653 if (prev_ire == NULL || ire == NULL ||
2654 (prev_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) ||
2655 (prev_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2656 !(ire->ire_type & IRE_IF_ALL) ||
2657 prev_ire->ire_gateway_addr != src) {
2658 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects);
2659 ip_drop_input("icmpInBadRedirects - ire", mp, ira->ira_ill);
2660 freemsg(mp);
2661 if (ire != NULL)
2662 ire_refrele(ire);
2663 if (prev_ire != NULL)
2664 ire_refrele(prev_ire);
2665 return;
2666 }
2667
2668 ire_refrele(prev_ire);
2669 ire_refrele(ire);
2670
2671 /*
2672 * TODO: more precise handling for cases 0, 2, 3, the latter two
2673 * require TOS routing
2674 */
2675 switch (icmph->icmph_code) {
2676 case 0:
2677 case 1:
2678 /* TODO: TOS specificity for cases 2 and 3 */
2679 case 2:
2680 case 3:
2681 break;
2682 default:
2683 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects);
2684 ip_drop_input("icmpInBadRedirects - code", mp, ira->ira_ill);
2685 freemsg(mp);
2686 return;
2687 }
2688 /*
2689 * Create a Route Association. This will allow us to remember that
2690 * someone we believe told us to use the particular gateway.
2691 */
2692 ire = ire_create(
2693 (uchar_t *)&dst, /* dest addr */
2694 (uchar_t *)&ip_g_all_ones, /* mask */
2695 (uchar_t *)&gateway, /* gateway addr */
2696 IRE_HOST,
2697 NULL, /* ill */
2698 ALL_ZONES,
2699 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
2700 NULL, /* tsol_gc_t */
2701 ipst);
2702
2703 if (ire == NULL) {
2704 freemsg(mp);
2705 return;
2706 }
2707 nire = ire_add(ire);
2708 /* Check if it was a duplicate entry */
2709 if (nire != NULL && nire != ire) {
2710 ASSERT(nire->ire_identical_ref > 1);
2711 ire_delete(nire);
2712 ire_refrele(nire);
2713 nire = NULL;
2714 }
2715 ire = nire;
2716 if (ire != NULL) {
2717 ire_refrele(ire); /* Held in ire_add */
2718
2719 /* tell routing sockets that we received a redirect */
2720 ip_rts_change(RTM_REDIRECT, dst, gateway, IP_HOST_MASK, 0, src,
2721 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
2722 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR), ipst);
2723 }
2724
2725 /*
2726 * Delete any existing IRE_HOST type redirect ires for this destination.
2727 * This together with the added IRE has the effect of
2728 * modifying an existing redirect.
2729 */
2730 prev_ire = ire_ftable_lookup_v4(dst, 0, src, IRE_HOST, NULL,
2731 ALL_ZONES, NULL, (MATCH_IRE_GW | MATCH_IRE_TYPE), 0, ipst, NULL);
2732 if (prev_ire != NULL) {
2733 if (prev_ire ->ire_flags & RTF_DYNAMIC)
2734 ire_delete(prev_ire);
2735 ire_refrele(prev_ire);
2736 }
2737
2738 freemsg(mp);
2739 }
2740
2741 /*
2742 * Generate an ICMP parameter problem message.
2743 * When called from ip_output side a minimal ip_recv_attr_t needs to be
2744 * constructed by the caller.
2745 */
2746 static void
2747 icmp_param_problem(mblk_t *mp, uint8_t ptr, ip_recv_attr_t *ira)
2748 {
2749 icmph_t icmph;
2750 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2751
2752 mp = icmp_pkt_err_ok(mp, ira);
2753 if (mp == NULL)
2754 return;
2755
2756 bzero(&icmph, sizeof (icmph_t));
2757 icmph.icmph_type = ICMP_PARAM_PROBLEM;
2758 icmph.icmph_pp_ptr = ptr;
2759 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutParmProbs);
2760 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
2761 }
2762
2763 /*
2764 * Build and ship an IPv4 ICMP message using the packet data in mp, and
2765 * the ICMP header pointed to by "stuff". (May be called as writer.)
2766 * Note: assumes that icmp_pkt_err_ok has been called to verify that
2767 * an icmp error packet can be sent.
2768 * Assigns an appropriate source address to the packet. If ipha_dst is
2769 * one of our addresses use it for source. Otherwise let ip_output_simple
2770 * pick the source address.
2771 */
2772 static void
2773 icmp_pkt(mblk_t *mp, void *stuff, size_t len, ip_recv_attr_t *ira)
2774 {
2775 ipaddr_t dst;
2776 icmph_t *icmph;
2777 ipha_t *ipha;
2778 uint_t len_needed;
2779 size_t msg_len;
2780 mblk_t *mp1;
2781 ipaddr_t src;
2782 ire_t *ire;
2783 ip_xmit_attr_t ixas;
2784 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2785
2786 ipha = (ipha_t *)mp->b_rptr;
2787
2788 bzero(&ixas, sizeof (ixas));
2789 ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
2790 ixas.ixa_zoneid = ira->ira_zoneid;
2791 ixas.ixa_ifindex = 0;
2792 ixas.ixa_ipst = ipst;
2793 ixas.ixa_cred = kcred;
2794 ixas.ixa_cpid = NOPID;
2795 ixas.ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */
2796 ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
2797
2798 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2799 /*
2800 * Apply IPsec based on how IPsec was applied to
2801 * the packet that had the error.
2802 *
2803 * If it was an outbound packet that caused the ICMP
2804 * error, then the caller will have setup the IRA
2805 * appropriately.
2806 */
2807 if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) {
2808 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
2809 /* Note: mp already consumed and ip_drop_packet done */
2810 return;
2811 }
2812 } else {
2813 /*
2814 * This is in clear. The icmp message we are building
2815 * here should go out in clear, independent of our policy.
2816 */
2817 ixas.ixa_flags |= IXAF_NO_IPSEC;
2818 }
2819
2820 /* Remember our eventual destination */
2821 dst = ipha->ipha_src;
2822
2823 /*
2824 * If the packet was for one of our unicast addresses, make
2825 * sure we respond with that as the source. Otherwise
2826 * have ip_output_simple pick the source address.
2827 */
2828 ire = ire_ftable_lookup_v4(ipha->ipha_dst, 0, 0,
2829 (IRE_LOCAL|IRE_LOOPBACK), NULL, ira->ira_zoneid, NULL,
2830 MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY, 0, ipst, NULL);
2831 if (ire != NULL) {
2832 ire_refrele(ire);
2833 src = ipha->ipha_dst;
2834 } else {
2835 src = INADDR_ANY;
2836 ixas.ixa_flags |= IXAF_SET_SOURCE;
2837 }
2838
2839 /*
2840 * Check if we can send back more then 8 bytes in addition to
2841 * the IP header. We try to send 64 bytes of data and the internal
2842 * header in the special cases of ipv4 encapsulated ipv4 or ipv6.
2843 */
2844 len_needed = IPH_HDR_LENGTH(ipha);
2845 if (ipha->ipha_protocol == IPPROTO_ENCAP ||
2846 ipha->ipha_protocol == IPPROTO_IPV6) {
2847 if (!pullupmsg(mp, -1)) {
2848 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
2849 ip_drop_output("ipIfStatsOutDiscards", mp, NULL);
2850 freemsg(mp);
2851 return;
2852 }
2853 ipha = (ipha_t *)mp->b_rptr;
2854
2855 if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2856 len_needed += IPH_HDR_LENGTH(((uchar_t *)ipha +
2857 len_needed));
2858 } else {
2859 ip6_t *ip6h = (ip6_t *)((uchar_t *)ipha + len_needed);
2860
2861 ASSERT(ipha->ipha_protocol == IPPROTO_IPV6);
2862 len_needed += ip_hdr_length_v6(mp, ip6h);
2863 }
2864 }
2865 len_needed += ipst->ips_ip_icmp_return;
2866 msg_len = msgdsize(mp);
2867 if (msg_len > len_needed) {
2868 (void) adjmsg(mp, len_needed - msg_len);
2869 msg_len = len_needed;
2870 }
2871 mp1 = allocb(sizeof (icmp_ipha) + len, BPRI_MED);
2872 if (mp1 == NULL) {
2873 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutErrors);
2874 freemsg(mp);
2875 return;
2876 }
2877 mp1->b_cont = mp;
2878 mp = mp1;
2879
2880 /*
2881 * Set IXAF_TRUSTED_ICMP so we can let the ICMP messages this
2882 * node generates be accepted in peace by all on-host destinations.
2883 * If we do NOT assume that all on-host destinations trust
2884 * self-generated ICMP messages, then rework here, ip6.c, and spd.c.
2885 * (Look for IXAF_TRUSTED_ICMP).
2886 */
2887 ixas.ixa_flags |= IXAF_TRUSTED_ICMP;
2888
2889 ipha = (ipha_t *)mp->b_rptr;
2890 mp1->b_wptr = (uchar_t *)ipha + (sizeof (icmp_ipha) + len);
2891 *ipha = icmp_ipha;
2892 ipha->ipha_src = src;
2893 ipha->ipha_dst = dst;
2894 ipha->ipha_ttl = ipst->ips_ip_def_ttl;
2895 msg_len += sizeof (icmp_ipha) + len;
2896 if (msg_len > IP_MAXPACKET) {
2897 (void) adjmsg(mp, IP_MAXPACKET - msg_len);
2898 msg_len = IP_MAXPACKET;
2899 }
2900 ipha->ipha_length = htons((uint16_t)msg_len);
2901 icmph = (icmph_t *)&ipha[1];
2902 bcopy(stuff, icmph, len);
2903 icmph->icmph_checksum = 0;
2904 icmph->icmph_checksum = IP_CSUM(mp, (int32_t)sizeof (ipha_t), 0);
2905 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs);
2906
2907 (void) ip_output_simple(mp, &ixas);
2908 ixa_cleanup(&ixas);
2909 }
2910
2911 /*
2912 * Determine if an ICMP error packet can be sent given the rate limit.
2913 * The limit consists of an average frequency (icmp_pkt_err_interval measured
2914 * in milliseconds) and a burst size. Burst size number of packets can
2915 * be sent arbitrarely closely spaced.
2916 * The state is tracked using two variables to implement an approximate
2917 * token bucket filter:
2918 * icmp_pkt_err_last - lbolt value when the last burst started
2919 * icmp_pkt_err_sent - number of packets sent in current burst
2920 */
2921 boolean_t
2922 icmp_err_rate_limit(ip_stack_t *ipst)
2923 {
2924 clock_t now = TICK_TO_MSEC(ddi_get_lbolt());
2925 uint_t refilled; /* Number of packets refilled in tbf since last */
2926 /* Guard against changes by loading into local variable */
2927 uint_t err_interval = ipst->ips_ip_icmp_err_interval;
2928
2929 if (err_interval == 0)
2930 return (B_FALSE);
2931
2932 if (ipst->ips_icmp_pkt_err_last > now) {
2933 /* 100HZ lbolt in ms for 32bit arch wraps every 49.7 days */
2934 ipst->ips_icmp_pkt_err_last = 0;
2935 ipst->ips_icmp_pkt_err_sent = 0;
2936 }
2937 /*
2938 * If we are in a burst update the token bucket filter.
2939 * Update the "last" time to be close to "now" but make sure
2940 * we don't loose precision.
2941 */
2942 if (ipst->ips_icmp_pkt_err_sent != 0) {
2943 refilled = (now - ipst->ips_icmp_pkt_err_last)/err_interval;
2944 if (refilled > ipst->ips_icmp_pkt_err_sent) {
2945 ipst->ips_icmp_pkt_err_sent = 0;
2946 } else {
2947 ipst->ips_icmp_pkt_err_sent -= refilled;
2948 ipst->ips_icmp_pkt_err_last += refilled * err_interval;
2949 }
2950 }
2951 if (ipst->ips_icmp_pkt_err_sent == 0) {
2952 /* Start of new burst */
2953 ipst->ips_icmp_pkt_err_last = now;
2954 }
2955 if (ipst->ips_icmp_pkt_err_sent < ipst->ips_ip_icmp_err_burst) {
2956 ipst->ips_icmp_pkt_err_sent++;
2957 ip1dbg(("icmp_err_rate_limit: %d sent in burst\n",
2958 ipst->ips_icmp_pkt_err_sent));
2959 return (B_FALSE);
2960 }
2961 ip1dbg(("icmp_err_rate_limit: dropped\n"));
2962 return (B_TRUE);
2963 }
2964
2965 /*
2966 * Check if it is ok to send an IPv4 ICMP error packet in
2967 * response to the IPv4 packet in mp.
2968 * Free the message and return null if no
2969 * ICMP error packet should be sent.
2970 */
2971 static mblk_t *
2972 icmp_pkt_err_ok(mblk_t *mp, ip_recv_attr_t *ira)
2973 {
2974 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2975 icmph_t *icmph;
2976 ipha_t *ipha;
2977 uint_t len_needed;
2978
2979 if (!mp)
2980 return (NULL);
2981 ipha = (ipha_t *)mp->b_rptr;
2982 if (ip_csum_hdr(ipha)) {
2983 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInCksumErrs);
2984 ip_drop_input("ipIfStatsInCksumErrs", mp, NULL);
2985 freemsg(mp);
2986 return (NULL);
2987 }
2988 if (ip_type_v4(ipha->ipha_dst, ipst) == IRE_BROADCAST ||
2989 ip_type_v4(ipha->ipha_src, ipst) == IRE_BROADCAST ||
2990 CLASSD(ipha->ipha_dst) ||
2991 CLASSD(ipha->ipha_src) ||
2992 (ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET)) {
2993 /* Note: only errors to the fragment with offset 0 */
2994 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
2995 freemsg(mp);
2996 return (NULL);
2997 }
2998 if (ipha->ipha_protocol == IPPROTO_ICMP) {
2999 /*
3000 * Check the ICMP type. RFC 1122 sez: don't send ICMP
3001 * errors in response to any ICMP errors.
3002 */
3003 len_needed = IPH_HDR_LENGTH(ipha) + ICMPH_SIZE;
3004 if (mp->b_wptr - mp->b_rptr < len_needed) {
3005 if (!pullupmsg(mp, len_needed)) {
3006 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
3007 freemsg(mp);
3008 return (NULL);
3009 }
3010 ipha = (ipha_t *)mp->b_rptr;
3011 }
3012 icmph = (icmph_t *)
3013 (&((char *)ipha)[IPH_HDR_LENGTH(ipha)]);
3014 switch (icmph->icmph_type) {
3015 case ICMP_DEST_UNREACHABLE:
3016 case ICMP_SOURCE_QUENCH:
3017 case ICMP_TIME_EXCEEDED:
3018 case ICMP_PARAM_PROBLEM:
3019 case ICMP_REDIRECT:
3020 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3021 freemsg(mp);
3022 return (NULL);
3023 default:
3024 break;
3025 }
3026 }
3027 /*
3028 * If this is a labeled system, then check to see if we're allowed to
3029 * send a response to this particular sender. If not, then just drop.
3030 */
3031 if (is_system_labeled() && !tsol_can_reply_error(mp, ira)) {
3032 ip2dbg(("icmp_pkt_err_ok: can't respond to packet\n"));
3033 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3034 freemsg(mp);
3035 return (NULL);
3036 }
3037 if (icmp_err_rate_limit(ipst)) {
3038 /*
3039 * Only send ICMP error packets every so often.
3040 * This should be done on a per port/source basis,
3041 * but for now this will suffice.
3042 */
3043 freemsg(mp);
3044 return (NULL);
3045 }
3046 return (mp);
3047 }
3048
3049 /*
3050 * Called when a packet was sent out the same link that it arrived on.
3051 * Check if it is ok to send a redirect and then send it.
3052 */
3053 void
3054 ip_send_potential_redirect_v4(mblk_t *mp, ipha_t *ipha, ire_t *ire,
3055 ip_recv_attr_t *ira)
3056 {
3057 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3058 ipaddr_t src, nhop;
3059 mblk_t *mp1;
3060 ire_t *nhop_ire;
3061
3062 /*
3063 * Check the source address to see if it originated
3064 * on the same logical subnet it is going back out on.
3065 * If so, we should be able to send it a redirect.
3066 * Avoid sending a redirect if the destination
3067 * is directly connected (i.e., we matched an IRE_ONLINK),
3068 * or if the packet was source routed out this interface.
3069 *
3070 * We avoid sending a redirect if the
3071 * destination is directly connected
3072 * because it is possible that multiple
3073 * IP subnets may have been configured on
3074 * the link, and the source may not
3075 * be on the same subnet as ip destination,
3076 * even though they are on the same
3077 * physical link.
3078 */
3079 if ((ire->ire_type & IRE_ONLINK) ||
3080 ip_source_routed(ipha, ipst))
3081 return;
3082
3083 nhop_ire = ire_nexthop(ire);
3084 if (nhop_ire == NULL)
3085 return;
3086
3087 nhop = nhop_ire->ire_addr;
3088
3089 if (nhop_ire->ire_type & IRE_IF_CLONE) {
3090 ire_t *ire2;
3091
3092 /* Follow ire_dep_parent to find non-clone IRE_INTERFACE */
3093 mutex_enter(&nhop_ire->ire_lock);
3094 ire2 = nhop_ire->ire_dep_parent;
3095 if (ire2 != NULL)
3096 ire_refhold(ire2);
3097 mutex_exit(&nhop_ire->ire_lock);
3098 ire_refrele(nhop_ire);
3099 nhop_ire = ire2;
3100 }
3101 if (nhop_ire == NULL)
3102 return;
3103
3104 ASSERT(!(nhop_ire->ire_type & IRE_IF_CLONE));
3105
3106 src = ipha->ipha_src;
3107
3108 /*
3109 * We look at the interface ire for the nexthop,
3110 * to see if ipha_src is in the same subnet
3111 * as the nexthop.
3112 */
3113 if ((src & nhop_ire->ire_mask) == (nhop & nhop_ire->ire_mask)) {
3114 /*
3115 * The source is directly connected.
3116 */
3117 mp1 = copymsg(mp);
3118 if (mp1 != NULL) {
3119 icmp_send_redirect(mp1, nhop, ira);
3120 }
3121 }
3122 ire_refrele(nhop_ire);
3123 }
3124
3125 /*
3126 * Generate an ICMP redirect message.
3127 */
3128 static void
3129 icmp_send_redirect(mblk_t *mp, ipaddr_t gateway, ip_recv_attr_t *ira)
3130 {
3131 icmph_t icmph;
3132 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3133
3134 mp = icmp_pkt_err_ok(mp, ira);
3135 if (mp == NULL)
3136 return;
3137
3138 bzero(&icmph, sizeof (icmph_t));
3139 icmph.icmph_type = ICMP_REDIRECT;
3140 icmph.icmph_code = 1;
3141 icmph.icmph_rd_gateway = gateway;
3142 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutRedirects);
3143 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3144 }
3145
3146 /*
3147 * Generate an ICMP time exceeded message.
3148 */
3149 void
3150 icmp_time_exceeded(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira)
3151 {
3152 icmph_t icmph;
3153 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3154
3155 mp = icmp_pkt_err_ok(mp, ira);
3156 if (mp == NULL)
3157 return;
3158
3159 bzero(&icmph, sizeof (icmph_t));
3160 icmph.icmph_type = ICMP_TIME_EXCEEDED;
3161 icmph.icmph_code = code;
3162 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimeExcds);
3163 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3164 }
3165
3166 /*
3167 * Generate an ICMP unreachable message.
3168 * When called from ip_output side a minimal ip_recv_attr_t needs to be
3169 * constructed by the caller.
3170 */
3171 void
3172 icmp_unreachable(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira)
3173 {
3174 icmph_t icmph;
3175 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3176
3177 mp = icmp_pkt_err_ok(mp, ira);
3178 if (mp == NULL)
3179 return;
3180
3181 bzero(&icmph, sizeof (icmph_t));
3182 icmph.icmph_type = ICMP_DEST_UNREACHABLE;
3183 icmph.icmph_code = code;
3184 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs);
3185 icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3186 }
3187
3188 /*
3189 * Latch in the IPsec state for a stream based the policy in the listener
3190 * and the actions in the ip_recv_attr_t.
3191 * Called directly from TCP and SCTP.
3192 */
3193 boolean_t
3194 ip_ipsec_policy_inherit(conn_t *connp, conn_t *lconnp, ip_recv_attr_t *ira)
3195 {
3196 ASSERT(lconnp->conn_policy != NULL);
3197 ASSERT(connp->conn_policy == NULL);
3198
3199 IPPH_REFHOLD(lconnp->conn_policy);
3200 connp->conn_policy = lconnp->conn_policy;
3201
3202 if (ira->ira_ipsec_action != NULL) {
3203 if (connp->conn_latch == NULL) {
3204 connp->conn_latch = iplatch_create();
3205 if (connp->conn_latch == NULL)
3206 return (B_FALSE);
3207 }
3208 ipsec_latch_inbound(connp, ira);
3209 }
3210 return (B_TRUE);
3211 }
3212
3213 /*
3214 * Verify whether or not the IP address is a valid local address.
3215 * Could be a unicast, including one for a down interface.
3216 * If allow_mcbc then a multicast or broadcast address is also
3217 * acceptable.
3218 *
3219 * In the case of a broadcast/multicast address, however, the
3220 * upper protocol is expected to reset the src address
3221 * to zero when we return IPVL_MCAST/IPVL_BCAST so that
3222 * no packets are emitted with broadcast/multicast address as
3223 * source address (that violates hosts requirements RFC 1122)
3224 * The addresses valid for bind are:
3225 * (1) - INADDR_ANY (0)
3226 * (2) - IP address of an UP interface
3227 * (3) - IP address of a DOWN interface
3228 * (4) - valid local IP broadcast addresses. In this case
3229 * the conn will only receive packets destined to
3230 * the specified broadcast address.
3231 * (5) - a multicast address. In this case
3232 * the conn will only receive packets destined to
3233 * the specified multicast address. Note: the
3234 * application still has to issue an
3235 * IP_ADD_MEMBERSHIP socket option.
3236 *
3237 * In all the above cases, the bound address must be valid in the current zone.
3238 * When the address is loopback, multicast or broadcast, there might be many
3239 * matching IREs so bind has to look up based on the zone.
3240 */
3241 ip_laddr_t
3242 ip_laddr_verify_v4(ipaddr_t src_addr, zoneid_t zoneid,
3243 ip_stack_t *ipst, boolean_t allow_mcbc)
3244 {
3245 ire_t *src_ire;
3246
3247 ASSERT(src_addr != INADDR_ANY);
3248
3249 src_ire = ire_ftable_lookup_v4(src_addr, 0, 0, 0,
3250 NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, 0, ipst, NULL);
3251
3252 /*
3253 * If an address other than in6addr_any is requested,
3254 * we verify that it is a valid address for bind
3255 * Note: Following code is in if-else-if form for
3256 * readability compared to a condition check.
3257 */
3258 if (src_ire != NULL && (src_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK))) {
3259 /*
3260 * (2) Bind to address of local UP interface
3261 */
3262 ire_refrele(src_ire);
3263 return (IPVL_UNICAST_UP);
3264 } else if (src_ire != NULL && src_ire->ire_type & IRE_BROADCAST) {
3265 /*
3266 * (4) Bind to broadcast address
3267 */
3268 ire_refrele(src_ire);
3269 if (allow_mcbc)
3270 return (IPVL_BCAST);
3271 else
3272 return (IPVL_BAD);
3273 } else if (CLASSD(src_addr)) {
3274 /* (5) bind to multicast address. */
3275 if (src_ire != NULL)
3276 ire_refrele(src_ire);
3277
3278 if (allow_mcbc)
3279 return (IPVL_MCAST);
3280 else
3281 return (IPVL_BAD);
3282 } else {
3283 ipif_t *ipif;
3284
3285 /*
3286 * (3) Bind to address of local DOWN interface?
3287 * (ipif_lookup_addr() looks up all interfaces
3288 * but we do not get here for UP interfaces
3289 * - case (2) above)
3290 */
3291 if (src_ire != NULL)
3292 ire_refrele(src_ire);
3293
3294 ipif = ipif_lookup_addr(src_addr, NULL, zoneid, ipst);
3295 if (ipif == NULL)
3296 return (IPVL_BAD);
3297
3298 /* Not a useful source? */
3299 if (ipif->ipif_flags & (IPIF_NOLOCAL | IPIF_ANYCAST)) {
3300 ipif_refrele(ipif);
3301 return (IPVL_BAD);
3302 }
3303 ipif_refrele(ipif);
3304 return (IPVL_UNICAST_DOWN);
3305 }
3306 }
3307
3308 /*
3309 * Insert in the bind fanout for IPv4 and IPv6.
3310 * The caller should already have used ip_laddr_verify_v*() before calling
3311 * this.
3312 */
3313 int
3314 ip_laddr_fanout_insert(conn_t *connp)
3315 {
3316 int error;
3317
3318 /*
3319 * Allow setting new policies. For example, disconnects result
3320 * in us being called. As we would have set conn_policy_cached
3321 * to B_TRUE before, we should set it to B_FALSE, so that policy
3322 * can change after the disconnect.
3323 */
3324 connp->conn_policy_cached = B_FALSE;
3325
3326 error = ipcl_bind_insert(connp);
3327 if (error != 0) {
3328 if (connp->conn_anon_port) {
3329 (void) tsol_mlp_anon(crgetzone(connp->conn_cred),
3330 connp->conn_mlp_type, connp->conn_proto,
3331 ntohs(connp->conn_lport), B_FALSE);
3332 }
3333 connp->conn_mlp_type = mlptSingle;
3334 }
3335 return (error);
3336 }
3337
3338 /*
3339 * Verify that both the source and destination addresses are valid. If
3340 * IPDF_VERIFY_DST is not set, then the destination address may be unreachable,
3341 * i.e. have no route to it. Protocols like TCP want to verify destination
3342 * reachability, while tunnels do not.
3343 *
3344 * Determine the route, the interface, and (optionally) the source address
3345 * to use to reach a given destination.
3346 * Note that we allow connect to broadcast and multicast addresses when
3347 * IPDF_ALLOW_MCBC is set.
3348 * first_hop and dst_addr are normally the same, but if source routing
3349 * they will differ; in that case the first_hop is what we'll use for the
3350 * routing lookup but the dce and label checks will be done on dst_addr,
3351 *
3352 * If uinfo is set, then we fill in the best available information
3353 * we have for the destination. This is based on (in priority order) any
3354 * metrics and path MTU stored in a dce_t, route metrics, and finally the
3355 * ill_mtu/ill_mc_mtu.
3356 *
3357 * Tsol note: If we have a source route then dst_addr != firsthop. But we
3358 * always do the label check on dst_addr.
3359 */
3360 int
3361 ip_set_destination_v4(ipaddr_t *src_addrp, ipaddr_t dst_addr, ipaddr_t firsthop,
3362 ip_xmit_attr_t *ixa, iulp_t *uinfo, uint32_t flags, uint_t mac_mode)
3363 {
3364 ire_t *ire = NULL;
3365 int error = 0;
3366 ipaddr_t setsrc; /* RTF_SETSRC */
3367 zoneid_t zoneid = ixa->ixa_zoneid; /* Honors SO_ALLZONES */
3368 ip_stack_t *ipst = ixa->ixa_ipst;
3369 dce_t *dce;
3370 uint_t pmtu;
3371 uint_t generation;
3372 nce_t *nce;
3373 ill_t *ill = NULL;
3374 boolean_t multirt = B_FALSE;
3375
3376 ASSERT(ixa->ixa_flags & IXAF_IS_IPV4);
3377
3378 /*
3379 * We never send to zero; the ULPs map it to the loopback address.
3380 * We can't allow it since we use zero to mean unitialized in some
3381 * places.
3382 */
3383 ASSERT(dst_addr != INADDR_ANY);
3384
3385 if (is_system_labeled()) {
3386 ts_label_t *tsl = NULL;
3387
3388 error = tsol_check_dest(ixa->ixa_tsl, &dst_addr, IPV4_VERSION,
3389 mac_mode, (flags & IPDF_ZONE_IS_GLOBAL) != 0, &tsl);
3390 if (error != 0)
3391 return (error);
3392 if (tsl != NULL) {
3393 /* Update the label */
3394 ip_xmit_attr_replace_tsl(ixa, tsl);
3395 }
3396 }
3397
3398 setsrc = INADDR_ANY;
3399 /*
3400 * Select a route; For IPMP interfaces, we would only select
3401 * a "hidden" route (i.e., going through a specific under_ill)
3402 * if ixa_ifindex has been specified.
3403 */
3404 ire = ip_select_route_v4(firsthop, *src_addrp, ixa,
3405 &generation, &setsrc, &error, &multirt);
3406 ASSERT(ire != NULL); /* IRE_NOROUTE if none found */
3407 if (error != 0)
3408 goto bad_addr;
3409
3410 /*
3411 * ire can't be a broadcast or multicast unless IPDF_ALLOW_MCBC is set.
3412 * If IPDF_VERIFY_DST is set, the destination must be reachable;
3413 * Otherwise the destination needn't be reachable.
3414 *
3415 * If we match on a reject or black hole, then we've got a
3416 * local failure. May as well fail out the connect() attempt,
3417 * since it's never going to succeed.
3418 */
3419 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
3420 /*
3421 * If we're verifying destination reachability, we always want
3422 * to complain here.
3423 *
3424 * If we're not verifying destination reachability but the
3425 * destination has a route, we still want to fail on the
3426 * temporary address and broadcast address tests.
3427 *
3428 * In both cases do we let the code continue so some reasonable
3429 * information is returned to the caller. That enables the
3430 * caller to use (and even cache) the IRE. conn_ip_ouput will
3431 * use the generation mismatch path to check for the unreachable
3432 * case thereby avoiding any specific check in the main path.
3433 */
3434 ASSERT(generation == IRE_GENERATION_VERIFY);
3435 if (flags & IPDF_VERIFY_DST) {
3436 /*
3437 * Set errno but continue to set up ixa_ire to be
3438 * the RTF_REJECT|RTF_BLACKHOLE IRE.
3439 * That allows callers to use ip_output to get an
3440 * ICMP error back.
3441 */
3442 if (!(ire->ire_type & IRE_HOST))
3443 error = ENETUNREACH;
3444 else
3445 error = EHOSTUNREACH;
3446 }
3447 }
3448
3449 if ((ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST)) &&
3450 !(flags & IPDF_ALLOW_MCBC)) {
3451 ire_refrele(ire);
3452 ire = ire_reject(ipst, B_FALSE);
3453 generation = IRE_GENERATION_VERIFY;
3454 error = ENETUNREACH;
3455 }
3456
3457 /* Cache things */
3458 if (ixa->ixa_ire != NULL)
3459 ire_refrele_notr(ixa->ixa_ire);
3460 #ifdef DEBUG
3461 ire_refhold_notr(ire);
3462 ire_refrele(ire);
3463 #endif
3464 ixa->ixa_ire = ire;
3465 ixa->ixa_ire_generation = generation;
3466
3467 /*
3468 * Ensure that ixa_dce is always set any time that ixa_ire is set,
3469 * since some callers will send a packet to conn_ip_output() even if
3470 * there's an error.
3471 */
3472 if (flags & IPDF_UNIQUE_DCE) {
3473 /* Fallback to the default dce if allocation fails */
3474 dce = dce_lookup_and_add_v4(dst_addr, ipst);
3475 if (dce != NULL)
3476 generation = dce->dce_generation;
3477 else
3478 dce = dce_lookup_v4(dst_addr, ipst, &generation);
3479 } else {
3480 dce = dce_lookup_v4(dst_addr, ipst, &generation);
3481 }
3482 ASSERT(dce != NULL);
3483 if (ixa->ixa_dce != NULL)
3484 dce_refrele_notr(ixa->ixa_dce);
3485 #ifdef DEBUG
3486 dce_refhold_notr(dce);
3487 dce_refrele(dce);
3488 #endif
3489 ixa->ixa_dce = dce;
3490 ixa->ixa_dce_generation = generation;
3491
3492 /*
3493 * For multicast with multirt we have a flag passed back from
3494 * ire_lookup_multi_ill_v4 since we don't have an IRE for each
3495 * possible multicast address.
3496 * We also need a flag for multicast since we can't check
3497 * whether RTF_MULTIRT is set in ixa_ire for multicast.
3498 */
3499 if (multirt) {
3500 ixa->ixa_postfragfn = ip_postfrag_multirt_v4;
3501 ixa->ixa_flags |= IXAF_MULTIRT_MULTICAST;
3502 } else {
3503 ixa->ixa_postfragfn = ire->ire_postfragfn;
3504 ixa->ixa_flags &= ~IXAF_MULTIRT_MULTICAST;
3505 }
3506 if (!(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) {
3507 /* Get an nce to cache. */
3508 nce = ire_to_nce(ire, firsthop, NULL);
3509 if (nce == NULL) {
3510 /* Allocation failure? */
3511 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
3512 } else {
3513 if (ixa->ixa_nce != NULL)
3514 nce_refrele(ixa->ixa_nce);
3515 ixa->ixa_nce = nce;
3516 }
3517 }
3518
3519 /*
3520 * If the source address is a loopback address, the
3521 * destination had best be local or multicast.
3522 * If we are sending to an IRE_LOCAL using a loopback source then
3523 * it had better be the same zoneid.
3524 */
3525 if (*src_addrp == htonl(INADDR_LOOPBACK)) {
3526 if ((ire->ire_type & IRE_LOCAL) && ire->ire_zoneid != zoneid) {
3527 ire = NULL; /* Stored in ixa_ire */
3528 error = EADDRNOTAVAIL;
3529 goto bad_addr;
3530 }
3531 if (!(ire->ire_type & (IRE_LOOPBACK|IRE_LOCAL|IRE_MULTICAST))) {
3532 ire = NULL; /* Stored in ixa_ire */
3533 error = EADDRNOTAVAIL;
3534 goto bad_addr;
3535 }
3536 }
3537 if (ire->ire_type & IRE_BROADCAST) {
3538 /*
3539 * If the ULP didn't have a specified source, then we
3540 * make sure we reselect the source when sending
3541 * broadcasts out different interfaces.
3542 */
3543 if (flags & IPDF_SELECT_SRC)
3544 ixa->ixa_flags |= IXAF_SET_SOURCE;
3545 else
3546 ixa->ixa_flags &= ~IXAF_SET_SOURCE;
3547 }
3548
3549 /*
3550 * Does the caller want us to pick a source address?
3551 */
3552 if (flags & IPDF_SELECT_SRC) {
3553 ipaddr_t src_addr;
3554
3555 /*
3556 * We use use ire_nexthop_ill to avoid the under ipmp
3557 * interface for source address selection. Note that for ipmp
3558 * probe packets, ixa_ifindex would have been specified, and
3559 * the ip_select_route() invocation would have picked an ire
3560 * will ire_ill pointing at an under interface.
3561 */
3562 ill = ire_nexthop_ill(ire);
3563
3564 /* If unreachable we have no ill but need some source */
3565 if (ill == NULL) {
3566 src_addr = htonl(INADDR_LOOPBACK);
3567 /* Make sure we look for a better source address */
3568 generation = SRC_GENERATION_VERIFY;
3569 } else {
3570 error = ip_select_source_v4(ill, setsrc, dst_addr,
3571 ixa->ixa_multicast_ifaddr, zoneid,
3572 ipst, &src_addr, &generation, NULL);
3573 if (error != 0) {
3574 ire = NULL; /* Stored in ixa_ire */
3575 goto bad_addr;
3576 }
3577 }
3578
3579 /*
3580 * We allow the source address to to down.
3581 * However, we check that we don't use the loopback address
3582 * as a source when sending out on the wire.
3583 */
3584 if ((src_addr == htonl(INADDR_LOOPBACK)) &&
3585 !(ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK|IRE_MULTICAST)) &&
3586 !(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) {
3587 ire = NULL; /* Stored in ixa_ire */
3588 error = EADDRNOTAVAIL;
3589 goto bad_addr;
3590 }
3591
3592 *src_addrp = src_addr;
3593 ixa->ixa_src_generation = generation;
3594 }
3595
3596 /*
3597 * Make sure we don't leave an unreachable ixa_nce in place
3598 * since ip_select_route is used when we unplumb i.e., remove
3599 * references on ixa_ire, ixa_nce, and ixa_dce.
3600 */
3601 nce = ixa->ixa_nce;
3602 if (nce != NULL && nce->nce_is_condemned) {
3603 nce_refrele(nce);
3604 ixa->ixa_nce = NULL;
3605 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
3606 }
3607
3608 /*
3609 * The caller has set IXAF_PMTU_DISCOVERY if path MTU is desired.
3610 * However, we can't do it for IPv4 multicast or broadcast.
3611 */
3612 if (ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST))
3613 ixa->ixa_flags &= ~IXAF_PMTU_DISCOVERY;
3614
3615 /*
3616 * Set initial value for fragmentation limit. Either conn_ip_output
3617 * or ULP might updates it when there are routing changes.
3618 * Handles a NULL ixa_ire->ire_ill or a NULL ixa_nce for RTF_REJECT.
3619 */
3620 pmtu = ip_get_pmtu(ixa);
3621 ixa->ixa_fragsize = pmtu;
3622 /* Make sure ixa_fragsize and ixa_pmtu remain identical */
3623 if (ixa->ixa_flags & IXAF_VERIFY_PMTU)
3624 ixa->ixa_pmtu = pmtu;
3625
3626 /*
3627 * Extract information useful for some transports.
3628 * First we look for DCE metrics. Then we take what we have in
3629 * the metrics in the route, where the offlink is used if we have
3630 * one.
3631 */
3632 if (uinfo != NULL) {
3633 bzero(uinfo, sizeof (*uinfo));
3634
3635 if (dce->dce_flags & DCEF_UINFO)
3636 *uinfo = dce->dce_uinfo;
3637
3638 rts_merge_metrics(uinfo, &ire->ire_metrics);
3639
3640 /* Allow ire_metrics to decrease the path MTU from above */
3641 if (uinfo->iulp_mtu == 0 || uinfo->iulp_mtu > pmtu)
3642 uinfo->iulp_mtu = pmtu;
3643
3644 uinfo->iulp_localnet = (ire->ire_type & IRE_ONLINK) != 0;
3645 uinfo->iulp_loopback = (ire->ire_type & IRE_LOOPBACK) != 0;
3646 uinfo->iulp_local = (ire->ire_type & IRE_LOCAL) != 0;
3647 }
3648
3649 if (ill != NULL)
3650 ill_refrele(ill);
3651
3652 return (error);
3653
3654 bad_addr:
3655 if (ire != NULL)
3656 ire_refrele(ire);
3657
3658 if (ill != NULL)
3659 ill_refrele(ill);
3660
3661 /*
3662 * Make sure we don't leave an unreachable ixa_nce in place
3663 * since ip_select_route is used when we unplumb i.e., remove
3664 * references on ixa_ire, ixa_nce, and ixa_dce.
3665 */
3666 nce = ixa->ixa_nce;
3667 if (nce != NULL && nce->nce_is_condemned) {
3668 nce_refrele(nce);
3669 ixa->ixa_nce = NULL;
3670 ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
3671 }
3672
3673 return (error);
3674 }
3675
3676
3677 /*
3678 * Get the base MTU for the case when path MTU discovery is not used.
3679 * Takes the MTU of the IRE into account.
3680 */
3681 uint_t
3682 ip_get_base_mtu(ill_t *ill, ire_t *ire)
3683 {
3684 uint_t mtu;
3685 uint_t iremtu = ire->ire_metrics.iulp_mtu;
3686
3687 if (ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST))
3688 mtu = ill->ill_mc_mtu;
3689 else
3690 mtu = ill->ill_mtu;
3691
3692 if (iremtu != 0 && iremtu < mtu)
3693 mtu = iremtu;
3694
3695 return (mtu);
3696 }
3697
3698 /*
3699 * Get the PMTU for the attributes. Handles both IPv4 and IPv6.
3700 * Assumes that ixa_ire, dce, and nce have already been set up.
3701 *
3702 * The caller has set IXAF_PMTU_DISCOVERY if path MTU discovery is desired.
3703 * We avoid path MTU discovery if it is disabled with ndd.
3704 * Furtermore, if the path MTU is too small, then we don't set DF for IPv4.
3705 *
3706 * NOTE: We also used to turn it off for source routed packets. That
3707 * is no longer required since the dce is per final destination.
3708 */
3709 uint_t
3710 ip_get_pmtu(ip_xmit_attr_t *ixa)
3711 {
3712 ip_stack_t *ipst = ixa->ixa_ipst;
3713 dce_t *dce;
3714 nce_t *nce;
3715 ire_t *ire;
3716 uint_t pmtu;
3717
3718 ire = ixa->ixa_ire;
3719 dce = ixa->ixa_dce;
3720 nce = ixa->ixa_nce;
3721
3722 /*
3723 * If path MTU discovery has been turned off by ndd, then we ignore
3724 * any dce_pmtu and for IPv4 we will not set DF.
3725 */
3726 if (!ipst->ips_ip_path_mtu_discovery)
3727 ixa->ixa_flags &= ~IXAF_PMTU_DISCOVERY;
3728
3729 pmtu = IP_MAXPACKET;
3730 /*
3731 * Decide whether whether IPv4 sets DF
3732 * For IPv6 "no DF" means to use the 1280 mtu
3733 */
3734 if (ixa->ixa_flags & IXAF_PMTU_DISCOVERY) {
3735 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF;
3736 } else {
3737 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF;
3738 if (!(ixa->ixa_flags & IXAF_IS_IPV4))
3739 pmtu = IPV6_MIN_MTU;
3740 }
3741
3742 /* Check if the PMTU is to old before we use it */
3743 if ((dce->dce_flags & DCEF_PMTU) &&
3744 TICK_TO_SEC(ddi_get_lbolt64()) - dce->dce_last_change_time >
3745 ipst->ips_ip_pathmtu_interval) {
3746 /*
3747 * Older than 20 minutes. Drop the path MTU information.
3748 */
3749 mutex_enter(&dce->dce_lock);
3750 dce->dce_flags &= ~(DCEF_PMTU|DCEF_TOO_SMALL_PMTU);
3751 dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64());
3752 mutex_exit(&dce->dce_lock);
3753 dce_increment_generation(dce);
3754 }
3755
3756 /* The metrics on the route can lower the path MTU */
3757 if (ire->ire_metrics.iulp_mtu != 0 &&
3758 ire->ire_metrics.iulp_mtu < pmtu)
3759 pmtu = ire->ire_metrics.iulp_mtu;
3760
3761 /*
3762 * If the path MTU is smaller than some minimum, we still use dce_pmtu
3763 * above (would be 576 for IPv4 and 1280 for IPv6), but we clear
3764 * IXAF_PMTU_IPV4_DF so that we avoid setting DF for IPv4.
3765 */
3766 if (ixa->ixa_flags & IXAF_PMTU_DISCOVERY) {
3767 if (dce->dce_flags & DCEF_PMTU) {
3768 if (dce->dce_pmtu < pmtu)
3769 pmtu = dce->dce_pmtu;
3770
3771 if (dce->dce_flags & DCEF_TOO_SMALL_PMTU) {
3772 ixa->ixa_flags |= IXAF_PMTU_TOO_SMALL;
3773 ixa->ixa_flags &= ~IXAF_PMTU_IPV4_DF;
3774 } else {
3775 ixa->ixa_flags &= ~IXAF_PMTU_TOO_SMALL;
3776 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF;
3777 }
3778 } else {
3779 ixa->ixa_flags &= ~IXAF_PMTU_TOO_SMALL;
3780 ixa->ixa_flags |= IXAF_PMTU_IPV4_DF;
3781 }
3782 }
3783
3784 /*
3785 * If we have an IRE_LOCAL we use the loopback mtu instead of
3786 * the ill for going out the wire i.e., IRE_LOCAL gets the same
3787 * mtu as IRE_LOOPBACK.
3788 */
3789 if (ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
3790 uint_t loopback_mtu;
3791
3792 loopback_mtu = (ire->ire_ipversion == IPV6_VERSION) ?
3793 ip_loopback_mtu_v6plus : ip_loopback_mtuplus;
3794
3795 if (loopback_mtu < pmtu)
3796 pmtu = loopback_mtu;
3797 } else if (nce != NULL) {
3798 /*
3799 * Make sure we don't exceed the interface MTU.
3800 * In the case of RTF_REJECT or RTF_BLACKHOLE we might not have
3801 * an ill. We'd use the above IP_MAXPACKET in that case just
3802 * to tell the transport something larger than zero.
3803 */
3804 if (ire->ire_type & (IRE_MULTICAST|IRE_BROADCAST)) {
3805 if (nce->nce_common->ncec_ill->ill_mc_mtu < pmtu)
3806 pmtu = nce->nce_common->ncec_ill->ill_mc_mtu;
3807 if (nce->nce_common->ncec_ill != nce->nce_ill &&
3808 nce->nce_ill->ill_mc_mtu < pmtu) {
3809 /*
3810 * for interfaces in an IPMP group, the mtu of
3811 * the nce_ill (under_ill) could be different
3812 * from the mtu of the ncec_ill, so we take the
3813 * min of the two.
3814 */
3815 pmtu = nce->nce_ill->ill_mc_mtu;
3816 }
3817 } else {
3818 if (nce->nce_common->ncec_ill->ill_mtu < pmtu)
3819 pmtu = nce->nce_common->ncec_ill->ill_mtu;
3820 if (nce->nce_common->ncec_ill != nce->nce_ill &&
3821 nce->nce_ill->ill_mtu < pmtu) {
3822 /*
3823 * for interfaces in an IPMP group, the mtu of
3824 * the nce_ill (under_ill) could be different
3825 * from the mtu of the ncec_ill, so we take the
3826 * min of the two.
3827 */
3828 pmtu = nce->nce_ill->ill_mtu;
3829 }
3830 }
3831 }
3832
3833 /*
3834 * Handle the IPV6_USE_MIN_MTU socket option or ancillary data.
3835 * Only applies to IPv6.
3836 */
3837 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) {
3838 if (ixa->ixa_flags & IXAF_USE_MIN_MTU) {
3839 switch (ixa->ixa_use_min_mtu) {
3840 case IPV6_USE_MIN_MTU_MULTICAST:
3841 if (ire->ire_type & IRE_MULTICAST)
3842 pmtu = IPV6_MIN_MTU;
3843 break;
3844 case IPV6_USE_MIN_MTU_ALWAYS:
3845 pmtu = IPV6_MIN_MTU;
3846 break;
3847 case IPV6_USE_MIN_MTU_NEVER:
3848 break;
3849 }
3850 } else {
3851 /* Default is IPV6_USE_MIN_MTU_MULTICAST */
3852 if (ire->ire_type & IRE_MULTICAST)
3853 pmtu = IPV6_MIN_MTU;
3854 }
3855 }
3856
3857 /*
3858 * For multirouted IPv6 packets, the IP layer will insert a 8-byte
3859 * fragment header in every packet. We compensate for those cases by
3860 * returning a smaller path MTU to the ULP.
3861 *
3862 * In the case of CGTP then ip_output will add a fragment header.
3863 * Make sure there is room for it by telling a smaller number
3864 * to the transport.
3865 *
3866 * When IXAF_IPV6_ADDR_FRAGHDR we subtract the frag hdr here
3867 * so the ULPs consistently see a iulp_pmtu and ip_get_pmtu()
3868 * which is the size of the packets it can send.
3869 */
3870 if (!(ixa->ixa_flags & IXAF_IS_IPV4)) {
3871 if ((ire->ire_flags & RTF_MULTIRT) ||
3872 (ixa->ixa_flags & IXAF_MULTIRT_MULTICAST)) {
3873 pmtu -= sizeof (ip6_frag_t);
3874 ixa->ixa_flags |= IXAF_IPV6_ADD_FRAGHDR;
3875 }
3876 }
3877
3878 return (pmtu);
3879 }
3880
3881 /*
3882 * Carve "len" bytes out of an mblk chain, consuming any we empty, and duping
3883 * the final piece where we don't. Return a pointer to the first mblk in the
3884 * result, and update the pointer to the next mblk to chew on. If anything
3885 * goes wrong (i.e., dupb fails), we waste everything in sight and return a
3886 * NULL pointer.
3887 */
3888 mblk_t *
3889 ip_carve_mp(mblk_t **mpp, ssize_t len)
3890 {
3891 mblk_t *mp0;
3892 mblk_t *mp1;
3893 mblk_t *mp2;
3894
3895 if (!len || !mpp || !(mp0 = *mpp))
3896 return (NULL);
3897 /* If we aren't going to consume the first mblk, we need a dup. */
3898 if (mp0->b_wptr - mp0->b_rptr > len) {
3899 mp1 = dupb(mp0);
3900 if (mp1) {
3901 /* Partition the data between the two mblks. */
3902 mp1->b_wptr = mp1->b_rptr + len;
3903 mp0->b_rptr = mp1->b_wptr;
3904 /*
3905 * after adjustments if mblk not consumed is now
3906 * unaligned, try to align it. If this fails free
3907 * all messages and let upper layer recover.
3908 */
3909 if (!OK_32PTR(mp0->b_rptr)) {
3910 if (!pullupmsg(mp0, -1)) {
3911 freemsg(mp0);
3912 freemsg(mp1);
3913 *mpp = NULL;
3914 return (NULL);
3915 }
3916 }
3917 }
3918 return (mp1);
3919 }
3920 /* Eat through as many mblks as we need to get len bytes. */
3921 len -= mp0->b_wptr - mp0->b_rptr;
3922 for (mp2 = mp1 = mp0; (mp2 = mp2->b_cont) != 0 && len; mp1 = mp2) {
3923 if (mp2->b_wptr - mp2->b_rptr > len) {
3924 /*
3925 * We won't consume the entire last mblk. Like
3926 * above, dup and partition it.
3927 */
3928 mp1->b_cont = dupb(mp2);
3929 mp1 = mp1->b_cont;
3930 if (!mp1) {
3931 /*
3932 * Trouble. Rather than go to a lot of
3933 * trouble to clean up, we free the messages.
3934 * This won't be any worse than losing it on
3935 * the wire.
3936 */
3937 freemsg(mp0);
3938 freemsg(mp2);
3939 *mpp = NULL;
3940 return (NULL);
3941 }
3942 mp1->b_wptr = mp1->b_rptr + len;
3943 mp2->b_rptr = mp1->b_wptr;
3944 /*
3945 * after adjustments if mblk not consumed is now
3946 * unaligned, try to align it. If this fails free
3947 * all messages and let upper layer recover.
3948 */
3949 if (!OK_32PTR(mp2->b_rptr)) {
3950 if (!pullupmsg(mp2, -1)) {
3951 freemsg(mp0);
3952 freemsg(mp2);
3953 *mpp = NULL;
3954 return (NULL);
3955 }
3956 }
3957 *mpp = mp2;
3958 return (mp0);
3959 }
3960 /* Decrement len by the amount we just got. */
3961 len -= mp2->b_wptr - mp2->b_rptr;
3962 }
3963 /*
3964 * len should be reduced to zero now. If not our caller has
3965 * screwed up.
3966 */
3967 if (len) {
3968 /* Shouldn't happen! */
3969 freemsg(mp0);
3970 *mpp = NULL;
3971 return (NULL);
3972 }
3973 /*
3974 * We consumed up to exactly the end of an mblk. Detach the part
3975 * we are returning from the rest of the chain.
3976 */
3977 mp1->b_cont = NULL;
3978 *mpp = mp2;
3979 return (mp0);
3980 }
3981
3982 /* The ill stream is being unplumbed. Called from ip_close */
3983 int
3984 ip_modclose(ill_t *ill)
3985 {
3986 boolean_t success;
3987 ipsq_t *ipsq;
3988 ipif_t *ipif;
3989 queue_t *q = ill->ill_rq;
3990 ip_stack_t *ipst = ill->ill_ipst;
3991 int i;
3992 arl_ill_common_t *ai = ill->ill_common;
3993
3994 /*
3995 * The punlink prior to this may have initiated a capability
3996 * negotiation. But ipsq_enter will block until that finishes or
3997 * times out.
3998 */
3999 success = ipsq_enter(ill, B_FALSE, NEW_OP);
4000
4001 /*
4002 * Open/close/push/pop is guaranteed to be single threaded
4003 * per stream by STREAMS. FS guarantees that all references
4004 * from top are gone before close is called. So there can't
4005 * be another close thread that has set CONDEMNED on this ill.
4006 * and cause ipsq_enter to return failure.
4007 */
4008 ASSERT(success);
4009 ipsq = ill->ill_phyint->phyint_ipsq;
4010
4011 /*
4012 * Mark it condemned. No new reference will be made to this ill.
4013 * Lookup functions will return an error. Threads that try to
4014 * increment the refcnt must check for ILL_CAN_LOOKUP. This ensures
4015 * that the refcnt will drop down to zero.
4016 */
4017 mutex_enter(&ill->ill_lock);
4018 ill->ill_state_flags |= ILL_CONDEMNED;
4019 for (ipif = ill->ill_ipif; ipif != NULL;
4020 ipif = ipif->ipif_next) {
4021 ipif->ipif_state_flags |= IPIF_CONDEMNED;
4022 }
4023 /*
4024 * Wake up anybody waiting to enter the ipsq. ipsq_enter
4025 * returns error if ILL_CONDEMNED is set
4026 */
4027 cv_broadcast(&ill->ill_cv);
4028 mutex_exit(&ill->ill_lock);
4029
4030 /*
4031 * Send all the deferred DLPI messages downstream which came in
4032 * during the small window right before ipsq_enter(). We do this
4033 * without waiting for the ACKs because all the ACKs for M_PROTO
4034 * messages are ignored in ip_rput() when ILL_CONDEMNED is set.
4035 */
4036 ill_dlpi_send_deferred(ill);
4037
4038 /*
4039 * Shut down fragmentation reassembly.
4040 * ill_frag_timer won't start a timer again.
4041 * Now cancel any existing timer
4042 */
4043 (void) untimeout(ill->ill_frag_timer_id);
4044 (void) ill_frag_timeout(ill, 0);
4045
4046 /*
4047 * Call ill_delete to bring down the ipifs, ilms and ill on
4048 * this ill. Then wait for the refcnts to drop to zero.
4049 * ill_is_freeable checks whether the ill is really quiescent.
4050 * Then make sure that threads that are waiting to enter the
4051 * ipsq have seen the error returned by ipsq_enter and have
4052 * gone away. Then we call ill_delete_tail which does the
4053 * DL_UNBIND_REQ with the driver and then qprocsoff.
4054 */
4055 ill_delete(ill);
4056 mutex_enter(&ill->ill_lock);
4057 while (!ill_is_freeable(ill))
4058 cv_wait(&ill->ill_cv, &ill->ill_lock);
4059
4060 while (ill->ill_waiters)
4061 cv_wait(&ill->ill_cv, &ill->ill_lock);
4062
4063 mutex_exit(&ill->ill_lock);
4064
4065 /*
4066 * ill_delete_tail drops reference on ill_ipst, but we need to keep
4067 * it held until the end of the function since the cleanup
4068 * below needs to be able to use the ip_stack_t.
4069 */
4070 netstack_hold(ipst->ips_netstack);
4071
4072 /* qprocsoff is done via ill_delete_tail */
4073 ill_delete_tail(ill);
4074 /*
4075 * synchronously wait for arp stream to unbind. After this, we
4076 * cannot get any data packets up from the driver.
4077 */
4078 arp_unbind_complete(ill);
4079 ASSERT(ill->ill_ipst == NULL);
4080
4081 /*
4082 * Walk through all conns and qenable those that have queued data.
4083 * Close synchronization needs this to
4084 * be done to ensure that all upper layers blocked
4085 * due to flow control to the closing device
4086 * get unblocked.
4087 */
4088 ip1dbg(("ip_wsrv: walking\n"));
4089 for (i = 0; i < TX_FANOUT_SIZE; i++) {
4090 conn_walk_drain(ipst, &ipst->ips_idl_tx_list[i]);
4091 }
4092
4093 /*
4094 * ai can be null if this is an IPv6 ill, or if the IPv4
4095 * stream is being torn down before ARP was plumbed (e.g.,
4096 * /sbin/ifconfig plumbing a stream twice, and encountering
4097 * an error
4098 */
4099 if (ai != NULL) {
4100 ASSERT(!ill->ill_isv6);
4101 mutex_enter(&ai->ai_lock);
4102 ai->ai_ill = NULL;
4103 if (ai->ai_arl == NULL) {
4104 mutex_destroy(&ai->ai_lock);
4105 kmem_free(ai, sizeof (*ai));
4106 } else {
4107 cv_signal(&ai->ai_ill_unplumb_done);
4108 mutex_exit(&ai->ai_lock);
4109 }
4110 }
4111
4112 mutex_enter(&ipst->ips_ip_mi_lock);
4113 mi_close_unlink(&ipst->ips_ip_g_head, (IDP)ill);
4114 mutex_exit(&ipst->ips_ip_mi_lock);
4115
4116 /*
4117 * credp could be null if the open didn't succeed and ip_modopen
4118 * itself calls ip_close.
4119 */
4120 if (ill->ill_credp != NULL)
4121 crfree(ill->ill_credp);
4122
4123 mutex_destroy(&ill->ill_saved_ire_lock);
4124 mutex_destroy(&ill->ill_lock);
4125 rw_destroy(&ill->ill_mcast_lock);
4126 mutex_destroy(&ill->ill_mcast_serializer);
4127 list_destroy(&ill->ill_nce);
4128
4129 /*
4130 * Now we are done with the module close pieces that
4131 * need the netstack_t.
4132 */
4133 netstack_rele(ipst->ips_netstack);
4134
4135 mi_close_free((IDP)ill);
4136 q->q_ptr = WR(q)->q_ptr = NULL;
4137
4138 ipsq_exit(ipsq);
4139
4140 return (0);
4141 }
4142
4143 /*
4144 * This is called as part of close() for IP, UDP, ICMP, and RTS
4145 * in order to quiesce the conn.
4146 */
4147 void
4148 ip_quiesce_conn(conn_t *connp)
4149 {
4150 boolean_t drain_cleanup_reqd = B_FALSE;
4151 boolean_t conn_ioctl_cleanup_reqd = B_FALSE;
4152 boolean_t ilg_cleanup_reqd = B_FALSE;
4153 ip_stack_t *ipst;
4154
4155 ASSERT(!IPCL_IS_TCP(connp));
4156 ipst = connp->conn_netstack->netstack_ip;
4157
4158 /*
4159 * Mark the conn as closing, and this conn must not be
4160 * inserted in future into any list. Eg. conn_drain_insert(),
4161 * won't insert this conn into the conn_drain_list.
4162 *
4163 * conn_idl, and conn_ilg cannot get set henceforth.
4164 */
4165 mutex_enter(&connp->conn_lock);
4166 ASSERT(!(connp->conn_state_flags & CONN_QUIESCED));
4167 connp->conn_state_flags |= CONN_CLOSING;
4168 if (connp->conn_idl != NULL)
4169 drain_cleanup_reqd = B_TRUE;
4170 if (connp->conn_oper_pending_ill != NULL)
4171 conn_ioctl_cleanup_reqd = B_TRUE;
4172 if (connp->conn_dhcpinit_ill != NULL) {
4173 ASSERT(connp->conn_dhcpinit_ill->ill_dhcpinit != 0);
4174 atomic_dec_32(&connp->conn_dhcpinit_ill->ill_dhcpinit);
4175 ill_set_inputfn(connp->conn_dhcpinit_ill);
4176 connp->conn_dhcpinit_ill = NULL;
4177 }
4178 if (connp->conn_ilg != NULL)
4179 ilg_cleanup_reqd = B_TRUE;
4180 mutex_exit(&connp->conn_lock);
4181
4182 if (conn_ioctl_cleanup_reqd)
4183 conn_ioctl_cleanup(connp);
4184
4185 if (is_system_labeled() && connp->conn_anon_port) {
4186 (void) tsol_mlp_anon(crgetzone(connp->conn_cred),
4187 connp->conn_mlp_type, connp->conn_proto,
4188 ntohs(connp->conn_lport), B_FALSE);
4189 connp->conn_anon_port = 0;
4190 }
4191 connp->conn_mlp_type = mlptSingle;
4192
4193 /*
4194 * Remove this conn from any fanout list it is on.
4195 * and then wait for any threads currently operating
4196 * on this endpoint to finish
4197 */
4198 ipcl_hash_remove(connp);
4199
4200 /*
4201 * Remove this conn from the drain list, and do any other cleanup that
4202 * may be required. (TCP conns are never flow controlled, and
4203 * conn_idl will be NULL.)
4204 */
4205 if (drain_cleanup_reqd && connp->conn_idl != NULL) {
4206 idl_t *idl = connp->conn_idl;
4207
4208 mutex_enter(&idl->idl_lock);
4209 conn_drain(connp, B_TRUE);
4210 mutex_exit(&idl->idl_lock);
4211 }
4212
4213 if (connp == ipst->ips_ip_g_mrouter)
4214 (void) ip_mrouter_done(ipst);
4215
4216 if (ilg_cleanup_reqd)
4217 ilg_delete_all(connp);
4218
4219 /*
4220 * Now conn refcnt can increase only thru CONN_INC_REF_LOCKED.
4221 * callers from write side can't be there now because close
4222 * is in progress. The only other caller is ipcl_walk
4223 * which checks for the condemned flag.
4224 */
4225 mutex_enter(&connp->conn_lock);
4226 connp->conn_state_flags |= CONN_CONDEMNED;
4227 while (connp->conn_ref != 1)
4228 cv_wait(&connp->conn_cv, &connp->conn_lock);
4229 connp->conn_state_flags |= CONN_QUIESCED;
4230 mutex_exit(&connp->conn_lock);
4231 }
4232
4233 /* ARGSUSED */
4234 int
4235 ip_close(queue_t *q, int flags, cred_t *credp __unused)
4236 {
4237 conn_t *connp;
4238
4239 /*
4240 * Call the appropriate delete routine depending on whether this is
4241 * a module or device.
4242 */
4243 if (WR(q)->q_next != NULL) {
4244 /* This is a module close */
4245 return (ip_modclose((ill_t *)q->q_ptr));
4246 }
4247
4248 connp = q->q_ptr;
4249 ip_quiesce_conn(connp);
4250
4251 qprocsoff(q);
4252
4253 /*
4254 * Now we are truly single threaded on this stream, and can
4255 * delete the things hanging off the connp, and finally the connp.
4256 * We removed this connp from the fanout list, it cannot be
4257 * accessed thru the fanouts, and we already waited for the
4258 * conn_ref to drop to 0. We are already in close, so
4259 * there cannot be any other thread from the top. qprocsoff
4260 * has completed, and service has completed or won't run in
4261 * future.
4262 */
4263 ASSERT(connp->conn_ref == 1);
4264
4265 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4266
4267 connp->conn_ref--;
4268 ipcl_conn_destroy(connp);
4269
4270 q->q_ptr = WR(q)->q_ptr = NULL;
4271 return (0);
4272 }
4273
4274 /*
4275 * Wapper around putnext() so that ip_rts_request can merely use
4276 * conn_recv.
4277 */
4278 /*ARGSUSED2*/
4279 static void
4280 ip_conn_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
4281 {
4282 conn_t *connp = (conn_t *)arg1;
4283
4284 putnext(connp->conn_rq, mp);
4285 }
4286
4287 /* Dummy in case ICMP error delivery is attempted to a /dev/ip instance */
4288 /* ARGSUSED */
4289 static void
4290 ip_conn_input_icmp(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
4291 {
4292 freemsg(mp);
4293 }
4294
4295 /*
4296 * Called when the module is about to be unloaded
4297 */
4298 void
4299 ip_ddi_destroy(void)
4300 {
4301 /* This needs to be called before destroying any transports. */
4302 mutex_enter(&cpu_lock);
4303 unregister_cpu_setup_func(ip_tp_cpu_update, NULL);
4304 mutex_exit(&cpu_lock);
4305
4306 tnet_fini();
4307
4308 icmp_ddi_g_destroy();
4309 rts_ddi_g_destroy();
4310 udp_ddi_g_destroy();
4311 sctp_ddi_g_destroy();
4312 tcp_ddi_g_destroy();
4313 ilb_ddi_g_destroy();
4314 dce_g_destroy();
4315 ipsec_policy_g_destroy();
4316 ipcl_g_destroy();
4317 ip_net_g_destroy();
4318 ip_ire_g_fini();
4319 inet_minor_destroy(ip_minor_arena_sa);
4320 #if defined(_LP64)
4321 inet_minor_destroy(ip_minor_arena_la);
4322 #endif
4323
4324 #ifdef DEBUG
4325 list_destroy(&ip_thread_list);
4326 rw_destroy(&ip_thread_rwlock);
4327 tsd_destroy(&ip_thread_data);
4328 #endif
4329
4330 netstack_unregister(NS_IP);
4331 }
4332
4333 /*
4334 * First step in cleanup.
4335 */
4336 /* ARGSUSED */
4337 static void
4338 ip_stack_shutdown(netstackid_t stackid, void *arg)
4339 {
4340 ip_stack_t *ipst = (ip_stack_t *)arg;
4341 kt_did_t ktid;
4342
4343 #ifdef NS_DEBUG
4344 printf("ip_stack_shutdown(%p, stack %d)\n", (void *)ipst, stackid);
4345 #endif
4346
4347 /*
4348 * Perform cleanup for special interfaces (loopback and IPMP).
4349 */
4350 ip_interface_cleanup(ipst);
4351
4352 /*
4353 * The *_hook_shutdown()s start the process of notifying any
4354 * consumers that things are going away.... nothing is destroyed.
4355 */
4356 ipv4_hook_shutdown(ipst);
4357 ipv6_hook_shutdown(ipst);
4358 arp_hook_shutdown(ipst);
4359
4360 mutex_enter(&ipst->ips_capab_taskq_lock);
4361 ktid = ipst->ips_capab_taskq_thread->t_did;
4362 ipst->ips_capab_taskq_quit = B_TRUE;
4363 cv_signal(&ipst->ips_capab_taskq_cv);
4364 mutex_exit(&ipst->ips_capab_taskq_lock);
4365
4366 /*
4367 * In rare occurrences, particularly on virtual hardware where CPUs can
4368 * be de-scheduled, the thread that we just signaled will not run until
4369 * after we have gotten through parts of ip_stack_fini. If that happens
4370 * then we'll try to grab the ips_capab_taskq_lock as part of returning
4371 * from cv_wait which no longer exists.
4372 */
4373 thread_join(ktid);
4374 }
4375
4376 /*
4377 * Free the IP stack instance.
4378 */
4379 static void
4380 ip_stack_fini(netstackid_t stackid, void *arg)
4381 {
4382 ip_stack_t *ipst = (ip_stack_t *)arg;
4383 int ret;
4384
4385 #ifdef NS_DEBUG
4386 printf("ip_stack_fini(%p, stack %d)\n", (void *)ipst, stackid);
4387 #endif
4388 /*
4389 * At this point, all of the notifications that the events and
4390 * protocols are going away have been run, meaning that we can
4391 * now set about starting to clean things up.
4392 */
4393 ipobs_fini(ipst);
4394 ipv4_hook_destroy(ipst);
4395 ipv6_hook_destroy(ipst);
4396 arp_hook_destroy(ipst);
4397 ip_net_destroy(ipst);
4398
4399 ipmp_destroy(ipst);
4400
4401 ip_kstat_fini(stackid, ipst->ips_ip_mibkp);
4402 ipst->ips_ip_mibkp = NULL;
4403 icmp_kstat_fini(stackid, ipst->ips_icmp_mibkp);
4404 ipst->ips_icmp_mibkp = NULL;
4405 ip_kstat2_fini(stackid, ipst->ips_ip_kstat);
4406 ipst->ips_ip_kstat = NULL;
4407 bzero(&ipst->ips_ip_statistics, sizeof (ipst->ips_ip_statistics));
4408 ip6_kstat_fini(stackid, ipst->ips_ip6_kstat);
4409 ipst->ips_ip6_kstat = NULL;
4410 bzero(&ipst->ips_ip6_statistics, sizeof (ipst->ips_ip6_statistics));
4411
4412 kmem_free(ipst->ips_propinfo_tbl,
4413 ip_propinfo_count * sizeof (mod_prop_info_t));
4414 ipst->ips_propinfo_tbl = NULL;
4415
4416 dce_stack_destroy(ipst);
4417 ip_mrouter_stack_destroy(ipst);
4418
4419 /*
4420 * Quiesce all of our timers. Note we set the quiesce flags before we
4421 * call untimeout. The slowtimers may actually kick off another instance
4422 * of the non-slow timers.
4423 */
4424 mutex_enter(&ipst->ips_igmp_timer_lock);
4425 ipst->ips_igmp_timer_quiesce = B_TRUE;
4426 mutex_exit(&ipst->ips_igmp_timer_lock);
4427
4428 mutex_enter(&ipst->ips_mld_timer_lock);
4429 ipst->ips_mld_timer_quiesce = B_TRUE;
4430 mutex_exit(&ipst->ips_mld_timer_lock);
4431
4432 mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
4433 ipst->ips_igmp_slowtimeout_quiesce = B_TRUE;
4434 mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
4435
4436 mutex_enter(&ipst->ips_mld_slowtimeout_lock);
4437 ipst->ips_mld_slowtimeout_quiesce = B_TRUE;
4438 mutex_exit(&ipst->ips_mld_slowtimeout_lock);
4439
4440 ret = untimeout(ipst->ips_igmp_timeout_id);
4441 if (ret == -1) {
4442 ASSERT(ipst->ips_igmp_timeout_id == 0);
4443 } else {
4444 ASSERT(ipst->ips_igmp_timeout_id != 0);
4445 ipst->ips_igmp_timeout_id = 0;
4446 }
4447 ret = untimeout(ipst->ips_igmp_slowtimeout_id);
4448 if (ret == -1) {
4449 ASSERT(ipst->ips_igmp_slowtimeout_id == 0);
4450 } else {
4451 ASSERT(ipst->ips_igmp_slowtimeout_id != 0);
4452 ipst->ips_igmp_slowtimeout_id = 0;
4453 }
4454 ret = untimeout(ipst->ips_mld_timeout_id);
4455 if (ret == -1) {
4456 ASSERT(ipst->ips_mld_timeout_id == 0);
4457 } else {
4458 ASSERT(ipst->ips_mld_timeout_id != 0);
4459 ipst->ips_mld_timeout_id = 0;
4460 }
4461 ret = untimeout(ipst->ips_mld_slowtimeout_id);
4462 if (ret == -1) {
4463 ASSERT(ipst->ips_mld_slowtimeout_id == 0);
4464 } else {
4465 ASSERT(ipst->ips_mld_slowtimeout_id != 0);
4466 ipst->ips_mld_slowtimeout_id = 0;
4467 }
4468
4469 ip_ire_fini(ipst);
4470 ip6_asp_free(ipst);
4471 conn_drain_fini(ipst);
4472 ipcl_destroy(ipst);
4473
4474 mutex_destroy(&ipst->ips_ndp4->ndp_g_lock);
4475 mutex_destroy(&ipst->ips_ndp6->ndp_g_lock);
4476 kmem_free(ipst->ips_ndp4, sizeof (ndp_g_t));
4477 ipst->ips_ndp4 = NULL;
4478 kmem_free(ipst->ips_ndp6, sizeof (ndp_g_t));
4479 ipst->ips_ndp6 = NULL;
4480
4481 if (ipst->ips_loopback_ksp != NULL) {
4482 kstat_delete_netstack(ipst->ips_loopback_ksp, stackid);
4483 ipst->ips_loopback_ksp = NULL;
4484 }
4485
4486 mutex_destroy(&ipst->ips_capab_taskq_lock);
4487 cv_destroy(&ipst->ips_capab_taskq_cv);
4488
4489 rw_destroy(&ipst->ips_srcid_lock);
4490
4491 mutex_destroy(&ipst->ips_ip_mi_lock);
4492 rw_destroy(&ipst->ips_ill_g_usesrc_lock);
4493
4494 mutex_destroy(&ipst->ips_igmp_timer_lock);
4495 mutex_destroy(&ipst->ips_mld_timer_lock);
4496 mutex_destroy(&ipst->ips_igmp_slowtimeout_lock);
4497 mutex_destroy(&ipst->ips_mld_slowtimeout_lock);
4498 mutex_destroy(&ipst->ips_ip_addr_avail_lock);
4499 rw_destroy(&ipst->ips_ill_g_lock);
4500
4501 kmem_free(ipst->ips_phyint_g_list, sizeof (phyint_list_t));
4502 ipst->ips_phyint_g_list = NULL;
4503 kmem_free(ipst->ips_ill_g_heads, sizeof (ill_g_head_t) * MAX_G_HEADS);
4504 ipst->ips_ill_g_heads = NULL;
4505
4506 ldi_ident_release(ipst->ips_ldi_ident);
4507 kmem_free(ipst, sizeof (*ipst));
4508 }
4509
4510 /*
4511 * This function is called from the TSD destructor, and is used to debug
4512 * reference count issues in IP. See block comment in <inet/ip_if.h> for
4513 * details.
4514 */
4515 static void
4516 ip_thread_exit(void *phash)
4517 {
4518 th_hash_t *thh = phash;
4519
4520 rw_enter(&ip_thread_rwlock, RW_WRITER);
4521 list_remove(&ip_thread_list, thh);
4522 rw_exit(&ip_thread_rwlock);
4523 mod_hash_destroy_hash(thh->thh_hash);
4524 kmem_free(thh, sizeof (*thh));
4525 }
4526
4527 /*
4528 * Called when the IP kernel module is loaded into the kernel
4529 */
4530 void
4531 ip_ddi_init(void)
4532 {
4533 ip_squeue_flag = ip_squeue_switch(ip_squeue_enter);
4534
4535 /*
4536 * For IP and TCP the minor numbers should start from 2 since we have 4
4537 * initial devices: ip, ip6, tcp, tcp6.
4538 */
4539 /*
4540 * If this is a 64-bit kernel, then create two separate arenas -
4541 * one for TLIs in the range of INET_MIN_DEV+2 through 2^^18-1, and the
4542 * other for socket apps in the range 2^^18 through 2^^32-1.
4543 */
4544 ip_minor_arena_la = NULL;
4545 ip_minor_arena_sa = NULL;
4546 #if defined(_LP64)
4547 if ((ip_minor_arena_sa = inet_minor_create("ip_minor_arena_sa",
4548 INET_MIN_DEV + 2, MAXMIN32, KM_SLEEP)) == NULL) {
4549 cmn_err(CE_PANIC,
4550 "ip_ddi_init: ip_minor_arena_sa creation failed\n");
4551 }
4552 if ((ip_minor_arena_la = inet_minor_create("ip_minor_arena_la",
4553 MAXMIN32 + 1, MAXMIN64, KM_SLEEP)) == NULL) {
4554 cmn_err(CE_PANIC,
4555 "ip_ddi_init: ip_minor_arena_la creation failed\n");
4556 }
4557 #else
4558 if ((ip_minor_arena_sa = inet_minor_create("ip_minor_arena_sa",
4559 INET_MIN_DEV + 2, MAXMIN, KM_SLEEP)) == NULL) {
4560 cmn_err(CE_PANIC,
4561 "ip_ddi_init: ip_minor_arena_sa creation failed\n");
4562 }
4563 #endif
4564 ip_poll_normal_ticks = MSEC_TO_TICK_ROUNDUP(ip_poll_normal_ms);
4565
4566 ipcl_g_init();
4567 ip_ire_g_init();
4568 ip_net_g_init();
4569
4570 #ifdef DEBUG
4571 tsd_create(&ip_thread_data, ip_thread_exit);
4572 rw_init(&ip_thread_rwlock, NULL, RW_DEFAULT, NULL);
4573 list_create(&ip_thread_list, sizeof (th_hash_t),
4574 offsetof(th_hash_t, thh_link));
4575 #endif
4576 ipsec_policy_g_init();
4577 tcp_ddi_g_init();
4578 sctp_ddi_g_init();
4579 dce_g_init();
4580
4581 /*
4582 * We want to be informed each time a stack is created or
4583 * destroyed in the kernel, so we can maintain the
4584 * set of udp_stack_t's.
4585 */
4586 netstack_register(NS_IP, ip_stack_init, ip_stack_shutdown,
4587 ip_stack_fini);
4588
4589 tnet_init();
4590
4591 udp_ddi_g_init();
4592 rts_ddi_g_init();
4593 icmp_ddi_g_init();
4594 ilb_ddi_g_init();
4595
4596 /* This needs to be called after all transports are initialized. */
4597 mutex_enter(&cpu_lock);
4598 register_cpu_setup_func(ip_tp_cpu_update, NULL);
4599 mutex_exit(&cpu_lock);
4600 }
4601
4602 /*
4603 * Initialize the IP stack instance.
4604 */
4605 static void *
4606 ip_stack_init(netstackid_t stackid, netstack_t *ns)
4607 {
4608 ip_stack_t *ipst;
4609 size_t arrsz;
4610 major_t major;
4611
4612 #ifdef NS_DEBUG
4613 printf("ip_stack_init(stack %d)\n", stackid);
4614 #endif
4615
4616 ipst = (ip_stack_t *)kmem_zalloc(sizeof (*ipst), KM_SLEEP);
4617 ipst->ips_netstack = ns;
4618
4619 ipst->ips_ill_g_heads = kmem_zalloc(sizeof (ill_g_head_t) * MAX_G_HEADS,
4620 KM_SLEEP);
4621 ipst->ips_phyint_g_list = kmem_zalloc(sizeof (phyint_list_t),
4622 KM_SLEEP);
4623 ipst->ips_ndp4 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP);
4624 ipst->ips_ndp6 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP);
4625 mutex_init(&ipst->ips_ndp4->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL);
4626 mutex_init(&ipst->ips_ndp6->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL);
4627
4628 mutex_init(&ipst->ips_igmp_timer_lock, NULL, MUTEX_DEFAULT, NULL);
4629 ipst->ips_igmp_deferred_next = INFINITY;
4630 mutex_init(&ipst->ips_mld_timer_lock, NULL, MUTEX_DEFAULT, NULL);
4631 ipst->ips_mld_deferred_next = INFINITY;
4632 mutex_init(&ipst->ips_igmp_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL);
4633 mutex_init(&ipst->ips_mld_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL);
4634 mutex_init(&ipst->ips_ip_mi_lock, NULL, MUTEX_DEFAULT, NULL);
4635 mutex_init(&ipst->ips_ip_addr_avail_lock, NULL, MUTEX_DEFAULT, NULL);
4636 rw_init(&ipst->ips_ill_g_lock, NULL, RW_DEFAULT, NULL);
4637 rw_init(&ipst->ips_ill_g_usesrc_lock, NULL, RW_DEFAULT, NULL);
4638
4639 ipcl_init(ipst);
4640 ip_ire_init(ipst);
4641 ip6_asp_init(ipst);
4642 ipif_init(ipst);
4643 conn_drain_init(ipst);
4644 ip_mrouter_stack_init(ipst);
4645 dce_stack_init(ipst);
4646
4647 ipst->ips_ip_multirt_log_interval = 1000;
4648
4649 ipst->ips_ill_index = 1;
4650
4651 ipst->ips_saved_ip_forwarding = -1;
4652 ipst->ips_reg_vif_num = ALL_VIFS; /* Index to Register vif */
4653
4654 arrsz = ip_propinfo_count * sizeof (mod_prop_info_t);
4655 ipst->ips_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP);
4656 bcopy(ip_propinfo_tbl, ipst->ips_propinfo_tbl, arrsz);
4657
4658 ipst->ips_ip_mibkp = ip_kstat_init(stackid, ipst);
4659 ipst->ips_icmp_mibkp = icmp_kstat_init(stackid);
4660 ipst->ips_ip_kstat = ip_kstat2_init(stackid, &ipst->ips_ip_statistics);
4661 ipst->ips_ip6_kstat =
4662 ip6_kstat_init(stackid, &ipst->ips_ip6_statistics);
4663
4664 ipst->ips_ip_src_id = 1;
4665 rw_init(&ipst->ips_srcid_lock, NULL, RW_DEFAULT, NULL);
4666
4667 ipst->ips_src_generation = SRC_GENERATION_INITIAL;
4668
4669 ip_net_init(ipst, ns);
4670 ipv4_hook_init(ipst);
4671 ipv6_hook_init(ipst);
4672 arp_hook_init(ipst);
4673 ipmp_init(ipst);
4674 ipobs_init(ipst);
4675
4676 /*
4677 * Create the taskq dispatcher thread and initialize related stuff.
4678 */
4679 mutex_init(&ipst->ips_capab_taskq_lock, NULL, MUTEX_DEFAULT, NULL);
4680 cv_init(&ipst->ips_capab_taskq_cv, NULL, CV_DEFAULT, NULL);
4681 ipst->ips_capab_taskq_thread = thread_create(NULL, 0,
4682 ill_taskq_dispatch, ipst, 0, &p0, TS_RUN, minclsyspri);
4683
4684 major = mod_name_to_major(INET_NAME);
4685 (void) ldi_ident_from_major(major, &ipst->ips_ldi_ident);
4686 return (ipst);
4687 }
4688
4689 /*
4690 * Allocate and initialize a DLPI template of the specified length. (May be
4691 * called as writer.)
4692 */
4693 mblk_t *
4694 ip_dlpi_alloc(size_t len, t_uscalar_t prim)
4695 {
4696 mblk_t *mp;
4697
4698 mp = allocb(len, BPRI_MED);
4699 if (!mp)
4700 return (NULL);
4701
4702 /*
4703 * DLPIv2 says that DL_INFO_REQ and DL_TOKEN_REQ (the latter
4704 * of which we don't seem to use) are sent with M_PCPROTO, and
4705 * that other DLPI are M_PROTO.
4706 */
4707 if (prim == DL_INFO_REQ) {
4708 mp->b_datap->db_type = M_PCPROTO;
4709 } else {
4710 mp->b_datap->db_type = M_PROTO;
4711 }
4712
4713 mp->b_wptr = mp->b_rptr + len;
4714 bzero(mp->b_rptr, len);
4715 ((dl_unitdata_req_t *)mp->b_rptr)->dl_primitive = prim;
4716 return (mp);
4717 }
4718
4719 /*
4720 * Allocate and initialize a DLPI notification. (May be called as writer.)
4721 */
4722 mblk_t *
4723 ip_dlnotify_alloc(uint_t notification, uint_t data)
4724 {
4725 dl_notify_ind_t *notifyp;
4726 mblk_t *mp;
4727
4728 if ((mp = ip_dlpi_alloc(DL_NOTIFY_IND_SIZE, DL_NOTIFY_IND)) == NULL)
4729 return (NULL);
4730
4731 notifyp = (dl_notify_ind_t *)mp->b_rptr;
4732 notifyp->dl_notification = notification;
4733 notifyp->dl_data = data;
4734 return (mp);
4735 }
4736
4737 mblk_t *
4738 ip_dlnotify_alloc2(uint_t notification, uint_t data1, uint_t data2)
4739 {
4740 dl_notify_ind_t *notifyp;
4741 mblk_t *mp;
4742
4743 if ((mp = ip_dlpi_alloc(DL_NOTIFY_IND_SIZE, DL_NOTIFY_IND)) == NULL)
4744 return (NULL);
4745
4746 notifyp = (dl_notify_ind_t *)mp->b_rptr;
4747 notifyp->dl_notification = notification;
4748 notifyp->dl_data1 = data1;
4749 notifyp->dl_data2 = data2;
4750 return (mp);
4751 }
4752
4753 /*
4754 * Debug formatting routine. Returns a character string representation of the
4755 * addr in buf, of the form xxx.xxx.xxx.xxx. This routine takes the address
4756 * in the form of a ipaddr_t and calls ip_dot_saddr with a pointer.
4757 *
4758 * Once the ndd table-printing interfaces are removed, this can be changed to
4759 * standard dotted-decimal form.
4760 */
4761 char *
4762 ip_dot_addr(ipaddr_t addr, char *buf)
4763 {
4764 uint8_t *ap = (uint8_t *)&addr;
4765
4766 (void) mi_sprintf(buf, "%03d.%03d.%03d.%03d",
4767 ap[0] & 0xFF, ap[1] & 0xFF, ap[2] & 0xFF, ap[3] & 0xFF);
4768 return (buf);
4769 }
4770
4771 /*
4772 * Write the given MAC address as a printable string in the usual colon-
4773 * separated format.
4774 */
4775 const char *
4776 mac_colon_addr(const uint8_t *addr, size_t alen, char *buf, size_t buflen)
4777 {
4778 char *bp;
4779
4780 if (alen == 0 || buflen < 4)
4781 return ("?");
4782 bp = buf;
4783 for (;;) {
4784 /*
4785 * If there are more MAC address bytes available, but we won't
4786 * have any room to print them, then add "..." to the string
4787 * instead. See below for the 'magic number' explanation.
4788 */
4789 if ((alen == 2 && buflen < 6) || (alen > 2 && buflen < 7)) {
4790 (void) strcpy(bp, "...");
4791 break;
4792 }
4793 (void) sprintf(bp, "%02x", *addr++);
4794 bp += 2;
4795 if (--alen == 0)
4796 break;
4797 *bp++ = ':';
4798 buflen -= 3;
4799 /*
4800 * At this point, based on the first 'if' statement above,
4801 * either alen == 1 and buflen >= 3, or alen > 1 and
4802 * buflen >= 4. The first case leaves room for the final "xx"
4803 * number and trailing NUL byte. The second leaves room for at
4804 * least "...". Thus the apparently 'magic' numbers chosen for
4805 * that statement.
4806 */
4807 }
4808 return (buf);
4809 }
4810
4811 /*
4812 * Called when it is conceptually a ULP that would sent the packet
4813 * e.g., port unreachable and protocol unreachable. Check that the packet
4814 * would have passed the IPsec global policy before sending the error.
4815 *
4816 * Send an ICMP error after patching up the packet appropriately.
4817 * Uses ip_drop_input and bumps the appropriate MIB.
4818 */
4819 void
4820 ip_fanout_send_icmp_v4(mblk_t *mp, uint_t icmp_type, uint_t icmp_code,
4821 ip_recv_attr_t *ira)
4822 {
4823 ipha_t *ipha;
4824 boolean_t secure;
4825 ill_t *ill = ira->ira_ill;
4826 ip_stack_t *ipst = ill->ill_ipst;
4827 netstack_t *ns = ipst->ips_netstack;
4828 ipsec_stack_t *ipss = ns->netstack_ipsec;
4829
4830 secure = ira->ira_flags & IRAF_IPSEC_SECURE;
4831
4832 /*
4833 * We are generating an icmp error for some inbound packet.
4834 * Called from all ip_fanout_(udp, tcp, proto) functions.
4835 * Before we generate an error, check with global policy
4836 * to see whether this is allowed to enter the system. As
4837 * there is no "conn", we are checking with global policy.
4838 */
4839 ipha = (ipha_t *)mp->b_rptr;
4840 if (secure || ipss->ipsec_inbound_v4_policy_present) {
4841 mp = ipsec_check_global_policy(mp, NULL, ipha, NULL, ira, ns);
4842 if (mp == NULL)
4843 return;
4844 }
4845
4846 /* We never send errors for protocols that we do implement */
4847 if (ira->ira_protocol == IPPROTO_ICMP ||
4848 ira->ira_protocol == IPPROTO_IGMP) {
4849 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
4850 ip_drop_input("ip_fanout_send_icmp_v4", mp, ill);
4851 freemsg(mp);
4852 return;
4853 }
4854 /*
4855 * Have to correct checksum since
4856 * the packet might have been
4857 * fragmented and the reassembly code in ip_rput
4858 * does not restore the IP checksum.
4859 */
4860 ipha->ipha_hdr_checksum = 0;
4861 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
4862
4863 switch (icmp_type) {
4864 case ICMP_DEST_UNREACHABLE:
4865 switch (icmp_code) {
4866 case ICMP_PROTOCOL_UNREACHABLE:
4867 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInUnknownProtos);
4868 ip_drop_input("ipIfStatsInUnknownProtos", mp, ill);
4869 break;
4870 case ICMP_PORT_UNREACHABLE:
4871 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts);
4872 ip_drop_input("ipIfStatsNoPorts", mp, ill);
4873 break;
4874 }
4875
4876 icmp_unreachable(mp, icmp_code, ira);
4877 break;
4878 default:
4879 #ifdef DEBUG
4880 panic("ip_fanout_send_icmp_v4: wrong type");
4881 /*NOTREACHED*/
4882 #else
4883 freemsg(mp);
4884 break;
4885 #endif
4886 }
4887 }
4888
4889 /*
4890 * Used to send an ICMP error message when a packet is received for
4891 * a protocol that is not supported. The mblk passed as argument
4892 * is consumed by this function.
4893 */
4894 void
4895 ip_proto_not_sup(mblk_t *mp, ip_recv_attr_t *ira)
4896 {
4897 ipha_t *ipha;
4898
4899 ipha = (ipha_t *)mp->b_rptr;
4900 if (ira->ira_flags & IRAF_IS_IPV4) {
4901 ASSERT(IPH_HDR_VERSION(ipha) == IP_VERSION);
4902 ip_fanout_send_icmp_v4(mp, ICMP_DEST_UNREACHABLE,
4903 ICMP_PROTOCOL_UNREACHABLE, ira);
4904 } else {
4905 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
4906 ip_fanout_send_icmp_v6(mp, ICMP6_PARAM_PROB,
4907 ICMP6_PARAMPROB_NEXTHEADER, ira);
4908 }
4909 }
4910
4911 /*
4912 * Deliver a rawip packet to the given conn, possibly applying ipsec policy.
4913 * Handles IPv4 and IPv6.
4914 * We are responsible for disposing of mp, such as by freemsg() or putnext()
4915 * Caller is responsible for dropping references to the conn.
4916 */
4917 void
4918 ip_fanout_proto_conn(conn_t *connp, mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
4919 ip_recv_attr_t *ira)
4920 {
4921 ill_t *ill = ira->ira_ill;
4922 ip_stack_t *ipst = ill->ill_ipst;
4923 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
4924 boolean_t secure;
4925 uint_t protocol = ira->ira_protocol;
4926 iaflags_t iraflags = ira->ira_flags;
4927 queue_t *rq;
4928
4929 secure = iraflags & IRAF_IPSEC_SECURE;
4930
4931 rq = connp->conn_rq;
4932 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : !canputnext(rq)) {
4933 switch (protocol) {
4934 case IPPROTO_ICMPV6:
4935 BUMP_MIB(ill->ill_icmp6_mib, ipv6IfIcmpInOverflows);
4936 break;
4937 case IPPROTO_ICMP:
4938 BUMP_MIB(&ipst->ips_icmp_mib, icmpInOverflows);
4939 break;
4940 default:
4941 BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows);
4942 break;
4943 }
4944 freemsg(mp);
4945 return;
4946 }
4947
4948 ASSERT(!(IPCL_IS_IPTUN(connp)));
4949
4950 if (((iraflags & IRAF_IS_IPV4) ?
4951 CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
4952 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
4953 secure) {
4954 mp = ipsec_check_inbound_policy(mp, connp, ipha,
4955 ip6h, ira);
4956 if (mp == NULL) {
4957 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
4958 /* Note that mp is NULL */
4959 ip_drop_input("ipIfStatsInDiscards", mp, ill);
4960 return;
4961 }
4962 }
4963
4964 if (iraflags & IRAF_ICMP_ERROR) {
4965 (connp->conn_recvicmp)(connp, mp, NULL, ira);
4966 } else {
4967 ill_t *rill = ira->ira_rill;
4968
4969 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
4970 ira->ira_ill = ira->ira_rill = NULL;
4971 /* Send it upstream */
4972 (connp->conn_recv)(connp, mp, NULL, ira);
4973 ira->ira_ill = ill;
4974 ira->ira_rill = rill;
4975 }
4976 }
4977
4978 /*
4979 * Handle protocols with which IP is less intimate. There
4980 * can be more than one stream bound to a particular
4981 * protocol. When this is the case, normally each one gets a copy
4982 * of any incoming packets.
4983 *
4984 * IPsec NOTE :
4985 *
4986 * Don't allow a secure packet going up a non-secure connection.
4987 * We don't allow this because
4988 *
4989 * 1) Reply might go out in clear which will be dropped at
4990 * the sending side.
4991 * 2) If the reply goes out in clear it will give the
4992 * adversary enough information for getting the key in
4993 * most of the cases.
4994 *
4995 * Moreover getting a secure packet when we expect clear
4996 * implies that SA's were added without checking for
4997 * policy on both ends. This should not happen once ISAKMP
4998 * is used to negotiate SAs as SAs will be added only after
4999 * verifying the policy.
5000 *
5001 * Zones notes:
5002 * Earlier in ip_input on a system with multiple shared-IP zones we
5003 * duplicate the multicast and broadcast packets and send them up
5004 * with each explicit zoneid that exists on that ill.
5005 * This means that here we can match the zoneid with SO_ALLZONES being special.
5006 */
5007 void
5008 ip_fanout_proto_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
5009 {
5010 mblk_t *mp1;
5011 ipaddr_t laddr;
5012 conn_t *connp, *first_connp, *next_connp;
5013 connf_t *connfp;
5014 ill_t *ill = ira->ira_ill;
5015 ip_stack_t *ipst = ill->ill_ipst;
5016
5017 laddr = ipha->ipha_dst;
5018
5019 connfp = &ipst->ips_ipcl_proto_fanout_v4[ira->ira_protocol];
5020 mutex_enter(&connfp->connf_lock);
5021 connp = connfp->connf_head;
5022 for (connp = connfp->connf_head; connp != NULL;
5023 connp = connp->conn_next) {
5024 /* Note: IPCL_PROTO_MATCH includes conn_wantpacket */
5025 if (IPCL_PROTO_MATCH(connp, ira, ipha) &&
5026 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5027 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp))) {
5028 break;
5029 }
5030 }
5031
5032 if (connp == NULL) {
5033 /*
5034 * No one bound to these addresses. Is
5035 * there a client that wants all
5036 * unclaimed datagrams?
5037 */
5038 mutex_exit(&connfp->connf_lock);
5039 ip_fanout_send_icmp_v4(mp, ICMP_DEST_UNREACHABLE,
5040 ICMP_PROTOCOL_UNREACHABLE, ira);
5041 return;
5042 }
5043
5044 ASSERT(IPCL_IS_NONSTR(connp) || connp->conn_rq != NULL);
5045
5046 CONN_INC_REF(connp);
5047 first_connp = connp;
5048 connp = connp->conn_next;
5049
5050 for (;;) {
5051 while (connp != NULL) {
5052 /* Note: IPCL_PROTO_MATCH includes conn_wantpacket */
5053 if (IPCL_PROTO_MATCH(connp, ira, ipha) &&
5054 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5055 tsol_receive_local(mp, &laddr, IPV4_VERSION,
5056 ira, connp)))
5057 break;
5058 connp = connp->conn_next;
5059 }
5060
5061 if (connp == NULL) {
5062 /* No more interested clients */
5063 connp = first_connp;
5064 break;
5065 }
5066 if (((mp1 = dupmsg(mp)) == NULL) &&
5067 ((mp1 = copymsg(mp)) == NULL)) {
5068 /* Memory allocation failed */
5069 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5070 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5071 connp = first_connp;
5072 break;
5073 }
5074
5075 CONN_INC_REF(connp);
5076 mutex_exit(&connfp->connf_lock);
5077
5078 ip_fanout_proto_conn(connp, mp1, (ipha_t *)mp1->b_rptr, NULL,
5079 ira);
5080
5081 mutex_enter(&connfp->connf_lock);
5082 /* Follow the next pointer before releasing the conn. */
5083 next_connp = connp->conn_next;
5084 CONN_DEC_REF(connp);
5085 connp = next_connp;
5086 }
5087
5088 /* Last one. Send it upstream. */
5089 mutex_exit(&connfp->connf_lock);
5090
5091 ip_fanout_proto_conn(connp, mp, ipha, NULL, ira);
5092
5093 CONN_DEC_REF(connp);
5094 }
5095
5096 /*
5097 * If we have a IPsec NAT-Traversal packet, strip the zero-SPI or
5098 * pass it along to ESP if the SPI is non-zero. Returns the mblk if the mblk
5099 * is not consumed.
5100 *
5101 * One of three things can happen, all of which affect the passed-in mblk:
5102 *
5103 * 1.) The packet is stock UDP and gets its zero-SPI stripped. Return mblk..
5104 *
5105 * 2.) The packet is ESP-in-UDP, gets transformed into an equivalent
5106 * ESP packet, and is passed along to ESP for consumption. Return NULL.
5107 *
5108 * 3.) The packet is an ESP-in-UDP Keepalive. Drop it and return NULL.
5109 */
5110 mblk_t *
5111 zero_spi_check(mblk_t *mp, ip_recv_attr_t *ira)
5112 {
5113 int shift, plen, iph_len;
5114 ipha_t *ipha;
5115 udpha_t *udpha;
5116 uint32_t *spi;
5117 uint32_t esp_ports;
5118 uint8_t *orptr;
5119 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
5120 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5121
5122 ipha = (ipha_t *)mp->b_rptr;
5123 iph_len = ira->ira_ip_hdr_length;
5124 plen = ira->ira_pktlen;
5125
5126 if (plen - iph_len - sizeof (udpha_t) < sizeof (uint32_t)) {
5127 /*
5128 * Most likely a keepalive for the benefit of an intervening
5129 * NAT. These aren't for us, per se, so drop it.
5130 *
5131 * RFC 3947/8 doesn't say for sure what to do for 2-3
5132 * byte packets (keepalives are 1-byte), but we'll drop them
5133 * also.
5134 */
5135 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
5136 DROPPER(ipss, ipds_esp_nat_t_ka), &ipss->ipsec_dropper);
5137 return (NULL);
5138 }
5139
5140 if (MBLKL(mp) < iph_len + sizeof (udpha_t) + sizeof (*spi)) {
5141 /* might as well pull it all up - it might be ESP. */
5142 if (!pullupmsg(mp, -1)) {
5143 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
5144 DROPPER(ipss, ipds_esp_nomem),
5145 &ipss->ipsec_dropper);
5146 return (NULL);
5147 }
5148
5149 ipha = (ipha_t *)mp->b_rptr;
5150 }
5151 spi = (uint32_t *)(mp->b_rptr + iph_len + sizeof (udpha_t));
5152 if (*spi == 0) {
5153 /* UDP packet - remove 0-spi. */
5154 shift = sizeof (uint32_t);
5155 } else {
5156 /* ESP-in-UDP packet - reduce to ESP. */
5157 ipha->ipha_protocol = IPPROTO_ESP;
5158 shift = sizeof (udpha_t);
5159 }
5160
5161 /* Fix IP header */
5162 ira->ira_pktlen = (plen - shift);
5163 ipha->ipha_length = htons(ira->ira_pktlen);
5164 ipha->ipha_hdr_checksum = 0;
5165
5166 orptr = mp->b_rptr;
5167 mp->b_rptr += shift;
5168
5169 udpha = (udpha_t *)(orptr + iph_len);
5170 if (*spi == 0) {
5171 ASSERT((uint8_t *)ipha == orptr);
5172 udpha->uha_length = htons(plen - shift - iph_len);
5173 iph_len += sizeof (udpha_t); /* For the call to ovbcopy(). */
5174 esp_ports = 0;
5175 } else {
5176 esp_ports = *((uint32_t *)udpha);
5177 ASSERT(esp_ports != 0);
5178 }
5179 ovbcopy(orptr, orptr + shift, iph_len);
5180 if (esp_ports != 0) /* Punt up for ESP processing. */ {
5181 ipha = (ipha_t *)(orptr + shift);
5182
5183 ira->ira_flags |= IRAF_ESP_UDP_PORTS;
5184 ira->ira_esp_udp_ports = esp_ports;
5185 ip_fanout_v4(mp, ipha, ira);
5186 return (NULL);
5187 }
5188 return (mp);
5189 }
5190
5191 /*
5192 * Deliver a udp packet to the given conn, possibly applying ipsec policy.
5193 * Handles IPv4 and IPv6.
5194 * We are responsible for disposing of mp, such as by freemsg() or putnext()
5195 * Caller is responsible for dropping references to the conn.
5196 */
5197 void
5198 ip_fanout_udp_conn(conn_t *connp, mblk_t *mp, ipha_t *ipha, ip6_t *ip6h,
5199 ip_recv_attr_t *ira)
5200 {
5201 ill_t *ill = ira->ira_ill;
5202 ip_stack_t *ipst = ill->ill_ipst;
5203 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5204 boolean_t secure;
5205 iaflags_t iraflags = ira->ira_flags;
5206
5207 secure = iraflags & IRAF_IPSEC_SECURE;
5208
5209 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld :
5210 !canputnext(connp->conn_rq)) {
5211 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
5212 freemsg(mp);
5213 return;
5214 }
5215
5216 if (((iraflags & IRAF_IS_IPV4) ?
5217 CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
5218 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
5219 secure) {
5220 mp = ipsec_check_inbound_policy(mp, connp, ipha,
5221 ip6h, ira);
5222 if (mp == NULL) {
5223 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5224 /* Note that mp is NULL */
5225 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5226 return;
5227 }
5228 }
5229
5230 /*
5231 * Since this code is not used for UDP unicast we don't need a NAT_T
5232 * check. Only ip_fanout_v4 has that check.
5233 */
5234 if (ira->ira_flags & IRAF_ICMP_ERROR) {
5235 (connp->conn_recvicmp)(connp, mp, NULL, ira);
5236 } else {
5237 ill_t *rill = ira->ira_rill;
5238
5239 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
5240 ira->ira_ill = ira->ira_rill = NULL;
5241 /* Send it upstream */
5242 (connp->conn_recv)(connp, mp, NULL, ira);
5243 ira->ira_ill = ill;
5244 ira->ira_rill = rill;
5245 }
5246 }
5247
5248 /*
5249 * Fanout for UDP packets that are multicast or broadcast, and ICMP errors.
5250 * (Unicast fanout is handled in ip_input_v4.)
5251 *
5252 * If SO_REUSEADDR is set all multicast and broadcast packets
5253 * will be delivered to all conns bound to the same port.
5254 *
5255 * If there is at least one matching AF_INET receiver, then we will
5256 * ignore any AF_INET6 receivers.
5257 * In the special case where an AF_INET socket binds to 0.0.0.0/<port> and an
5258 * AF_INET6 socket binds to ::/<port>, only the AF_INET socket receives the IPv4
5259 * packets.
5260 *
5261 * Zones notes:
5262 * Earlier in ip_input on a system with multiple shared-IP zones we
5263 * duplicate the multicast and broadcast packets and send them up
5264 * with each explicit zoneid that exists on that ill.
5265 * This means that here we can match the zoneid with SO_ALLZONES being special.
5266 */
5267 void
5268 ip_fanout_udp_multi_v4(mblk_t *mp, ipha_t *ipha, uint16_t lport, uint16_t fport,
5269 ip_recv_attr_t *ira)
5270 {
5271 ipaddr_t laddr;
5272 in6_addr_t v6faddr;
5273 conn_t *connp;
5274 connf_t *connfp;
5275 ipaddr_t faddr;
5276 ill_t *ill = ira->ira_ill;
5277 ip_stack_t *ipst = ill->ill_ipst;
5278
5279 ASSERT(ira->ira_flags & (IRAF_MULTIBROADCAST|IRAF_ICMP_ERROR));
5280
5281 laddr = ipha->ipha_dst;
5282 faddr = ipha->ipha_src;
5283
5284 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)];
5285 mutex_enter(&connfp->connf_lock);
5286 connp = connfp->connf_head;
5287
5288 /*
5289 * If SO_REUSEADDR has been set on the first we send the
5290 * packet to all clients that have joined the group and
5291 * match the port.
5292 */
5293 while (connp != NULL) {
5294 if ((IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)) &&
5295 conn_wantpacket(connp, ira, ipha) &&
5296 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5297 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp)))
5298 break;
5299 connp = connp->conn_next;
5300 }
5301
5302 if (connp == NULL)
5303 goto notfound;
5304
5305 CONN_INC_REF(connp);
5306
5307 if (connp->conn_reuseaddr) {
5308 conn_t *first_connp = connp;
5309 conn_t *next_connp;
5310 mblk_t *mp1;
5311
5312 connp = connp->conn_next;
5313 for (;;) {
5314 while (connp != NULL) {
5315 if (IPCL_UDP_MATCH(connp, lport, laddr,
5316 fport, faddr) &&
5317 conn_wantpacket(connp, ira, ipha) &&
5318 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5319 tsol_receive_local(mp, &laddr, IPV4_VERSION,
5320 ira, connp)))
5321 break;
5322 connp = connp->conn_next;
5323 }
5324 if (connp == NULL) {
5325 /* No more interested clients */
5326 connp = first_connp;
5327 break;
5328 }
5329 if (((mp1 = dupmsg(mp)) == NULL) &&
5330 ((mp1 = copymsg(mp)) == NULL)) {
5331 /* Memory allocation failed */
5332 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5333 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5334 connp = first_connp;
5335 break;
5336 }
5337 CONN_INC_REF(connp);
5338 mutex_exit(&connfp->connf_lock);
5339
5340 IP_STAT(ipst, ip_udp_fanmb);
5341 ip_fanout_udp_conn(connp, mp1, (ipha_t *)mp1->b_rptr,
5342 NULL, ira);
5343 mutex_enter(&connfp->connf_lock);
5344 /* Follow the next pointer before releasing the conn */
5345 next_connp = connp->conn_next;
5346 CONN_DEC_REF(connp);
5347 connp = next_connp;
5348 }
5349 }
5350
5351 /* Last one. Send it upstream. */
5352 mutex_exit(&connfp->connf_lock);
5353 IP_STAT(ipst, ip_udp_fanmb);
5354 ip_fanout_udp_conn(connp, mp, ipha, NULL, ira);
5355 CONN_DEC_REF(connp);
5356 return;
5357
5358 notfound:
5359 mutex_exit(&connfp->connf_lock);
5360 /*
5361 * IPv6 endpoints bound to multicast IPv4-mapped addresses
5362 * have already been matched above, since they live in the IPv4
5363 * fanout tables. This implies we only need to
5364 * check for IPv6 in6addr_any endpoints here.
5365 * Thus we compare using ipv6_all_zeros instead of the destination
5366 * address, except for the multicast group membership lookup which
5367 * uses the IPv4 destination.
5368 */
5369 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6faddr);
5370 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(lport, ipst)];
5371 mutex_enter(&connfp->connf_lock);
5372 connp = connfp->connf_head;
5373 /*
5374 * IPv4 multicast packet being delivered to an AF_INET6
5375 * in6addr_any endpoint.
5376 * Need to check conn_wantpacket(). Note that we use conn_wantpacket()
5377 * and not conn_wantpacket_v6() since any multicast membership is
5378 * for an IPv4-mapped multicast address.
5379 */
5380 while (connp != NULL) {
5381 if (IPCL_UDP_MATCH_V6(connp, lport, ipv6_all_zeros,
5382 fport, v6faddr) &&
5383 conn_wantpacket(connp, ira, ipha) &&
5384 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5385 tsol_receive_local(mp, &laddr, IPV4_VERSION, ira, connp)))
5386 break;
5387 connp = connp->conn_next;
5388 }
5389
5390 if (connp == NULL) {
5391 /*
5392 * No one bound to this port. Is
5393 * there a client that wants all
5394 * unclaimed datagrams?
5395 */
5396 mutex_exit(&connfp->connf_lock);
5397
5398 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].connf_head !=
5399 NULL) {
5400 ASSERT(ira->ira_protocol == IPPROTO_UDP);
5401 ip_fanout_proto_v4(mp, ipha, ira);
5402 } else {
5403 /*
5404 * We used to attempt to send an icmp error here, but
5405 * since this is known to be a multicast packet
5406 * and we don't send icmp errors in response to
5407 * multicast, just drop the packet and give up sooner.
5408 */
5409 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts);
5410 freemsg(mp);
5411 }
5412 return;
5413 }
5414 CONN_INC_REF(connp);
5415 ASSERT(IPCL_IS_NONSTR(connp) || connp->conn_rq != NULL);
5416
5417 /*
5418 * If SO_REUSEADDR has been set on the first we send the
5419 * packet to all clients that have joined the group and
5420 * match the port.
5421 */
5422 if (connp->conn_reuseaddr) {
5423 conn_t *first_connp = connp;
5424 conn_t *next_connp;
5425 mblk_t *mp1;
5426
5427 connp = connp->conn_next;
5428 for (;;) {
5429 while (connp != NULL) {
5430 if (IPCL_UDP_MATCH_V6(connp, lport,
5431 ipv6_all_zeros, fport, v6faddr) &&
5432 conn_wantpacket(connp, ira, ipha) &&
5433 (!(ira->ira_flags & IRAF_SYSTEM_LABELED) ||
5434 tsol_receive_local(mp, &laddr, IPV4_VERSION,
5435 ira, connp)))
5436 break;
5437 connp = connp->conn_next;
5438 }
5439 if (connp == NULL) {
5440 /* No more interested clients */
5441 connp = first_connp;
5442 break;
5443 }
5444 if (((mp1 = dupmsg(mp)) == NULL) &&
5445 ((mp1 = copymsg(mp)) == NULL)) {
5446 /* Memory allocation failed */
5447 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
5448 ip_drop_input("ipIfStatsInDiscards", mp, ill);
5449 connp = first_connp;
5450 break;
5451 }
5452 CONN_INC_REF(connp);
5453 mutex_exit(&connfp->connf_lock);
5454
5455 IP_STAT(ipst, ip_udp_fanmb);
5456 ip_fanout_udp_conn(connp, mp1, (ipha_t *)mp1->b_rptr,
5457 NULL, ira);
5458 mutex_enter(&connfp->connf_lock);
5459 /* Follow the next pointer before releasing the conn */
5460 next_connp = connp->conn_next;
5461 CONN_DEC_REF(connp);
5462 connp = next_connp;
5463 }
5464 }
5465
5466 /* Last one. Send it upstream. */
5467 mutex_exit(&connfp->connf_lock);
5468 IP_STAT(ipst, ip_udp_fanmb);
5469 ip_fanout_udp_conn(connp, mp, ipha, NULL, ira);
5470 CONN_DEC_REF(connp);
5471 }
5472
5473 /*
5474 * Split an incoming packet's IPv4 options into the label and the other options.
5475 * If 'allocate' is set it does memory allocation for the ip_pkt_t, including
5476 * clearing out any leftover label or options.
5477 * Otherwise it just makes ipp point into the packet.
5478 *
5479 * Returns zero if ok; ENOMEM if the buffer couldn't be allocated.
5480 */
5481 int
5482 ip_find_hdr_v4(ipha_t *ipha, ip_pkt_t *ipp, boolean_t allocate)
5483 {
5484 uchar_t *opt;
5485 uint32_t totallen;
5486 uint32_t optval;
5487 uint32_t optlen;
5488
5489 ipp->ipp_fields |= IPPF_HOPLIMIT | IPPF_TCLASS | IPPF_ADDR;
5490 ipp->ipp_hoplimit = ipha->ipha_ttl;
5491 ipp->ipp_type_of_service = ipha->ipha_type_of_service;
5492 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &ipp->ipp_addr);
5493
5494 /*
5495 * Get length (in 4 byte octets) of IP header options.
5496 */
5497 totallen = ipha->ipha_version_and_hdr_length -
5498 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
5499
5500 if (totallen == 0) {
5501 if (!allocate)
5502 return (0);
5503
5504 /* Clear out anything from a previous packet */
5505 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
5506 kmem_free(ipp->ipp_ipv4_options,
5507 ipp->ipp_ipv4_options_len);
5508 ipp->ipp_ipv4_options = NULL;
5509 ipp->ipp_ipv4_options_len = 0;
5510 ipp->ipp_fields &= ~IPPF_IPV4_OPTIONS;
5511 }
5512 if (ipp->ipp_fields & IPPF_LABEL_V4) {
5513 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4);
5514 ipp->ipp_label_v4 = NULL;
5515 ipp->ipp_label_len_v4 = 0;
5516 ipp->ipp_fields &= ~IPPF_LABEL_V4;
5517 }
5518 return (0);
5519 }
5520
5521 totallen <<= 2;
5522 opt = (uchar_t *)&ipha[1];
5523 if (!is_system_labeled()) {
5524
5525 copyall:
5526 if (!allocate) {
5527 if (totallen != 0) {
5528 ipp->ipp_ipv4_options = opt;
5529 ipp->ipp_ipv4_options_len = totallen;
5530 ipp->ipp_fields |= IPPF_IPV4_OPTIONS;
5531 }
5532 return (0);
5533 }
5534 /* Just copy all of options */
5535 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
5536 if (totallen == ipp->ipp_ipv4_options_len) {
5537 bcopy(opt, ipp->ipp_ipv4_options, totallen);
5538 return (0);
5539 }
5540 kmem_free(ipp->ipp_ipv4_options,
5541 ipp->ipp_ipv4_options_len);
5542 ipp->ipp_ipv4_options = NULL;
5543 ipp->ipp_ipv4_options_len = 0;
5544 ipp->ipp_fields &= ~IPPF_IPV4_OPTIONS;
5545 }
5546 if (totallen == 0)
5547 return (0);
5548
5549 ipp->ipp_ipv4_options = kmem_alloc(totallen, KM_NOSLEEP);
5550 if (ipp->ipp_ipv4_options == NULL)
5551 return (ENOMEM);
5552 ipp->ipp_ipv4_options_len = totallen;
5553 ipp->ipp_fields |= IPPF_IPV4_OPTIONS;
5554 bcopy(opt, ipp->ipp_ipv4_options, totallen);
5555 return (0);
5556 }
5557
5558 if (allocate && (ipp->ipp_fields & IPPF_LABEL_V4)) {
5559 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4);
5560 ipp->ipp_label_v4 = NULL;
5561 ipp->ipp_label_len_v4 = 0;
5562 ipp->ipp_fields &= ~IPPF_LABEL_V4;
5563 }
5564
5565 /*
5566 * Search for CIPSO option.
5567 * We assume CIPSO is first in options if it is present.
5568 * If it isn't, then ipp_opt_ipv4_options will not include the options
5569 * prior to the CIPSO option.
5570 */
5571 while (totallen != 0) {
5572 switch (optval = opt[IPOPT_OPTVAL]) {
5573 case IPOPT_EOL:
5574 return (0);
5575 case IPOPT_NOP:
5576 optlen = 1;
5577 break;
5578 default:
5579 if (totallen <= IPOPT_OLEN)
5580 return (EINVAL);
5581 optlen = opt[IPOPT_OLEN];
5582 if (optlen < 2)
5583 return (EINVAL);
5584 }
5585 if (optlen > totallen)
5586 return (EINVAL);
5587
5588 switch (optval) {
5589 case IPOPT_COMSEC:
5590 if (!allocate) {
5591 ipp->ipp_label_v4 = opt;
5592 ipp->ipp_label_len_v4 = optlen;
5593 ipp->ipp_fields |= IPPF_LABEL_V4;
5594 } else {
5595 ipp->ipp_label_v4 = kmem_alloc(optlen,
5596 KM_NOSLEEP);
5597 if (ipp->ipp_label_v4 == NULL)
5598 return (ENOMEM);
5599 ipp->ipp_label_len_v4 = optlen;
5600 ipp->ipp_fields |= IPPF_LABEL_V4;
5601 bcopy(opt, ipp->ipp_label_v4, optlen);
5602 }
5603 totallen -= optlen;
5604 opt += optlen;
5605
5606 /* Skip padding bytes until we get to a multiple of 4 */
5607 while ((totallen & 3) != 0 && opt[0] == IPOPT_NOP) {
5608 totallen--;
5609 opt++;
5610 }
5611 /* Remaining as ipp_ipv4_options */
5612 goto copyall;
5613 }
5614 totallen -= optlen;
5615 opt += optlen;
5616 }
5617 /* No CIPSO found; return everything as ipp_ipv4_options */
5618 totallen = ipha->ipha_version_and_hdr_length -
5619 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
5620 totallen <<= 2;
5621 opt = (uchar_t *)&ipha[1];
5622 goto copyall;
5623 }
5624
5625 /*
5626 * Efficient versions of lookup for an IRE when we only
5627 * match the address.
5628 * For RTF_REJECT or BLACKHOLE we return IRE_NOROUTE.
5629 * Does not handle multicast addresses.
5630 */
5631 uint_t
5632 ip_type_v4(ipaddr_t addr, ip_stack_t *ipst)
5633 {
5634 ire_t *ire;
5635 uint_t result;
5636
5637 ire = ire_ftable_lookup_simple_v4(addr, 0, ipst, NULL);
5638 ASSERT(ire != NULL);
5639 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))
5640 result = IRE_NOROUTE;
5641 else
5642 result = ire->ire_type;
5643 ire_refrele(ire);
5644 return (result);
5645 }
5646
5647 /*
5648 * Efficient versions of lookup for an IRE when we only
5649 * match the address.
5650 * For RTF_REJECT or BLACKHOLE we return IRE_NOROUTE.
5651 * Does not handle multicast addresses.
5652 */
5653 uint_t
5654 ip_type_v6(const in6_addr_t *addr, ip_stack_t *ipst)
5655 {
5656 ire_t *ire;
5657 uint_t result;
5658
5659 ire = ire_ftable_lookup_simple_v6(addr, 0, ipst, NULL);
5660 ASSERT(ire != NULL);
5661 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))
5662 result = IRE_NOROUTE;
5663 else
5664 result = ire->ire_type;
5665 ire_refrele(ire);
5666 return (result);
5667 }
5668
5669 /*
5670 * Nobody should be sending
5671 * packets up this stream
5672 */
5673 static int
5674 ip_lrput(queue_t *q, mblk_t *mp)
5675 {
5676 switch (mp->b_datap->db_type) {
5677 case M_FLUSH:
5678 /* Turn around */
5679 if (*mp->b_rptr & FLUSHW) {
5680 *mp->b_rptr &= ~FLUSHR;
5681 qreply(q, mp);
5682 return (0);
5683 }
5684 break;
5685 }
5686 freemsg(mp);
5687 return (0);
5688 }
5689
5690 /* Nobody should be sending packets down this stream */
5691 /* ARGSUSED */
5692 int
5693 ip_lwput(queue_t *q, mblk_t *mp)
5694 {
5695 freemsg(mp);
5696 return (0);
5697 }
5698
5699 /*
5700 * Move the first hop in any source route to ipha_dst and remove that part of
5701 * the source route. Called by other protocols. Errors in option formatting
5702 * are ignored - will be handled by ip_output_options. Return the final
5703 * destination (either ipha_dst or the last entry in a source route.)
5704 */
5705 ipaddr_t
5706 ip_massage_options(ipha_t *ipha, netstack_t *ns)
5707 {
5708 ipoptp_t opts;
5709 uchar_t *opt;
5710 uint8_t optval;
5711 uint8_t optlen;
5712 ipaddr_t dst;
5713 int i;
5714 ip_stack_t *ipst = ns->netstack_ip;
5715
5716 ip2dbg(("ip_massage_options\n"));
5717 dst = ipha->ipha_dst;
5718 for (optval = ipoptp_first(&opts, ipha);
5719 optval != IPOPT_EOL;
5720 optval = ipoptp_next(&opts)) {
5721 opt = opts.ipoptp_cur;
5722 switch (optval) {
5723 uint8_t off;
5724 case IPOPT_SSRR:
5725 case IPOPT_LSRR:
5726 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
5727 ip1dbg(("ip_massage_options: bad src route\n"));
5728 break;
5729 }
5730 optlen = opts.ipoptp_len;
5731 off = opt[IPOPT_OFFSET];
5732 off--;
5733 redo_srr:
5734 if (optlen < IP_ADDR_LEN ||
5735 off > optlen - IP_ADDR_LEN) {
5736 /* End of source route */
5737 ip1dbg(("ip_massage_options: end of SR\n"));
5738 break;
5739 }
5740 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
5741 ip1dbg(("ip_massage_options: next hop 0x%x\n",
5742 ntohl(dst)));
5743 /*
5744 * Check if our address is present more than
5745 * once as consecutive hops in source route.
5746 * XXX verify per-interface ip_forwarding
5747 * for source route?
5748 */
5749 if (ip_type_v4(dst, ipst) == IRE_LOCAL) {
5750 off += IP_ADDR_LEN;
5751 goto redo_srr;
5752 }
5753 if (dst == htonl(INADDR_LOOPBACK)) {
5754 ip1dbg(("ip_massage_options: loopback addr in "
5755 "source route!\n"));
5756 break;
5757 }
5758 /*
5759 * Update ipha_dst to be the first hop and remove the
5760 * first hop from the source route (by overwriting
5761 * part of the option with NOP options).
5762 */
5763 ipha->ipha_dst = dst;
5764 /* Put the last entry in dst */
5765 off = ((optlen - IP_ADDR_LEN - 3) & ~(IP_ADDR_LEN-1)) +
5766 3;
5767 bcopy(&opt[off], &dst, IP_ADDR_LEN);
5768
5769 ip1dbg(("ip_massage_options: last hop 0x%x\n",
5770 ntohl(dst)));
5771 /* Move down and overwrite */
5772 opt[IP_ADDR_LEN] = opt[0];
5773 opt[IP_ADDR_LEN+1] = opt[IPOPT_OLEN] - IP_ADDR_LEN;
5774 opt[IP_ADDR_LEN+2] = opt[IPOPT_OFFSET];
5775 for (i = 0; i < IP_ADDR_LEN; i++)
5776 opt[i] = IPOPT_NOP;
5777 break;
5778 }
5779 }
5780 return (dst);
5781 }
5782
5783 /*
5784 * Return the network mask
5785 * associated with the specified address.
5786 */
5787 ipaddr_t
5788 ip_net_mask(ipaddr_t addr)
5789 {
5790 uchar_t *up = (uchar_t *)&addr;
5791 ipaddr_t mask = 0;
5792 uchar_t *maskp = (uchar_t *)&mask;
5793
5794 #if defined(__i386) || defined(__amd64)
5795 #define TOTALLY_BRAIN_DAMAGED_C_COMPILER
5796 #endif
5797 #ifdef TOTALLY_BRAIN_DAMAGED_C_COMPILER
5798 maskp[0] = maskp[1] = maskp[2] = maskp[3] = 0;
5799 #endif
5800 if (CLASSD(addr)) {
5801 maskp[0] = 0xF0;
5802 return (mask);
5803 }
5804
5805 /* We assume Class E default netmask to be 32 */
5806 if (CLASSE(addr))
5807 return (0xffffffffU);
5808
5809 if (addr == 0)
5810 return (0);
5811 maskp[0] = 0xFF;
5812 if ((up[0] & 0x80) == 0)
5813 return (mask);
5814
5815 maskp[1] = 0xFF;
5816 if ((up[0] & 0xC0) == 0x80)
5817 return (mask);
5818
5819 maskp[2] = 0xFF;
5820 if ((up[0] & 0xE0) == 0xC0)
5821 return (mask);
5822
5823 /* Otherwise return no mask */
5824 return ((ipaddr_t)0);
5825 }
5826
5827 /* Name/Value Table Lookup Routine */
5828 char *
5829 ip_nv_lookup(nv_t *nv, int value)
5830 {
5831 if (!nv)
5832 return (NULL);
5833 for (; nv->nv_name; nv++) {
5834 if (nv->nv_value == value)
5835 return (nv->nv_name);
5836 }
5837 return ("unknown");
5838 }
5839
5840 static int
5841 ip_wait_for_info_ack(ill_t *ill)
5842 {
5843 int err;
5844
5845 mutex_enter(&ill->ill_lock);
5846 while (ill->ill_state_flags & ILL_LL_SUBNET_PENDING) {
5847 /*
5848 * Return value of 0 indicates a pending signal.
5849 */
5850 err = cv_wait_sig(&ill->ill_cv, &ill->ill_lock);
5851 if (err == 0) {
5852 mutex_exit(&ill->ill_lock);
5853 return (EINTR);
5854 }
5855 }
5856 mutex_exit(&ill->ill_lock);
5857 /*
5858 * ip_rput_other could have set an error in ill_error on
5859 * receipt of M_ERROR.
5860 */
5861 return (ill->ill_error);
5862 }
5863
5864 /*
5865 * This is a module open, i.e. this is a control stream for access
5866 * to a DLPI device. We allocate an ill_t as the instance data in
5867 * this case.
5868 */
5869 static int
5870 ip_modopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
5871 {
5872 ill_t *ill;
5873 int err;
5874 zoneid_t zoneid;
5875 netstack_t *ns;
5876 ip_stack_t *ipst;
5877
5878 /*
5879 * Prevent unprivileged processes from pushing IP so that
5880 * they can't send raw IP.
5881 */
5882 if (secpolicy_net_rawaccess(credp) != 0)
5883 return (EPERM);
5884
5885 ns = netstack_find_by_cred(credp);
5886 ASSERT(ns != NULL);
5887 ipst = ns->netstack_ip;
5888 ASSERT(ipst != NULL);
5889
5890 /*
5891 * For exclusive stacks we set the zoneid to zero
5892 * to make IP operate as if in the global zone.
5893 */
5894 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID)
5895 zoneid = GLOBAL_ZONEID;
5896 else
5897 zoneid = crgetzoneid(credp);
5898
5899 ill = (ill_t *)mi_open_alloc_sleep(sizeof (ill_t));
5900 q->q_ptr = WR(q)->q_ptr = ill;
5901 ill->ill_ipst = ipst;
5902 ill->ill_zoneid = zoneid;
5903
5904 /*
5905 * ill_init initializes the ill fields and then sends down
5906 * down a DL_INFO_REQ after calling qprocson.
5907 */
5908 err = ill_init(q, ill);
5909
5910 if (err != 0) {
5911 mi_free(ill);
5912 netstack_rele(ipst->ips_netstack);
5913 q->q_ptr = NULL;
5914 WR(q)->q_ptr = NULL;
5915 return (err);
5916 }
5917
5918 /*
5919 * Wait for the DL_INFO_ACK if a DL_INFO_REQ was sent.
5920 *
5921 * ill_init initializes the ipsq marking this thread as
5922 * writer
5923 */
5924 ipsq_exit(ill->ill_phyint->phyint_ipsq);
5925 err = ip_wait_for_info_ack(ill);
5926 if (err == 0)
5927 ill->ill_credp = credp;
5928 else
5929 goto fail;
5930
5931 crhold(credp);
5932
5933 mutex_enter(&ipst->ips_ip_mi_lock);
5934 err = mi_open_link(&ipst->ips_ip_g_head, (IDP)q->q_ptr, devp, flag,
5935 sflag, credp);
5936 mutex_exit(&ipst->ips_ip_mi_lock);
5937 fail:
5938 if (err) {
5939 (void) ip_close(q, 0, credp);
5940 return (err);
5941 }
5942 return (0);
5943 }
5944
5945 /* For /dev/ip aka AF_INET open */
5946 int
5947 ip_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
5948 {
5949 return (ip_open(q, devp, flag, sflag, credp, B_FALSE));
5950 }
5951
5952 /* For /dev/ip6 aka AF_INET6 open */
5953 int
5954 ip_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
5955 {
5956 return (ip_open(q, devp, flag, sflag, credp, B_TRUE));
5957 }
5958
5959 /* IP open routine. */
5960 int
5961 ip_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
5962 boolean_t isv6)
5963 {
5964 conn_t *connp;
5965 major_t maj;
5966 zoneid_t zoneid;
5967 netstack_t *ns;
5968 ip_stack_t *ipst;
5969
5970 /* Allow reopen. */
5971 if (q->q_ptr != NULL)
5972 return (0);
5973
5974 if (sflag & MODOPEN) {
5975 /* This is a module open */
5976 return (ip_modopen(q, devp, flag, sflag, credp));
5977 }
5978
5979 if ((flag & ~(FKLYR)) == IP_HELPER_STR) {
5980 /*
5981 * Non streams based socket looking for a stream
5982 * to access IP
5983 */
5984 return (ip_helper_stream_setup(q, devp, flag, sflag,
5985 credp, isv6));
5986 }
5987
5988 ns = netstack_find_by_cred(credp);
5989 ASSERT(ns != NULL);
5990 ipst = ns->netstack_ip;
5991 ASSERT(ipst != NULL);
5992
5993 /*
5994 * For exclusive stacks we set the zoneid to zero
5995 * to make IP operate as if in the global zone.
5996 */
5997 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID)
5998 zoneid = GLOBAL_ZONEID;
5999 else
6000 zoneid = crgetzoneid(credp);
6001
6002 /*
6003 * We are opening as a device. This is an IP client stream, and we
6004 * allocate an conn_t as the instance data.
6005 */
6006 connp = ipcl_conn_create(IPCL_IPCCONN, KM_SLEEP, ipst->ips_netstack);
6007
6008 /*
6009 * ipcl_conn_create did a netstack_hold. Undo the hold that was
6010 * done by netstack_find_by_cred()
6011 */
6012 netstack_rele(ipst->ips_netstack);
6013
6014 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
6015 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
6016 connp->conn_ixa->ixa_zoneid = zoneid;
6017 connp->conn_zoneid = zoneid;
6018
6019 connp->conn_rq = q;
6020 q->q_ptr = WR(q)->q_ptr = connp;
6021
6022 /* Minor tells us which /dev entry was opened */
6023 if (isv6) {
6024 connp->conn_family = AF_INET6;
6025 connp->conn_ipversion = IPV6_VERSION;
6026 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
6027 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT;
6028 } else {
6029 connp->conn_family = AF_INET;
6030 connp->conn_ipversion = IPV4_VERSION;
6031 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
6032 }
6033
6034 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
6035 ((connp->conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
6036 connp->conn_minor_arena = ip_minor_arena_la;
6037 } else {
6038 /*
6039 * Either minor numbers in the large arena were exhausted
6040 * or a non socket application is doing the open.
6041 * Try to allocate from the small arena.
6042 */
6043 if ((connp->conn_dev =
6044 inet_minor_alloc(ip_minor_arena_sa)) == 0) {
6045 /* CONN_DEC_REF takes care of netstack_rele() */
6046 q->q_ptr = WR(q)->q_ptr = NULL;
6047 CONN_DEC_REF(connp);
6048 return (EBUSY);
6049 }
6050 connp->conn_minor_arena = ip_minor_arena_sa;
6051 }
6052
6053 maj = getemajor(*devp);
6054 *devp = makedevice(maj, (minor_t)connp->conn_dev);
6055
6056 /*
6057 * connp->conn_cred is crfree()ed in ipcl_conn_destroy()
6058 */
6059 connp->conn_cred = credp;
6060 connp->conn_cpid = curproc->p_pid;
6061 /* Cache things in ixa without an extra refhold */
6062 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
6063 connp->conn_ixa->ixa_cred = connp->conn_cred;
6064 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
6065 if (is_system_labeled())
6066 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
6067
6068 /*
6069 * Handle IP_IOC_RTS_REQUEST and other ioctls which use conn_recv
6070 */
6071 connp->conn_recv = ip_conn_input;
6072 connp->conn_recvicmp = ip_conn_input_icmp;
6073
6074 crhold(connp->conn_cred);
6075
6076 /*
6077 * If the caller has the process-wide flag set, then default to MAC
6078 * exempt mode. This allows read-down to unlabeled hosts.
6079 */
6080 if (getpflags(NET_MAC_AWARE, credp) != 0)
6081 connp->conn_mac_mode = CONN_MAC_AWARE;
6082
6083 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
6084
6085 connp->conn_rq = q;
6086 connp->conn_wq = WR(q);
6087
6088 /* Non-zero default values */
6089 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP;
6090
6091 /*
6092 * Make the conn globally visible to walkers
6093 */
6094 ASSERT(connp->conn_ref == 1);
6095 mutex_enter(&connp->conn_lock);
6096 connp->conn_state_flags &= ~CONN_INCIPIENT;
6097 mutex_exit(&connp->conn_lock);
6098
6099 qprocson(q);
6100
6101 return (0);
6102 }
6103
6104 /*
6105 * Set IPsec policy from an ipsec_req_t. If the req is not "zero" and valid,
6106 * all of them are copied to the conn_t. If the req is "zero", the policy is
6107 * zeroed out. A "zero" policy has zero ipsr_{ah,req,self_encap}_req
6108 * fields.
6109 * We keep only the latest setting of the policy and thus policy setting
6110 * is not incremental/cumulative.
6111 *
6112 * Requests to set policies with multiple alternative actions will
6113 * go through a different API.
6114 */
6115 int
6116 ipsec_set_req(cred_t *cr, conn_t *connp, ipsec_req_t *req)
6117 {
6118 uint_t ah_req = 0;
6119 uint_t esp_req = 0;
6120 uint_t se_req = 0;
6121 ipsec_act_t *actp = NULL;
6122 uint_t nact;
6123 ipsec_policy_head_t *ph;
6124 boolean_t is_pol_reset, is_pol_inserted = B_FALSE;
6125 int error = 0;
6126 netstack_t *ns = connp->conn_netstack;
6127 ip_stack_t *ipst = ns->netstack_ip;
6128 ipsec_stack_t *ipss = ns->netstack_ipsec;
6129
6130 #define REQ_MASK (IPSEC_PREF_REQUIRED|IPSEC_PREF_NEVER)
6131
6132 /*
6133 * The IP_SEC_OPT option does not allow variable length parameters,
6134 * hence a request cannot be NULL.
6135 */
6136 if (req == NULL)
6137 return (EINVAL);
6138
6139 ah_req = req->ipsr_ah_req;
6140 esp_req = req->ipsr_esp_req;
6141 se_req = req->ipsr_self_encap_req;
6142
6143 /* Don't allow setting self-encap without one or more of AH/ESP. */
6144 if (se_req != 0 && esp_req == 0 && ah_req == 0)
6145 return (EINVAL);
6146
6147 /*
6148 * Are we dealing with a request to reset the policy (i.e.
6149 * zero requests).
6150 */
6151 is_pol_reset = ((ah_req & REQ_MASK) == 0 &&
6152 (esp_req & REQ_MASK) == 0 &&
6153 (se_req & REQ_MASK) == 0);
6154
6155 if (!is_pol_reset) {
6156 /*
6157 * If we couldn't load IPsec, fail with "protocol
6158 * not supported".
6159 * IPsec may not have been loaded for a request with zero
6160 * policies, so we don't fail in this case.
6161 */
6162 mutex_enter(&ipss->ipsec_loader_lock);
6163 if (ipss->ipsec_loader_state != IPSEC_LOADER_SUCCEEDED) {
6164 mutex_exit(&ipss->ipsec_loader_lock);
6165 return (EPROTONOSUPPORT);
6166 }
6167 mutex_exit(&ipss->ipsec_loader_lock);
6168
6169 /*
6170 * Test for valid requests. Invalid algorithms
6171 * need to be tested by IPsec code because new
6172 * algorithms can be added dynamically.
6173 */
6174 if ((ah_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 ||
6175 (esp_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 ||
6176 (se_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0) {
6177 return (EINVAL);
6178 }
6179
6180 /*
6181 * Only privileged users can issue these
6182 * requests.
6183 */
6184 if (((ah_req & IPSEC_PREF_NEVER) ||
6185 (esp_req & IPSEC_PREF_NEVER) ||
6186 (se_req & IPSEC_PREF_NEVER)) &&
6187 secpolicy_ip_config(cr, B_FALSE) != 0) {
6188 return (EPERM);
6189 }
6190
6191 /*
6192 * The IPSEC_PREF_REQUIRED and IPSEC_PREF_NEVER
6193 * are mutually exclusive.
6194 */
6195 if (((ah_req & REQ_MASK) == REQ_MASK) ||
6196 ((esp_req & REQ_MASK) == REQ_MASK) ||
6197 ((se_req & REQ_MASK) == REQ_MASK)) {
6198 /* Both of them are set */
6199 return (EINVAL);
6200 }
6201 }
6202
6203 ASSERT(MUTEX_HELD(&connp->conn_lock));
6204
6205 /*
6206 * If we have already cached policies in conn_connect(), don't
6207 * let them change now. We cache policies for connections
6208 * whose src,dst [addr, port] is known.
6209 */
6210 if (connp->conn_policy_cached) {
6211 return (EINVAL);
6212 }
6213
6214 /*
6215 * We have a zero policies, reset the connection policy if already
6216 * set. This will cause the connection to inherit the
6217 * global policy, if any.
6218 */
6219 if (is_pol_reset) {
6220 if (connp->conn_policy != NULL) {
6221 IPPH_REFRELE(connp->conn_policy, ipst->ips_netstack);
6222 connp->conn_policy = NULL;
6223 }
6224 connp->conn_in_enforce_policy = B_FALSE;
6225 connp->conn_out_enforce_policy = B_FALSE;
6226 return (0);
6227 }
6228
6229 ph = connp->conn_policy = ipsec_polhead_split(connp->conn_policy,
6230 ipst->ips_netstack);
6231 if (ph == NULL)
6232 goto enomem;
6233
6234 ipsec_actvec_from_req(req, &actp, &nact, ipst->ips_netstack);
6235 if (actp == NULL)
6236 goto enomem;
6237
6238 /*
6239 * Always insert IPv4 policy entries, since they can also apply to
6240 * ipv6 sockets being used in ipv4-compat mode.
6241 */
6242 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V4,
6243 IPSEC_TYPE_INBOUND, ns))
6244 goto enomem;
6245 is_pol_inserted = B_TRUE;
6246 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V4,
6247 IPSEC_TYPE_OUTBOUND, ns))
6248 goto enomem;
6249
6250 /*
6251 * We're looking at a v6 socket, also insert the v6-specific
6252 * entries.
6253 */
6254 if (connp->conn_family == AF_INET6) {
6255 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V6,
6256 IPSEC_TYPE_INBOUND, ns))
6257 goto enomem;
6258 if (!ipsec_polhead_insert(ph, actp, nact, IPSEC_AF_V6,
6259 IPSEC_TYPE_OUTBOUND, ns))
6260 goto enomem;
6261 }
6262
6263 ipsec_actvec_free(actp, nact);
6264
6265 /*
6266 * If the requests need security, set enforce_policy.
6267 * If the requests are IPSEC_PREF_NEVER, one should
6268 * still set conn_out_enforce_policy so that ip_set_destination
6269 * marks the ip_xmit_attr_t appropriatly. This is needed so that
6270 * for connections that we don't cache policy in at connect time,
6271 * if global policy matches in ip_output_attach_policy, we
6272 * don't wrongly inherit global policy. Similarly, we need
6273 * to set conn_in_enforce_policy also so that we don't verify
6274 * policy wrongly.
6275 */
6276 if ((ah_req & REQ_MASK) != 0 ||
6277 (esp_req & REQ_MASK) != 0 ||
6278 (se_req & REQ_MASK) != 0) {
6279 connp->conn_in_enforce_policy = B_TRUE;
6280 connp->conn_out_enforce_policy = B_TRUE;
6281 }
6282
6283 return (error);
6284 #undef REQ_MASK
6285
6286 /*
6287 * Common memory-allocation-failure exit path.
6288 */
6289 enomem:
6290 if (actp != NULL)
6291 ipsec_actvec_free(actp, nact);
6292 if (is_pol_inserted)
6293 ipsec_polhead_flush(ph, ns);
6294 return (ENOMEM);
6295 }
6296
6297 /*
6298 * Set socket options for joining and leaving multicast groups.
6299 * Common to IPv4 and IPv6; inet6 indicates the type of socket.
6300 * The caller has already check that the option name is consistent with
6301 * the address family of the socket.
6302 */
6303 int
6304 ip_opt_set_multicast_group(conn_t *connp, t_scalar_t name,
6305 uchar_t *invalp, boolean_t inet6, boolean_t checkonly)
6306 {
6307 int *i1 = (int *)invalp;
6308 int error = 0;
6309 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
6310 struct ip_mreq *v4_mreqp;
6311 struct ipv6_mreq *v6_mreqp;
6312 struct group_req *greqp;
6313 ire_t *ire;
6314 boolean_t done = B_FALSE;
6315 ipaddr_t ifaddr;
6316 in6_addr_t v6group;
6317 uint_t ifindex;
6318 boolean_t mcast_opt = B_TRUE;
6319 mcast_record_t fmode;
6320 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *,
6321 ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *);
6322
6323 switch (name) {
6324 case IP_ADD_MEMBERSHIP:
6325 case IPV6_JOIN_GROUP:
6326 mcast_opt = B_FALSE;
6327 /* FALLTHROUGH */
6328 case MCAST_JOIN_GROUP:
6329 fmode = MODE_IS_EXCLUDE;
6330 optfn = ip_opt_add_group;
6331 break;
6332
6333 case IP_DROP_MEMBERSHIP:
6334 case IPV6_LEAVE_GROUP:
6335 mcast_opt = B_FALSE;
6336 /* FALLTHROUGH */
6337 case MCAST_LEAVE_GROUP:
6338 fmode = MODE_IS_INCLUDE;
6339 optfn = ip_opt_delete_group;
6340 break;
6341 default:
6342 /* Should not be reached. */
6343 fmode = MODE_IS_INCLUDE;
6344 optfn = NULL;
6345 ASSERT(0);
6346 }
6347
6348 if (mcast_opt) {
6349 struct sockaddr_in *sin;
6350 struct sockaddr_in6 *sin6;
6351
6352 greqp = (struct group_req *)i1;
6353 if (greqp->gr_group.ss_family == AF_INET) {
6354 sin = (struct sockaddr_in *)&(greqp->gr_group);
6355 IN6_INADDR_TO_V4MAPPED(&sin->sin_addr, &v6group);
6356 } else {
6357 if (!inet6)
6358 return (EINVAL); /* Not on INET socket */
6359
6360 sin6 = (struct sockaddr_in6 *)&(greqp->gr_group);
6361 v6group = sin6->sin6_addr;
6362 }
6363 ifaddr = INADDR_ANY;
6364 ifindex = greqp->gr_interface;
6365 } else if (inet6) {
6366 v6_mreqp = (struct ipv6_mreq *)i1;
6367 v6group = v6_mreqp->ipv6mr_multiaddr;
6368 ifaddr = INADDR_ANY;
6369 ifindex = v6_mreqp->ipv6mr_interface;
6370 } else {
6371 v4_mreqp = (struct ip_mreq *)i1;
6372 IN6_INADDR_TO_V4MAPPED(&v4_mreqp->imr_multiaddr, &v6group);
6373 ifaddr = (ipaddr_t)v4_mreqp->imr_interface.s_addr;
6374 ifindex = 0;
6375 }
6376
6377 /*
6378 * In the multirouting case, we need to replicate
6379 * the request on all interfaces that will take part
6380 * in replication. We do so because multirouting is
6381 * reflective, thus we will probably receive multi-
6382 * casts on those interfaces.
6383 * The ip_multirt_apply_membership() succeeds if
6384 * the operation succeeds on at least one interface.
6385 */
6386 if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
6387 ipaddr_t group;
6388
6389 IN6_V4MAPPED_TO_IPADDR(&v6group, group);
6390
6391 ire = ire_ftable_lookup_v4(group, IP_HOST_MASK, 0,
6392 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6393 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6394 } else {
6395 ire = ire_ftable_lookup_v6(&v6group, &ipv6_all_ones, 0,
6396 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6397 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6398 }
6399 if (ire != NULL) {
6400 if (ire->ire_flags & RTF_MULTIRT) {
6401 error = ip_multirt_apply_membership(optfn, ire, connp,
6402 checkonly, &v6group, fmode, &ipv6_all_zeros);
6403 done = B_TRUE;
6404 }
6405 ire_refrele(ire);
6406 }
6407
6408 if (!done) {
6409 error = optfn(connp, checkonly, &v6group, ifaddr, ifindex,
6410 fmode, &ipv6_all_zeros);
6411 }
6412 return (error);
6413 }
6414
6415 /*
6416 * Set socket options for joining and leaving multicast groups
6417 * for specific sources.
6418 * Common to IPv4 and IPv6; inet6 indicates the type of socket.
6419 * The caller has already check that the option name is consistent with
6420 * the address family of the socket.
6421 */
6422 int
6423 ip_opt_set_multicast_sources(conn_t *connp, t_scalar_t name,
6424 uchar_t *invalp, boolean_t inet6, boolean_t checkonly)
6425 {
6426 int *i1 = (int *)invalp;
6427 int error = 0;
6428 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
6429 struct ip_mreq_source *imreqp;
6430 struct group_source_req *gsreqp;
6431 in6_addr_t v6group, v6src;
6432 uint32_t ifindex;
6433 ipaddr_t ifaddr;
6434 boolean_t mcast_opt = B_TRUE;
6435 mcast_record_t fmode;
6436 ire_t *ire;
6437 boolean_t done = B_FALSE;
6438 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *,
6439 ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *);
6440
6441 switch (name) {
6442 case IP_BLOCK_SOURCE:
6443 mcast_opt = B_FALSE;
6444 /* FALLTHROUGH */
6445 case MCAST_BLOCK_SOURCE:
6446 fmode = MODE_IS_EXCLUDE;
6447 optfn = ip_opt_add_group;
6448 break;
6449
6450 case IP_UNBLOCK_SOURCE:
6451 mcast_opt = B_FALSE;
6452 /* FALLTHROUGH */
6453 case MCAST_UNBLOCK_SOURCE:
6454 fmode = MODE_IS_EXCLUDE;
6455 optfn = ip_opt_delete_group;
6456 break;
6457
6458 case IP_ADD_SOURCE_MEMBERSHIP:
6459 mcast_opt = B_FALSE;
6460 /* FALLTHROUGH */
6461 case MCAST_JOIN_SOURCE_GROUP:
6462 fmode = MODE_IS_INCLUDE;
6463 optfn = ip_opt_add_group;
6464 break;
6465
6466 case IP_DROP_SOURCE_MEMBERSHIP:
6467 mcast_opt = B_FALSE;
6468 /* FALLTHROUGH */
6469 case MCAST_LEAVE_SOURCE_GROUP:
6470 fmode = MODE_IS_INCLUDE;
6471 optfn = ip_opt_delete_group;
6472 break;
6473 default:
6474 /* Should not be reached. */
6475 optfn = NULL;
6476 fmode = 0;
6477 ASSERT(0);
6478 }
6479
6480 if (mcast_opt) {
6481 gsreqp = (struct group_source_req *)i1;
6482 ifindex = gsreqp->gsr_interface;
6483 if (gsreqp->gsr_group.ss_family == AF_INET) {
6484 struct sockaddr_in *s;
6485 s = (struct sockaddr_in *)&gsreqp->gsr_group;
6486 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6group);
6487 s = (struct sockaddr_in *)&gsreqp->gsr_source;
6488 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6src);
6489 } else {
6490 struct sockaddr_in6 *s6;
6491
6492 if (!inet6)
6493 return (EINVAL); /* Not on INET socket */
6494
6495 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_group;
6496 v6group = s6->sin6_addr;
6497 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_source;
6498 v6src = s6->sin6_addr;
6499 }
6500 ifaddr = INADDR_ANY;
6501 } else {
6502 imreqp = (struct ip_mreq_source *)i1;
6503 IN6_INADDR_TO_V4MAPPED(&imreqp->imr_multiaddr, &v6group);
6504 IN6_INADDR_TO_V4MAPPED(&imreqp->imr_sourceaddr, &v6src);
6505 ifaddr = (ipaddr_t)imreqp->imr_interface.s_addr;
6506 ifindex = 0;
6507 }
6508
6509 /*
6510 * Handle src being mapped INADDR_ANY by changing it to unspecified.
6511 */
6512 if (IN6_IS_ADDR_V4MAPPED_ANY(&v6src))
6513 v6src = ipv6_all_zeros;
6514
6515 /*
6516 * In the multirouting case, we need to replicate
6517 * the request as noted in the mcast cases above.
6518 */
6519 if (IN6_IS_ADDR_V4MAPPED(&v6group)) {
6520 ipaddr_t group;
6521
6522 IN6_V4MAPPED_TO_IPADDR(&v6group, group);
6523
6524 ire = ire_ftable_lookup_v4(group, IP_HOST_MASK, 0,
6525 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6526 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6527 } else {
6528 ire = ire_ftable_lookup_v6(&v6group, &ipv6_all_ones, 0,
6529 IRE_HOST | IRE_INTERFACE, NULL, ALL_ZONES, NULL,
6530 MATCH_IRE_MASK | MATCH_IRE_TYPE, 0, ipst, NULL);
6531 }
6532 if (ire != NULL) {
6533 if (ire->ire_flags & RTF_MULTIRT) {
6534 error = ip_multirt_apply_membership(optfn, ire, connp,
6535 checkonly, &v6group, fmode, &v6src);
6536 done = B_TRUE;
6537 }
6538 ire_refrele(ire);
6539 }
6540 if (!done) {
6541 error = optfn(connp, checkonly, &v6group, ifaddr, ifindex,
6542 fmode, &v6src);
6543 }
6544 return (error);
6545 }
6546
6547 /*
6548 * Given a destination address and a pointer to where to put the information
6549 * this routine fills in the mtuinfo.
6550 * The socket must be connected.
6551 * For sctp conn_faddr is the primary address.
6552 */
6553 int
6554 ip_fill_mtuinfo(conn_t *connp, ip_xmit_attr_t *ixa, struct ip6_mtuinfo *mtuinfo)
6555 {
6556 uint32_t pmtu = IP_MAXPACKET;
6557 uint_t scopeid;
6558
6559 if (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6))
6560 return (-1);
6561
6562 /* In case we never sent or called ip_set_destination_v4/v6 */
6563 if (ixa->ixa_ire != NULL)
6564 pmtu = ip_get_pmtu(ixa);
6565
6566 if (ixa->ixa_flags & IXAF_SCOPEID_SET)
6567 scopeid = ixa->ixa_scopeid;
6568 else
6569 scopeid = 0;
6570
6571 bzero(mtuinfo, sizeof (*mtuinfo));
6572 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
6573 mtuinfo->ip6m_addr.sin6_port = connp->conn_fport;
6574 mtuinfo->ip6m_addr.sin6_addr = connp->conn_faddr_v6;
6575 mtuinfo->ip6m_addr.sin6_scope_id = scopeid;
6576 mtuinfo->ip6m_mtu = pmtu;
6577
6578 return (sizeof (struct ip6_mtuinfo));
6579 }
6580
6581 /*
6582 * When the src multihoming is changed from weak to [strong, preferred]
6583 * ip_ire_rebind_walker is called to walk the list of all ire_t entries
6584 * and identify routes that were created by user-applications in the
6585 * unbound state (i.e., without RTA_IFP), and for which an ire_ill is not
6586 * currently defined. These routes are then 'rebound', i.e., their ire_ill
6587 * is selected by finding an interface route for the gateway.
6588 */
6589 /* ARGSUSED */
6590 void
6591 ip_ire_rebind_walker(ire_t *ire, void *notused)
6592 {
6593 if (!ire->ire_unbound || ire->ire_ill != NULL)
6594 return;
6595 ire_rebind(ire);
6596 ire_delete(ire);
6597 }
6598
6599 /*
6600 * When the src multihoming is changed from [strong, preferred] to weak,
6601 * ip_ire_unbind_walker is called to walk the list of all ire_t entries, and
6602 * set any entries that were created by user-applications in the unbound state
6603 * (i.e., without RTA_IFP) back to having a NULL ire_ill.
6604 */
6605 /* ARGSUSED */
6606 void
6607 ip_ire_unbind_walker(ire_t *ire, void *notused)
6608 {
6609 ire_t *new_ire;
6610
6611 if (!ire->ire_unbound || ire->ire_ill == NULL)
6612 return;
6613 if (ire->ire_ipversion == IPV6_VERSION) {
6614 new_ire = ire_create_v6(&ire->ire_addr_v6, &ire->ire_mask_v6,
6615 &ire->ire_gateway_addr_v6, ire->ire_type, NULL,
6616 ire->ire_zoneid, ire->ire_flags, NULL, ire->ire_ipst);
6617 } else {
6618 new_ire = ire_create((uchar_t *)&ire->ire_addr,
6619 (uchar_t *)&ire->ire_mask,
6620 (uchar_t *)&ire->ire_gateway_addr, ire->ire_type, NULL,
6621 ire->ire_zoneid, ire->ire_flags, NULL, ire->ire_ipst);
6622 }
6623 if (new_ire == NULL)
6624 return;
6625 new_ire->ire_unbound = B_TRUE;
6626 /*
6627 * The bound ire must first be deleted so that we don't return
6628 * the existing one on the attempt to add the unbound new_ire.
6629 */
6630 ire_delete(ire);
6631 new_ire = ire_add(new_ire);
6632 if (new_ire != NULL)
6633 ire_refrele(new_ire);
6634 }
6635
6636 /*
6637 * When the settings of ip*_strict_src_multihoming tunables are changed,
6638 * all cached routes need to be recomputed. This recomputation needs to be
6639 * done when going from weaker to stronger modes so that the cached ire
6640 * for the connection does not violate the current ip*_strict_src_multihoming
6641 * setting. It also needs to be done when going from stronger to weaker modes,
6642 * so that we fall back to matching on the longest-matching-route (as opposed
6643 * to a shorter match that may have been selected in the strong mode
6644 * to satisfy src_multihoming settings).
6645 *
6646 * The cached ixa_ire entires for all conn_t entries are marked as
6647 * "verify" so that they will be recomputed for the next packet.
6648 */
6649 void
6650 conn_ire_revalidate(conn_t *connp, void *arg)
6651 {
6652 boolean_t isv6 = (boolean_t)arg;
6653
6654 if ((isv6 && connp->conn_ipversion != IPV6_VERSION) ||
6655 (!isv6 && connp->conn_ipversion != IPV4_VERSION))
6656 return;
6657 connp->conn_ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
6658 }
6659
6660 /*
6661 * Handles both IPv4 and IPv6 reassembly - doing the out-of-order cases,
6662 * When an ipf is passed here for the first time, if
6663 * we already have in-order fragments on the queue, we convert from the fast-
6664 * path reassembly scheme to the hard-case scheme. From then on, additional
6665 * fragments are reassembled here. We keep track of the start and end offsets
6666 * of each piece, and the number of holes in the chain. When the hole count
6667 * goes to zero, we are done!
6668 *
6669 * The ipf_count will be updated to account for any mblk(s) added (pointed to
6670 * by mp) or subtracted (freeb()ed dups), upon return the caller must update
6671 * ipfb_count and ill_frag_count by the difference of ipf_count before and
6672 * after the call to ip_reassemble().
6673 */
6674 int
6675 ip_reassemble(mblk_t *mp, ipf_t *ipf, uint_t start, boolean_t more, ill_t *ill,
6676 size_t msg_len)
6677 {
6678 uint_t end;
6679 mblk_t *next_mp;
6680 mblk_t *mp1;
6681 uint_t offset;
6682 boolean_t incr_dups = B_TRUE;
6683 boolean_t offset_zero_seen = B_FALSE;
6684 boolean_t pkt_boundary_checked = B_FALSE;
6685
6686 /* If start == 0 then ipf_nf_hdr_len has to be set. */
6687 ASSERT(start != 0 || ipf->ipf_nf_hdr_len != 0);
6688
6689 /* Add in byte count */
6690 ipf->ipf_count += msg_len;
6691 if (ipf->ipf_end) {
6692 /*
6693 * We were part way through in-order reassembly, but now there
6694 * is a hole. We walk through messages already queued, and
6695 * mark them for hard case reassembly. We know that up till
6696 * now they were in order starting from offset zero.
6697 */
6698 offset = 0;
6699 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) {
6700 IP_REASS_SET_START(mp1, offset);
6701 if (offset == 0) {
6702 ASSERT(ipf->ipf_nf_hdr_len != 0);
6703 offset = -ipf->ipf_nf_hdr_len;
6704 }
6705 offset += mp1->b_wptr - mp1->b_rptr;
6706 IP_REASS_SET_END(mp1, offset);
6707 }
6708 /* One hole at the end. */
6709 ipf->ipf_hole_cnt = 1;
6710 /* Brand it as a hard case, forever. */
6711 ipf->ipf_end = 0;
6712 }
6713 /* Walk through all the new pieces. */
6714 do {
6715 end = start + (mp->b_wptr - mp->b_rptr);
6716 /*
6717 * If start is 0, decrease 'end' only for the first mblk of
6718 * the fragment. Otherwise 'end' can get wrong value in the
6719 * second pass of the loop if first mblk is exactly the
6720 * size of ipf_nf_hdr_len.
6721 */
6722 if (start == 0 && !offset_zero_seen) {
6723 /* First segment */
6724 ASSERT(ipf->ipf_nf_hdr_len != 0);
6725 end -= ipf->ipf_nf_hdr_len;
6726 offset_zero_seen = B_TRUE;
6727 }
6728 next_mp = mp->b_cont;
6729 /*
6730 * We are checking to see if there is any interesing data
6731 * to process. If there isn't and the mblk isn't the
6732 * one which carries the unfragmentable header then we
6733 * drop it. It's possible to have just the unfragmentable
6734 * header come through without any data. That needs to be
6735 * saved.
6736 *
6737 * If the assert at the top of this function holds then the
6738 * term "ipf->ipf_nf_hdr_len != 0" isn't needed. This code
6739 * is infrequently traveled enough that the test is left in
6740 * to protect against future code changes which break that
6741 * invariant.
6742 */
6743 if (start == end && start != 0 && ipf->ipf_nf_hdr_len != 0) {
6744 /* Empty. Blast it. */
6745 IP_REASS_SET_START(mp, 0);
6746 IP_REASS_SET_END(mp, 0);
6747 /*
6748 * If the ipf points to the mblk we are about to free,
6749 * update ipf to point to the next mblk (or NULL
6750 * if none).
6751 */
6752 if (ipf->ipf_mp->b_cont == mp)
6753 ipf->ipf_mp->b_cont = next_mp;
6754 freeb(mp);
6755 continue;
6756 }
6757 mp->b_cont = NULL;
6758 IP_REASS_SET_START(mp, start);
6759 IP_REASS_SET_END(mp, end);
6760 if (!ipf->ipf_tail_mp) {
6761 ipf->ipf_tail_mp = mp;
6762 ipf->ipf_mp->b_cont = mp;
6763 if (start == 0 || !more) {
6764 ipf->ipf_hole_cnt = 1;
6765 /*
6766 * if the first fragment comes in more than one
6767 * mblk, this loop will be executed for each
6768 * mblk. Need to adjust hole count so exiting
6769 * this routine will leave hole count at 1.
6770 */
6771 if (next_mp)
6772 ipf->ipf_hole_cnt++;
6773 } else
6774 ipf->ipf_hole_cnt = 2;
6775 continue;
6776 } else if (ipf->ipf_last_frag_seen && !more &&
6777 !pkt_boundary_checked) {
6778 /*
6779 * We check datagram boundary only if this fragment
6780 * claims to be the last fragment and we have seen a
6781 * last fragment in the past too. We do this only
6782 * once for a given fragment.
6783 *
6784 * start cannot be 0 here as fragments with start=0
6785 * and MF=0 gets handled as a complete packet. These
6786 * fragments should not reach here.
6787 */
6788
6789 if (start + msgdsize(mp) !=
6790 IP_REASS_END(ipf->ipf_tail_mp)) {
6791 /*
6792 * We have two fragments both of which claim
6793 * to be the last fragment but gives conflicting
6794 * information about the whole datagram size.
6795 * Something fishy is going on. Drop the
6796 * fragment and free up the reassembly list.
6797 */
6798 return (IP_REASS_FAILED);
6799 }
6800
6801 /*
6802 * We shouldn't come to this code block again for this
6803 * particular fragment.
6804 */
6805 pkt_boundary_checked = B_TRUE;
6806 }
6807
6808 /* New stuff at or beyond tail? */
6809 offset = IP_REASS_END(ipf->ipf_tail_mp);
6810 if (start >= offset) {
6811 if (ipf->ipf_last_frag_seen) {
6812 /* current fragment is beyond last fragment */
6813 return (IP_REASS_FAILED);
6814 }
6815 /* Link it on end. */
6816 ipf->ipf_tail_mp->b_cont = mp;
6817 ipf->ipf_tail_mp = mp;
6818 if (more) {
6819 if (start != offset)
6820 ipf->ipf_hole_cnt++;
6821 } else if (start == offset && next_mp == NULL)
6822 ipf->ipf_hole_cnt--;
6823 continue;
6824 }
6825 mp1 = ipf->ipf_mp->b_cont;
6826 offset = IP_REASS_START(mp1);
6827 /* New stuff at the front? */
6828 if (start < offset) {
6829 if (start == 0) {
6830 if (end >= offset) {
6831 /* Nailed the hole at the begining. */
6832 ipf->ipf_hole_cnt--;
6833 }
6834 } else if (end < offset) {
6835 /*
6836 * A hole, stuff, and a hole where there used
6837 * to be just a hole.
6838 */
6839 ipf->ipf_hole_cnt++;
6840 }
6841 mp->b_cont = mp1;
6842 /* Check for overlap. */
6843 while (end > offset) {
6844 if (end < IP_REASS_END(mp1)) {
6845 mp->b_wptr -= end - offset;
6846 IP_REASS_SET_END(mp, offset);
6847 BUMP_MIB(ill->ill_ip_mib,
6848 ipIfStatsReasmPartDups);
6849 break;
6850 }
6851 /* Did we cover another hole? */
6852 if ((mp1->b_cont &&
6853 IP_REASS_END(mp1) !=
6854 IP_REASS_START(mp1->b_cont) &&
6855 end >= IP_REASS_START(mp1->b_cont)) ||
6856 (!ipf->ipf_last_frag_seen && !more)) {
6857 ipf->ipf_hole_cnt--;
6858 }
6859 /* Clip out mp1. */
6860 if ((mp->b_cont = mp1->b_cont) == NULL) {
6861 /*
6862 * After clipping out mp1, this guy
6863 * is now hanging off the end.
6864 */
6865 ipf->ipf_tail_mp = mp;
6866 }
6867 IP_REASS_SET_START(mp1, 0);
6868 IP_REASS_SET_END(mp1, 0);
6869 /* Subtract byte count */
6870 ipf->ipf_count -= mp1->b_datap->db_lim -
6871 mp1->b_datap->db_base;
6872 freeb(mp1);
6873 BUMP_MIB(ill->ill_ip_mib,
6874 ipIfStatsReasmPartDups);
6875 mp1 = mp->b_cont;
6876 if (!mp1)
6877 break;
6878 offset = IP_REASS_START(mp1);
6879 }
6880 ipf->ipf_mp->b_cont = mp;
6881 continue;
6882 }
6883 /*
6884 * The new piece starts somewhere between the start of the head
6885 * and before the end of the tail.
6886 */
6887 for (; mp1; mp1 = mp1->b_cont) {
6888 offset = IP_REASS_END(mp1);
6889 if (start < offset) {
6890 if (end <= offset) {
6891 /* Nothing new. */
6892 IP_REASS_SET_START(mp, 0);
6893 IP_REASS_SET_END(mp, 0);
6894 /* Subtract byte count */
6895 ipf->ipf_count -= mp->b_datap->db_lim -
6896 mp->b_datap->db_base;
6897 if (incr_dups) {
6898 ipf->ipf_num_dups++;
6899 incr_dups = B_FALSE;
6900 }
6901 freeb(mp);
6902 BUMP_MIB(ill->ill_ip_mib,
6903 ipIfStatsReasmDuplicates);
6904 break;
6905 }
6906 /*
6907 * Trim redundant stuff off beginning of new
6908 * piece.
6909 */
6910 IP_REASS_SET_START(mp, offset);
6911 mp->b_rptr += offset - start;
6912 BUMP_MIB(ill->ill_ip_mib,
6913 ipIfStatsReasmPartDups);
6914 start = offset;
6915 if (!mp1->b_cont) {
6916 /*
6917 * After trimming, this guy is now
6918 * hanging off the end.
6919 */
6920 mp1->b_cont = mp;
6921 ipf->ipf_tail_mp = mp;
6922 if (!more) {
6923 ipf->ipf_hole_cnt--;
6924 }
6925 break;
6926 }
6927 }
6928 if (start >= IP_REASS_START(mp1->b_cont))
6929 continue;
6930 /* Fill a hole */
6931 if (start > offset)
6932 ipf->ipf_hole_cnt++;
6933 mp->b_cont = mp1->b_cont;
6934 mp1->b_cont = mp;
6935 mp1 = mp->b_cont;
6936 offset = IP_REASS_START(mp1);
6937 if (end >= offset) {
6938 ipf->ipf_hole_cnt--;
6939 /* Check for overlap. */
6940 while (end > offset) {
6941 if (end < IP_REASS_END(mp1)) {
6942 mp->b_wptr -= end - offset;
6943 IP_REASS_SET_END(mp, offset);
6944 /*
6945 * TODO we might bump
6946 * this up twice if there is
6947 * overlap at both ends.
6948 */
6949 BUMP_MIB(ill->ill_ip_mib,
6950 ipIfStatsReasmPartDups);
6951 break;
6952 }
6953 /* Did we cover another hole? */
6954 if ((mp1->b_cont &&
6955 IP_REASS_END(mp1)
6956 != IP_REASS_START(mp1->b_cont) &&
6957 end >=
6958 IP_REASS_START(mp1->b_cont)) ||
6959 (!ipf->ipf_last_frag_seen &&
6960 !more)) {
6961 ipf->ipf_hole_cnt--;
6962 }
6963 /* Clip out mp1. */
6964 if ((mp->b_cont = mp1->b_cont) ==
6965 NULL) {
6966 /*
6967 * After clipping out mp1,
6968 * this guy is now hanging
6969 * off the end.
6970 */
6971 ipf->ipf_tail_mp = mp;
6972 }
6973 IP_REASS_SET_START(mp1, 0);
6974 IP_REASS_SET_END(mp1, 0);
6975 /* Subtract byte count */
6976 ipf->ipf_count -=
6977 mp1->b_datap->db_lim -
6978 mp1->b_datap->db_base;
6979 freeb(mp1);
6980 BUMP_MIB(ill->ill_ip_mib,
6981 ipIfStatsReasmPartDups);
6982 mp1 = mp->b_cont;
6983 if (!mp1)
6984 break;
6985 offset = IP_REASS_START(mp1);
6986 }
6987 }
6988 break;
6989 }
6990 } while (start = end, mp = next_mp);
6991
6992 /* Fragment just processed could be the last one. Remember this fact */
6993 if (!more)
6994 ipf->ipf_last_frag_seen = B_TRUE;
6995
6996 /* Still got holes? */
6997 if (ipf->ipf_hole_cnt)
6998 return (IP_REASS_PARTIAL);
6999 /* Clean up overloaded fields to avoid upstream disasters. */
7000 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) {
7001 IP_REASS_SET_START(mp1, 0);
7002 IP_REASS_SET_END(mp1, 0);
7003 }
7004 return (IP_REASS_COMPLETE);
7005 }
7006
7007 /*
7008 * Fragmentation reassembly. Each ILL has a hash table for
7009 * queuing packets undergoing reassembly for all IPIFs
7010 * associated with the ILL. The hash is based on the packet
7011 * IP ident field. The ILL frag hash table was allocated
7012 * as a timer block at the time the ILL was created. Whenever
7013 * there is anything on the reassembly queue, the timer will
7014 * be running. Returns the reassembled packet if reassembly completes.
7015 */
7016 mblk_t *
7017 ip_input_fragment(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
7018 {
7019 uint32_t frag_offset_flags;
7020 mblk_t *t_mp;
7021 ipaddr_t dst;
7022 uint8_t proto = ipha->ipha_protocol;
7023 uint32_t sum_val;
7024 uint16_t sum_flags;
7025 ipf_t *ipf;
7026 ipf_t **ipfp;
7027 ipfb_t *ipfb;
7028 uint16_t ident;
7029 uint32_t offset;
7030 ipaddr_t src;
7031 uint_t hdr_length;
7032 uint32_t end;
7033 mblk_t *mp1;
7034 mblk_t *tail_mp;
7035 size_t count;
7036 size_t msg_len;
7037 uint8_t ecn_info = 0;
7038 uint32_t packet_size;
7039 boolean_t pruned = B_FALSE;
7040 ill_t *ill = ira->ira_ill;
7041 ip_stack_t *ipst = ill->ill_ipst;
7042
7043 /*
7044 * Drop the fragmented as early as possible, if
7045 * we don't have resource(s) to re-assemble.
7046 */
7047 if (ipst->ips_ip_reass_queue_bytes == 0) {
7048 freemsg(mp);
7049 return (NULL);
7050 }
7051
7052 /* Check for fragmentation offset; return if there's none */
7053 if ((frag_offset_flags = ntohs(ipha->ipha_fragment_offset_and_flags) &
7054 (IPH_MF | IPH_OFFSET)) == 0)
7055 return (mp);
7056
7057 /*
7058 * We utilize hardware computed checksum info only for UDP since
7059 * IP fragmentation is a normal occurrence for the protocol. In
7060 * addition, checksum offload support for IP fragments carrying
7061 * UDP payload is commonly implemented across network adapters.
7062 */
7063 ASSERT(ira->ira_rill != NULL);
7064 if (proto == IPPROTO_UDP && dohwcksum &&
7065 ILL_HCKSUM_CAPABLE(ira->ira_rill) &&
7066 (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) {
7067 mblk_t *mp1 = mp->b_cont;
7068 int32_t len;
7069
7070 /* Record checksum information from the packet */
7071 sum_val = (uint32_t)DB_CKSUM16(mp);
7072 sum_flags = DB_CKSUMFLAGS(mp);
7073
7074 /* IP payload offset from beginning of mblk */
7075 offset = ((uchar_t *)ipha + IPH_HDR_LENGTH(ipha)) - mp->b_rptr;
7076
7077 if ((sum_flags & HCK_PARTIALCKSUM) &&
7078 (mp1 == NULL || mp1->b_cont == NULL) &&
7079 offset >= DB_CKSUMSTART(mp) &&
7080 ((len = offset - DB_CKSUMSTART(mp)) & 1) == 0) {
7081 uint32_t adj;
7082 /*
7083 * Partial checksum has been calculated by hardware
7084 * and attached to the packet; in addition, any
7085 * prepended extraneous data is even byte aligned.
7086 * If any such data exists, we adjust the checksum;
7087 * this would also handle any postpended data.
7088 */
7089 IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp),
7090 mp, mp1, len, adj);
7091
7092 /* One's complement subtract extraneous checksum */
7093 if (adj >= sum_val)
7094 sum_val = ~(adj - sum_val) & 0xFFFF;
7095 else
7096 sum_val -= adj;
7097 }
7098 } else {
7099 sum_val = 0;
7100 sum_flags = 0;
7101 }
7102
7103 /* Clear hardware checksumming flag */
7104 DB_CKSUMFLAGS(mp) = 0;
7105
7106 ident = ipha->ipha_ident;
7107 offset = (frag_offset_flags << 3) & 0xFFFF;
7108 src = ipha->ipha_src;
7109 dst = ipha->ipha_dst;
7110 hdr_length = IPH_HDR_LENGTH(ipha);
7111 end = ntohs(ipha->ipha_length) - hdr_length;
7112
7113 /* If end == 0 then we have a packet with no data, so just free it */
7114 if (end == 0) {
7115 freemsg(mp);
7116 return (NULL);
7117 }
7118
7119 /* Record the ECN field info. */
7120 ecn_info = (ipha->ipha_type_of_service & 0x3);
7121 if (offset != 0) {
7122 /*
7123 * If this isn't the first piece, strip the header, and
7124 * add the offset to the end value.
7125 */
7126 mp->b_rptr += hdr_length;
7127 end += offset;
7128 }
7129
7130 /* Handle vnic loopback of fragments */
7131 if (mp->b_datap->db_ref > 2)
7132 msg_len = 0;
7133 else
7134 msg_len = MBLKSIZE(mp);
7135
7136 tail_mp = mp;
7137 while (tail_mp->b_cont != NULL) {
7138 tail_mp = tail_mp->b_cont;
7139 if (tail_mp->b_datap->db_ref <= 2)
7140 msg_len += MBLKSIZE(tail_mp);
7141 }
7142
7143 /* If the reassembly list for this ILL will get too big, prune it */
7144 if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >=
7145 ipst->ips_ip_reass_queue_bytes) {
7146 DTRACE_PROBE3(ip_reass_queue_bytes, uint_t, msg_len,
7147 uint_t, ill->ill_frag_count,
7148 uint_t, ipst->ips_ip_reass_queue_bytes);
7149 ill_frag_prune(ill,
7150 (ipst->ips_ip_reass_queue_bytes < msg_len) ? 0 :
7151 (ipst->ips_ip_reass_queue_bytes - msg_len));
7152 pruned = B_TRUE;
7153 }
7154
7155 ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH(src, ident)];
7156 mutex_enter(&ipfb->ipfb_lock);
7157
7158 ipfp = &ipfb->ipfb_ipf;
7159 /* Try to find an existing fragment queue for this packet. */
7160 for (;;) {
7161 ipf = ipfp[0];
7162 if (ipf != NULL) {
7163 /*
7164 * It has to match on ident and src/dst address.
7165 */
7166 if (ipf->ipf_ident == ident &&
7167 ipf->ipf_src == src &&
7168 ipf->ipf_dst == dst &&
7169 ipf->ipf_protocol == proto) {
7170 /*
7171 * If we have received too many
7172 * duplicate fragments for this packet
7173 * free it.
7174 */
7175 if (ipf->ipf_num_dups > ip_max_frag_dups) {
7176 ill_frag_free_pkts(ill, ipfb, ipf, 1);
7177 freemsg(mp);
7178 mutex_exit(&ipfb->ipfb_lock);
7179 return (NULL);
7180 }
7181 /* Found it. */
7182 break;
7183 }
7184 ipfp = &ipf->ipf_hash_next;
7185 continue;
7186 }
7187
7188 /*
7189 * If we pruned the list, do we want to store this new
7190 * fragment?. We apply an optimization here based on the
7191 * fact that most fragments will be received in order.
7192 * So if the offset of this incoming fragment is zero,
7193 * it is the first fragment of a new packet. We will
7194 * keep it. Otherwise drop the fragment, as we have
7195 * probably pruned the packet already (since the
7196 * packet cannot be found).
7197 */
7198 if (pruned && offset != 0) {
7199 mutex_exit(&ipfb->ipfb_lock);
7200 freemsg(mp);
7201 return (NULL);
7202 }
7203
7204 if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS(ipst)) {
7205 /*
7206 * Too many fragmented packets in this hash
7207 * bucket. Free the oldest.
7208 */
7209 ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1);
7210 }
7211
7212 /* New guy. Allocate a frag message. */
7213 mp1 = allocb(sizeof (*ipf), BPRI_MED);
7214 if (mp1 == NULL) {
7215 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7216 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7217 freemsg(mp);
7218 reass_done:
7219 mutex_exit(&ipfb->ipfb_lock);
7220 return (NULL);
7221 }
7222
7223 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmReqds);
7224 mp1->b_cont = mp;
7225
7226 /* Initialize the fragment header. */
7227 ipf = (ipf_t *)mp1->b_rptr;
7228 ipf->ipf_mp = mp1;
7229 ipf->ipf_ptphn = ipfp;
7230 ipfp[0] = ipf;
7231 ipf->ipf_hash_next = NULL;
7232 ipf->ipf_ident = ident;
7233 ipf->ipf_protocol = proto;
7234 ipf->ipf_src = src;
7235 ipf->ipf_dst = dst;
7236 ipf->ipf_nf_hdr_len = 0;
7237 /* Record reassembly start time. */
7238 ipf->ipf_timestamp = gethrestime_sec();
7239 /* Record ipf generation and account for frag header */
7240 ipf->ipf_gen = ill->ill_ipf_gen++;
7241 ipf->ipf_count = MBLKSIZE(mp1);
7242 ipf->ipf_last_frag_seen = B_FALSE;
7243 ipf->ipf_ecn = ecn_info;
7244 ipf->ipf_num_dups = 0;
7245 ipfb->ipfb_frag_pkts++;
7246 ipf->ipf_checksum = 0;
7247 ipf->ipf_checksum_flags = 0;
7248
7249 /* Store checksum value in fragment header */
7250 if (sum_flags != 0) {
7251 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7252 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7253 ipf->ipf_checksum = sum_val;
7254 ipf->ipf_checksum_flags = sum_flags;
7255 }
7256
7257 /*
7258 * We handle reassembly two ways. In the easy case,
7259 * where all the fragments show up in order, we do
7260 * minimal bookkeeping, and just clip new pieces on
7261 * the end. If we ever see a hole, then we go off
7262 * to ip_reassemble which has to mark the pieces and
7263 * keep track of the number of holes, etc. Obviously,
7264 * the point of having both mechanisms is so we can
7265 * handle the easy case as efficiently as possible.
7266 */
7267 if (offset == 0) {
7268 /* Easy case, in-order reassembly so far. */
7269 ipf->ipf_count += msg_len;
7270 ipf->ipf_tail_mp = tail_mp;
7271 /*
7272 * Keep track of next expected offset in
7273 * ipf_end.
7274 */
7275 ipf->ipf_end = end;
7276 ipf->ipf_nf_hdr_len = hdr_length;
7277 } else {
7278 /* Hard case, hole at the beginning. */
7279 ipf->ipf_tail_mp = NULL;
7280 /*
7281 * ipf_end == 0 means that we have given up
7282 * on easy reassembly.
7283 */
7284 ipf->ipf_end = 0;
7285
7286 /* Forget checksum offload from now on */
7287 ipf->ipf_checksum_flags = 0;
7288
7289 /*
7290 * ipf_hole_cnt is set by ip_reassemble.
7291 * ipf_count is updated by ip_reassemble.
7292 * No need to check for return value here
7293 * as we don't expect reassembly to complete
7294 * or fail for the first fragment itself.
7295 */
7296 (void) ip_reassemble(mp, ipf,
7297 (frag_offset_flags & IPH_OFFSET) << 3,
7298 (frag_offset_flags & IPH_MF), ill, msg_len);
7299 }
7300 /* Update per ipfb and ill byte counts */
7301 ipfb->ipfb_count += ipf->ipf_count;
7302 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
7303 atomic_add_32(&ill->ill_frag_count, ipf->ipf_count);
7304 /* If the frag timer wasn't already going, start it. */
7305 mutex_enter(&ill->ill_lock);
7306 ill_frag_timer_start(ill);
7307 mutex_exit(&ill->ill_lock);
7308 goto reass_done;
7309 }
7310
7311 /*
7312 * If the packet's flag has changed (it could be coming up
7313 * from an interface different than the previous, therefore
7314 * possibly different checksum capability), then forget about
7315 * any stored checksum states. Otherwise add the value to
7316 * the existing one stored in the fragment header.
7317 */
7318 if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) {
7319 sum_val += ipf->ipf_checksum;
7320 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7321 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16);
7322 ipf->ipf_checksum = sum_val;
7323 } else if (ipf->ipf_checksum_flags != 0) {
7324 /* Forget checksum offload from now on */
7325 ipf->ipf_checksum_flags = 0;
7326 }
7327
7328 /*
7329 * We have a new piece of a datagram which is already being
7330 * reassembled. Update the ECN info if all IP fragments
7331 * are ECN capable. If there is one which is not, clear
7332 * all the info. If there is at least one which has CE
7333 * code point, IP needs to report that up to transport.
7334 */
7335 if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) {
7336 if (ecn_info == IPH_ECN_CE)
7337 ipf->ipf_ecn = IPH_ECN_CE;
7338 } else {
7339 ipf->ipf_ecn = IPH_ECN_NECT;
7340 }
7341 if (offset && ipf->ipf_end == offset) {
7342 /* The new fragment fits at the end */
7343 ipf->ipf_tail_mp->b_cont = mp;
7344 /* Update the byte count */
7345 ipf->ipf_count += msg_len;
7346 /* Update per ipfb and ill byte counts */
7347 ipfb->ipfb_count += msg_len;
7348 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
7349 atomic_add_32(&ill->ill_frag_count, msg_len);
7350 if (frag_offset_flags & IPH_MF) {
7351 /* More to come. */
7352 ipf->ipf_end = end;
7353 ipf->ipf_tail_mp = tail_mp;
7354 goto reass_done;
7355 }
7356 } else {
7357 /* Go do the hard cases. */
7358 int ret;
7359
7360 if (offset == 0)
7361 ipf->ipf_nf_hdr_len = hdr_length;
7362
7363 /* Save current byte count */
7364 count = ipf->ipf_count;
7365 ret = ip_reassemble(mp, ipf,
7366 (frag_offset_flags & IPH_OFFSET) << 3,
7367 (frag_offset_flags & IPH_MF), ill, msg_len);
7368 /* Count of bytes added and subtracted (freeb()ed) */
7369 count = ipf->ipf_count - count;
7370 if (count) {
7371 /* Update per ipfb and ill byte counts */
7372 ipfb->ipfb_count += count;
7373 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */
7374 atomic_add_32(&ill->ill_frag_count, count);
7375 }
7376 if (ret == IP_REASS_PARTIAL) {
7377 goto reass_done;
7378 } else if (ret == IP_REASS_FAILED) {
7379 /* Reassembly failed. Free up all resources */
7380 ill_frag_free_pkts(ill, ipfb, ipf, 1);
7381 for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) {
7382 IP_REASS_SET_START(t_mp, 0);
7383 IP_REASS_SET_END(t_mp, 0);
7384 }
7385 freemsg(mp);
7386 goto reass_done;
7387 }
7388 /* We will reach here iff 'ret' is IP_REASS_COMPLETE */
7389 }
7390 /*
7391 * We have completed reassembly. Unhook the frag header from
7392 * the reassembly list.
7393 *
7394 * Before we free the frag header, record the ECN info
7395 * to report back to the transport.
7396 */
7397 ecn_info = ipf->ipf_ecn;
7398 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmOKs);
7399 ipfp = ipf->ipf_ptphn;
7400
7401 /* We need to supply these to caller */
7402 if ((sum_flags = ipf->ipf_checksum_flags) != 0)
7403 sum_val = ipf->ipf_checksum;
7404 else
7405 sum_val = 0;
7406
7407 mp1 = ipf->ipf_mp;
7408 count = ipf->ipf_count;
7409 ipf = ipf->ipf_hash_next;
7410 if (ipf != NULL)
7411 ipf->ipf_ptphn = ipfp;
7412 ipfp[0] = ipf;
7413 atomic_add_32(&ill->ill_frag_count, -count);
7414 ASSERT(ipfb->ipfb_count >= count);
7415 ipfb->ipfb_count -= count;
7416 ipfb->ipfb_frag_pkts--;
7417 mutex_exit(&ipfb->ipfb_lock);
7418 /* Ditch the frag header. */
7419 mp = mp1->b_cont;
7420
7421 freeb(mp1);
7422
7423 /* Restore original IP length in header. */
7424 packet_size = (uint32_t)msgdsize(mp);
7425 if (packet_size > IP_MAXPACKET) {
7426 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7427 ip_drop_input("Reassembled packet too large", mp, ill);
7428 freemsg(mp);
7429 return (NULL);
7430 }
7431
7432 if (DB_REF(mp) > 1) {
7433 mblk_t *mp2 = copymsg(mp);
7434
7435 if (mp2 == NULL) {
7436 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7437 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7438 freemsg(mp);
7439 return (NULL);
7440 }
7441 freemsg(mp);
7442 mp = mp2;
7443 }
7444 ipha = (ipha_t *)mp->b_rptr;
7445
7446 ipha->ipha_length = htons((uint16_t)packet_size);
7447 /* We're now complete, zip the frag state */
7448 ipha->ipha_fragment_offset_and_flags = 0;
7449 /* Record the ECN info. */
7450 ipha->ipha_type_of_service &= 0xFC;
7451 ipha->ipha_type_of_service |= ecn_info;
7452
7453 /* Update the receive attributes */
7454 ira->ira_pktlen = packet_size;
7455 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
7456
7457 /* Reassembly is successful; set checksum information in packet */
7458 DB_CKSUM16(mp) = (uint16_t)sum_val;
7459 DB_CKSUMFLAGS(mp) = sum_flags;
7460 DB_CKSUMSTART(mp) = ira->ira_ip_hdr_length;
7461
7462 return (mp);
7463 }
7464
7465 /*
7466 * Pullup function that should be used for IP input in order to
7467 * ensure we do not loose the L2 source address; we need the l2 source
7468 * address for IP_RECVSLLA and for ndp_input.
7469 *
7470 * We return either NULL or b_rptr.
7471 */
7472 void *
7473 ip_pullup(mblk_t *mp, ssize_t len, ip_recv_attr_t *ira)
7474 {
7475 ill_t *ill = ira->ira_ill;
7476
7477 if (ip_rput_pullups++ == 0) {
7478 (void) mi_strlog(ill->ill_rq, 1, SL_ERROR|SL_TRACE,
7479 "ip_pullup: %s forced us to "
7480 " pullup pkt, hdr len %ld, hdr addr %p",
7481 ill->ill_name, len, (void *)mp->b_rptr);
7482 }
7483 if (!(ira->ira_flags & IRAF_L2SRC_SET))
7484 ip_setl2src(mp, ira, ira->ira_rill);
7485 ASSERT(ira->ira_flags & IRAF_L2SRC_SET);
7486 if (!pullupmsg(mp, len))
7487 return (NULL);
7488 else
7489 return (mp->b_rptr);
7490 }
7491
7492 /*
7493 * Make sure ira_l2src has an address. If we don't have one fill with zeros.
7494 * When called from the ULP ira_rill will be NULL hence the caller has to
7495 * pass in the ill.
7496 */
7497 /* ARGSUSED */
7498 void
7499 ip_setl2src(mblk_t *mp, ip_recv_attr_t *ira, ill_t *ill)
7500 {
7501 const uchar_t *addr;
7502 int alen;
7503
7504 if (ira->ira_flags & IRAF_L2SRC_SET)
7505 return;
7506
7507 ASSERT(ill != NULL);
7508 alen = ill->ill_phys_addr_length;
7509 ASSERT(alen <= sizeof (ira->ira_l2src));
7510 if (ira->ira_mhip != NULL &&
7511 (addr = ira->ira_mhip->mhi_saddr) != NULL) {
7512 bcopy(addr, ira->ira_l2src, alen);
7513 } else if ((ira->ira_flags & IRAF_L2SRC_LOOPBACK) &&
7514 (addr = ill->ill_phys_addr) != NULL) {
7515 bcopy(addr, ira->ira_l2src, alen);
7516 } else {
7517 bzero(ira->ira_l2src, alen);
7518 }
7519 ira->ira_flags |= IRAF_L2SRC_SET;
7520 }
7521
7522 /*
7523 * check ip header length and align it.
7524 */
7525 mblk_t *
7526 ip_check_and_align_header(mblk_t *mp, uint_t min_size, ip_recv_attr_t *ira)
7527 {
7528 ill_t *ill = ira->ira_ill;
7529 ssize_t len;
7530
7531 len = MBLKL(mp);
7532
7533 if (!OK_32PTR(mp->b_rptr))
7534 IP_STAT(ill->ill_ipst, ip_notaligned);
7535 else
7536 IP_STAT(ill->ill_ipst, ip_recv_pullup);
7537
7538 /* Guard against bogus device drivers */
7539 if (len < 0) {
7540 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7541 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7542 freemsg(mp);
7543 return (NULL);
7544 }
7545
7546 if (len == 0) {
7547 /* GLD sometimes sends up mblk with b_rptr == b_wptr! */
7548 mblk_t *mp1 = mp->b_cont;
7549
7550 if (!(ira->ira_flags & IRAF_L2SRC_SET))
7551 ip_setl2src(mp, ira, ira->ira_rill);
7552 ASSERT(ira->ira_flags & IRAF_L2SRC_SET);
7553
7554 freeb(mp);
7555 mp = mp1;
7556 if (mp == NULL)
7557 return (NULL);
7558
7559 if (OK_32PTR(mp->b_rptr) && MBLKL(mp) >= min_size)
7560 return (mp);
7561 }
7562 if (ip_pullup(mp, min_size, ira) == NULL) {
7563 if (msgdsize(mp) < min_size) {
7564 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7565 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7566 } else {
7567 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7568 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7569 }
7570 freemsg(mp);
7571 return (NULL);
7572 }
7573 return (mp);
7574 }
7575
7576 /*
7577 * Common code for IPv4 and IPv6 to check and pullup multi-mblks
7578 */
7579 mblk_t *
7580 ip_check_length(mblk_t *mp, uchar_t *rptr, ssize_t len, uint_t pkt_len,
7581 uint_t min_size, ip_recv_attr_t *ira)
7582 {
7583 ill_t *ill = ira->ira_ill;
7584
7585 /*
7586 * Make sure we have data length consistent
7587 * with the IP header.
7588 */
7589 if (mp->b_cont == NULL) {
7590 /* pkt_len is based on ipha_len, not the mblk length */
7591 if (pkt_len < min_size) {
7592 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7593 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7594 freemsg(mp);
7595 return (NULL);
7596 }
7597 if (len < 0) {
7598 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
7599 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
7600 freemsg(mp);
7601 return (NULL);
7602 }
7603 /* Drop any pad */
7604 mp->b_wptr = rptr + pkt_len;
7605 } else if ((len += msgdsize(mp->b_cont)) != 0) {
7606 ASSERT(pkt_len >= min_size);
7607 if (pkt_len < min_size) {
7608 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7609 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7610 freemsg(mp);
7611 return (NULL);
7612 }
7613 if (len < 0) {
7614 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
7615 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
7616 freemsg(mp);
7617 return (NULL);
7618 }
7619 /* Drop any pad */
7620 (void) adjmsg(mp, -len);
7621 /*
7622 * adjmsg may have freed an mblk from the chain, hence
7623 * invalidate any hw checksum here. This will force IP to
7624 * calculate the checksum in sw, but only for this packet.
7625 */
7626 DB_CKSUMFLAGS(mp) = 0;
7627 IP_STAT(ill->ill_ipst, ip_multimblk);
7628 }
7629 return (mp);
7630 }
7631
7632 /*
7633 * Check that the IPv4 opt_len is consistent with the packet and pullup
7634 * the options.
7635 */
7636 mblk_t *
7637 ip_check_optlen(mblk_t *mp, ipha_t *ipha, uint_t opt_len, uint_t pkt_len,
7638 ip_recv_attr_t *ira)
7639 {
7640 ill_t *ill = ira->ira_ill;
7641 ssize_t len;
7642
7643 /* Assume no IPv6 packets arrive over the IPv4 queue */
7644 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
7645 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7646 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInWrongIPVersion);
7647 ip_drop_input("IPvN packet on IPv4 ill", mp, ill);
7648 freemsg(mp);
7649 return (NULL);
7650 }
7651
7652 if (opt_len > (15 - IP_SIMPLE_HDR_LENGTH_IN_WORDS)) {
7653 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7654 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7655 freemsg(mp);
7656 return (NULL);
7657 }
7658 /*
7659 * Recompute complete header length and make sure we
7660 * have access to all of it.
7661 */
7662 len = ((size_t)opt_len + IP_SIMPLE_HDR_LENGTH_IN_WORDS) << 2;
7663 if (len > (mp->b_wptr - mp->b_rptr)) {
7664 if (len > pkt_len) {
7665 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
7666 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
7667 freemsg(mp);
7668 return (NULL);
7669 }
7670 if (ip_pullup(mp, len, ira) == NULL) {
7671 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
7672 ip_drop_input("ipIfStatsInDiscards", mp, ill);
7673 freemsg(mp);
7674 return (NULL);
7675 }
7676 }
7677 return (mp);
7678 }
7679
7680 /*
7681 * Returns a new ire, or the same ire, or NULL.
7682 * If a different IRE is returned, then it is held; the caller
7683 * needs to release it.
7684 * In no case is there any hold/release on the ire argument.
7685 */
7686 ire_t *
7687 ip_check_multihome(void *addr, ire_t *ire, ill_t *ill)
7688 {
7689 ire_t *new_ire;
7690 ill_t *ire_ill;
7691 uint_t ifindex;
7692 ip_stack_t *ipst = ill->ill_ipst;
7693 boolean_t strict_check = B_FALSE;
7694
7695 /*
7696 * IPMP common case: if IRE and ILL are in the same group, there's no
7697 * issue (e.g. packet received on an underlying interface matched an
7698 * IRE_LOCAL on its associated group interface).
7699 */
7700 ASSERT(ire->ire_ill != NULL);
7701 if (IS_IN_SAME_ILLGRP(ill, ire->ire_ill))
7702 return (ire);
7703
7704 /*
7705 * Do another ire lookup here, using the ingress ill, to see if the
7706 * interface is in a usesrc group.
7707 * As long as the ills belong to the same group, we don't consider
7708 * them to be arriving on the wrong interface. Thus, if the switch
7709 * is doing inbound load spreading, we won't drop packets when the
7710 * ip*_strict_dst_multihoming switch is on.
7711 * We also need to check for IPIF_UNNUMBERED point2point interfaces
7712 * where the local address may not be unique. In this case we were
7713 * at the mercy of the initial ire lookup and the IRE_LOCAL it
7714 * actually returned. The new lookup, which is more specific, should
7715 * only find the IRE_LOCAL associated with the ingress ill if one
7716 * exists.
7717 */
7718 if (ire->ire_ipversion == IPV4_VERSION) {
7719 if (ipst->ips_ip_strict_dst_multihoming)
7720 strict_check = B_TRUE;
7721 new_ire = ire_ftable_lookup_v4(*((ipaddr_t *)addr), 0, 0,
7722 IRE_LOCAL, ill, ALL_ZONES, NULL,
7723 (MATCH_IRE_TYPE|MATCH_IRE_ILL), 0, ipst, NULL);
7724 } else {
7725 ASSERT(!IN6_IS_ADDR_MULTICAST((in6_addr_t *)addr));
7726 if (ipst->ips_ipv6_strict_dst_multihoming)
7727 strict_check = B_TRUE;
7728 new_ire = ire_ftable_lookup_v6((in6_addr_t *)addr, NULL, NULL,
7729 IRE_LOCAL, ill, ALL_ZONES, NULL,
7730 (MATCH_IRE_TYPE|MATCH_IRE_ILL), 0, ipst, NULL);
7731 }
7732 /*
7733 * If the same ire that was returned in ip_input() is found then this
7734 * is an indication that usesrc groups are in use. The packet
7735 * arrived on a different ill in the group than the one associated with
7736 * the destination address. If a different ire was found then the same
7737 * IP address must be hosted on multiple ills. This is possible with
7738 * unnumbered point2point interfaces. We switch to use this new ire in
7739 * order to have accurate interface statistics.
7740 */
7741 if (new_ire != NULL) {
7742 /* Note: held in one case but not the other? Caller handles */
7743 if (new_ire != ire)
7744 return (new_ire);
7745 /* Unchanged */
7746 ire_refrele(new_ire);
7747 return (ire);
7748 }
7749
7750 /*
7751 * Chase pointers once and store locally.
7752 */
7753 ASSERT(ire->ire_ill != NULL);
7754 ire_ill = ire->ire_ill;
7755 ifindex = ill->ill_usesrc_ifindex;
7756
7757 /*
7758 * Check if it's a legal address on the 'usesrc' interface.
7759 * For IPMP data addresses the IRE_LOCAL is the upper, hence we
7760 * can just check phyint_ifindex.
7761 */
7762 if (ifindex != 0 && ifindex == ire_ill->ill_phyint->phyint_ifindex) {
7763 return (ire);
7764 }
7765
7766 /*
7767 * If the ip*_strict_dst_multihoming switch is on then we can
7768 * only accept this packet if the interface is marked as routing.
7769 */
7770 if (!(strict_check))
7771 return (ire);
7772
7773 if ((ill->ill_flags & ire->ire_ill->ill_flags & ILLF_ROUTER) != 0) {
7774 return (ire);
7775 }
7776 return (NULL);
7777 }
7778
7779 /*
7780 * This function is used to construct a mac_header_info_s from a
7781 * DL_UNITDATA_IND message.
7782 * The address fields in the mhi structure points into the message,
7783 * thus the caller can't use those fields after freeing the message.
7784 *
7785 * We determine whether the packet received is a non-unicast packet
7786 * and in doing so, determine whether or not it is broadcast vs multicast.
7787 * For it to be a broadcast packet, we must have the appropriate mblk_t
7788 * hanging off the ill_t. If this is either not present or doesn't match
7789 * the destination mac address in the DL_UNITDATA_IND, the packet is deemed
7790 * to be multicast. Thus NICs that have no broadcast address (or no
7791 * capability for one, such as point to point links) cannot return as
7792 * the packet being broadcast.
7793 */
7794 void
7795 ip_dlur_to_mhi(ill_t *ill, mblk_t *mb, struct mac_header_info_s *mhip)
7796 {
7797 dl_unitdata_ind_t *ind = (dl_unitdata_ind_t *)mb->b_rptr;
7798 mblk_t *bmp;
7799 uint_t extra_offset;
7800
7801 bzero(mhip, sizeof (struct mac_header_info_s));
7802
7803 mhip->mhi_dsttype = MAC_ADDRTYPE_UNICAST;
7804
7805 if (ill->ill_sap_length < 0)
7806 extra_offset = 0;
7807 else
7808 extra_offset = ill->ill_sap_length;
7809
7810 mhip->mhi_daddr = (uchar_t *)ind + ind->dl_dest_addr_offset +
7811 extra_offset;
7812 mhip->mhi_saddr = (uchar_t *)ind + ind->dl_src_addr_offset +
7813 extra_offset;
7814
7815 if (!ind->dl_group_address)
7816 return;
7817
7818 /* Multicast or broadcast */
7819 mhip->mhi_dsttype = MAC_ADDRTYPE_MULTICAST;
7820
7821 if (ind->dl_dest_addr_offset > sizeof (*ind) &&
7822 ind->dl_dest_addr_offset + ind->dl_dest_addr_length < MBLKL(mb) &&
7823 (bmp = ill->ill_bcast_mp) != NULL) {
7824 dl_unitdata_req_t *dlur;
7825 uint8_t *bphys_addr;
7826
7827 dlur = (dl_unitdata_req_t *)bmp->b_rptr;
7828 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
7829 extra_offset;
7830
7831 if (bcmp(mhip->mhi_daddr, bphys_addr,
7832 ind->dl_dest_addr_length) == 0)
7833 mhip->mhi_dsttype = MAC_ADDRTYPE_BROADCAST;
7834 }
7835 }
7836
7837 /*
7838 * This function is used to construct a mac_header_info_s from a
7839 * M_DATA fastpath message from a DLPI driver.
7840 * The address fields in the mhi structure points into the message,
7841 * thus the caller can't use those fields after freeing the message.
7842 *
7843 * We determine whether the packet received is a non-unicast packet
7844 * and in doing so, determine whether or not it is broadcast vs multicast.
7845 * For it to be a broadcast packet, we must have the appropriate mblk_t
7846 * hanging off the ill_t. If this is either not present or doesn't match
7847 * the destination mac address in the DL_UNITDATA_IND, the packet is deemed
7848 * to be multicast. Thus NICs that have no broadcast address (or no
7849 * capability for one, such as point to point links) cannot return as
7850 * the packet being broadcast.
7851 */
7852 void
7853 ip_mdata_to_mhi(ill_t *ill, mblk_t *mp, struct mac_header_info_s *mhip)
7854 {
7855 mblk_t *bmp;
7856 struct ether_header *pether;
7857
7858 bzero(mhip, sizeof (struct mac_header_info_s));
7859
7860 mhip->mhi_dsttype = MAC_ADDRTYPE_UNICAST;
7861
7862 pether = (struct ether_header *)((char *)mp->b_rptr
7863 - sizeof (struct ether_header));
7864
7865 /*
7866 * Make sure the interface is an ethernet type, since we don't
7867 * know the header format for anything but Ethernet. Also make
7868 * sure we are pointing correctly above db_base.
7869 */
7870 if (ill->ill_type != IFT_ETHER)
7871 return;
7872
7873 retry:
7874 if ((uchar_t *)pether < mp->b_datap->db_base)
7875 return;
7876
7877 /* Is there a VLAN tag? */
7878 if (ill->ill_isv6) {
7879 if (pether->ether_type != htons(ETHERTYPE_IPV6)) {
7880 pether = (struct ether_header *)((char *)pether - 4);
7881 goto retry;
7882 }
7883 } else {
7884 if (pether->ether_type != htons(ETHERTYPE_IP)) {
7885 pether = (struct ether_header *)((char *)pether - 4);
7886 goto retry;
7887 }
7888 }
7889 mhip->mhi_daddr = (uchar_t *)&pether->ether_dhost;
7890 mhip->mhi_saddr = (uchar_t *)&pether->ether_shost;
7891
7892 if (!(mhip->mhi_daddr[0] & 0x01))
7893 return;
7894
7895 /* Multicast or broadcast */
7896 mhip->mhi_dsttype = MAC_ADDRTYPE_MULTICAST;
7897
7898 if ((bmp = ill->ill_bcast_mp) != NULL) {
7899 dl_unitdata_req_t *dlur;
7900 uint8_t *bphys_addr;
7901 uint_t addrlen;
7902
7903 dlur = (dl_unitdata_req_t *)bmp->b_rptr;
7904 addrlen = dlur->dl_dest_addr_length;
7905 if (ill->ill_sap_length < 0) {
7906 bphys_addr = (uchar_t *)dlur +
7907 dlur->dl_dest_addr_offset;
7908 addrlen += ill->ill_sap_length;
7909 } else {
7910 bphys_addr = (uchar_t *)dlur +
7911 dlur->dl_dest_addr_offset +
7912 ill->ill_sap_length;
7913 addrlen -= ill->ill_sap_length;
7914 }
7915 if (bcmp(mhip->mhi_daddr, bphys_addr, addrlen) == 0)
7916 mhip->mhi_dsttype = MAC_ADDRTYPE_BROADCAST;
7917 }
7918 }
7919
7920 /*
7921 * Handle anything but M_DATA messages
7922 * We see the DL_UNITDATA_IND which are part
7923 * of the data path, and also the other messages from the driver.
7924 */
7925 void
7926 ip_rput_notdata(ill_t *ill, mblk_t *mp)
7927 {
7928 mblk_t *first_mp;
7929 struct iocblk *iocp;
7930 struct mac_header_info_s mhi;
7931
7932 switch (DB_TYPE(mp)) {
7933 case M_PROTO:
7934 case M_PCPROTO: {
7935 if (((dl_unitdata_ind_t *)mp->b_rptr)->dl_primitive !=
7936 DL_UNITDATA_IND) {
7937 /* Go handle anything other than data elsewhere. */
7938 ip_rput_dlpi(ill, mp);
7939 return;
7940 }
7941
7942 first_mp = mp;
7943 mp = first_mp->b_cont;
7944 first_mp->b_cont = NULL;
7945
7946 if (mp == NULL) {
7947 freeb(first_mp);
7948 return;
7949 }
7950 ip_dlur_to_mhi(ill, first_mp, &mhi);
7951 if (ill->ill_isv6)
7952 ip_input_v6(ill, NULL, mp, &mhi);
7953 else
7954 ip_input(ill, NULL, mp, &mhi);
7955
7956 /* Ditch the DLPI header. */
7957 freeb(first_mp);
7958 return;
7959 }
7960 case M_IOCACK:
7961 iocp = (struct iocblk *)mp->b_rptr;
7962 switch (iocp->ioc_cmd) {
7963 case DL_IOC_HDR_INFO:
7964 ill_fastpath_ack(ill, mp);
7965 return;
7966 default:
7967 putnext(ill->ill_rq, mp);
7968 return;
7969 }
7970 /* FALLTHROUGH */
7971 case M_ERROR:
7972 case M_HANGUP:
7973 mutex_enter(&ill->ill_lock);
7974 if (ill->ill_state_flags & ILL_CONDEMNED) {
7975 mutex_exit(&ill->ill_lock);
7976 freemsg(mp);
7977 return;
7978 }
7979 ill_refhold_locked(ill);
7980 mutex_exit(&ill->ill_lock);
7981 qwriter_ip(ill, ill->ill_rq, mp, ip_rput_other, CUR_OP,
7982 B_FALSE);
7983 return;
7984 case M_CTL:
7985 putnext(ill->ill_rq, mp);
7986 return;
7987 case M_IOCNAK:
7988 ip1dbg(("got iocnak "));
7989 iocp = (struct iocblk *)mp->b_rptr;
7990 switch (iocp->ioc_cmd) {
7991 case DL_IOC_HDR_INFO:
7992 ip_rput_other(NULL, ill->ill_rq, mp, NULL);
7993 return;
7994 default:
7995 break;
7996 }
7997 /* FALLTHROUGH */
7998 default:
7999 putnext(ill->ill_rq, mp);
8000 return;
8001 }
8002 }
8003
8004 /* Read side put procedure. Packets coming from the wire arrive here. */
8005 int
8006 ip_rput(queue_t *q, mblk_t *mp)
8007 {
8008 ill_t *ill;
8009 union DL_primitives *dl;
8010
8011 ill = (ill_t *)q->q_ptr;
8012
8013 if (ill->ill_state_flags & (ILL_CONDEMNED | ILL_LL_SUBNET_PENDING)) {
8014 /*
8015 * If things are opening or closing, only accept high-priority
8016 * DLPI messages. (On open ill->ill_ipif has not yet been
8017 * created; on close, things hanging off the ill may have been
8018 * freed already.)
8019 */
8020 dl = (union DL_primitives *)mp->b_rptr;
8021 if (DB_TYPE(mp) != M_PCPROTO ||
8022 dl->dl_primitive == DL_UNITDATA_IND) {
8023 inet_freemsg(mp);
8024 return (0);
8025 }
8026 }
8027 if (DB_TYPE(mp) == M_DATA) {
8028 struct mac_header_info_s mhi;
8029
8030 ip_mdata_to_mhi(ill, mp, &mhi);
8031 ip_input(ill, NULL, mp, &mhi);
8032 } else {
8033 ip_rput_notdata(ill, mp);
8034 }
8035 return (0);
8036 }
8037
8038 /*
8039 * Move the information to a copy.
8040 */
8041 mblk_t *
8042 ip_fix_dbref(mblk_t *mp, ip_recv_attr_t *ira)
8043 {
8044 mblk_t *mp1;
8045 ill_t *ill = ira->ira_ill;
8046 ip_stack_t *ipst = ill->ill_ipst;
8047
8048 IP_STAT(ipst, ip_db_ref);
8049
8050 /* Make sure we have ira_l2src before we loose the original mblk */
8051 if (!(ira->ira_flags & IRAF_L2SRC_SET))
8052 ip_setl2src(mp, ira, ira->ira_rill);
8053
8054 mp1 = copymsg(mp);
8055 if (mp1 == NULL) {
8056 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
8057 ip_drop_input("ipIfStatsInDiscards", mp, ill);
8058 freemsg(mp);
8059 return (NULL);
8060 }
8061 /* preserve the hardware checksum flags and data, if present */
8062 if (DB_CKSUMFLAGS(mp) != 0) {
8063 DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp);
8064 DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp);
8065 DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp);
8066 DB_CKSUMEND(mp1) = DB_CKSUMEND(mp);
8067 DB_CKSUM16(mp1) = DB_CKSUM16(mp);
8068 }
8069 freemsg(mp);
8070 return (mp1);
8071 }
8072
8073 static void
8074 ip_dlpi_error(ill_t *ill, t_uscalar_t prim, t_uscalar_t dl_err,
8075 t_uscalar_t err)
8076 {
8077 if (dl_err == DL_SYSERR) {
8078 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
8079 "%s: %s failed: DL_SYSERR (errno %u)\n",
8080 ill->ill_name, dl_primstr(prim), err);
8081 return;
8082 }
8083
8084 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
8085 "%s: %s failed: %s\n", ill->ill_name, dl_primstr(prim),
8086 dl_errstr(dl_err));
8087 }
8088
8089 /*
8090 * ip_rput_dlpi is called by ip_rput to handle all DLPI messages other
8091 * than DL_UNITDATA_IND messages. If we need to process this message
8092 * exclusively, we call qwriter_ip, in which case we also need to call
8093 * ill_refhold before that, since qwriter_ip does an ill_refrele.
8094 */
8095 void
8096 ip_rput_dlpi(ill_t *ill, mblk_t *mp)
8097 {
8098 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr;
8099 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa;
8100 queue_t *q = ill->ill_rq;
8101 t_uscalar_t prim = dloa->dl_primitive;
8102 t_uscalar_t reqprim = DL_PRIM_INVAL;
8103
8104 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi",
8105 char *, dl_primstr(prim), ill_t *, ill);
8106 ip1dbg(("ip_rput_dlpi"));
8107
8108 /*
8109 * If we received an ACK but didn't send a request for it, then it
8110 * can't be part of any pending operation; discard up-front.
8111 */
8112 switch (prim) {
8113 case DL_ERROR_ACK:
8114 reqprim = dlea->dl_error_primitive;
8115 ip2dbg(("ip_rput_dlpi(%s): DL_ERROR_ACK for %s (0x%x): %s "
8116 "(0x%x), unix %u\n", ill->ill_name, dl_primstr(reqprim),
8117 reqprim, dl_errstr(dlea->dl_errno), dlea->dl_errno,
8118 dlea->dl_unix_errno));
8119 break;
8120 case DL_OK_ACK:
8121 reqprim = dloa->dl_correct_primitive;
8122 break;
8123 case DL_INFO_ACK:
8124 reqprim = DL_INFO_REQ;
8125 break;
8126 case DL_BIND_ACK:
8127 reqprim = DL_BIND_REQ;
8128 break;
8129 case DL_PHYS_ADDR_ACK:
8130 reqprim = DL_PHYS_ADDR_REQ;
8131 break;
8132 case DL_NOTIFY_ACK:
8133 reqprim = DL_NOTIFY_REQ;
8134 break;
8135 case DL_CAPABILITY_ACK:
8136 reqprim = DL_CAPABILITY_REQ;
8137 break;
8138 }
8139
8140 if (prim != DL_NOTIFY_IND) {
8141 if (reqprim == DL_PRIM_INVAL ||
8142 !ill_dlpi_pending(ill, reqprim)) {
8143 /* Not a DLPI message we support or expected */
8144 freemsg(mp);
8145 return;
8146 }
8147 ip1dbg(("ip_rput: received %s for %s\n", dl_primstr(prim),
8148 dl_primstr(reqprim)));
8149 }
8150
8151 switch (reqprim) {
8152 case DL_UNBIND_REQ:
8153 /*
8154 * NOTE: we mark the unbind as complete even if we got a
8155 * DL_ERROR_ACK, since there's not much else we can do.
8156 */
8157 mutex_enter(&ill->ill_lock);
8158 ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
8159 cv_signal(&ill->ill_cv);
8160 mutex_exit(&ill->ill_lock);
8161 break;
8162
8163 case DL_ENABMULTI_REQ:
8164 if (prim == DL_OK_ACK) {
8165 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS)
8166 ill->ill_dlpi_multicast_state = IDS_OK;
8167 }
8168 break;
8169 }
8170
8171 /*
8172 * The message is one we're waiting for (or DL_NOTIFY_IND), but we
8173 * need to become writer to continue to process it. Because an
8174 * exclusive operation doesn't complete until replies to all queued
8175 * DLPI messages have been received, we know we're in the middle of an
8176 * exclusive operation and pass CUR_OP (except for DL_NOTIFY_IND).
8177 *
8178 * As required by qwriter_ip(), we refhold the ill; it will refrele.
8179 * Since this is on the ill stream we unconditionally bump up the
8180 * refcount without doing ILL_CAN_LOOKUP().
8181 */
8182 ill_refhold(ill);
8183 if (prim == DL_NOTIFY_IND)
8184 qwriter_ip(ill, q, mp, ip_rput_dlpi_writer, NEW_OP, B_FALSE);
8185 else
8186 qwriter_ip(ill, q, mp, ip_rput_dlpi_writer, CUR_OP, B_FALSE);
8187 }
8188
8189 /*
8190 * Handling of DLPI messages that require exclusive access to the ipsq.
8191 *
8192 * Need to do ipsq_pending_mp_get on ioctl completion, which could
8193 * happen here. (along with mi_copy_done)
8194 */
8195 /* ARGSUSED */
8196 static void
8197 ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8198 {
8199 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr;
8200 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa;
8201 int err = 0;
8202 ill_t *ill = (ill_t *)q->q_ptr;
8203 ipif_t *ipif = NULL;
8204 mblk_t *mp1 = NULL;
8205 conn_t *connp = NULL;
8206 t_uscalar_t paddrreq;
8207 mblk_t *mp_hw;
8208 boolean_t success;
8209 boolean_t ioctl_aborted = B_FALSE;
8210 boolean_t log = B_TRUE;
8211
8212 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer",
8213 char *, dl_primstr(dloa->dl_primitive), ill_t *, ill);
8214
8215 ip1dbg(("ip_rput_dlpi_writer .."));
8216 ASSERT(ipsq->ipsq_xop == ill->ill_phyint->phyint_ipsq->ipsq_xop);
8217 ASSERT(IAM_WRITER_ILL(ill));
8218
8219 ipif = ipsq->ipsq_xop->ipx_pending_ipif;
8220 /*
8221 * The current ioctl could have been aborted by the user and a new
8222 * ioctl to bring up another ill could have started. We could still
8223 * get a response from the driver later.
8224 */
8225 if (ipif != NULL && ipif->ipif_ill != ill)
8226 ioctl_aborted = B_TRUE;
8227
8228 switch (dloa->dl_primitive) {
8229 case DL_ERROR_ACK:
8230 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for %s\n",
8231 dl_primstr(dlea->dl_error_primitive)));
8232
8233 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer error",
8234 char *, dl_primstr(dlea->dl_error_primitive),
8235 ill_t *, ill);
8236
8237 switch (dlea->dl_error_primitive) {
8238 case DL_DISABMULTI_REQ:
8239 ill_dlpi_done(ill, dlea->dl_error_primitive);
8240 break;
8241 case DL_PROMISCON_REQ:
8242 case DL_PROMISCOFF_REQ:
8243 case DL_UNBIND_REQ:
8244 case DL_ATTACH_REQ:
8245 case DL_INFO_REQ:
8246 ill_dlpi_done(ill, dlea->dl_error_primitive);
8247 break;
8248 case DL_NOTIFY_REQ:
8249 ill_dlpi_done(ill, DL_NOTIFY_REQ);
8250 log = B_FALSE;
8251 break;
8252 case DL_PHYS_ADDR_REQ:
8253 /*
8254 * For IPv6 only, there are two additional
8255 * phys_addr_req's sent to the driver to get the
8256 * IPv6 token and lla. This allows IP to acquire
8257 * the hardware address format for a given interface
8258 * without having built in knowledge of the hardware
8259 * address. ill_phys_addr_pend keeps track of the last
8260 * DL_PAR sent so we know which response we are
8261 * dealing with. ill_dlpi_done will update
8262 * ill_phys_addr_pend when it sends the next req.
8263 * We don't complete the IOCTL until all three DL_PARs
8264 * have been attempted, so set *_len to 0 and break.
8265 */
8266 paddrreq = ill->ill_phys_addr_pend;
8267 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ);
8268 if (paddrreq == DL_IPV6_TOKEN) {
8269 ill->ill_token_length = 0;
8270 log = B_FALSE;
8271 break;
8272 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) {
8273 ill->ill_nd_lla_len = 0;
8274 log = B_FALSE;
8275 break;
8276 }
8277 /*
8278 * Something went wrong with the DL_PHYS_ADDR_REQ.
8279 * We presumably have an IOCTL hanging out waiting
8280 * for completion. Find it and complete the IOCTL
8281 * with the error noted.
8282 * However, ill_dl_phys was called on an ill queue
8283 * (from SIOCSLIFNAME), thus conn_pending_ill is not
8284 * set. But the ioctl is known to be pending on ill_wq.
8285 */
8286 if (!ill->ill_ifname_pending)
8287 break;
8288 ill->ill_ifname_pending = 0;
8289 if (!ioctl_aborted)
8290 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8291 if (mp1 != NULL) {
8292 /*
8293 * This operation (SIOCSLIFNAME) must have
8294 * happened on the ill. Assert there is no conn
8295 */
8296 ASSERT(connp == NULL);
8297 q = ill->ill_wq;
8298 }
8299 break;
8300 case DL_BIND_REQ:
8301 ill_dlpi_done(ill, DL_BIND_REQ);
8302 if (ill->ill_ifname_pending)
8303 break;
8304 mutex_enter(&ill->ill_lock);
8305 ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
8306 mutex_exit(&ill->ill_lock);
8307 /*
8308 * Something went wrong with the bind. We presumably
8309 * have an IOCTL hanging out waiting for completion.
8310 * Find it, take down the interface that was coming
8311 * up, and complete the IOCTL with the error noted.
8312 */
8313 if (!ioctl_aborted)
8314 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8315 if (mp1 != NULL) {
8316 /*
8317 * This might be a result of a DL_NOTE_REPLUMB
8318 * notification. In that case, connp is NULL.
8319 */
8320 if (connp != NULL)
8321 q = CONNP_TO_WQ(connp);
8322
8323 (void) ipif_down(ipif, NULL, NULL);
8324 /* error is set below the switch */
8325 }
8326 break;
8327 case DL_ENABMULTI_REQ:
8328 ill_dlpi_done(ill, DL_ENABMULTI_REQ);
8329
8330 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS)
8331 ill->ill_dlpi_multicast_state = IDS_FAILED;
8332 if (ill->ill_dlpi_multicast_state == IDS_FAILED) {
8333
8334 printf("ip: joining multicasts failed (%d)"
8335 " on %s - will use link layer "
8336 "broadcasts for multicast\n",
8337 dlea->dl_errno, ill->ill_name);
8338
8339 /*
8340 * Set up for multi_bcast; We are the
8341 * writer, so ok to access ill->ill_ipif
8342 * without any lock.
8343 */
8344 mutex_enter(&ill->ill_phyint->phyint_lock);
8345 ill->ill_phyint->phyint_flags |=
8346 PHYI_MULTI_BCAST;
8347 mutex_exit(&ill->ill_phyint->phyint_lock);
8348
8349 }
8350 freemsg(mp); /* Don't want to pass this up */
8351 return;
8352 case DL_CAPABILITY_REQ:
8353 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for "
8354 "DL_CAPABILITY REQ\n"));
8355 if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
8356 ill->ill_dlpi_capab_state = IDCS_FAILED;
8357 ill_capability_done(ill);
8358 freemsg(mp);
8359 return;
8360 }
8361 /*
8362 * Note the error for IOCTL completion (mp1 is set when
8363 * ready to complete ioctl). If ill_ifname_pending_err is
8364 * set, an error occured during plumbing (ill_ifname_pending),
8365 * so we want to report that error.
8366 *
8367 * NOTE: there are two addtional DL_PHYS_ADDR_REQ's
8368 * (DL_IPV6_TOKEN and DL_IPV6_LINK_LAYER_ADDR) that are
8369 * expected to get errack'd if the driver doesn't support
8370 * these flags (e.g. ethernet). log will be set to B_FALSE
8371 * if these error conditions are encountered.
8372 */
8373 if (mp1 != NULL) {
8374 if (ill->ill_ifname_pending_err != 0) {
8375 err = ill->ill_ifname_pending_err;
8376 ill->ill_ifname_pending_err = 0;
8377 } else {
8378 err = dlea->dl_unix_errno ?
8379 dlea->dl_unix_errno : ENXIO;
8380 }
8381 /*
8382 * If we're plumbing an interface and an error hasn't already
8383 * been saved, set ill_ifname_pending_err to the error passed
8384 * up. Ignore the error if log is B_FALSE (see comment above).
8385 */
8386 } else if (log && ill->ill_ifname_pending &&
8387 ill->ill_ifname_pending_err == 0) {
8388 ill->ill_ifname_pending_err = dlea->dl_unix_errno ?
8389 dlea->dl_unix_errno : ENXIO;
8390 }
8391
8392 if (log)
8393 ip_dlpi_error(ill, dlea->dl_error_primitive,
8394 dlea->dl_errno, dlea->dl_unix_errno);
8395 break;
8396 case DL_CAPABILITY_ACK:
8397 ill_capability_ack(ill, mp);
8398 /*
8399 * The message has been handed off to ill_capability_ack
8400 * and must not be freed below
8401 */
8402 mp = NULL;
8403 break;
8404
8405 case DL_INFO_ACK:
8406 /* Call a routine to handle this one. */
8407 ill_dlpi_done(ill, DL_INFO_REQ);
8408 ip_ll_subnet_defaults(ill, mp);
8409 ASSERT(!MUTEX_HELD(&ill->ill_phyint->phyint_ipsq->ipsq_lock));
8410 return;
8411 case DL_BIND_ACK:
8412 /*
8413 * We should have an IOCTL waiting on this unless
8414 * sent by ill_dl_phys, in which case just return
8415 */
8416 ill_dlpi_done(ill, DL_BIND_REQ);
8417
8418 if (ill->ill_ifname_pending) {
8419 DTRACE_PROBE2(ip__rput__dlpi__ifname__pending,
8420 ill_t *, ill, mblk_t *, mp);
8421 break;
8422 }
8423 mutex_enter(&ill->ill_lock);
8424 ill->ill_dl_up = 1;
8425 ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
8426 mutex_exit(&ill->ill_lock);
8427
8428 if (!ioctl_aborted)
8429 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8430 if (mp1 == NULL) {
8431 DTRACE_PROBE1(ip__rput__dlpi__no__mblk, ill_t *, ill);
8432 break;
8433 }
8434 /*
8435 * mp1 was added by ill_dl_up(). if that is a result of
8436 * a DL_NOTE_REPLUMB notification, connp could be NULL.
8437 */
8438 if (connp != NULL)
8439 q = CONNP_TO_WQ(connp);
8440 /*
8441 * We are exclusive. So nothing can change even after
8442 * we get the pending mp.
8443 */
8444 ip1dbg(("ip_rput_dlpi: bind_ack %s\n", ill->ill_name));
8445 DTRACE_PROBE1(ip__rput__dlpi__bind__ack, ill_t *, ill);
8446 ill_nic_event_dispatch(ill, 0, NE_UP, NULL, 0);
8447
8448 /*
8449 * Now bring up the resolver; when that is complete, we'll
8450 * create IREs. Note that we intentionally mirror what
8451 * ipif_up() would have done, because we got here by way of
8452 * ill_dl_up(), which stopped ipif_up()'s processing.
8453 */
8454 if (ill->ill_isv6) {
8455 /*
8456 * v6 interfaces.
8457 * Unlike ARP which has to do another bind
8458 * and attach, once we get here we are
8459 * done with NDP
8460 */
8461 (void) ipif_resolver_up(ipif, Res_act_initial);
8462 if ((err = ipif_ndp_up(ipif, B_TRUE)) == 0)
8463 err = ipif_up_done_v6(ipif);
8464 } else if (ill->ill_net_type == IRE_IF_RESOLVER) {
8465 /*
8466 * ARP and other v4 external resolvers.
8467 * Leave the pending mblk intact so that
8468 * the ioctl completes in ip_rput().
8469 */
8470 if (connp != NULL)
8471 mutex_enter(&connp->conn_lock);
8472 mutex_enter(&ill->ill_lock);
8473 success = ipsq_pending_mp_add(connp, ipif, q, mp1, 0);
8474 mutex_exit(&ill->ill_lock);
8475 if (connp != NULL)
8476 mutex_exit(&connp->conn_lock);
8477 if (success) {
8478 err = ipif_resolver_up(ipif, Res_act_initial);
8479 if (err == EINPROGRESS) {
8480 freemsg(mp);
8481 return;
8482 }
8483 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8484 } else {
8485 /* The conn has started closing */
8486 err = EINTR;
8487 }
8488 } else {
8489 /*
8490 * This one is complete. Reply to pending ioctl.
8491 */
8492 (void) ipif_resolver_up(ipif, Res_act_initial);
8493 err = ipif_up_done(ipif);
8494 }
8495
8496 if ((err == 0) && (ill->ill_up_ipifs)) {
8497 err = ill_up_ipifs(ill, q, mp1);
8498 if (err == EINPROGRESS) {
8499 freemsg(mp);
8500 return;
8501 }
8502 }
8503
8504 /*
8505 * If we have a moved ipif to bring up, and everything has
8506 * succeeded to this point, bring it up on the IPMP ill.
8507 * Otherwise, leave it down -- the admin can try to bring it
8508 * up by hand if need be.
8509 */
8510 if (ill->ill_move_ipif != NULL) {
8511 if (err != 0) {
8512 ill->ill_move_ipif = NULL;
8513 } else {
8514 ipif = ill->ill_move_ipif;
8515 ill->ill_move_ipif = NULL;
8516 err = ipif_up(ipif, q, mp1);
8517 if (err == EINPROGRESS) {
8518 freemsg(mp);
8519 return;
8520 }
8521 }
8522 }
8523 break;
8524
8525 case DL_NOTIFY_IND: {
8526 dl_notify_ind_t *notify = (dl_notify_ind_t *)mp->b_rptr;
8527 uint_t orig_mtu, orig_mc_mtu;
8528
8529 switch (notify->dl_notification) {
8530 case DL_NOTE_PHYS_ADDR:
8531 err = ill_set_phys_addr(ill, mp);
8532 break;
8533
8534 case DL_NOTE_REPLUMB:
8535 /*
8536 * Directly return after calling ill_replumb().
8537 * Note that we should not free mp as it is reused
8538 * in the ill_replumb() function.
8539 */
8540 err = ill_replumb(ill, mp);
8541 return;
8542
8543 case DL_NOTE_FASTPATH_FLUSH:
8544 nce_flush(ill, B_FALSE);
8545 break;
8546
8547 case DL_NOTE_SDU_SIZE:
8548 case DL_NOTE_SDU_SIZE2:
8549 /*
8550 * The dce and fragmentation code can cope with
8551 * this changing while packets are being sent.
8552 * When packets are sent ip_output will discover
8553 * a change.
8554 *
8555 * Change the MTU size of the interface.
8556 */
8557 mutex_enter(&ill->ill_lock);
8558 orig_mtu = ill->ill_mtu;
8559 orig_mc_mtu = ill->ill_mc_mtu;
8560 switch (notify->dl_notification) {
8561 case DL_NOTE_SDU_SIZE:
8562 ill->ill_current_frag =
8563 (uint_t)notify->dl_data;
8564 ill->ill_mc_mtu = (uint_t)notify->dl_data;
8565 break;
8566 case DL_NOTE_SDU_SIZE2:
8567 ill->ill_current_frag =
8568 (uint_t)notify->dl_data1;
8569 ill->ill_mc_mtu = (uint_t)notify->dl_data2;
8570 break;
8571 }
8572 if (ill->ill_current_frag > ill->ill_max_frag)
8573 ill->ill_max_frag = ill->ill_current_frag;
8574
8575 if (!(ill->ill_flags & ILLF_FIXEDMTU)) {
8576 ill->ill_mtu = ill->ill_current_frag;
8577
8578 /*
8579 * If ill_user_mtu was set (via
8580 * SIOCSLIFLNKINFO), clamp ill_mtu at it.
8581 */
8582 if (ill->ill_user_mtu != 0 &&
8583 ill->ill_user_mtu < ill->ill_mtu)
8584 ill->ill_mtu = ill->ill_user_mtu;
8585
8586 if (ill->ill_user_mtu != 0 &&
8587 ill->ill_user_mtu < ill->ill_mc_mtu)
8588 ill->ill_mc_mtu = ill->ill_user_mtu;
8589
8590 if (ill->ill_isv6) {
8591 if (ill->ill_mtu < IPV6_MIN_MTU)
8592 ill->ill_mtu = IPV6_MIN_MTU;
8593 if (ill->ill_mc_mtu < IPV6_MIN_MTU)
8594 ill->ill_mc_mtu = IPV6_MIN_MTU;
8595 } else {
8596 if (ill->ill_mtu < IP_MIN_MTU)
8597 ill->ill_mtu = IP_MIN_MTU;
8598 if (ill->ill_mc_mtu < IP_MIN_MTU)
8599 ill->ill_mc_mtu = IP_MIN_MTU;
8600 }
8601 } else if (ill->ill_mc_mtu > ill->ill_mtu) {
8602 ill->ill_mc_mtu = ill->ill_mtu;
8603 }
8604
8605 mutex_exit(&ill->ill_lock);
8606 /*
8607 * Make sure all dce_generation checks find out
8608 * that ill_mtu/ill_mc_mtu has changed.
8609 */
8610 if (orig_mtu != ill->ill_mtu ||
8611 orig_mc_mtu != ill->ill_mc_mtu) {
8612 dce_increment_all_generations(ill->ill_isv6,
8613 ill->ill_ipst);
8614 }
8615
8616 /*
8617 * Refresh IPMP meta-interface MTU if necessary.
8618 */
8619 if (IS_UNDER_IPMP(ill))
8620 ipmp_illgrp_refresh_mtu(ill->ill_grp);
8621 break;
8622
8623 case DL_NOTE_LINK_UP:
8624 case DL_NOTE_LINK_DOWN: {
8625 /*
8626 * We are writer. ill / phyint / ipsq assocs stable.
8627 * The RUNNING flag reflects the state of the link.
8628 */
8629 phyint_t *phyint = ill->ill_phyint;
8630 uint64_t new_phyint_flags;
8631 boolean_t changed = B_FALSE;
8632 boolean_t went_up;
8633
8634 went_up = notify->dl_notification == DL_NOTE_LINK_UP;
8635 mutex_enter(&phyint->phyint_lock);
8636
8637 new_phyint_flags = went_up ?
8638 phyint->phyint_flags | PHYI_RUNNING :
8639 phyint->phyint_flags & ~PHYI_RUNNING;
8640
8641 if (IS_IPMP(ill)) {
8642 new_phyint_flags = went_up ?
8643 new_phyint_flags & ~PHYI_FAILED :
8644 new_phyint_flags | PHYI_FAILED;
8645 }
8646
8647 if (new_phyint_flags != phyint->phyint_flags) {
8648 phyint->phyint_flags = new_phyint_flags;
8649 changed = B_TRUE;
8650 }
8651 mutex_exit(&phyint->phyint_lock);
8652 /*
8653 * ill_restart_dad handles the DAD restart and routing
8654 * socket notification logic.
8655 */
8656 if (changed) {
8657 ill_restart_dad(phyint->phyint_illv4, went_up);
8658 ill_restart_dad(phyint->phyint_illv6, went_up);
8659 }
8660 break;
8661 }
8662 case DL_NOTE_PROMISC_ON_PHYS: {
8663 phyint_t *phyint = ill->ill_phyint;
8664
8665 mutex_enter(&phyint->phyint_lock);
8666 phyint->phyint_flags |= PHYI_PROMISC;
8667 mutex_exit(&phyint->phyint_lock);
8668 break;
8669 }
8670 case DL_NOTE_PROMISC_OFF_PHYS: {
8671 phyint_t *phyint = ill->ill_phyint;
8672
8673 mutex_enter(&phyint->phyint_lock);
8674 phyint->phyint_flags &= ~PHYI_PROMISC;
8675 mutex_exit(&phyint->phyint_lock);
8676 break;
8677 }
8678 case DL_NOTE_CAPAB_RENEG:
8679 /*
8680 * Something changed on the driver side.
8681 * It wants us to renegotiate the capabilities
8682 * on this ill. One possible cause is the aggregation
8683 * interface under us where a port got added or
8684 * went away.
8685 *
8686 * If the capability negotiation is already done
8687 * or is in progress, reset the capabilities and
8688 * mark the ill's ill_capab_reneg to be B_TRUE,
8689 * so that when the ack comes back, we can start
8690 * the renegotiation process.
8691 *
8692 * Note that if ill_capab_reneg is already B_TRUE
8693 * (ill_dlpi_capab_state is IDS_UNKNOWN in this case),
8694 * the capability resetting request has been sent
8695 * and the renegotiation has not been started yet;
8696 * nothing needs to be done in this case.
8697 */
8698 ipsq_current_start(ipsq, ill->ill_ipif, 0);
8699 ill_capability_reset(ill, B_TRUE);
8700 ipsq_current_finish(ipsq);
8701 break;
8702
8703 case DL_NOTE_ALLOWED_IPS:
8704 ill_set_allowed_ips(ill, mp);
8705 break;
8706 default:
8707 ip0dbg(("ip_rput_dlpi_writer: unknown notification "
8708 "type 0x%x for DL_NOTIFY_IND\n",
8709 notify->dl_notification));
8710 break;
8711 }
8712
8713 /*
8714 * As this is an asynchronous operation, we
8715 * should not call ill_dlpi_done
8716 */
8717 break;
8718 }
8719 case DL_NOTIFY_ACK: {
8720 dl_notify_ack_t *noteack = (dl_notify_ack_t *)mp->b_rptr;
8721
8722 if (noteack->dl_notifications & DL_NOTE_LINK_UP)
8723 ill->ill_note_link = 1;
8724 ill_dlpi_done(ill, DL_NOTIFY_REQ);
8725 break;
8726 }
8727 case DL_PHYS_ADDR_ACK: {
8728 /*
8729 * As part of plumbing the interface via SIOCSLIFNAME,
8730 * ill_dl_phys() will queue a series of DL_PHYS_ADDR_REQs,
8731 * whose answers we receive here. As each answer is received,
8732 * we call ill_dlpi_done() to dispatch the next request as
8733 * we're processing the current one. Once all answers have
8734 * been received, we use ipsq_pending_mp_get() to dequeue the
8735 * outstanding IOCTL and reply to it. (Because ill_dl_phys()
8736 * is invoked from an ill queue, conn_oper_pending_ill is not
8737 * available, but we know the ioctl is pending on ill_wq.)
8738 */
8739 uint_t paddrlen, paddroff;
8740 uint8_t *addr;
8741
8742 paddrreq = ill->ill_phys_addr_pend;
8743 paddrlen = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_length;
8744 paddroff = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_offset;
8745 addr = mp->b_rptr + paddroff;
8746
8747 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ);
8748 if (paddrreq == DL_IPV6_TOKEN) {
8749 /*
8750 * bcopy to low-order bits of ill_token
8751 *
8752 * XXX Temporary hack - currently, all known tokens
8753 * are 64 bits, so I'll cheat for the moment.
8754 */
8755 bcopy(addr, &ill->ill_token.s6_addr32[2], paddrlen);
8756 ill->ill_token_length = paddrlen;
8757 break;
8758 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) {
8759 ASSERT(ill->ill_nd_lla_mp == NULL);
8760 ill_set_ndmp(ill, mp, paddroff, paddrlen);
8761 mp = NULL;
8762 break;
8763 } else if (paddrreq == DL_CURR_DEST_ADDR) {
8764 ASSERT(ill->ill_dest_addr_mp == NULL);
8765 ill->ill_dest_addr_mp = mp;
8766 ill->ill_dest_addr = addr;
8767 mp = NULL;
8768 if (ill->ill_isv6) {
8769 ill_setdesttoken(ill);
8770 ipif_setdestlinklocal(ill->ill_ipif);
8771 }
8772 break;
8773 }
8774
8775 ASSERT(paddrreq == DL_CURR_PHYS_ADDR);
8776 ASSERT(ill->ill_phys_addr_mp == NULL);
8777 if (!ill->ill_ifname_pending)
8778 break;
8779 ill->ill_ifname_pending = 0;
8780 if (!ioctl_aborted)
8781 mp1 = ipsq_pending_mp_get(ipsq, &connp);
8782 if (mp1 != NULL) {
8783 ASSERT(connp == NULL);
8784 q = ill->ill_wq;
8785 }
8786 /*
8787 * If any error acks received during the plumbing sequence,
8788 * ill_ifname_pending_err will be set. Break out and send up
8789 * the error to the pending ioctl.
8790 */
8791 if (ill->ill_ifname_pending_err != 0) {
8792 err = ill->ill_ifname_pending_err;
8793 ill->ill_ifname_pending_err = 0;
8794 break;
8795 }
8796
8797 ill->ill_phys_addr_mp = mp;
8798 ill->ill_phys_addr = (paddrlen == 0 ? NULL : addr);
8799 mp = NULL;
8800
8801 /*
8802 * If paddrlen or ill_phys_addr_length is zero, the DLPI
8803 * provider doesn't support physical addresses. We check both
8804 * paddrlen and ill_phys_addr_length because sppp (PPP) does
8805 * not have physical addresses, but historically adversises a
8806 * physical address length of 0 in its DL_INFO_ACK, but 6 in
8807 * its DL_PHYS_ADDR_ACK.
8808 */
8809 if (paddrlen == 0 || ill->ill_phys_addr_length == 0) {
8810 ill->ill_phys_addr = NULL;
8811 } else if (paddrlen != ill->ill_phys_addr_length) {
8812 ip0dbg(("DL_PHYS_ADDR_ACK: got addrlen %d, expected %d",
8813 paddrlen, ill->ill_phys_addr_length));
8814 err = EINVAL;
8815 break;
8816 }
8817
8818 if (ill->ill_nd_lla_mp == NULL) {
8819 if ((mp_hw = copyb(ill->ill_phys_addr_mp)) == NULL) {
8820 err = ENOMEM;
8821 break;
8822 }
8823 ill_set_ndmp(ill, mp_hw, paddroff, paddrlen);
8824 }
8825
8826 if (ill->ill_isv6) {
8827 ill_setdefaulttoken(ill);
8828 ipif_setlinklocal(ill->ill_ipif);
8829 }
8830 break;
8831 }
8832 case DL_OK_ACK:
8833 ip2dbg(("DL_OK_ACK %s (0x%x)\n",
8834 dl_primstr((int)dloa->dl_correct_primitive),
8835 dloa->dl_correct_primitive));
8836 DTRACE_PROBE3(ill__dlpi, char *, "ip_rput_dlpi_writer ok",
8837 char *, dl_primstr(dloa->dl_correct_primitive),
8838 ill_t *, ill);
8839
8840 switch (dloa->dl_correct_primitive) {
8841 case DL_ENABMULTI_REQ:
8842 case DL_DISABMULTI_REQ:
8843 ill_dlpi_done(ill, dloa->dl_correct_primitive);
8844 break;
8845 case DL_PROMISCON_REQ:
8846 case DL_PROMISCOFF_REQ:
8847 case DL_UNBIND_REQ:
8848 case DL_ATTACH_REQ:
8849 ill_dlpi_done(ill, dloa->dl_correct_primitive);
8850 break;
8851 }
8852 break;
8853 default:
8854 break;
8855 }
8856
8857 freemsg(mp);
8858 if (mp1 == NULL)
8859 return;
8860
8861 /*
8862 * The operation must complete without EINPROGRESS since
8863 * ipsq_pending_mp_get() has removed the mblk (mp1). Otherwise,
8864 * the operation will be stuck forever inside the IPSQ.
8865 */
8866 ASSERT(err != EINPROGRESS);
8867
8868 DTRACE_PROBE4(ipif__ioctl, char *, "ip_rput_dlpi_writer finish",
8869 int, ipsq->ipsq_xop->ipx_current_ioctl, ill_t *, ill,
8870 ipif_t *, NULL);
8871
8872 switch (ipsq->ipsq_xop->ipx_current_ioctl) {
8873 case 0:
8874 ipsq_current_finish(ipsq);
8875 break;
8876
8877 case SIOCSLIFNAME:
8878 case IF_UNITSEL: {
8879 ill_t *ill_other = ILL_OTHER(ill);
8880
8881 /*
8882 * If SIOCSLIFNAME or IF_UNITSEL is about to succeed, and the
8883 * ill has a peer which is in an IPMP group, then place ill
8884 * into the same group. One catch: although ifconfig plumbs
8885 * the appropriate IPMP meta-interface prior to plumbing this
8886 * ill, it is possible for multiple ifconfig applications to
8887 * race (or for another application to adjust plumbing), in
8888 * which case the IPMP meta-interface we need will be missing.
8889 * If so, kick the phyint out of the group.
8890 */
8891 if (err == 0 && ill_other != NULL && IS_UNDER_IPMP(ill_other)) {
8892 ipmp_grp_t *grp = ill->ill_phyint->phyint_grp;
8893 ipmp_illgrp_t *illg;
8894
8895 illg = ill->ill_isv6 ? grp->gr_v6 : grp->gr_v4;
8896 if (illg == NULL)
8897 ipmp_phyint_leave_grp(ill->ill_phyint);
8898 else
8899 ipmp_ill_join_illgrp(ill, illg);
8900 }
8901
8902 if (ipsq->ipsq_xop->ipx_current_ioctl == IF_UNITSEL)
8903 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
8904 else
8905 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq);
8906 break;
8907 }
8908 case SIOCLIFADDIF:
8909 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq);
8910 break;
8911
8912 default:
8913 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
8914 break;
8915 }
8916 }
8917
8918 /*
8919 * ip_rput_other is called by ip_rput to handle messages modifying the global
8920 * state in IP. If 'ipsq' is non-NULL, caller is writer on it.
8921 */
8922 /* ARGSUSED */
8923 void
8924 ip_rput_other(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8925 {
8926 ill_t *ill = q->q_ptr;
8927 struct iocblk *iocp;
8928
8929 ip1dbg(("ip_rput_other "));
8930 if (ipsq != NULL) {
8931 ASSERT(IAM_WRITER_IPSQ(ipsq));
8932 ASSERT(ipsq->ipsq_xop ==
8933 ill->ill_phyint->phyint_ipsq->ipsq_xop);
8934 }
8935
8936 switch (mp->b_datap->db_type) {
8937 case M_ERROR:
8938 case M_HANGUP:
8939 /*
8940 * The device has a problem. We force the ILL down. It can
8941 * be brought up again manually using SIOCSIFFLAGS (via
8942 * ifconfig or equivalent).
8943 */
8944 ASSERT(ipsq != NULL);
8945 if (mp->b_rptr < mp->b_wptr)
8946 ill->ill_error = (int)(*mp->b_rptr & 0xFF);
8947 if (ill->ill_error == 0)
8948 ill->ill_error = ENXIO;
8949 if (!ill_down_start(q, mp))
8950 return;
8951 ipif_all_down_tail(ipsq, q, mp, NULL);
8952 break;
8953 case M_IOCNAK: {
8954 iocp = (struct iocblk *)mp->b_rptr;
8955
8956 ASSERT(iocp->ioc_cmd == DL_IOC_HDR_INFO);
8957 /*
8958 * If this was the first attempt, turn off the fastpath
8959 * probing.
8960 */
8961 mutex_enter(&ill->ill_lock);
8962 if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS) {
8963 ill->ill_dlpi_fastpath_state = IDS_FAILED;
8964 mutex_exit(&ill->ill_lock);
8965 /*
8966 * don't flush the nce_t entries: we use them
8967 * as an index to the ncec itself.
8968 */
8969 ip1dbg(("ip_rput: DLPI fastpath off on interface %s\n",
8970 ill->ill_name));
8971 } else {
8972 mutex_exit(&ill->ill_lock);
8973 }
8974 freemsg(mp);
8975 break;
8976 }
8977 default:
8978 ASSERT(0);
8979 break;
8980 }
8981 }
8982
8983 /*
8984 * Update any source route, record route or timestamp options
8985 * When it fails it has consumed the message and BUMPed the MIB.
8986 */
8987 boolean_t
8988 ip_forward_options(mblk_t *mp, ipha_t *ipha, ill_t *dst_ill,
8989 ip_recv_attr_t *ira)
8990 {
8991 ipoptp_t opts;
8992 uchar_t *opt;
8993 uint8_t optval;
8994 uint8_t optlen;
8995 ipaddr_t dst;
8996 ipaddr_t ifaddr;
8997 uint32_t ts;
8998 timestruc_t now;
8999 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
9000
9001 ip2dbg(("ip_forward_options\n"));
9002 dst = ipha->ipha_dst;
9003 opt = NULL;
9004
9005 for (optval = ipoptp_first(&opts, ipha);
9006 optval != IPOPT_EOL;
9007 optval = ipoptp_next(&opts)) {
9008 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
9009 opt = opts.ipoptp_cur;
9010 optlen = opts.ipoptp_len;
9011 ip2dbg(("ip_forward_options: opt %d, len %d\n",
9012 optval, opts.ipoptp_len));
9013 switch (optval) {
9014 uint32_t off;
9015 case IPOPT_SSRR:
9016 case IPOPT_LSRR:
9017 /* Check if adminstratively disabled */
9018 if (!ipst->ips_ip_forward_src_routed) {
9019 BUMP_MIB(dst_ill->ill_ip_mib,
9020 ipIfStatsForwProhibits);
9021 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
9022 mp, dst_ill);
9023 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED,
9024 ira);
9025 return (B_FALSE);
9026 }
9027 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9028 /*
9029 * Must be partial since ip_input_options
9030 * checked for strict.
9031 */
9032 break;
9033 }
9034 off = opt[IPOPT_OFFSET];
9035 off--;
9036 redo_srr:
9037 if (optlen < IP_ADDR_LEN ||
9038 off > optlen - IP_ADDR_LEN) {
9039 /* End of source route */
9040 ip1dbg((
9041 "ip_forward_options: end of SR\n"));
9042 break;
9043 }
9044 /* Pick a reasonable address on the outbound if */
9045 ASSERT(dst_ill != NULL);
9046 if (ip_select_source_v4(dst_ill, INADDR_ANY, dst,
9047 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL,
9048 NULL) != 0) {
9049 /* No source! Shouldn't happen */
9050 ifaddr = INADDR_ANY;
9051 }
9052 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9053 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9054 ip1dbg(("ip_forward_options: next hop 0x%x\n",
9055 ntohl(dst)));
9056
9057 /*
9058 * Check if our address is present more than
9059 * once as consecutive hops in source route.
9060 */
9061 if (ip_type_v4(dst, ipst) == IRE_LOCAL) {
9062 off += IP_ADDR_LEN;
9063 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9064 goto redo_srr;
9065 }
9066 ipha->ipha_dst = dst;
9067 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9068 break;
9069 case IPOPT_RR:
9070 off = opt[IPOPT_OFFSET];
9071 off--;
9072 if (optlen < IP_ADDR_LEN ||
9073 off > optlen - IP_ADDR_LEN) {
9074 /* No more room - ignore */
9075 ip1dbg((
9076 "ip_forward_options: end of RR\n"));
9077 break;
9078 }
9079 /* Pick a reasonable address on the outbound if */
9080 ASSERT(dst_ill != NULL);
9081 if (ip_select_source_v4(dst_ill, INADDR_ANY, dst,
9082 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL,
9083 NULL) != 0) {
9084 /* No source! Shouldn't happen */
9085 ifaddr = INADDR_ANY;
9086 }
9087 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9088 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9089 break;
9090 case IPOPT_TS:
9091 off = 0;
9092 /* Insert timestamp if there is room */
9093 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9094 case IPOPT_TS_TSONLY:
9095 off = IPOPT_TS_TIMELEN;
9096 break;
9097 case IPOPT_TS_PRESPEC:
9098 case IPOPT_TS_PRESPEC_RFC791:
9099 /* Verify that the address matched */
9100 off = opt[IPOPT_OFFSET] - 1;
9101 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9102 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9103 /* Not for us */
9104 break;
9105 }
9106 /* FALLTHROUGH */
9107 case IPOPT_TS_TSANDADDR:
9108 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
9109 break;
9110 default:
9111 /*
9112 * ip_*put_options should have already
9113 * dropped this packet.
9114 */
9115 cmn_err(CE_PANIC, "ip_forward_options: "
9116 "unknown IT - bug in ip_input_options?\n");
9117 }
9118 if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
9119 /* Increase overflow counter */
9120 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
9121 opt[IPOPT_POS_OV_FLG] =
9122 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) |
9123 (off << 4));
9124 break;
9125 }
9126 off = opt[IPOPT_OFFSET] - 1;
9127 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9128 case IPOPT_TS_PRESPEC:
9129 case IPOPT_TS_PRESPEC_RFC791:
9130 case IPOPT_TS_TSANDADDR:
9131 /* Pick a reasonable addr on the outbound if */
9132 ASSERT(dst_ill != NULL);
9133 if (ip_select_source_v4(dst_ill, INADDR_ANY,
9134 dst, INADDR_ANY, ALL_ZONES, ipst, &ifaddr,
9135 NULL, NULL) != 0) {
9136 /* No source! Shouldn't happen */
9137 ifaddr = INADDR_ANY;
9138 }
9139 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9140 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9141 /* FALLTHROUGH */
9142 case IPOPT_TS_TSONLY:
9143 off = opt[IPOPT_OFFSET] - 1;
9144 /* Compute # of milliseconds since midnight */
9145 gethrestime(&now);
9146 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
9147 NSEC2MSEC(now.tv_nsec);
9148 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
9149 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
9150 break;
9151 }
9152 break;
9153 }
9154 }
9155 return (B_TRUE);
9156 }
9157
9158 /*
9159 * Call ill_frag_timeout to do garbage collection. ill_frag_timeout
9160 * returns 'true' if there are still fragments left on the queue, in
9161 * which case we restart the timer.
9162 */
9163 void
9164 ill_frag_timer(void *arg)
9165 {
9166 ill_t *ill = (ill_t *)arg;
9167 boolean_t frag_pending;
9168 ip_stack_t *ipst = ill->ill_ipst;
9169 time_t timeout;
9170
9171 mutex_enter(&ill->ill_lock);
9172 ASSERT(!ill->ill_fragtimer_executing);
9173 if (ill->ill_state_flags & ILL_CONDEMNED) {
9174 ill->ill_frag_timer_id = 0;
9175 mutex_exit(&ill->ill_lock);
9176 return;
9177 }
9178 ill->ill_fragtimer_executing = 1;
9179 mutex_exit(&ill->ill_lock);
9180
9181 timeout = (ill->ill_isv6 ? ipst->ips_ipv6_reassembly_timeout :
9182 ipst->ips_ip_reassembly_timeout);
9183
9184 frag_pending = ill_frag_timeout(ill, timeout);
9185
9186 /*
9187 * Restart the timer, if we have fragments pending or if someone
9188 * wanted us to be scheduled again.
9189 */
9190 mutex_enter(&ill->ill_lock);
9191 ill->ill_fragtimer_executing = 0;
9192 ill->ill_frag_timer_id = 0;
9193 if (frag_pending || ill->ill_fragtimer_needrestart)
9194 ill_frag_timer_start(ill);
9195 mutex_exit(&ill->ill_lock);
9196 }
9197
9198 void
9199 ill_frag_timer_start(ill_t *ill)
9200 {
9201 ip_stack_t *ipst = ill->ill_ipst;
9202 clock_t timeo_ms;
9203
9204 ASSERT(MUTEX_HELD(&ill->ill_lock));
9205
9206 /* If the ill is closing or opening don't proceed */
9207 if (ill->ill_state_flags & ILL_CONDEMNED)
9208 return;
9209
9210 if (ill->ill_fragtimer_executing) {
9211 /*
9212 * ill_frag_timer is currently executing. Just record the
9213 * the fact that we want the timer to be restarted.
9214 * ill_frag_timer will post a timeout before it returns,
9215 * ensuring it will be called again.
9216 */
9217 ill->ill_fragtimer_needrestart = 1;
9218 return;
9219 }
9220
9221 if (ill->ill_frag_timer_id == 0) {
9222 timeo_ms = (ill->ill_isv6 ? ipst->ips_ipv6_reassembly_timeout :
9223 ipst->ips_ip_reassembly_timeout) * SECONDS;
9224
9225 /*
9226 * The timer is neither running nor is the timeout handler
9227 * executing. Post a timeout so that ill_frag_timer will be
9228 * called
9229 */
9230 ill->ill_frag_timer_id = timeout(ill_frag_timer, ill,
9231 MSEC_TO_TICK(timeo_ms >> 1));
9232 ill->ill_fragtimer_needrestart = 0;
9233 }
9234 }
9235
9236 /*
9237 * Update any source route, record route or timestamp options.
9238 * Check that we are at end of strict source route.
9239 * The options have already been checked for sanity in ip_input_options().
9240 */
9241 boolean_t
9242 ip_input_local_options(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
9243 {
9244 ipoptp_t opts;
9245 uchar_t *opt;
9246 uint8_t optval;
9247 uint8_t optlen;
9248 ipaddr_t dst;
9249 ipaddr_t ifaddr;
9250 uint32_t ts;
9251 timestruc_t now;
9252 ill_t *ill = ira->ira_ill;
9253 ip_stack_t *ipst = ill->ill_ipst;
9254
9255 ip2dbg(("ip_input_local_options\n"));
9256 opt = NULL;
9257
9258 for (optval = ipoptp_first(&opts, ipha);
9259 optval != IPOPT_EOL;
9260 optval = ipoptp_next(&opts)) {
9261 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
9262 opt = opts.ipoptp_cur;
9263 optlen = opts.ipoptp_len;
9264 ip2dbg(("ip_input_local_options: opt %d, len %d\n",
9265 optval, optlen));
9266 switch (optval) {
9267 uint32_t off;
9268 case IPOPT_SSRR:
9269 case IPOPT_LSRR:
9270 off = opt[IPOPT_OFFSET];
9271 off--;
9272 if (optlen < IP_ADDR_LEN ||
9273 off > optlen - IP_ADDR_LEN) {
9274 /* End of source route */
9275 ip1dbg(("ip_input_local_options: end of SR\n"));
9276 break;
9277 }
9278 /*
9279 * This will only happen if two consecutive entries
9280 * in the source route contains our address or if
9281 * it is a packet with a loose source route which
9282 * reaches us before consuming the whole source route
9283 */
9284 ip1dbg(("ip_input_local_options: not end of SR\n"));
9285 if (optval == IPOPT_SSRR) {
9286 goto bad_src_route;
9287 }
9288 /*
9289 * Hack: instead of dropping the packet truncate the
9290 * source route to what has been used by filling the
9291 * rest with IPOPT_NOP.
9292 */
9293 opt[IPOPT_OLEN] = (uint8_t)off;
9294 while (off < optlen) {
9295 opt[off++] = IPOPT_NOP;
9296 }
9297 break;
9298 case IPOPT_RR:
9299 off = opt[IPOPT_OFFSET];
9300 off--;
9301 if (optlen < IP_ADDR_LEN ||
9302 off > optlen - IP_ADDR_LEN) {
9303 /* No more room - ignore */
9304 ip1dbg((
9305 "ip_input_local_options: end of RR\n"));
9306 break;
9307 }
9308 /* Pick a reasonable address on the outbound if */
9309 if (ip_select_source_v4(ill, INADDR_ANY, ipha->ipha_dst,
9310 INADDR_ANY, ALL_ZONES, ipst, &ifaddr, NULL,
9311 NULL) != 0) {
9312 /* No source! Shouldn't happen */
9313 ifaddr = INADDR_ANY;
9314 }
9315 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9316 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9317 break;
9318 case IPOPT_TS:
9319 off = 0;
9320 /* Insert timestamp if there is romm */
9321 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9322 case IPOPT_TS_TSONLY:
9323 off = IPOPT_TS_TIMELEN;
9324 break;
9325 case IPOPT_TS_PRESPEC:
9326 case IPOPT_TS_PRESPEC_RFC791:
9327 /* Verify that the address matched */
9328 off = opt[IPOPT_OFFSET] - 1;
9329 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9330 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9331 /* Not for us */
9332 break;
9333 }
9334 /* FALLTHROUGH */
9335 case IPOPT_TS_TSANDADDR:
9336 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
9337 break;
9338 default:
9339 /*
9340 * ip_*put_options should have already
9341 * dropped this packet.
9342 */
9343 cmn_err(CE_PANIC, "ip_input_local_options: "
9344 "unknown IT - bug in ip_input_options?\n");
9345 }
9346 if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
9347 /* Increase overflow counter */
9348 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
9349 opt[IPOPT_POS_OV_FLG] =
9350 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) |
9351 (off << 4));
9352 break;
9353 }
9354 off = opt[IPOPT_OFFSET] - 1;
9355 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9356 case IPOPT_TS_PRESPEC:
9357 case IPOPT_TS_PRESPEC_RFC791:
9358 case IPOPT_TS_TSANDADDR:
9359 /* Pick a reasonable addr on the outbound if */
9360 if (ip_select_source_v4(ill, INADDR_ANY,
9361 ipha->ipha_dst, INADDR_ANY, ALL_ZONES, ipst,
9362 &ifaddr, NULL, NULL) != 0) {
9363 /* No source! Shouldn't happen */
9364 ifaddr = INADDR_ANY;
9365 }
9366 bcopy(&ifaddr, (char *)opt + off, IP_ADDR_LEN);
9367 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
9368 /* FALLTHROUGH */
9369 case IPOPT_TS_TSONLY:
9370 off = opt[IPOPT_OFFSET] - 1;
9371 /* Compute # of milliseconds since midnight */
9372 gethrestime(&now);
9373 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
9374 NSEC2MSEC(now.tv_nsec);
9375 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
9376 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
9377 break;
9378 }
9379 break;
9380 }
9381 }
9382 return (B_TRUE);
9383
9384 bad_src_route:
9385 /* make sure we clear any indication of a hardware checksum */
9386 DB_CKSUMFLAGS(mp) = 0;
9387 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
9388 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
9389 return (B_FALSE);
9390
9391 }
9392
9393 /*
9394 * Process IP options in an inbound packet. Always returns the nexthop.
9395 * Normally this is the passed in nexthop, but if there is an option
9396 * that effects the nexthop (such as a source route) that will be returned.
9397 * Sets *errorp if there is an error, in which case an ICMP error has been sent
9398 * and mp freed.
9399 */
9400 ipaddr_t
9401 ip_input_options(ipha_t *ipha, ipaddr_t dst, mblk_t *mp,
9402 ip_recv_attr_t *ira, int *errorp)
9403 {
9404 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
9405 ipoptp_t opts;
9406 uchar_t *opt;
9407 uint8_t optval;
9408 uint8_t optlen;
9409 intptr_t code = 0;
9410 ire_t *ire;
9411
9412 ip2dbg(("ip_input_options\n"));
9413 opt = NULL;
9414 *errorp = 0;
9415 for (optval = ipoptp_first(&opts, ipha);
9416 optval != IPOPT_EOL;
9417 optval = ipoptp_next(&opts)) {
9418 opt = opts.ipoptp_cur;
9419 optlen = opts.ipoptp_len;
9420 ip2dbg(("ip_input_options: opt %d, len %d\n",
9421 optval, optlen));
9422 /*
9423 * Note: we need to verify the checksum before we
9424 * modify anything thus this routine only extracts the next
9425 * hop dst from any source route.
9426 */
9427 switch (optval) {
9428 uint32_t off;
9429 case IPOPT_SSRR:
9430 case IPOPT_LSRR:
9431 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
9432 if (optval == IPOPT_SSRR) {
9433 ip1dbg(("ip_input_options: not next"
9434 " strict source route 0x%x\n",
9435 ntohl(dst)));
9436 code = (char *)&ipha->ipha_dst -
9437 (char *)ipha;
9438 goto param_prob; /* RouterReq's */
9439 }
9440 ip2dbg(("ip_input_options: "
9441 "not next source route 0x%x\n",
9442 ntohl(dst)));
9443 break;
9444 }
9445
9446 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
9447 ip1dbg((
9448 "ip_input_options: bad option offset\n"));
9449 code = (char *)&opt[IPOPT_OLEN] -
9450 (char *)ipha;
9451 goto param_prob;
9452 }
9453 off = opt[IPOPT_OFFSET];
9454 off--;
9455 redo_srr:
9456 if (optlen < IP_ADDR_LEN ||
9457 off > optlen - IP_ADDR_LEN) {
9458 /* End of source route */
9459 ip1dbg(("ip_input_options: end of SR\n"));
9460 break;
9461 }
9462 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
9463 ip1dbg(("ip_input_options: next hop 0x%x\n",
9464 ntohl(dst)));
9465
9466 /*
9467 * Check if our address is present more than
9468 * once as consecutive hops in source route.
9469 * XXX verify per-interface ip_forwarding
9470 * for source route?
9471 */
9472 if (ip_type_v4(dst, ipst) == IRE_LOCAL) {
9473 off += IP_ADDR_LEN;
9474 goto redo_srr;
9475 }
9476
9477 if (dst == htonl(INADDR_LOOPBACK)) {
9478 ip1dbg(("ip_input_options: loopback addr in "
9479 "source route!\n"));
9480 goto bad_src_route;
9481 }
9482 /*
9483 * For strict: verify that dst is directly
9484 * reachable.
9485 */
9486 if (optval == IPOPT_SSRR) {
9487 ire = ire_ftable_lookup_v4(dst, 0, 0,
9488 IRE_INTERFACE, NULL, ALL_ZONES,
9489 ira->ira_tsl,
9490 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst,
9491 NULL);
9492 if (ire == NULL) {
9493 ip1dbg(("ip_input_options: SSRR not "
9494 "directly reachable: 0x%x\n",
9495 ntohl(dst)));
9496 goto bad_src_route;
9497 }
9498 ire_refrele(ire);
9499 }
9500 /*
9501 * Defer update of the offset and the record route
9502 * until the packet is forwarded.
9503 */
9504 break;
9505 case IPOPT_RR:
9506 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
9507 ip1dbg((
9508 "ip_input_options: bad option offset\n"));
9509 code = (char *)&opt[IPOPT_OLEN] -
9510 (char *)ipha;
9511 goto param_prob;
9512 }
9513 break;
9514 case IPOPT_TS:
9515 /*
9516 * Verify that length >= 5 and that there is either
9517 * room for another timestamp or that the overflow
9518 * counter is not maxed out.
9519 */
9520 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha;
9521 if (optlen < IPOPT_MINLEN_IT) {
9522 goto param_prob;
9523 }
9524 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
9525 ip1dbg((
9526 "ip_input_options: bad option offset\n"));
9527 code = (char *)&opt[IPOPT_OFFSET] -
9528 (char *)ipha;
9529 goto param_prob;
9530 }
9531 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
9532 case IPOPT_TS_TSONLY:
9533 off = IPOPT_TS_TIMELEN;
9534 break;
9535 case IPOPT_TS_TSANDADDR:
9536 case IPOPT_TS_PRESPEC:
9537 case IPOPT_TS_PRESPEC_RFC791:
9538 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
9539 break;
9540 default:
9541 code = (char *)&opt[IPOPT_POS_OV_FLG] -
9542 (char *)ipha;
9543 goto param_prob;
9544 }
9545 if (opt[IPOPT_OFFSET] - 1 + off > optlen &&
9546 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) {
9547 /*
9548 * No room and the overflow counter is 15
9549 * already.
9550 */
9551 goto param_prob;
9552 }
9553 break;
9554 }
9555 }
9556
9557 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) {
9558 return (dst);
9559 }
9560
9561 ip1dbg(("ip_input_options: error processing IP options."));
9562 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha;
9563
9564 param_prob:
9565 /* make sure we clear any indication of a hardware checksum */
9566 DB_CKSUMFLAGS(mp) = 0;
9567 ip_drop_input("ICMP_PARAM_PROBLEM", mp, ira->ira_ill);
9568 icmp_param_problem(mp, (uint8_t)code, ira);
9569 *errorp = -1;
9570 return (dst);
9571
9572 bad_src_route:
9573 /* make sure we clear any indication of a hardware checksum */
9574 DB_CKSUMFLAGS(mp) = 0;
9575 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ira->ira_ill);
9576 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
9577 *errorp = -1;
9578 return (dst);
9579 }
9580
9581 /*
9582 * IP & ICMP info in >=14 msg's ...
9583 * - ip fixed part (mib2_ip_t)
9584 * - icmp fixed part (mib2_icmp_t)
9585 * - ipAddrEntryTable (ip 20) all IPv4 ipifs
9586 * - ipRouteEntryTable (ip 21) all IPv4 IREs
9587 * - ipNetToMediaEntryTable (ip 22) all IPv4 Neighbor Cache entries
9588 * - ipRouteAttributeTable (ip 102) labeled routes
9589 * - ip multicast membership (ip_member_t)
9590 * - ip multicast source filtering (ip_grpsrc_t)
9591 * - igmp fixed part (struct igmpstat)
9592 * - multicast routing stats (struct mrtstat)
9593 * - multicast routing vifs (array of struct vifctl)
9594 * - multicast routing routes (array of struct mfcctl)
9595 * - ip6 fixed part (mib2_ipv6IfStatsEntry_t)
9596 * One per ill plus one generic
9597 * - icmp6 fixed part (mib2_ipv6IfIcmpEntry_t)
9598 * One per ill plus one generic
9599 * - ipv6RouteEntry all IPv6 IREs
9600 * - ipv6RouteAttributeTable (ip6 102) labeled routes
9601 * - ipv6NetToMediaEntry all IPv6 Neighbor Cache entries
9602 * - ipv6AddrEntry all IPv6 ipifs
9603 * - ipv6 multicast membership (ipv6_member_t)
9604 * - ipv6 multicast source filtering (ipv6_grpsrc_t)
9605 *
9606 * NOTE: original mpctl is copied for msg's 2..N, since its ctl part is
9607 * already filled in by the caller.
9608 * If legacy_req is true then MIB structures needs to be truncated to their
9609 * legacy sizes before being returned.
9610 * Return value of 0 indicates that no messages were sent and caller
9611 * should free mpctl.
9612 */
9613 int
9614 ip_snmp_get(queue_t *q, mblk_t *mpctl, int level, boolean_t legacy_req)
9615 {
9616 ip_stack_t *ipst;
9617 sctp_stack_t *sctps;
9618
9619 if (q->q_next != NULL) {
9620 ipst = ILLQ_TO_IPST(q);
9621 } else {
9622 ipst = CONNQ_TO_IPST(q);
9623 }
9624 ASSERT(ipst != NULL);
9625 sctps = ipst->ips_netstack->netstack_sctp;
9626
9627 if (mpctl == NULL || mpctl->b_cont == NULL) {
9628 return (0);
9629 }
9630
9631 /*
9632 * For the purposes of the (broken) packet shell use
9633 * of the level we make sure MIB2_TCP/MIB2_UDP can be used
9634 * to make TCP and UDP appear first in the list of mib items.
9635 * TBD: We could expand this and use it in netstat so that
9636 * the kernel doesn't have to produce large tables (connections,
9637 * routes, etc) when netstat only wants the statistics or a particular
9638 * table.
9639 */
9640 if (!(level == MIB2_TCP || level == MIB2_UDP)) {
9641 if ((mpctl = icmp_snmp_get(q, mpctl)) == NULL) {
9642 return (1);
9643 }
9644 }
9645
9646 if (level != MIB2_TCP) {
9647 if ((mpctl = udp_snmp_get(q, mpctl, legacy_req)) == NULL) {
9648 return (1);
9649 }
9650 if (level == MIB2_UDP) {
9651 goto done;
9652 }
9653 }
9654
9655 if (level != MIB2_UDP) {
9656 if ((mpctl = tcp_snmp_get(q, mpctl, legacy_req)) == NULL) {
9657 return (1);
9658 }
9659 if (level == MIB2_TCP) {
9660 goto done;
9661 }
9662 }
9663
9664 if ((mpctl = ip_snmp_get_mib2_ip_traffic_stats(q, mpctl,
9665 ipst, legacy_req)) == NULL) {
9666 return (1);
9667 }
9668
9669 if ((mpctl = ip_snmp_get_mib2_ip6(q, mpctl, ipst,
9670 legacy_req)) == NULL) {
9671 return (1);
9672 }
9673
9674 if ((mpctl = ip_snmp_get_mib2_icmp(q, mpctl, ipst)) == NULL) {
9675 return (1);
9676 }
9677
9678 if ((mpctl = ip_snmp_get_mib2_icmp6(q, mpctl, ipst)) == NULL) {
9679 return (1);
9680 }
9681
9682 if ((mpctl = ip_snmp_get_mib2_igmp(q, mpctl, ipst)) == NULL) {
9683 return (1);
9684 }
9685
9686 if ((mpctl = ip_snmp_get_mib2_multi(q, mpctl, ipst)) == NULL) {
9687 return (1);
9688 }
9689
9690 if ((mpctl = ip_snmp_get_mib2_ip_addr(q, mpctl, ipst,
9691 legacy_req)) == NULL) {
9692 return (1);
9693 }
9694
9695 if ((mpctl = ip_snmp_get_mib2_ip6_addr(q, mpctl, ipst,
9696 legacy_req)) == NULL) {
9697 return (1);
9698 }
9699
9700 if ((mpctl = ip_snmp_get_mib2_ip_group_mem(q, mpctl, ipst)) == NULL) {
9701 return (1);
9702 }
9703
9704 if ((mpctl = ip_snmp_get_mib2_ip6_group_mem(q, mpctl, ipst)) == NULL) {
9705 return (1);
9706 }
9707
9708 if ((mpctl = ip_snmp_get_mib2_ip_group_src(q, mpctl, ipst)) == NULL) {
9709 return (1);
9710 }
9711
9712 if ((mpctl = ip_snmp_get_mib2_ip6_group_src(q, mpctl, ipst)) == NULL) {
9713 return (1);
9714 }
9715
9716 if ((mpctl = ip_snmp_get_mib2_virt_multi(q, mpctl, ipst)) == NULL) {
9717 return (1);
9718 }
9719
9720 if ((mpctl = ip_snmp_get_mib2_multi_rtable(q, mpctl, ipst)) == NULL) {
9721 return (1);
9722 }
9723
9724 mpctl = ip_snmp_get_mib2_ip_route_media(q, mpctl, level, ipst);
9725 if (mpctl == NULL)
9726 return (1);
9727
9728 mpctl = ip_snmp_get_mib2_ip6_route_media(q, mpctl, level, ipst);
9729 if (mpctl == NULL)
9730 return (1);
9731
9732 if ((mpctl = sctp_snmp_get_mib2(q, mpctl, sctps)) == NULL) {
9733 return (1);
9734 }
9735 if ((mpctl = ip_snmp_get_mib2_ip_dce(q, mpctl, ipst)) == NULL) {
9736 return (1);
9737 }
9738 done:
9739 freemsg(mpctl);
9740 return (1);
9741 }
9742
9743 /* Get global (legacy) IPv4 statistics */
9744 static mblk_t *
9745 ip_snmp_get_mib2_ip(queue_t *q, mblk_t *mpctl, mib2_ipIfStatsEntry_t *ipmib,
9746 ip_stack_t *ipst, boolean_t legacy_req)
9747 {
9748 mib2_ip_t old_ip_mib;
9749 struct opthdr *optp;
9750 mblk_t *mp2ctl;
9751 mib2_ipAddrEntry_t mae;
9752
9753 /*
9754 * make a copy of the original message
9755 */
9756 mp2ctl = copymsg(mpctl);
9757
9758 /* fixed length IP structure... */
9759 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9760 optp->level = MIB2_IP;
9761 optp->name = 0;
9762 SET_MIB(old_ip_mib.ipForwarding,
9763 (WE_ARE_FORWARDING(ipst) ? 1 : 2));
9764 SET_MIB(old_ip_mib.ipDefaultTTL,
9765 (uint32_t)ipst->ips_ip_def_ttl);
9766 SET_MIB(old_ip_mib.ipReasmTimeout,
9767 ipst->ips_ip_reassembly_timeout);
9768 SET_MIB(old_ip_mib.ipAddrEntrySize,
9769 (legacy_req) ? LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t) :
9770 sizeof (mib2_ipAddrEntry_t));
9771 SET_MIB(old_ip_mib.ipRouteEntrySize,
9772 sizeof (mib2_ipRouteEntry_t));
9773 SET_MIB(old_ip_mib.ipNetToMediaEntrySize,
9774 sizeof (mib2_ipNetToMediaEntry_t));
9775 SET_MIB(old_ip_mib.ipMemberEntrySize, sizeof (ip_member_t));
9776 SET_MIB(old_ip_mib.ipGroupSourceEntrySize, sizeof (ip_grpsrc_t));
9777 SET_MIB(old_ip_mib.ipRouteAttributeSize,
9778 sizeof (mib2_ipAttributeEntry_t));
9779 SET_MIB(old_ip_mib.transportMLPSize, sizeof (mib2_transportMLPEntry_t));
9780 SET_MIB(old_ip_mib.ipDestEntrySize, sizeof (dest_cache_entry_t));
9781
9782 /*
9783 * Grab the statistics from the new IP MIB
9784 */
9785 SET_MIB(old_ip_mib.ipInReceives,
9786 (uint32_t)ipmib->ipIfStatsHCInReceives);
9787 SET_MIB(old_ip_mib.ipInHdrErrors, ipmib->ipIfStatsInHdrErrors);
9788 SET_MIB(old_ip_mib.ipInAddrErrors, ipmib->ipIfStatsInAddrErrors);
9789 SET_MIB(old_ip_mib.ipForwDatagrams,
9790 (uint32_t)ipmib->ipIfStatsHCOutForwDatagrams);
9791 SET_MIB(old_ip_mib.ipInUnknownProtos,
9792 ipmib->ipIfStatsInUnknownProtos);
9793 SET_MIB(old_ip_mib.ipInDiscards, ipmib->ipIfStatsInDiscards);
9794 SET_MIB(old_ip_mib.ipInDelivers,
9795 (uint32_t)ipmib->ipIfStatsHCInDelivers);
9796 SET_MIB(old_ip_mib.ipOutRequests,
9797 (uint32_t)ipmib->ipIfStatsHCOutRequests);
9798 SET_MIB(old_ip_mib.ipOutDiscards, ipmib->ipIfStatsOutDiscards);
9799 SET_MIB(old_ip_mib.ipOutNoRoutes, ipmib->ipIfStatsOutNoRoutes);
9800 SET_MIB(old_ip_mib.ipReasmReqds, ipmib->ipIfStatsReasmReqds);
9801 SET_MIB(old_ip_mib.ipReasmOKs, ipmib->ipIfStatsReasmOKs);
9802 SET_MIB(old_ip_mib.ipReasmFails, ipmib->ipIfStatsReasmFails);
9803 SET_MIB(old_ip_mib.ipFragOKs, ipmib->ipIfStatsOutFragOKs);
9804 SET_MIB(old_ip_mib.ipFragFails, ipmib->ipIfStatsOutFragFails);
9805 SET_MIB(old_ip_mib.ipFragCreates, ipmib->ipIfStatsOutFragCreates);
9806
9807 /* ipRoutingDiscards is not being used */
9808 SET_MIB(old_ip_mib.ipRoutingDiscards, 0);
9809 SET_MIB(old_ip_mib.tcpInErrs, ipmib->tcpIfStatsInErrs);
9810 SET_MIB(old_ip_mib.udpNoPorts, ipmib->udpIfStatsNoPorts);
9811 SET_MIB(old_ip_mib.ipInCksumErrs, ipmib->ipIfStatsInCksumErrs);
9812 SET_MIB(old_ip_mib.ipReasmDuplicates,
9813 ipmib->ipIfStatsReasmDuplicates);
9814 SET_MIB(old_ip_mib.ipReasmPartDups, ipmib->ipIfStatsReasmPartDups);
9815 SET_MIB(old_ip_mib.ipForwProhibits, ipmib->ipIfStatsForwProhibits);
9816 SET_MIB(old_ip_mib.udpInCksumErrs, ipmib->udpIfStatsInCksumErrs);
9817 SET_MIB(old_ip_mib.udpInOverflows, ipmib->udpIfStatsInOverflows);
9818 SET_MIB(old_ip_mib.rawipInOverflows,
9819 ipmib->rawipIfStatsInOverflows);
9820
9821 SET_MIB(old_ip_mib.ipsecInSucceeded, ipmib->ipsecIfStatsInSucceeded);
9822 SET_MIB(old_ip_mib.ipsecInFailed, ipmib->ipsecIfStatsInFailed);
9823 SET_MIB(old_ip_mib.ipInIPv6, ipmib->ipIfStatsInWrongIPVersion);
9824 SET_MIB(old_ip_mib.ipOutIPv6, ipmib->ipIfStatsOutWrongIPVersion);
9825 SET_MIB(old_ip_mib.ipOutSwitchIPv6,
9826 ipmib->ipIfStatsOutSwitchIPVersion);
9827
9828 if (!snmp_append_data(mpctl->b_cont, (char *)&old_ip_mib,
9829 (int)sizeof (old_ip_mib))) {
9830 ip1dbg(("ip_snmp_get_mib2_ip: failed to allocate %u bytes\n",
9831 (uint_t)sizeof (old_ip_mib)));
9832 }
9833
9834 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9835 ip3dbg(("ip_snmp_get_mib2_ip: level %d, name %d, len %d\n",
9836 (int)optp->level, (int)optp->name, (int)optp->len));
9837 qreply(q, mpctl);
9838 return (mp2ctl);
9839 }
9840
9841 /* Per interface IPv4 statistics */
9842 static mblk_t *
9843 ip_snmp_get_mib2_ip_traffic_stats(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
9844 boolean_t legacy_req)
9845 {
9846 struct opthdr *optp;
9847 mblk_t *mp2ctl;
9848 ill_t *ill;
9849 ill_walk_context_t ctx;
9850 mblk_t *mp_tail = NULL;
9851 mib2_ipIfStatsEntry_t global_ip_mib;
9852 mib2_ipAddrEntry_t mae;
9853
9854 /*
9855 * Make a copy of the original message
9856 */
9857 mp2ctl = copymsg(mpctl);
9858
9859 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9860 optp->level = MIB2_IP;
9861 optp->name = MIB2_IP_TRAFFIC_STATS;
9862 /* Include "unknown interface" ip_mib */
9863 ipst->ips_ip_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
9864 ipst->ips_ip_mib.ipIfStatsIfIndex =
9865 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */
9866 SET_MIB(ipst->ips_ip_mib.ipIfStatsForwarding,
9867 (ipst->ips_ip_forwarding ? 1 : 2));
9868 SET_MIB(ipst->ips_ip_mib.ipIfStatsDefaultTTL,
9869 (uint32_t)ipst->ips_ip_def_ttl);
9870 SET_MIB(ipst->ips_ip_mib.ipIfStatsEntrySize,
9871 sizeof (mib2_ipIfStatsEntry_t));
9872 SET_MIB(ipst->ips_ip_mib.ipIfStatsAddrEntrySize,
9873 sizeof (mib2_ipAddrEntry_t));
9874 SET_MIB(ipst->ips_ip_mib.ipIfStatsRouteEntrySize,
9875 sizeof (mib2_ipRouteEntry_t));
9876 SET_MIB(ipst->ips_ip_mib.ipIfStatsNetToMediaEntrySize,
9877 sizeof (mib2_ipNetToMediaEntry_t));
9878 SET_MIB(ipst->ips_ip_mib.ipIfStatsMemberEntrySize,
9879 sizeof (ip_member_t));
9880 SET_MIB(ipst->ips_ip_mib.ipIfStatsGroupSourceEntrySize,
9881 sizeof (ip_grpsrc_t));
9882
9883 bcopy(&ipst->ips_ip_mib, &global_ip_mib, sizeof (global_ip_mib));
9884
9885 if (legacy_req) {
9886 SET_MIB(global_ip_mib.ipIfStatsAddrEntrySize,
9887 LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t));
9888 }
9889
9890 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
9891 (char *)&global_ip_mib, (int)sizeof (global_ip_mib))) {
9892 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: "
9893 "failed to allocate %u bytes\n",
9894 (uint_t)sizeof (global_ip_mib)));
9895 }
9896
9897 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
9898 ill = ILL_START_WALK_V4(&ctx, ipst);
9899 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
9900 ill->ill_ip_mib->ipIfStatsIfIndex =
9901 ill->ill_phyint->phyint_ifindex;
9902 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding,
9903 (ipst->ips_ip_forwarding ? 1 : 2));
9904 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultTTL,
9905 (uint32_t)ipst->ips_ip_def_ttl);
9906
9907 ip_mib2_add_ip_stats(&global_ip_mib, ill->ill_ip_mib);
9908 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
9909 (char *)ill->ill_ip_mib,
9910 (int)sizeof (*ill->ill_ip_mib))) {
9911 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: "
9912 "failed to allocate %u bytes\n",
9913 (uint_t)sizeof (*ill->ill_ip_mib)));
9914 }
9915 }
9916 rw_exit(&ipst->ips_ill_g_lock);
9917
9918 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9919 ip3dbg(("ip_snmp_get_mib2_ip_traffic_stats: "
9920 "level %d, name %d, len %d\n",
9921 (int)optp->level, (int)optp->name, (int)optp->len));
9922 qreply(q, mpctl);
9923
9924 if (mp2ctl == NULL)
9925 return (NULL);
9926
9927 return (ip_snmp_get_mib2_ip(q, mp2ctl, &global_ip_mib, ipst,
9928 legacy_req));
9929 }
9930
9931 /* Global IPv4 ICMP statistics */
9932 static mblk_t *
9933 ip_snmp_get_mib2_icmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
9934 {
9935 struct opthdr *optp;
9936 mblk_t *mp2ctl;
9937
9938 /*
9939 * Make a copy of the original message
9940 */
9941 mp2ctl = copymsg(mpctl);
9942
9943 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9944 optp->level = MIB2_ICMP;
9945 optp->name = 0;
9946 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_icmp_mib,
9947 (int)sizeof (ipst->ips_icmp_mib))) {
9948 ip1dbg(("ip_snmp_get_mib2_icmp: failed to allocate %u bytes\n",
9949 (uint_t)sizeof (ipst->ips_icmp_mib)));
9950 }
9951 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9952 ip3dbg(("ip_snmp_get_mib2_icmp: level %d, name %d, len %d\n",
9953 (int)optp->level, (int)optp->name, (int)optp->len));
9954 qreply(q, mpctl);
9955 return (mp2ctl);
9956 }
9957
9958 /* Global IPv4 IGMP statistics */
9959 static mblk_t *
9960 ip_snmp_get_mib2_igmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
9961 {
9962 struct opthdr *optp;
9963 mblk_t *mp2ctl;
9964
9965 /*
9966 * make a copy of the original message
9967 */
9968 mp2ctl = copymsg(mpctl);
9969
9970 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9971 optp->level = EXPER_IGMP;
9972 optp->name = 0;
9973 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_igmpstat,
9974 (int)sizeof (ipst->ips_igmpstat))) {
9975 ip1dbg(("ip_snmp_get_mib2_igmp: failed to allocate %u bytes\n",
9976 (uint_t)sizeof (ipst->ips_igmpstat)));
9977 }
9978 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
9979 ip3dbg(("ip_snmp_get_mib2_igmp: level %d, name %d, len %d\n",
9980 (int)optp->level, (int)optp->name, (int)optp->len));
9981 qreply(q, mpctl);
9982 return (mp2ctl);
9983 }
9984
9985 /* Global IPv4 Multicast Routing statistics */
9986 static mblk_t *
9987 ip_snmp_get_mib2_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
9988 {
9989 struct opthdr *optp;
9990 mblk_t *mp2ctl;
9991
9992 /*
9993 * make a copy of the original message
9994 */
9995 mp2ctl = copymsg(mpctl);
9996
9997 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
9998 optp->level = EXPER_DVMRP;
9999 optp->name = 0;
10000 if (!ip_mroute_stats(mpctl->b_cont, ipst)) {
10001 ip0dbg(("ip_mroute_stats: failed\n"));
10002 }
10003 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10004 ip3dbg(("ip_snmp_get_mib2_multi: level %d, name %d, len %d\n",
10005 (int)optp->level, (int)optp->name, (int)optp->len));
10006 qreply(q, mpctl);
10007 return (mp2ctl);
10008 }
10009
10010 /* IPv4 address information */
10011 static mblk_t *
10012 ip_snmp_get_mib2_ip_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
10013 boolean_t legacy_req)
10014 {
10015 struct opthdr *optp;
10016 mblk_t *mp2ctl;
10017 mblk_t *mp_tail = NULL;
10018 ill_t *ill;
10019 ipif_t *ipif;
10020 uint_t bitval;
10021 mib2_ipAddrEntry_t mae;
10022 size_t mae_size;
10023 zoneid_t zoneid;
10024 ill_walk_context_t ctx;
10025
10026 /*
10027 * make a copy of the original message
10028 */
10029 mp2ctl = copymsg(mpctl);
10030
10031 mae_size = (legacy_req) ? LEGACY_MIB_SIZE(&mae, mib2_ipAddrEntry_t) :
10032 sizeof (mib2_ipAddrEntry_t);
10033
10034 /* ipAddrEntryTable */
10035
10036 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10037 optp->level = MIB2_IP;
10038 optp->name = MIB2_IP_ADDR;
10039 zoneid = Q_TO_CONN(q)->conn_zoneid;
10040
10041 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10042 ill = ILL_START_WALK_V4(&ctx, ipst);
10043 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10044 for (ipif = ill->ill_ipif; ipif != NULL;
10045 ipif = ipif->ipif_next) {
10046 if (ipif->ipif_zoneid != zoneid &&
10047 ipif->ipif_zoneid != ALL_ZONES)
10048 continue;
10049 /* Sum of count from dead IRE_LO* and our current */
10050 mae.ipAdEntInfo.ae_ibcnt = ipif->ipif_ib_pkt_count;
10051 if (ipif->ipif_ire_local != NULL) {
10052 mae.ipAdEntInfo.ae_ibcnt +=
10053 ipif->ipif_ire_local->ire_ib_pkt_count;
10054 }
10055 mae.ipAdEntInfo.ae_obcnt = 0;
10056 mae.ipAdEntInfo.ae_focnt = 0;
10057
10058 ipif_get_name(ipif, mae.ipAdEntIfIndex.o_bytes,
10059 OCTET_LENGTH);
10060 mae.ipAdEntIfIndex.o_length =
10061 mi_strlen(mae.ipAdEntIfIndex.o_bytes);
10062 mae.ipAdEntAddr = ipif->ipif_lcl_addr;
10063 mae.ipAdEntNetMask = ipif->ipif_net_mask;
10064 mae.ipAdEntInfo.ae_subnet = ipif->ipif_subnet;
10065 mae.ipAdEntInfo.ae_subnet_len =
10066 ip_mask_to_plen(ipif->ipif_net_mask);
10067 mae.ipAdEntInfo.ae_src_addr = ipif->ipif_lcl_addr;
10068 for (bitval = 1;
10069 bitval &&
10070 !(bitval & ipif->ipif_brd_addr);
10071 bitval <<= 1)
10072 noop;
10073 mae.ipAdEntBcastAddr = bitval;
10074 mae.ipAdEntReasmMaxSize = IP_MAXPACKET;
10075 mae.ipAdEntInfo.ae_mtu = ipif->ipif_ill->ill_mtu;
10076 mae.ipAdEntInfo.ae_metric = ipif->ipif_ill->ill_metric;
10077 mae.ipAdEntInfo.ae_broadcast_addr =
10078 ipif->ipif_brd_addr;
10079 mae.ipAdEntInfo.ae_pp_dst_addr =
10080 ipif->ipif_pp_dst_addr;
10081 mae.ipAdEntInfo.ae_flags = ipif->ipif_flags |
10082 ill->ill_flags | ill->ill_phyint->phyint_flags;
10083 mae.ipAdEntRetransmitTime =
10084 ill->ill_reachable_retrans_time;
10085
10086 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10087 (char *)&mae, (int)mae_size)) {
10088 ip1dbg(("ip_snmp_get_mib2_ip_addr: failed to "
10089 "allocate %u bytes\n", (uint_t)mae_size));
10090 }
10091 }
10092 }
10093 rw_exit(&ipst->ips_ill_g_lock);
10094
10095 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10096 ip3dbg(("ip_snmp_get_mib2_ip_addr: level %d, name %d, len %d\n",
10097 (int)optp->level, (int)optp->name, (int)optp->len));
10098 qreply(q, mpctl);
10099 return (mp2ctl);
10100 }
10101
10102 /* IPv6 address information */
10103 static mblk_t *
10104 ip_snmp_get_mib2_ip6_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
10105 boolean_t legacy_req)
10106 {
10107 struct opthdr *optp;
10108 mblk_t *mp2ctl;
10109 mblk_t *mp_tail = NULL;
10110 ill_t *ill;
10111 ipif_t *ipif;
10112 mib2_ipv6AddrEntry_t mae6;
10113 size_t mae6_size;
10114 zoneid_t zoneid;
10115 ill_walk_context_t ctx;
10116
10117 /*
10118 * make a copy of the original message
10119 */
10120 mp2ctl = copymsg(mpctl);
10121
10122 mae6_size = (legacy_req) ?
10123 LEGACY_MIB_SIZE(&mae6, mib2_ipv6AddrEntry_t) :
10124 sizeof (mib2_ipv6AddrEntry_t);
10125
10126 /* ipv6AddrEntryTable */
10127
10128 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10129 optp->level = MIB2_IP6;
10130 optp->name = MIB2_IP6_ADDR;
10131 zoneid = Q_TO_CONN(q)->conn_zoneid;
10132
10133 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10134 ill = ILL_START_WALK_V6(&ctx, ipst);
10135 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10136 for (ipif = ill->ill_ipif; ipif != NULL;
10137 ipif = ipif->ipif_next) {
10138 if (ipif->ipif_zoneid != zoneid &&
10139 ipif->ipif_zoneid != ALL_ZONES)
10140 continue;
10141 /* Sum of count from dead IRE_LO* and our current */
10142 mae6.ipv6AddrInfo.ae_ibcnt = ipif->ipif_ib_pkt_count;
10143 if (ipif->ipif_ire_local != NULL) {
10144 mae6.ipv6AddrInfo.ae_ibcnt +=
10145 ipif->ipif_ire_local->ire_ib_pkt_count;
10146 }
10147 mae6.ipv6AddrInfo.ae_obcnt = 0;
10148 mae6.ipv6AddrInfo.ae_focnt = 0;
10149
10150 ipif_get_name(ipif, mae6.ipv6AddrIfIndex.o_bytes,
10151 OCTET_LENGTH);
10152 mae6.ipv6AddrIfIndex.o_length =
10153 mi_strlen(mae6.ipv6AddrIfIndex.o_bytes);
10154 mae6.ipv6AddrAddress = ipif->ipif_v6lcl_addr;
10155 mae6.ipv6AddrPfxLength =
10156 ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
10157 mae6.ipv6AddrInfo.ae_subnet = ipif->ipif_v6subnet;
10158 mae6.ipv6AddrInfo.ae_subnet_len =
10159 mae6.ipv6AddrPfxLength;
10160 mae6.ipv6AddrInfo.ae_src_addr = ipif->ipif_v6lcl_addr;
10161
10162 /* Type: stateless(1), stateful(2), unknown(3) */
10163 if (ipif->ipif_flags & IPIF_ADDRCONF)
10164 mae6.ipv6AddrType = 1;
10165 else
10166 mae6.ipv6AddrType = 2;
10167 /* Anycast: true(1), false(2) */
10168 if (ipif->ipif_flags & IPIF_ANYCAST)
10169 mae6.ipv6AddrAnycastFlag = 1;
10170 else
10171 mae6.ipv6AddrAnycastFlag = 2;
10172
10173 /*
10174 * Address status: preferred(1), deprecated(2),
10175 * invalid(3), inaccessible(4), unknown(5)
10176 */
10177 if (ipif->ipif_flags & IPIF_NOLOCAL)
10178 mae6.ipv6AddrStatus = 3;
10179 else if (ipif->ipif_flags & IPIF_DEPRECATED)
10180 mae6.ipv6AddrStatus = 2;
10181 else
10182 mae6.ipv6AddrStatus = 1;
10183 mae6.ipv6AddrInfo.ae_mtu = ipif->ipif_ill->ill_mtu;
10184 mae6.ipv6AddrInfo.ae_metric =
10185 ipif->ipif_ill->ill_metric;
10186 mae6.ipv6AddrInfo.ae_pp_dst_addr =
10187 ipif->ipif_v6pp_dst_addr;
10188 mae6.ipv6AddrInfo.ae_flags = ipif->ipif_flags |
10189 ill->ill_flags | ill->ill_phyint->phyint_flags;
10190 mae6.ipv6AddrReasmMaxSize = IP_MAXPACKET;
10191 mae6.ipv6AddrIdentifier = ill->ill_token;
10192 mae6.ipv6AddrIdentifierLen = ill->ill_token_length;
10193 mae6.ipv6AddrReachableTime = ill->ill_reachable_time;
10194 mae6.ipv6AddrRetransmitTime =
10195 ill->ill_reachable_retrans_time;
10196 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10197 (char *)&mae6, (int)mae6_size)) {
10198 ip1dbg(("ip_snmp_get_mib2_ip6_addr: failed to "
10199 "allocate %u bytes\n",
10200 (uint_t)mae6_size));
10201 }
10202 }
10203 }
10204 rw_exit(&ipst->ips_ill_g_lock);
10205
10206 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10207 ip3dbg(("ip_snmp_get_mib2_ip6_addr: level %d, name %d, len %d\n",
10208 (int)optp->level, (int)optp->name, (int)optp->len));
10209 qreply(q, mpctl);
10210 return (mp2ctl);
10211 }
10212
10213 /* IPv4 multicast group membership. */
10214 static mblk_t *
10215 ip_snmp_get_mib2_ip_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10216 {
10217 struct opthdr *optp;
10218 mblk_t *mp2ctl;
10219 ill_t *ill;
10220 ipif_t *ipif;
10221 ilm_t *ilm;
10222 ip_member_t ipm;
10223 mblk_t *mp_tail = NULL;
10224 ill_walk_context_t ctx;
10225 zoneid_t zoneid;
10226
10227 /*
10228 * make a copy of the original message
10229 */
10230 mp2ctl = copymsg(mpctl);
10231 zoneid = Q_TO_CONN(q)->conn_zoneid;
10232
10233 /* ipGroupMember table */
10234 optp = (struct opthdr *)&mpctl->b_rptr[
10235 sizeof (struct T_optmgmt_ack)];
10236 optp->level = MIB2_IP;
10237 optp->name = EXPER_IP_GROUP_MEMBERSHIP;
10238
10239 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10240 ill = ILL_START_WALK_V4(&ctx, ipst);
10241 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10242 /* Make sure the ill isn't going away. */
10243 if (!ill_check_and_refhold(ill))
10244 continue;
10245 rw_exit(&ipst->ips_ill_g_lock);
10246 rw_enter(&ill->ill_mcast_lock, RW_READER);
10247 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10248 if (ilm->ilm_zoneid != zoneid &&
10249 ilm->ilm_zoneid != ALL_ZONES)
10250 continue;
10251
10252 /* Is there an ipif for ilm_ifaddr? */
10253 for (ipif = ill->ill_ipif; ipif != NULL;
10254 ipif = ipif->ipif_next) {
10255 if (!IPIF_IS_CONDEMNED(ipif) &&
10256 ipif->ipif_lcl_addr == ilm->ilm_ifaddr &&
10257 ilm->ilm_ifaddr != INADDR_ANY)
10258 break;
10259 }
10260 if (ipif != NULL) {
10261 ipif_get_name(ipif,
10262 ipm.ipGroupMemberIfIndex.o_bytes,
10263 OCTET_LENGTH);
10264 } else {
10265 ill_get_name(ill,
10266 ipm.ipGroupMemberIfIndex.o_bytes,
10267 OCTET_LENGTH);
10268 }
10269 ipm.ipGroupMemberIfIndex.o_length =
10270 mi_strlen(ipm.ipGroupMemberIfIndex.o_bytes);
10271
10272 ipm.ipGroupMemberAddress = ilm->ilm_addr;
10273 ipm.ipGroupMemberRefCnt = ilm->ilm_refcnt;
10274 ipm.ipGroupMemberFilterMode = ilm->ilm_fmode;
10275 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10276 (char *)&ipm, (int)sizeof (ipm))) {
10277 ip1dbg(("ip_snmp_get_mib2_ip_group: "
10278 "failed to allocate %u bytes\n",
10279 (uint_t)sizeof (ipm)));
10280 }
10281 }
10282 rw_exit(&ill->ill_mcast_lock);
10283 ill_refrele(ill);
10284 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10285 }
10286 rw_exit(&ipst->ips_ill_g_lock);
10287 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10288 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10289 (int)optp->level, (int)optp->name, (int)optp->len));
10290 qreply(q, mpctl);
10291 return (mp2ctl);
10292 }
10293
10294 /* IPv6 multicast group membership. */
10295 static mblk_t *
10296 ip_snmp_get_mib2_ip6_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10297 {
10298 struct opthdr *optp;
10299 mblk_t *mp2ctl;
10300 ill_t *ill;
10301 ilm_t *ilm;
10302 ipv6_member_t ipm6;
10303 mblk_t *mp_tail = NULL;
10304 ill_walk_context_t ctx;
10305 zoneid_t zoneid;
10306
10307 /*
10308 * make a copy of the original message
10309 */
10310 mp2ctl = copymsg(mpctl);
10311 zoneid = Q_TO_CONN(q)->conn_zoneid;
10312
10313 /* ip6GroupMember table */
10314 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10315 optp->level = MIB2_IP6;
10316 optp->name = EXPER_IP6_GROUP_MEMBERSHIP;
10317
10318 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10319 ill = ILL_START_WALK_V6(&ctx, ipst);
10320 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10321 /* Make sure the ill isn't going away. */
10322 if (!ill_check_and_refhold(ill))
10323 continue;
10324 rw_exit(&ipst->ips_ill_g_lock);
10325 /*
10326 * Normally we don't have any members on under IPMP interfaces.
10327 * We report them as a debugging aid.
10328 */
10329 rw_enter(&ill->ill_mcast_lock, RW_READER);
10330 ipm6.ipv6GroupMemberIfIndex = ill->ill_phyint->phyint_ifindex;
10331 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10332 if (ilm->ilm_zoneid != zoneid &&
10333 ilm->ilm_zoneid != ALL_ZONES)
10334 continue; /* not this zone */
10335 ipm6.ipv6GroupMemberAddress = ilm->ilm_v6addr;
10336 ipm6.ipv6GroupMemberRefCnt = ilm->ilm_refcnt;
10337 ipm6.ipv6GroupMemberFilterMode = ilm->ilm_fmode;
10338 if (!snmp_append_data2(mpctl->b_cont,
10339 &mp_tail,
10340 (char *)&ipm6, (int)sizeof (ipm6))) {
10341 ip1dbg(("ip_snmp_get_mib2_ip6_group: "
10342 "failed to allocate %u bytes\n",
10343 (uint_t)sizeof (ipm6)));
10344 }
10345 }
10346 rw_exit(&ill->ill_mcast_lock);
10347 ill_refrele(ill);
10348 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10349 }
10350 rw_exit(&ipst->ips_ill_g_lock);
10351
10352 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10353 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10354 (int)optp->level, (int)optp->name, (int)optp->len));
10355 qreply(q, mpctl);
10356 return (mp2ctl);
10357 }
10358
10359 /* IP multicast filtered sources */
10360 static mblk_t *
10361 ip_snmp_get_mib2_ip_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10362 {
10363 struct opthdr *optp;
10364 mblk_t *mp2ctl;
10365 ill_t *ill;
10366 ipif_t *ipif;
10367 ilm_t *ilm;
10368 ip_grpsrc_t ips;
10369 mblk_t *mp_tail = NULL;
10370 ill_walk_context_t ctx;
10371 zoneid_t zoneid;
10372 int i;
10373 slist_t *sl;
10374
10375 /*
10376 * make a copy of the original message
10377 */
10378 mp2ctl = copymsg(mpctl);
10379 zoneid = Q_TO_CONN(q)->conn_zoneid;
10380
10381 /* ipGroupSource table */
10382 optp = (struct opthdr *)&mpctl->b_rptr[
10383 sizeof (struct T_optmgmt_ack)];
10384 optp->level = MIB2_IP;
10385 optp->name = EXPER_IP_GROUP_SOURCES;
10386
10387 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10388 ill = ILL_START_WALK_V4(&ctx, ipst);
10389 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10390 /* Make sure the ill isn't going away. */
10391 if (!ill_check_and_refhold(ill))
10392 continue;
10393 rw_exit(&ipst->ips_ill_g_lock);
10394 rw_enter(&ill->ill_mcast_lock, RW_READER);
10395 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10396 sl = ilm->ilm_filter;
10397 if (ilm->ilm_zoneid != zoneid &&
10398 ilm->ilm_zoneid != ALL_ZONES)
10399 continue;
10400 if (SLIST_IS_EMPTY(sl))
10401 continue;
10402
10403 /* Is there an ipif for ilm_ifaddr? */
10404 for (ipif = ill->ill_ipif; ipif != NULL;
10405 ipif = ipif->ipif_next) {
10406 if (!IPIF_IS_CONDEMNED(ipif) &&
10407 ipif->ipif_lcl_addr == ilm->ilm_ifaddr &&
10408 ilm->ilm_ifaddr != INADDR_ANY)
10409 break;
10410 }
10411 if (ipif != NULL) {
10412 ipif_get_name(ipif,
10413 ips.ipGroupSourceIfIndex.o_bytes,
10414 OCTET_LENGTH);
10415 } else {
10416 ill_get_name(ill,
10417 ips.ipGroupSourceIfIndex.o_bytes,
10418 OCTET_LENGTH);
10419 }
10420 ips.ipGroupSourceIfIndex.o_length =
10421 mi_strlen(ips.ipGroupSourceIfIndex.o_bytes);
10422
10423 ips.ipGroupSourceGroup = ilm->ilm_addr;
10424 for (i = 0; i < sl->sl_numsrc; i++) {
10425 if (!IN6_IS_ADDR_V4MAPPED(&sl->sl_addr[i]))
10426 continue;
10427 IN6_V4MAPPED_TO_IPADDR(&sl->sl_addr[i],
10428 ips.ipGroupSourceAddress);
10429 if (snmp_append_data2(mpctl->b_cont, &mp_tail,
10430 (char *)&ips, (int)sizeof (ips)) == 0) {
10431 ip1dbg(("ip_snmp_get_mib2_ip_group_src:"
10432 " failed to allocate %u bytes\n",
10433 (uint_t)sizeof (ips)));
10434 }
10435 }
10436 }
10437 rw_exit(&ill->ill_mcast_lock);
10438 ill_refrele(ill);
10439 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10440 }
10441 rw_exit(&ipst->ips_ill_g_lock);
10442 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10443 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10444 (int)optp->level, (int)optp->name, (int)optp->len));
10445 qreply(q, mpctl);
10446 return (mp2ctl);
10447 }
10448
10449 /* IPv6 multicast filtered sources. */
10450 static mblk_t *
10451 ip_snmp_get_mib2_ip6_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10452 {
10453 struct opthdr *optp;
10454 mblk_t *mp2ctl;
10455 ill_t *ill;
10456 ilm_t *ilm;
10457 ipv6_grpsrc_t ips6;
10458 mblk_t *mp_tail = NULL;
10459 ill_walk_context_t ctx;
10460 zoneid_t zoneid;
10461 int i;
10462 slist_t *sl;
10463
10464 /*
10465 * make a copy of the original message
10466 */
10467 mp2ctl = copymsg(mpctl);
10468 zoneid = Q_TO_CONN(q)->conn_zoneid;
10469
10470 /* ip6GroupMember table */
10471 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10472 optp->level = MIB2_IP6;
10473 optp->name = EXPER_IP6_GROUP_SOURCES;
10474
10475 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10476 ill = ILL_START_WALK_V6(&ctx, ipst);
10477 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10478 /* Make sure the ill isn't going away. */
10479 if (!ill_check_and_refhold(ill))
10480 continue;
10481 rw_exit(&ipst->ips_ill_g_lock);
10482 /*
10483 * Normally we don't have any members on under IPMP interfaces.
10484 * We report them as a debugging aid.
10485 */
10486 rw_enter(&ill->ill_mcast_lock, RW_READER);
10487 ips6.ipv6GroupSourceIfIndex = ill->ill_phyint->phyint_ifindex;
10488 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) {
10489 sl = ilm->ilm_filter;
10490 if (ilm->ilm_zoneid != zoneid &&
10491 ilm->ilm_zoneid != ALL_ZONES)
10492 continue;
10493 if (SLIST_IS_EMPTY(sl))
10494 continue;
10495 ips6.ipv6GroupSourceGroup = ilm->ilm_v6addr;
10496 for (i = 0; i < sl->sl_numsrc; i++) {
10497 ips6.ipv6GroupSourceAddress = sl->sl_addr[i];
10498 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10499 (char *)&ips6, (int)sizeof (ips6))) {
10500 ip1dbg(("ip_snmp_get_mib2_ip6_"
10501 "group_src: failed to allocate "
10502 "%u bytes\n",
10503 (uint_t)sizeof (ips6)));
10504 }
10505 }
10506 }
10507 rw_exit(&ill->ill_mcast_lock);
10508 ill_refrele(ill);
10509 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10510 }
10511 rw_exit(&ipst->ips_ill_g_lock);
10512
10513 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10514 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n",
10515 (int)optp->level, (int)optp->name, (int)optp->len));
10516 qreply(q, mpctl);
10517 return (mp2ctl);
10518 }
10519
10520 /* Multicast routing virtual interface table. */
10521 static mblk_t *
10522 ip_snmp_get_mib2_virt_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10523 {
10524 struct opthdr *optp;
10525 mblk_t *mp2ctl;
10526
10527 /*
10528 * make a copy of the original message
10529 */
10530 mp2ctl = copymsg(mpctl);
10531
10532 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10533 optp->level = EXPER_DVMRP;
10534 optp->name = EXPER_DVMRP_VIF;
10535 if (!ip_mroute_vif(mpctl->b_cont, ipst)) {
10536 ip0dbg(("ip_mroute_vif: failed\n"));
10537 }
10538 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10539 ip3dbg(("ip_snmp_get_mib2_virt_multi: level %d, name %d, len %d\n",
10540 (int)optp->level, (int)optp->name, (int)optp->len));
10541 qreply(q, mpctl);
10542 return (mp2ctl);
10543 }
10544
10545 /* Multicast routing table. */
10546 static mblk_t *
10547 ip_snmp_get_mib2_multi_rtable(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10548 {
10549 struct opthdr *optp;
10550 mblk_t *mp2ctl;
10551
10552 /*
10553 * make a copy of the original message
10554 */
10555 mp2ctl = copymsg(mpctl);
10556
10557 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10558 optp->level = EXPER_DVMRP;
10559 optp->name = EXPER_DVMRP_MRT;
10560 if (!ip_mroute_mrt(mpctl->b_cont, ipst)) {
10561 ip0dbg(("ip_mroute_mrt: failed\n"));
10562 }
10563 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10564 ip3dbg(("ip_snmp_get_mib2_multi_rtable: level %d, name %d, len %d\n",
10565 (int)optp->level, (int)optp->name, (int)optp->len));
10566 qreply(q, mpctl);
10567 return (mp2ctl);
10568 }
10569
10570 /*
10571 * Return ipRouteEntryTable, ipNetToMediaEntryTable, and ipRouteAttributeTable
10572 * in one IRE walk.
10573 */
10574 static mblk_t *
10575 ip_snmp_get_mib2_ip_route_media(queue_t *q, mblk_t *mpctl, int level,
10576 ip_stack_t *ipst)
10577 {
10578 struct opthdr *optp;
10579 mblk_t *mp2ctl; /* Returned */
10580 mblk_t *mp3ctl; /* nettomedia */
10581 mblk_t *mp4ctl; /* routeattrs */
10582 iproutedata_t ird;
10583 zoneid_t zoneid;
10584
10585 /*
10586 * make copies of the original message
10587 * - mp2ctl is returned unchanged to the caller for its use
10588 * - mpctl is sent upstream as ipRouteEntryTable
10589 * - mp3ctl is sent upstream as ipNetToMediaEntryTable
10590 * - mp4ctl is sent upstream as ipRouteAttributeTable
10591 */
10592 mp2ctl = copymsg(mpctl);
10593 mp3ctl = copymsg(mpctl);
10594 mp4ctl = copymsg(mpctl);
10595 if (mp3ctl == NULL || mp4ctl == NULL) {
10596 freemsg(mp4ctl);
10597 freemsg(mp3ctl);
10598 freemsg(mp2ctl);
10599 freemsg(mpctl);
10600 return (NULL);
10601 }
10602
10603 bzero(&ird, sizeof (ird));
10604
10605 ird.ird_route.lp_head = mpctl->b_cont;
10606 ird.ird_netmedia.lp_head = mp3ctl->b_cont;
10607 ird.ird_attrs.lp_head = mp4ctl->b_cont;
10608 /*
10609 * If the level has been set the special EXPER_IP_AND_ALL_IRES value,
10610 * then also include ire_testhidden IREs and IRE_IF_CLONE. This is
10611 * intended a temporary solution until a proper MIB API is provided
10612 * that provides complete filtering/caller-opt-in.
10613 */
10614 if (level == EXPER_IP_AND_ALL_IRES)
10615 ird.ird_flags |= IRD_REPORT_ALL;
10616
10617 zoneid = Q_TO_CONN(q)->conn_zoneid;
10618 ire_walk_v4(ip_snmp_get2_v4, &ird, zoneid, ipst);
10619
10620 /* ipRouteEntryTable in mpctl */
10621 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10622 optp->level = MIB2_IP;
10623 optp->name = MIB2_IP_ROUTE;
10624 optp->len = msgdsize(ird.ird_route.lp_head);
10625 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
10626 (int)optp->level, (int)optp->name, (int)optp->len));
10627 qreply(q, mpctl);
10628
10629 /* ipNetToMediaEntryTable in mp3ctl */
10630 ncec_walk(NULL, ip_snmp_get2_v4_media, &ird, ipst);
10631
10632 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10633 optp->level = MIB2_IP;
10634 optp->name = MIB2_IP_MEDIA;
10635 optp->len = msgdsize(ird.ird_netmedia.lp_head);
10636 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
10637 (int)optp->level, (int)optp->name, (int)optp->len));
10638 qreply(q, mp3ctl);
10639
10640 /* ipRouteAttributeTable in mp4ctl */
10641 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10642 optp->level = MIB2_IP;
10643 optp->name = EXPER_IP_RTATTR;
10644 optp->len = msgdsize(ird.ird_attrs.lp_head);
10645 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n",
10646 (int)optp->level, (int)optp->name, (int)optp->len));
10647 if (optp->len == 0)
10648 freemsg(mp4ctl);
10649 else
10650 qreply(q, mp4ctl);
10651
10652 return (mp2ctl);
10653 }
10654
10655 /*
10656 * Return ipv6RouteEntryTable and ipv6RouteAttributeTable in one IRE walk, and
10657 * ipv6NetToMediaEntryTable in an NDP walk.
10658 */
10659 static mblk_t *
10660 ip_snmp_get_mib2_ip6_route_media(queue_t *q, mblk_t *mpctl, int level,
10661 ip_stack_t *ipst)
10662 {
10663 struct opthdr *optp;
10664 mblk_t *mp2ctl; /* Returned */
10665 mblk_t *mp3ctl; /* nettomedia */
10666 mblk_t *mp4ctl; /* routeattrs */
10667 iproutedata_t ird;
10668 zoneid_t zoneid;
10669
10670 /*
10671 * make copies of the original message
10672 * - mp2ctl is returned unchanged to the caller for its use
10673 * - mpctl is sent upstream as ipv6RouteEntryTable
10674 * - mp3ctl is sent upstream as ipv6NetToMediaEntryTable
10675 * - mp4ctl is sent upstream as ipv6RouteAttributeTable
10676 */
10677 mp2ctl = copymsg(mpctl);
10678 mp3ctl = copymsg(mpctl);
10679 mp4ctl = copymsg(mpctl);
10680 if (mp3ctl == NULL || mp4ctl == NULL) {
10681 freemsg(mp4ctl);
10682 freemsg(mp3ctl);
10683 freemsg(mp2ctl);
10684 freemsg(mpctl);
10685 return (NULL);
10686 }
10687
10688 bzero(&ird, sizeof (ird));
10689
10690 ird.ird_route.lp_head = mpctl->b_cont;
10691 ird.ird_netmedia.lp_head = mp3ctl->b_cont;
10692 ird.ird_attrs.lp_head = mp4ctl->b_cont;
10693 /*
10694 * If the level has been set the special EXPER_IP_AND_ALL_IRES value,
10695 * then also include ire_testhidden IREs and IRE_IF_CLONE. This is
10696 * intended a temporary solution until a proper MIB API is provided
10697 * that provides complete filtering/caller-opt-in.
10698 */
10699 if (level == EXPER_IP_AND_ALL_IRES)
10700 ird.ird_flags |= IRD_REPORT_ALL;
10701
10702 zoneid = Q_TO_CONN(q)->conn_zoneid;
10703 ire_walk_v6(ip_snmp_get2_v6_route, &ird, zoneid, ipst);
10704
10705 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10706 optp->level = MIB2_IP6;
10707 optp->name = MIB2_IP6_ROUTE;
10708 optp->len = msgdsize(ird.ird_route.lp_head);
10709 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
10710 (int)optp->level, (int)optp->name, (int)optp->len));
10711 qreply(q, mpctl);
10712
10713 /* ipv6NetToMediaEntryTable in mp3ctl */
10714 ncec_walk(NULL, ip_snmp_get2_v6_media, &ird, ipst);
10715
10716 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10717 optp->level = MIB2_IP6;
10718 optp->name = MIB2_IP6_MEDIA;
10719 optp->len = msgdsize(ird.ird_netmedia.lp_head);
10720 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
10721 (int)optp->level, (int)optp->name, (int)optp->len));
10722 qreply(q, mp3ctl);
10723
10724 /* ipv6RouteAttributeTable in mp4ctl */
10725 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10726 optp->level = MIB2_IP6;
10727 optp->name = EXPER_IP_RTATTR;
10728 optp->len = msgdsize(ird.ird_attrs.lp_head);
10729 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n",
10730 (int)optp->level, (int)optp->name, (int)optp->len));
10731 if (optp->len == 0)
10732 freemsg(mp4ctl);
10733 else
10734 qreply(q, mp4ctl);
10735
10736 return (mp2ctl);
10737 }
10738
10739 /*
10740 * IPv6 mib: One per ill
10741 */
10742 static mblk_t *
10743 ip_snmp_get_mib2_ip6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst,
10744 boolean_t legacy_req)
10745 {
10746 struct opthdr *optp;
10747 mblk_t *mp2ctl;
10748 ill_t *ill;
10749 ill_walk_context_t ctx;
10750 mblk_t *mp_tail = NULL;
10751 mib2_ipv6AddrEntry_t mae6;
10752 mib2_ipIfStatsEntry_t *ise;
10753 size_t ise_size, iae_size;
10754
10755 /*
10756 * Make a copy of the original message
10757 */
10758 mp2ctl = copymsg(mpctl);
10759
10760 /* fixed length IPv6 structure ... */
10761
10762 if (legacy_req) {
10763 ise_size = LEGACY_MIB_SIZE(&ipst->ips_ip6_mib,
10764 mib2_ipIfStatsEntry_t);
10765 iae_size = LEGACY_MIB_SIZE(&mae6, mib2_ipv6AddrEntry_t);
10766 } else {
10767 ise_size = sizeof (mib2_ipIfStatsEntry_t);
10768 iae_size = sizeof (mib2_ipv6AddrEntry_t);
10769 }
10770
10771 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10772 optp->level = MIB2_IP6;
10773 optp->name = 0;
10774 /* Include "unknown interface" ip6_mib */
10775 ipst->ips_ip6_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
10776 ipst->ips_ip6_mib.ipIfStatsIfIndex =
10777 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */
10778 SET_MIB(ipst->ips_ip6_mib.ipIfStatsForwarding,
10779 ipst->ips_ipv6_forwarding ? 1 : 2);
10780 SET_MIB(ipst->ips_ip6_mib.ipIfStatsDefaultHopLimit,
10781 ipst->ips_ipv6_def_hops);
10782 SET_MIB(ipst->ips_ip6_mib.ipIfStatsEntrySize,
10783 sizeof (mib2_ipIfStatsEntry_t));
10784 SET_MIB(ipst->ips_ip6_mib.ipIfStatsAddrEntrySize,
10785 sizeof (mib2_ipv6AddrEntry_t));
10786 SET_MIB(ipst->ips_ip6_mib.ipIfStatsRouteEntrySize,
10787 sizeof (mib2_ipv6RouteEntry_t));
10788 SET_MIB(ipst->ips_ip6_mib.ipIfStatsNetToMediaEntrySize,
10789 sizeof (mib2_ipv6NetToMediaEntry_t));
10790 SET_MIB(ipst->ips_ip6_mib.ipIfStatsMemberEntrySize,
10791 sizeof (ipv6_member_t));
10792 SET_MIB(ipst->ips_ip6_mib.ipIfStatsGroupSourceEntrySize,
10793 sizeof (ipv6_grpsrc_t));
10794
10795 /*
10796 * Synchronize 64- and 32-bit counters
10797 */
10798 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInReceives,
10799 ipIfStatsHCInReceives);
10800 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInDelivers,
10801 ipIfStatsHCInDelivers);
10802 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutRequests,
10803 ipIfStatsHCOutRequests);
10804 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutForwDatagrams,
10805 ipIfStatsHCOutForwDatagrams);
10806 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutMcastPkts,
10807 ipIfStatsHCOutMcastPkts);
10808 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInMcastPkts,
10809 ipIfStatsHCInMcastPkts);
10810
10811 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10812 (char *)&ipst->ips_ip6_mib, (int)ise_size)) {
10813 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate %u bytes\n",
10814 (uint_t)ise_size));
10815 } else if (legacy_req) {
10816 /* Adjust the EntrySize fields for legacy requests. */
10817 ise =
10818 (mib2_ipIfStatsEntry_t *)(mp_tail->b_wptr - (int)ise_size);
10819 SET_MIB(ise->ipIfStatsEntrySize, ise_size);
10820 SET_MIB(ise->ipIfStatsAddrEntrySize, iae_size);
10821 }
10822
10823 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10824 ill = ILL_START_WALK_V6(&ctx, ipst);
10825 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10826 ill->ill_ip_mib->ipIfStatsIfIndex =
10827 ill->ill_phyint->phyint_ifindex;
10828 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding,
10829 ipst->ips_ipv6_forwarding ? 1 : 2);
10830 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultHopLimit,
10831 ill->ill_max_hops);
10832
10833 /*
10834 * Synchronize 64- and 32-bit counters
10835 */
10836 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInReceives,
10837 ipIfStatsHCInReceives);
10838 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInDelivers,
10839 ipIfStatsHCInDelivers);
10840 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutRequests,
10841 ipIfStatsHCOutRequests);
10842 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutForwDatagrams,
10843 ipIfStatsHCOutForwDatagrams);
10844 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutMcastPkts,
10845 ipIfStatsHCOutMcastPkts);
10846 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInMcastPkts,
10847 ipIfStatsHCInMcastPkts);
10848
10849 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10850 (char *)ill->ill_ip_mib, (int)ise_size)) {
10851 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate "
10852 "%u bytes\n", (uint_t)ise_size));
10853 } else if (legacy_req) {
10854 /* Adjust the EntrySize fields for legacy requests. */
10855 ise = (mib2_ipIfStatsEntry_t *)(mp_tail->b_wptr -
10856 (int)ise_size);
10857 SET_MIB(ise->ipIfStatsEntrySize, ise_size);
10858 SET_MIB(ise->ipIfStatsAddrEntrySize, iae_size);
10859 }
10860 }
10861 rw_exit(&ipst->ips_ill_g_lock);
10862
10863 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10864 ip3dbg(("ip_snmp_get_mib2_ip6: level %d, name %d, len %d\n",
10865 (int)optp->level, (int)optp->name, (int)optp->len));
10866 qreply(q, mpctl);
10867 return (mp2ctl);
10868 }
10869
10870 /*
10871 * ICMPv6 mib: One per ill
10872 */
10873 static mblk_t *
10874 ip_snmp_get_mib2_icmp6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst)
10875 {
10876 struct opthdr *optp;
10877 mblk_t *mp2ctl;
10878 ill_t *ill;
10879 ill_walk_context_t ctx;
10880 mblk_t *mp_tail = NULL;
10881 /*
10882 * Make a copy of the original message
10883 */
10884 mp2ctl = copymsg(mpctl);
10885
10886 /* fixed length ICMPv6 structure ... */
10887
10888 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
10889 optp->level = MIB2_ICMP6;
10890 optp->name = 0;
10891 /* Include "unknown interface" icmp6_mib */
10892 ipst->ips_icmp6_mib.ipv6IfIcmpIfIndex =
10893 MIB2_UNKNOWN_INTERFACE; /* netstat flag */
10894 ipst->ips_icmp6_mib.ipv6IfIcmpEntrySize =
10895 sizeof (mib2_ipv6IfIcmpEntry_t);
10896 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10897 (char *)&ipst->ips_icmp6_mib,
10898 (int)sizeof (ipst->ips_icmp6_mib))) {
10899 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate %u bytes\n",
10900 (uint_t)sizeof (ipst->ips_icmp6_mib)));
10901 }
10902
10903 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
10904 ill = ILL_START_WALK_V6(&ctx, ipst);
10905 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
10906 ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
10907 ill->ill_phyint->phyint_ifindex;
10908 if (!snmp_append_data2(mpctl->b_cont, &mp_tail,
10909 (char *)ill->ill_icmp6_mib,
10910 (int)sizeof (*ill->ill_icmp6_mib))) {
10911 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate "
10912 "%u bytes\n",
10913 (uint_t)sizeof (*ill->ill_icmp6_mib)));
10914 }
10915 }
10916 rw_exit(&ipst->ips_ill_g_lock);
10917
10918 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont);
10919 ip3dbg(("ip_snmp_get_mib2_icmp6: level %d, name %d, len %d\n",
10920 (int)optp->level, (int)optp->name, (int)optp->len));
10921 qreply(q, mpctl);
10922 return (mp2ctl);
10923 }
10924
10925 /*
10926 * ire_walk routine to create both ipRouteEntryTable and
10927 * ipRouteAttributeTable in one IRE walk
10928 */
10929 static void
10930 ip_snmp_get2_v4(ire_t *ire, iproutedata_t *ird)
10931 {
10932 ill_t *ill;
10933 mib2_ipRouteEntry_t *re;
10934 mib2_ipAttributeEntry_t iaes;
10935 tsol_ire_gw_secattr_t *attrp;
10936 tsol_gc_t *gc = NULL;
10937 tsol_gcgrp_t *gcgrp = NULL;
10938 ip_stack_t *ipst = ire->ire_ipst;
10939
10940 ASSERT(ire->ire_ipversion == IPV4_VERSION);
10941
10942 if (!(ird->ird_flags & IRD_REPORT_ALL)) {
10943 if (ire->ire_testhidden)
10944 return;
10945 if (ire->ire_type & IRE_IF_CLONE)
10946 return;
10947 }
10948
10949 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL)
10950 return;
10951
10952 if ((attrp = ire->ire_gw_secattr) != NULL) {
10953 mutex_enter(&attrp->igsa_lock);
10954 if ((gc = attrp->igsa_gc) != NULL) {
10955 gcgrp = gc->gc_grp;
10956 ASSERT(gcgrp != NULL);
10957 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER);
10958 }
10959 mutex_exit(&attrp->igsa_lock);
10960 }
10961 /*
10962 * Return all IRE types for route table... let caller pick and choose
10963 */
10964 re->ipRouteDest = ire->ire_addr;
10965 ill = ire->ire_ill;
10966 re->ipRouteIfIndex.o_length = 0;
10967 if (ill != NULL) {
10968 ill_get_name(ill, re->ipRouteIfIndex.o_bytes, OCTET_LENGTH);
10969 re->ipRouteIfIndex.o_length =
10970 mi_strlen(re->ipRouteIfIndex.o_bytes);
10971 }
10972 re->ipRouteMetric1 = -1;
10973 re->ipRouteMetric2 = -1;
10974 re->ipRouteMetric3 = -1;
10975 re->ipRouteMetric4 = -1;
10976
10977 re->ipRouteNextHop = ire->ire_gateway_addr;
10978 /* indirect(4), direct(3), or invalid(2) */
10979 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
10980 re->ipRouteType = 2;
10981 else if (ire->ire_type & IRE_ONLINK)
10982 re->ipRouteType = 3;
10983 else
10984 re->ipRouteType = 4;
10985
10986 re->ipRouteProto = -1;
10987 re->ipRouteAge = gethrestime_sec() - ire->ire_create_time;
10988 re->ipRouteMask = ire->ire_mask;
10989 re->ipRouteMetric5 = -1;
10990 re->ipRouteInfo.re_max_frag = ire->ire_metrics.iulp_mtu;
10991 if (ire->ire_ill != NULL && re->ipRouteInfo.re_max_frag == 0)
10992 re->ipRouteInfo.re_max_frag = ire->ire_ill->ill_mtu;
10993
10994 re->ipRouteInfo.re_frag_flag = 0;
10995 re->ipRouteInfo.re_rtt = 0;
10996 re->ipRouteInfo.re_src_addr = 0;
10997 re->ipRouteInfo.re_ref = ire->ire_refcnt;
10998 re->ipRouteInfo.re_obpkt = ire->ire_ob_pkt_count;
10999 re->ipRouteInfo.re_ibpkt = ire->ire_ib_pkt_count;
11000 re->ipRouteInfo.re_flags = ire->ire_flags;
11001
11002 /* Add the IRE_IF_CLONE's counters to their parent IRE_INTERFACE */
11003 if (ire->ire_type & IRE_INTERFACE) {
11004 ire_t *child;
11005
11006 rw_enter(&ipst->ips_ire_dep_lock, RW_READER);
11007 child = ire->ire_dep_children;
11008 while (child != NULL) {
11009 re->ipRouteInfo.re_obpkt += child->ire_ob_pkt_count;
11010 re->ipRouteInfo.re_ibpkt += child->ire_ib_pkt_count;
11011 child = child->ire_dep_sib_next;
11012 }
11013 rw_exit(&ipst->ips_ire_dep_lock);
11014 }
11015
11016 if (ire->ire_flags & RTF_DYNAMIC) {
11017 re->ipRouteInfo.re_ire_type = IRE_HOST_REDIRECT;
11018 } else {
11019 re->ipRouteInfo.re_ire_type = ire->ire_type;
11020 }
11021
11022 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail,
11023 (char *)re, (int)sizeof (*re))) {
11024 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n",
11025 (uint_t)sizeof (*re)));
11026 }
11027
11028 if (gc != NULL) {
11029 iaes.iae_routeidx = ird->ird_idx;
11030 iaes.iae_doi = gc->gc_db->gcdb_doi;
11031 iaes.iae_slrange = gc->gc_db->gcdb_slrange;
11032
11033 if (!snmp_append_data2(ird->ird_attrs.lp_head,
11034 &ird->ird_attrs.lp_tail, (char *)&iaes, sizeof (iaes))) {
11035 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u "
11036 "bytes\n", (uint_t)sizeof (iaes)));
11037 }
11038 }
11039
11040 /* bump route index for next pass */
11041 ird->ird_idx++;
11042
11043 kmem_free(re, sizeof (*re));
11044 if (gcgrp != NULL)
11045 rw_exit(&gcgrp->gcgrp_rwlock);
11046 }
11047
11048 /*
11049 * ire_walk routine to create ipv6RouteEntryTable and ipRouteEntryTable.
11050 */
11051 static void
11052 ip_snmp_get2_v6_route(ire_t *ire, iproutedata_t *ird)
11053 {
11054 ill_t *ill;
11055 mib2_ipv6RouteEntry_t *re;
11056 mib2_ipAttributeEntry_t iaes;
11057 tsol_ire_gw_secattr_t *attrp;
11058 tsol_gc_t *gc = NULL;
11059 tsol_gcgrp_t *gcgrp = NULL;
11060 ip_stack_t *ipst = ire->ire_ipst;
11061
11062 ASSERT(ire->ire_ipversion == IPV6_VERSION);
11063
11064 if (!(ird->ird_flags & IRD_REPORT_ALL)) {
11065 if (ire->ire_testhidden)
11066 return;
11067 if (ire->ire_type & IRE_IF_CLONE)
11068 return;
11069 }
11070
11071 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL)
11072 return;
11073
11074 if ((attrp = ire->ire_gw_secattr) != NULL) {
11075 mutex_enter(&attrp->igsa_lock);
11076 if ((gc = attrp->igsa_gc) != NULL) {
11077 gcgrp = gc->gc_grp;
11078 ASSERT(gcgrp != NULL);
11079 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER);
11080 }
11081 mutex_exit(&attrp->igsa_lock);
11082 }
11083 /*
11084 * Return all IRE types for route table... let caller pick and choose
11085 */
11086 re->ipv6RouteDest = ire->ire_addr_v6;
11087 re->ipv6RoutePfxLength = ip_mask_to_plen_v6(&ire->ire_mask_v6);
11088 re->ipv6RouteIndex = 0; /* Unique when multiple with same dest/plen */
11089 re->ipv6RouteIfIndex.o_length = 0;
11090 ill = ire->ire_ill;
11091 if (ill != NULL) {
11092 ill_get_name(ill, re->ipv6RouteIfIndex.o_bytes, OCTET_LENGTH);
11093 re->ipv6RouteIfIndex.o_length =
11094 mi_strlen(re->ipv6RouteIfIndex.o_bytes);
11095 }
11096
11097 ASSERT(!(ire->ire_type & IRE_BROADCAST));
11098
11099 mutex_enter(&ire->ire_lock);
11100 re->ipv6RouteNextHop = ire->ire_gateway_addr_v6;
11101 mutex_exit(&ire->ire_lock);
11102
11103 /* remote(4), local(3), or discard(2) */
11104 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))
11105 re->ipv6RouteType = 2;
11106 else if (ire->ire_type & IRE_ONLINK)
11107 re->ipv6RouteType = 3;
11108 else
11109 re->ipv6RouteType = 4;
11110
11111 re->ipv6RouteProtocol = -1;
11112 re->ipv6RoutePolicy = 0;
11113 re->ipv6RouteAge = gethrestime_sec() - ire->ire_create_time;
11114 re->ipv6RouteNextHopRDI = 0;
11115 re->ipv6RouteWeight = 0;
11116 re->ipv6RouteMetric = 0;
11117 re->ipv6RouteInfo.re_max_frag = ire->ire_metrics.iulp_mtu;
11118 if (ire->ire_ill != NULL && re->ipv6RouteInfo.re_max_frag == 0)
11119 re->ipv6RouteInfo.re_max_frag = ire->ire_ill->ill_mtu;
11120
11121 re->ipv6RouteInfo.re_frag_flag = 0;
11122 re->ipv6RouteInfo.re_rtt = 0;
11123 re->ipv6RouteInfo.re_src_addr = ipv6_all_zeros;
11124 re->ipv6RouteInfo.re_obpkt = ire->ire_ob_pkt_count;
11125 re->ipv6RouteInfo.re_ibpkt = ire->ire_ib_pkt_count;
11126 re->ipv6RouteInfo.re_ref = ire->ire_refcnt;
11127 re->ipv6RouteInfo.re_flags = ire->ire_flags;
11128
11129 /* Add the IRE_IF_CLONE's counters to their parent IRE_INTERFACE */
11130 if (ire->ire_type & IRE_INTERFACE) {
11131 ire_t *child;
11132
11133 rw_enter(&ipst->ips_ire_dep_lock, RW_READER);
11134 child = ire->ire_dep_children;
11135 while (child != NULL) {
11136 re->ipv6RouteInfo.re_obpkt += child->ire_ob_pkt_count;
11137 re->ipv6RouteInfo.re_ibpkt += child->ire_ib_pkt_count;
11138 child = child->ire_dep_sib_next;
11139 }
11140 rw_exit(&ipst->ips_ire_dep_lock);
11141 }
11142 if (ire->ire_flags & RTF_DYNAMIC) {
11143 re->ipv6RouteInfo.re_ire_type = IRE_HOST_REDIRECT;
11144 } else {
11145 re->ipv6RouteInfo.re_ire_type = ire->ire_type;
11146 }
11147
11148 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail,
11149 (char *)re, (int)sizeof (*re))) {
11150 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u bytes\n",
11151 (uint_t)sizeof (*re)));
11152 }
11153
11154 if (gc != NULL) {
11155 iaes.iae_routeidx = ird->ird_idx;
11156 iaes.iae_doi = gc->gc_db->gcdb_doi;
11157 iaes.iae_slrange = gc->gc_db->gcdb_slrange;
11158
11159 if (!snmp_append_data2(ird->ird_attrs.lp_head,
11160 &ird->ird_attrs.lp_tail, (char *)&iaes, sizeof (iaes))) {
11161 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u "
11162 "bytes\n", (uint_t)sizeof (iaes)));
11163 }
11164 }
11165
11166 /* bump route index for next pass */
11167 ird->ird_idx++;
11168
11169 kmem_free(re, sizeof (*re));
11170 if (gcgrp != NULL)
11171 rw_exit(&gcgrp->gcgrp_rwlock);
11172 }
11173
11174 /*
11175 * ncec_walk routine to create ipv6NetToMediaEntryTable
11176 */
11177 static void
11178 ip_snmp_get2_v6_media(ncec_t *ncec, void *ptr)
11179 {
11180 iproutedata_t *ird = ptr;
11181 ill_t *ill;
11182 mib2_ipv6NetToMediaEntry_t ntme;
11183
11184 ill = ncec->ncec_ill;
11185 /* skip arpce entries, and loopback ncec entries */
11186 if (ill->ill_isv6 == B_FALSE || ill->ill_net_type == IRE_LOOPBACK)
11187 return;
11188 /*
11189 * Neighbor cache entry attached to IRE with on-link
11190 * destination.
11191 * We report all IPMP groups on ncec_ill which is normally the upper.
11192 */
11193 ntme.ipv6NetToMediaIfIndex = ill->ill_phyint->phyint_ifindex;
11194 ntme.ipv6NetToMediaNetAddress = ncec->ncec_addr;
11195 ntme.ipv6NetToMediaPhysAddress.o_length = ill->ill_phys_addr_length;
11196 if (ncec->ncec_lladdr != NULL) {
11197 bcopy(ncec->ncec_lladdr, ntme.ipv6NetToMediaPhysAddress.o_bytes,
11198 ntme.ipv6NetToMediaPhysAddress.o_length);
11199 }
11200 /*
11201 * Note: Returns ND_* states. Should be:
11202 * reachable(1), stale(2), delay(3), probe(4),
11203 * invalid(5), unknown(6)
11204 */
11205 ntme.ipv6NetToMediaState = ncec->ncec_state;
11206 ntme.ipv6NetToMediaLastUpdated = 0;
11207
11208 /* other(1), dynamic(2), static(3), local(4) */
11209 if (NCE_MYADDR(ncec)) {
11210 ntme.ipv6NetToMediaType = 4;
11211 } else if (ncec->ncec_flags & NCE_F_PUBLISH) {
11212 ntme.ipv6NetToMediaType = 1; /* proxy */
11213 } else if (ncec->ncec_flags & NCE_F_STATIC) {
11214 ntme.ipv6NetToMediaType = 3;
11215 } else if (ncec->ncec_flags & (NCE_F_MCAST|NCE_F_BCAST)) {
11216 ntme.ipv6NetToMediaType = 1;
11217 } else {
11218 ntme.ipv6NetToMediaType = 2;
11219 }
11220
11221 if (!snmp_append_data2(ird->ird_netmedia.lp_head,
11222 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) {
11223 ip1dbg(("ip_snmp_get2_v6_media: failed to allocate %u bytes\n",
11224 (uint_t)sizeof (ntme)));
11225 }
11226 }
11227
11228 int
11229 nce2ace(ncec_t *ncec)
11230 {
11231 int flags = 0;
11232
11233 if (NCE_ISREACHABLE(ncec))
11234 flags |= ACE_F_RESOLVED;
11235 if (ncec->ncec_flags & NCE_F_AUTHORITY)
11236 flags |= ACE_F_AUTHORITY;
11237 if (ncec->ncec_flags & NCE_F_PUBLISH)
11238 flags |= ACE_F_PUBLISH;
11239 if ((ncec->ncec_flags & NCE_F_NONUD) != 0)
11240 flags |= ACE_F_PERMANENT;
11241 if (NCE_MYADDR(ncec))
11242 flags |= (ACE_F_MYADDR | ACE_F_AUTHORITY);
11243 if (ncec->ncec_flags & NCE_F_UNVERIFIED)
11244 flags |= ACE_F_UNVERIFIED;
11245 if (ncec->ncec_flags & NCE_F_AUTHORITY)
11246 flags |= ACE_F_AUTHORITY;
11247 if (ncec->ncec_flags & NCE_F_DELAYED)
11248 flags |= ACE_F_DELAYED;
11249 return (flags);
11250 }
11251
11252 /*
11253 * ncec_walk routine to create ipNetToMediaEntryTable
11254 */
11255 static void
11256 ip_snmp_get2_v4_media(ncec_t *ncec, void *ptr)
11257 {
11258 iproutedata_t *ird = ptr;
11259 ill_t *ill;
11260 mib2_ipNetToMediaEntry_t ntme;
11261 const char *name = "unknown";
11262 ipaddr_t ncec_addr;
11263
11264 ill = ncec->ncec_ill;
11265 if (ill->ill_isv6 || (ncec->ncec_flags & NCE_F_BCAST) ||
11266 ill->ill_net_type == IRE_LOOPBACK)
11267 return;
11268
11269 /* We report all IPMP groups on ncec_ill which is normally the upper. */
11270 name = ill->ill_name;
11271 /* Based on RFC 4293: other(1), inval(2), dyn(3), stat(4) */
11272 if (NCE_MYADDR(ncec)) {
11273 ntme.ipNetToMediaType = 4;
11274 } else if (ncec->ncec_flags & (NCE_F_MCAST|NCE_F_BCAST|NCE_F_PUBLISH)) {
11275 ntme.ipNetToMediaType = 1;
11276 } else {
11277 ntme.ipNetToMediaType = 3;
11278 }
11279 ntme.ipNetToMediaIfIndex.o_length = MIN(OCTET_LENGTH, strlen(name));
11280 bcopy(name, ntme.ipNetToMediaIfIndex.o_bytes,
11281 ntme.ipNetToMediaIfIndex.o_length);
11282
11283 IN6_V4MAPPED_TO_IPADDR(&ncec->ncec_addr, ncec_addr);
11284 bcopy(&ncec_addr, &ntme.ipNetToMediaNetAddress, sizeof (ncec_addr));
11285
11286 ntme.ipNetToMediaInfo.ntm_mask.o_length = sizeof (ipaddr_t);
11287 ncec_addr = INADDR_BROADCAST;
11288 bcopy(&ncec_addr, ntme.ipNetToMediaInfo.ntm_mask.o_bytes,
11289 sizeof (ncec_addr));
11290 /*
11291 * map all the flags to the ACE counterpart.
11292 */
11293 ntme.ipNetToMediaInfo.ntm_flags = nce2ace(ncec);
11294
11295 ntme.ipNetToMediaPhysAddress.o_length =
11296 MIN(OCTET_LENGTH, ill->ill_phys_addr_length);
11297
11298 if (!NCE_ISREACHABLE(ncec))
11299 ntme.ipNetToMediaPhysAddress.o_length = 0;
11300 else {
11301 if (ncec->ncec_lladdr != NULL) {
11302 bcopy(ncec->ncec_lladdr,
11303 ntme.ipNetToMediaPhysAddress.o_bytes,
11304 ntme.ipNetToMediaPhysAddress.o_length);
11305 }
11306 }
11307
11308 if (!snmp_append_data2(ird->ird_netmedia.lp_head,
11309 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) {
11310 ip1dbg(("ip_snmp_get2_v4_media: failed to allocate %u bytes\n",
11311 (uint_t)sizeof (ntme)));
11312 }
11313 }
11314
11315 /*
11316 * return (0) if invalid set request, 1 otherwise, including non-tcp requests
11317 */
11318 /* ARGSUSED */
11319 int
11320 ip_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len)
11321 {
11322 switch (level) {
11323 case MIB2_IP:
11324 case MIB2_ICMP:
11325 switch (name) {
11326 default:
11327 break;
11328 }
11329 return (1);
11330 default:
11331 return (1);
11332 }
11333 }
11334
11335 /*
11336 * When there exists both a 64- and 32-bit counter of a particular type
11337 * (i.e., InReceives), only the 64-bit counters are added.
11338 */
11339 void
11340 ip_mib2_add_ip_stats(mib2_ipIfStatsEntry_t *o1, mib2_ipIfStatsEntry_t *o2)
11341 {
11342 UPDATE_MIB(o1, ipIfStatsInHdrErrors, o2->ipIfStatsInHdrErrors);
11343 UPDATE_MIB(o1, ipIfStatsInTooBigErrors, o2->ipIfStatsInTooBigErrors);
11344 UPDATE_MIB(o1, ipIfStatsInNoRoutes, o2->ipIfStatsInNoRoutes);
11345 UPDATE_MIB(o1, ipIfStatsInAddrErrors, o2->ipIfStatsInAddrErrors);
11346 UPDATE_MIB(o1, ipIfStatsInUnknownProtos, o2->ipIfStatsInUnknownProtos);
11347 UPDATE_MIB(o1, ipIfStatsInTruncatedPkts, o2->ipIfStatsInTruncatedPkts);
11348 UPDATE_MIB(o1, ipIfStatsInDiscards, o2->ipIfStatsInDiscards);
11349 UPDATE_MIB(o1, ipIfStatsOutDiscards, o2->ipIfStatsOutDiscards);
11350 UPDATE_MIB(o1, ipIfStatsOutFragOKs, o2->ipIfStatsOutFragOKs);
11351 UPDATE_MIB(o1, ipIfStatsOutFragFails, o2->ipIfStatsOutFragFails);
11352 UPDATE_MIB(o1, ipIfStatsOutFragCreates, o2->ipIfStatsOutFragCreates);
11353 UPDATE_MIB(o1, ipIfStatsReasmReqds, o2->ipIfStatsReasmReqds);
11354 UPDATE_MIB(o1, ipIfStatsReasmOKs, o2->ipIfStatsReasmOKs);
11355 UPDATE_MIB(o1, ipIfStatsReasmFails, o2->ipIfStatsReasmFails);
11356 UPDATE_MIB(o1, ipIfStatsOutNoRoutes, o2->ipIfStatsOutNoRoutes);
11357 UPDATE_MIB(o1, ipIfStatsReasmDuplicates, o2->ipIfStatsReasmDuplicates);
11358 UPDATE_MIB(o1, ipIfStatsReasmPartDups, o2->ipIfStatsReasmPartDups);
11359 UPDATE_MIB(o1, ipIfStatsForwProhibits, o2->ipIfStatsForwProhibits);
11360 UPDATE_MIB(o1, udpInCksumErrs, o2->udpInCksumErrs);
11361 UPDATE_MIB(o1, udpInOverflows, o2->udpInOverflows);
11362 UPDATE_MIB(o1, rawipInOverflows, o2->rawipInOverflows);
11363 UPDATE_MIB(o1, ipIfStatsInWrongIPVersion,
11364 o2->ipIfStatsInWrongIPVersion);
11365 UPDATE_MIB(o1, ipIfStatsOutWrongIPVersion,
11366 o2->ipIfStatsInWrongIPVersion);
11367 UPDATE_MIB(o1, ipIfStatsOutSwitchIPVersion,
11368 o2->ipIfStatsOutSwitchIPVersion);
11369 UPDATE_MIB(o1, ipIfStatsHCInReceives, o2->ipIfStatsHCInReceives);
11370 UPDATE_MIB(o1, ipIfStatsHCInOctets, o2->ipIfStatsHCInOctets);
11371 UPDATE_MIB(o1, ipIfStatsHCInForwDatagrams,
11372 o2->ipIfStatsHCInForwDatagrams);
11373 UPDATE_MIB(o1, ipIfStatsHCInDelivers, o2->ipIfStatsHCInDelivers);
11374 UPDATE_MIB(o1, ipIfStatsHCOutRequests, o2->ipIfStatsHCOutRequests);
11375 UPDATE_MIB(o1, ipIfStatsHCOutForwDatagrams,
11376 o2->ipIfStatsHCOutForwDatagrams);
11377 UPDATE_MIB(o1, ipIfStatsOutFragReqds, o2->ipIfStatsOutFragReqds);
11378 UPDATE_MIB(o1, ipIfStatsHCOutTransmits, o2->ipIfStatsHCOutTransmits);
11379 UPDATE_MIB(o1, ipIfStatsHCOutOctets, o2->ipIfStatsHCOutOctets);
11380 UPDATE_MIB(o1, ipIfStatsHCInMcastPkts, o2->ipIfStatsHCInMcastPkts);
11381 UPDATE_MIB(o1, ipIfStatsHCInMcastOctets, o2->ipIfStatsHCInMcastOctets);
11382 UPDATE_MIB(o1, ipIfStatsHCOutMcastPkts, o2->ipIfStatsHCOutMcastPkts);
11383 UPDATE_MIB(o1, ipIfStatsHCOutMcastOctets,
11384 o2->ipIfStatsHCOutMcastOctets);
11385 UPDATE_MIB(o1, ipIfStatsHCInBcastPkts, o2->ipIfStatsHCInBcastPkts);
11386 UPDATE_MIB(o1, ipIfStatsHCOutBcastPkts, o2->ipIfStatsHCOutBcastPkts);
11387 UPDATE_MIB(o1, ipsecInSucceeded, o2->ipsecInSucceeded);
11388 UPDATE_MIB(o1, ipsecInFailed, o2->ipsecInFailed);
11389 UPDATE_MIB(o1, ipInCksumErrs, o2->ipInCksumErrs);
11390 UPDATE_MIB(o1, tcpInErrs, o2->tcpInErrs);
11391 UPDATE_MIB(o1, udpNoPorts, o2->udpNoPorts);
11392 }
11393
11394 void
11395 ip_mib2_add_icmp6_stats(mib2_ipv6IfIcmpEntry_t *o1, mib2_ipv6IfIcmpEntry_t *o2)
11396 {
11397 UPDATE_MIB(o1, ipv6IfIcmpInMsgs, o2->ipv6IfIcmpInMsgs);
11398 UPDATE_MIB(o1, ipv6IfIcmpInErrors, o2->ipv6IfIcmpInErrors);
11399 UPDATE_MIB(o1, ipv6IfIcmpInDestUnreachs, o2->ipv6IfIcmpInDestUnreachs);
11400 UPDATE_MIB(o1, ipv6IfIcmpInAdminProhibs, o2->ipv6IfIcmpInAdminProhibs);
11401 UPDATE_MIB(o1, ipv6IfIcmpInTimeExcds, o2->ipv6IfIcmpInTimeExcds);
11402 UPDATE_MIB(o1, ipv6IfIcmpInParmProblems, o2->ipv6IfIcmpInParmProblems);
11403 UPDATE_MIB(o1, ipv6IfIcmpInPktTooBigs, o2->ipv6IfIcmpInPktTooBigs);
11404 UPDATE_MIB(o1, ipv6IfIcmpInEchos, o2->ipv6IfIcmpInEchos);
11405 UPDATE_MIB(o1, ipv6IfIcmpInEchoReplies, o2->ipv6IfIcmpInEchoReplies);
11406 UPDATE_MIB(o1, ipv6IfIcmpInRouterSolicits,
11407 o2->ipv6IfIcmpInRouterSolicits);
11408 UPDATE_MIB(o1, ipv6IfIcmpInRouterAdvertisements,
11409 o2->ipv6IfIcmpInRouterAdvertisements);
11410 UPDATE_MIB(o1, ipv6IfIcmpInNeighborSolicits,
11411 o2->ipv6IfIcmpInNeighborSolicits);
11412 UPDATE_MIB(o1, ipv6IfIcmpInNeighborAdvertisements,
11413 o2->ipv6IfIcmpInNeighborAdvertisements);
11414 UPDATE_MIB(o1, ipv6IfIcmpInRedirects, o2->ipv6IfIcmpInRedirects);
11415 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembQueries,
11416 o2->ipv6IfIcmpInGroupMembQueries);
11417 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembResponses,
11418 o2->ipv6IfIcmpInGroupMembResponses);
11419 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembReductions,
11420 o2->ipv6IfIcmpInGroupMembReductions);
11421 UPDATE_MIB(o1, ipv6IfIcmpOutMsgs, o2->ipv6IfIcmpOutMsgs);
11422 UPDATE_MIB(o1, ipv6IfIcmpOutErrors, o2->ipv6IfIcmpOutErrors);
11423 UPDATE_MIB(o1, ipv6IfIcmpOutDestUnreachs,
11424 o2->ipv6IfIcmpOutDestUnreachs);
11425 UPDATE_MIB(o1, ipv6IfIcmpOutAdminProhibs,
11426 o2->ipv6IfIcmpOutAdminProhibs);
11427 UPDATE_MIB(o1, ipv6IfIcmpOutTimeExcds, o2->ipv6IfIcmpOutTimeExcds);
11428 UPDATE_MIB(o1, ipv6IfIcmpOutParmProblems,
11429 o2->ipv6IfIcmpOutParmProblems);
11430 UPDATE_MIB(o1, ipv6IfIcmpOutPktTooBigs, o2->ipv6IfIcmpOutPktTooBigs);
11431 UPDATE_MIB(o1, ipv6IfIcmpOutEchos, o2->ipv6IfIcmpOutEchos);
11432 UPDATE_MIB(o1, ipv6IfIcmpOutEchoReplies, o2->ipv6IfIcmpOutEchoReplies);
11433 UPDATE_MIB(o1, ipv6IfIcmpOutRouterSolicits,
11434 o2->ipv6IfIcmpOutRouterSolicits);
11435 UPDATE_MIB(o1, ipv6IfIcmpOutRouterAdvertisements,
11436 o2->ipv6IfIcmpOutRouterAdvertisements);
11437 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborSolicits,
11438 o2->ipv6IfIcmpOutNeighborSolicits);
11439 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborAdvertisements,
11440 o2->ipv6IfIcmpOutNeighborAdvertisements);
11441 UPDATE_MIB(o1, ipv6IfIcmpOutRedirects, o2->ipv6IfIcmpOutRedirects);
11442 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembQueries,
11443 o2->ipv6IfIcmpOutGroupMembQueries);
11444 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembResponses,
11445 o2->ipv6IfIcmpOutGroupMembResponses);
11446 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembReductions,
11447 o2->ipv6IfIcmpOutGroupMembReductions);
11448 UPDATE_MIB(o1, ipv6IfIcmpInOverflows, o2->ipv6IfIcmpInOverflows);
11449 UPDATE_MIB(o1, ipv6IfIcmpBadHoplimit, o2->ipv6IfIcmpBadHoplimit);
11450 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborAdvertisements,
11451 o2->ipv6IfIcmpInBadNeighborAdvertisements);
11452 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborSolicitations,
11453 o2->ipv6IfIcmpInBadNeighborSolicitations);
11454 UPDATE_MIB(o1, ipv6IfIcmpInBadRedirects, o2->ipv6IfIcmpInBadRedirects);
11455 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembTotal,
11456 o2->ipv6IfIcmpInGroupMembTotal);
11457 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadQueries,
11458 o2->ipv6IfIcmpInGroupMembBadQueries);
11459 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadReports,
11460 o2->ipv6IfIcmpInGroupMembBadReports);
11461 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembOurReports,
11462 o2->ipv6IfIcmpInGroupMembOurReports);
11463 }
11464
11465 /*
11466 * Called before the options are updated to check if this packet will
11467 * be source routed from here.
11468 * This routine assumes that the options are well formed i.e. that they
11469 * have already been checked.
11470 */
11471 boolean_t
11472 ip_source_routed(ipha_t *ipha, ip_stack_t *ipst)
11473 {
11474 ipoptp_t opts;
11475 uchar_t *opt;
11476 uint8_t optval;
11477 uint8_t optlen;
11478 ipaddr_t dst;
11479
11480 if (IS_SIMPLE_IPH(ipha)) {
11481 ip2dbg(("not source routed\n"));
11482 return (B_FALSE);
11483 }
11484 dst = ipha->ipha_dst;
11485 for (optval = ipoptp_first(&opts, ipha);
11486 optval != IPOPT_EOL;
11487 optval = ipoptp_next(&opts)) {
11488 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
11489 opt = opts.ipoptp_cur;
11490 optlen = opts.ipoptp_len;
11491 ip2dbg(("ip_source_routed: opt %d, len %d\n",
11492 optval, optlen));
11493 switch (optval) {
11494 uint32_t off;
11495 case IPOPT_SSRR:
11496 case IPOPT_LSRR:
11497 /*
11498 * If dst is one of our addresses and there are some
11499 * entries left in the source route return (true).
11500 */
11501 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
11502 ip2dbg(("ip_source_routed: not next"
11503 " source route 0x%x\n",
11504 ntohl(dst)));
11505 return (B_FALSE);
11506 }
11507 off = opt[IPOPT_OFFSET];
11508 off--;
11509 if (optlen < IP_ADDR_LEN ||
11510 off > optlen - IP_ADDR_LEN) {
11511 /* End of source route */
11512 ip1dbg(("ip_source_routed: end of SR\n"));
11513 return (B_FALSE);
11514 }
11515 return (B_TRUE);
11516 }
11517 }
11518 ip2dbg(("not source routed\n"));
11519 return (B_FALSE);
11520 }
11521
11522 /*
11523 * ip_unbind is called by the transports to remove a conn from
11524 * the fanout table.
11525 */
11526 void
11527 ip_unbind(conn_t *connp)
11528 {
11529
11530 ASSERT(!MUTEX_HELD(&connp->conn_lock));
11531
11532 if (is_system_labeled() && connp->conn_anon_port) {
11533 (void) tsol_mlp_anon(crgetzone(connp->conn_cred),
11534 connp->conn_mlp_type, connp->conn_proto,
11535 ntohs(connp->conn_lport), B_FALSE);
11536 connp->conn_anon_port = 0;
11537 }
11538 connp->conn_mlp_type = mlptSingle;
11539
11540 ipcl_hash_remove(connp);
11541 }
11542
11543 /*
11544 * Used for deciding the MSS size for the upper layer. Thus
11545 * we need to check the outbound policy values in the conn.
11546 */
11547 int
11548 conn_ipsec_length(conn_t *connp)
11549 {
11550 ipsec_latch_t *ipl;
11551
11552 ipl = connp->conn_latch;
11553 if (ipl == NULL)
11554 return (0);
11555
11556 if (connp->conn_ixa->ixa_ipsec_policy == NULL)
11557 return (0);
11558
11559 return (connp->conn_ixa->ixa_ipsec_policy->ipsp_act->ipa_ovhd);
11560 }
11561
11562 /*
11563 * Returns an estimate of the IPsec headers size. This is used if
11564 * we don't want to call into IPsec to get the exact size.
11565 */
11566 int
11567 ipsec_out_extra_length(ip_xmit_attr_t *ixa)
11568 {
11569 ipsec_action_t *a;
11570
11571 if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE))
11572 return (0);
11573
11574 a = ixa->ixa_ipsec_action;
11575 if (a == NULL) {
11576 ASSERT(ixa->ixa_ipsec_policy != NULL);
11577 a = ixa->ixa_ipsec_policy->ipsp_act;
11578 }
11579 ASSERT(a != NULL);
11580
11581 return (a->ipa_ovhd);
11582 }
11583
11584 /*
11585 * If there are any source route options, return the true final
11586 * destination. Otherwise, return the destination.
11587 */
11588 ipaddr_t
11589 ip_get_dst(ipha_t *ipha)
11590 {
11591 ipoptp_t opts;
11592 uchar_t *opt;
11593 uint8_t optval;
11594 uint8_t optlen;
11595 ipaddr_t dst;
11596 uint32_t off;
11597
11598 dst = ipha->ipha_dst;
11599
11600 if (IS_SIMPLE_IPH(ipha))
11601 return (dst);
11602
11603 for (optval = ipoptp_first(&opts, ipha);
11604 optval != IPOPT_EOL;
11605 optval = ipoptp_next(&opts)) {
11606 opt = opts.ipoptp_cur;
11607 optlen = opts.ipoptp_len;
11608 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
11609 switch (optval) {
11610 case IPOPT_SSRR:
11611 case IPOPT_LSRR:
11612 off = opt[IPOPT_OFFSET];
11613 /*
11614 * If one of the conditions is true, it means
11615 * end of options and dst already has the right
11616 * value.
11617 */
11618 if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) {
11619 off = optlen - IP_ADDR_LEN;
11620 bcopy(&opt[off], &dst, IP_ADDR_LEN);
11621 }
11622 return (dst);
11623 default:
11624 break;
11625 }
11626 }
11627
11628 return (dst);
11629 }
11630
11631 /*
11632 * Outbound IP fragmentation routine.
11633 * Assumes the caller has checked whether or not fragmentation should
11634 * be allowed. Here we copy the DF bit from the header to all the generated
11635 * fragments.
11636 */
11637 int
11638 ip_fragment_v4(mblk_t *mp_orig, nce_t *nce, iaflags_t ixaflags,
11639 uint_t pkt_len, uint32_t max_frag, uint32_t xmit_hint, zoneid_t szone,
11640 zoneid_t nolzid, pfirepostfrag_t postfragfn, uintptr_t *ixa_cookie)
11641 {
11642 int i1;
11643 int hdr_len;
11644 mblk_t *hdr_mp;
11645 ipha_t *ipha;
11646 int ip_data_end;
11647 int len;
11648 mblk_t *mp = mp_orig;
11649 int offset;
11650 ill_t *ill = nce->nce_ill;
11651 ip_stack_t *ipst = ill->ill_ipst;
11652 mblk_t *carve_mp;
11653 uint32_t frag_flag;
11654 uint_t priority = mp->b_band;
11655 int error = 0;
11656
11657 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragReqds);
11658
11659 if (pkt_len != msgdsize(mp)) {
11660 ip0dbg(("Packet length mismatch: %d, %ld\n",
11661 pkt_len, msgdsize(mp)));
11662 freemsg(mp);
11663 return (EINVAL);
11664 }
11665
11666 if (max_frag == 0) {
11667 ip1dbg(("ip_fragment_v4: max_frag is zero. Dropping packet\n"));
11668 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11669 ip_drop_output("FragFails: zero max_frag", mp, ill);
11670 freemsg(mp);
11671 return (EINVAL);
11672 }
11673
11674 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
11675 ipha = (ipha_t *)mp->b_rptr;
11676 ASSERT(ntohs(ipha->ipha_length) == pkt_len);
11677 frag_flag = ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_DF;
11678
11679 /*
11680 * Establish the starting offset. May not be zero if we are fragging
11681 * a fragment that is being forwarded.
11682 */
11683 offset = ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET;
11684
11685 /* TODO why is this test needed? */
11686 if (((max_frag - ntohs(ipha->ipha_length)) & ~7) < 8) {
11687 /* TODO: notify ulp somehow */
11688 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11689 ip_drop_output("FragFails: bad starting offset", mp, ill);
11690 freemsg(mp);
11691 return (EINVAL);
11692 }
11693
11694 hdr_len = IPH_HDR_LENGTH(ipha);
11695 ipha->ipha_hdr_checksum = 0;
11696
11697 /*
11698 * Establish the number of bytes maximum per frag, after putting
11699 * in the header.
11700 */
11701 len = (max_frag - hdr_len) & ~7;
11702
11703 /* Get a copy of the header for the trailing frags */
11704 hdr_mp = ip_fragment_copyhdr((uchar_t *)ipha, hdr_len, offset, ipst,
11705 mp);
11706 if (hdr_mp == NULL) {
11707 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11708 ip_drop_output("FragFails: no hdr_mp", mp, ill);
11709 freemsg(mp);
11710 return (ENOBUFS);
11711 }
11712
11713 /* Store the starting offset, with the MoreFrags flag. */
11714 i1 = offset | IPH_MF | frag_flag;
11715 ipha->ipha_fragment_offset_and_flags = htons((uint16_t)i1);
11716
11717 /* Establish the ending byte offset, based on the starting offset. */
11718 offset <<= 3;
11719 ip_data_end = offset + ntohs(ipha->ipha_length) - hdr_len;
11720
11721 /* Store the length of the first fragment in the IP header. */
11722 i1 = len + hdr_len;
11723 ASSERT(i1 <= IP_MAXPACKET);
11724 ipha->ipha_length = htons((uint16_t)i1);
11725
11726 /*
11727 * Compute the IP header checksum for the first frag. We have to
11728 * watch out that we stop at the end of the header.
11729 */
11730 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
11731
11732 /*
11733 * Now carve off the first frag. Note that this will include the
11734 * original IP header.
11735 */
11736 if (!(mp = ip_carve_mp(&mp_orig, i1))) {
11737 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11738 ip_drop_output("FragFails: could not carve mp", mp_orig, ill);
11739 freeb(hdr_mp);
11740 freemsg(mp_orig);
11741 return (ENOBUFS);
11742 }
11743
11744 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
11745
11746 error = postfragfn(mp, nce, ixaflags, i1, xmit_hint, szone, nolzid,
11747 ixa_cookie);
11748 if (error != 0 && error != EWOULDBLOCK) {
11749 /* No point in sending the other fragments */
11750 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11751 ip_drop_output("FragFails: postfragfn failed", mp_orig, ill);
11752 freeb(hdr_mp);
11753 freemsg(mp_orig);
11754 return (error);
11755 }
11756
11757 /* No need to redo state machine in loop */
11758 ixaflags &= ~IXAF_REACH_CONF;
11759
11760 /* Advance the offset to the second frag starting point. */
11761 offset += len;
11762 /*
11763 * Update hdr_len from the copied header - there might be less options
11764 * in the later fragments.
11765 */
11766 hdr_len = IPH_HDR_LENGTH(hdr_mp->b_rptr);
11767 /* Loop until done. */
11768 for (;;) {
11769 uint16_t offset_and_flags;
11770 uint16_t ip_len;
11771
11772 if (ip_data_end - offset > len) {
11773 /*
11774 * Carve off the appropriate amount from the original
11775 * datagram.
11776 */
11777 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) {
11778 mp = NULL;
11779 break;
11780 }
11781 /*
11782 * More frags after this one. Get another copy
11783 * of the header.
11784 */
11785 if (carve_mp->b_datap->db_ref == 1 &&
11786 hdr_mp->b_wptr - hdr_mp->b_rptr <
11787 carve_mp->b_rptr - carve_mp->b_datap->db_base) {
11788 /* Inline IP header */
11789 carve_mp->b_rptr -= hdr_mp->b_wptr -
11790 hdr_mp->b_rptr;
11791 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr,
11792 hdr_mp->b_wptr - hdr_mp->b_rptr);
11793 mp = carve_mp;
11794 } else {
11795 if (!(mp = copyb(hdr_mp))) {
11796 freemsg(carve_mp);
11797 break;
11798 }
11799 /* Get priority marking, if any. */
11800 mp->b_band = priority;
11801 mp->b_cont = carve_mp;
11802 }
11803 ipha = (ipha_t *)mp->b_rptr;
11804 offset_and_flags = IPH_MF;
11805 } else {
11806 /*
11807 * Last frag. Consume the header. Set len to
11808 * the length of this last piece.
11809 */
11810 len = ip_data_end - offset;
11811
11812 /*
11813 * Carve off the appropriate amount from the original
11814 * datagram.
11815 */
11816 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) {
11817 mp = NULL;
11818 break;
11819 }
11820 if (carve_mp->b_datap->db_ref == 1 &&
11821 hdr_mp->b_wptr - hdr_mp->b_rptr <
11822 carve_mp->b_rptr - carve_mp->b_datap->db_base) {
11823 /* Inline IP header */
11824 carve_mp->b_rptr -= hdr_mp->b_wptr -
11825 hdr_mp->b_rptr;
11826 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr,
11827 hdr_mp->b_wptr - hdr_mp->b_rptr);
11828 mp = carve_mp;
11829 freeb(hdr_mp);
11830 hdr_mp = mp;
11831 } else {
11832 mp = hdr_mp;
11833 /* Get priority marking, if any. */
11834 mp->b_band = priority;
11835 mp->b_cont = carve_mp;
11836 }
11837 ipha = (ipha_t *)mp->b_rptr;
11838 /* A frag of a frag might have IPH_MF non-zero */
11839 offset_and_flags =
11840 ntohs(ipha->ipha_fragment_offset_and_flags) &
11841 IPH_MF;
11842 }
11843 offset_and_flags |= (uint16_t)(offset >> 3);
11844 offset_and_flags |= (uint16_t)frag_flag;
11845 /* Store the offset and flags in the IP header. */
11846 ipha->ipha_fragment_offset_and_flags = htons(offset_and_flags);
11847
11848 /* Store the length in the IP header. */
11849 ip_len = (uint16_t)(len + hdr_len);
11850 ipha->ipha_length = htons(ip_len);
11851
11852 /*
11853 * Set the IP header checksum. Note that mp is just
11854 * the header, so this is easy to pass to ip_csum.
11855 */
11856 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
11857
11858 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates);
11859
11860 error = postfragfn(mp, nce, ixaflags, ip_len, xmit_hint, szone,
11861 nolzid, ixa_cookie);
11862 /* All done if we just consumed the hdr_mp. */
11863 if (mp == hdr_mp) {
11864 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragOKs);
11865 return (error);
11866 }
11867 if (error != 0 && error != EWOULDBLOCK) {
11868 DTRACE_PROBE2(ip__xmit__frag__fail, ill_t *, ill,
11869 mblk_t *, hdr_mp);
11870 /* No point in sending the other fragments */
11871 break;
11872 }
11873
11874 /* Otherwise, advance and loop. */
11875 offset += len;
11876 }
11877 /* Clean up following allocation failure. */
11878 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails);
11879 ip_drop_output("FragFails: loop ended", NULL, ill);
11880 if (mp != hdr_mp)
11881 freeb(hdr_mp);
11882 if (mp != mp_orig)
11883 freemsg(mp_orig);
11884 return (error);
11885 }
11886
11887 /*
11888 * Copy the header plus those options which have the copy bit set
11889 */
11890 static mblk_t *
11891 ip_fragment_copyhdr(uchar_t *rptr, int hdr_len, int offset, ip_stack_t *ipst,
11892 mblk_t *src)
11893 {
11894 mblk_t *mp;
11895 uchar_t *up;
11896
11897 /*
11898 * Quick check if we need to look for options without the copy bit
11899 * set
11900 */
11901 mp = allocb_tmpl(ipst->ips_ip_wroff_extra + hdr_len, src);
11902 if (!mp)
11903 return (mp);
11904 mp->b_rptr += ipst->ips_ip_wroff_extra;
11905 if (hdr_len == IP_SIMPLE_HDR_LENGTH || offset != 0) {
11906 bcopy(rptr, mp->b_rptr, hdr_len);
11907 mp->b_wptr += hdr_len + ipst->ips_ip_wroff_extra;
11908 return (mp);
11909 }
11910 up = mp->b_rptr;
11911 bcopy(rptr, up, IP_SIMPLE_HDR_LENGTH);
11912 up += IP_SIMPLE_HDR_LENGTH;
11913 rptr += IP_SIMPLE_HDR_LENGTH;
11914 hdr_len -= IP_SIMPLE_HDR_LENGTH;
11915 while (hdr_len > 0) {
11916 uint32_t optval;
11917 uint32_t optlen;
11918
11919 optval = *rptr;
11920 if (optval == IPOPT_EOL)
11921 break;
11922 if (optval == IPOPT_NOP)
11923 optlen = 1;
11924 else
11925 optlen = rptr[1];
11926 if (optval & IPOPT_COPY) {
11927 bcopy(rptr, up, optlen);
11928 up += optlen;
11929 }
11930 rptr += optlen;
11931 hdr_len -= optlen;
11932 }
11933 /*
11934 * Make sure that we drop an even number of words by filling
11935 * with EOL to the next word boundary.
11936 */
11937 for (hdr_len = up - (mp->b_rptr + IP_SIMPLE_HDR_LENGTH);
11938 hdr_len & 0x3; hdr_len++)
11939 *up++ = IPOPT_EOL;
11940 mp->b_wptr = up;
11941 /* Update header length */
11942 mp->b_rptr[0] = (uint8_t)((IP_VERSION << 4) | ((up - mp->b_rptr) >> 2));
11943 return (mp);
11944 }
11945
11946 /*
11947 * Update any source route, record route, or timestamp options when
11948 * sending a packet back to ourselves.
11949 * Check that we are at end of strict source route.
11950 * The options have been sanity checked by ip_output_options().
11951 */
11952 void
11953 ip_output_local_options(ipha_t *ipha, ip_stack_t *ipst)
11954 {
11955 ipoptp_t opts;
11956 uchar_t *opt;
11957 uint8_t optval;
11958 uint8_t optlen;
11959 ipaddr_t dst;
11960 uint32_t ts;
11961 timestruc_t now;
11962 uint32_t off = 0;
11963
11964 for (optval = ipoptp_first(&opts, ipha);
11965 optval != IPOPT_EOL;
11966 optval = ipoptp_next(&opts)) {
11967 opt = opts.ipoptp_cur;
11968 optlen = opts.ipoptp_len;
11969 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
11970 switch (optval) {
11971 case IPOPT_SSRR:
11972 case IPOPT_LSRR:
11973 off = opt[IPOPT_OFFSET];
11974 off--;
11975 if (optlen < IP_ADDR_LEN ||
11976 off > optlen - IP_ADDR_LEN) {
11977 /* End of source route */
11978 break;
11979 }
11980 /*
11981 * This will only happen if two consecutive entries
11982 * in the source route contains our address or if
11983 * it is a packet with a loose source route which
11984 * reaches us before consuming the whole source route
11985 */
11986
11987 if (optval == IPOPT_SSRR) {
11988 return;
11989 }
11990 /*
11991 * Hack: instead of dropping the packet truncate the
11992 * source route to what has been used by filling the
11993 * rest with IPOPT_NOP.
11994 */
11995 opt[IPOPT_OLEN] = (uint8_t)off;
11996 while (off < optlen) {
11997 opt[off++] = IPOPT_NOP;
11998 }
11999 break;
12000 case IPOPT_RR:
12001 off = opt[IPOPT_OFFSET];
12002 off--;
12003 if (optlen < IP_ADDR_LEN ||
12004 off > optlen - IP_ADDR_LEN) {
12005 /* No more room - ignore */
12006 ip1dbg((
12007 "ip_output_local_options: end of RR\n"));
12008 break;
12009 }
12010 dst = htonl(INADDR_LOOPBACK);
12011 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN);
12012 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
12013 break;
12014 case IPOPT_TS:
12015 /* Insert timestamp if there is romm */
12016 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
12017 case IPOPT_TS_TSONLY:
12018 off = IPOPT_TS_TIMELEN;
12019 break;
12020 case IPOPT_TS_PRESPEC:
12021 case IPOPT_TS_PRESPEC_RFC791:
12022 /* Verify that the address matched */
12023 off = opt[IPOPT_OFFSET] - 1;
12024 bcopy((char *)opt + off, &dst, IP_ADDR_LEN);
12025 if (ip_type_v4(dst, ipst) != IRE_LOCAL) {
12026 /* Not for us */
12027 break;
12028 }
12029 /* FALLTHROUGH */
12030 case IPOPT_TS_TSANDADDR:
12031 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
12032 break;
12033 default:
12034 /*
12035 * ip_*put_options should have already
12036 * dropped this packet.
12037 */
12038 cmn_err(CE_PANIC, "ip_output_local_options: "
12039 "unknown IT - bug in ip_output_options?\n");
12040 }
12041 if (opt[IPOPT_OFFSET] - 1 + off > optlen) {
12042 /* Increase overflow counter */
12043 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1;
12044 opt[IPOPT_POS_OV_FLG] = (uint8_t)
12045 (opt[IPOPT_POS_OV_FLG] & 0x0F) |
12046 (off << 4);
12047 break;
12048 }
12049 off = opt[IPOPT_OFFSET] - 1;
12050 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
12051 case IPOPT_TS_PRESPEC:
12052 case IPOPT_TS_PRESPEC_RFC791:
12053 case IPOPT_TS_TSANDADDR:
12054 dst = htonl(INADDR_LOOPBACK);
12055 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN);
12056 opt[IPOPT_OFFSET] += IP_ADDR_LEN;
12057 /* FALLTHROUGH */
12058 case IPOPT_TS_TSONLY:
12059 off = opt[IPOPT_OFFSET] - 1;
12060 /* Compute # of milliseconds since midnight */
12061 gethrestime(&now);
12062 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
12063 NSEC2MSEC(now.tv_nsec);
12064 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN);
12065 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN;
12066 break;
12067 }
12068 break;
12069 }
12070 }
12071 }
12072
12073 /*
12074 * Prepend an M_DATA fastpath header, and if none present prepend a
12075 * DL_UNITDATA_REQ. Frees the mblk on failure.
12076 *
12077 * nce_dlur_mp and nce_fp_mp can not disappear once they have been set.
12078 * If there is a change to them, the nce will be deleted (condemned) and
12079 * a new nce_t will be created when packets are sent. Thus we need no locks
12080 * to access those fields.
12081 *
12082 * We preserve b_band to support IPQoS. If a DL_UNITDATA_REQ is prepended
12083 * we place b_band in dl_priority.dl_max.
12084 */
12085 static mblk_t *
12086 ip_xmit_attach_llhdr(mblk_t *mp, nce_t *nce)
12087 {
12088 uint_t hlen;
12089 mblk_t *mp1;
12090 uint_t priority;
12091 uchar_t *rptr;
12092
12093 rptr = mp->b_rptr;
12094
12095 ASSERT(DB_TYPE(mp) == M_DATA);
12096 priority = mp->b_band;
12097
12098 ASSERT(nce != NULL);
12099 if ((mp1 = nce->nce_fp_mp) != NULL) {
12100 hlen = MBLKL(mp1);
12101 /*
12102 * Check if we have enough room to prepend fastpath
12103 * header
12104 */
12105 if (hlen != 0 && (rptr - mp->b_datap->db_base) >= hlen) {
12106 rptr -= hlen;
12107 bcopy(mp1->b_rptr, rptr, hlen);
12108 /*
12109 * Set the b_rptr to the start of the link layer
12110 * header
12111 */
12112 mp->b_rptr = rptr;
12113 return (mp);
12114 }
12115 mp1 = copyb(mp1);
12116 if (mp1 == NULL) {
12117 ill_t *ill = nce->nce_ill;
12118
12119 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12120 ip_drop_output("ipIfStatsOutDiscards", mp, ill);
12121 freemsg(mp);
12122 return (NULL);
12123 }
12124 mp1->b_band = priority;
12125 mp1->b_cont = mp;
12126 DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp);
12127 DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp);
12128 DB_CKSUMEND(mp1) = DB_CKSUMEND(mp);
12129 DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp);
12130 DB_LSOMSS(mp1) = DB_LSOMSS(mp);
12131 DTRACE_PROBE1(ip__xmit__copyb, (mblk_t *), mp1);
12132 /*
12133 * XXX disable ICK_VALID and compute checksum
12134 * here; can happen if nce_fp_mp changes and
12135 * it can't be copied now due to insufficient
12136 * space. (unlikely, fp mp can change, but it
12137 * does not increase in length)
12138 */
12139 return (mp1);
12140 }
12141 mp1 = copyb(nce->nce_dlur_mp);
12142
12143 if (mp1 == NULL) {
12144 ill_t *ill = nce->nce_ill;
12145
12146 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12147 ip_drop_output("ipIfStatsOutDiscards", mp, ill);
12148 freemsg(mp);
12149 return (NULL);
12150 }
12151 mp1->b_cont = mp;
12152 if (priority != 0) {
12153 mp1->b_band = priority;
12154 ((dl_unitdata_req_t *)(mp1->b_rptr))->dl_priority.dl_max =
12155 priority;
12156 }
12157 return (mp1);
12158 }
12159
12160 /*
12161 * Finish the outbound IPsec processing. This function is called from
12162 * ipsec_out_process() if the IPsec packet was processed
12163 * synchronously, or from {ah,esp}_kcf_callback_outbound() if it was processed
12164 * asynchronously.
12165 *
12166 * This is common to IPv4 and IPv6.
12167 */
12168 int
12169 ip_output_post_ipsec(mblk_t *mp, ip_xmit_attr_t *ixa)
12170 {
12171 iaflags_t ixaflags = ixa->ixa_flags;
12172 uint_t pktlen;
12173
12174
12175 /* AH/ESP don't update ixa_pktlen when they modify the packet */
12176 if (ixaflags & IXAF_IS_IPV4) {
12177 ipha_t *ipha = (ipha_t *)mp->b_rptr;
12178
12179 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
12180 pktlen = ntohs(ipha->ipha_length);
12181 } else {
12182 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
12183
12184 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
12185 pktlen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
12186 }
12187
12188 /*
12189 * We release any hard reference on the SAs here to make
12190 * sure the SAs can be garbage collected. ipsr_sa has a soft reference
12191 * on the SAs.
12192 * If in the future we want the hard latching of the SAs in the
12193 * ip_xmit_attr_t then we should remove this.
12194 */
12195 if (ixa->ixa_ipsec_esp_sa != NULL) {
12196 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
12197 ixa->ixa_ipsec_esp_sa = NULL;
12198 }
12199 if (ixa->ixa_ipsec_ah_sa != NULL) {
12200 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
12201 ixa->ixa_ipsec_ah_sa = NULL;
12202 }
12203
12204 /* Do we need to fragment? */
12205 if ((ixa->ixa_flags & IXAF_IPV6_ADD_FRAGHDR) ||
12206 pktlen > ixa->ixa_fragsize) {
12207 if (ixaflags & IXAF_IS_IPV4) {
12208 ASSERT(!(ixa->ixa_flags & IXAF_IPV6_ADD_FRAGHDR));
12209 /*
12210 * We check for the DF case in ipsec_out_process
12211 * hence this only handles the non-DF case.
12212 */
12213 return (ip_fragment_v4(mp, ixa->ixa_nce, ixa->ixa_flags,
12214 pktlen, ixa->ixa_fragsize,
12215 ixa->ixa_xmit_hint, ixa->ixa_zoneid,
12216 ixa->ixa_no_loop_zoneid, ixa->ixa_postfragfn,
12217 &ixa->ixa_cookie));
12218 } else {
12219 mp = ip_fraghdr_add_v6(mp, ixa->ixa_ident, ixa);
12220 if (mp == NULL) {
12221 /* MIB and ip_drop_output already done */
12222 return (ENOMEM);
12223 }
12224 pktlen += sizeof (ip6_frag_t);
12225 if (pktlen > ixa->ixa_fragsize) {
12226 return (ip_fragment_v6(mp, ixa->ixa_nce,
12227 ixa->ixa_flags, pktlen,
12228 ixa->ixa_fragsize, ixa->ixa_xmit_hint,
12229 ixa->ixa_zoneid, ixa->ixa_no_loop_zoneid,
12230 ixa->ixa_postfragfn, &ixa->ixa_cookie));
12231 }
12232 }
12233 }
12234 return ((ixa->ixa_postfragfn)(mp, ixa->ixa_nce, ixa->ixa_flags,
12235 pktlen, ixa->ixa_xmit_hint, ixa->ixa_zoneid,
12236 ixa->ixa_no_loop_zoneid, NULL));
12237 }
12238
12239 /*
12240 * Finish the inbound IPsec processing. This function is called from
12241 * ipsec_out_process() if the IPsec packet was processed
12242 * synchronously, or from {ah,esp}_kcf_callback_outbound() if it was processed
12243 * asynchronously.
12244 *
12245 * This is common to IPv4 and IPv6.
12246 */
12247 void
12248 ip_input_post_ipsec(mblk_t *mp, ip_recv_attr_t *ira)
12249 {
12250 iaflags_t iraflags = ira->ira_flags;
12251
12252 /* Length might have changed */
12253 if (iraflags & IRAF_IS_IPV4) {
12254 ipha_t *ipha = (ipha_t *)mp->b_rptr;
12255
12256 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
12257 ira->ira_pktlen = ntohs(ipha->ipha_length);
12258 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
12259 ira->ira_protocol = ipha->ipha_protocol;
12260
12261 ip_fanout_v4(mp, ipha, ira);
12262 } else {
12263 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
12264 uint8_t *nexthdrp;
12265
12266 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
12267 ira->ira_pktlen = ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN;
12268 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ira->ira_ip_hdr_length,
12269 &nexthdrp)) {
12270 /* Malformed packet */
12271 BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
12272 ip_drop_input("ipIfStatsInDiscards", mp, ira->ira_ill);
12273 freemsg(mp);
12274 return;
12275 }
12276 ira->ira_protocol = *nexthdrp;
12277 ip_fanout_v6(mp, ip6h, ira);
12278 }
12279 }
12280
12281 /*
12282 * Select which AH & ESP SA's to use (if any) for the outbound packet.
12283 *
12284 * If this function returns B_TRUE, the requested SA's have been filled
12285 * into the ixa_ipsec_*_sa pointers.
12286 *
12287 * If the function returns B_FALSE, the packet has been "consumed", most
12288 * likely by an ACQUIRE sent up via PF_KEY to a key management daemon.
12289 *
12290 * The SA references created by the protocol-specific "select"
12291 * function will be released in ip_output_post_ipsec.
12292 */
12293 static boolean_t
12294 ipsec_out_select_sa(mblk_t *mp, ip_xmit_attr_t *ixa)
12295 {
12296 boolean_t need_ah_acquire = B_FALSE, need_esp_acquire = B_FALSE;
12297 ipsec_policy_t *pp;
12298 ipsec_action_t *ap;
12299
12300 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE);
12301 ASSERT((ixa->ixa_ipsec_policy != NULL) ||
12302 (ixa->ixa_ipsec_action != NULL));
12303
12304 ap = ixa->ixa_ipsec_action;
12305 if (ap == NULL) {
12306 pp = ixa->ixa_ipsec_policy;
12307 ASSERT(pp != NULL);
12308 ap = pp->ipsp_act;
12309 ASSERT(ap != NULL);
12310 }
12311
12312 /*
12313 * We have an action. now, let's select SA's.
12314 * A side effect of setting ixa_ipsec_*_sa is that it will
12315 * be cached in the conn_t.
12316 */
12317 if (ap->ipa_want_esp) {
12318 if (ixa->ixa_ipsec_esp_sa == NULL) {
12319 need_esp_acquire = !ipsec_outbound_sa(mp, ixa,
12320 IPPROTO_ESP);
12321 }
12322 ASSERT(need_esp_acquire || ixa->ixa_ipsec_esp_sa != NULL);
12323 }
12324
12325 if (ap->ipa_want_ah) {
12326 if (ixa->ixa_ipsec_ah_sa == NULL) {
12327 need_ah_acquire = !ipsec_outbound_sa(mp, ixa,
12328 IPPROTO_AH);
12329 }
12330 ASSERT(need_ah_acquire || ixa->ixa_ipsec_ah_sa != NULL);
12331 /*
12332 * The ESP and AH processing order needs to be preserved
12333 * when both protocols are required (ESP should be applied
12334 * before AH for an outbound packet). Force an ESP ACQUIRE
12335 * when both ESP and AH are required, and an AH ACQUIRE
12336 * is needed.
12337 */
12338 if (ap->ipa_want_esp && need_ah_acquire)
12339 need_esp_acquire = B_TRUE;
12340 }
12341
12342 /*
12343 * Send an ACQUIRE (extended, regular, or both) if we need one.
12344 * Release SAs that got referenced, but will not be used until we
12345 * acquire _all_ of the SAs we need.
12346 */
12347 if (need_ah_acquire || need_esp_acquire) {
12348 if (ixa->ixa_ipsec_ah_sa != NULL) {
12349 IPSA_REFRELE(ixa->ixa_ipsec_ah_sa);
12350 ixa->ixa_ipsec_ah_sa = NULL;
12351 }
12352 if (ixa->ixa_ipsec_esp_sa != NULL) {
12353 IPSA_REFRELE(ixa->ixa_ipsec_esp_sa);
12354 ixa->ixa_ipsec_esp_sa = NULL;
12355 }
12356
12357 sadb_acquire(mp, ixa, need_ah_acquire, need_esp_acquire);
12358 return (B_FALSE);
12359 }
12360
12361 return (B_TRUE);
12362 }
12363
12364 /*
12365 * Handle IPsec output processing.
12366 * This function is only entered once for a given packet.
12367 * We try to do things synchronously, but if we need to have user-level
12368 * set up SAs, or ESP or AH uses asynchronous kEF, then the operation
12369 * will be completed
12370 * - when the SAs are added in esp_add_sa_finish/ah_add_sa_finish
12371 * - when asynchronous ESP is done it will do AH
12372 *
12373 * In all cases we come back in ip_output_post_ipsec() to fragment and
12374 * send out the packet.
12375 */
12376 int
12377 ipsec_out_process(mblk_t *mp, ip_xmit_attr_t *ixa)
12378 {
12379 ill_t *ill = ixa->ixa_nce->nce_ill;
12380 ip_stack_t *ipst = ixa->ixa_ipst;
12381 ipsec_stack_t *ipss;
12382 ipsec_policy_t *pp;
12383 ipsec_action_t *ap;
12384
12385 ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE);
12386
12387 ASSERT((ixa->ixa_ipsec_policy != NULL) ||
12388 (ixa->ixa_ipsec_action != NULL));
12389
12390 ipss = ipst->ips_netstack->netstack_ipsec;
12391 if (!ipsec_loaded(ipss)) {
12392 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12393 ip_drop_packet(mp, B_TRUE, ill,
12394 DROPPER(ipss, ipds_ip_ipsec_not_loaded),
12395 &ipss->ipsec_dropper);
12396 return (ENOTSUP);
12397 }
12398
12399 ap = ixa->ixa_ipsec_action;
12400 if (ap == NULL) {
12401 pp = ixa->ixa_ipsec_policy;
12402 ASSERT(pp != NULL);
12403 ap = pp->ipsp_act;
12404 ASSERT(ap != NULL);
12405 }
12406
12407 /* Handle explicit drop action and bypass. */
12408 switch (ap->ipa_act.ipa_type) {
12409 case IPSEC_ACT_DISCARD:
12410 case IPSEC_ACT_REJECT:
12411 ip_drop_packet(mp, B_FALSE, ill,
12412 DROPPER(ipss, ipds_spd_explicit), &ipss->ipsec_spd_dropper);
12413 return (EHOSTUNREACH); /* IPsec policy failure */
12414 case IPSEC_ACT_BYPASS:
12415 return (ip_output_post_ipsec(mp, ixa));
12416 }
12417
12418 /*
12419 * The order of processing is first insert a IP header if needed.
12420 * Then insert the ESP header and then the AH header.
12421 */
12422 if ((ixa->ixa_flags & IXAF_IS_IPV4) && ap->ipa_want_se) {
12423 /*
12424 * First get the outer IP header before sending
12425 * it to ESP.
12426 */
12427 ipha_t *oipha, *iipha;
12428 mblk_t *outer_mp, *inner_mp;
12429
12430 if ((outer_mp = allocb(sizeof (ipha_t), BPRI_HI)) == NULL) {
12431 (void) mi_strlog(ill->ill_rq, 0,
12432 SL_ERROR|SL_TRACE|SL_CONSOLE,
12433 "ipsec_out_process: "
12434 "Self-Encapsulation failed: Out of memory\n");
12435 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
12436 ip_drop_output("ipIfStatsOutDiscards", mp, ill);
12437 freemsg(mp);
12438 return (ENOBUFS);
12439 }
12440 inner_mp = mp;
12441 ASSERT(inner_mp->b_datap->db_type == M_DATA);
12442 oipha = (ipha_t *)outer_mp->b_rptr;
12443 iipha = (ipha_t *)inner_mp->b_rptr;
12444 *oipha = *iipha;
12445 outer_mp->b_wptr += sizeof (ipha_t);
12446 oipha->ipha_length = htons(ntohs(iipha->ipha_length) +
12447 sizeof (ipha_t));
12448 oipha->ipha_protocol = IPPROTO_ENCAP;
12449 oipha->ipha_version_and_hdr_length =
12450 IP_SIMPLE_HDR_VERSION;
12451 oipha->ipha_hdr_checksum = 0;
12452 oipha->ipha_hdr_checksum = ip_csum_hdr(oipha);
12453 outer_mp->b_cont = inner_mp;
12454 mp = outer_mp;
12455
12456 ixa->ixa_flags |= IXAF_IPSEC_TUNNEL;
12457 }
12458
12459 /* If we need to wait for a SA then we can't return any errno */
12460 if (((ap->ipa_want_ah && (ixa->ixa_ipsec_ah_sa == NULL)) ||
12461 (ap->ipa_want_esp && (ixa->ixa_ipsec_esp_sa == NULL))) &&
12462 !ipsec_out_select_sa(mp, ixa))
12463 return (0);
12464
12465 /*
12466 * By now, we know what SA's to use. Toss over to ESP & AH
12467 * to do the heavy lifting.
12468 */
12469 if (ap->ipa_want_esp) {
12470 ASSERT(ixa->ixa_ipsec_esp_sa != NULL);
12471
12472 mp = ixa->ixa_ipsec_esp_sa->ipsa_output_func(mp, ixa);
12473 if (mp == NULL) {
12474 /*
12475 * Either it failed or is pending. In the former case
12476 * ipIfStatsInDiscards was increased.
12477 */
12478 return (0);
12479 }
12480 }
12481
12482 if (ap->ipa_want_ah) {
12483 ASSERT(ixa->ixa_ipsec_ah_sa != NULL);
12484
12485 mp = ixa->ixa_ipsec_ah_sa->ipsa_output_func(mp, ixa);
12486 if (mp == NULL) {
12487 /*
12488 * Either it failed or is pending. In the former case
12489 * ipIfStatsInDiscards was increased.
12490 */
12491 return (0);
12492 }
12493 }
12494 /*
12495 * We are done with IPsec processing. Send it over
12496 * the wire.
12497 */
12498 return (ip_output_post_ipsec(mp, ixa));
12499 }
12500
12501 /*
12502 * ioctls that go through a down/up sequence may need to wait for the down
12503 * to complete. This involves waiting for the ire and ipif refcnts to go down
12504 * to zero. Subsequently the ioctl is restarted from ipif_ill_refrele_tail.
12505 */
12506 /* ARGSUSED */
12507 void
12508 ip_reprocess_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
12509 {
12510 struct iocblk *iocp;
12511 mblk_t *mp1;
12512 ip_ioctl_cmd_t *ipip;
12513 int err;
12514 sin_t *sin;
12515 struct lifreq *lifr;
12516 struct ifreq *ifr;
12517
12518 iocp = (struct iocblk *)mp->b_rptr;
12519 ASSERT(ipsq != NULL);
12520 /* Existence of mp1 verified in ip_wput_nondata */
12521 mp1 = mp->b_cont->b_cont;
12522 ipip = ip_sioctl_lookup(iocp->ioc_cmd);
12523 if (ipip->ipi_cmd == SIOCSLIFNAME || ipip->ipi_cmd == IF_UNITSEL) {
12524 /*
12525 * Special case where ipx_current_ipif is not set:
12526 * ill_phyint_reinit merged the v4 and v6 into a single ipsq.
12527 * We are here as were not able to complete the operation in
12528 * ipif_set_values because we could not become exclusive on
12529 * the new ipsq.
12530 */
12531 ill_t *ill = q->q_ptr;
12532 ipsq_current_start(ipsq, ill->ill_ipif, ipip->ipi_cmd);
12533 }
12534 ASSERT(ipsq->ipsq_xop->ipx_current_ipif != NULL);
12535
12536 if (ipip->ipi_cmd_type == IF_CMD) {
12537 /* This a old style SIOC[GS]IF* command */
12538 ifr = (struct ifreq *)mp1->b_rptr;
12539 sin = (sin_t *)&ifr->ifr_addr;
12540 } else if (ipip->ipi_cmd_type == LIF_CMD) {
12541 /* This a new style SIOC[GS]LIF* command */
12542 lifr = (struct lifreq *)mp1->b_rptr;
12543 sin = (sin_t *)&lifr->lifr_addr;
12544 } else {
12545 sin = NULL;
12546 }
12547
12548 err = (*ipip->ipi_func_restart)(ipsq->ipsq_xop->ipx_current_ipif, sin,
12549 q, mp, ipip, mp1->b_rptr);
12550
12551 DTRACE_PROBE4(ipif__ioctl, char *, "ip_reprocess_ioctl finish",
12552 int, ipip->ipi_cmd,
12553 ill_t *, ipsq->ipsq_xop->ipx_current_ipif->ipif_ill,
12554 ipif_t *, ipsq->ipsq_xop->ipx_current_ipif);
12555
12556 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq);
12557 }
12558
12559 /*
12560 * ioctl processing
12561 *
12562 * ioctl processing starts with ip_sioctl_copyin_setup(), which looks up
12563 * the ioctl command in the ioctl tables, determines the copyin data size
12564 * from the ipi_copyin_size field, and does an mi_copyin() of that size.
12565 *
12566 * ioctl processing then continues when the M_IOCDATA makes its way down to
12567 * ip_wput_nondata(). The ioctl is looked up again in the ioctl table, its
12568 * associated 'conn' is refheld till the end of the ioctl and the general
12569 * ioctl processing function ip_process_ioctl() is called to extract the
12570 * arguments and process the ioctl. To simplify extraction, ioctl commands
12571 * are "typed" based on the arguments they take (e.g., LIF_CMD which takes a
12572 * `struct lifreq'), and a common extract function (e.g., ip_extract_lifreq())
12573 * is used to extract the ioctl's arguments.
12574 *
12575 * ip_process_ioctl determines if the ioctl needs to be serialized, and if
12576 * so goes thru the serialization primitive ipsq_try_enter. Then the
12577 * appropriate function to handle the ioctl is called based on the entry in
12578 * the ioctl table. ioctl completion is encapsulated in ip_ioctl_finish
12579 * which also refreleases the 'conn' that was refheld at the start of the
12580 * ioctl. Finally ipsq_exit is called if needed to exit the ipsq.
12581 *
12582 * Many exclusive ioctls go thru an internal down up sequence as part of
12583 * the operation. For example an attempt to change the IP address of an
12584 * ipif entails ipif_down, set address, ipif_up. Bringing down the interface
12585 * does all the cleanup such as deleting all ires that use this address.
12586 * Then we need to wait till all references to the interface go away.
12587 */
12588 void
12589 ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12590 {
12591 struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
12592 ip_ioctl_cmd_t *ipip = arg;
12593 ip_extract_func_t *extract_funcp;
12594 cmd_info_t ci;
12595 int err;
12596 boolean_t entered_ipsq = B_FALSE;
12597
12598 ip3dbg(("ip_process_ioctl: ioctl %X\n", iocp->ioc_cmd));
12599
12600 if (ipip == NULL)
12601 ipip = ip_sioctl_lookup(iocp->ioc_cmd);
12602
12603 /*
12604 * SIOCLIFADDIF needs to go thru a special path since the
12605 * ill may not exist yet. This happens in the case of lo0
12606 * which is created using this ioctl.
12607 */
12608 if (ipip->ipi_cmd == SIOCLIFADDIF) {
12609 err = ip_sioctl_addif(NULL, NULL, q, mp, NULL, NULL);
12610 DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish",
12611 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL);
12612 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);
12613 return;
12614 }
12615
12616 ci.ci_ipif = NULL;
12617 extract_funcp = NULL;
12618 switch (ipip->ipi_cmd_type) {
12619 case MISC_CMD:
12620 case MSFILT_CMD:
12621 /*
12622 * All MISC_CMD ioctls come in here -- e.g. SIOCGLIFCONF.
12623 */
12624 if (ipip->ipi_cmd == IF_UNITSEL) {
12625 /* ioctl comes down the ill */
12626 ci.ci_ipif = ((ill_t *)q->q_ptr)->ill_ipif;
12627 ipif_refhold(ci.ci_ipif);
12628 }
12629 err = 0;
12630 ci.ci_sin = NULL;
12631 ci.ci_sin6 = NULL;
12632 ci.ci_lifr = NULL;
12633 extract_funcp = NULL;
12634 break;
12635
12636 case IF_CMD:
12637 case LIF_CMD:
12638 extract_funcp = ip_extract_lifreq;
12639 break;
12640
12641 case ARP_CMD:
12642 case XARP_CMD:
12643 extract_funcp = ip_extract_arpreq;
12644 break;
12645
12646 default:
12647 ASSERT(0);
12648 }
12649
12650 if (extract_funcp != NULL) {
12651 err = (*extract_funcp)(q, mp, ipip, &ci);
12652 if (err != 0) {
12653 DTRACE_PROBE4(ipif__ioctl,
12654 char *, "ip_process_ioctl finish err",
12655 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL);
12656 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);
12657 return;
12658 }
12659
12660 /*
12661 * All of the extraction functions return a refheld ipif.
12662 */
12663 ASSERT(ci.ci_ipif != NULL);
12664 }
12665
12666 if (!(ipip->ipi_flags & IPI_WR)) {
12667 /*
12668 * A return value of EINPROGRESS means the ioctl is
12669 * either queued and waiting for some reason or has
12670 * already completed.
12671 */
12672 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip,
12673 ci.ci_lifr);
12674 if (ci.ci_ipif != NULL) {
12675 DTRACE_PROBE4(ipif__ioctl,
12676 char *, "ip_process_ioctl finish RD",
12677 int, ipip->ipi_cmd, ill_t *, ci.ci_ipif->ipif_ill,
12678 ipif_t *, ci.ci_ipif);
12679 ipif_refrele(ci.ci_ipif);
12680 } else {
12681 DTRACE_PROBE4(ipif__ioctl,
12682 char *, "ip_process_ioctl finish RD",
12683 int, ipip->ipi_cmd, ill_t *, NULL, ipif_t *, NULL);
12684 }
12685 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL);
12686 return;
12687 }
12688
12689 ASSERT(ci.ci_ipif != NULL);
12690
12691 /*
12692 * If ipsq is non-NULL, we are already being called exclusively
12693 */
12694 ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq));
12695 if (ipsq == NULL) {
12696 ipsq = ipsq_try_enter(ci.ci_ipif, NULL, q, mp, ip_process_ioctl,
12697 NEW_OP, B_TRUE);
12698 if (ipsq == NULL) {
12699 ipif_refrele(ci.ci_ipif);
12700 return;
12701 }
12702 entered_ipsq = B_TRUE;
12703 }
12704 /*
12705 * Release the ipif so that ipif_down and friends that wait for
12706 * references to go away are not misled about the current ipif_refcnt
12707 * values. We are writer so we can access the ipif even after releasing
12708 * the ipif.
12709 */
12710 ipif_refrele(ci.ci_ipif);
12711
12712 ipsq_current_start(ipsq, ci.ci_ipif, ipip->ipi_cmd);
12713
12714 /*
12715 * A return value of EINPROGRESS means the ioctl is
12716 * either queued and waiting for some reason or has
12717 * already completed.
12718 */
12719 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, ci.ci_lifr);
12720
12721 DTRACE_PROBE4(ipif__ioctl, char *, "ip_process_ioctl finish WR",
12722 int, ipip->ipi_cmd,
12723 ill_t *, ci.ci_ipif == NULL ? NULL : ci.ci_ipif->ipif_ill,
12724 ipif_t *, ci.ci_ipif);
12725 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq);
12726
12727 if (entered_ipsq)
12728 ipsq_exit(ipsq);
12729 }
12730
12731 /*
12732 * Complete the ioctl. Typically ioctls use the mi package and need to
12733 * do mi_copyout/mi_copy_done.
12734 */
12735 void
12736 ip_ioctl_finish(queue_t *q, mblk_t *mp, int err, int mode, ipsq_t *ipsq)
12737 {
12738 conn_t *connp = NULL;
12739
12740 if (err == EINPROGRESS)
12741 return;
12742
12743 if (CONN_Q(q)) {
12744 connp = Q_TO_CONN(q);
12745 ASSERT(connp->conn_ref >= 2);
12746 }
12747
12748 switch (mode) {
12749 case COPYOUT:
12750 if (err == 0)
12751 mi_copyout(q, mp);
12752 else
12753 mi_copy_done(q, mp, err);
12754 break;
12755
12756 case NO_COPYOUT:
12757 mi_copy_done(q, mp, err);
12758 break;
12759
12760 default:
12761 ASSERT(mode == CONN_CLOSE); /* aborted through CONN_CLOSE */
12762 break;
12763 }
12764
12765 /*
12766 * The conn refhold and ioctlref placed on the conn at the start of the
12767 * ioctl are released here.
12768 */
12769 if (connp != NULL) {
12770 CONN_DEC_IOCTLREF(connp);
12771 CONN_OPER_PENDING_DONE(connp);
12772 }
12773
12774 if (ipsq != NULL)
12775 ipsq_current_finish(ipsq);
12776 }
12777
12778 /* Handles all non data messages */
12779 int
12780 ip_wput_nondata(queue_t *q, mblk_t *mp)
12781 {
12782 mblk_t *mp1;
12783 struct iocblk *iocp;
12784 ip_ioctl_cmd_t *ipip;
12785 conn_t *connp;
12786 cred_t *cr;
12787 char *proto_str;
12788
12789 if (CONN_Q(q))
12790 connp = Q_TO_CONN(q);
12791 else
12792 connp = NULL;
12793
12794 iocp = NULL;
12795 switch (DB_TYPE(mp)) {
12796 case M_IOCTL:
12797 /*
12798 * IOCTL processing begins in ip_sioctl_copyin_setup which
12799 * will arrange to copy in associated control structures.
12800 */
12801 ip_sioctl_copyin_setup(q, mp);
12802 return (0);
12803 case M_IOCDATA:
12804 /*
12805 * Ensure that this is associated with one of our trans-
12806 * parent ioctls. If it's not ours, discard it if we're
12807 * running as a driver, or pass it on if we're a module.
12808 */
12809 iocp = (struct iocblk *)mp->b_rptr;
12810 ipip = ip_sioctl_lookup(iocp->ioc_cmd);
12811 if (ipip == NULL) {
12812 if (q->q_next == NULL) {
12813 goto nak;
12814 } else {
12815 putnext(q, mp);
12816 }
12817 return (0);
12818 }
12819 if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
12820 /*
12821 * The ioctl is one we recognise, but is not consumed
12822 * by IP as a module and we are a module, so we drop
12823 */
12824 goto nak;
12825 }
12826
12827 /* IOCTL continuation following copyin or copyout. */
12828 if (mi_copy_state(q, mp, NULL) == -1) {
12829 /*
12830 * The copy operation failed. mi_copy_state already
12831 * cleaned up, so we're out of here.
12832 */
12833 return (0);
12834 }
12835 /*
12836 * If we just completed a copy in, we become writer and
12837 * continue processing in ip_sioctl_copyin_done. If it
12838 * was a copy out, we call mi_copyout again. If there is
12839 * nothing more to copy out, it will complete the IOCTL.
12840 */
12841 if (MI_COPY_DIRECTION(mp) == MI_COPY_IN) {
12842 if (!(mp1 = mp->b_cont) || !(mp1 = mp1->b_cont)) {
12843 mi_copy_done(q, mp, EPROTO);
12844 return (0);
12845 }
12846 /*
12847 * Check for cases that need more copying. A return
12848 * value of 0 means a second copyin has been started,
12849 * so we return; a return value of 1 means no more
12850 * copying is needed, so we continue.
12851 */
12852 if (ipip->ipi_cmd_type == MSFILT_CMD &&
12853 MI_COPY_COUNT(mp) == 1) {
12854 if (ip_copyin_msfilter(q, mp) == 0)
12855 return (0);
12856 }
12857 /*
12858 * Refhold the conn, till the ioctl completes. This is
12859 * needed in case the ioctl ends up in the pending mp
12860 * list. Every mp in the ipx_pending_mp list must have
12861 * a refhold on the conn to resume processing. The
12862 * refhold is released when the ioctl completes
12863 * (whether normally or abnormally). An ioctlref is also
12864 * placed on the conn to prevent TCP from removing the
12865 * queue needed to send the ioctl reply back.
12866 * In all cases ip_ioctl_finish is called to finish
12867 * the ioctl and release the refholds.
12868 */
12869 if (connp != NULL) {
12870 /* This is not a reentry */
12871 CONN_INC_REF(connp);
12872 CONN_INC_IOCTLREF(connp);
12873 } else {
12874 if (!(ipip->ipi_flags & IPI_MODOK)) {
12875 mi_copy_done(q, mp, EINVAL);
12876 return (0);
12877 }
12878 }
12879
12880 ip_process_ioctl(NULL, q, mp, ipip);
12881
12882 } else {
12883 mi_copyout(q, mp);
12884 }
12885 return (0);
12886
12887 case M_IOCNAK:
12888 /*
12889 * The only way we could get here is if a resolver didn't like
12890 * an IOCTL we sent it. This shouldn't happen.
12891 */
12892 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
12893 "ip_wput_nondata: unexpected M_IOCNAK, ioc_cmd 0x%x",
12894 ((struct iocblk *)mp->b_rptr)->ioc_cmd);
12895 freemsg(mp);
12896 return (0);
12897 case M_IOCACK:
12898 /* /dev/ip shouldn't see this */
12899 goto nak;
12900 case M_FLUSH:
12901 if (*mp->b_rptr & FLUSHW)
12902 flushq(q, FLUSHALL);
12903 if (q->q_next) {
12904 putnext(q, mp);
12905 return (0);
12906 }
12907 if (*mp->b_rptr & FLUSHR) {
12908 *mp->b_rptr &= ~FLUSHW;
12909 qreply(q, mp);
12910 return (0);
12911 }
12912 freemsg(mp);
12913 return (0);
12914 case M_CTL:
12915 break;
12916 case M_PROTO:
12917 case M_PCPROTO:
12918 /*
12919 * The only PROTO messages we expect are SNMP-related.
12920 */
12921 switch (((union T_primitives *)mp->b_rptr)->type) {
12922 case T_SVR4_OPTMGMT_REQ:
12923 ip2dbg(("ip_wput_nondata: T_SVR4_OPTMGMT_REQ "
12924 "flags %x\n",
12925 ((struct T_optmgmt_req *)mp->b_rptr)->MGMT_flags));
12926
12927 if (connp == NULL) {
12928 proto_str = "T_SVR4_OPTMGMT_REQ";
12929 goto protonak;
12930 }
12931
12932 /*
12933 * All Solaris components should pass a db_credp
12934 * for this TPI message, hence we ASSERT.
12935 * But in case there is some other M_PROTO that looks
12936 * like a TPI message sent by some other kernel
12937 * component, we check and return an error.
12938 */
12939 cr = msg_getcred(mp, NULL);
12940 ASSERT(cr != NULL);
12941 if (cr == NULL) {
12942 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, EINVAL);
12943 if (mp != NULL)
12944 qreply(q, mp);
12945 return (0);
12946 }
12947
12948 if (!snmpcom_req(q, mp, ip_snmp_set, ip_snmp_get, cr)) {
12949 proto_str = "Bad SNMPCOM request?";
12950 goto protonak;
12951 }
12952 return (0);
12953 default:
12954 ip1dbg(("ip_wput_nondata: dropping M_PROTO prim %u\n",
12955 (int)*(uint_t *)mp->b_rptr));
12956 freemsg(mp);
12957 return (0);
12958 }
12959 default:
12960 break;
12961 }
12962 if (q->q_next) {
12963 putnext(q, mp);
12964 } else
12965 freemsg(mp);
12966 return (0);
12967
12968 nak:
12969 iocp->ioc_error = EINVAL;
12970 mp->b_datap->db_type = M_IOCNAK;
12971 iocp->ioc_count = 0;
12972 qreply(q, mp);
12973 return (0);
12974
12975 protonak:
12976 cmn_err(CE_NOTE, "IP doesn't process %s as a module", proto_str);
12977 if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, EINVAL)) != NULL)
12978 qreply(q, mp);
12979 return (0);
12980 }
12981
12982 /*
12983 * Process IP options in an outbound packet. Verify that the nexthop in a
12984 * strict source route is onlink.
12985 * Returns non-zero if something fails in which case an ICMP error has been
12986 * sent and mp freed.
12987 *
12988 * Assumes the ULP has called ip_massage_options to move nexthop into ipha_dst.
12989 */
12990 int
12991 ip_output_options(mblk_t *mp, ipha_t *ipha, ip_xmit_attr_t *ixa, ill_t *ill)
12992 {
12993 ipoptp_t opts;
12994 uchar_t *opt;
12995 uint8_t optval;
12996 uint8_t optlen;
12997 ipaddr_t dst;
12998 intptr_t code = 0;
12999 ire_t *ire;
13000 ip_stack_t *ipst = ixa->ixa_ipst;
13001 ip_recv_attr_t iras;
13002
13003 ip2dbg(("ip_output_options\n"));
13004
13005 opt = NULL;
13006 dst = ipha->ipha_dst;
13007 for (optval = ipoptp_first(&opts, ipha);
13008 optval != IPOPT_EOL;
13009 optval = ipoptp_next(&opts)) {
13010 opt = opts.ipoptp_cur;
13011 optlen = opts.ipoptp_len;
13012 ip2dbg(("ip_output_options: opt %d, len %d\n",
13013 optval, optlen));
13014 switch (optval) {
13015 uint32_t off;
13016 case IPOPT_SSRR:
13017 case IPOPT_LSRR:
13018 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
13019 ip1dbg((
13020 "ip_output_options: bad option offset\n"));
13021 code = (char *)&opt[IPOPT_OLEN] -
13022 (char *)ipha;
13023 goto param_prob;
13024 }
13025 off = opt[IPOPT_OFFSET];
13026 ip1dbg(("ip_output_options: next hop 0x%x\n",
13027 ntohl(dst)));
13028 /*
13029 * For strict: verify that dst is directly
13030 * reachable.
13031 */
13032 if (optval == IPOPT_SSRR) {
13033 ire = ire_ftable_lookup_v4(dst, 0, 0,
13034 IRE_INTERFACE, NULL, ALL_ZONES,
13035 ixa->ixa_tsl,
13036 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 0, ipst,
13037 NULL);
13038 if (ire == NULL) {
13039 ip1dbg(("ip_output_options: SSRR not"
13040 " directly reachable: 0x%x\n",
13041 ntohl(dst)));
13042 goto bad_src_route;
13043 }
13044 ire_refrele(ire);
13045 }
13046 break;
13047 case IPOPT_RR:
13048 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
13049 ip1dbg((
13050 "ip_output_options: bad option offset\n"));
13051 code = (char *)&opt[IPOPT_OLEN] -
13052 (char *)ipha;
13053 goto param_prob;
13054 }
13055 break;
13056 case IPOPT_TS:
13057 /*
13058 * Verify that length >=5 and that there is either
13059 * room for another timestamp or that the overflow
13060 * counter is not maxed out.
13061 */
13062 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha;
13063 if (optlen < IPOPT_MINLEN_IT) {
13064 goto param_prob;
13065 }
13066 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
13067 ip1dbg((
13068 "ip_output_options: bad option offset\n"));
13069 code = (char *)&opt[IPOPT_OFFSET] -
13070 (char *)ipha;
13071 goto param_prob;
13072 }
13073 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) {
13074 case IPOPT_TS_TSONLY:
13075 off = IPOPT_TS_TIMELEN;
13076 break;
13077 case IPOPT_TS_TSANDADDR:
13078 case IPOPT_TS_PRESPEC:
13079 case IPOPT_TS_PRESPEC_RFC791:
13080 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN;
13081 break;
13082 default:
13083 code = (char *)&opt[IPOPT_POS_OV_FLG] -
13084 (char *)ipha;
13085 goto param_prob;
13086 }
13087 if (opt[IPOPT_OFFSET] - 1 + off > optlen &&
13088 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) {
13089 /*
13090 * No room and the overflow counter is 15
13091 * already.
13092 */
13093 goto param_prob;
13094 }
13095 break;
13096 }
13097 }
13098
13099 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0)
13100 return (0);
13101
13102 ip1dbg(("ip_output_options: error processing IP options."));
13103 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha;
13104
13105 param_prob:
13106 bzero(&iras, sizeof (iras));
13107 iras.ira_ill = iras.ira_rill = ill;
13108 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
13109 iras.ira_rifindex = iras.ira_ruifindex;
13110 iras.ira_flags = IRAF_IS_IPV4;
13111
13112 ip_drop_output("ip_output_options", mp, ill);
13113 icmp_param_problem(mp, (uint8_t)code, &iras);
13114 ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
13115 return (-1);
13116
13117 bad_src_route:
13118 bzero(&iras, sizeof (iras));
13119 iras.ira_ill = iras.ira_rill = ill;
13120 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
13121 iras.ira_rifindex = iras.ira_ruifindex;
13122 iras.ira_flags = IRAF_IS_IPV4;
13123
13124 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
13125 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, &iras);
13126 ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
13127 return (-1);
13128 }
13129
13130 /*
13131 * The maximum value of conn_drain_list_cnt is CONN_MAXDRAINCNT.
13132 * conn_drain_list_cnt can be changed by setting conn_drain_nthreads
13133 * thru /etc/system.
13134 */
13135 #define CONN_MAXDRAINCNT 64
13136
13137 static void
13138 conn_drain_init(ip_stack_t *ipst)
13139 {
13140 int i, j;
13141 idl_tx_list_t *itl_tx;
13142
13143 ipst->ips_conn_drain_list_cnt = conn_drain_nthreads;
13144
13145 if ((ipst->ips_conn_drain_list_cnt == 0) ||
13146 (ipst->ips_conn_drain_list_cnt > CONN_MAXDRAINCNT)) {
13147 /*
13148 * Default value of the number of drainers is the
13149 * number of cpus, subject to maximum of 8 drainers.
13150 */
13151 if (boot_max_ncpus != -1)
13152 ipst->ips_conn_drain_list_cnt = MIN(boot_max_ncpus, 8);
13153 else
13154 ipst->ips_conn_drain_list_cnt = MIN(max_ncpus, 8);
13155 }
13156
13157 ipst->ips_idl_tx_list =
13158 kmem_zalloc(TX_FANOUT_SIZE * sizeof (idl_tx_list_t), KM_SLEEP);
13159 for (i = 0; i < TX_FANOUT_SIZE; i++) {
13160 itl_tx = &ipst->ips_idl_tx_list[i];
13161 itl_tx->txl_drain_list =
13162 kmem_zalloc(ipst->ips_conn_drain_list_cnt *
13163 sizeof (idl_t), KM_SLEEP);
13164 mutex_init(&itl_tx->txl_lock, NULL, MUTEX_DEFAULT, NULL);
13165 for (j = 0; j < ipst->ips_conn_drain_list_cnt; j++) {
13166 mutex_init(&itl_tx->txl_drain_list[j].idl_lock, NULL,
13167 MUTEX_DEFAULT, NULL);
13168 itl_tx->txl_drain_list[j].idl_itl = itl_tx;
13169 }
13170 }
13171 }
13172
13173 static void
13174 conn_drain_fini(ip_stack_t *ipst)
13175 {
13176 int i;
13177 idl_tx_list_t *itl_tx;
13178
13179 for (i = 0; i < TX_FANOUT_SIZE; i++) {
13180 itl_tx = &ipst->ips_idl_tx_list[i];
13181 kmem_free(itl_tx->txl_drain_list,
13182 ipst->ips_conn_drain_list_cnt * sizeof (idl_t));
13183 }
13184 kmem_free(ipst->ips_idl_tx_list,
13185 TX_FANOUT_SIZE * sizeof (idl_tx_list_t));
13186 ipst->ips_idl_tx_list = NULL;
13187 }
13188
13189 /*
13190 * Flow control has blocked us from proceeding. Insert the given conn in one
13191 * of the conn drain lists. When flow control is unblocked, either ip_wsrv()
13192 * (STREAMS) or ill_flow_enable() (direct) will be called back, which in turn
13193 * will call conn_walk_drain(). See the flow control notes at the top of this
13194 * file for more details.
13195 */
13196 void
13197 conn_drain_insert(conn_t *connp, idl_tx_list_t *tx_list)
13198 {
13199 idl_t *idl = tx_list->txl_drain_list;
13200 uint_t index;
13201 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
13202
13203 mutex_enter(&connp->conn_lock);
13204 if (connp->conn_state_flags & CONN_CLOSING) {
13205 /*
13206 * The conn is closing as a result of which CONN_CLOSING
13207 * is set. Return.
13208 */
13209 mutex_exit(&connp->conn_lock);
13210 return;
13211 } else if (connp->conn_idl == NULL) {
13212 /*
13213 * Assign the next drain list round robin. We dont' use
13214 * a lock, and thus it may not be strictly round robin.
13215 * Atomicity of load/stores is enough to make sure that
13216 * conn_drain_list_index is always within bounds.
13217 */
13218 index = tx_list->txl_drain_index;
13219 ASSERT(index < ipst->ips_conn_drain_list_cnt);
13220 connp->conn_idl = &tx_list->txl_drain_list[index];
13221 index++;
13222 if (index == ipst->ips_conn_drain_list_cnt)
13223 index = 0;
13224 tx_list->txl_drain_index = index;
13225 } else {
13226 ASSERT(connp->conn_idl->idl_itl == tx_list);
13227 }
13228 mutex_exit(&connp->conn_lock);
13229
13230 idl = connp->conn_idl;
13231 mutex_enter(&idl->idl_lock);
13232 if ((connp->conn_drain_prev != NULL) ||
13233 (connp->conn_state_flags & CONN_CLOSING)) {
13234 /*
13235 * The conn is either already in the drain list or closing.
13236 * (We needed to check for CONN_CLOSING again since close can
13237 * sneak in between dropping conn_lock and acquiring idl_lock.)
13238 */
13239 mutex_exit(&idl->idl_lock);
13240 return;
13241 }
13242
13243 /*
13244 * The conn is not in the drain list. Insert it at the
13245 * tail of the drain list. The drain list is circular
13246 * and doubly linked. idl_conn points to the 1st element
13247 * in the list.
13248 */
13249 if (idl->idl_conn == NULL) {
13250 idl->idl_conn = connp;
13251 connp->conn_drain_next = connp;
13252 connp->conn_drain_prev = connp;
13253 } else {
13254 conn_t *head = idl->idl_conn;
13255
13256 connp->conn_drain_next = head;
13257 connp->conn_drain_prev = head->conn_drain_prev;
13258 head->conn_drain_prev->conn_drain_next = connp;
13259 head->conn_drain_prev = connp;
13260 }
13261 /*
13262 * For non streams based sockets assert flow control.
13263 */
13264 conn_setqfull(connp, NULL);
13265 mutex_exit(&idl->idl_lock);
13266 }
13267
13268 static void
13269 conn_drain_remove(conn_t *connp)
13270 {
13271 idl_t *idl = connp->conn_idl;
13272
13273 if (idl != NULL) {
13274 /*
13275 * Remove ourself from the drain list.
13276 */
13277 if (connp->conn_drain_next == connp) {
13278 /* Singleton in the list */
13279 ASSERT(connp->conn_drain_prev == connp);
13280 idl->idl_conn = NULL;
13281 } else {
13282 connp->conn_drain_prev->conn_drain_next =
13283 connp->conn_drain_next;
13284 connp->conn_drain_next->conn_drain_prev =
13285 connp->conn_drain_prev;
13286 if (idl->idl_conn == connp)
13287 idl->idl_conn = connp->conn_drain_next;
13288 }
13289
13290 /*
13291 * NOTE: because conn_idl is associated with a specific drain
13292 * list which in turn is tied to the index the TX ring
13293 * (txl_cookie) hashes to, and because the TX ring can change
13294 * over the lifetime of the conn_t, we must clear conn_idl so
13295 * a subsequent conn_drain_insert() will set conn_idl again
13296 * based on the latest txl_cookie.
13297 */
13298 connp->conn_idl = NULL;
13299 }
13300 connp->conn_drain_next = NULL;
13301 connp->conn_drain_prev = NULL;
13302
13303 conn_clrqfull(connp, NULL);
13304 /*
13305 * For streams based sockets open up flow control.
13306 */
13307 if (!IPCL_IS_NONSTR(connp))
13308 enableok(connp->conn_wq);
13309 }
13310
13311 /*
13312 * This conn is closing, and we are called from ip_close. OR
13313 * this conn is draining because flow-control on the ill has been relieved.
13314 *
13315 * We must also need to remove conn's on this idl from the list, and also
13316 * inform the sockfs upcalls about the change in flow-control.
13317 */
13318 static void
13319 conn_drain(conn_t *connp, boolean_t closing)
13320 {
13321 idl_t *idl;
13322 conn_t *next_connp;
13323
13324 /*
13325 * connp->conn_idl is stable at this point, and no lock is needed
13326 * to check it. If we are called from ip_close, close has already
13327 * set CONN_CLOSING, thus freezing the value of conn_idl, and
13328 * called us only because conn_idl is non-null. If we are called thru
13329 * service, conn_idl could be null, but it cannot change because
13330 * service is single-threaded per queue, and there cannot be another
13331 * instance of service trying to call conn_drain_insert on this conn
13332 * now.
13333 */
13334 ASSERT(!closing || connp == NULL || connp->conn_idl != NULL);
13335
13336 /*
13337 * If the conn doesn't exist or is not on a drain list, bail.
13338 */
13339 if (connp == NULL || connp->conn_idl == NULL ||
13340 connp->conn_drain_prev == NULL) {
13341 return;
13342 }
13343
13344 idl = connp->conn_idl;
13345 ASSERT(MUTEX_HELD(&idl->idl_lock));
13346
13347 if (!closing) {
13348 next_connp = connp->conn_drain_next;
13349 while (next_connp != connp) {
13350 conn_t *delconnp = next_connp;
13351
13352 next_connp = next_connp->conn_drain_next;
13353 conn_drain_remove(delconnp);
13354 }
13355 ASSERT(connp->conn_drain_next == idl->idl_conn);
13356 }
13357 conn_drain_remove(connp);
13358 }
13359
13360 /*
13361 * Write service routine. Shared perimeter entry point.
13362 * The device queue's messages has fallen below the low water mark and STREAMS
13363 * has backenabled the ill_wq. Send sockfs notification about flow-control on
13364 * each waiting conn.
13365 */
13366 int
13367 ip_wsrv(queue_t *q)
13368 {
13369 ill_t *ill;
13370
13371 ill = (ill_t *)q->q_ptr;
13372 if (ill->ill_state_flags == 0) {
13373 ip_stack_t *ipst = ill->ill_ipst;
13374
13375 /*
13376 * The device flow control has opened up.
13377 * Walk through conn drain lists and qenable the
13378 * first conn in each list. This makes sense only
13379 * if the stream is fully plumbed and setup.
13380 * Hence the ill_state_flags check above.
13381 */
13382 ip1dbg(("ip_wsrv: walking\n"));
13383 conn_walk_drain(ipst, &ipst->ips_idl_tx_list[0]);
13384 enableok(ill->ill_wq);
13385 }
13386 return (0);
13387 }
13388
13389 /*
13390 * Callback to disable flow control in IP.
13391 *
13392 * This is a mac client callback added when the DLD_CAPAB_DIRECT capability
13393 * is enabled.
13394 *
13395 * When MAC_TX() is not able to send any more packets, dld sets its queue
13396 * to QFULL and enable the STREAMS flow control. Later, when the underlying
13397 * driver is able to continue to send packets, it calls mac_tx_(ring_)update()
13398 * function and wakes up corresponding mac worker threads, which in turn
13399 * calls this callback function, and disables flow control.
13400 */
13401 void
13402 ill_flow_enable(void *arg, ip_mac_tx_cookie_t cookie)
13403 {
13404 ill_t *ill = (ill_t *)arg;
13405 ip_stack_t *ipst = ill->ill_ipst;
13406 idl_tx_list_t *idl_txl;
13407
13408 idl_txl = &ipst->ips_idl_tx_list[IDLHASHINDEX(cookie)];
13409 mutex_enter(&idl_txl->txl_lock);
13410 /* add code to to set a flag to indicate idl_txl is enabled */
13411 conn_walk_drain(ipst, idl_txl);
13412 mutex_exit(&idl_txl->txl_lock);
13413 }
13414
13415 /*
13416 * Flow control has been relieved and STREAMS has backenabled us; drain
13417 * all the conn lists on `tx_list'.
13418 */
13419 static void
13420 conn_walk_drain(ip_stack_t *ipst, idl_tx_list_t *tx_list)
13421 {
13422 int i;
13423 idl_t *idl;
13424
13425 IP_STAT(ipst, ip_conn_walk_drain);
13426
13427 for (i = 0; i < ipst->ips_conn_drain_list_cnt; i++) {
13428 idl = &tx_list->txl_drain_list[i];
13429 mutex_enter(&idl->idl_lock);
13430 conn_drain(idl->idl_conn, B_FALSE);
13431 mutex_exit(&idl->idl_lock);
13432 }
13433 }
13434
13435 /*
13436 * Determine if the ill and multicast aspects of that packets
13437 * "matches" the conn.
13438 */
13439 boolean_t
13440 conn_wantpacket(conn_t *connp, ip_recv_attr_t *ira, ipha_t *ipha)
13441 {
13442 ill_t *ill = ira->ira_rill;
13443 zoneid_t zoneid = ira->ira_zoneid;
13444 uint_t in_ifindex;
13445 ipaddr_t dst, src;
13446
13447 dst = ipha->ipha_dst;
13448 src = ipha->ipha_src;
13449
13450 /*
13451 * conn_incoming_ifindex is set by IP_BOUND_IF which limits
13452 * unicast, broadcast and multicast reception to
13453 * conn_incoming_ifindex.
13454 * conn_wantpacket is called for unicast, broadcast and
13455 * multicast packets.
13456 */
13457 in_ifindex = connp->conn_incoming_ifindex;
13458
13459 /* mpathd can bind to the under IPMP interface, which we allow */
13460 if (in_ifindex != 0 && in_ifindex != ill->ill_phyint->phyint_ifindex) {
13461 if (!IS_UNDER_IPMP(ill))
13462 return (B_FALSE);
13463
13464 if (in_ifindex != ipmp_ill_get_ipmp_ifindex(ill))
13465 return (B_FALSE);
13466 }
13467
13468 if (!IPCL_ZONE_MATCH(connp, zoneid))
13469 return (B_FALSE);
13470
13471 if (!(ira->ira_flags & IRAF_MULTICAST))
13472 return (B_TRUE);
13473
13474 if (connp->conn_multi_router) {
13475 /* multicast packet and multicast router socket: send up */
13476 return (B_TRUE);
13477 }
13478
13479 if (ipha->ipha_protocol == IPPROTO_PIM ||
13480 ipha->ipha_protocol == IPPROTO_RSVP)
13481 return (B_TRUE);
13482
13483 return (conn_hasmembers_ill_withsrc_v4(connp, dst, src, ira->ira_ill));
13484 }
13485
13486 void
13487 conn_setqfull(conn_t *connp, boolean_t *flow_stopped)
13488 {
13489 if (IPCL_IS_NONSTR(connp)) {
13490 (*connp->conn_upcalls->su_txq_full)
13491 (connp->conn_upper_handle, B_TRUE);
13492 if (flow_stopped != NULL)
13493 *flow_stopped = B_TRUE;
13494 } else {
13495 queue_t *q = connp->conn_wq;
13496
13497 ASSERT(q != NULL);
13498 if (!(q->q_flag & QFULL)) {
13499 mutex_enter(QLOCK(q));
13500 if (!(q->q_flag & QFULL)) {
13501 /* still need to set QFULL */
13502 q->q_flag |= QFULL;
13503 /* set flow_stopped to true under QLOCK */
13504 if (flow_stopped != NULL)
13505 *flow_stopped = B_TRUE;
13506 mutex_exit(QLOCK(q));
13507 } else {
13508 /* flow_stopped is left unchanged */
13509 mutex_exit(QLOCK(q));
13510 }
13511 }
13512 }
13513 }
13514
13515 void
13516 conn_clrqfull(conn_t *connp, boolean_t *flow_stopped)
13517 {
13518 if (IPCL_IS_NONSTR(connp)) {
13519 (*connp->conn_upcalls->su_txq_full)
13520 (connp->conn_upper_handle, B_FALSE);
13521 if (flow_stopped != NULL)
13522 *flow_stopped = B_FALSE;
13523 } else {
13524 queue_t *q = connp->conn_wq;
13525
13526 ASSERT(q != NULL);
13527 if (q->q_flag & QFULL) {
13528 mutex_enter(QLOCK(q));
13529 if (q->q_flag & QFULL) {
13530 q->q_flag &= ~QFULL;
13531 /* set flow_stopped to false under QLOCK */
13532 if (flow_stopped != NULL)
13533 *flow_stopped = B_FALSE;
13534 mutex_exit(QLOCK(q));
13535 if (q->q_flag & QWANTW)
13536 qbackenable(q, 0);
13537 } else {
13538 /* flow_stopped is left unchanged */
13539 mutex_exit(QLOCK(q));
13540 }
13541 }
13542 }
13543
13544 mutex_enter(&connp->conn_lock);
13545 connp->conn_blocked = B_FALSE;
13546 mutex_exit(&connp->conn_lock);
13547 }
13548
13549 /*
13550 * Return the length in bytes of the IPv4 headers (base header, label, and
13551 * other IP options) that will be needed based on the
13552 * ip_pkt_t structure passed by the caller.
13553 *
13554 * The returned length does not include the length of the upper level
13555 * protocol (ULP) header.
13556 * The caller needs to check that the length doesn't exceed the max for IPv4.
13557 */
13558 int
13559 ip_total_hdrs_len_v4(const ip_pkt_t *ipp)
13560 {
13561 int len;
13562
13563 len = IP_SIMPLE_HDR_LENGTH;
13564 if (ipp->ipp_fields & IPPF_LABEL_V4) {
13565 ASSERT(ipp->ipp_label_len_v4 != 0);
13566 /* We need to round up here */
13567 len += (ipp->ipp_label_len_v4 + 3) & ~3;
13568 }
13569
13570 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
13571 ASSERT(ipp->ipp_ipv4_options_len != 0);
13572 ASSERT((ipp->ipp_ipv4_options_len & 3) == 0);
13573 len += ipp->ipp_ipv4_options_len;
13574 }
13575 return (len);
13576 }
13577
13578 /*
13579 * All-purpose routine to build an IPv4 header with options based
13580 * on the abstract ip_pkt_t.
13581 *
13582 * The caller has to set the source and destination address as well as
13583 * ipha_length. The caller has to massage any source route and compensate
13584 * for the ULP pseudo-header checksum due to the source route.
13585 */
13586 void
13587 ip_build_hdrs_v4(uchar_t *buf, uint_t buf_len, const ip_pkt_t *ipp,
13588 uint8_t protocol)
13589 {
13590 ipha_t *ipha = (ipha_t *)buf;
13591 uint8_t *cp;
13592
13593 /* Initialize IPv4 header */
13594 ipha->ipha_type_of_service = ipp->ipp_type_of_service;
13595 ipha->ipha_length = 0; /* Caller will set later */
13596 ipha->ipha_ident = 0;
13597 ipha->ipha_fragment_offset_and_flags = 0;
13598 ipha->ipha_ttl = ipp->ipp_unicast_hops;
13599 ipha->ipha_protocol = protocol;
13600 ipha->ipha_hdr_checksum = 0;
13601
13602 if ((ipp->ipp_fields & IPPF_ADDR) &&
13603 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
13604 ipha->ipha_src = ipp->ipp_addr_v4;
13605
13606 cp = (uint8_t *)&ipha[1];
13607 if (ipp->ipp_fields & IPPF_LABEL_V4) {
13608 ASSERT(ipp->ipp_label_len_v4 != 0);
13609 bcopy(ipp->ipp_label_v4, cp, ipp->ipp_label_len_v4);
13610 cp += ipp->ipp_label_len_v4;
13611 /* We need to round up here */
13612 while ((uintptr_t)cp & 0x3) {
13613 *cp++ = IPOPT_NOP;
13614 }
13615 }
13616
13617 if (ipp->ipp_fields & IPPF_IPV4_OPTIONS) {
13618 ASSERT(ipp->ipp_ipv4_options_len != 0);
13619 ASSERT((ipp->ipp_ipv4_options_len & 3) == 0);
13620 bcopy(ipp->ipp_ipv4_options, cp, ipp->ipp_ipv4_options_len);
13621 cp += ipp->ipp_ipv4_options_len;
13622 }
13623 ipha->ipha_version_and_hdr_length =
13624 (uint8_t)((IP_VERSION << 4) + buf_len / 4);
13625
13626 ASSERT((int)(cp - buf) == buf_len);
13627 }
13628
13629 /* Allocate the private structure */
13630 static int
13631 ip_priv_alloc(void **bufp)
13632 {
13633 void *buf;
13634
13635 if ((buf = kmem_alloc(sizeof (ip_priv_t), KM_NOSLEEP)) == NULL)
13636 return (ENOMEM);
13637
13638 *bufp = buf;
13639 return (0);
13640 }
13641
13642 /* Function to delete the private structure */
13643 void
13644 ip_priv_free(void *buf)
13645 {
13646 ASSERT(buf != NULL);
13647 kmem_free(buf, sizeof (ip_priv_t));
13648 }
13649
13650 /*
13651 * The entry point for IPPF processing.
13652 * If the classifier (IPGPC_CLASSIFY) is not loaded and configured, the
13653 * routine just returns.
13654 *
13655 * When called, ip_process generates an ipp_packet_t structure
13656 * which holds the state information for this packet and invokes the
13657 * the classifier (via ipp_packet_process). The classification, depending on
13658 * configured filters, results in a list of actions for this packet. Invoking
13659 * an action may cause the packet to be dropped, in which case we return NULL.
13660 * proc indicates the callout position for
13661 * this packet and ill is the interface this packet arrived on or will leave
13662 * on (inbound and outbound resp.).
13663 *
13664 * We do the processing on the rill (mapped to the upper if ipmp), but MIB
13665 * on the ill corrsponding to the destination IP address.
13666 */
13667 mblk_t *
13668 ip_process(ip_proc_t proc, mblk_t *mp, ill_t *rill, ill_t *ill)
13669 {
13670 ip_priv_t *priv;
13671 ipp_action_id_t aid;
13672 int rc = 0;
13673 ipp_packet_t *pp;
13674
13675 /* If the classifier is not loaded, return */
13676 if ((aid = ipp_action_lookup(IPGPC_CLASSIFY)) == IPP_ACTION_INVAL) {
13677 return (mp);
13678 }
13679
13680 ASSERT(mp != NULL);
13681
13682 /* Allocate the packet structure */
13683 rc = ipp_packet_alloc(&pp, "ip", aid);
13684 if (rc != 0)
13685 goto drop;
13686
13687 /* Allocate the private structure */
13688 rc = ip_priv_alloc((void **)&priv);
13689 if (rc != 0) {
13690 ipp_packet_free(pp);
13691 goto drop;
13692 }
13693 priv->proc = proc;
13694 priv->ill_index = ill_get_upper_ifindex(rill);
13695
13696 ipp_packet_set_private(pp, priv, ip_priv_free);
13697 ipp_packet_set_data(pp, mp);
13698
13699 /* Invoke the classifier */
13700 rc = ipp_packet_process(&pp);
13701 if (pp != NULL) {
13702 mp = ipp_packet_get_data(pp);
13703 ipp_packet_free(pp);
13704 if (rc != 0)
13705 goto drop;
13706 return (mp);
13707 } else {
13708 /* No mp to trace in ip_drop_input/ip_drop_output */
13709 mp = NULL;
13710 }
13711 drop:
13712 if (proc == IPP_LOCAL_IN || proc == IPP_FWD_IN) {
13713 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
13714 ip_drop_input("ip_process", mp, ill);
13715 } else {
13716 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13717 ip_drop_output("ip_process", mp, ill);
13718 }
13719 freemsg(mp);
13720 return (NULL);
13721 }
13722
13723 /*
13724 * Propagate a multicast group membership operation (add/drop) on
13725 * all the interfaces crossed by the related multirt routes.
13726 * The call is considered successful if the operation succeeds
13727 * on at least one interface.
13728 *
13729 * This assumes that a set of IRE_HOST/RTF_MULTIRT has been created for the
13730 * multicast addresses with the ire argument being the first one.
13731 * We walk the bucket to find all the of those.
13732 *
13733 * Common to IPv4 and IPv6.
13734 */
13735 static int
13736 ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t,
13737 const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *),
13738 ire_t *ire, conn_t *connp, boolean_t checkonly, const in6_addr_t *v6group,
13739 mcast_record_t fmode, const in6_addr_t *v6src)
13740 {
13741 ire_t *ire_gw;
13742 irb_t *irb;
13743 int ifindex;
13744 int error = 0;
13745 int result;
13746 ip_stack_t *ipst = ire->ire_ipst;
13747 ipaddr_t group;
13748 boolean_t isv6;
13749 int match_flags;
13750
13751 if (IN6_IS_ADDR_V4MAPPED(v6group)) {
13752 IN6_V4MAPPED_TO_IPADDR(v6group, group);
13753 isv6 = B_FALSE;
13754 } else {
13755 isv6 = B_TRUE;
13756 }
13757
13758 irb = ire->ire_bucket;
13759 ASSERT(irb != NULL);
13760
13761 result = 0;
13762 irb_refhold(irb);
13763 for (; ire != NULL; ire = ire->ire_next) {
13764 if ((ire->ire_flags & RTF_MULTIRT) == 0)
13765 continue;
13766
13767 /* We handle -ifp routes by matching on the ill if set */
13768 match_flags = MATCH_IRE_TYPE;
13769 if (ire->ire_ill != NULL)
13770 match_flags |= MATCH_IRE_ILL;
13771
13772 if (isv6) {
13773 if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6group))
13774 continue;
13775
13776 ire_gw = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6,
13777 0, 0, IRE_INTERFACE, ire->ire_ill, ALL_ZONES, NULL,
13778 match_flags, 0, ipst, NULL);
13779 } else {
13780 if (ire->ire_addr != group)
13781 continue;
13782
13783 ire_gw = ire_ftable_lookup_v4(ire->ire_gateway_addr,
13784 0, 0, IRE_INTERFACE, ire->ire_ill, ALL_ZONES, NULL,
13785 match_flags, 0, ipst, NULL);
13786 }
13787 /* No interface route exists for the gateway; skip this ire. */
13788 if (ire_gw == NULL)
13789 continue;
13790 if (ire_gw->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
13791 ire_refrele(ire_gw);
13792 continue;
13793 }
13794 ASSERT(ire_gw->ire_ill != NULL); /* IRE_INTERFACE */
13795 ifindex = ire_gw->ire_ill->ill_phyint->phyint_ifindex;
13796
13797 /*
13798 * The operation is considered a success if
13799 * it succeeds at least once on any one interface.
13800 */
13801 error = fn(connp, checkonly, v6group, INADDR_ANY, ifindex,
13802 fmode, v6src);
13803 if (error == 0)
13804 result = CGTP_MCAST_SUCCESS;
13805
13806 ire_refrele(ire_gw);
13807 }
13808 irb_refrele(irb);
13809 /*
13810 * Consider the call as successful if we succeeded on at least
13811 * one interface. Otherwise, return the last encountered error.
13812 */
13813 return (result == CGTP_MCAST_SUCCESS ? 0 : error);
13814 }
13815
13816 /*
13817 * Return the expected CGTP hooks version number.
13818 */
13819 int
13820 ip_cgtp_filter_supported(void)
13821 {
13822 return (ip_cgtp_filter_rev);
13823 }
13824
13825 /*
13826 * CGTP hooks can be registered by invoking this function.
13827 * Checks that the version number matches.
13828 */
13829 int
13830 ip_cgtp_filter_register(netstackid_t stackid, cgtp_filter_ops_t *ops)
13831 {
13832 netstack_t *ns;
13833 ip_stack_t *ipst;
13834
13835 if (ops->cfo_filter_rev != CGTP_FILTER_REV)
13836 return (ENOTSUP);
13837
13838 ns = netstack_find_by_stackid(stackid);
13839 if (ns == NULL)
13840 return (EINVAL);
13841 ipst = ns->netstack_ip;
13842 ASSERT(ipst != NULL);
13843
13844 if (ipst->ips_ip_cgtp_filter_ops != NULL) {
13845 netstack_rele(ns);
13846 return (EALREADY);
13847 }
13848
13849 ipst->ips_ip_cgtp_filter_ops = ops;
13850
13851 ill_set_inputfn_all(ipst);
13852
13853 netstack_rele(ns);
13854 return (0);
13855 }
13856
13857 /*
13858 * CGTP hooks can be unregistered by invoking this function.
13859 * Returns ENXIO if there was no registration.
13860 * Returns EBUSY if the ndd variable has not been turned off.
13861 */
13862 int
13863 ip_cgtp_filter_unregister(netstackid_t stackid)
13864 {
13865 netstack_t *ns;
13866 ip_stack_t *ipst;
13867
13868 ns = netstack_find_by_stackid(stackid);
13869 if (ns == NULL)
13870 return (EINVAL);
13871 ipst = ns->netstack_ip;
13872 ASSERT(ipst != NULL);
13873
13874 if (ipst->ips_ip_cgtp_filter) {
13875 netstack_rele(ns);
13876 return (EBUSY);
13877 }
13878
13879 if (ipst->ips_ip_cgtp_filter_ops == NULL) {
13880 netstack_rele(ns);
13881 return (ENXIO);
13882 }
13883 ipst->ips_ip_cgtp_filter_ops = NULL;
13884
13885 ill_set_inputfn_all(ipst);
13886
13887 netstack_rele(ns);
13888 return (0);
13889 }
13890
13891 /*
13892 * Check whether there is a CGTP filter registration.
13893 * Returns non-zero if there is a registration, otherwise returns zero.
13894 * Note: returns zero if bad stackid.
13895 */
13896 int
13897 ip_cgtp_filter_is_registered(netstackid_t stackid)
13898 {
13899 netstack_t *ns;
13900 ip_stack_t *ipst;
13901 int ret;
13902
13903 ns = netstack_find_by_stackid(stackid);
13904 if (ns == NULL)
13905 return (0);
13906 ipst = ns->netstack_ip;
13907 ASSERT(ipst != NULL);
13908
13909 if (ipst->ips_ip_cgtp_filter_ops != NULL)
13910 ret = 1;
13911 else
13912 ret = 0;
13913
13914 netstack_rele(ns);
13915 return (ret);
13916 }
13917
13918 static int
13919 ip_squeue_switch(int val)
13920 {
13921 int rval;
13922
13923 switch (val) {
13924 case IP_SQUEUE_ENTER_NODRAIN:
13925 rval = SQ_NODRAIN;
13926 break;
13927 case IP_SQUEUE_ENTER:
13928 rval = SQ_PROCESS;
13929 break;
13930 case IP_SQUEUE_FILL:
13931 default:
13932 rval = SQ_FILL;
13933 break;
13934 }
13935 return (rval);
13936 }
13937
13938 static void *
13939 ip_kstat2_init(netstackid_t stackid, ip_stat_t *ip_statisticsp)
13940 {
13941 kstat_t *ksp;
13942
13943 ip_stat_t template = {
13944 { "ip_udp_fannorm", KSTAT_DATA_UINT64 },
13945 { "ip_udp_fanmb", KSTAT_DATA_UINT64 },
13946 { "ip_recv_pullup", KSTAT_DATA_UINT64 },
13947 { "ip_db_ref", KSTAT_DATA_UINT64 },
13948 { "ip_notaligned", KSTAT_DATA_UINT64 },
13949 { "ip_multimblk", KSTAT_DATA_UINT64 },
13950 { "ip_opt", KSTAT_DATA_UINT64 },
13951 { "ipsec_proto_ahesp", KSTAT_DATA_UINT64 },
13952 { "ip_conn_flputbq", KSTAT_DATA_UINT64 },
13953 { "ip_conn_walk_drain", KSTAT_DATA_UINT64 },
13954 { "ip_out_sw_cksum", KSTAT_DATA_UINT64 },
13955 { "ip_out_sw_cksum_bytes", KSTAT_DATA_UINT64 },
13956 { "ip_in_sw_cksum", KSTAT_DATA_UINT64 },
13957 { "ip_ire_reclaim_calls", KSTAT_DATA_UINT64 },
13958 { "ip_ire_reclaim_deleted", KSTAT_DATA_UINT64 },
13959 { "ip_nce_reclaim_calls", KSTAT_DATA_UINT64 },
13960 { "ip_nce_reclaim_deleted", KSTAT_DATA_UINT64 },
13961 { "ip_nce_mcast_reclaim_calls", KSTAT_DATA_UINT64 },
13962 { "ip_nce_mcast_reclaim_deleted", KSTAT_DATA_UINT64 },
13963 { "ip_nce_mcast_reclaim_tqfail", KSTAT_DATA_UINT64 },
13964 { "ip_dce_reclaim_calls", KSTAT_DATA_UINT64 },
13965 { "ip_dce_reclaim_deleted", KSTAT_DATA_UINT64 },
13966 { "ip_tcp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 },
13967 { "ip_tcp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 },
13968 { "ip_tcp_in_sw_cksum_err", KSTAT_DATA_UINT64 },
13969 { "ip_udp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 },
13970 { "ip_udp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 },
13971 { "ip_udp_in_sw_cksum_err", KSTAT_DATA_UINT64 },
13972 { "conn_in_recvdstaddr", KSTAT_DATA_UINT64 },
13973 { "conn_in_recvopts", KSTAT_DATA_UINT64 },
13974 { "conn_in_recvif", KSTAT_DATA_UINT64 },
13975 { "conn_in_recvslla", KSTAT_DATA_UINT64 },
13976 { "conn_in_recvucred", KSTAT_DATA_UINT64 },
13977 { "conn_in_recvttl", KSTAT_DATA_UINT64 },
13978 { "conn_in_recvhopopts", KSTAT_DATA_UINT64 },
13979 { "conn_in_recvhoplimit", KSTAT_DATA_UINT64 },
13980 { "conn_in_recvdstopts", KSTAT_DATA_UINT64 },
13981 { "conn_in_recvrthdrdstopts", KSTAT_DATA_UINT64 },
13982 { "conn_in_recvrthdr", KSTAT_DATA_UINT64 },
13983 { "conn_in_recvpktinfo", KSTAT_DATA_UINT64 },
13984 { "conn_in_recvtclass", KSTAT_DATA_UINT64 },
13985 { "conn_in_timestamp", KSTAT_DATA_UINT64 },
13986 };
13987
13988 ksp = kstat_create_netstack("ip", 0, "ipstat", "net",
13989 KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t),
13990 KSTAT_FLAG_VIRTUAL, stackid);
13991
13992 if (ksp == NULL)
13993 return (NULL);
13994
13995 bcopy(&template, ip_statisticsp, sizeof (template));
13996 ksp->ks_data = (void *)ip_statisticsp;
13997 ksp->ks_private = (void *)(uintptr_t)stackid;
13998
13999 kstat_install(ksp);
14000 return (ksp);
14001 }
14002
14003 static void
14004 ip_kstat2_fini(netstackid_t stackid, kstat_t *ksp)
14005 {
14006 if (ksp != NULL) {
14007 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
14008 kstat_delete_netstack(ksp, stackid);
14009 }
14010 }
14011
14012 static void *
14013 ip_kstat_init(netstackid_t stackid, ip_stack_t *ipst)
14014 {
14015 kstat_t *ksp;
14016
14017 ip_named_kstat_t template = {
14018 { "forwarding", KSTAT_DATA_UINT32, 0 },
14019 { "defaultTTL", KSTAT_DATA_UINT32, 0 },
14020 { "inReceives", KSTAT_DATA_UINT64, 0 },
14021 { "inHdrErrors", KSTAT_DATA_UINT32, 0 },
14022 { "inAddrErrors", KSTAT_DATA_UINT32, 0 },
14023 { "forwDatagrams", KSTAT_DATA_UINT64, 0 },
14024 { "inUnknownProtos", KSTAT_DATA_UINT32, 0 },
14025 { "inDiscards", KSTAT_DATA_UINT32, 0 },
14026 { "inDelivers", KSTAT_DATA_UINT64, 0 },
14027 { "outRequests", KSTAT_DATA_UINT64, 0 },
14028 { "outDiscards", KSTAT_DATA_UINT32, 0 },
14029 { "outNoRoutes", KSTAT_DATA_UINT32, 0 },
14030 { "reasmTimeout", KSTAT_DATA_UINT32, 0 },
14031 { "reasmReqds", KSTAT_DATA_UINT32, 0 },
14032 { "reasmOKs", KSTAT_DATA_UINT32, 0 },
14033 { "reasmFails", KSTAT_DATA_UINT32, 0 },
14034 { "fragOKs", KSTAT_DATA_UINT32, 0 },
14035 { "fragFails", KSTAT_DATA_UINT32, 0 },
14036 { "fragCreates", KSTAT_DATA_UINT32, 0 },
14037 { "addrEntrySize", KSTAT_DATA_INT32, 0 },
14038 { "routeEntrySize", KSTAT_DATA_INT32, 0 },
14039 { "netToMediaEntrySize", KSTAT_DATA_INT32, 0 },
14040 { "routingDiscards", KSTAT_DATA_UINT32, 0 },
14041 { "inErrs", KSTAT_DATA_UINT32, 0 },
14042 { "noPorts", KSTAT_DATA_UINT32, 0 },
14043 { "inCksumErrs", KSTAT_DATA_UINT32, 0 },
14044 { "reasmDuplicates", KSTAT_DATA_UINT32, 0 },
14045 { "reasmPartDups", KSTAT_DATA_UINT32, 0 },
14046 { "forwProhibits", KSTAT_DATA_UINT32, 0 },
14047 { "udpInCksumErrs", KSTAT_DATA_UINT32, 0 },
14048 { "udpInOverflows", KSTAT_DATA_UINT32, 0 },
14049 { "rawipInOverflows", KSTAT_DATA_UINT32, 0 },
14050 { "ipsecInSucceeded", KSTAT_DATA_UINT32, 0 },
14051 { "ipsecInFailed", KSTAT_DATA_INT32, 0 },
14052 { "memberEntrySize", KSTAT_DATA_INT32, 0 },
14053 { "inIPv6", KSTAT_DATA_UINT32, 0 },
14054 { "outIPv6", KSTAT_DATA_UINT32, 0 },
14055 { "outSwitchIPv6", KSTAT_DATA_UINT32, 0 },
14056 };
14057
14058 ksp = kstat_create_netstack("ip", 0, "ip", "mib2", KSTAT_TYPE_NAMED,
14059 NUM_OF_FIELDS(ip_named_kstat_t), 0, stackid);
14060 if (ksp == NULL || ksp->ks_data == NULL)
14061 return (NULL);
14062
14063 template.forwarding.value.ui32 = WE_ARE_FORWARDING(ipst) ? 1:2;
14064 template.defaultTTL.value.ui32 = (uint32_t)ipst->ips_ip_def_ttl;
14065 template.reasmTimeout.value.ui32 = ipst->ips_ip_reassembly_timeout;
14066 template.addrEntrySize.value.i32 = sizeof (mib2_ipAddrEntry_t);
14067 template.routeEntrySize.value.i32 = sizeof (mib2_ipRouteEntry_t);
14068
14069 template.netToMediaEntrySize.value.i32 =
14070 sizeof (mib2_ipNetToMediaEntry_t);
14071
14072 template.memberEntrySize.value.i32 = sizeof (ipv6_member_t);
14073
14074 bcopy(&template, ksp->ks_data, sizeof (template));
14075 ksp->ks_update = ip_kstat_update;
14076 ksp->ks_private = (void *)(uintptr_t)stackid;
14077
14078 kstat_install(ksp);
14079 return (ksp);
14080 }
14081
14082 static void
14083 ip_kstat_fini(netstackid_t stackid, kstat_t *ksp)
14084 {
14085 if (ksp != NULL) {
14086 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
14087 kstat_delete_netstack(ksp, stackid);
14088 }
14089 }
14090
14091 static int
14092 ip_kstat_update(kstat_t *kp, int rw)
14093 {
14094 ip_named_kstat_t *ipkp;
14095 mib2_ipIfStatsEntry_t ipmib;
14096 ill_walk_context_t ctx;
14097 ill_t *ill;
14098 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private;
14099 netstack_t *ns;
14100 ip_stack_t *ipst;
14101
14102 if (kp->ks_data == NULL)
14103 return (EIO);
14104
14105 if (rw == KSTAT_WRITE)
14106 return (EACCES);
14107
14108 ns = netstack_find_by_stackid(stackid);
14109 if (ns == NULL)
14110 return (-1);
14111 ipst = ns->netstack_ip;
14112 if (ipst == NULL) {
14113 netstack_rele(ns);
14114 return (-1);
14115 }
14116 ipkp = (ip_named_kstat_t *)kp->ks_data;
14117
14118 bcopy(&ipst->ips_ip_mib, &ipmib, sizeof (ipmib));
14119 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
14120 ill = ILL_START_WALK_V4(&ctx, ipst);
14121 for (; ill != NULL; ill = ill_next(&ctx, ill))
14122 ip_mib2_add_ip_stats(&ipmib, ill->ill_ip_mib);
14123 rw_exit(&ipst->ips_ill_g_lock);
14124
14125 ipkp->forwarding.value.ui32 = ipmib.ipIfStatsForwarding;
14126 ipkp->defaultTTL.value.ui32 = ipmib.ipIfStatsDefaultTTL;
14127 ipkp->inReceives.value.ui64 = ipmib.ipIfStatsHCInReceives;
14128 ipkp->inHdrErrors.value.ui32 = ipmib.ipIfStatsInHdrErrors;
14129 ipkp->inAddrErrors.value.ui32 = ipmib.ipIfStatsInAddrErrors;
14130 ipkp->forwDatagrams.value.ui64 = ipmib.ipIfStatsHCOutForwDatagrams;
14131 ipkp->inUnknownProtos.value.ui32 = ipmib.ipIfStatsInUnknownProtos;
14132 ipkp->inDiscards.value.ui32 = ipmib.ipIfStatsInDiscards;
14133 ipkp->inDelivers.value.ui64 = ipmib.ipIfStatsHCInDelivers;
14134 ipkp->outRequests.value.ui64 = ipmib.ipIfStatsHCOutRequests;
14135 ipkp->outDiscards.value.ui32 = ipmib.ipIfStatsOutDiscards;
14136 ipkp->outNoRoutes.value.ui32 = ipmib.ipIfStatsOutNoRoutes;
14137 ipkp->reasmTimeout.value.ui32 = ipst->ips_ip_reassembly_timeout;
14138 ipkp->reasmReqds.value.ui32 = ipmib.ipIfStatsReasmReqds;
14139 ipkp->reasmOKs.value.ui32 = ipmib.ipIfStatsReasmOKs;
14140 ipkp->reasmFails.value.ui32 = ipmib.ipIfStatsReasmFails;
14141 ipkp->fragOKs.value.ui32 = ipmib.ipIfStatsOutFragOKs;
14142 ipkp->fragFails.value.ui32 = ipmib.ipIfStatsOutFragFails;
14143 ipkp->fragCreates.value.ui32 = ipmib.ipIfStatsOutFragCreates;
14144
14145 ipkp->routingDiscards.value.ui32 = 0;
14146 ipkp->inErrs.value.ui32 = ipmib.tcpIfStatsInErrs;
14147 ipkp->noPorts.value.ui32 = ipmib.udpIfStatsNoPorts;
14148 ipkp->inCksumErrs.value.ui32 = ipmib.ipIfStatsInCksumErrs;
14149 ipkp->reasmDuplicates.value.ui32 = ipmib.ipIfStatsReasmDuplicates;
14150 ipkp->reasmPartDups.value.ui32 = ipmib.ipIfStatsReasmPartDups;
14151 ipkp->forwProhibits.value.ui32 = ipmib.ipIfStatsForwProhibits;
14152 ipkp->udpInCksumErrs.value.ui32 = ipmib.udpIfStatsInCksumErrs;
14153 ipkp->udpInOverflows.value.ui32 = ipmib.udpIfStatsInOverflows;
14154 ipkp->rawipInOverflows.value.ui32 = ipmib.rawipIfStatsInOverflows;
14155 ipkp->ipsecInSucceeded.value.ui32 = ipmib.ipsecIfStatsInSucceeded;
14156 ipkp->ipsecInFailed.value.i32 = ipmib.ipsecIfStatsInFailed;
14157
14158 ipkp->inIPv6.value.ui32 = ipmib.ipIfStatsInWrongIPVersion;
14159 ipkp->outIPv6.value.ui32 = ipmib.ipIfStatsOutWrongIPVersion;
14160 ipkp->outSwitchIPv6.value.ui32 = ipmib.ipIfStatsOutSwitchIPVersion;
14161
14162 netstack_rele(ns);
14163
14164 return (0);
14165 }
14166
14167 static void *
14168 icmp_kstat_init(netstackid_t stackid)
14169 {
14170 kstat_t *ksp;
14171
14172 icmp_named_kstat_t template = {
14173 { "inMsgs", KSTAT_DATA_UINT32 },
14174 { "inErrors", KSTAT_DATA_UINT32 },
14175 { "inDestUnreachs", KSTAT_DATA_UINT32 },
14176 { "inTimeExcds", KSTAT_DATA_UINT32 },
14177 { "inParmProbs", KSTAT_DATA_UINT32 },
14178 { "inSrcQuenchs", KSTAT_DATA_UINT32 },
14179 { "inRedirects", KSTAT_DATA_UINT32 },
14180 { "inEchos", KSTAT_DATA_UINT32 },
14181 { "inEchoReps", KSTAT_DATA_UINT32 },
14182 { "inTimestamps", KSTAT_DATA_UINT32 },
14183 { "inTimestampReps", KSTAT_DATA_UINT32 },
14184 { "inAddrMasks", KSTAT_DATA_UINT32 },
14185 { "inAddrMaskReps", KSTAT_DATA_UINT32 },
14186 { "outMsgs", KSTAT_DATA_UINT32 },
14187 { "outErrors", KSTAT_DATA_UINT32 },
14188 { "outDestUnreachs", KSTAT_DATA_UINT32 },
14189 { "outTimeExcds", KSTAT_DATA_UINT32 },
14190 { "outParmProbs", KSTAT_DATA_UINT32 },
14191 { "outSrcQuenchs", KSTAT_DATA_UINT32 },
14192 { "outRedirects", KSTAT_DATA_UINT32 },
14193 { "outEchos", KSTAT_DATA_UINT32 },
14194 { "outEchoReps", KSTAT_DATA_UINT32 },
14195 { "outTimestamps", KSTAT_DATA_UINT32 },
14196 { "outTimestampReps", KSTAT_DATA_UINT32 },
14197 { "outAddrMasks", KSTAT_DATA_UINT32 },
14198 { "outAddrMaskReps", KSTAT_DATA_UINT32 },
14199 { "inChksumErrs", KSTAT_DATA_UINT32 },
14200 { "inUnknowns", KSTAT_DATA_UINT32 },
14201 { "inFragNeeded", KSTAT_DATA_UINT32 },
14202 { "outFragNeeded", KSTAT_DATA_UINT32 },
14203 { "outDrops", KSTAT_DATA_UINT32 },
14204 { "inOverFlows", KSTAT_DATA_UINT32 },
14205 { "inBadRedirects", KSTAT_DATA_UINT32 },
14206 };
14207
14208 ksp = kstat_create_netstack("ip", 0, "icmp", "mib2", KSTAT_TYPE_NAMED,
14209 NUM_OF_FIELDS(icmp_named_kstat_t), 0, stackid);
14210 if (ksp == NULL || ksp->ks_data == NULL)
14211 return (NULL);
14212
14213 bcopy(&template, ksp->ks_data, sizeof (template));
14214
14215 ksp->ks_update = icmp_kstat_update;
14216 ksp->ks_private = (void *)(uintptr_t)stackid;
14217
14218 kstat_install(ksp);
14219 return (ksp);
14220 }
14221
14222 static void
14223 icmp_kstat_fini(netstackid_t stackid, kstat_t *ksp)
14224 {
14225 if (ksp != NULL) {
14226 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
14227 kstat_delete_netstack(ksp, stackid);
14228 }
14229 }
14230
14231 static int
14232 icmp_kstat_update(kstat_t *kp, int rw)
14233 {
14234 icmp_named_kstat_t *icmpkp;
14235 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private;
14236 netstack_t *ns;
14237 ip_stack_t *ipst;
14238
14239 if (kp->ks_data == NULL)
14240 return (EIO);
14241
14242 if (rw == KSTAT_WRITE)
14243 return (EACCES);
14244
14245 ns = netstack_find_by_stackid(stackid);
14246 if (ns == NULL)
14247 return (-1);
14248 ipst = ns->netstack_ip;
14249 if (ipst == NULL) {
14250 netstack_rele(ns);
14251 return (-1);
14252 }
14253 icmpkp = (icmp_named_kstat_t *)kp->ks_data;
14254
14255 icmpkp->inMsgs.value.ui32 = ipst->ips_icmp_mib.icmpInMsgs;
14256 icmpkp->inErrors.value.ui32 = ipst->ips_icmp_mib.icmpInErrors;
14257 icmpkp->inDestUnreachs.value.ui32 =
14258 ipst->ips_icmp_mib.icmpInDestUnreachs;
14259 icmpkp->inTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpInTimeExcds;
14260 icmpkp->inParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpInParmProbs;
14261 icmpkp->inSrcQuenchs.value.ui32 = ipst->ips_icmp_mib.icmpInSrcQuenchs;
14262 icmpkp->inRedirects.value.ui32 = ipst->ips_icmp_mib.icmpInRedirects;
14263 icmpkp->inEchos.value.ui32 = ipst->ips_icmp_mib.icmpInEchos;
14264 icmpkp->inEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpInEchoReps;
14265 icmpkp->inTimestamps.value.ui32 = ipst->ips_icmp_mib.icmpInTimestamps;
14266 icmpkp->inTimestampReps.value.ui32 =
14267 ipst->ips_icmp_mib.icmpInTimestampReps;
14268 icmpkp->inAddrMasks.value.ui32 = ipst->ips_icmp_mib.icmpInAddrMasks;
14269 icmpkp->inAddrMaskReps.value.ui32 =
14270 ipst->ips_icmp_mib.icmpInAddrMaskReps;
14271 icmpkp->outMsgs.value.ui32 = ipst->ips_icmp_mib.icmpOutMsgs;
14272 icmpkp->outErrors.value.ui32 = ipst->ips_icmp_mib.icmpOutErrors;
14273 icmpkp->outDestUnreachs.value.ui32 =
14274 ipst->ips_icmp_mib.icmpOutDestUnreachs;
14275 icmpkp->outTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpOutTimeExcds;
14276 icmpkp->outParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpOutParmProbs;
14277 icmpkp->outSrcQuenchs.value.ui32 =
14278 ipst->ips_icmp_mib.icmpOutSrcQuenchs;
14279 icmpkp->outRedirects.value.ui32 = ipst->ips_icmp_mib.icmpOutRedirects;
14280 icmpkp->outEchos.value.ui32 = ipst->ips_icmp_mib.icmpOutEchos;
14281 icmpkp->outEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpOutEchoReps;
14282 icmpkp->outTimestamps.value.ui32 =
14283 ipst->ips_icmp_mib.icmpOutTimestamps;
14284 icmpkp->outTimestampReps.value.ui32 =
14285 ipst->ips_icmp_mib.icmpOutTimestampReps;
14286 icmpkp->outAddrMasks.value.ui32 =
14287 ipst->ips_icmp_mib.icmpOutAddrMasks;
14288 icmpkp->outAddrMaskReps.value.ui32 =
14289 ipst->ips_icmp_mib.icmpOutAddrMaskReps;
14290 icmpkp->inCksumErrs.value.ui32 = ipst->ips_icmp_mib.icmpInCksumErrs;
14291 icmpkp->inUnknowns.value.ui32 = ipst->ips_icmp_mib.icmpInUnknowns;
14292 icmpkp->inFragNeeded.value.ui32 = ipst->ips_icmp_mib.icmpInFragNeeded;
14293 icmpkp->outFragNeeded.value.ui32 =
14294 ipst->ips_icmp_mib.icmpOutFragNeeded;
14295 icmpkp->outDrops.value.ui32 = ipst->ips_icmp_mib.icmpOutDrops;
14296 icmpkp->inOverflows.value.ui32 = ipst->ips_icmp_mib.icmpInOverflows;
14297 icmpkp->inBadRedirects.value.ui32 =
14298 ipst->ips_icmp_mib.icmpInBadRedirects;
14299
14300 netstack_rele(ns);
14301 return (0);
14302 }
14303
14304 /*
14305 * This is the fanout function for raw socket opened for SCTP. Note
14306 * that it is called after SCTP checks that there is no socket which
14307 * wants a packet. Then before SCTP handles this out of the blue packet,
14308 * this function is called to see if there is any raw socket for SCTP.
14309 * If there is and it is bound to the correct address, the packet will
14310 * be sent to that socket. Note that only one raw socket can be bound to
14311 * a port. This is assured in ipcl_sctp_hash_insert();
14312 */
14313 void
14314 ip_fanout_sctp_raw(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, uint32_t ports,
14315 ip_recv_attr_t *ira)
14316 {
14317 conn_t *connp;
14318 queue_t *rq;
14319 boolean_t secure;
14320 ill_t *ill = ira->ira_ill;
14321 ip_stack_t *ipst = ill->ill_ipst;
14322 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
14323 sctp_stack_t *sctps = ipst->ips_netstack->netstack_sctp;
14324 iaflags_t iraflags = ira->ira_flags;
14325 ill_t *rill = ira->ira_rill;
14326
14327 secure = iraflags & IRAF_IPSEC_SECURE;
14328
14329 connp = ipcl_classify_raw(mp, IPPROTO_SCTP, ports, ipha, ip6h,
14330 ira, ipst);
14331 if (connp == NULL) {
14332 /*
14333 * Although raw sctp is not summed, OOB chunks must be.
14334 * Drop the packet here if the sctp checksum failed.
14335 */
14336 if (iraflags & IRAF_SCTP_CSUM_ERR) {
14337 SCTPS_BUMP_MIB(sctps, sctpChecksumError);
14338 freemsg(mp);
14339 return;
14340 }
14341 ira->ira_ill = ira->ira_rill = NULL;
14342 sctp_ootb_input(mp, ira, ipst);
14343 ira->ira_ill = ill;
14344 ira->ira_rill = rill;
14345 return;
14346 }
14347 rq = connp->conn_rq;
14348 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld : !canputnext(rq)) {
14349 CONN_DEC_REF(connp);
14350 BUMP_MIB(ill->ill_ip_mib, rawipIfStatsInOverflows);
14351 freemsg(mp);
14352 return;
14353 }
14354 if (((iraflags & IRAF_IS_IPV4) ?
14355 CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
14356 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
14357 secure) {
14358 mp = ipsec_check_inbound_policy(mp, connp, ipha,
14359 ip6h, ira);
14360 if (mp == NULL) {
14361 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
14362 /* Note that mp is NULL */
14363 ip_drop_input("ipIfStatsInDiscards", mp, ill);
14364 CONN_DEC_REF(connp);
14365 return;
14366 }
14367 }
14368
14369 if (iraflags & IRAF_ICMP_ERROR) {
14370 (connp->conn_recvicmp)(connp, mp, NULL, ira);
14371 } else {
14372 ill_t *rill = ira->ira_rill;
14373
14374 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
14375 /* This is the SOCK_RAW, IPPROTO_SCTP case. */
14376 ira->ira_ill = ira->ira_rill = NULL;
14377 (connp->conn_recv)(connp, mp, NULL, ira);
14378 ira->ira_ill = ill;
14379 ira->ira_rill = rill;
14380 }
14381 CONN_DEC_REF(connp);
14382 }
14383
14384 /*
14385 * Free a packet that has the link-layer dl_unitdata_req_t or fast-path
14386 * header before the ip payload.
14387 */
14388 static void
14389 ip_xmit_flowctl_drop(ill_t *ill, mblk_t *mp, boolean_t is_fp_mp, int fp_mp_len)
14390 {
14391 int len = (mp->b_wptr - mp->b_rptr);
14392 mblk_t *ip_mp;
14393
14394 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
14395 if (is_fp_mp || len != fp_mp_len) {
14396 if (len > fp_mp_len) {
14397 /*
14398 * fastpath header and ip header in the first mblk
14399 */
14400 mp->b_rptr += fp_mp_len;
14401 } else {
14402 /*
14403 * ip_xmit_attach_llhdr had to prepend an mblk to
14404 * attach the fastpath header before ip header.
14405 */
14406 ip_mp = mp->b_cont;
14407 freeb(mp);
14408 mp = ip_mp;
14409 mp->b_rptr += (fp_mp_len - len);
14410 }
14411 } else {
14412 ip_mp = mp->b_cont;
14413 freeb(mp);
14414 mp = ip_mp;
14415 }
14416 ip_drop_output("ipIfStatsOutDiscards - flow ctl", mp, ill);
14417 freemsg(mp);
14418 }
14419
14420 /*
14421 * Normal post fragmentation function.
14422 *
14423 * Send a packet using the passed in nce. This handles both IPv4 and IPv6
14424 * using the same state machine.
14425 *
14426 * We return an error on failure. In particular we return EWOULDBLOCK
14427 * when the driver flow controls. In that case this ensures that ip_wsrv runs
14428 * (currently by canputnext failure resulting in backenabling from GLD.)
14429 * This allows the callers of conn_ip_output() to use EWOULDBLOCK as an
14430 * indication that they can flow control until ip_wsrv() tells then to restart.
14431 *
14432 * If the nce passed by caller is incomplete, this function
14433 * queues the packet and if necessary, sends ARP request and bails.
14434 * If the Neighbor Cache passed is fully resolved, we simply prepend
14435 * the link-layer header to the packet, do ipsec hw acceleration
14436 * work if necessary, and send the packet out on the wire.
14437 */
14438 /* ARGSUSED6 */
14439 int
14440 ip_xmit(mblk_t *mp, nce_t *nce, iaflags_t ixaflags, uint_t pkt_len,
14441 uint32_t xmit_hint, zoneid_t szone, zoneid_t nolzid, uintptr_t *ixacookie)
14442 {
14443 queue_t *wq;
14444 ill_t *ill = nce->nce_ill;
14445 ip_stack_t *ipst = ill->ill_ipst;
14446 uint64_t delta;
14447 boolean_t isv6 = ill->ill_isv6;
14448 boolean_t fp_mp;
14449 ncec_t *ncec = nce->nce_common;
14450 int64_t now = LBOLT_FASTPATH64;
14451 boolean_t is_probe;
14452
14453 DTRACE_PROBE1(ip__xmit, nce_t *, nce);
14454
14455 ASSERT(mp != NULL);
14456 ASSERT(mp->b_datap->db_type == M_DATA);
14457 ASSERT(pkt_len == msgdsize(mp));
14458
14459 /*
14460 * If we have already been here and are coming back after ARP/ND.
14461 * the IXAF_NO_TRACE flag is set. We skip FW_HOOKS, DTRACE and ipobs
14462 * in that case since they have seen the packet when it came here
14463 * the first time.
14464 */
14465 if (ixaflags & IXAF_NO_TRACE)
14466 goto sendit;
14467
14468 if (ixaflags & IXAF_IS_IPV4) {
14469 ipha_t *ipha = (ipha_t *)mp->b_rptr;
14470
14471 ASSERT(!isv6);
14472 ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length));
14473 if (HOOKS4_INTERESTED_PHYSICAL_OUT(ipst) &&
14474 !(ixaflags & IXAF_NO_PFHOOK)) {
14475 int error;
14476
14477 FW_HOOKS(ipst->ips_ip4_physical_out_event,
14478 ipst->ips_ipv4firewall_physical_out,
14479 NULL, ill, ipha, mp, mp, 0, ipst, error);
14480 DTRACE_PROBE1(ip4__physical__out__end,
14481 mblk_t *, mp);
14482 if (mp == NULL)
14483 return (error);
14484
14485 /* The length could have changed */
14486 pkt_len = msgdsize(mp);
14487 }
14488 if (ipst->ips_ip4_observe.he_interested) {
14489 /*
14490 * Note that for TX the zoneid is the sending
14491 * zone, whether or not MLP is in play.
14492 * Since the szone argument is the IP zoneid (i.e.,
14493 * zero for exclusive-IP zones) and ipobs wants
14494 * the system zoneid, we map it here.
14495 */
14496 szone = IP_REAL_ZONEID(szone, ipst);
14497
14498 /*
14499 * On the outbound path the destination zone will be
14500 * unknown as we're sending this packet out on the
14501 * wire.
14502 */
14503 ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone, ALL_ZONES,
14504 ill, ipst);
14505 }
14506 DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL,
14507 void_ip_t *, ipha, __dtrace_ipsr_ill_t *, ill,
14508 ipha_t *, ipha, ip6_t *, NULL, int, 0);
14509 } else {
14510 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
14511
14512 ASSERT(isv6);
14513 ASSERT(pkt_len ==
14514 ntohs(((ip6_t *)mp->b_rptr)->ip6_plen) + IPV6_HDR_LEN);
14515 if (HOOKS6_INTERESTED_PHYSICAL_OUT(ipst) &&
14516 !(ixaflags & IXAF_NO_PFHOOK)) {
14517 int error;
14518
14519 FW_HOOKS6(ipst->ips_ip6_physical_out_event,
14520 ipst->ips_ipv6firewall_physical_out,
14521 NULL, ill, ip6h, mp, mp, 0, ipst, error);
14522 DTRACE_PROBE1(ip6__physical__out__end,
14523 mblk_t *, mp);
14524 if (mp == NULL)
14525 return (error);
14526
14527 /* The length could have changed */
14528 pkt_len = msgdsize(mp);
14529 }
14530 if (ipst->ips_ip6_observe.he_interested) {
14531 /* See above */
14532 szone = IP_REAL_ZONEID(szone, ipst);
14533
14534 ipobs_hook(mp, IPOBS_HOOK_OUTBOUND, szone, ALL_ZONES,
14535 ill, ipst);
14536 }
14537 DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL,
14538 void_ip_t *, ip6h, __dtrace_ipsr_ill_t *, ill,
14539 ipha_t *, NULL, ip6_t *, ip6h, int, 0);
14540 }
14541
14542 sendit:
14543 /*
14544 * We check the state without a lock because the state can never
14545 * move "backwards" to initial or incomplete.
14546 */
14547 switch (ncec->ncec_state) {
14548 case ND_REACHABLE:
14549 case ND_STALE:
14550 case ND_DELAY:
14551 case ND_PROBE:
14552 mp = ip_xmit_attach_llhdr(mp, nce);
14553 if (mp == NULL) {
14554 /*
14555 * ip_xmit_attach_llhdr has increased
14556 * ipIfStatsOutDiscards and called ip_drop_output()
14557 */
14558 return (ENOBUFS);
14559 }
14560 /*
14561 * check if nce_fastpath completed and we tagged on a
14562 * copy of nce_fp_mp in ip_xmit_attach_llhdr().
14563 */
14564 fp_mp = (mp->b_datap->db_type == M_DATA);
14565
14566 if (fp_mp &&
14567 (ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT)) {
14568 ill_dld_direct_t *idd;
14569
14570 idd = &ill->ill_dld_capab->idc_direct;
14571 /*
14572 * Send the packet directly to DLD, where it
14573 * may be queued depending on the availability
14574 * of transmit resources at the media layer.
14575 * Return value should be taken into
14576 * account and flow control the TCP.
14577 */
14578 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits);
14579 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
14580 pkt_len);
14581
14582 if (ixaflags & IXAF_NO_DEV_FLOW_CTL) {
14583 (void) idd->idd_tx_df(idd->idd_tx_dh, mp,
14584 (uintptr_t)xmit_hint, IP_DROP_ON_NO_DESC);
14585 } else {
14586 uintptr_t cookie;
14587
14588 if ((cookie = idd->idd_tx_df(idd->idd_tx_dh,
14589 mp, (uintptr_t)xmit_hint, 0)) != 0) {
14590 if (ixacookie != NULL)
14591 *ixacookie = cookie;
14592 return (EWOULDBLOCK);
14593 }
14594 }
14595 } else {
14596 wq = ill->ill_wq;
14597
14598 if (!(ixaflags & IXAF_NO_DEV_FLOW_CTL) &&
14599 !canputnext(wq)) {
14600 if (ixacookie != NULL)
14601 *ixacookie = 0;
14602 ip_xmit_flowctl_drop(ill, mp, fp_mp,
14603 nce->nce_fp_mp != NULL ?
14604 MBLKL(nce->nce_fp_mp) : 0);
14605 return (EWOULDBLOCK);
14606 }
14607 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits);
14608 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets,
14609 pkt_len);
14610 putnext(wq, mp);
14611 }
14612
14613 /*
14614 * The rest of this function implements Neighbor Unreachability
14615 * detection. Determine if the ncec is eligible for NUD.
14616 */
14617 if (ncec->ncec_flags & NCE_F_NONUD)
14618 return (0);
14619
14620 ASSERT(ncec->ncec_state != ND_INCOMPLETE);
14621
14622 /*
14623 * Check for upper layer advice
14624 */
14625 if (ixaflags & IXAF_REACH_CONF) {
14626 timeout_id_t tid;
14627
14628 /*
14629 * It should be o.k. to check the state without
14630 * a lock here, at most we lose an advice.
14631 */
14632 ncec->ncec_last = TICK_TO_MSEC(now);
14633 if (ncec->ncec_state != ND_REACHABLE) {
14634 mutex_enter(&ncec->ncec_lock);
14635 ncec->ncec_state = ND_REACHABLE;
14636 tid = ncec->ncec_timeout_id;
14637 ncec->ncec_timeout_id = 0;
14638 mutex_exit(&ncec->ncec_lock);
14639 (void) untimeout(tid);
14640 if (ip_debug > 2) {
14641 /* ip1dbg */
14642 pr_addr_dbg("ip_xmit: state"
14643 " for %s changed to"
14644 " REACHABLE\n", AF_INET6,
14645 &ncec->ncec_addr);
14646 }
14647 }
14648 return (0);
14649 }
14650
14651 delta = TICK_TO_MSEC(now) - ncec->ncec_last;
14652 ip1dbg(("ip_xmit: delta = %" PRId64
14653 " ill_reachable_time = %d \n", delta,
14654 ill->ill_reachable_time));
14655 if (delta > (uint64_t)ill->ill_reachable_time) {
14656 mutex_enter(&ncec->ncec_lock);
14657 switch (ncec->ncec_state) {
14658 case ND_REACHABLE:
14659 ASSERT((ncec->ncec_flags & NCE_F_NONUD) == 0);
14660 /* FALLTHROUGH */
14661 case ND_STALE:
14662 /*
14663 * ND_REACHABLE is identical to
14664 * ND_STALE in this specific case. If
14665 * reachable time has expired for this
14666 * neighbor (delta is greater than
14667 * reachable time), conceptually, the
14668 * neighbor cache is no longer in
14669 * REACHABLE state, but already in
14670 * STALE state. So the correct
14671 * transition here is to ND_DELAY.
14672 */
14673 ncec->ncec_state = ND_DELAY;
14674 mutex_exit(&ncec->ncec_lock);
14675 nce_restart_timer(ncec,
14676 ipst->ips_delay_first_probe_time);
14677 if (ip_debug > 3) {
14678 /* ip2dbg */
14679 pr_addr_dbg("ip_xmit: state"
14680 " for %s changed to"
14681 " DELAY\n", AF_INET6,
14682 &ncec->ncec_addr);
14683 }
14684 break;
14685 case ND_DELAY:
14686 case ND_PROBE:
14687 mutex_exit(&ncec->ncec_lock);
14688 /* Timers have already started */
14689 break;
14690 case ND_UNREACHABLE:
14691 /*
14692 * nce_timer has detected that this ncec
14693 * is unreachable and initiated deleting
14694 * this ncec.
14695 * This is a harmless race where we found the
14696 * ncec before it was deleted and have
14697 * just sent out a packet using this
14698 * unreachable ncec.
14699 */
14700 mutex_exit(&ncec->ncec_lock);
14701 break;
14702 default:
14703 ASSERT(0);
14704 mutex_exit(&ncec->ncec_lock);
14705 }
14706 }
14707 return (0);
14708
14709 case ND_INCOMPLETE:
14710 /*
14711 * the state could have changed since we didn't hold the lock.
14712 * Re-verify state under lock.
14713 */
14714 is_probe = ipmp_packet_is_probe(mp, nce->nce_ill);
14715 mutex_enter(&ncec->ncec_lock);
14716 if (NCE_ISREACHABLE(ncec)) {
14717 mutex_exit(&ncec->ncec_lock);
14718 goto sendit;
14719 }
14720 /* queue the packet */
14721 nce_queue_mp(ncec, mp, is_probe);
14722 mutex_exit(&ncec->ncec_lock);
14723 DTRACE_PROBE2(ip__xmit__incomplete,
14724 (ncec_t *), ncec, (mblk_t *), mp);
14725 return (0);
14726
14727 case ND_INITIAL:
14728 /*
14729 * State could have changed since we didn't hold the lock, so
14730 * re-verify state.
14731 */
14732 is_probe = ipmp_packet_is_probe(mp, nce->nce_ill);
14733 mutex_enter(&ncec->ncec_lock);
14734 if (NCE_ISREACHABLE(ncec)) {
14735 mutex_exit(&ncec->ncec_lock);
14736 goto sendit;
14737 }
14738 nce_queue_mp(ncec, mp, is_probe);
14739 if (ncec->ncec_state == ND_INITIAL) {
14740 ncec->ncec_state = ND_INCOMPLETE;
14741 mutex_exit(&ncec->ncec_lock);
14742 /*
14743 * figure out the source we want to use
14744 * and resolve it.
14745 */
14746 ip_ndp_resolve(ncec);
14747 } else {
14748 mutex_exit(&ncec->ncec_lock);
14749 }
14750 return (0);
14751
14752 case ND_UNREACHABLE:
14753 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
14754 ip_drop_output("ipIfStatsOutDiscards - ND_UNREACHABLE",
14755 mp, ill);
14756 freemsg(mp);
14757 return (0);
14758
14759 default:
14760 ASSERT(0);
14761 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
14762 ip_drop_output("ipIfStatsOutDiscards - ND_other",
14763 mp, ill);
14764 freemsg(mp);
14765 return (ENETUNREACH);
14766 }
14767 }
14768
14769 /*
14770 * Return B_TRUE if the buffers differ in length or content.
14771 * This is used for comparing extension header buffers.
14772 * Note that an extension header would be declared different
14773 * even if all that changed was the next header value in that header i.e.
14774 * what really changed is the next extension header.
14775 */
14776 boolean_t
14777 ip_cmpbuf(const void *abuf, uint_t alen, boolean_t b_valid, const void *bbuf,
14778 uint_t blen)
14779 {
14780 if (!b_valid)
14781 blen = 0;
14782
14783 if (alen != blen)
14784 return (B_TRUE);
14785 if (alen == 0)
14786 return (B_FALSE); /* Both zero length */
14787 return (bcmp(abuf, bbuf, alen));
14788 }
14789
14790 /*
14791 * Preallocate memory for ip_savebuf(). Returns B_TRUE if ok.
14792 * Return B_FALSE if memory allocation fails - don't change any state!
14793 */
14794 boolean_t
14795 ip_allocbuf(void **dstp, uint_t *dstlenp, boolean_t src_valid,
14796 const void *src, uint_t srclen)
14797 {
14798 void *dst;
14799
14800 if (!src_valid)
14801 srclen = 0;
14802
14803 ASSERT(*dstlenp == 0);
14804 if (src != NULL && srclen != 0) {
14805 dst = mi_alloc(srclen, BPRI_MED);
14806 if (dst == NULL)
14807 return (B_FALSE);
14808 } else {
14809 dst = NULL;
14810 }
14811 if (*dstp != NULL)
14812 mi_free(*dstp);
14813 *dstp = dst;
14814 *dstlenp = dst == NULL ? 0 : srclen;
14815 return (B_TRUE);
14816 }
14817
14818 /*
14819 * Replace what is in *dst, *dstlen with the source.
14820 * Assumes ip_allocbuf has already been called.
14821 */
14822 void
14823 ip_savebuf(void **dstp, uint_t *dstlenp, boolean_t src_valid,
14824 const void *src, uint_t srclen)
14825 {
14826 if (!src_valid)
14827 srclen = 0;
14828
14829 ASSERT(*dstlenp == srclen);
14830 if (src != NULL && srclen != 0)
14831 bcopy(src, *dstp, srclen);
14832 }
14833
14834 /*
14835 * Free the storage pointed to by the members of an ip_pkt_t.
14836 */
14837 void
14838 ip_pkt_free(ip_pkt_t *ipp)
14839 {
14840 uint_t fields = ipp->ipp_fields;
14841
14842 if (fields & IPPF_HOPOPTS) {
14843 kmem_free(ipp->ipp_hopopts, ipp->ipp_hopoptslen);
14844 ipp->ipp_hopopts = NULL;
14845 ipp->ipp_hopoptslen = 0;
14846 }
14847 if (fields & IPPF_RTHDRDSTOPTS) {
14848 kmem_free(ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
14849 ipp->ipp_rthdrdstopts = NULL;
14850 ipp->ipp_rthdrdstoptslen = 0;
14851 }
14852 if (fields & IPPF_DSTOPTS) {
14853 kmem_free(ipp->ipp_dstopts, ipp->ipp_dstoptslen);
14854 ipp->ipp_dstopts = NULL;
14855 ipp->ipp_dstoptslen = 0;
14856 }
14857 if (fields & IPPF_RTHDR) {
14858 kmem_free(ipp->ipp_rthdr, ipp->ipp_rthdrlen);
14859 ipp->ipp_rthdr = NULL;
14860 ipp->ipp_rthdrlen = 0;
14861 }
14862 if (fields & IPPF_IPV4_OPTIONS) {
14863 kmem_free(ipp->ipp_ipv4_options, ipp->ipp_ipv4_options_len);
14864 ipp->ipp_ipv4_options = NULL;
14865 ipp->ipp_ipv4_options_len = 0;
14866 }
14867 if (fields & IPPF_LABEL_V4) {
14868 kmem_free(ipp->ipp_label_v4, ipp->ipp_label_len_v4);
14869 ipp->ipp_label_v4 = NULL;
14870 ipp->ipp_label_len_v4 = 0;
14871 }
14872 if (fields & IPPF_LABEL_V6) {
14873 kmem_free(ipp->ipp_label_v6, ipp->ipp_label_len_v6);
14874 ipp->ipp_label_v6 = NULL;
14875 ipp->ipp_label_len_v6 = 0;
14876 }
14877 ipp->ipp_fields &= ~(IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS |
14878 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6);
14879 }
14880
14881 /*
14882 * Copy from src to dst and allocate as needed.
14883 * Returns zero or ENOMEM.
14884 *
14885 * The caller must initialize dst to zero.
14886 */
14887 int
14888 ip_pkt_copy(ip_pkt_t *src, ip_pkt_t *dst, int kmflag)
14889 {
14890 uint_t fields = src->ipp_fields;
14891
14892 /* Start with fields that don't require memory allocation */
14893 dst->ipp_fields = fields &
14894 ~(IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS |
14895 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6);
14896
14897 dst->ipp_addr = src->ipp_addr;
14898 dst->ipp_unicast_hops = src->ipp_unicast_hops;
14899 dst->ipp_hoplimit = src->ipp_hoplimit;
14900 dst->ipp_tclass = src->ipp_tclass;
14901 dst->ipp_type_of_service = src->ipp_type_of_service;
14902
14903 if (!(fields & (IPPF_HOPOPTS | IPPF_RTHDRDSTOPTS | IPPF_DSTOPTS |
14904 IPPF_RTHDR | IPPF_IPV4_OPTIONS | IPPF_LABEL_V4 | IPPF_LABEL_V6)))
14905 return (0);
14906
14907 if (fields & IPPF_HOPOPTS) {
14908 dst->ipp_hopopts = kmem_alloc(src->ipp_hopoptslen, kmflag);
14909 if (dst->ipp_hopopts == NULL) {
14910 ip_pkt_free(dst);
14911 return (ENOMEM);
14912 }
14913 dst->ipp_fields |= IPPF_HOPOPTS;
14914 bcopy(src->ipp_hopopts, dst->ipp_hopopts,
14915 src->ipp_hopoptslen);
14916 dst->ipp_hopoptslen = src->ipp_hopoptslen;
14917 }
14918 if (fields & IPPF_RTHDRDSTOPTS) {
14919 dst->ipp_rthdrdstopts = kmem_alloc(src->ipp_rthdrdstoptslen,
14920 kmflag);
14921 if (dst->ipp_rthdrdstopts == NULL) {
14922 ip_pkt_free(dst);
14923 return (ENOMEM);
14924 }
14925 dst->ipp_fields |= IPPF_RTHDRDSTOPTS;
14926 bcopy(src->ipp_rthdrdstopts, dst->ipp_rthdrdstopts,
14927 src->ipp_rthdrdstoptslen);
14928 dst->ipp_rthdrdstoptslen = src->ipp_rthdrdstoptslen;
14929 }
14930 if (fields & IPPF_DSTOPTS) {
14931 dst->ipp_dstopts = kmem_alloc(src->ipp_dstoptslen, kmflag);
14932 if (dst->ipp_dstopts == NULL) {
14933 ip_pkt_free(dst);
14934 return (ENOMEM);
14935 }
14936 dst->ipp_fields |= IPPF_DSTOPTS;
14937 bcopy(src->ipp_dstopts, dst->ipp_dstopts,
14938 src->ipp_dstoptslen);
14939 dst->ipp_dstoptslen = src->ipp_dstoptslen;
14940 }
14941 if (fields & IPPF_RTHDR) {
14942 dst->ipp_rthdr = kmem_alloc(src->ipp_rthdrlen, kmflag);
14943 if (dst->ipp_rthdr == NULL) {
14944 ip_pkt_free(dst);
14945 return (ENOMEM);
14946 }
14947 dst->ipp_fields |= IPPF_RTHDR;
14948 bcopy(src->ipp_rthdr, dst->ipp_rthdr,
14949 src->ipp_rthdrlen);
14950 dst->ipp_rthdrlen = src->ipp_rthdrlen;
14951 }
14952 if (fields & IPPF_IPV4_OPTIONS) {
14953 dst->ipp_ipv4_options = kmem_alloc(src->ipp_ipv4_options_len,
14954 kmflag);
14955 if (dst->ipp_ipv4_options == NULL) {
14956 ip_pkt_free(dst);
14957 return (ENOMEM);
14958 }
14959 dst->ipp_fields |= IPPF_IPV4_OPTIONS;
14960 bcopy(src->ipp_ipv4_options, dst->ipp_ipv4_options,
14961 src->ipp_ipv4_options_len);
14962 dst->ipp_ipv4_options_len = src->ipp_ipv4_options_len;
14963 }
14964 if (fields & IPPF_LABEL_V4) {
14965 dst->ipp_label_v4 = kmem_alloc(src->ipp_label_len_v4, kmflag);
14966 if (dst->ipp_label_v4 == NULL) {
14967 ip_pkt_free(dst);
14968 return (ENOMEM);
14969 }
14970 dst->ipp_fields |= IPPF_LABEL_V4;
14971 bcopy(src->ipp_label_v4, dst->ipp_label_v4,
14972 src->ipp_label_len_v4);
14973 dst->ipp_label_len_v4 = src->ipp_label_len_v4;
14974 }
14975 if (fields & IPPF_LABEL_V6) {
14976 dst->ipp_label_v6 = kmem_alloc(src->ipp_label_len_v6, kmflag);
14977 if (dst->ipp_label_v6 == NULL) {
14978 ip_pkt_free(dst);
14979 return (ENOMEM);
14980 }
14981 dst->ipp_fields |= IPPF_LABEL_V6;
14982 bcopy(src->ipp_label_v6, dst->ipp_label_v6,
14983 src->ipp_label_len_v6);
14984 dst->ipp_label_len_v6 = src->ipp_label_len_v6;
14985 }
14986 if (fields & IPPF_FRAGHDR) {
14987 dst->ipp_fraghdr = kmem_alloc(src->ipp_fraghdrlen, kmflag);
14988 if (dst->ipp_fraghdr == NULL) {
14989 ip_pkt_free(dst);
14990 return (ENOMEM);
14991 }
14992 dst->ipp_fields |= IPPF_FRAGHDR;
14993 bcopy(src->ipp_fraghdr, dst->ipp_fraghdr,
14994 src->ipp_fraghdrlen);
14995 dst->ipp_fraghdrlen = src->ipp_fraghdrlen;
14996 }
14997 return (0);
14998 }
14999
15000 /*
15001 * Returns INADDR_ANY if no source route
15002 */
15003 ipaddr_t
15004 ip_pkt_source_route_v4(const ip_pkt_t *ipp)
15005 {
15006 ipaddr_t nexthop = INADDR_ANY;
15007 ipoptp_t opts;
15008 uchar_t *opt;
15009 uint8_t optval;
15010 uint8_t optlen;
15011 uint32_t totallen;
15012
15013 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
15014 return (INADDR_ANY);
15015
15016 totallen = ipp->ipp_ipv4_options_len;
15017 if (totallen & 0x3)
15018 return (INADDR_ANY);
15019
15020 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
15021 optval != IPOPT_EOL;
15022 optval = ipoptp_next(&opts)) {
15023 opt = opts.ipoptp_cur;
15024 switch (optval) {
15025 uint8_t off;
15026 case IPOPT_SSRR:
15027 case IPOPT_LSRR:
15028 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15029 break;
15030 }
15031 optlen = opts.ipoptp_len;
15032 off = opt[IPOPT_OFFSET];
15033 off--;
15034 if (optlen < IP_ADDR_LEN ||
15035 off > optlen - IP_ADDR_LEN) {
15036 /* End of source route */
15037 break;
15038 }
15039 bcopy((char *)opt + off, &nexthop, IP_ADDR_LEN);
15040 if (nexthop == htonl(INADDR_LOOPBACK)) {
15041 /* Ignore */
15042 nexthop = INADDR_ANY;
15043 break;
15044 }
15045 break;
15046 }
15047 }
15048 return (nexthop);
15049 }
15050
15051 /*
15052 * Reverse a source route.
15053 */
15054 void
15055 ip_pkt_source_route_reverse_v4(ip_pkt_t *ipp)
15056 {
15057 ipaddr_t tmp;
15058 ipoptp_t opts;
15059 uchar_t *opt;
15060 uint8_t optval;
15061 uint32_t totallen;
15062
15063 if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
15064 return;
15065
15066 totallen = ipp->ipp_ipv4_options_len;
15067 if (totallen & 0x3)
15068 return;
15069
15070 for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
15071 optval != IPOPT_EOL;
15072 optval = ipoptp_next(&opts)) {
15073 uint8_t off1, off2;
15074
15075 opt = opts.ipoptp_cur;
15076 switch (optval) {
15077 case IPOPT_SSRR:
15078 case IPOPT_LSRR:
15079 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
15080 break;
15081 }
15082 off1 = IPOPT_MINOFF_SR - 1;
15083 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
15084 while (off2 > off1) {
15085 bcopy(opt + off2, &tmp, IP_ADDR_LEN);
15086 bcopy(opt + off1, opt + off2, IP_ADDR_LEN);
15087 bcopy(&tmp, opt + off2, IP_ADDR_LEN);
15088 off2 -= IP_ADDR_LEN;
15089 off1 += IP_ADDR_LEN;
15090 }
15091 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
15092 break;
15093 }
15094 }
15095 }
15096
15097 /*
15098 * Returns NULL if no routing header
15099 */
15100 in6_addr_t *
15101 ip_pkt_source_route_v6(const ip_pkt_t *ipp)
15102 {
15103 in6_addr_t *nexthop = NULL;
15104 ip6_rthdr0_t *rthdr;
15105
15106 if (!(ipp->ipp_fields & IPPF_RTHDR))
15107 return (NULL);
15108
15109 rthdr = (ip6_rthdr0_t *)ipp->ipp_rthdr;
15110 if (rthdr->ip6r0_segleft == 0)
15111 return (NULL);
15112
15113 nexthop = (in6_addr_t *)((char *)rthdr + sizeof (*rthdr));
15114 return (nexthop);
15115 }
15116
15117 zoneid_t
15118 ip_get_zoneid_v4(ipaddr_t addr, mblk_t *mp, ip_recv_attr_t *ira,
15119 zoneid_t lookup_zoneid)
15120 {
15121 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
15122 ire_t *ire;
15123 int ire_flags = MATCH_IRE_TYPE;
15124 zoneid_t zoneid = ALL_ZONES;
15125
15126 if (is_system_labeled() && !tsol_can_accept_raw(mp, ira, B_FALSE))
15127 return (ALL_ZONES);
15128
15129 if (lookup_zoneid != ALL_ZONES)
15130 ire_flags |= MATCH_IRE_ZONEONLY;
15131 ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_LOCAL | IRE_LOOPBACK,
15132 NULL, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL);
15133 if (ire != NULL) {
15134 zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst);
15135 ire_refrele(ire);
15136 }
15137 return (zoneid);
15138 }
15139
15140 zoneid_t
15141 ip_get_zoneid_v6(in6_addr_t *addr, mblk_t *mp, const ill_t *ill,
15142 ip_recv_attr_t *ira, zoneid_t lookup_zoneid)
15143 {
15144 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
15145 ire_t *ire;
15146 int ire_flags = MATCH_IRE_TYPE;
15147 zoneid_t zoneid = ALL_ZONES;
15148
15149 if (is_system_labeled() && !tsol_can_accept_raw(mp, ira, B_FALSE))
15150 return (ALL_ZONES);
15151
15152 if (IN6_IS_ADDR_LINKLOCAL(addr))
15153 ire_flags |= MATCH_IRE_ILL;
15154
15155 if (lookup_zoneid != ALL_ZONES)
15156 ire_flags |= MATCH_IRE_ZONEONLY;
15157 ire = ire_ftable_lookup_v6(addr, NULL, NULL, IRE_LOCAL | IRE_LOOPBACK,
15158 ill, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL);
15159 if (ire != NULL) {
15160 zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst);
15161 ire_refrele(ire);
15162 }
15163 return (zoneid);
15164 }
15165
15166 /*
15167 * IP obserability hook support functions.
15168 */
15169 static void
15170 ipobs_init(ip_stack_t *ipst)
15171 {
15172 netid_t id;
15173
15174 id = net_getnetidbynetstackid(ipst->ips_netstack->netstack_stackid);
15175
15176 ipst->ips_ip4_observe_pr = net_protocol_lookup(id, NHF_INET);
15177 VERIFY(ipst->ips_ip4_observe_pr != NULL);
15178
15179 ipst->ips_ip6_observe_pr = net_protocol_lookup(id, NHF_INET6);
15180 VERIFY(ipst->ips_ip6_observe_pr != NULL);
15181 }
15182
15183 static void
15184 ipobs_fini(ip_stack_t *ipst)
15185 {
15186
15187 VERIFY(net_protocol_release(ipst->ips_ip4_observe_pr) == 0);
15188 VERIFY(net_protocol_release(ipst->ips_ip6_observe_pr) == 0);
15189 }
15190
15191 /*
15192 * hook_pkt_observe_t is composed in network byte order so that the
15193 * entire mblk_t chain handed into hook_run can be used as-is.
15194 * The caveat is that use of the fields, such as the zone fields,
15195 * requires conversion into host byte order first.
15196 */
15197 void
15198 ipobs_hook(mblk_t *mp, int htype, zoneid_t zsrc, zoneid_t zdst,
15199 const ill_t *ill, ip_stack_t *ipst)
15200 {
15201 hook_pkt_observe_t *hdr;
15202 uint64_t grifindex;
15203 mblk_t *imp;
15204
15205 imp = allocb(sizeof (*hdr), BPRI_HI);
15206 if (imp == NULL)
15207 return;
15208
15209 hdr = (hook_pkt_observe_t *)imp->b_rptr;
15210 /*
15211 * b_wptr is set to make the apparent size of the data in the mblk_t
15212 * to exclude the pointers at the end of hook_pkt_observer_t.
15213 */
15214 imp->b_wptr = imp->b_rptr + sizeof (dl_ipnetinfo_t);
15215 imp->b_cont = mp;
15216
15217 ASSERT(DB_TYPE(mp) == M_DATA);
15218
15219 if (IS_UNDER_IPMP(ill))
15220 grifindex = ipmp_ill_get_ipmp_ifindex(ill);
15221 else
15222 grifindex = 0;
15223
15224 hdr->hpo_version = 1;
15225 hdr->hpo_htype = htons(htype);
15226 hdr->hpo_pktlen = htonl((ulong_t)msgdsize(mp));
15227 hdr->hpo_ifindex = htonl(ill->ill_phyint->phyint_ifindex);
15228 hdr->hpo_grifindex = htonl(grifindex);
15229 hdr->hpo_zsrc = htonl(zsrc);
15230 hdr->hpo_zdst = htonl(zdst);
15231 hdr->hpo_pkt = imp;
15232 hdr->hpo_ctx = ipst->ips_netstack;
15233
15234 if (ill->ill_isv6) {
15235 hdr->hpo_family = AF_INET6;
15236 (void) hook_run(ipst->ips_ipv6_net_data->netd_hooks,
15237 ipst->ips_ipv6observing, (hook_data_t)hdr);
15238 } else {
15239 hdr->hpo_family = AF_INET;
15240 (void) hook_run(ipst->ips_ipv4_net_data->netd_hooks,
15241 ipst->ips_ipv4observing, (hook_data_t)hdr);
15242 }
15243
15244 imp->b_cont = NULL;
15245 freemsg(imp);
15246 }
15247
15248 /*
15249 * Utility routine that checks if `v4srcp' is a valid address on underlying
15250 * interface `ill'. If `ipifp' is non-NULL, it's set to a held ipif
15251 * associated with `v4srcp' on success. NOTE: if this is not called from
15252 * inside the IPSQ (ill_g_lock is not held), `ill' may be removed from the
15253 * group during or after this lookup.
15254 */
15255 boolean_t
15256 ipif_lookup_testaddr_v4(ill_t *ill, const in_addr_t *v4srcp, ipif_t **ipifp)
15257 {
15258 ipif_t *ipif;
15259
15260 ipif = ipif_lookup_addr_exact(*v4srcp, ill, ill->ill_ipst);
15261 if (ipif != NULL) {
15262 if (ipifp != NULL)
15263 *ipifp = ipif;
15264 else
15265 ipif_refrele(ipif);
15266 return (B_TRUE);
15267 }
15268
15269 ip1dbg(("ipif_lookup_testaddr_v4: cannot find ipif for src %x\n",
15270 *v4srcp));
15271 return (B_FALSE);
15272 }
15273
15274 /*
15275 * Transport protocol call back function for CPU state change.
15276 */
15277 /* ARGSUSED */
15278 static int
15279 ip_tp_cpu_update(cpu_setup_t what, int id, void *arg)
15280 {
15281 processorid_t cpu_seqid;
15282 netstack_handle_t nh;
15283 netstack_t *ns;
15284
15285 ASSERT(MUTEX_HELD(&cpu_lock));
15286
15287 switch (what) {
15288 case CPU_CONFIG:
15289 case CPU_ON:
15290 case CPU_INIT:
15291 case CPU_CPUPART_IN:
15292 cpu_seqid = cpu[id]->cpu_seqid;
15293 netstack_next_init(&nh);
15294 while ((ns = netstack_next(&nh)) != NULL) {
15295 tcp_stack_cpu_add(ns->netstack_tcp, cpu_seqid);
15296 sctp_stack_cpu_add(ns->netstack_sctp, cpu_seqid);
15297 udp_stack_cpu_add(ns->netstack_udp, cpu_seqid);
15298 netstack_rele(ns);
15299 }
15300 netstack_next_fini(&nh);
15301 break;
15302 case CPU_UNCONFIG:
15303 case CPU_OFF:
15304 case CPU_CPUPART_OUT:
15305 /*
15306 * Nothing to do. We don't remove the per CPU stats from
15307 * the IP stack even when the CPU goes offline.
15308 */
15309 break;
15310 default:
15311 break;
15312 }
15313 return (0);
15314 }