1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright (c) 2013 by Delphix. All rights reserved.
24 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
25 */
26 /* Copyright (c) 1990 Mentat Inc. */
27
28 #include <sys/types.h>
29 #include <sys/stream.h>
30 #include <sys/stropts.h>
31 #include <sys/strlog.h>
32 #include <sys/strsun.h>
33 #define _SUN_TPI_VERSION 2
34 #include <sys/tihdr.h>
35 #include <sys/timod.h>
36 #include <sys/ddi.h>
37 #include <sys/sunddi.h>
38 #include <sys/strsubr.h>
39 #include <sys/suntpi.h>
40 #include <sys/xti_inet.h>
41 #include <sys/cmn_err.h>
42 #include <sys/kmem.h>
43 #include <sys/cred.h>
44 #include <sys/policy.h>
45 #include <sys/priv.h>
46 #include <sys/ucred.h>
47 #include <sys/zone.h>
48
49 #include <sys/sockio.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/vtrace.h>
53 #include <sys/sdt.h>
54 #include <sys/debug.h>
55 #include <sys/isa_defs.h>
56 #include <sys/random.h>
57 #include <netinet/in.h>
58 #include <netinet/ip6.h>
59 #include <netinet/icmp6.h>
60 #include <netinet/udp.h>
61
62 #include <inet/common.h>
63 #include <inet/ip.h>
64 #include <inet/ip_impl.h>
65 #include <inet/ipsec_impl.h>
66 #include <inet/ip6.h>
67 #include <inet/ip_ire.h>
68 #include <inet/ip_if.h>
69 #include <inet/ip_multi.h>
70 #include <inet/ip_ndp.h>
71 #include <inet/proto_set.h>
72 #include <inet/mib2.h>
73 #include <inet/nd.h>
74 #include <inet/optcom.h>
75 #include <inet/snmpcom.h>
76 #include <inet/kstatcom.h>
77 #include <inet/ipclassifier.h>
78
79 #include <sys/tsol/label.h>
80 #include <sys/tsol/tnet.h>
81
82 #include <inet/rawip_impl.h>
83
84 #include <sys/disp.h>
85
86 /*
87 * Synchronization notes:
88 *
89 * RAWIP is MT and uses the usual kernel synchronization primitives. We use
90 * conn_lock to protect the icmp_t.
91 *
92 * Plumbing notes:
93 * ICMP is always a device driver. For compatibility with mibopen() code
94 * it is possible to I_PUSH "icmp", but that results in pushing a passthrough
95 * dummy module.
96 */
97 static void icmp_addr_req(queue_t *q, mblk_t *mp);
98 static void icmp_tpi_bind(queue_t *q, mblk_t *mp);
99 static void icmp_bind_proto(icmp_t *icmp);
100 static int icmp_build_hdr_template(conn_t *, const in6_addr_t *,
101 const in6_addr_t *, uint32_t);
102 static void icmp_capability_req(queue_t *q, mblk_t *mp);
103 static int icmp_close(queue_t *q, int flags, cred_t *);
104 static void icmp_close_free(conn_t *);
105 static void icmp_tpi_connect(queue_t *q, mblk_t *mp);
106 static void icmp_tpi_disconnect(queue_t *q, mblk_t *mp);
107 static void icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
108 int sys_error);
109 static void icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
110 t_scalar_t tlierr, int sys_error);
111 static void icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2,
112 ip_recv_attr_t *);
113 static void icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
114 ip_recv_attr_t *);
115 static void icmp_info_req(queue_t *q, mblk_t *mp);
116 static void icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
117 static conn_t *icmp_open(int family, cred_t *credp, int *err, int flags);
118 static int icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
119 cred_t *credp);
120 static int icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
121 cred_t *credp);
122 static boolean_t icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
123 int icmp_opt_set(conn_t *connp, uint_t optset_context,
124 int level, int name, uint_t inlen,
125 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
126 void *thisdg_attrs, cred_t *cr);
127 int icmp_opt_get(conn_t *connp, int level, int name,
128 uchar_t *ptr);
129 static int icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
130 sin6_t *sin6, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa);
131 static mblk_t *icmp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
132 const in6_addr_t *, const in6_addr_t *, uint32_t, mblk_t *, int *);
133 static mblk_t *icmp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
134 mblk_t *, const in6_addr_t *, uint32_t, int *);
135 static int icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
136 uchar_t *ptr, int len);
137 static void icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
138 static void icmp_tpi_unbind(queue_t *q, mblk_t *mp);
139 static int icmp_wput(queue_t *q, mblk_t *mp);
140 static int icmp_wput_fallback(queue_t *q, mblk_t *mp);
141 static void icmp_wput_other(queue_t *q, mblk_t *mp);
142 static void icmp_wput_iocdata(queue_t *q, mblk_t *mp);
143 static void icmp_wput_restricted(queue_t *q, mblk_t *mp);
144 static void icmp_ulp_recv(conn_t *, mblk_t *, uint_t);
145
146 static void *rawip_stack_init(netstackid_t stackid, netstack_t *ns);
147 static void rawip_stack_fini(netstackid_t stackid, void *arg);
148
149 static void *rawip_kstat_init(netstackid_t stackid);
150 static void rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp);
151 static int rawip_kstat_update(kstat_t *kp, int rw);
152 static void rawip_stack_shutdown(netstackid_t stackid, void *arg);
153
154 /* Common routines for TPI and socket module */
155 static conn_t *rawip_do_open(int, cred_t *, int *, int);
156 static void rawip_do_close(conn_t *);
157 static int rawip_do_bind(conn_t *, struct sockaddr *, socklen_t);
158 static int rawip_do_unbind(conn_t *);
159 static int rawip_do_connect(conn_t *, const struct sockaddr *, socklen_t,
160 cred_t *, pid_t);
161
162 int rawip_getsockname(sock_lower_handle_t, struct sockaddr *,
163 socklen_t *, cred_t *);
164 int rawip_getpeername(sock_lower_handle_t, struct sockaddr *,
165 socklen_t *, cred_t *);
166
167 static struct module_info icmp_mod_info = {
168 5707, "icmp", 1, INFPSZ, 512, 128
169 };
170
171 /*
172 * Entry points for ICMP as a device.
173 * We have separate open functions for the /dev/icmp and /dev/icmp6 devices.
174 */
175 static struct qinit icmprinitv4 = {
176 NULL, NULL, icmp_openv4, icmp_close, NULL, &icmp_mod_info
177 };
178
179 static struct qinit icmprinitv6 = {
180 NULL, NULL, icmp_openv6, icmp_close, NULL, &icmp_mod_info
181 };
182
183 static struct qinit icmpwinit = {
184 icmp_wput, ip_wsrv, NULL, NULL, NULL, &icmp_mod_info
185 };
186
187 /* ICMP entry point during fallback */
188 static struct qinit icmp_fallback_sock_winit = {
189 icmp_wput_fallback, NULL, NULL, NULL, NULL, &icmp_mod_info
190 };
191
192 /* For AF_INET aka /dev/icmp */
193 struct streamtab icmpinfov4 = {
194 &icmprinitv4, &icmpwinit
195 };
196
197 /* For AF_INET6 aka /dev/icmp6 */
198 struct streamtab icmpinfov6 = {
199 &icmprinitv6, &icmpwinit
200 };
201
202 /* Default structure copied into T_INFO_ACK messages */
203 static struct T_info_ack icmp_g_t_info_ack = {
204 T_INFO_ACK,
205 IP_MAXPACKET, /* TSDU_size. icmp allows maximum size messages. */
206 T_INVALID, /* ETSDU_size. icmp does not support expedited data. */
207 T_INVALID, /* CDATA_size. icmp does not support connect data. */
208 T_INVALID, /* DDATA_size. icmp does not support disconnect data. */
209 0, /* ADDR_size - filled in later. */
210 0, /* OPT_size - not initialized here */
211 IP_MAXPACKET, /* TIDU_size. icmp allows maximum size messages. */
212 T_CLTS, /* SERV_type. icmp supports connection-less. */
213 TS_UNBND, /* CURRENT_state. This is set from icmp_state. */
214 (XPG4_1|SENDZERO) /* PROVIDER_flag */
215 };
216
217 static int
218 icmp_set_buf_prop(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
219 const char *ifname, const void *pval, uint_t flags)
220 {
221 return (mod_set_buf_prop(stack->netstack_icmp->is_propinfo_tbl,
222 stack, cr, pinfo, ifname, pval, flags));
223 }
224
225 static int
226 icmp_get_buf_prop(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
227 void *val, uint_t psize, uint_t flags)
228 {
229 return (mod_get_buf_prop(stack->netstack_icmp->is_propinfo_tbl, stack,
230 pinfo, ifname, val, psize, flags));
231 }
232
233 /*
234 * All of these are alterable, within the min/max values given, at run time.
235 *
236 * Note: All those tunables which do not start with "icmp_" are Committed and
237 * therefore are public. See PSARC 2010/080.
238 */
239 static mod_prop_info_t icmp_propinfo_tbl[] = {
240 /* tunable - 0 */
241 { "_wroff_extra", MOD_PROTO_RAWIP,
242 mod_set_uint32, mod_get_uint32,
243 {0, 128, 32}, {32} },
244
245 { "_ipv4_ttl", MOD_PROTO_RAWIP,
246 mod_set_uint32, mod_get_uint32,
247 {1, 255, 255}, {255} },
248
249 { "_ipv6_hoplimit", MOD_PROTO_RAWIP,
250 mod_set_uint32, mod_get_uint32,
251 {0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS},
252 {IPV6_DEFAULT_HOPS} },
253
254 { "_bsd_compat", MOD_PROTO_RAWIP,
255 mod_set_boolean, mod_get_boolean,
256 {B_TRUE}, {B_TRUE} },
257
258 { "send_buf", MOD_PROTO_RAWIP,
259 icmp_set_buf_prop, icmp_get_buf_prop,
260 {4096, 65536, 8192}, {8192} },
261
262 { "_xmit_lowat", MOD_PROTO_RAWIP,
263 mod_set_uint32, mod_get_uint32,
264 {0, 65536, 1024}, {1024} },
265
266 { "recv_buf", MOD_PROTO_RAWIP,
267 icmp_set_buf_prop, icmp_get_buf_prop,
268 {4096, 65536, 8192}, {8192} },
269
270 { "max_buf", MOD_PROTO_RAWIP,
271 mod_set_uint32, mod_get_uint32,
272 {65536, ULP_MAX_BUF, 256*1024}, {256*1024} },
273
274 { "_pmtu_discovery", MOD_PROTO_RAWIP,
275 mod_set_boolean, mod_get_boolean,
276 {B_FALSE}, {B_FALSE} },
277
278 { "_sendto_ignerr", MOD_PROTO_RAWIP,
279 mod_set_boolean, mod_get_boolean,
280 {B_FALSE}, {B_FALSE} },
281
282 { "?", MOD_PROTO_RAWIP, NULL, mod_get_allprop, {0}, {0} },
283
284 { NULL, 0, NULL, NULL, {0}, {0} }
285 };
286
287 #define is_wroff_extra is_propinfo_tbl[0].prop_cur_uval
288 #define is_ipv4_ttl is_propinfo_tbl[1].prop_cur_uval
289 #define is_ipv6_hoplimit is_propinfo_tbl[2].prop_cur_uval
290 #define is_bsd_compat is_propinfo_tbl[3].prop_cur_bval
291 #define is_xmit_hiwat is_propinfo_tbl[4].prop_cur_uval
292 #define is_xmit_lowat is_propinfo_tbl[5].prop_cur_uval
293 #define is_recv_hiwat is_propinfo_tbl[6].prop_cur_uval
294 #define is_max_buf is_propinfo_tbl[7].prop_cur_uval
295 #define is_pmtu_discovery is_propinfo_tbl[8].prop_cur_bval
296 #define is_sendto_ignerr is_propinfo_tbl[9].prop_cur_bval
297
298 typedef union T_primitives *t_primp_t;
299
300 /*
301 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
302 * passed to icmp_wput.
303 * It calls IP to verify the local IP address, and calls IP to insert
304 * the conn_t in the fanout table.
305 * If everything is ok it then sends the T_BIND_ACK back up.
306 */
307 static void
308 icmp_tpi_bind(queue_t *q, mblk_t *mp)
309 {
310 int error;
311 struct sockaddr *sa;
312 struct T_bind_req *tbr;
313 socklen_t len;
314 sin_t *sin;
315 sin6_t *sin6;
316 icmp_t *icmp;
317 conn_t *connp = Q_TO_CONN(q);
318 mblk_t *mp1;
319 cred_t *cr;
320
321 /*
322 * All Solaris components should pass a db_credp
323 * for this TPI message, hence we ASSERT.
324 * But in case there is some other M_PROTO that looks
325 * like a TPI message sent by some other kernel
326 * component, we check and return an error.
327 */
328 cr = msg_getcred(mp, NULL);
329 ASSERT(cr != NULL);
330 if (cr == NULL) {
331 icmp_err_ack(q, mp, TSYSERR, EINVAL);
332 return;
333 }
334
335 icmp = connp->conn_icmp;
336 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
337 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
338 "icmp_bind: bad req, len %u",
339 (uint_t)(mp->b_wptr - mp->b_rptr));
340 icmp_err_ack(q, mp, TPROTO, 0);
341 return;
342 }
343
344 if (icmp->icmp_state != TS_UNBND) {
345 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
346 "icmp_bind: bad state, %u", icmp->icmp_state);
347 icmp_err_ack(q, mp, TOUTSTATE, 0);
348 return;
349 }
350
351 /*
352 * Reallocate the message to make sure we have enough room for an
353 * address.
354 */
355 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
356 if (mp1 == NULL) {
357 icmp_err_ack(q, mp, TSYSERR, ENOMEM);
358 return;
359 }
360 mp = mp1;
361
362 /* Reset the message type in preparation for shipping it back. */
363 DB_TYPE(mp) = M_PCPROTO;
364 tbr = (struct T_bind_req *)mp->b_rptr;
365 len = tbr->ADDR_length;
366 switch (len) {
367 case 0: /* request for a generic port */
368 tbr->ADDR_offset = sizeof (struct T_bind_req);
369 if (connp->conn_family == AF_INET) {
370 tbr->ADDR_length = sizeof (sin_t);
371 sin = (sin_t *)&tbr[1];
372 *sin = sin_null;
373 sin->sin_family = AF_INET;
374 mp->b_wptr = (uchar_t *)&sin[1];
375 sa = (struct sockaddr *)sin;
376 len = sizeof (sin_t);
377 } else {
378 ASSERT(connp->conn_family == AF_INET6);
379 tbr->ADDR_length = sizeof (sin6_t);
380 sin6 = (sin6_t *)&tbr[1];
381 *sin6 = sin6_null;
382 sin6->sin6_family = AF_INET6;
383 mp->b_wptr = (uchar_t *)&sin6[1];
384 sa = (struct sockaddr *)sin6;
385 len = sizeof (sin6_t);
386 }
387 break;
388
389 case sizeof (sin_t): /* Complete IPv4 address */
390 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
391 sizeof (sin_t));
392 break;
393
394 case sizeof (sin6_t): /* Complete IPv6 address */
395 sa = (struct sockaddr *)mi_offset_param(mp,
396 tbr->ADDR_offset, sizeof (sin6_t));
397 break;
398
399 default:
400 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
401 "icmp_bind: bad ADDR_length %u", tbr->ADDR_length);
402 icmp_err_ack(q, mp, TBADADDR, 0);
403 return;
404 }
405
406 error = rawip_do_bind(connp, sa, len);
407 if (error != 0) {
408 if (error > 0) {
409 icmp_err_ack(q, mp, TSYSERR, error);
410 } else {
411 icmp_err_ack(q, mp, -error, 0);
412 }
413 } else {
414 tbr->PRIM_type = T_BIND_ACK;
415 qreply(q, mp);
416 }
417 }
418
419 static int
420 rawip_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len)
421 {
422 sin_t *sin;
423 sin6_t *sin6;
424 icmp_t *icmp = connp->conn_icmp;
425 int error = 0;
426 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */
427 in_port_t lport; /* Network byte order */
428 ipaddr_t v4src; /* Set if AF_INET */
429 in6_addr_t v6src;
430 uint_t scopeid = 0;
431 zoneid_t zoneid = IPCL_ZONEID(connp);
432 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
433
434 if (sa == NULL || !OK_32PTR((char *)sa)) {
435 return (EINVAL);
436 }
437
438 switch (len) {
439 case sizeof (sin_t): /* Complete IPv4 address */
440 sin = (sin_t *)sa;
441 if (sin->sin_family != AF_INET ||
442 connp->conn_family != AF_INET) {
443 /* TSYSERR, EAFNOSUPPORT */
444 return (EAFNOSUPPORT);
445 }
446 v4src = sin->sin_addr.s_addr;
447 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
448 if (v4src != INADDR_ANY) {
449 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
450 B_TRUE);
451 }
452 lport = sin->sin_port;
453 break;
454 case sizeof (sin6_t): /* Complete IPv6 address */
455 sin6 = (sin6_t *)sa;
456 if (sin6->sin6_family != AF_INET6 ||
457 connp->conn_family != AF_INET6) {
458 /* TSYSERR, EAFNOSUPPORT */
459 return (EAFNOSUPPORT);
460 }
461 /* No support for mapped addresses on raw sockets */
462 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
463 /* TSYSERR, EADDRNOTAVAIL */
464 return (EADDRNOTAVAIL);
465 }
466 v6src = sin6->sin6_addr;
467 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
468 if (IN6_IS_ADDR_LINKSCOPE(&v6src))
469 scopeid = sin6->sin6_scope_id;
470 laddr_type = ip_laddr_verify_v6(&v6src, zoneid, ipst,
471 B_TRUE, scopeid);
472 }
473 lport = sin6->sin6_port;
474 break;
475
476 default:
477 /* TBADADDR */
478 return (EADDRNOTAVAIL);
479 }
480
481 /* Is the local address a valid unicast, multicast, or broadcast? */
482 if (laddr_type == IPVL_BAD)
483 return (EADDRNOTAVAIL);
484
485 /*
486 * The state must be TS_UNBND.
487 */
488 mutex_enter(&connp->conn_lock);
489 if (icmp->icmp_state != TS_UNBND) {
490 mutex_exit(&connp->conn_lock);
491 return (-TOUTSTATE);
492 }
493
494 /*
495 * Copy the source address into our icmp structure. This address
496 * may still be zero; if so, ip will fill in the correct address
497 * each time an outbound packet is passed to it.
498 * If we are binding to a broadcast or multicast address then
499 * we just set the conn_bound_addr since we don't want to use
500 * that as the source address when sending.
501 */
502 connp->conn_bound_addr_v6 = v6src;
503 connp->conn_laddr_v6 = v6src;
504 if (scopeid != 0) {
505 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
506 connp->conn_ixa->ixa_scopeid = scopeid;
507 connp->conn_incoming_ifindex = scopeid;
508 } else {
509 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
510 connp->conn_incoming_ifindex = connp->conn_bound_if;
511 }
512
513 switch (laddr_type) {
514 case IPVL_UNICAST_UP:
515 case IPVL_UNICAST_DOWN:
516 connp->conn_saddr_v6 = v6src;
517 connp->conn_mcbc_bind = B_FALSE;
518 break;
519 case IPVL_MCAST:
520 case IPVL_BCAST:
521 /* ip_set_destination will pick a source address later */
522 connp->conn_saddr_v6 = ipv6_all_zeros;
523 connp->conn_mcbc_bind = B_TRUE;
524 break;
525 }
526
527 /* Any errors after this point should use late_error */
528
529 /*
530 * Use sin_port/sin6_port since applications like psh use SOCK_RAW
531 * with IPPROTO_TCP.
532 */
533 connp->conn_lport = lport;
534 connp->conn_fport = 0;
535
536 if (connp->conn_family == AF_INET) {
537 ASSERT(connp->conn_ipversion == IPV4_VERSION);
538 } else {
539 ASSERT(connp->conn_ipversion == IPV6_VERSION);
540 }
541
542 icmp->icmp_state = TS_IDLE;
543
544 /*
545 * We create an initial header template here to make a subsequent
546 * sendto have a starting point. Since conn_last_dst is zero the
547 * first sendto will always follow the 'dst changed' code path.
548 * Note that we defer massaging options and the related checksum
549 * adjustment until we have a destination address.
550 */
551 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
552 &connp->conn_faddr_v6, connp->conn_flowinfo);
553 if (error != 0) {
554 mutex_exit(&connp->conn_lock);
555 goto late_error;
556 }
557 /* Just in case */
558 connp->conn_faddr_v6 = ipv6_all_zeros;
559 connp->conn_v6lastdst = ipv6_all_zeros;
560 mutex_exit(&connp->conn_lock);
561
562 error = ip_laddr_fanout_insert(connp);
563 if (error != 0)
564 goto late_error;
565
566 /* Bind succeeded */
567 return (0);
568
569 late_error:
570 mutex_enter(&connp->conn_lock);
571 connp->conn_saddr_v6 = ipv6_all_zeros;
572 connp->conn_bound_addr_v6 = ipv6_all_zeros;
573 connp->conn_laddr_v6 = ipv6_all_zeros;
574 if (scopeid != 0) {
575 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
576 connp->conn_incoming_ifindex = connp->conn_bound_if;
577 }
578 icmp->icmp_state = TS_UNBND;
579 connp->conn_v6lastdst = ipv6_all_zeros;
580 connp->conn_lport = 0;
581
582 /* Restore the header that was built above - different source address */
583 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
584 &connp->conn_faddr_v6, connp->conn_flowinfo);
585 mutex_exit(&connp->conn_lock);
586 return (error);
587 }
588
589 /*
590 * Tell IP to just bind to the protocol.
591 */
592 static void
593 icmp_bind_proto(icmp_t *icmp)
594 {
595 conn_t *connp = icmp->icmp_connp;
596
597 mutex_enter(&connp->conn_lock);
598 connp->conn_saddr_v6 = ipv6_all_zeros;
599 connp->conn_laddr_v6 = ipv6_all_zeros;
600 connp->conn_faddr_v6 = ipv6_all_zeros;
601 connp->conn_v6lastdst = ipv6_all_zeros;
602 mutex_exit(&connp->conn_lock);
603
604 (void) ip_laddr_fanout_insert(connp);
605 }
606
607 /*
608 * This routine handles each T_CONN_REQ message passed to icmp. It
609 * associates a default destination address with the stream.
610 *
611 * After various error checks are completed, icmp_connect() lays
612 * the target address and port into the composite header template.
613 * Then we ask IP for information, including a source address if we didn't
614 * already have one. Finally we send up the T_OK_ACK reply message.
615 */
616 static void
617 icmp_tpi_connect(queue_t *q, mblk_t *mp)
618 {
619 conn_t *connp = Q_TO_CONN(q);
620 struct T_conn_req *tcr;
621 struct sockaddr *sa;
622 socklen_t len;
623 int error;
624 cred_t *cr;
625 pid_t pid;
626 /*
627 * All Solaris components should pass a db_credp
628 * for this TPI message, hence we ASSERT.
629 * But in case there is some other M_PROTO that looks
630 * like a TPI message sent by some other kernel
631 * component, we check and return an error.
632 */
633 cr = msg_getcred(mp, &pid);
634 ASSERT(cr != NULL);
635 if (cr == NULL) {
636 icmp_err_ack(q, mp, TSYSERR, EINVAL);
637 return;
638 }
639
640 tcr = (struct T_conn_req *)mp->b_rptr;
641 /* Sanity checks */
642 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
643 icmp_err_ack(q, mp, TPROTO, 0);
644 return;
645 }
646
647 if (tcr->OPT_length != 0) {
648 icmp_err_ack(q, mp, TBADOPT, 0);
649 return;
650 }
651
652 len = tcr->DEST_length;
653
654 switch (len) {
655 default:
656 icmp_err_ack(q, mp, TBADADDR, 0);
657 return;
658 case sizeof (sin_t):
659 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
660 sizeof (sin_t));
661 break;
662 case sizeof (sin6_t):
663 sa = (struct sockaddr *)mi_offset_param(mp,
664 tcr->DEST_offset, sizeof (sin6_t));
665 break;
666 }
667
668 error = proto_verify_ip_addr(connp->conn_family, sa, len);
669 if (error != 0) {
670 icmp_err_ack(q, mp, TSYSERR, error);
671 return;
672 }
673
674 error = rawip_do_connect(connp, sa, len, cr, pid);
675 if (error != 0) {
676 if (error < 0) {
677 icmp_err_ack(q, mp, -error, 0);
678 } else {
679 icmp_err_ack(q, mp, 0, error);
680 }
681 } else {
682 mblk_t *mp1;
683
684 /*
685 * We have to send a connection confirmation to
686 * keep TLI happy.
687 */
688 if (connp->conn_family == AF_INET) {
689 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
690 sizeof (sin_t), NULL, 0);
691 } else {
692 ASSERT(connp->conn_family == AF_INET6);
693 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
694 sizeof (sin6_t), NULL, 0);
695 }
696 if (mp1 == NULL) {
697 icmp_err_ack(q, mp, TSYSERR, ENOMEM);
698 return;
699 }
700
701 /*
702 * Send ok_ack for T_CONN_REQ
703 */
704 mp = mi_tpi_ok_ack_alloc(mp);
705 if (mp == NULL) {
706 /* Unable to reuse the T_CONN_REQ for the ack. */
707 icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
708 return;
709 }
710 putnext(connp->conn_rq, mp);
711 putnext(connp->conn_rq, mp1);
712 }
713 }
714
715 static int
716 rawip_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
717 cred_t *cr, pid_t pid)
718 {
719 icmp_t *icmp;
720 sin_t *sin;
721 sin6_t *sin6;
722 int error;
723 uint16_t dstport;
724 ipaddr_t v4dst;
725 in6_addr_t v6dst;
726 uint32_t flowinfo;
727 ip_xmit_attr_t *ixa;
728 ip_xmit_attr_t *oldixa;
729 uint_t scopeid = 0;
730 uint_t srcid = 0;
731 in6_addr_t v6src = connp->conn_saddr_v6;
732
733 icmp = connp->conn_icmp;
734
735 if (sa == NULL || !OK_32PTR((char *)sa)) {
736 return (EINVAL);
737 }
738
739 ASSERT(sa != NULL && len != 0);
740
741 /*
742 * Determine packet type based on type of address passed in
743 * the request should contain an IPv4 or IPv6 address.
744 * Make sure that address family matches the type of
745 * family of the address passed down.
746 */
747 switch (len) {
748 case sizeof (sin_t):
749 sin = (sin_t *)sa;
750
751 v4dst = sin->sin_addr.s_addr;
752 dstport = sin->sin_port;
753 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
754 ASSERT(connp->conn_ipversion == IPV4_VERSION);
755 break;
756
757 case sizeof (sin6_t):
758 sin6 = (sin6_t *)sa;
759
760 /* No support for mapped addresses on raw sockets */
761 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
762 return (EADDRNOTAVAIL);
763 }
764 v6dst = sin6->sin6_addr;
765 dstport = sin6->sin6_port;
766 ASSERT(connp->conn_ipversion == IPV6_VERSION);
767 flowinfo = sin6->sin6_flowinfo;
768 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
769 scopeid = sin6->sin6_scope_id;
770 srcid = sin6->__sin6_src_id;
771 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
772 /* Due to check above, we know sin6_addr is v6-only. */
773 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
774 B_FALSE, connp->conn_netstack)) {
775 /* Mismatch - v6src would be v4mapped. */
776 return (EADDRNOTAVAIL);
777 }
778 }
779 break;
780 }
781
782 /*
783 * If there is a different thread using conn_ixa then we get a new
784 * copy and cut the old one loose from conn_ixa. Otherwise we use
785 * conn_ixa and prevent any other thread from using/changing it.
786 * Once connect() is done other threads can use conn_ixa since the
787 * refcnt will be back at one.
788 * We defer updating conn_ixa until later to handle any concurrent
789 * conn_ixa_cleanup thread.
790 */
791 ixa = conn_get_ixa(connp, B_FALSE);
792 if (ixa == NULL)
793 return (ENOMEM);
794
795 mutex_enter(&connp->conn_lock);
796 /*
797 * This icmp_t must have bound already before doing a connect.
798 * Reject if a connect is in progress (we drop conn_lock during
799 * rawip_do_connect).
800 */
801 if (icmp->icmp_state == TS_UNBND || icmp->icmp_state == TS_WCON_CREQ) {
802 mutex_exit(&connp->conn_lock);
803 ixa_refrele(ixa);
804 return (-TOUTSTATE);
805 }
806
807 if (icmp->icmp_state == TS_DATA_XFER) {
808 /* Already connected - clear out state */
809 if (connp->conn_mcbc_bind)
810 connp->conn_saddr_v6 = ipv6_all_zeros;
811 else
812 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
813 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
814 connp->conn_faddr_v6 = ipv6_all_zeros;
815 icmp->icmp_state = TS_IDLE;
816 }
817
818 /*
819 * Use sin_port/sin6_port since applications like psh use SOCK_RAW
820 * with IPPROTO_TCP.
821 */
822 connp->conn_fport = dstport;
823 if (connp->conn_ipversion == IPV4_VERSION) {
824 /*
825 * Interpret a zero destination to mean loopback.
826 * Update the T_CONN_REQ (sin/sin6) since it is used to
827 * generate the T_CONN_CON.
828 */
829 if (v4dst == INADDR_ANY) {
830 v4dst = htonl(INADDR_LOOPBACK);
831 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
832 ASSERT(connp->conn_family == AF_INET);
833 sin->sin_addr.s_addr = v4dst;
834 }
835 connp->conn_faddr_v6 = v6dst;
836 connp->conn_flowinfo = 0;
837 } else {
838 ASSERT(connp->conn_ipversion == IPV6_VERSION);
839 /*
840 * Interpret a zero destination to mean loopback.
841 * Update the T_CONN_REQ (sin/sin6) since it is used to
842 * generate the T_CONN_CON.
843 */
844 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
845 v6dst = ipv6_loopback;
846 sin6->sin6_addr = v6dst;
847 }
848 connp->conn_faddr_v6 = v6dst;
849 connp->conn_flowinfo = flowinfo;
850 }
851
852 /*
853 * We update our cred/cpid based on the caller of connect
854 */
855 if (connp->conn_cred != cr) {
856 crhold(cr);
857 crfree(connp->conn_cred);
858 connp->conn_cred = cr;
859 }
860 connp->conn_cpid = pid;
861 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
862 ixa->ixa_cred = cr;
863 ixa->ixa_cpid = pid;
864 if (is_system_labeled()) {
865 /* We need to restart with a label based on the cred */
866 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
867 }
868
869 if (scopeid != 0) {
870 ixa->ixa_flags |= IXAF_SCOPEID_SET;
871 ixa->ixa_scopeid = scopeid;
872 connp->conn_incoming_ifindex = scopeid;
873 } else {
874 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
875 connp->conn_incoming_ifindex = connp->conn_bound_if;
876 }
877
878 /*
879 * conn_connect will drop conn_lock and reacquire it.
880 * To prevent a send* from messing with this icmp_t while the lock
881 * is dropped we set icmp_state and clear conn_v6lastdst.
882 * That will make all send* fail with EISCONN.
883 */
884 connp->conn_v6lastdst = ipv6_all_zeros;
885 icmp->icmp_state = TS_WCON_CREQ;
886
887 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
888 mutex_exit(&connp->conn_lock);
889 if (error != 0)
890 goto connect_failed;
891
892 /*
893 * The addresses have been verified. Time to insert in
894 * the correct fanout list.
895 */
896 error = ipcl_conn_insert(connp);
897 if (error != 0)
898 goto connect_failed;
899
900 mutex_enter(&connp->conn_lock);
901 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
902 &connp->conn_faddr_v6, connp->conn_flowinfo);
903 if (error != 0) {
904 mutex_exit(&connp->conn_lock);
905 goto connect_failed;
906 }
907
908 icmp->icmp_state = TS_DATA_XFER;
909 /* Record this as the "last" send even though we haven't sent any */
910 connp->conn_v6lastdst = connp->conn_faddr_v6;
911 connp->conn_lastipversion = connp->conn_ipversion;
912 connp->conn_lastdstport = connp->conn_fport;
913 connp->conn_lastflowinfo = connp->conn_flowinfo;
914 connp->conn_lastscopeid = scopeid;
915 connp->conn_lastsrcid = srcid;
916 /* Also remember a source to use together with lastdst */
917 connp->conn_v6lastsrc = v6src;
918
919 oldixa = conn_replace_ixa(connp, ixa);
920 mutex_exit(&connp->conn_lock);
921 ixa_refrele(oldixa);
922
923 ixa_refrele(ixa);
924 return (0);
925
926 connect_failed:
927 if (ixa != NULL)
928 ixa_refrele(ixa);
929 mutex_enter(&connp->conn_lock);
930 icmp->icmp_state = TS_IDLE;
931 /* In case the source address was set above */
932 if (connp->conn_mcbc_bind)
933 connp->conn_saddr_v6 = ipv6_all_zeros;
934 else
935 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
936 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
937 connp->conn_faddr_v6 = ipv6_all_zeros;
938 connp->conn_v6lastdst = ipv6_all_zeros;
939 connp->conn_flowinfo = 0;
940
941 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
942 &connp->conn_faddr_v6, connp->conn_flowinfo);
943 mutex_exit(&connp->conn_lock);
944 return (error);
945 }
946
947 static void
948 rawip_do_close(conn_t *connp)
949 {
950 ASSERT(connp != NULL && IPCL_IS_RAWIP(connp));
951
952 ip_quiesce_conn(connp);
953
954 if (!IPCL_IS_NONSTR(connp)) {
955 qprocsoff(connp->conn_rq);
956 }
957
958 icmp_close_free(connp);
959
960 /*
961 * Now we are truly single threaded on this stream, and can
962 * delete the things hanging off the connp, and finally the connp.
963 * We removed this connp from the fanout list, it cannot be
964 * accessed thru the fanouts, and we already waited for the
965 * conn_ref to drop to 0. We are already in close, so
966 * there cannot be any other thread from the top. qprocsoff
967 * has completed, and service has completed or won't run in
968 * future.
969 */
970 ASSERT(connp->conn_ref == 1);
971
972 if (!IPCL_IS_NONSTR(connp)) {
973 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
974 } else {
975 ip_free_helper_stream(connp);
976 }
977
978 connp->conn_ref--;
979 ipcl_conn_destroy(connp);
980 }
981
982 /* ARGSUSED */
983 static int
984 icmp_close(queue_t *q, int flags, cred_t *credp __unused)
985 {
986 conn_t *connp;
987
988 if (flags & SO_FALLBACK) {
989 /*
990 * stream is being closed while in fallback
991 * simply free the resources that were allocated
992 */
993 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
994 qprocsoff(q);
995 goto done;
996 }
997
998 connp = Q_TO_CONN(q);
999 (void) rawip_do_close(connp);
1000 done:
1001 q->q_ptr = WR(q)->q_ptr = NULL;
1002 return (0);
1003 }
1004
1005 static void
1006 icmp_close_free(conn_t *connp)
1007 {
1008 icmp_t *icmp = connp->conn_icmp;
1009
1010 if (icmp->icmp_filter != NULL) {
1011 kmem_free(icmp->icmp_filter, sizeof (icmp6_filter_t));
1012 icmp->icmp_filter = NULL;
1013 }
1014
1015 /*
1016 * Clear any fields which the kmem_cache constructor clears.
1017 * Only icmp_connp needs to be preserved.
1018 * TBD: We should make this more efficient to avoid clearing
1019 * everything.
1020 */
1021 ASSERT(icmp->icmp_connp == connp);
1022 bzero(icmp, sizeof (icmp_t));
1023 icmp->icmp_connp = connp;
1024 }
1025
1026 /*
1027 * This routine handles each T_DISCON_REQ message passed to icmp
1028 * as an indicating that ICMP is no longer connected. This results
1029 * in telling IP to restore the binding to just the local address.
1030 */
1031 static int
1032 icmp_do_disconnect(conn_t *connp)
1033 {
1034 icmp_t *icmp = connp->conn_icmp;
1035 int error;
1036
1037 mutex_enter(&connp->conn_lock);
1038 if (icmp->icmp_state != TS_DATA_XFER) {
1039 mutex_exit(&connp->conn_lock);
1040 return (-TOUTSTATE);
1041 }
1042 if (connp->conn_mcbc_bind)
1043 connp->conn_saddr_v6 = ipv6_all_zeros;
1044 else
1045 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
1046 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
1047 connp->conn_faddr_v6 = ipv6_all_zeros;
1048 icmp->icmp_state = TS_IDLE;
1049
1050 connp->conn_v6lastdst = ipv6_all_zeros;
1051 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
1052 &connp->conn_faddr_v6, connp->conn_flowinfo);
1053 mutex_exit(&connp->conn_lock);
1054 if (error != 0)
1055 return (error);
1056
1057 /*
1058 * Tell IP to remove the full binding and revert
1059 * to the local address binding.
1060 */
1061 return (ip_laddr_fanout_insert(connp));
1062 }
1063
1064 static void
1065 icmp_tpi_disconnect(queue_t *q, mblk_t *mp)
1066 {
1067 conn_t *connp = Q_TO_CONN(q);
1068 int error;
1069
1070 /*
1071 * Allocate the largest primitive we need to send back
1072 * T_error_ack is > than T_ok_ack
1073 */
1074 mp = reallocb(mp, sizeof (struct T_error_ack), 1);
1075 if (mp == NULL) {
1076 /* Unable to reuse the T_DISCON_REQ for the ack. */
1077 icmp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
1078 return;
1079 }
1080
1081 error = icmp_do_disconnect(connp);
1082
1083 if (error != 0) {
1084 if (error > 0) {
1085 icmp_err_ack(q, mp, 0, error);
1086 } else {
1087 icmp_err_ack(q, mp, -error, 0);
1088 }
1089 } else {
1090 mp = mi_tpi_ok_ack_alloc(mp);
1091 ASSERT(mp != NULL);
1092 qreply(q, mp);
1093 }
1094 }
1095
1096 static int
1097 icmp_disconnect(conn_t *connp)
1098 {
1099 int error;
1100
1101 connp->conn_dgram_errind = B_FALSE;
1102
1103 error = icmp_do_disconnect(connp);
1104
1105 if (error < 0)
1106 error = proto_tlitosyserr(-error);
1107 return (error);
1108 }
1109
1110 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
1111 static void
1112 icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
1113 {
1114 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
1115 qreply(q, mp);
1116 }
1117
1118 /* Shorthand to generate and send TPI error acks to our client */
1119 static void
1120 icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
1121 t_scalar_t t_error, int sys_error)
1122 {
1123 struct T_error_ack *teackp;
1124
1125 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
1126 M_PCPROTO, T_ERROR_ACK)) != NULL) {
1127 teackp = (struct T_error_ack *)mp->b_rptr;
1128 teackp->ERROR_prim = primitive;
1129 teackp->TLI_error = t_error;
1130 teackp->UNIX_error = sys_error;
1131 qreply(q, mp);
1132 }
1133 }
1134
1135 /*
1136 * icmp_icmp_input is called as conn_recvicmp to process ICMP messages.
1137 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1138 * Assumes that IP has pulled up everything up to and including the ICMP header.
1139 */
1140 /* ARGSUSED2 */
1141 static void
1142 icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1143 {
1144 conn_t *connp = (conn_t *)arg1;
1145 icmp_t *icmp = connp->conn_icmp;
1146 icmph_t *icmph;
1147 ipha_t *ipha;
1148 int iph_hdr_length;
1149 sin_t sin;
1150 mblk_t *mp1;
1151 int error = 0;
1152
1153 ipha = (ipha_t *)mp->b_rptr;
1154
1155 ASSERT(OK_32PTR(mp->b_rptr));
1156
1157 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1158 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1159 icmp_icmp_error_ipv6(connp, mp, ira);
1160 return;
1161 }
1162 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
1163
1164 /* Skip past the outer IP and ICMP headers */
1165 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
1166 iph_hdr_length = ira->ira_ip_hdr_length;
1167 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1168 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
1169
1170 iph_hdr_length = IPH_HDR_LENGTH(ipha);
1171
1172 switch (icmph->icmph_type) {
1173 case ICMP_DEST_UNREACHABLE:
1174 switch (icmph->icmph_code) {
1175 case ICMP_FRAGMENTATION_NEEDED: {
1176 ipha_t *ipha;
1177 ip_xmit_attr_t *ixa;
1178 /*
1179 * IP has already adjusted the path MTU.
1180 * But we need to adjust DF for IPv4.
1181 */
1182 if (connp->conn_ipversion != IPV4_VERSION)
1183 break;
1184
1185 ixa = conn_get_ixa(connp, B_FALSE);
1186 if (ixa == NULL || ixa->ixa_ire == NULL) {
1187 /*
1188 * Some other thread holds conn_ixa. We will
1189 * redo this on the next ICMP too big.
1190 */
1191 if (ixa != NULL)
1192 ixa_refrele(ixa);
1193 break;
1194 }
1195 (void) ip_get_pmtu(ixa);
1196
1197 mutex_enter(&connp->conn_lock);
1198 ipha = (ipha_t *)connp->conn_ht_iphc;
1199 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
1200 ipha->ipha_fragment_offset_and_flags |=
1201 IPH_DF_HTONS;
1202 } else {
1203 ipha->ipha_fragment_offset_and_flags &=
1204 ~IPH_DF_HTONS;
1205 }
1206 mutex_exit(&connp->conn_lock);
1207 ixa_refrele(ixa);
1208 break;
1209 }
1210 case ICMP_PORT_UNREACHABLE:
1211 case ICMP_PROTOCOL_UNREACHABLE:
1212 error = ECONNREFUSED;
1213 break;
1214 default:
1215 /* Transient errors */
1216 break;
1217 }
1218 break;
1219 default:
1220 /* Transient errors */
1221 break;
1222 }
1223 if (error == 0) {
1224 freemsg(mp);
1225 return;
1226 }
1227
1228 /*
1229 * Deliver T_UDERROR_IND when the application has asked for it.
1230 * The socket layer enables this automatically when connected.
1231 */
1232 if (!connp->conn_dgram_errind) {
1233 freemsg(mp);
1234 return;
1235 }
1236
1237 sin = sin_null;
1238 sin.sin_family = AF_INET;
1239 sin.sin_addr.s_addr = ipha->ipha_dst;
1240
1241 if (IPCL_IS_NONSTR(connp)) {
1242 mutex_enter(&connp->conn_lock);
1243 if (icmp->icmp_state == TS_DATA_XFER) {
1244 if (sin.sin_addr.s_addr == connp->conn_faddr_v4) {
1245 mutex_exit(&connp->conn_lock);
1246 (*connp->conn_upcalls->su_set_error)
1247 (connp->conn_upper_handle, error);
1248 goto done;
1249 }
1250 } else {
1251 icmp->icmp_delayed_error = error;
1252 *((sin_t *)&icmp->icmp_delayed_addr) = sin;
1253 }
1254 mutex_exit(&connp->conn_lock);
1255 } else {
1256 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0,
1257 error);
1258 if (mp1 != NULL)
1259 putnext(connp->conn_rq, mp1);
1260 }
1261 done:
1262 freemsg(mp);
1263 }
1264
1265 /*
1266 * icmp_icmp_error_ipv6 is called by icmp_icmp_error to process ICMP for IPv6.
1267 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1268 * Assumes that IP has pulled up all the extension headers as well as the
1269 * ICMPv6 header.
1270 */
1271 static void
1272 icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1273 {
1274 icmp6_t *icmp6;
1275 ip6_t *ip6h, *outer_ip6h;
1276 uint16_t iph_hdr_length;
1277 uint8_t *nexthdrp;
1278 sin6_t sin6;
1279 mblk_t *mp1;
1280 int error = 0;
1281 icmp_t *icmp = connp->conn_icmp;
1282
1283 outer_ip6h = (ip6_t *)mp->b_rptr;
1284 #ifdef DEBUG
1285 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1286 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1287 else
1288 iph_hdr_length = IPV6_HDR_LEN;
1289 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1290 #endif
1291 /* Skip past the outer IP and ICMP headers */
1292 iph_hdr_length = ira->ira_ip_hdr_length;
1293 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1294
1295 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */
1296 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1297 freemsg(mp);
1298 return;
1299 }
1300
1301 switch (icmp6->icmp6_type) {
1302 case ICMP6_DST_UNREACH:
1303 switch (icmp6->icmp6_code) {
1304 case ICMP6_DST_UNREACH_NOPORT:
1305 error = ECONNREFUSED;
1306 break;
1307 case ICMP6_DST_UNREACH_ADMIN:
1308 case ICMP6_DST_UNREACH_NOROUTE:
1309 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1310 case ICMP6_DST_UNREACH_ADDR:
1311 /* Transient errors */
1312 break;
1313 default:
1314 break;
1315 }
1316 break;
1317 case ICMP6_PACKET_TOO_BIG: {
1318 struct T_unitdata_ind *tudi;
1319 struct T_opthdr *toh;
1320 size_t udi_size;
1321 mblk_t *newmp;
1322 t_scalar_t opt_length = sizeof (struct T_opthdr) +
1323 sizeof (struct ip6_mtuinfo);
1324 sin6_t *sin6;
1325 struct ip6_mtuinfo *mtuinfo;
1326
1327 /*
1328 * If the application has requested to receive path mtu
1329 * information, send up an empty message containing an
1330 * IPV6_PATHMTU ancillary data item.
1331 */
1332 if (!connp->conn_ipv6_recvpathmtu)
1333 break;
1334
1335 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1336 opt_length;
1337 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1338 BUMP_MIB(&icmp->icmp_is->is_rawip_mib, rawipInErrors);
1339 break;
1340 }
1341
1342 /*
1343 * newmp->b_cont is left to NULL on purpose. This is an
1344 * empty message containing only ancillary data.
1345 */
1346 newmp->b_datap->db_type = M_PROTO;
1347 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1348 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1349 tudi->PRIM_type = T_UNITDATA_IND;
1350 tudi->SRC_length = sizeof (sin6_t);
1351 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1352 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1353 tudi->OPT_length = opt_length;
1354
1355 sin6 = (sin6_t *)&tudi[1];
1356 bzero(sin6, sizeof (sin6_t));
1357 sin6->sin6_family = AF_INET6;
1358 sin6->sin6_addr = connp->conn_faddr_v6;
1359
1360 toh = (struct T_opthdr *)&sin6[1];
1361 toh->level = IPPROTO_IPV6;
1362 toh->name = IPV6_PATHMTU;
1363 toh->len = opt_length;
1364 toh->status = 0;
1365
1366 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1367 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1368 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1369 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1370 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1371 /*
1372 * We've consumed everything we need from the original
1373 * message. Free it, then send our empty message.
1374 */
1375 freemsg(mp);
1376 icmp_ulp_recv(connp, newmp, msgdsize(newmp));
1377 return;
1378 }
1379 case ICMP6_TIME_EXCEEDED:
1380 /* Transient errors */
1381 break;
1382 case ICMP6_PARAM_PROB:
1383 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1384 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1385 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1386 (uchar_t *)nexthdrp) {
1387 error = ECONNREFUSED;
1388 break;
1389 }
1390 break;
1391 }
1392 if (error == 0) {
1393 freemsg(mp);
1394 return;
1395 }
1396
1397 /*
1398 * Deliver T_UDERROR_IND when the application has asked for it.
1399 * The socket layer enables this automatically when connected.
1400 */
1401 if (!connp->conn_dgram_errind) {
1402 freemsg(mp);
1403 return;
1404 }
1405
1406 sin6 = sin6_null;
1407 sin6.sin6_family = AF_INET6;
1408 sin6.sin6_addr = ip6h->ip6_dst;
1409 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1410 if (IPCL_IS_NONSTR(connp)) {
1411 mutex_enter(&connp->conn_lock);
1412 if (icmp->icmp_state == TS_DATA_XFER) {
1413 if (IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1414 &connp->conn_faddr_v6)) {
1415 mutex_exit(&connp->conn_lock);
1416 (*connp->conn_upcalls->su_set_error)
1417 (connp->conn_upper_handle, error);
1418 goto done;
1419 }
1420 } else {
1421 icmp->icmp_delayed_error = error;
1422 *((sin6_t *)&icmp->icmp_delayed_addr) = sin6;
1423 }
1424 mutex_exit(&connp->conn_lock);
1425 } else {
1426 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1427 NULL, 0, error);
1428 if (mp1 != NULL)
1429 putnext(connp->conn_rq, mp1);
1430 }
1431 done:
1432 freemsg(mp);
1433 }
1434
1435 /*
1436 * This routine responds to T_ADDR_REQ messages. It is called by icmp_wput.
1437 * The local address is filled in if endpoint is bound. The remote address
1438 * is filled in if remote address has been precified ("connected endpoint")
1439 * (The concept of connected CLTS sockets is alien to published TPI
1440 * but we support it anyway).
1441 */
1442 static void
1443 icmp_addr_req(queue_t *q, mblk_t *mp)
1444 {
1445 struct sockaddr *sa;
1446 mblk_t *ackmp;
1447 struct T_addr_ack *taa;
1448 icmp_t *icmp = Q_TO_ICMP(q);
1449 conn_t *connp = icmp->icmp_connp;
1450 uint_t addrlen;
1451
1452 /* Make it large enough for worst case */
1453 ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1454 2 * sizeof (sin6_t), 1);
1455 if (ackmp == NULL) {
1456 icmp_err_ack(q, mp, TSYSERR, ENOMEM);
1457 return;
1458 }
1459 taa = (struct T_addr_ack *)ackmp->b_rptr;
1460
1461 bzero(taa, sizeof (struct T_addr_ack));
1462 ackmp->b_wptr = (uchar_t *)&taa[1];
1463
1464 taa->PRIM_type = T_ADDR_ACK;
1465 ackmp->b_datap->db_type = M_PCPROTO;
1466
1467 if (connp->conn_family == AF_INET)
1468 addrlen = sizeof (sin_t);
1469 else
1470 addrlen = sizeof (sin6_t);
1471
1472 mutex_enter(&connp->conn_lock);
1473 /*
1474 * Note: Following code assumes 32 bit alignment of basic
1475 * data structures like sin_t and struct T_addr_ack.
1476 */
1477 if (icmp->icmp_state != TS_UNBND) {
1478 /*
1479 * Fill in local address first
1480 */
1481 taa->LOCADDR_offset = sizeof (*taa);
1482 taa->LOCADDR_length = addrlen;
1483 sa = (struct sockaddr *)&taa[1];
1484 (void) conn_getsockname(connp, sa, &addrlen);
1485 ackmp->b_wptr += addrlen;
1486 }
1487 if (icmp->icmp_state == TS_DATA_XFER) {
1488 /*
1489 * connected, fill remote address too
1490 */
1491 taa->REMADDR_length = addrlen;
1492 /* assumed 32-bit alignment */
1493 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1494 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1495 (void) conn_getpeername(connp, sa, &addrlen);
1496 ackmp->b_wptr += addrlen;
1497 }
1498 mutex_exit(&connp->conn_lock);
1499 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1500 qreply(q, ackmp);
1501 }
1502
1503 static void
1504 icmp_copy_info(struct T_info_ack *tap, icmp_t *icmp)
1505 {
1506 conn_t *connp = icmp->icmp_connp;
1507
1508 *tap = icmp_g_t_info_ack;
1509
1510 if (connp->conn_family == AF_INET6)
1511 tap->ADDR_size = sizeof (sin6_t);
1512 else
1513 tap->ADDR_size = sizeof (sin_t);
1514 tap->CURRENT_state = icmp->icmp_state;
1515 tap->OPT_size = icmp_max_optsize;
1516 }
1517
1518 static void
1519 icmp_do_capability_ack(icmp_t *icmp, struct T_capability_ack *tcap,
1520 t_uscalar_t cap_bits1)
1521 {
1522 tcap->CAP_bits1 = 0;
1523
1524 if (cap_bits1 & TC1_INFO) {
1525 icmp_copy_info(&tcap->INFO_ack, icmp);
1526 tcap->CAP_bits1 |= TC1_INFO;
1527 }
1528 }
1529
1530 /*
1531 * This routine responds to T_CAPABILITY_REQ messages. It is called by
1532 * icmp_wput. Much of the T_CAPABILITY_ACK information is copied from
1533 * icmp_g_t_info_ack. The current state of the stream is copied from
1534 * icmp_state.
1535 */
1536 static void
1537 icmp_capability_req(queue_t *q, mblk_t *mp)
1538 {
1539 icmp_t *icmp = Q_TO_ICMP(q);
1540 t_uscalar_t cap_bits1;
1541 struct T_capability_ack *tcap;
1542
1543 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1544
1545 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1546 mp->b_datap->db_type, T_CAPABILITY_ACK);
1547 if (!mp)
1548 return;
1549
1550 tcap = (struct T_capability_ack *)mp->b_rptr;
1551
1552 icmp_do_capability_ack(icmp, tcap, cap_bits1);
1553
1554 qreply(q, mp);
1555 }
1556
1557 /*
1558 * This routine responds to T_INFO_REQ messages. It is called by icmp_wput.
1559 * Most of the T_INFO_ACK information is copied from icmp_g_t_info_ack.
1560 * The current state of the stream is copied from icmp_state.
1561 */
1562 static void
1563 icmp_info_req(queue_t *q, mblk_t *mp)
1564 {
1565 icmp_t *icmp = Q_TO_ICMP(q);
1566
1567 /* Create a T_INFO_ACK message. */
1568 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1569 T_INFO_ACK);
1570 if (!mp)
1571 return;
1572 icmp_copy_info((struct T_info_ack *)mp->b_rptr, icmp);
1573 qreply(q, mp);
1574 }
1575
1576 static int
1577 icmp_tpi_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1578 int family)
1579 {
1580 conn_t *connp;
1581 dev_t conn_dev;
1582 int error;
1583
1584 /* If the stream is already open, return immediately. */
1585 if (q->q_ptr != NULL)
1586 return (0);
1587
1588 if (sflag == MODOPEN)
1589 return (EINVAL);
1590
1591 /*
1592 * Since ICMP is not used so heavily, allocating from the small
1593 * arena should be sufficient.
1594 */
1595 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) {
1596 return (EBUSY);
1597 }
1598
1599 if (flag & SO_FALLBACK) {
1600 /*
1601 * Non streams socket needs a stream to fallback to
1602 */
1603 RD(q)->q_ptr = (void *)conn_dev;
1604 WR(q)->q_qinfo = &icmp_fallback_sock_winit;
1605 WR(q)->q_ptr = (void *)ip_minor_arena_sa;
1606 qprocson(q);
1607 return (0);
1608 }
1609
1610 connp = rawip_do_open(family, credp, &error, KM_SLEEP);
1611 if (connp == NULL) {
1612 ASSERT(error != 0);
1613 inet_minor_free(ip_minor_arena_sa, conn_dev);
1614 return (error);
1615 }
1616
1617 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1618 connp->conn_dev = conn_dev;
1619 connp->conn_minor_arena = ip_minor_arena_sa;
1620
1621 /*
1622 * Initialize the icmp_t structure for this stream.
1623 */
1624 q->q_ptr = connp;
1625 WR(q)->q_ptr = connp;
1626 connp->conn_rq = q;
1627 connp->conn_wq = WR(q);
1628
1629 WR(q)->q_hiwat = connp->conn_sndbuf;
1630 WR(q)->q_lowat = connp->conn_sndlowat;
1631
1632 qprocson(q);
1633
1634 /* Set the Stream head write offset. */
1635 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1636 (void) proto_set_rx_hiwat(connp->conn_rq, connp, connp->conn_rcvbuf);
1637
1638 mutex_enter(&connp->conn_lock);
1639 connp->conn_state_flags &= ~CONN_INCIPIENT;
1640 mutex_exit(&connp->conn_lock);
1641
1642 icmp_bind_proto(connp->conn_icmp);
1643
1644 return (0);
1645 }
1646
1647 /* For /dev/icmp aka AF_INET open */
1648 static int
1649 icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1650 {
1651 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET));
1652 }
1653
1654 /* For /dev/icmp6 aka AF_INET6 open */
1655 static int
1656 icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1657 {
1658 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET6));
1659 }
1660
1661 /*
1662 * This is the open routine for icmp. It allocates a icmp_t structure for
1663 * the stream and, on the first open of the module, creates an ND table.
1664 */
1665 static conn_t *
1666 rawip_do_open(int family, cred_t *credp, int *err, int flags)
1667 {
1668 icmp_t *icmp;
1669 conn_t *connp;
1670 zoneid_t zoneid;
1671 netstack_t *ns;
1672 icmp_stack_t *is;
1673 int len;
1674 boolean_t isv6 = B_FALSE;
1675
1676 *err = secpolicy_net_icmpaccess(credp);
1677 if (*err != 0)
1678 return (NULL);
1679
1680 if (family == AF_INET6)
1681 isv6 = B_TRUE;
1682
1683 ns = netstack_find_by_cred(credp);
1684 ASSERT(ns != NULL);
1685 is = ns->netstack_icmp;
1686 ASSERT(is != NULL);
1687
1688 /*
1689 * For exclusive stacks we set the zoneid to zero
1690 * to make ICMP operate as if in the global zone.
1691 */
1692 if (ns->netstack_stackid != GLOBAL_NETSTACKID)
1693 zoneid = GLOBAL_ZONEID;
1694 else
1695 zoneid = crgetzoneid(credp);
1696
1697 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
1698
1699 connp = ipcl_conn_create(IPCL_RAWIPCONN, flags, ns);
1700 icmp = connp->conn_icmp;
1701
1702 /*
1703 * ipcl_conn_create did a netstack_hold. Undo the hold that was
1704 * done by netstack_find_by_cred()
1705 */
1706 netstack_rele(ns);
1707
1708 /*
1709 * Since this conn_t/icmp_t is not yet visible to anybody else we don't
1710 * need to lock anything.
1711 */
1712 ASSERT(connp->conn_proto == IPPROTO_ICMP);
1713 ASSERT(connp->conn_icmp == icmp);
1714 ASSERT(icmp->icmp_connp == connp);
1715
1716 /* Set the initial state of the stream and the privilege status. */
1717 icmp->icmp_state = TS_UNBND;
1718 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
1719 if (isv6) {
1720 connp->conn_family = AF_INET6;
1721 connp->conn_ipversion = IPV6_VERSION;
1722 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
1723 connp->conn_proto = IPPROTO_ICMPV6;
1724 /* May be changed by a SO_PROTOTYPE socket option. */
1725 connp->conn_proto = IPPROTO_ICMPV6;
1726 connp->conn_ixa->ixa_protocol = connp->conn_proto;
1727 connp->conn_ixa->ixa_raw_cksum_offset = 2;
1728 connp->conn_default_ttl = is->is_ipv6_hoplimit;
1729 len = sizeof (ip6_t);
1730 } else {
1731 connp->conn_family = AF_INET;
1732 connp->conn_ipversion = IPV4_VERSION;
1733 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
1734 /* May be changed by a SO_PROTOTYPE socket option. */
1735 connp->conn_proto = IPPROTO_ICMP;
1736 connp->conn_ixa->ixa_protocol = connp->conn_proto;
1737 connp->conn_default_ttl = is->is_ipv4_ttl;
1738 len = sizeof (ipha_t);
1739 }
1740 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
1741
1742 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1743
1744 /*
1745 * For the socket of protocol IPPROTO_RAW or when IP_HDRINCL is set,
1746 * the checksum is provided in the pre-built packet. We clear
1747 * IXAF_SET_ULP_CKSUM to tell IP that the application has sent a
1748 * complete IP header and not to compute the transport checksum.
1749 */
1750 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
1751 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
1752 connp->conn_ixa->ixa_zoneid = zoneid;
1753
1754 connp->conn_zoneid = zoneid;
1755
1756 /*
1757 * If the caller has the process-wide flag set, then default to MAC
1758 * exempt mode. This allows read-down to unlabeled hosts.
1759 */
1760 if (getpflags(NET_MAC_AWARE, credp) != 0)
1761 connp->conn_mac_mode = CONN_MAC_AWARE;
1762
1763 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
1764
1765 icmp->icmp_is = is;
1766
1767 connp->conn_rcvbuf = is->is_recv_hiwat;
1768 connp->conn_sndbuf = is->is_xmit_hiwat;
1769 connp->conn_sndlowat = is->is_xmit_lowat;
1770 connp->conn_rcvlowat = icmp_mod_info.mi_lowat;
1771
1772 connp->conn_wroff = len + is->is_wroff_extra;
1773 connp->conn_so_type = SOCK_RAW;
1774
1775 connp->conn_recv = icmp_input;
1776 connp->conn_recvicmp = icmp_icmp_input;
1777 crhold(credp);
1778 connp->conn_cred = credp;
1779 connp->conn_cpid = curproc->p_pid;
1780 connp->conn_open_time = ddi_get_lbolt64();
1781 /* Cache things in ixa without an extra refhold */
1782 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
1783 connp->conn_ixa->ixa_cred = connp->conn_cred;
1784 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
1785 if (is_system_labeled())
1786 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
1787
1788 connp->conn_flow_cntrld = B_FALSE;
1789
1790 if (is->is_pmtu_discovery)
1791 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
1792
1793 return (connp);
1794 }
1795
1796 /*
1797 * Which ICMP options OK to set through T_UNITDATA_REQ...
1798 */
1799 /* ARGSUSED */
1800 static boolean_t
1801 icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1802 {
1803 return (B_TRUE);
1804 }
1805
1806 /*
1807 * This routine gets default values of certain options whose default
1808 * values are maintained by protcol specific code
1809 */
1810 int
1811 icmp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1812 {
1813 icmp_t *icmp = Q_TO_ICMP(q);
1814 icmp_stack_t *is = icmp->icmp_is;
1815 int *i1 = (int *)ptr;
1816
1817 switch (level) {
1818 case IPPROTO_IP:
1819 switch (name) {
1820 case IP_MULTICAST_TTL:
1821 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1822 return (sizeof (uchar_t));
1823 case IP_MULTICAST_LOOP:
1824 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1825 return (sizeof (uchar_t));
1826 }
1827 break;
1828 case IPPROTO_IPV6:
1829 switch (name) {
1830 case IPV6_MULTICAST_HOPS:
1831 *i1 = IP_DEFAULT_MULTICAST_TTL;
1832 return (sizeof (int));
1833 case IPV6_MULTICAST_LOOP:
1834 *i1 = IP_DEFAULT_MULTICAST_LOOP;
1835 return (sizeof (int));
1836 case IPV6_UNICAST_HOPS:
1837 *i1 = is->is_ipv6_hoplimit;
1838 return (sizeof (int));
1839 }
1840 break;
1841 case IPPROTO_ICMPV6:
1842 switch (name) {
1843 case ICMP6_FILTER:
1844 /* Make it look like "pass all" */
1845 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr);
1846 return (sizeof (icmp6_filter_t));
1847 }
1848 break;
1849 }
1850 return (-1);
1851 }
1852
1853 /*
1854 * This routine retrieves the current status of socket options.
1855 * It returns the size of the option retrieved, or -1.
1856 */
1857 int
1858 icmp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr)
1859 {
1860 icmp_t *icmp = connp->conn_icmp;
1861 int *i1 = (int *)ptr;
1862 conn_opt_arg_t coas;
1863 int retval;
1864
1865 coas.coa_connp = connp;
1866 coas.coa_ixa = connp->conn_ixa;
1867 coas.coa_ipp = &connp->conn_xmit_ipp;
1868 coas.coa_ancillary = B_FALSE;
1869 coas.coa_changed = 0;
1870
1871 /*
1872 * We assume that the optcom framework has checked for the set
1873 * of levels and names that are supported, hence we don't worry
1874 * about rejecting based on that.
1875 * First check for ICMP specific handling, then pass to common routine.
1876 */
1877 switch (level) {
1878 case IPPROTO_IP:
1879 /*
1880 * Only allow IPv4 option processing on IPv4 sockets.
1881 */
1882 if (connp->conn_family != AF_INET)
1883 return (-1);
1884
1885 switch (name) {
1886 case IP_OPTIONS:
1887 case T_IP_OPTIONS:
1888 /* Options are passed up with each packet */
1889 return (0);
1890 case IP_HDRINCL:
1891 mutex_enter(&connp->conn_lock);
1892 *i1 = (int)icmp->icmp_hdrincl;
1893 mutex_exit(&connp->conn_lock);
1894 return (sizeof (int));
1895 }
1896 break;
1897
1898 case IPPROTO_IPV6:
1899 /*
1900 * Only allow IPv6 option processing on native IPv6 sockets.
1901 */
1902 if (connp->conn_family != AF_INET6)
1903 return (-1);
1904
1905 switch (name) {
1906 case IPV6_CHECKSUM:
1907 /*
1908 * Return offset or -1 if no checksum offset.
1909 * Does not apply to IPPROTO_ICMPV6
1910 */
1911 if (connp->conn_proto == IPPROTO_ICMPV6)
1912 return (-1);
1913
1914 mutex_enter(&connp->conn_lock);
1915 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM)
1916 *i1 = connp->conn_ixa->ixa_raw_cksum_offset;
1917 else
1918 *i1 = -1;
1919 mutex_exit(&connp->conn_lock);
1920 return (sizeof (int));
1921 }
1922 break;
1923
1924 case IPPROTO_ICMPV6:
1925 /*
1926 * Only allow IPv6 option processing on native IPv6 sockets.
1927 */
1928 if (connp->conn_family != AF_INET6)
1929 return (-1);
1930
1931 if (connp->conn_proto != IPPROTO_ICMPV6)
1932 return (-1);
1933
1934 switch (name) {
1935 case ICMP6_FILTER:
1936 mutex_enter(&connp->conn_lock);
1937 if (icmp->icmp_filter == NULL) {
1938 /* Make it look like "pass all" */
1939 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr);
1940 } else {
1941 (void) bcopy(icmp->icmp_filter, ptr,
1942 sizeof (icmp6_filter_t));
1943 }
1944 mutex_exit(&connp->conn_lock);
1945 return (sizeof (icmp6_filter_t));
1946 }
1947 }
1948 mutex_enter(&connp->conn_lock);
1949 retval = conn_opt_get(&coas, level, name, ptr);
1950 mutex_exit(&connp->conn_lock);
1951 return (retval);
1952 }
1953
1954 /*
1955 * This routine retrieves the current status of socket options.
1956 * It returns the size of the option retrieved, or -1.
1957 */
1958 int
1959 icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr)
1960 {
1961 conn_t *connp = Q_TO_CONN(q);
1962 int err;
1963
1964 err = icmp_opt_get(connp, level, name, ptr);
1965 return (err);
1966 }
1967
1968 /*
1969 * This routine sets socket options.
1970 */
1971 int
1972 icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1973 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1974 {
1975 conn_t *connp = coa->coa_connp;
1976 ip_xmit_attr_t *ixa = coa->coa_ixa;
1977 icmp_t *icmp = connp->conn_icmp;
1978 icmp_stack_t *is = icmp->icmp_is;
1979 int *i1 = (int *)invalp;
1980 boolean_t onoff = (*i1 == 0) ? 0 : 1;
1981 int error;
1982
1983 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1984
1985 /*
1986 * For fixed length options, no sanity check
1987 * of passed in length is done. It is assumed *_optcom_req()
1988 * routines do the right thing.
1989 */
1990
1991 switch (level) {
1992 case SOL_SOCKET:
1993 switch (name) {
1994 case SO_PROTOTYPE:
1995 if ((*i1 & 0xFF) != IPPROTO_ICMP &&
1996 (*i1 & 0xFF) != IPPROTO_ICMPV6 &&
1997 secpolicy_net_rawaccess(cr) != 0) {
1998 return (EACCES);
1999 }
2000 if (checkonly)
2001 break;
2002
2003 mutex_enter(&connp->conn_lock);
2004 connp->conn_proto = *i1 & 0xFF;
2005 ixa->ixa_protocol = connp->conn_proto;
2006 if ((connp->conn_proto == IPPROTO_RAW ||
2007 connp->conn_proto == IPPROTO_IGMP) &&
2008 connp->conn_family == AF_INET) {
2009 icmp->icmp_hdrincl = 1;
2010 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2011 } else if (connp->conn_proto == IPPROTO_UDP ||
2012 connp->conn_proto == IPPROTO_TCP ||
2013 connp->conn_proto == IPPROTO_SCTP) {
2014 /* Used by test applications like psh */
2015 icmp->icmp_hdrincl = 0;
2016 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2017 } else {
2018 icmp->icmp_hdrincl = 0;
2019 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM;
2020 }
2021
2022 if (connp->conn_family == AF_INET6 &&
2023 connp->conn_proto == IPPROTO_ICMPV6) {
2024 /* Set offset for icmp6_cksum */
2025 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM;
2026 ixa->ixa_raw_cksum_offset = 2;
2027 }
2028 if (icmp->icmp_filter != NULL &&
2029 connp->conn_proto != IPPROTO_ICMPV6) {
2030 kmem_free(icmp->icmp_filter,
2031 sizeof (icmp6_filter_t));
2032 icmp->icmp_filter = NULL;
2033 }
2034 mutex_exit(&connp->conn_lock);
2035
2036 coa->coa_changed |= COA_HEADER_CHANGED;
2037 /*
2038 * For SCTP, we don't use icmp_bind_proto() for
2039 * raw socket binding.
2040 */
2041 if (connp->conn_proto == IPPROTO_SCTP)
2042 return (0);
2043
2044 coa->coa_changed |= COA_ICMP_BIND_NEEDED;
2045 return (0);
2046
2047 case SO_SNDBUF:
2048 if (*i1 > is->is_max_buf) {
2049 return (ENOBUFS);
2050 }
2051 break;
2052 case SO_RCVBUF:
2053 if (*i1 > is->is_max_buf) {
2054 return (ENOBUFS);
2055 }
2056 break;
2057 }
2058 break;
2059
2060 case IPPROTO_IP:
2061 /*
2062 * Only allow IPv4 option processing on IPv4 sockets.
2063 */
2064 if (connp->conn_family != AF_INET)
2065 return (EINVAL);
2066
2067 switch (name) {
2068 case IP_HDRINCL:
2069 if (!checkonly) {
2070 mutex_enter(&connp->conn_lock);
2071 icmp->icmp_hdrincl = onoff;
2072 if (onoff)
2073 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2074 else
2075 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM;
2076 mutex_exit(&connp->conn_lock);
2077 }
2078 break;
2079 }
2080 break;
2081
2082 case IPPROTO_IPV6:
2083 if (connp->conn_family != AF_INET6)
2084 return (EINVAL);
2085
2086 switch (name) {
2087 case IPV6_CHECKSUM:
2088 /*
2089 * Integer offset into the user data of where the
2090 * checksum is located.
2091 * Offset of -1 disables option.
2092 * Does not apply to IPPROTO_ICMPV6.
2093 */
2094 if (connp->conn_proto == IPPROTO_ICMPV6 ||
2095 coa->coa_ancillary) {
2096 return (EINVAL);
2097 }
2098 if ((*i1 != -1) && ((*i1 < 0) || (*i1 & 0x1) != 0)) {
2099 /* Negative or not 16 bit aligned offset */
2100 return (EINVAL);
2101 }
2102 if (checkonly)
2103 break;
2104
2105 mutex_enter(&connp->conn_lock);
2106 if (*i1 == -1) {
2107 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM;
2108 ixa->ixa_raw_cksum_offset = 0;
2109 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM;
2110 } else {
2111 ixa->ixa_flags |= IXAF_SET_RAW_CKSUM;
2112 ixa->ixa_raw_cksum_offset = *i1;
2113 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM;
2114 }
2115 mutex_exit(&connp->conn_lock);
2116 break;
2117 }
2118 break;
2119
2120 case IPPROTO_ICMPV6:
2121 /*
2122 * Only allow IPv6 option processing on IPv6 sockets.
2123 */
2124 if (connp->conn_family != AF_INET6)
2125 return (EINVAL);
2126 if (connp->conn_proto != IPPROTO_ICMPV6)
2127 return (EINVAL);
2128
2129 switch (name) {
2130 case ICMP6_FILTER:
2131 if (checkonly)
2132 break;
2133
2134 if ((inlen != 0) &&
2135 (inlen != sizeof (icmp6_filter_t)))
2136 return (EINVAL);
2137
2138 mutex_enter(&connp->conn_lock);
2139 if (inlen == 0) {
2140 if (icmp->icmp_filter != NULL) {
2141 kmem_free(icmp->icmp_filter,
2142 sizeof (icmp6_filter_t));
2143 icmp->icmp_filter = NULL;
2144 }
2145 } else {
2146 if (icmp->icmp_filter == NULL) {
2147 icmp->icmp_filter = kmem_alloc(
2148 sizeof (icmp6_filter_t),
2149 KM_NOSLEEP);
2150 if (icmp->icmp_filter == NULL) {
2151 mutex_exit(&connp->conn_lock);
2152 return (ENOBUFS);
2153 }
2154 }
2155 (void) bcopy(invalp, icmp->icmp_filter, inlen);
2156 }
2157 mutex_exit(&connp->conn_lock);
2158 break;
2159 }
2160 break;
2161 }
2162 error = conn_opt_set(coa, level, name, inlen, invalp,
2163 checkonly, cr);
2164 return (error);
2165 }
2166
2167 /*
2168 * This routine sets socket options.
2169 */
2170 int
2171 icmp_opt_set(conn_t *connp, uint_t optset_context, int level, int name,
2172 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
2173 void *thisdg_attrs, cred_t *cr)
2174 {
2175 icmp_t *icmp = connp->conn_icmp;
2176 int err;
2177 conn_opt_arg_t coas, *coa;
2178 boolean_t checkonly;
2179 icmp_stack_t *is = icmp->icmp_is;
2180
2181 switch (optset_context) {
2182 case SETFN_OPTCOM_CHECKONLY:
2183 checkonly = B_TRUE;
2184 /*
2185 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
2186 * inlen != 0 implies value supplied and
2187 * we have to "pretend" to set it.
2188 * inlen == 0 implies that there is no
2189 * value part in T_CHECK request and just validation
2190 * done elsewhere should be enough, we just return here.
2191 */
2192 if (inlen == 0) {
2193 *outlenp = 0;
2194 return (0);
2195 }
2196 break;
2197 case SETFN_OPTCOM_NEGOTIATE:
2198 checkonly = B_FALSE;
2199 break;
2200 case SETFN_UD_NEGOTIATE:
2201 case SETFN_CONN_NEGOTIATE:
2202 checkonly = B_FALSE;
2203 /*
2204 * Negotiating local and "association-related" options
2205 * through T_UNITDATA_REQ.
2206 *
2207 * Following routine can filter out ones we do not
2208 * want to be "set" this way.
2209 */
2210 if (!icmp_opt_allow_udr_set(level, name)) {
2211 *outlenp = 0;
2212 return (EINVAL);
2213 }
2214 break;
2215 default:
2216 /*
2217 * We should never get here
2218 */
2219 *outlenp = 0;
2220 return (EINVAL);
2221 }
2222
2223 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
2224 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
2225
2226 if (thisdg_attrs != NULL) {
2227 /* Options from T_UNITDATA_REQ */
2228 coa = (conn_opt_arg_t *)thisdg_attrs;
2229 ASSERT(coa->coa_connp == connp);
2230 ASSERT(coa->coa_ixa != NULL);
2231 ASSERT(coa->coa_ipp != NULL);
2232 ASSERT(coa->coa_ancillary);
2233 } else {
2234 coa = &coas;
2235 coas.coa_connp = connp;
2236 /* Get a reference on conn_ixa to prevent concurrent mods */
2237 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
2238 if (coas.coa_ixa == NULL) {
2239 *outlenp = 0;
2240 return (ENOMEM);
2241 }
2242 coas.coa_ipp = &connp->conn_xmit_ipp;
2243 coas.coa_ancillary = B_FALSE;
2244 coas.coa_changed = 0;
2245 }
2246
2247 err = icmp_do_opt_set(coa, level, name, inlen, invalp,
2248 cr, checkonly);
2249 if (err != 0) {
2250 errout:
2251 if (!coa->coa_ancillary)
2252 ixa_refrele(coa->coa_ixa);
2253 *outlenp = 0;
2254 return (err);
2255 }
2256
2257 /*
2258 * Common case of OK return with outval same as inval.
2259 */
2260 if (invalp != outvalp) {
2261 /* don't trust bcopy for identical src/dst */
2262 (void) bcopy(invalp, outvalp, inlen);
2263 }
2264 *outlenp = inlen;
2265
2266 /*
2267 * If this was not ancillary data, then we rebuild the headers,
2268 * update the IRE/NCE, and IPsec as needed.
2269 * Since the label depends on the destination we go through
2270 * ip_set_destination first.
2271 */
2272 if (coa->coa_ancillary) {
2273 return (0);
2274 }
2275
2276 if (coa->coa_changed & COA_ROUTE_CHANGED) {
2277 in6_addr_t saddr, faddr, nexthop;
2278 in_port_t fport;
2279
2280 /*
2281 * We clear lastdst to make sure we pick up the change
2282 * next time sending.
2283 * If we are connected we re-cache the information.
2284 * We ignore errors to preserve BSD behavior.
2285 * Note that we don't redo IPsec policy lookup here
2286 * since the final destination (or source) didn't change.
2287 */
2288 mutex_enter(&connp->conn_lock);
2289 connp->conn_v6lastdst = ipv6_all_zeros;
2290
2291 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
2292 &connp->conn_faddr_v6, &nexthop);
2293 saddr = connp->conn_saddr_v6;
2294 faddr = connp->conn_faddr_v6;
2295 fport = connp->conn_fport;
2296 mutex_exit(&connp->conn_lock);
2297
2298 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
2299 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
2300 (void) ip_attr_connect(connp, coa->coa_ixa,
2301 &saddr, &faddr, &nexthop, fport, NULL, NULL,
2302 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
2303 }
2304 }
2305
2306 ixa_refrele(coa->coa_ixa);
2307
2308 if (coa->coa_changed & COA_HEADER_CHANGED) {
2309 /*
2310 * Rebuild the header template if we are connected.
2311 * Otherwise clear conn_v6lastdst so we rebuild the header
2312 * in the data path.
2313 */
2314 mutex_enter(&connp->conn_lock);
2315 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
2316 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
2317 err = icmp_build_hdr_template(connp,
2318 &connp->conn_saddr_v6, &connp->conn_faddr_v6,
2319 connp->conn_flowinfo);
2320 if (err != 0) {
2321 mutex_exit(&connp->conn_lock);
2322 return (err);
2323 }
2324 } else {
2325 connp->conn_v6lastdst = ipv6_all_zeros;
2326 }
2327 mutex_exit(&connp->conn_lock);
2328 }
2329 if (coa->coa_changed & COA_RCVBUF_CHANGED) {
2330 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2331 connp->conn_rcvbuf);
2332 }
2333 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
2334 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
2335 }
2336 if (coa->coa_changed & COA_WROFF_CHANGED) {
2337 /* Increase wroff if needed */
2338 uint_t wroff;
2339
2340 mutex_enter(&connp->conn_lock);
2341 wroff = connp->conn_ht_iphc_allocated + is->is_wroff_extra;
2342 if (wroff > connp->conn_wroff) {
2343 connp->conn_wroff = wroff;
2344 mutex_exit(&connp->conn_lock);
2345 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
2346 } else {
2347 mutex_exit(&connp->conn_lock);
2348 }
2349 }
2350 if (coa->coa_changed & COA_ICMP_BIND_NEEDED) {
2351 icmp_bind_proto(icmp);
2352 }
2353 return (err);
2354 }
2355
2356 /* This routine sets socket options. */
2357 int
2358 icmp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
2359 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
2360 void *thisdg_attrs, cred_t *cr)
2361 {
2362 conn_t *connp = Q_TO_CONN(q);
2363 int error;
2364
2365 error = icmp_opt_set(connp, optset_context, level, name, inlen, invalp,
2366 outlenp, outvalp, thisdg_attrs, cr);
2367 return (error);
2368 }
2369
2370 /*
2371 * Setup IP headers.
2372 *
2373 * Note that IP_HDRINCL has ipha_protocol that is different than conn_proto,
2374 * but icmp_output_hdrincl restores ipha_protocol once we return.
2375 */
2376 mblk_t *
2377 icmp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
2378 const in6_addr_t *v6src, const in6_addr_t *v6dst, uint32_t flowinfo,
2379 mblk_t *data_mp, int *errorp)
2380 {
2381 mblk_t *mp;
2382 icmp_stack_t *is = connp->conn_netstack->netstack_icmp;
2383 uint_t data_len;
2384 uint32_t cksum;
2385
2386 data_len = msgdsize(data_mp);
2387 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, connp->conn_proto,
2388 flowinfo, 0, data_mp, data_len, is->is_wroff_extra, &cksum, errorp);
2389 if (mp == NULL) {
2390 ASSERT(*errorp != 0);
2391 return (NULL);
2392 }
2393
2394 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2395
2396 /*
2397 * If there was a routing option/header then conn_prepend_hdr
2398 * has massaged it and placed the pseudo-header checksum difference
2399 * in the cksum argument.
2400 *
2401 * Prepare for ICMPv6 checksum done in IP.
2402 *
2403 * We make it easy for IP to include our pseudo header
2404 * by putting our length (and any routing header adjustment)
2405 * in the ICMPv6 checksum field.
2406 * The IP source, destination, and length have already been set by
2407 * conn_prepend_hdr.
2408 */
2409 cksum += data_len;
2410 cksum = (cksum >> 16) + (cksum & 0xFFFF);
2411 ASSERT(cksum < 0x10000);
2412
2413 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2414 ipha_t *ipha = (ipha_t *)mp->b_rptr;
2415
2416 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2417 } else {
2418 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2419 uint_t cksum_offset = 0;
2420
2421 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2422
2423 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) {
2424 if (connp->conn_proto == IPPROTO_ICMPV6) {
2425 cksum_offset = ixa->ixa_ip_hdr_length +
2426 offsetof(icmp6_t, icmp6_cksum);
2427 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) {
2428 cksum_offset = ixa->ixa_ip_hdr_length +
2429 ixa->ixa_raw_cksum_offset;
2430 }
2431 }
2432 if (cksum_offset != 0) {
2433 uint16_t *ptr;
2434
2435 /* Make sure the checksum fits in the first mblk */
2436 if (cksum_offset + sizeof (short) > MBLKL(mp)) {
2437 mblk_t *mp1;
2438
2439 mp1 = msgpullup(mp,
2440 cksum_offset + sizeof (short));
2441 freemsg(mp);
2442 if (mp1 == NULL) {
2443 *errorp = ENOMEM;
2444 return (NULL);
2445 }
2446 mp = mp1;
2447 ip6h = (ip6_t *)mp->b_rptr;
2448 }
2449 ptr = (uint16_t *)(mp->b_rptr + cksum_offset);
2450 *ptr = htons(cksum);
2451 }
2452 }
2453
2454 /* Note that we don't try to update wroff due to ancillary data */
2455 return (mp);
2456 }
2457
2458 static int
2459 icmp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2460 const in6_addr_t *v6dst, uint32_t flowinfo)
2461 {
2462 int error;
2463
2464 ASSERT(MUTEX_HELD(&connp->conn_lock));
2465 /*
2466 * We clear lastdst to make sure we don't use the lastdst path
2467 * next time sending since we might not have set v6dst yet.
2468 */
2469 connp->conn_v6lastdst = ipv6_all_zeros;
2470
2471 error = conn_build_hdr_template(connp, 0, 0, v6src, v6dst, flowinfo);
2472 if (error != 0)
2473 return (error);
2474
2475 /*
2476 * Any routing header/option has been massaged. The checksum difference
2477 * is stored in conn_sum.
2478 */
2479 return (0);
2480 }
2481
2482 static mblk_t *
2483 icmp_queue_fallback(icmp_t *icmp, mblk_t *mp)
2484 {
2485 ASSERT(MUTEX_HELD(&icmp->icmp_recv_lock));
2486 if (IPCL_IS_NONSTR(icmp->icmp_connp)) {
2487 /*
2488 * fallback has started but messages have not been moved yet
2489 */
2490 if (icmp->icmp_fallback_queue_head == NULL) {
2491 ASSERT(icmp->icmp_fallback_queue_tail == NULL);
2492 icmp->icmp_fallback_queue_head = mp;
2493 icmp->icmp_fallback_queue_tail = mp;
2494 } else {
2495 ASSERT(icmp->icmp_fallback_queue_tail != NULL);
2496 icmp->icmp_fallback_queue_tail->b_next = mp;
2497 icmp->icmp_fallback_queue_tail = mp;
2498 }
2499 return (NULL);
2500 } else {
2501 /*
2502 * Fallback completed, let the caller putnext() the mblk.
2503 */
2504 return (mp);
2505 }
2506 }
2507
2508 /*
2509 * Deliver data to ULP. In case we have a socket, and it's falling back to
2510 * TPI, then we'll queue the mp for later processing.
2511 */
2512 static void
2513 icmp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len)
2514 {
2515 if (IPCL_IS_NONSTR(connp)) {
2516 icmp_t *icmp = connp->conn_icmp;
2517 int error;
2518
2519 ASSERT(len == msgdsize(mp));
2520 if ((*connp->conn_upcalls->su_recv)
2521 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2522 mutex_enter(&icmp->icmp_recv_lock);
2523 if (error == ENOSPC) {
2524 /*
2525 * let's confirm while holding the lock
2526 */
2527 if ((*connp->conn_upcalls->su_recv)
2528 (connp->conn_upper_handle, NULL, 0, 0,
2529 &error, NULL) < 0) {
2530 ASSERT(error == ENOSPC);
2531 if (error == ENOSPC) {
2532 connp->conn_flow_cntrld =
2533 B_TRUE;
2534 }
2535 }
2536 mutex_exit(&icmp->icmp_recv_lock);
2537 } else {
2538 ASSERT(error == EOPNOTSUPP);
2539 mp = icmp_queue_fallback(icmp, mp);
2540 mutex_exit(&icmp->icmp_recv_lock);
2541 if (mp != NULL)
2542 putnext(connp->conn_rq, mp);
2543 }
2544 }
2545 ASSERT(MUTEX_NOT_HELD(&icmp->icmp_recv_lock));
2546 } else {
2547 putnext(connp->conn_rq, mp);
2548 }
2549 }
2550
2551 /*
2552 * This is the inbound data path.
2553 * IP has already pulled up the IP headers and verified alignment
2554 * etc.
2555 */
2556 /* ARGSUSED2 */
2557 static void
2558 icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2559 {
2560 conn_t *connp = (conn_t *)arg1;
2561 struct T_unitdata_ind *tudi;
2562 uchar_t *rptr; /* Pointer to IP header */
2563 int ip_hdr_length;
2564 int udi_size; /* Size of T_unitdata_ind */
2565 int pkt_len;
2566 icmp_t *icmp;
2567 ip_pkt_t ipps;
2568 ip6_t *ip6h;
2569 mblk_t *mp1;
2570 crb_t recv_ancillary;
2571 icmp_stack_t *is;
2572 sin_t *sin;
2573 sin6_t *sin6;
2574 ipha_t *ipha;
2575
2576 ASSERT(connp->conn_flags & IPCL_RAWIPCONN);
2577
2578 icmp = connp->conn_icmp;
2579 is = icmp->icmp_is;
2580 rptr = mp->b_rptr;
2581
2582 ASSERT(DB_TYPE(mp) == M_DATA);
2583 ASSERT(OK_32PTR(rptr));
2584 ASSERT(ira->ira_pktlen == msgdsize(mp));
2585 pkt_len = ira->ira_pktlen;
2586
2587 /*
2588 * Get a snapshot of these and allow other threads to change
2589 * them after that. We need the same recv_ancillary when determining
2590 * the size as when adding the ancillary data items.
2591 */
2592 mutex_enter(&connp->conn_lock);
2593 recv_ancillary = connp->conn_recv_ancillary;
2594 mutex_exit(&connp->conn_lock);
2595
2596 ip_hdr_length = ira->ira_ip_hdr_length;
2597 ASSERT(MBLKL(mp) >= ip_hdr_length); /* IP did a pullup */
2598
2599 /* Initialize regardless of IP version */
2600 ipps.ipp_fields = 0;
2601
2602 if (ira->ira_flags & IRAF_IS_IPV4) {
2603 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2604 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2605 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2606
2607 ipha = (ipha_t *)mp->b_rptr;
2608 if (recv_ancillary.crb_all != 0)
2609 (void) ip_find_hdr_v4(ipha, &ipps, B_FALSE);
2610
2611 /*
2612 * BSD for some reason adjusts ipha_length to exclude the
2613 * IP header length. We do the same.
2614 */
2615 if (is->is_bsd_compat) {
2616 ushort_t len;
2617
2618 len = ntohs(ipha->ipha_length);
2619 if (mp->b_datap->db_ref > 1) {
2620 /*
2621 * Allocate a new IP header so that we can
2622 * modify ipha_length.
2623 */
2624 mblk_t *mp1;
2625
2626 mp1 = allocb(ip_hdr_length, BPRI_MED);
2627 if (mp1 == NULL) {
2628 freemsg(mp);
2629 BUMP_MIB(&is->is_rawip_mib,
2630 rawipInErrors);
2631 return;
2632 }
2633 bcopy(rptr, mp1->b_rptr, ip_hdr_length);
2634 mp->b_rptr = rptr + ip_hdr_length;
2635 rptr = mp1->b_rptr;
2636 ipha = (ipha_t *)rptr;
2637 mp1->b_cont = mp;
2638 mp1->b_wptr = rptr + ip_hdr_length;
2639 mp = mp1;
2640 }
2641 len -= ip_hdr_length;
2642 ipha->ipha_length = htons(len);
2643 }
2644
2645 /*
2646 * For RAW sockets we not pass ICMP/IPv4 packets to AF_INET6
2647 * sockets. This is ensured by icmp_bind and the IP fanout code.
2648 */
2649 ASSERT(connp->conn_family == AF_INET);
2650
2651 /*
2652 * This is the inbound data path. Packets are passed upstream
2653 * as T_UNITDATA_IND messages with full IPv4 headers still
2654 * attached.
2655 */
2656
2657 /*
2658 * Normally only send up the source address.
2659 * If any ancillary data items are wanted we add those.
2660 */
2661 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2662 if (recv_ancillary.crb_all != 0) {
2663 udi_size += conn_recvancillary_size(connp,
2664 recv_ancillary, ira, mp, &ipps);
2665 }
2666
2667 /* Allocate a message block for the T_UNITDATA_IND structure. */
2668 mp1 = allocb(udi_size, BPRI_MED);
2669 if (mp1 == NULL) {
2670 freemsg(mp);
2671 BUMP_MIB(&is->is_rawip_mib, rawipInErrors);
2672 return;
2673 }
2674 mp1->b_cont = mp;
2675 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2676 mp1->b_datap->db_type = M_PROTO;
2677 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2678 tudi->PRIM_type = T_UNITDATA_IND;
2679 tudi->SRC_length = sizeof (sin_t);
2680 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2681 sin = (sin_t *)&tudi[1];
2682 *sin = sin_null;
2683 sin->sin_family = AF_INET;
2684 sin->sin_addr.s_addr = ipha->ipha_src;
2685 *(uint32_t *)&sin->sin_zero[0] = 0;
2686 *(uint32_t *)&sin->sin_zero[4] = 0;
2687 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2688 sizeof (sin_t);
2689 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2690 tudi->OPT_length = udi_size;
2691
2692 /*
2693 * Add options if IP_RECVIF etc is set
2694 */
2695 if (udi_size != 0) {
2696 conn_recvancillary_add(connp, recv_ancillary, ira,
2697 &ipps, (uchar_t *)&sin[1], udi_size);
2698 }
2699 goto deliver;
2700 }
2701
2702 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2703 /*
2704 * IPv6 packets can only be received by applications
2705 * that are prepared to receive IPv6 addresses.
2706 * The IP fanout must ensure this.
2707 */
2708 ASSERT(connp->conn_family == AF_INET6);
2709
2710 /*
2711 * Handle IPv6 packets. We don't pass up the IP headers with the
2712 * payload for IPv6.
2713 */
2714
2715 ip6h = (ip6_t *)rptr;
2716 if (recv_ancillary.crb_all != 0) {
2717 /*
2718 * Call on ip_find_hdr_v6 which gets individual lenghts of
2719 * extension headers (and pointers to them).
2720 */
2721 uint8_t nexthdr;
2722
2723 /* We don't care about the length or nextheader. */
2724 (void) ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps, &nexthdr);
2725
2726 /*
2727 * We do not pass up hop-by-hop options or any other
2728 * extension header as part of the packet. Applications
2729 * that want to see them have to specify IPV6_RECV* socket
2730 * options. And conn_recvancillary_size/add explicitly
2731 * drops the TX option from IPV6_HOPOPTS as it does for UDP.
2732 *
2733 * If we had multilevel ICMP sockets, then we'd want to
2734 * modify conn_recvancillary_size/add to
2735 * allow the user to see the label.
2736 */
2737 }
2738
2739 /*
2740 * Check a filter for ICMPv6 types if needed.
2741 * Verify raw checksums if needed.
2742 */
2743 mutex_enter(&connp->conn_lock);
2744 if (icmp->icmp_filter != NULL) {
2745 int type;
2746
2747 /* Assumes that IP has done the pullupmsg */
2748 type = mp->b_rptr[ip_hdr_length];
2749
2750 ASSERT(mp->b_rptr + ip_hdr_length <= mp->b_wptr);
2751 if (ICMP6_FILTER_WILLBLOCK(type, icmp->icmp_filter)) {
2752 mutex_exit(&connp->conn_lock);
2753 freemsg(mp);
2754 return;
2755 }
2756 }
2757 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) {
2758 /* Checksum */
2759 uint16_t *up;
2760 uint32_t sum;
2761 int remlen;
2762
2763 up = (uint16_t *)&ip6h->ip6_src;
2764
2765 remlen = msgdsize(mp) - ip_hdr_length;
2766 sum = htons(connp->conn_proto + remlen)
2767 + up[0] + up[1] + up[2] + up[3]
2768 + up[4] + up[5] + up[6] + up[7]
2769 + up[8] + up[9] + up[10] + up[11]
2770 + up[12] + up[13] + up[14] + up[15];
2771 sum = (sum & 0xffff) + (sum >> 16);
2772 sum = IP_CSUM(mp, ip_hdr_length, sum);
2773 if (sum != 0) {
2774 /* IPv6 RAW checksum failed */
2775 ip0dbg(("icmp_rput: RAW checksum failed %x\n", sum));
2776 mutex_exit(&connp->conn_lock);
2777 freemsg(mp);
2778 BUMP_MIB(&is->is_rawip_mib, rawipInCksumErrs);
2779 return;
2780 }
2781 }
2782 mutex_exit(&connp->conn_lock);
2783
2784 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2785
2786 if (recv_ancillary.crb_all != 0) {
2787 udi_size += conn_recvancillary_size(connp,
2788 recv_ancillary, ira, mp, &ipps);
2789 }
2790
2791 mp1 = allocb(udi_size, BPRI_MED);
2792 if (mp1 == NULL) {
2793 freemsg(mp);
2794 BUMP_MIB(&is->is_rawip_mib, rawipInErrors);
2795 return;
2796 }
2797 mp1->b_cont = mp;
2798 mp1->b_datap->db_type = M_PROTO;
2799 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2800 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2801 tudi->PRIM_type = T_UNITDATA_IND;
2802 tudi->SRC_length = sizeof (sin6_t);
2803 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2804 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2805 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2806 tudi->OPT_length = udi_size;
2807 sin6 = (sin6_t *)&tudi[1];
2808 *sin6 = sin6_null;
2809 sin6->sin6_port = 0;
2810 sin6->sin6_family = AF_INET6;
2811
2812 sin6->sin6_addr = ip6h->ip6_src;
2813 /* No sin6_flowinfo per API */
2814 sin6->sin6_flowinfo = 0;
2815 /* For link-scope pass up scope id */
2816 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2817 sin6->sin6_scope_id = ira->ira_ruifindex;
2818 else
2819 sin6->sin6_scope_id = 0;
2820 sin6->__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst,
2821 IPCL_ZONEID(connp), is->is_netstack);
2822
2823 if (udi_size != 0) {
2824 conn_recvancillary_add(connp, recv_ancillary, ira,
2825 &ipps, (uchar_t *)&sin6[1], udi_size);
2826 }
2827
2828 /* Skip all the IPv6 headers per API */
2829 mp->b_rptr += ip_hdr_length;
2830 pkt_len -= ip_hdr_length;
2831
2832 deliver:
2833 BUMP_MIB(&is->is_rawip_mib, rawipInDatagrams);
2834 icmp_ulp_recv(connp, mp1, pkt_len);
2835 }
2836
2837 /*
2838 * return SNMP stuff in buffer in mpdata. We don't hold any lock and report
2839 * information that can be changing beneath us.
2840 */
2841 mblk_t *
2842 icmp_snmp_get(queue_t *q, mblk_t *mpctl)
2843 {
2844 mblk_t *mpdata;
2845 struct opthdr *optp;
2846 conn_t *connp = Q_TO_CONN(q);
2847 icmp_stack_t *is = connp->conn_netstack->netstack_icmp;
2848 mblk_t *mp2ctl;
2849
2850 /*
2851 * make a copy of the original message
2852 */
2853 mp2ctl = copymsg(mpctl);
2854
2855 if (mpctl == NULL ||
2856 (mpdata = mpctl->b_cont) == NULL) {
2857 freemsg(mpctl);
2858 freemsg(mp2ctl);
2859 return (0);
2860 }
2861
2862 /* fixed length structure for IPv4 and IPv6 counters */
2863 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
2864 optp->level = EXPER_RAWIP;
2865 optp->name = 0;
2866 (void) snmp_append_data(mpdata, (char *)&is->is_rawip_mib,
2867 sizeof (is->is_rawip_mib));
2868 optp->len = msgdsize(mpdata);
2869 qreply(q, mpctl);
2870
2871 return (mp2ctl);
2872 }
2873
2874 /*
2875 * Return 0 if invalid set request, 1 otherwise, including non-rawip requests.
2876 * TODO: If this ever actually tries to set anything, it needs to be
2877 * to do the appropriate locking.
2878 */
2879 /* ARGSUSED */
2880 int
2881 icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name,
2882 uchar_t *ptr, int len)
2883 {
2884 switch (level) {
2885 case EXPER_RAWIP:
2886 return (0);
2887 default:
2888 return (1);
2889 }
2890 }
2891
2892 /*
2893 * This routine creates a T_UDERROR_IND message and passes it upstream.
2894 * The address and options are copied from the T_UNITDATA_REQ message
2895 * passed in mp. This message is freed.
2896 */
2897 static void
2898 icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2899 {
2900 struct T_unitdata_req *tudr;
2901 mblk_t *mp1;
2902 uchar_t *destaddr;
2903 t_scalar_t destlen;
2904 uchar_t *optaddr;
2905 t_scalar_t optlen;
2906
2907 if ((mp->b_wptr < mp->b_rptr) ||
2908 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2909 goto done;
2910 }
2911 tudr = (struct T_unitdata_req *)mp->b_rptr;
2912 destaddr = mp->b_rptr + tudr->DEST_offset;
2913 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2914 destaddr + tudr->DEST_length < mp->b_rptr ||
2915 destaddr + tudr->DEST_length > mp->b_wptr) {
2916 goto done;
2917 }
2918 optaddr = mp->b_rptr + tudr->OPT_offset;
2919 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2920 optaddr + tudr->OPT_length < mp->b_rptr ||
2921 optaddr + tudr->OPT_length > mp->b_wptr) {
2922 goto done;
2923 }
2924 destlen = tudr->DEST_length;
2925 optlen = tudr->OPT_length;
2926
2927 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2928 (char *)optaddr, optlen, err);
2929 if (mp1 != NULL)
2930 qreply(q, mp1);
2931
2932 done:
2933 freemsg(mp);
2934 }
2935
2936 static int
2937 rawip_do_unbind(conn_t *connp)
2938 {
2939 icmp_t *icmp = connp->conn_icmp;
2940
2941 mutex_enter(&connp->conn_lock);
2942 /* If a bind has not been done, we can't unbind. */
2943 if (icmp->icmp_state == TS_UNBND) {
2944 mutex_exit(&connp->conn_lock);
2945 return (-TOUTSTATE);
2946 }
2947 connp->conn_saddr_v6 = ipv6_all_zeros;
2948 connp->conn_bound_addr_v6 = ipv6_all_zeros;
2949 connp->conn_laddr_v6 = ipv6_all_zeros;
2950 connp->conn_mcbc_bind = B_FALSE;
2951 connp->conn_lport = 0;
2952 connp->conn_fport = 0;
2953 /* In case we were also connected */
2954 connp->conn_faddr_v6 = ipv6_all_zeros;
2955 connp->conn_v6lastdst = ipv6_all_zeros;
2956
2957 icmp->icmp_state = TS_UNBND;
2958
2959 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6,
2960 &connp->conn_faddr_v6, connp->conn_flowinfo);
2961 mutex_exit(&connp->conn_lock);
2962
2963 ip_unbind(connp);
2964 return (0);
2965 }
2966
2967 /*
2968 * This routine is called by icmp_wput to handle T_UNBIND_REQ messages.
2969 * After some error checking, the message is passed downstream to ip.
2970 */
2971 static void
2972 icmp_tpi_unbind(queue_t *q, mblk_t *mp)
2973 {
2974 conn_t *connp = Q_TO_CONN(q);
2975 int error;
2976
2977 ASSERT(mp->b_cont == NULL);
2978 error = rawip_do_unbind(connp);
2979 if (error) {
2980 if (error < 0) {
2981 icmp_err_ack(q, mp, -error, 0);
2982 } else {
2983 icmp_err_ack(q, mp, 0, error);
2984 }
2985 return;
2986 }
2987
2988 /*
2989 * Convert mp into a T_OK_ACK
2990 */
2991
2992 mp = mi_tpi_ok_ack_alloc(mp);
2993
2994 /*
2995 * should not happen in practice... T_OK_ACK is smaller than the
2996 * original message.
2997 */
2998 ASSERT(mp != NULL);
2999 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
3000 qreply(q, mp);
3001 }
3002
3003 /*
3004 * Process IPv4 packets that already include an IP header.
3005 * Used when IP_HDRINCL has been set (implicit for IPPROTO_RAW and
3006 * IPPROTO_IGMP).
3007 * In this case we ignore the address and any options in the T_UNITDATA_REQ.
3008 *
3009 * The packet is assumed to have a base (20 byte) IP header followed
3010 * by the upper-layer protocol. We include any IP_OPTIONS including a
3011 * CIPSO label but otherwise preserve the base IP header.
3012 */
3013 static int
3014 icmp_output_hdrincl(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
3015 {
3016 icmp_t *icmp = connp->conn_icmp;
3017 icmp_stack_t *is = icmp->icmp_is;
3018 ipha_t iphas;
3019 ipha_t *ipha;
3020 int ip_hdr_length;
3021 int tp_hdr_len;
3022 ip_xmit_attr_t *ixa;
3023 ip_pkt_t *ipp;
3024 in6_addr_t v6src;
3025 in6_addr_t v6dst;
3026 in6_addr_t v6nexthop;
3027 int error;
3028 boolean_t do_ipsec;
3029
3030 /*
3031 * We need an exclusive copy of conn_ixa since the included IP
3032 * header could have any destination.
3033 * That copy has no pointers hence we
3034 * need to set them up once we've parsed the ancillary data.
3035 */
3036 ixa = conn_get_ixa_exclusive(connp);
3037 if (ixa == NULL) {
3038 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3039 freemsg(mp);
3040 return (ENOMEM);
3041 }
3042 ASSERT(cr != NULL);
3043 /*
3044 * Caller has a reference on cr; from db_credp or because we
3045 * are running in process context.
3046 */
3047 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3048 ixa->ixa_cred = cr;
3049 ixa->ixa_cpid = pid;
3050 if (is_system_labeled()) {
3051 /* We need to restart with a label based on the cred */
3052 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3053 }
3054
3055 /* In case previous destination was multicast or multirt */
3056 ip_attr_newdst(ixa);
3057
3058 /* Get a copy of conn_xmit_ipp since the TX label might change it */
3059 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
3060 if (ipp == NULL) {
3061 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3062 ixa->ixa_cred = connp->conn_cred; /* Restore */
3063 ixa->ixa_cpid = connp->conn_cpid;
3064 ixa_refrele(ixa);
3065 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3066 freemsg(mp);
3067 return (ENOMEM);
3068 }
3069 mutex_enter(&connp->conn_lock);
3070 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
3071 mutex_exit(&connp->conn_lock);
3072 if (error != 0) {
3073 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3074 freemsg(mp);
3075 goto done;
3076 }
3077
3078 /* Sanity check length of packet */
3079 ipha = (ipha_t *)mp->b_rptr;
3080
3081 ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
3082 if ((mp->b_wptr - mp->b_rptr) < IP_SIMPLE_HDR_LENGTH) {
3083 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) {
3084 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3085 freemsg(mp);
3086 goto done;
3087 }
3088 ipha = (ipha_t *)mp->b_rptr;
3089 }
3090 ipha->ipha_version_and_hdr_length =
3091 (IP_VERSION<<4) | (ip_hdr_length>>2);
3092
3093 /*
3094 * We set IXAF_DONTFRAG if the application set DF which makes
3095 * IP not fragment.
3096 */
3097 ipha->ipha_fragment_offset_and_flags &= htons(IPH_DF);
3098 if (ipha->ipha_fragment_offset_and_flags & htons(IPH_DF))
3099 ixa->ixa_flags |= (IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
3100 else
3101 ixa->ixa_flags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
3102
3103 /* Even for multicast and broadcast we honor the apps ttl */
3104 ixa->ixa_flags |= IXAF_NO_TTL_CHANGE;
3105
3106 /*
3107 * No source verification for non-local addresses
3108 */
3109 if (ipha->ipha_src != INADDR_ANY &&
3110 ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid,
3111 is->is_netstack->netstack_ip, B_FALSE)
3112 != IPVL_UNICAST_UP) {
3113 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE;
3114 }
3115
3116 if (ipha->ipha_dst == INADDR_ANY)
3117 ipha->ipha_dst = htonl(INADDR_LOOPBACK);
3118
3119 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src);
3120 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst);
3121
3122 /* Defer IPsec if it might need to look at ICMP type/code */
3123 do_ipsec = ipha->ipha_protocol != IPPROTO_ICMP;
3124 ixa->ixa_flags |= IXAF_IS_IPV4;
3125
3126 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
3127 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop,
3128 connp->conn_fport, &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
3129 (do_ipsec ? IPDF_IPSEC : 0));
3130 switch (error) {
3131 case 0:
3132 break;
3133 case EADDRNOTAVAIL:
3134 /*
3135 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3136 * Don't have the application see that errno
3137 */
3138 error = ENETUNREACH;
3139 goto failed;
3140 case ENETDOWN:
3141 /*
3142 * Have !ipif_addr_ready address; drop packet silently
3143 * until we can get applications to not send until we
3144 * are ready.
3145 */
3146 error = 0;
3147 goto failed;
3148 case EHOSTUNREACH:
3149 case ENETUNREACH:
3150 if (ixa->ixa_ire != NULL) {
3151 /*
3152 * Let conn_ip_output/ire_send_noroute return
3153 * the error and send any local ICMP error.
3154 */
3155 error = 0;
3156 break;
3157 }
3158 /* FALLTHRU */
3159 default:
3160 failed:
3161 freemsg(mp);
3162 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3163 goto done;
3164 }
3165 if (ipha->ipha_src == INADDR_ANY)
3166 IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src);
3167
3168 /*
3169 * We might be going to a different destination than last time,
3170 * thus check that TX allows the communication and compute any
3171 * needed label.
3172 *
3173 * TSOL Note: We have an exclusive ipp and ixa for this thread so we
3174 * don't have to worry about concurrent threads.
3175 */
3176 if (is_system_labeled()) {
3177 /*
3178 * Check whether Trusted Solaris policy allows communication
3179 * with this host, and pretend that the destination is
3180 * unreachable if not.
3181 * Compute any needed label and place it in ipp_label_v4/v6.
3182 *
3183 * Later conn_build_hdr_template/conn_prepend_hdr takes
3184 * ipp_label_v4/v6 to form the packet.
3185 *
3186 * Tsol note: We have ipp structure local to this thread so
3187 * no locking is needed.
3188 */
3189 error = conn_update_label(connp, ixa, &v6dst, ipp);
3190 if (error != 0) {
3191 freemsg(mp);
3192 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3193 goto done;
3194 }
3195 }
3196
3197 /*
3198 * Save away a copy of the IPv4 header the application passed down
3199 * and then prepend an IPv4 header complete with any IP options
3200 * including label.
3201 * We need a struct copy since icmp_prepend_hdr will reuse the available
3202 * space in the mblk.
3203 */
3204 iphas = *ipha;
3205 mp->b_rptr += IP_SIMPLE_HDR_LENGTH;
3206
3207 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, 0, mp, &error);
3208 if (mp == NULL) {
3209 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3210 ASSERT(error != 0);
3211 goto done;
3212 }
3213 if (ixa->ixa_pktlen > IP_MAXPACKET) {
3214 error = EMSGSIZE;
3215 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3216 freemsg(mp);
3217 goto done;
3218 }
3219 /* Restore key parts of the header that the application passed down */
3220 ipha = (ipha_t *)mp->b_rptr;
3221 ipha->ipha_type_of_service = iphas.ipha_type_of_service;
3222 ipha->ipha_ident = iphas.ipha_ident;
3223 ipha->ipha_fragment_offset_and_flags =
3224 iphas.ipha_fragment_offset_and_flags;
3225 ipha->ipha_ttl = iphas.ipha_ttl;
3226 ipha->ipha_protocol = iphas.ipha_protocol;
3227 ipha->ipha_src = iphas.ipha_src;
3228 ipha->ipha_dst = iphas.ipha_dst;
3229
3230 ixa->ixa_protocol = ipha->ipha_protocol;
3231
3232 /*
3233 * Make sure that the IP header plus any transport header that is
3234 * checksumed by ip_output is in the first mblk. (ip_output assumes
3235 * that at least the checksum field is in the first mblk.)
3236 */
3237 switch (ipha->ipha_protocol) {
3238 case IPPROTO_UDP:
3239 tp_hdr_len = 8;
3240 break;
3241 case IPPROTO_TCP:
3242 tp_hdr_len = 20;
3243 break;
3244 default:
3245 tp_hdr_len = 0;
3246 break;
3247 }
3248 ip_hdr_length = IPH_HDR_LENGTH(ipha);
3249 if (mp->b_wptr - mp->b_rptr < ip_hdr_length + tp_hdr_len) {
3250 if (!pullupmsg(mp, ip_hdr_length + tp_hdr_len)) {
3251 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3252 if (mp->b_cont == NULL)
3253 error = EINVAL;
3254 else
3255 error = ENOMEM;
3256 freemsg(mp);
3257 goto done;
3258 }
3259 }
3260
3261 if (!do_ipsec) {
3262 /* Policy might differ for different ICMP type/code */
3263 if (ixa->ixa_ipsec_policy != NULL) {
3264 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
3265 ixa->ixa_ipsec_policy = NULL;
3266 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
3267 }
3268 mp = ip_output_attach_policy(mp, ipha, NULL, connp, ixa);
3269 if (mp == NULL) {
3270 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3271 error = EHOSTUNREACH; /* IPsec policy failure */
3272 goto done;
3273 }
3274 }
3275
3276 /* We're done. Pass the packet to ip. */
3277 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3278
3279 error = conn_ip_output(mp, ixa);
3280 /* No rawipOutErrors if an error since IP increases its error counter */
3281 switch (error) {
3282 case 0:
3283 break;
3284 case EWOULDBLOCK:
3285 (void) ixa_check_drain_insert(connp, ixa);
3286 error = 0;
3287 break;
3288 case EADDRNOTAVAIL:
3289 /*
3290 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3291 * Don't have the application see that errno
3292 */
3293 error = ENETUNREACH;
3294 break;
3295 }
3296 done:
3297 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3298 ixa->ixa_cred = connp->conn_cred; /* Restore */
3299 ixa->ixa_cpid = connp->conn_cpid;
3300 ixa_refrele(ixa);
3301 ip_pkt_free(ipp);
3302 kmem_free(ipp, sizeof (*ipp));
3303 return (error);
3304 }
3305
3306 static mblk_t *
3307 icmp_output_attach_policy(mblk_t *mp, conn_t *connp, ip_xmit_attr_t *ixa)
3308 {
3309 ipha_t *ipha = NULL;
3310 ip6_t *ip6h = NULL;
3311
3312 if (ixa->ixa_flags & IXAF_IS_IPV4)
3313 ipha = (ipha_t *)mp->b_rptr;
3314 else
3315 ip6h = (ip6_t *)mp->b_rptr;
3316
3317 if (ixa->ixa_ipsec_policy != NULL) {
3318 IPPOL_REFRELE(ixa->ixa_ipsec_policy);
3319 ixa->ixa_ipsec_policy = NULL;
3320 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE;
3321 }
3322 return (ip_output_attach_policy(mp, ipha, ip6h, connp, ixa));
3323 }
3324
3325 /*
3326 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
3327 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
3328 * the TPI options, otherwise we take them from msg_control.
3329 * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
3330 * Always consumes mp; never consumes tudr_mp.
3331 */
3332 static int
3333 icmp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
3334 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
3335 {
3336 icmp_t *icmp = connp->conn_icmp;
3337 icmp_stack_t *is = icmp->icmp_is;
3338 int error;
3339 ip_xmit_attr_t *ixa;
3340 ip_pkt_t *ipp;
3341 in6_addr_t v6src;
3342 in6_addr_t v6dst;
3343 in6_addr_t v6nexthop;
3344 in_port_t dstport;
3345 uint32_t flowinfo;
3346 int is_absreq_failure = 0;
3347 conn_opt_arg_t coas, *coa;
3348
3349 ASSERT(tudr_mp != NULL || msg != NULL);
3350
3351 /*
3352 * Get ixa before checking state to handle a disconnect race.
3353 *
3354 * We need an exclusive copy of conn_ixa since the ancillary data
3355 * options might modify it. That copy has no pointers hence we
3356 * need to set them up once we've parsed the ancillary data.
3357 */
3358 ixa = conn_get_ixa_exclusive(connp);
3359 if (ixa == NULL) {
3360 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3361 freemsg(mp);
3362 return (ENOMEM);
3363 }
3364 ASSERT(cr != NULL);
3365 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3366 ixa->ixa_cred = cr;
3367 ixa->ixa_cpid = pid;
3368 if (is_system_labeled()) {
3369 /* We need to restart with a label based on the cred */
3370 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3371 }
3372
3373 /* In case previous destination was multicast or multirt */
3374 ip_attr_newdst(ixa);
3375
3376 /* Get a copy of conn_xmit_ipp since the options might change it */
3377 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
3378 if (ipp == NULL) {
3379 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3380 ixa->ixa_cred = connp->conn_cred; /* Restore */
3381 ixa->ixa_cpid = connp->conn_cpid;
3382 ixa_refrele(ixa);
3383 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3384 freemsg(mp);
3385 return (ENOMEM);
3386 }
3387 mutex_enter(&connp->conn_lock);
3388 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
3389 mutex_exit(&connp->conn_lock);
3390 if (error != 0) {
3391 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3392 freemsg(mp);
3393 goto done;
3394 }
3395
3396 /*
3397 * Parse the options and update ixa and ipp as a result.
3398 */
3399
3400 coa = &coas;
3401 coa->coa_connp = connp;
3402 coa->coa_ixa = ixa;
3403 coa->coa_ipp = ipp;
3404 coa->coa_ancillary = B_TRUE;
3405 coa->coa_changed = 0;
3406
3407 if (msg != NULL) {
3408 error = process_auxiliary_options(connp, msg->msg_control,
3409 msg->msg_controllen, coa, &icmp_opt_obj, icmp_opt_set, cr);
3410 } else {
3411 struct T_unitdata_req *tudr;
3412
3413 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
3414 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
3415 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
3416 &tudr->OPT_length, tudr->OPT_offset, cr, &icmp_opt_obj,
3417 coa, &is_absreq_failure);
3418 }
3419 if (error != 0) {
3420 /*
3421 * Note: No special action needed in this
3422 * module for "is_absreq_failure"
3423 */
3424 freemsg(mp);
3425 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3426 goto done;
3427 }
3428 ASSERT(is_absreq_failure == 0);
3429
3430 mutex_enter(&connp->conn_lock);
3431 /*
3432 * If laddr is unspecified then we look at sin6_src_id.
3433 * We will give precedence to a source address set with IPV6_PKTINFO
3434 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3435 * want ip_attr_connect to select a source (since it can fail) when
3436 * IPV6_PKTINFO is specified.
3437 * If this doesn't result in a source address then we get a source
3438 * from ip_attr_connect() below.
3439 */
3440 v6src = connp->conn_saddr_v6;
3441 if (sin != NULL) {
3442 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3443 dstport = sin->sin_port;
3444 flowinfo = 0;
3445 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3446 ixa->ixa_flags |= IXAF_IS_IPV4;
3447 } else if (sin6 != NULL) {
3448 boolean_t v4mapped;
3449 uint_t srcid;
3450
3451 v6dst = sin6->sin6_addr;
3452 dstport = sin6->sin6_port;
3453 flowinfo = sin6->sin6_flowinfo;
3454 srcid = sin6->__sin6_src_id;
3455 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3456 ixa->ixa_scopeid = sin6->sin6_scope_id;
3457 ixa->ixa_flags |= IXAF_SCOPEID_SET;
3458 } else {
3459 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3460 }
3461 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3462 if (v4mapped)
3463 ixa->ixa_flags |= IXAF_IS_IPV4;
3464 else
3465 ixa->ixa_flags &= ~IXAF_IS_IPV4;
3466 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3467 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3468 v4mapped, connp->conn_netstack)) {
3469 /* Mismatched v4mapped/v6 specified by srcid. */
3470 mutex_exit(&connp->conn_lock);
3471 error = EADDRNOTAVAIL;
3472 goto failed; /* Does freemsg() and mib. */
3473 }
3474 }
3475 } else {
3476 /* Connected case */
3477 v6dst = connp->conn_faddr_v6;
3478 flowinfo = connp->conn_flowinfo;
3479 }
3480 mutex_exit(&connp->conn_lock);
3481 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3482 if (ipp->ipp_fields & IPPF_ADDR) {
3483 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3484 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3485 v6src = ipp->ipp_addr;
3486 } else {
3487 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3488 v6src = ipp->ipp_addr;
3489 }
3490 }
3491 /*
3492 * Allow source not assigned to the system
3493 * only if it is not a local addresses
3494 */
3495 if (!V6_OR_V4_INADDR_ANY(v6src)) {
3496 ip_laddr_t laddr_type;
3497
3498 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3499 ipaddr_t v4src;
3500
3501 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
3502 laddr_type = ip_laddr_verify_v4(v4src, ixa->ixa_zoneid,
3503 is->is_netstack->netstack_ip, B_FALSE);
3504 } else {
3505 laddr_type = ip_laddr_verify_v6(&v6src, ixa->ixa_zoneid,
3506 is->is_netstack->netstack_ip, B_FALSE, B_FALSE);
3507 }
3508 if (laddr_type != IPVL_UNICAST_UP)
3509 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE;
3510 }
3511
3512 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
3513 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3514 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
3515
3516 switch (error) {
3517 case 0:
3518 break;
3519 case EADDRNOTAVAIL:
3520 /*
3521 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3522 * Don't have the application see that errno
3523 */
3524 error = ENETUNREACH;
3525 goto failed;
3526 case ENETDOWN:
3527 /*
3528 * Have !ipif_addr_ready address; drop packet silently
3529 * until we can get applications to not send until we
3530 * are ready.
3531 */
3532 error = 0;
3533 goto failed;
3534 case EHOSTUNREACH:
3535 case ENETUNREACH:
3536 if (ixa->ixa_ire != NULL) {
3537 /*
3538 * Let conn_ip_output/ire_send_noroute return
3539 * the error and send any local ICMP error.
3540 */
3541 error = 0;
3542 break;
3543 }
3544 /* FALLTHRU */
3545 default:
3546 failed:
3547 freemsg(mp);
3548 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3549 goto done;
3550 }
3551
3552 /*
3553 * We might be going to a different destination than last time,
3554 * thus check that TX allows the communication and compute any
3555 * needed label.
3556 *
3557 * TSOL Note: We have an exclusive ipp and ixa for this thread so we
3558 * don't have to worry about concurrent threads.
3559 */
3560 if (is_system_labeled()) {
3561 /*
3562 * Check whether Trusted Solaris policy allows communication
3563 * with this host, and pretend that the destination is
3564 * unreachable if not.
3565 * Compute any needed label and place it in ipp_label_v4/v6.
3566 *
3567 * Later conn_build_hdr_template/conn_prepend_hdr takes
3568 * ipp_label_v4/v6 to form the packet.
3569 *
3570 * Tsol note: We have ipp structure local to this thread so
3571 * no locking is needed.
3572 */
3573 error = conn_update_label(connp, ixa, &v6dst, ipp);
3574 if (error != 0) {
3575 freemsg(mp);
3576 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3577 goto done;
3578 }
3579 }
3580 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, flowinfo, mp,
3581 &error);
3582 if (mp == NULL) {
3583 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3584 ASSERT(error != 0);
3585 goto done;
3586 }
3587 if (ixa->ixa_pktlen > IP_MAXPACKET) {
3588 error = EMSGSIZE;
3589 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3590 freemsg(mp);
3591 goto done;
3592 }
3593
3594 /* Policy might differ for different ICMP type/code */
3595 mp = icmp_output_attach_policy(mp, connp, ixa);
3596 if (mp == NULL) {
3597 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3598 error = EHOSTUNREACH; /* IPsec policy failure */
3599 goto done;
3600 }
3601
3602 /* We're done. Pass the packet to ip. */
3603 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3604
3605 error = conn_ip_output(mp, ixa);
3606 if (!connp->conn_unspec_src)
3607 ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
3608 /* No rawipOutErrors if an error since IP increases its error counter */
3609 switch (error) {
3610 case 0:
3611 break;
3612 case EWOULDBLOCK:
3613 (void) ixa_check_drain_insert(connp, ixa);
3614 error = 0;
3615 break;
3616 case EADDRNOTAVAIL:
3617 /*
3618 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3619 * Don't have the application see that errno
3620 */
3621 error = ENETUNREACH;
3622 /* FALLTHRU */
3623 default:
3624 mutex_enter(&connp->conn_lock);
3625 /*
3626 * Clear the source and v6lastdst so we call ip_attr_connect
3627 * for the next packet and try to pick a better source.
3628 */
3629 if (connp->conn_mcbc_bind)
3630 connp->conn_saddr_v6 = ipv6_all_zeros;
3631 else
3632 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3633 connp->conn_v6lastdst = ipv6_all_zeros;
3634 mutex_exit(&connp->conn_lock);
3635 break;
3636 }
3637 done:
3638 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3639 ixa->ixa_cred = connp->conn_cred; /* Restore */
3640 ixa->ixa_cpid = connp->conn_cpid;
3641 ixa_refrele(ixa);
3642 ip_pkt_free(ipp);
3643 kmem_free(ipp, sizeof (*ipp));
3644 return (error);
3645 }
3646
3647 /*
3648 * Handle sending an M_DATA for a connected socket.
3649 * Handles both IPv4 and IPv6.
3650 */
3651 int
3652 icmp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
3653 {
3654 icmp_t *icmp = connp->conn_icmp;
3655 icmp_stack_t *is = icmp->icmp_is;
3656 int error;
3657 ip_xmit_attr_t *ixa;
3658 boolean_t do_ipsec;
3659
3660 /*
3661 * If no other thread is using conn_ixa this just gets a reference to
3662 * conn_ixa. Otherwise we get a safe copy of conn_ixa.
3663 */
3664 ixa = conn_get_ixa(connp, B_FALSE);
3665 if (ixa == NULL) {
3666 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3667 freemsg(mp);
3668 return (ENOMEM);
3669 }
3670
3671 ASSERT(cr != NULL);
3672 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3673 ixa->ixa_cred = cr;
3674 ixa->ixa_cpid = pid;
3675
3676 /* Defer IPsec if it might need to look at ICMP type/code */
3677 switch (ixa->ixa_protocol) {
3678 case IPPROTO_ICMP:
3679 case IPPROTO_ICMPV6:
3680 do_ipsec = B_FALSE;
3681 break;
3682 default:
3683 do_ipsec = B_TRUE;
3684 }
3685
3686 mutex_enter(&connp->conn_lock);
3687 mp = icmp_prepend_header_template(connp, ixa, mp,
3688 &connp->conn_saddr_v6, connp->conn_flowinfo, &error);
3689
3690 if (mp == NULL) {
3691 ASSERT(error != 0);
3692 mutex_exit(&connp->conn_lock);
3693 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3694 ixa->ixa_cred = connp->conn_cred; /* Restore */
3695 ixa->ixa_cpid = connp->conn_cpid;
3696 ixa_refrele(ixa);
3697 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3698 freemsg(mp);
3699 return (error);
3700 }
3701
3702 if (!do_ipsec) {
3703 /* Policy might differ for different ICMP type/code */
3704 mp = icmp_output_attach_policy(mp, connp, ixa);
3705 if (mp == NULL) {
3706 mutex_exit(&connp->conn_lock);
3707 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3708 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3709 ixa->ixa_cred = connp->conn_cred; /* Restore */
3710 ixa->ixa_cpid = connp->conn_cpid;
3711 ixa_refrele(ixa);
3712 return (EHOSTUNREACH); /* IPsec policy failure */
3713 }
3714 }
3715
3716 /*
3717 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3718 * safe copy, then we need to fill in any pointers in it.
3719 */
3720 if (ixa->ixa_ire == NULL) {
3721 in6_addr_t faddr, saddr;
3722 in6_addr_t nexthop;
3723 in_port_t fport;
3724
3725 saddr = connp->conn_saddr_v6;
3726 faddr = connp->conn_faddr_v6;
3727 fport = connp->conn_fport;
3728 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
3729 mutex_exit(&connp->conn_lock);
3730
3731 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
3732 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
3733 (do_ipsec ? IPDF_IPSEC : 0));
3734 switch (error) {
3735 case 0:
3736 break;
3737 case EADDRNOTAVAIL:
3738 /*
3739 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3740 * Don't have the application see that errno
3741 */
3742 error = ENETUNREACH;
3743 goto failed;
3744 case ENETDOWN:
3745 /*
3746 * Have !ipif_addr_ready address; drop packet silently
3747 * until we can get applications to not send until we
3748 * are ready.
3749 */
3750 error = 0;
3751 goto failed;
3752 case EHOSTUNREACH:
3753 case ENETUNREACH:
3754 if (ixa->ixa_ire != NULL) {
3755 /*
3756 * Let conn_ip_output/ire_send_noroute return
3757 * the error and send any local ICMP error.
3758 */
3759 error = 0;
3760 break;
3761 }
3762 /* FALLTHRU */
3763 default:
3764 failed:
3765 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3766 ixa->ixa_cred = connp->conn_cred; /* Restore */
3767 ixa->ixa_cpid = connp->conn_cpid;
3768 ixa_refrele(ixa);
3769 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3770 freemsg(mp);
3771 return (error);
3772 }
3773 } else {
3774 /* Done with conn_t */
3775 mutex_exit(&connp->conn_lock);
3776 }
3777
3778 /* We're done. Pass the packet to ip. */
3779 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3780
3781 error = conn_ip_output(mp, ixa);
3782 /* No rawipOutErrors if an error since IP increases its error counter */
3783 switch (error) {
3784 case 0:
3785 break;
3786 case EWOULDBLOCK:
3787 (void) ixa_check_drain_insert(connp, ixa);
3788 error = 0;
3789 break;
3790 case EADDRNOTAVAIL:
3791 /*
3792 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3793 * Don't have the application see that errno
3794 */
3795 error = ENETUNREACH;
3796 break;
3797 }
3798 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3799 ixa->ixa_cred = connp->conn_cred; /* Restore */
3800 ixa->ixa_cpid = connp->conn_cpid;
3801 ixa_refrele(ixa);
3802 return (error);
3803 }
3804
3805 /*
3806 * Handle sending an M_DATA to the last destination.
3807 * Handles both IPv4 and IPv6.
3808 *
3809 * NOTE: The caller must hold conn_lock and we drop it here.
3810 */
3811 int
3812 icmp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3813 ip_xmit_attr_t *ixa)
3814 {
3815 icmp_t *icmp = connp->conn_icmp;
3816 icmp_stack_t *is = icmp->icmp_is;
3817 int error;
3818 boolean_t do_ipsec;
3819
3820 ASSERT(MUTEX_HELD(&connp->conn_lock));
3821 ASSERT(ixa != NULL);
3822
3823 ASSERT(cr != NULL);
3824 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3825 ixa->ixa_cred = cr;
3826 ixa->ixa_cpid = pid;
3827
3828 /* Defer IPsec if it might need to look at ICMP type/code */
3829 switch (ixa->ixa_protocol) {
3830 case IPPROTO_ICMP:
3831 case IPPROTO_ICMPV6:
3832 do_ipsec = B_FALSE;
3833 break;
3834 default:
3835 do_ipsec = B_TRUE;
3836 }
3837
3838
3839 mp = icmp_prepend_header_template(connp, ixa, mp,
3840 &connp->conn_v6lastsrc, connp->conn_lastflowinfo, &error);
3841
3842 if (mp == NULL) {
3843 ASSERT(error != 0);
3844 mutex_exit(&connp->conn_lock);
3845 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3846 ixa->ixa_cred = connp->conn_cred; /* Restore */
3847 ixa->ixa_cpid = connp->conn_cpid;
3848 ixa_refrele(ixa);
3849 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3850 freemsg(mp);
3851 return (error);
3852 }
3853
3854 if (!do_ipsec) {
3855 /* Policy might differ for different ICMP type/code */
3856 mp = icmp_output_attach_policy(mp, connp, ixa);
3857 if (mp == NULL) {
3858 mutex_exit(&connp->conn_lock);
3859 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3860 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3861 ixa->ixa_cred = connp->conn_cred; /* Restore */
3862 ixa->ixa_cpid = connp->conn_cpid;
3863 ixa_refrele(ixa);
3864 return (EHOSTUNREACH); /* IPsec policy failure */
3865 }
3866 }
3867
3868 /*
3869 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3870 * safe copy, then we need to fill in any pointers in it.
3871 */
3872 if (ixa->ixa_ire == NULL) {
3873 in6_addr_t lastdst, lastsrc;
3874 in6_addr_t nexthop;
3875 in_port_t lastport;
3876
3877 lastsrc = connp->conn_v6lastsrc;
3878 lastdst = connp->conn_v6lastdst;
3879 lastport = connp->conn_lastdstport;
3880 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3881 mutex_exit(&connp->conn_lock);
3882
3883 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3884 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3885 IPDF_VERIFY_DST | (do_ipsec ? IPDF_IPSEC : 0));
3886 switch (error) {
3887 case 0:
3888 break;
3889 case EADDRNOTAVAIL:
3890 /*
3891 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3892 * Don't have the application see that errno
3893 */
3894 error = ENETUNREACH;
3895 goto failed;
3896 case ENETDOWN:
3897 /*
3898 * Have !ipif_addr_ready address; drop packet silently
3899 * until we can get applications to not send until we
3900 * are ready.
3901 */
3902 error = 0;
3903 goto failed;
3904 case EHOSTUNREACH:
3905 case ENETUNREACH:
3906 if (ixa->ixa_ire != NULL) {
3907 /*
3908 * Let conn_ip_output/ire_send_noroute return
3909 * the error and send any local ICMP error.
3910 */
3911 error = 0;
3912 break;
3913 }
3914 /* FALLTHRU */
3915 default:
3916 failed:
3917 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3918 ixa->ixa_cred = connp->conn_cred; /* Restore */
3919 ixa->ixa_cpid = connp->conn_cpid;
3920 ixa_refrele(ixa);
3921 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
3922 freemsg(mp);
3923 return (error);
3924 }
3925 } else {
3926 /* Done with conn_t */
3927 mutex_exit(&connp->conn_lock);
3928 }
3929
3930 /* We're done. Pass the packet to ip. */
3931 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
3932 error = conn_ip_output(mp, ixa);
3933 /* No rawipOutErrors if an error since IP increases its error counter */
3934 switch (error) {
3935 case 0:
3936 break;
3937 case EWOULDBLOCK:
3938 (void) ixa_check_drain_insert(connp, ixa);
3939 error = 0;
3940 break;
3941 case EADDRNOTAVAIL:
3942 /*
3943 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3944 * Don't have the application see that errno
3945 */
3946 error = ENETUNREACH;
3947 /* FALLTHRU */
3948 default:
3949 mutex_enter(&connp->conn_lock);
3950 /*
3951 * Clear the source and v6lastdst so we call ip_attr_connect
3952 * for the next packet and try to pick a better source.
3953 */
3954 if (connp->conn_mcbc_bind)
3955 connp->conn_saddr_v6 = ipv6_all_zeros;
3956 else
3957 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3958 connp->conn_v6lastdst = ipv6_all_zeros;
3959 mutex_exit(&connp->conn_lock);
3960 break;
3961 }
3962 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3963 ixa->ixa_cred = connp->conn_cred; /* Restore */
3964 ixa->ixa_cpid = connp->conn_cpid;
3965 ixa_refrele(ixa);
3966 return (error);
3967 }
3968
3969
3970 /*
3971 * Prepend the header template and then fill in the source and
3972 * flowinfo. The caller needs to handle the destination address since
3973 * it's setting is different if rthdr or source route.
3974 *
3975 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3976 * When it returns NULL it sets errorp.
3977 */
3978 static mblk_t *
3979 icmp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3980 const in6_addr_t *v6src, uint32_t flowinfo, int *errorp)
3981 {
3982 icmp_t *icmp = connp->conn_icmp;
3983 icmp_stack_t *is = icmp->icmp_is;
3984 uint_t pktlen;
3985 uint_t copylen;
3986 uint8_t *iph;
3987 uint_t ip_hdr_length;
3988 uint32_t cksum;
3989 ip_pkt_t *ipp;
3990
3991 ASSERT(MUTEX_HELD(&connp->conn_lock));
3992
3993 /*
3994 * Copy the header template.
3995 */
3996 copylen = connp->conn_ht_iphc_len;
3997 pktlen = copylen + msgdsize(mp);
3998 if (pktlen > IP_MAXPACKET) {
3999 freemsg(mp);
4000 *errorp = EMSGSIZE;
4001 return (NULL);
4002 }
4003 ixa->ixa_pktlen = pktlen;
4004
4005 /* check/fix buffer config, setup pointers into it */
4006 iph = mp->b_rptr - copylen;
4007 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
4008 mblk_t *mp1;
4009
4010 mp1 = allocb(copylen + is->is_wroff_extra, BPRI_MED);
4011 if (mp1 == NULL) {
4012 freemsg(mp);
4013 *errorp = ENOMEM;
4014 return (NULL);
4015 }
4016 mp1->b_wptr = DB_LIM(mp1);
4017 mp1->b_cont = mp;
4018 mp = mp1;
4019 iph = (mp->b_wptr - copylen);
4020 }
4021 mp->b_rptr = iph;
4022 bcopy(connp->conn_ht_iphc, iph, copylen);
4023 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
4024
4025 ixa->ixa_ip_hdr_length = ip_hdr_length;
4026
4027 /*
4028 * Prepare for ICMPv6 checksum done in IP.
4029 *
4030 * icmp_build_hdr_template has already massaged any routing header
4031 * and placed the result in conn_sum.
4032 *
4033 * We make it easy for IP to include our pseudo header
4034 * by putting our length (and any routing header adjustment)
4035 * in the ICMPv6 checksum field.
4036 */
4037 cksum = pktlen - ip_hdr_length;
4038
4039 cksum += connp->conn_sum;
4040 cksum = (cksum >> 16) + (cksum & 0xFFFF);
4041 ASSERT(cksum < 0x10000);
4042
4043 ipp = &connp->conn_xmit_ipp;
4044 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4045 ipha_t *ipha = (ipha_t *)iph;
4046
4047 ipha->ipha_length = htons((uint16_t)pktlen);
4048
4049 /* if IP_PKTINFO specified an addres it wins over bind() */
4050 if ((ipp->ipp_fields & IPPF_ADDR) &&
4051 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
4052 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
4053 ipha->ipha_src = ipp->ipp_addr_v4;
4054 } else {
4055 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
4056 }
4057 } else {
4058 ip6_t *ip6h = (ip6_t *)iph;
4059 uint_t cksum_offset = 0;
4060
4061 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN));
4062
4063 /* if IP_PKTINFO specified an addres it wins over bind() */
4064 if ((ipp->ipp_fields & IPPF_ADDR) &&
4065 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
4066 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
4067 ip6h->ip6_src = ipp->ipp_addr;
4068 } else {
4069 ip6h->ip6_src = *v6src;
4070 }
4071 ip6h->ip6_vcf =
4072 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
4073 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
4074 if (ipp->ipp_fields & IPPF_TCLASS) {
4075 /* Overrides the class part of flowinfo */
4076 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
4077 ipp->ipp_tclass);
4078 }
4079
4080 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) {
4081 if (connp->conn_proto == IPPROTO_ICMPV6) {
4082 cksum_offset = ixa->ixa_ip_hdr_length +
4083 offsetof(icmp6_t, icmp6_cksum);
4084 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) {
4085 cksum_offset = ixa->ixa_ip_hdr_length +
4086 ixa->ixa_raw_cksum_offset;
4087 }
4088 }
4089 if (cksum_offset != 0) {
4090 uint16_t *ptr;
4091
4092 /* Make sure the checksum fits in the first mblk */
4093 if (cksum_offset + sizeof (short) > MBLKL(mp)) {
4094 mblk_t *mp1;
4095
4096 mp1 = msgpullup(mp,
4097 cksum_offset + sizeof (short));
4098 freemsg(mp);
4099 if (mp1 == NULL) {
4100 *errorp = ENOMEM;
4101 return (NULL);
4102 }
4103 mp = mp1;
4104 iph = mp->b_rptr;
4105 ip6h = (ip6_t *)iph;
4106 }
4107 ptr = (uint16_t *)(mp->b_rptr + cksum_offset);
4108 *ptr = htons(cksum);
4109 }
4110 }
4111
4112 return (mp);
4113 }
4114
4115 /*
4116 * This routine handles all messages passed downstream. It either
4117 * consumes the message or passes it downstream; it never queues a
4118 * a message.
4119 */
4120 int
4121 icmp_wput(queue_t *q, mblk_t *mp)
4122 {
4123 sin6_t *sin6;
4124 sin_t *sin = NULL;
4125 uint_t srcid;
4126 conn_t *connp = Q_TO_CONN(q);
4127 icmp_t *icmp = connp->conn_icmp;
4128 int error = 0;
4129 struct sockaddr *addr = NULL;
4130 socklen_t addrlen;
4131 icmp_stack_t *is = icmp->icmp_is;
4132 struct T_unitdata_req *tudr;
4133 mblk_t *data_mp;
4134 cred_t *cr;
4135 pid_t pid;
4136
4137 /*
4138 * We directly handle several cases here: T_UNITDATA_REQ message
4139 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
4140 * socket.
4141 */
4142 switch (DB_TYPE(mp)) {
4143 case M_DATA:
4144 /* sockfs never sends down M_DATA */
4145 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4146 freemsg(mp);
4147 return (0);
4148
4149 case M_PROTO:
4150 case M_PCPROTO:
4151 tudr = (struct T_unitdata_req *)mp->b_rptr;
4152 if (MBLKL(mp) < sizeof (*tudr) ||
4153 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
4154 icmp_wput_other(q, mp);
4155 return (0);
4156 }
4157 break;
4158
4159 default:
4160 icmp_wput_other(q, mp);
4161 return (0);
4162 }
4163
4164 /* Handle valid T_UNITDATA_REQ here */
4165 data_mp = mp->b_cont;
4166 if (data_mp == NULL) {
4167 error = EPROTO;
4168 goto ud_error2;
4169 }
4170 mp->b_cont = NULL;
4171
4172 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
4173 error = EADDRNOTAVAIL;
4174 goto ud_error2;
4175 }
4176
4177 /*
4178 * All Solaris components should pass a db_credp
4179 * for this message, hence we ASSERT.
4180 * On production kernels we return an error to be robust against
4181 * random streams modules sitting on top of us.
4182 */
4183 cr = msg_getcred(mp, &pid);
4184 ASSERT(cr != NULL);
4185 if (cr == NULL) {
4186 error = EINVAL;
4187 goto ud_error2;
4188 }
4189
4190 /*
4191 * If a port has not been bound to the stream, fail.
4192 * This is not a problem when sockfs is directly
4193 * above us, because it will ensure that the socket
4194 * is first bound before allowing data to be sent.
4195 */
4196 if (icmp->icmp_state == TS_UNBND) {
4197 error = EPROTO;
4198 goto ud_error2;
4199 }
4200 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
4201 addrlen = tudr->DEST_length;
4202
4203 switch (connp->conn_family) {
4204 case AF_INET6:
4205 sin6 = (sin6_t *)addr;
4206 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
4207 (sin6->sin6_family != AF_INET6)) {
4208 error = EADDRNOTAVAIL;
4209 goto ud_error2;
4210 }
4211
4212 /* No support for mapped addresses on raw sockets */
4213 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4214 error = EADDRNOTAVAIL;
4215 goto ud_error2;
4216 }
4217 srcid = sin6->__sin6_src_id;
4218
4219 /*
4220 * If the local address is a mapped address return
4221 * an error.
4222 * It would be possible to send an IPv6 packet but the
4223 * response would never make it back to the application
4224 * since it is bound to a mapped address.
4225 */
4226 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
4227 error = EADDRNOTAVAIL;
4228 goto ud_error2;
4229 }
4230
4231 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
4232 sin6->sin6_addr = ipv6_loopback;
4233
4234 if (tudr->OPT_length != 0) {
4235 /*
4236 * If we are connected then the destination needs to be
4237 * the same as the connected one.
4238 */
4239 if (icmp->icmp_state == TS_DATA_XFER &&
4240 !conn_same_as_last_v6(connp, sin6)) {
4241 error = EISCONN;
4242 goto ud_error2;
4243 }
4244 error = icmp_output_ancillary(connp, NULL, sin6,
4245 data_mp, mp, NULL, cr, pid);
4246 } else {
4247 ip_xmit_attr_t *ixa;
4248
4249 /*
4250 * We have to allocate an ip_xmit_attr_t before we grab
4251 * conn_lock and we need to hold conn_lock once we've
4252 * checked conn_same_as_last_v6 to handle concurrent
4253 * send* calls on a socket.
4254 */
4255 ixa = conn_get_ixa(connp, B_FALSE);
4256 if (ixa == NULL) {
4257 error = ENOMEM;
4258 goto ud_error2;
4259 }
4260 mutex_enter(&connp->conn_lock);
4261
4262 if (conn_same_as_last_v6(connp, sin6) &&
4263 connp->conn_lastsrcid == srcid &&
4264 ipsec_outbound_policy_current(ixa)) {
4265 /* icmp_output_lastdst drops conn_lock */
4266 error = icmp_output_lastdst(connp, data_mp, cr,
4267 pid, ixa);
4268 } else {
4269 /* icmp_output_newdst drops conn_lock */
4270 error = icmp_output_newdst(connp, data_mp, NULL,
4271 sin6, cr, pid, ixa);
4272 }
4273 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
4274 }
4275 if (error == 0) {
4276 freeb(mp);
4277 return (0);
4278 }
4279 break;
4280
4281 case AF_INET:
4282 sin = (sin_t *)addr;
4283 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
4284 (sin->sin_family != AF_INET)) {
4285 error = EADDRNOTAVAIL;
4286 goto ud_error2;
4287 }
4288 if (sin->sin_addr.s_addr == INADDR_ANY)
4289 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
4290
4291 /* Protocol 255 contains full IP headers */
4292 /* Read without holding lock */
4293 if (icmp->icmp_hdrincl) {
4294 if (MBLKL(data_mp) < IP_SIMPLE_HDR_LENGTH) {
4295 if (!pullupmsg(data_mp, IP_SIMPLE_HDR_LENGTH)) {
4296 error = EINVAL;
4297 goto ud_error2;
4298 }
4299 }
4300 error = icmp_output_hdrincl(connp, data_mp, cr, pid);
4301 if (error == 0) {
4302 freeb(mp);
4303 return (0);
4304 }
4305 /* data_mp consumed above */
4306 data_mp = NULL;
4307 goto ud_error2;
4308 }
4309
4310 if (tudr->OPT_length != 0) {
4311 /*
4312 * If we are connected then the destination needs to be
4313 * the same as the connected one.
4314 */
4315 if (icmp->icmp_state == TS_DATA_XFER &&
4316 !conn_same_as_last_v4(connp, sin)) {
4317 error = EISCONN;
4318 goto ud_error2;
4319 }
4320 error = icmp_output_ancillary(connp, sin, NULL,
4321 data_mp, mp, NULL, cr, pid);
4322 } else {
4323 ip_xmit_attr_t *ixa;
4324
4325 /*
4326 * We have to allocate an ip_xmit_attr_t before we grab
4327 * conn_lock and we need to hold conn_lock once we've
4328 * checked conn_same_as_last_v4 to handle concurrent
4329 * send* calls on a socket.
4330 */
4331 ixa = conn_get_ixa(connp, B_FALSE);
4332 if (ixa == NULL) {
4333 error = ENOMEM;
4334 goto ud_error2;
4335 }
4336 mutex_enter(&connp->conn_lock);
4337
4338 if (conn_same_as_last_v4(connp, sin) &&
4339 ipsec_outbound_policy_current(ixa)) {
4340 /* icmp_output_lastdst drops conn_lock */
4341 error = icmp_output_lastdst(connp, data_mp, cr,
4342 pid, ixa);
4343 } else {
4344 /* icmp_output_newdst drops conn_lock */
4345 error = icmp_output_newdst(connp, data_mp, sin,
4346 NULL, cr, pid, ixa);
4347 }
4348 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
4349 }
4350 if (error == 0) {
4351 freeb(mp);
4352 return (0);
4353 }
4354 break;
4355 }
4356 ASSERT(mp != NULL);
4357 /* mp is freed by the following routine */
4358 icmp_ud_err(q, mp, (t_scalar_t)error);
4359 return (0);
4360
4361 ud_error2:
4362 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4363 freemsg(data_mp);
4364 ASSERT(mp != NULL);
4365 /* mp is freed by the following routine */
4366 icmp_ud_err(q, mp, (t_scalar_t)error);
4367 return (0);
4368 }
4369
4370 /*
4371 * Handle the case of the IP address or flow label being different
4372 * for both IPv4 and IPv6.
4373 *
4374 * NOTE: The caller must hold conn_lock and we drop it here.
4375 */
4376 static int
4377 icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
4378 cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
4379 {
4380 icmp_t *icmp = connp->conn_icmp;
4381 icmp_stack_t *is = icmp->icmp_is;
4382 int error;
4383 ip_xmit_attr_t *oldixa;
4384 boolean_t do_ipsec;
4385 uint_t srcid;
4386 uint32_t flowinfo;
4387 in6_addr_t v6src;
4388 in6_addr_t v6dst;
4389 in6_addr_t v6nexthop;
4390 in_port_t dstport;
4391
4392 ASSERT(MUTEX_HELD(&connp->conn_lock));
4393 ASSERT(ixa != NULL);
4394
4395 /*
4396 * We hold conn_lock across all the use and modifications of
4397 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
4398 * stay consistent.
4399 */
4400
4401 ASSERT(cr != NULL);
4402 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4403 ixa->ixa_cred = cr;
4404 ixa->ixa_cpid = pid;
4405 if (is_system_labeled()) {
4406 /* We need to restart with a label based on the cred */
4407 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
4408 }
4409 /*
4410 * If we are connected then the destination needs to be the
4411 * same as the connected one, which is not the case here since we
4412 * checked for that above.
4413 */
4414 if (icmp->icmp_state == TS_DATA_XFER) {
4415 mutex_exit(&connp->conn_lock);
4416 error = EISCONN;
4417 goto ud_error;
4418 }
4419
4420 /* In case previous destination was multicast or multirt */
4421 ip_attr_newdst(ixa);
4422
4423 /*
4424 * If laddr is unspecified then we look at sin6_src_id.
4425 * We will give precedence to a source address set with IPV6_PKTINFO
4426 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
4427 * want ip_attr_connect to select a source (since it can fail) when
4428 * IPV6_PKTINFO is specified.
4429 * If this doesn't result in a source address then we get a source
4430 * from ip_attr_connect() below.
4431 */
4432 v6src = connp->conn_saddr_v6;
4433 if (sin != NULL) {
4434 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
4435 dstport = sin->sin_port;
4436 flowinfo = 0;
4437 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
4438 srcid = 0;
4439 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
4440 ixa->ixa_flags |= IXAF_IS_IPV4;
4441 } else {
4442 boolean_t v4mapped;
4443
4444 v6dst = sin6->sin6_addr;
4445 dstport = sin6->sin6_port;
4446 flowinfo = sin6->sin6_flowinfo;
4447 srcid = sin6->__sin6_src_id;
4448 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
4449 ixa->ixa_scopeid = sin6->sin6_scope_id;
4450 ixa->ixa_flags |= IXAF_SCOPEID_SET;
4451 } else {
4452 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
4453 }
4454 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
4455 if (v4mapped)
4456 ixa->ixa_flags |= IXAF_IS_IPV4;
4457 else
4458 ixa->ixa_flags &= ~IXAF_IS_IPV4;
4459 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
4460 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
4461 v4mapped, connp->conn_netstack)) {
4462 /* Mismatched v4mapped/v6 specified by srcid. */
4463 mutex_exit(&connp->conn_lock);
4464 error = EADDRNOTAVAIL;
4465 goto ud_error;
4466 }
4467 }
4468 }
4469 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
4470 if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
4471 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
4472
4473 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4474 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
4475 v6src = ipp->ipp_addr;
4476 } else {
4477 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
4478 v6src = ipp->ipp_addr;
4479 }
4480 }
4481
4482 /* Defer IPsec if it might need to look at ICMP type/code */
4483 switch (ixa->ixa_protocol) {
4484 case IPPROTO_ICMP:
4485 case IPPROTO_ICMPV6:
4486 do_ipsec = B_FALSE;
4487 break;
4488 default:
4489 do_ipsec = B_TRUE;
4490 }
4491
4492 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
4493 mutex_exit(&connp->conn_lock);
4494
4495 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
4496 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
4497 (do_ipsec ? IPDF_IPSEC : 0));
4498 switch (error) {
4499 case 0:
4500 break;
4501 case EADDRNOTAVAIL:
4502 /*
4503 * IXAF_VERIFY_SOURCE tells us to pick a better source.
4504 * Don't have the application see that errno
4505 */
4506 error = ENETUNREACH;
4507 goto failed;
4508 case ENETDOWN:
4509 /*
4510 * Have !ipif_addr_ready address; drop packet silently
4511 * until we can get applications to not send until we
4512 * are ready.
4513 */
4514 error = 0;
4515 goto failed;
4516 case EHOSTUNREACH:
4517 case ENETUNREACH:
4518 if (ixa->ixa_ire != NULL) {
4519 /*
4520 * Let conn_ip_output/ire_send_noroute return
4521 * the error and send any local ICMP error.
4522 */
4523 error = 0;
4524 break;
4525 }
4526 /* FALLTHRU */
4527 default:
4528 failed:
4529 goto ud_error;
4530 }
4531
4532 mutex_enter(&connp->conn_lock);
4533 /*
4534 * While we dropped the lock some other thread might have connected
4535 * this socket. If so we bail out with EISCONN to ensure that the
4536 * connecting thread is the one that updates conn_ixa, conn_ht_*
4537 * and conn_*last*.
4538 */
4539 if (icmp->icmp_state == TS_DATA_XFER) {
4540 mutex_exit(&connp->conn_lock);
4541 error = EISCONN;
4542 goto ud_error;
4543 }
4544
4545 /*
4546 * We need to rebuild the headers if
4547 * - we are labeling packets (could be different for different
4548 * destinations)
4549 * - we have a source route (or routing header) since we need to
4550 * massage that to get the pseudo-header checksum
4551 * - a socket option with COA_HEADER_CHANGED has been set which
4552 * set conn_v6lastdst to zero.
4553 *
4554 * Otherwise the prepend function will just update the src, dst,
4555 * and flow label.
4556 */
4557 if (is_system_labeled()) {
4558 /* TX MLP requires SCM_UCRED and don't have that here */
4559 if (connp->conn_mlp_type != mlptSingle) {
4560 mutex_exit(&connp->conn_lock);
4561 error = ECONNREFUSED;
4562 goto ud_error;
4563 }
4564 /*
4565 * Check whether Trusted Solaris policy allows communication
4566 * with this host, and pretend that the destination is
4567 * unreachable if not.
4568 * Compute any needed label and place it in ipp_label_v4/v6.
4569 *
4570 * Later conn_build_hdr_template/conn_prepend_hdr takes
4571 * ipp_label_v4/v6 to form the packet.
4572 *
4573 * Tsol note: Since we hold conn_lock we know no other
4574 * thread manipulates conn_xmit_ipp.
4575 */
4576 error = conn_update_label(connp, ixa, &v6dst,
4577 &connp->conn_xmit_ipp);
4578 if (error != 0) {
4579 mutex_exit(&connp->conn_lock);
4580 goto ud_error;
4581 }
4582 /* Rebuild the header template */
4583 error = icmp_build_hdr_template(connp, &v6src, &v6dst,
4584 flowinfo);
4585 if (error != 0) {
4586 mutex_exit(&connp->conn_lock);
4587 goto ud_error;
4588 }
4589 } else if (connp->conn_xmit_ipp.ipp_fields &
4590 (IPPF_IPV4_OPTIONS|IPPF_RTHDR) ||
4591 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
4592 /* Rebuild the header template */
4593 error = icmp_build_hdr_template(connp, &v6src, &v6dst,
4594 flowinfo);
4595 if (error != 0) {
4596 mutex_exit(&connp->conn_lock);
4597 goto ud_error;
4598 }
4599 } else {
4600 /* Simply update the destination address if no source route */
4601 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4602 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc;
4603
4604 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
4605 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
4606 ipha->ipha_fragment_offset_and_flags |=
4607 IPH_DF_HTONS;
4608 } else {
4609 ipha->ipha_fragment_offset_and_flags &=
4610 ~IPH_DF_HTONS;
4611 }
4612 } else {
4613 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
4614 ip6h->ip6_dst = v6dst;
4615 }
4616 }
4617
4618 /*
4619 * Remember the dst etc which corresponds to the built header
4620 * template and conn_ixa.
4621 */
4622 oldixa = conn_replace_ixa(connp, ixa);
4623 connp->conn_v6lastdst = v6dst;
4624 connp->conn_lastflowinfo = flowinfo;
4625 connp->conn_lastscopeid = ixa->ixa_scopeid;
4626 connp->conn_lastsrcid = srcid;
4627 /* Also remember a source to use together with lastdst */
4628 connp->conn_v6lastsrc = v6src;
4629
4630 data_mp = icmp_prepend_header_template(connp, ixa, data_mp, &v6src,
4631 flowinfo, &error);
4632
4633 /* Done with conn_t */
4634 mutex_exit(&connp->conn_lock);
4635 ixa_refrele(oldixa);
4636
4637 if (data_mp == NULL) {
4638 ASSERT(error != 0);
4639 goto ud_error;
4640 }
4641
4642 if (!do_ipsec) {
4643 /* Policy might differ for different ICMP type/code */
4644 data_mp = icmp_output_attach_policy(data_mp, connp, ixa);
4645 if (data_mp == NULL) {
4646 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4647 error = EHOSTUNREACH; /* IPsec policy failure */
4648 goto done;
4649 }
4650 }
4651
4652 /* We're done. Pass the packet to ip. */
4653 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams);
4654
4655 error = conn_ip_output(data_mp, ixa);
4656 /* No rawipOutErrors if an error since IP increases its error counter */
4657 switch (error) {
4658 case 0:
4659 break;
4660 case EWOULDBLOCK:
4661 (void) ixa_check_drain_insert(connp, ixa);
4662 error = 0;
4663 break;
4664 case EADDRNOTAVAIL:
4665 /*
4666 * IXAF_VERIFY_SOURCE tells us to pick a better source.
4667 * Don't have the application see that errno
4668 */
4669 error = ENETUNREACH;
4670 /* FALLTHRU */
4671 default:
4672 mutex_enter(&connp->conn_lock);
4673 /*
4674 * Clear the source and v6lastdst so we call ip_attr_connect
4675 * for the next packet and try to pick a better source.
4676 */
4677 if (connp->conn_mcbc_bind)
4678 connp->conn_saddr_v6 = ipv6_all_zeros;
4679 else
4680 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
4681 connp->conn_v6lastdst = ipv6_all_zeros;
4682 mutex_exit(&connp->conn_lock);
4683 break;
4684 }
4685 done:
4686 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4687 ixa->ixa_cred = connp->conn_cred; /* Restore */
4688 ixa->ixa_cpid = connp->conn_cpid;
4689 ixa_refrele(ixa);
4690 return (error);
4691
4692 ud_error:
4693 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4694 ixa->ixa_cred = connp->conn_cred; /* Restore */
4695 ixa->ixa_cpid = connp->conn_cpid;
4696 ixa_refrele(ixa);
4697
4698 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
4699 freemsg(data_mp);
4700 return (error);
4701 }
4702
4703 /* ARGSUSED */
4704 static int
4705 icmp_wput_fallback(queue_t *q, mblk_t *mp)
4706 {
4707 #ifdef DEBUG
4708 cmn_err(CE_CONT, "icmp_wput_fallback: Message during fallback \n");
4709 #endif
4710 freemsg(mp);
4711 return (0);
4712 }
4713
4714 static void
4715 icmp_wput_other(queue_t *q, mblk_t *mp)
4716 {
4717 uchar_t *rptr = mp->b_rptr;
4718 struct iocblk *iocp;
4719 conn_t *connp = Q_TO_CONN(q);
4720 icmp_t *icmp = connp->conn_icmp;
4721 cred_t *cr;
4722
4723 switch (mp->b_datap->db_type) {
4724 case M_PROTO:
4725 case M_PCPROTO:
4726 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4727 /*
4728 * If the message does not contain a PRIM_type,
4729 * throw it away.
4730 */
4731 freemsg(mp);
4732 return;
4733 }
4734 switch (((t_primp_t)rptr)->type) {
4735 case T_ADDR_REQ:
4736 icmp_addr_req(q, mp);
4737 return;
4738 case O_T_BIND_REQ:
4739 case T_BIND_REQ:
4740 icmp_tpi_bind(q, mp);
4741 return;
4742 case T_CONN_REQ:
4743 icmp_tpi_connect(q, mp);
4744 return;
4745 case T_CAPABILITY_REQ:
4746 icmp_capability_req(q, mp);
4747 return;
4748 case T_INFO_REQ:
4749 icmp_info_req(q, mp);
4750 return;
4751 case T_UNITDATA_REQ:
4752 /*
4753 * If a T_UNITDATA_REQ gets here, the address must
4754 * be bad. Valid T_UNITDATA_REQs are handled
4755 * in icmp_wput.
4756 */
4757 icmp_ud_err(q, mp, EADDRNOTAVAIL);
4758 return;
4759 case T_UNBIND_REQ:
4760 icmp_tpi_unbind(q, mp);
4761 return;
4762 case T_SVR4_OPTMGMT_REQ:
4763 /*
4764 * All Solaris components should pass a db_credp
4765 * for this TPI message, hence we ASSERT.
4766 * But in case there is some other M_PROTO that looks
4767 * like a TPI message sent by some other kernel
4768 * component, we check and return an error.
4769 */
4770 cr = msg_getcred(mp, NULL);
4771 ASSERT(cr != NULL);
4772 if (cr == NULL) {
4773 icmp_err_ack(q, mp, TSYSERR, EINVAL);
4774 return;
4775 }
4776
4777 if (!snmpcom_req(q, mp, icmp_snmp_set, ip_snmp_get,
4778 cr)) {
4779 svr4_optcom_req(q, mp, cr, &icmp_opt_obj);
4780 }
4781 return;
4782
4783 case T_OPTMGMT_REQ:
4784 /*
4785 * All Solaris components should pass a db_credp
4786 * for this TPI message, hence we ASSERT.
4787 * But in case there is some other M_PROTO that looks
4788 * like a TPI message sent by some other kernel
4789 * component, we check and return an error.
4790 */
4791 cr = msg_getcred(mp, NULL);
4792 ASSERT(cr != NULL);
4793 if (cr == NULL) {
4794 icmp_err_ack(q, mp, TSYSERR, EINVAL);
4795 return;
4796 }
4797 tpi_optcom_req(q, mp, cr, &icmp_opt_obj);
4798 return;
4799
4800 case T_DISCON_REQ:
4801 icmp_tpi_disconnect(q, mp);
4802 return;
4803
4804 /* The following TPI message is not supported by icmp. */
4805 case O_T_CONN_RES:
4806 case T_CONN_RES:
4807 icmp_err_ack(q, mp, TNOTSUPPORT, 0);
4808 return;
4809
4810 /* The following 3 TPI requests are illegal for icmp. */
4811 case T_DATA_REQ:
4812 case T_EXDATA_REQ:
4813 case T_ORDREL_REQ:
4814 icmp_err_ack(q, mp, TNOTSUPPORT, 0);
4815 return;
4816 default:
4817 break;
4818 }
4819 break;
4820 case M_FLUSH:
4821 if (*rptr & FLUSHW)
4822 flushq(q, FLUSHDATA);
4823 break;
4824 case M_IOCTL:
4825 iocp = (struct iocblk *)mp->b_rptr;
4826 switch (iocp->ioc_cmd) {
4827 case TI_GETPEERNAME:
4828 if (icmp->icmp_state != TS_DATA_XFER) {
4829 /*
4830 * If a default destination address has not
4831 * been associated with the stream, then we
4832 * don't know the peer's name.
4833 */
4834 iocp->ioc_error = ENOTCONN;
4835 iocp->ioc_count = 0;
4836 mp->b_datap->db_type = M_IOCACK;
4837 qreply(q, mp);
4838 return;
4839 }
4840 /* FALLTHRU */
4841 case TI_GETMYNAME:
4842 /*
4843 * For TI_GETPEERNAME and TI_GETMYNAME, we first
4844 * need to copyin the user's strbuf structure.
4845 * Processing will continue in the M_IOCDATA case
4846 * below.
4847 */
4848 mi_copyin(q, mp, NULL,
4849 SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4850 return;
4851 default:
4852 break;
4853 }
4854 break;
4855 case M_IOCDATA:
4856 icmp_wput_iocdata(q, mp);
4857 return;
4858 default:
4859 /* Unrecognized messages are passed through without change. */
4860 break;
4861 }
4862 ip_wput_nondata(q, mp);
4863 }
4864
4865 /*
4866 * icmp_wput_iocdata is called by icmp_wput_other to handle all M_IOCDATA
4867 * messages.
4868 */
4869 static void
4870 icmp_wput_iocdata(queue_t *q, mblk_t *mp)
4871 {
4872 mblk_t *mp1;
4873 STRUCT_HANDLE(strbuf, sb);
4874 uint_t addrlen;
4875 conn_t *connp = Q_TO_CONN(q);
4876 icmp_t *icmp = connp->conn_icmp;
4877
4878 /* Make sure it is one of ours. */
4879 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4880 case TI_GETMYNAME:
4881 case TI_GETPEERNAME:
4882 break;
4883 default:
4884 ip_wput_nondata(q, mp);
4885 return;
4886 }
4887
4888 switch (mi_copy_state(q, mp, &mp1)) {
4889 case -1:
4890 return;
4891 case MI_COPY_CASE(MI_COPY_IN, 1):
4892 break;
4893 case MI_COPY_CASE(MI_COPY_OUT, 1):
4894 /*
4895 * The address has been copied out, so now
4896 * copyout the strbuf.
4897 */
4898 mi_copyout(q, mp);
4899 return;
4900 case MI_COPY_CASE(MI_COPY_OUT, 2):
4901 /*
4902 * The address and strbuf have been copied out.
4903 * We're done, so just acknowledge the original
4904 * M_IOCTL.
4905 */
4906 mi_copy_done(q, mp, 0);
4907 return;
4908 default:
4909 /*
4910 * Something strange has happened, so acknowledge
4911 * the original M_IOCTL with an EPROTO error.
4912 */
4913 mi_copy_done(q, mp, EPROTO);
4914 return;
4915 }
4916
4917 /*
4918 * Now we have the strbuf structure for TI_GETMYNAME
4919 * and TI_GETPEERNAME. Next we copyout the requested
4920 * address and then we'll copyout the strbuf.
4921 */
4922 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag,
4923 (void *)mp1->b_rptr);
4924
4925 if (connp->conn_family == AF_INET)
4926 addrlen = sizeof (sin_t);
4927 else
4928 addrlen = sizeof (sin6_t);
4929
4930 if (STRUCT_FGET(sb, maxlen) < addrlen) {
4931 mi_copy_done(q, mp, EINVAL);
4932 return;
4933 }
4934 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4935 case TI_GETMYNAME:
4936 break;
4937 case TI_GETPEERNAME:
4938 if (icmp->icmp_state != TS_DATA_XFER) {
4939 mi_copy_done(q, mp, ENOTCONN);
4940 return;
4941 }
4942 break;
4943 default:
4944 mi_copy_done(q, mp, EPROTO);
4945 return;
4946 }
4947 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4948 if (!mp1)
4949 return;
4950
4951 STRUCT_FSET(sb, len, addrlen);
4952 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4953 case TI_GETMYNAME:
4954 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4955 &addrlen);
4956 break;
4957 case TI_GETPEERNAME:
4958 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4959 &addrlen);
4960 break;
4961 }
4962 mp1->b_wptr += addrlen;
4963 /* Copy out the address */
4964 mi_copyout(q, mp);
4965 }
4966
4967 void
4968 icmp_ddi_g_init(void)
4969 {
4970 icmp_max_optsize = optcom_max_optsize(icmp_opt_obj.odb_opt_des_arr,
4971 icmp_opt_obj.odb_opt_arr_cnt);
4972
4973 /*
4974 * We want to be informed each time a stack is created or
4975 * destroyed in the kernel, so we can maintain the
4976 * set of icmp_stack_t's.
4977 */
4978 netstack_register(NS_ICMP, rawip_stack_init, NULL, rawip_stack_fini);
4979 }
4980
4981 void
4982 icmp_ddi_g_destroy(void)
4983 {
4984 netstack_unregister(NS_ICMP);
4985 }
4986
4987 #define INET_NAME "ip"
4988
4989 /*
4990 * Initialize the ICMP stack instance.
4991 */
4992 static void *
4993 rawip_stack_init(netstackid_t stackid, netstack_t *ns)
4994 {
4995 icmp_stack_t *is;
4996 int error = 0;
4997 size_t arrsz;
4998 major_t major;
4999
5000 is = (icmp_stack_t *)kmem_zalloc(sizeof (*is), KM_SLEEP);
5001 is->is_netstack = ns;
5002
5003 arrsz = sizeof (icmp_propinfo_tbl);
5004 is->is_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP);
5005 bcopy(icmp_propinfo_tbl, is->is_propinfo_tbl, arrsz);
5006
5007 is->is_ksp = rawip_kstat_init(stackid);
5008
5009 major = mod_name_to_major(INET_NAME);
5010 error = ldi_ident_from_major(major, &is->is_ldi_ident);
5011 ASSERT(error == 0);
5012 return (is);
5013 }
5014
5015 /*
5016 * Free the ICMP stack instance.
5017 */
5018 static void
5019 rawip_stack_fini(netstackid_t stackid, void *arg)
5020 {
5021 icmp_stack_t *is = (icmp_stack_t *)arg;
5022
5023 kmem_free(is->is_propinfo_tbl, sizeof (icmp_propinfo_tbl));
5024 is->is_propinfo_tbl = NULL;
5025
5026 rawip_kstat_fini(stackid, is->is_ksp);
5027 is->is_ksp = NULL;
5028 ldi_ident_release(is->is_ldi_ident);
5029 kmem_free(is, sizeof (*is));
5030 }
5031
5032 static void *
5033 rawip_kstat_init(netstackid_t stackid)
5034 {
5035 kstat_t *ksp;
5036
5037 rawip_named_kstat_t template = {
5038 { "inDatagrams", KSTAT_DATA_UINT32, 0 },
5039 { "inCksumErrs", KSTAT_DATA_UINT32, 0 },
5040 { "inErrors", KSTAT_DATA_UINT32, 0 },
5041 { "outDatagrams", KSTAT_DATA_UINT32, 0 },
5042 { "outErrors", KSTAT_DATA_UINT32, 0 },
5043 };
5044
5045 ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2",
5046 KSTAT_TYPE_NAMED, NUM_OF_FIELDS(rawip_named_kstat_t), 0, stackid);
5047 if (ksp == NULL || ksp->ks_data == NULL)
5048 return (NULL);
5049
5050 bcopy(&template, ksp->ks_data, sizeof (template));
5051 ksp->ks_update = rawip_kstat_update;
5052 ksp->ks_private = (void *)(uintptr_t)stackid;
5053
5054 kstat_install(ksp);
5055 return (ksp);
5056 }
5057
5058 static void
5059 rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp)
5060 {
5061 if (ksp != NULL) {
5062 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private);
5063 kstat_delete_netstack(ksp, stackid);
5064 }
5065 }
5066
5067 static int
5068 rawip_kstat_update(kstat_t *ksp, int rw)
5069 {
5070 rawip_named_kstat_t *rawipkp;
5071 netstackid_t stackid = (netstackid_t)(uintptr_t)ksp->ks_private;
5072 netstack_t *ns;
5073 icmp_stack_t *is;
5074
5075 if ((ksp == NULL) || (ksp->ks_data == NULL))
5076 return (EIO);
5077
5078 if (rw == KSTAT_WRITE)
5079 return (EACCES);
5080
5081 rawipkp = (rawip_named_kstat_t *)ksp->ks_data;
5082
5083 ns = netstack_find_by_stackid(stackid);
5084 if (ns == NULL)
5085 return (-1);
5086 is = ns->netstack_icmp;
5087 if (is == NULL) {
5088 netstack_rele(ns);
5089 return (-1);
5090 }
5091 rawipkp->inDatagrams.value.ui32 = is->is_rawip_mib.rawipInDatagrams;
5092 rawipkp->inCksumErrs.value.ui32 = is->is_rawip_mib.rawipInCksumErrs;
5093 rawipkp->inErrors.value.ui32 = is->is_rawip_mib.rawipInErrors;
5094 rawipkp->outDatagrams.value.ui32 = is->is_rawip_mib.rawipOutDatagrams;
5095 rawipkp->outErrors.value.ui32 = is->is_rawip_mib.rawipOutErrors;
5096 netstack_rele(ns);
5097 return (0);
5098 }
5099
5100 /* ARGSUSED */
5101 int
5102 rawip_accept(sock_lower_handle_t lproto_handle,
5103 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
5104 cred_t *cr)
5105 {
5106 return (EOPNOTSUPP);
5107 }
5108
5109 /* ARGSUSED */
5110 int
5111 rawip_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5112 socklen_t len, cred_t *cr)
5113 {
5114 conn_t *connp = (conn_t *)proto_handle;
5115 int error;
5116
5117 /* All Solaris components should pass a cred for this operation. */
5118 ASSERT(cr != NULL);
5119
5120 /* Binding to a NULL address really means unbind */
5121 if (sa == NULL)
5122 error = rawip_do_unbind(connp);
5123 else
5124 error = rawip_do_bind(connp, sa, len);
5125
5126 if (error < 0) {
5127 if (error == -TOUTSTATE)
5128 error = EINVAL;
5129 else
5130 error = proto_tlitosyserr(-error);
5131 }
5132 return (error);
5133 }
5134
5135 static int
5136 rawip_implicit_bind(conn_t *connp)
5137 {
5138 sin6_t sin6addr;
5139 sin_t *sin;
5140 sin6_t *sin6;
5141 socklen_t len;
5142 int error;
5143
5144 if (connp->conn_family == AF_INET) {
5145 len = sizeof (struct sockaddr_in);
5146 sin = (sin_t *)&sin6addr;
5147 *sin = sin_null;
5148 sin->sin_family = AF_INET;
5149 sin->sin_addr.s_addr = INADDR_ANY;
5150 } else {
5151 ASSERT(connp->conn_family == AF_INET6);
5152 len = sizeof (sin6_t);
5153 sin6 = (sin6_t *)&sin6addr;
5154 *sin6 = sin6_null;
5155 sin6->sin6_family = AF_INET6;
5156 V6_SET_ZERO(sin6->sin6_addr);
5157 }
5158
5159 error = rawip_do_bind(connp, (struct sockaddr *)&sin6addr, len);
5160
5161 return ((error < 0) ? proto_tlitosyserr(-error) : error);
5162 }
5163
5164 static int
5165 rawip_unbind(conn_t *connp)
5166 {
5167 int error;
5168
5169 error = rawip_do_unbind(connp);
5170 if (error < 0) {
5171 error = proto_tlitosyserr(-error);
5172 }
5173 return (error);
5174 }
5175
5176 /* ARGSUSED */
5177 int
5178 rawip_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
5179 {
5180 return (EOPNOTSUPP);
5181 }
5182
5183 int
5184 rawip_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5185 socklen_t len, sock_connid_t *id, cred_t *cr)
5186 {
5187 conn_t *connp = (conn_t *)proto_handle;
5188 icmp_t *icmp = connp->conn_icmp;
5189 int error;
5190 boolean_t did_bind = B_FALSE;
5191 pid_t pid = curproc->p_pid;
5192
5193 /* All Solaris components should pass a cred for this operation. */
5194 ASSERT(cr != NULL);
5195
5196 if (sa == NULL) {
5197 /*
5198 * Disconnect
5199 * Make sure we are connected
5200 */
5201 if (icmp->icmp_state != TS_DATA_XFER)
5202 return (EINVAL);
5203
5204 error = icmp_disconnect(connp);
5205 return (error);
5206 }
5207
5208 error = proto_verify_ip_addr(connp->conn_family, sa, len);
5209 if (error != 0)
5210 return (error);
5211
5212 /* do an implicit bind if necessary */
5213 if (icmp->icmp_state == TS_UNBND) {
5214 error = rawip_implicit_bind(connp);
5215 /*
5216 * We could be racing with an actual bind, in which case
5217 * we would see EPROTO. We cross our fingers and try
5218 * to connect.
5219 */
5220 if (!(error == 0 || error == EPROTO))
5221 return (error);
5222 did_bind = B_TRUE;
5223 }
5224
5225 /*
5226 * set SO_DGRAM_ERRIND
5227 */
5228 connp->conn_dgram_errind = B_TRUE;
5229
5230 error = rawip_do_connect(connp, sa, len, cr, pid);
5231 if (error != 0 && did_bind) {
5232 int unbind_err;
5233
5234 unbind_err = rawip_unbind(connp);
5235 ASSERT(unbind_err == 0);
5236 }
5237
5238 if (error == 0) {
5239 *id = 0;
5240 (*connp->conn_upcalls->su_connected)(connp->conn_upper_handle,
5241 0, NULL, -1);
5242 } else if (error < 0) {
5243 error = proto_tlitosyserr(-error);
5244 }
5245 return (error);
5246 }
5247
5248 /* ARGSUSED2 */
5249 int
5250 rawip_fallback(sock_lower_handle_t proto_handle, queue_t *q,
5251 boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb,
5252 sock_quiesce_arg_t *arg)
5253 {
5254 conn_t *connp = (conn_t *)proto_handle;
5255 icmp_t *icmp;
5256 struct T_capability_ack tca;
5257 struct sockaddr_in6 laddr, faddr;
5258 socklen_t laddrlen, faddrlen;
5259 short opts;
5260 struct stroptions *stropt;
5261 mblk_t *mp, *stropt_mp;
5262 int error;
5263
5264 icmp = connp->conn_icmp;
5265
5266 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
5267
5268 /*
5269 * setup the fallback stream that was allocated
5270 */
5271 connp->conn_dev = (dev_t)RD(q)->q_ptr;
5272 connp->conn_minor_arena = WR(q)->q_ptr;
5273
5274 RD(q)->q_ptr = WR(q)->q_ptr = connp;
5275
5276 WR(q)->q_qinfo = &icmpwinit;
5277
5278 connp->conn_rq = RD(q);
5279 connp->conn_wq = WR(q);
5280
5281 /* Notify stream head about options before sending up data */
5282 stropt_mp->b_datap->db_type = M_SETOPTS;
5283 stropt_mp->b_wptr += sizeof (*stropt);
5284 stropt = (struct stroptions *)stropt_mp->b_rptr;
5285 stropt->so_flags = SO_WROFF | SO_HIWAT;
5286 stropt->so_wroff = connp->conn_wroff;
5287 stropt->so_hiwat = connp->conn_rcvbuf;
5288 putnext(RD(q), stropt_mp);
5289
5290 /*
5291 * free helper stream
5292 */
5293 ip_free_helper_stream(connp);
5294
5295 /*
5296 * Collect the information needed to sync with the sonode
5297 */
5298 icmp_do_capability_ack(icmp, &tca, TC1_INFO);
5299
5300 laddrlen = faddrlen = sizeof (sin6_t);
5301 (void) rawip_getsockname((sock_lower_handle_t)connp,
5302 (struct sockaddr *)&laddr, &laddrlen, CRED());
5303 error = rawip_getpeername((sock_lower_handle_t)connp,
5304 (struct sockaddr *)&faddr, &faddrlen, CRED());
5305 if (error != 0)
5306 faddrlen = 0;
5307 opts = 0;
5308 if (connp->conn_dgram_errind)
5309 opts |= SO_DGRAM_ERRIND;
5310 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
5311 opts |= SO_DONTROUTE;
5312
5313 mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
5314 (struct sockaddr *)&laddr, laddrlen,
5315 (struct sockaddr *)&faddr, faddrlen, opts);
5316
5317 /*
5318 * Attempts to send data up during fallback will result in it being
5319 * queued in icmp_t. Now we push up any queued packets.
5320 */
5321 mutex_enter(&icmp->icmp_recv_lock);
5322 if (mp != NULL) {
5323 mp->b_next = icmp->icmp_fallback_queue_head;
5324 icmp->icmp_fallback_queue_head = mp;
5325 }
5326 while (icmp->icmp_fallback_queue_head != NULL) {
5327 mp = icmp->icmp_fallback_queue_head;
5328 icmp->icmp_fallback_queue_head = mp->b_next;
5329 mp->b_next = NULL;
5330 mutex_exit(&icmp->icmp_recv_lock);
5331 putnext(RD(q), mp);
5332 mutex_enter(&icmp->icmp_recv_lock);
5333 }
5334 icmp->icmp_fallback_queue_tail = icmp->icmp_fallback_queue_head;
5335
5336 /*
5337 * No longer a streams less socket
5338 */
5339 mutex_enter(&connp->conn_lock);
5340 connp->conn_flags &= ~IPCL_NONSTR;
5341 mutex_exit(&connp->conn_lock);
5342
5343 mutex_exit(&icmp->icmp_recv_lock);
5344
5345 ASSERT(icmp->icmp_fallback_queue_head == NULL &&
5346 icmp->icmp_fallback_queue_tail == NULL);
5347
5348 ASSERT(connp->conn_ref >= 1);
5349
5350 return (0);
5351 }
5352
5353 /* ARGSUSED2 */
5354 sock_lower_handle_t
5355 rawip_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
5356 uint_t *smodep, int *errorp, int flags, cred_t *credp)
5357 {
5358 conn_t *connp;
5359
5360 if (type != SOCK_RAW || (family != AF_INET && family != AF_INET6)) {
5361 *errorp = EPROTONOSUPPORT;
5362 return (NULL);
5363 }
5364
5365 connp = rawip_do_open(family, credp, errorp, flags);
5366 if (connp != NULL) {
5367 connp->conn_flags |= IPCL_NONSTR;
5368
5369 mutex_enter(&connp->conn_lock);
5370 connp->conn_state_flags &= ~CONN_INCIPIENT;
5371 mutex_exit(&connp->conn_lock);
5372 *sock_downcalls = &sock_rawip_downcalls;
5373 *smodep = SM_ATOMIC;
5374 } else {
5375 ASSERT(*errorp != 0);
5376 }
5377
5378 return ((sock_lower_handle_t)connp);
5379 }
5380
5381 /* ARGSUSED3 */
5382 void
5383 rawip_activate(sock_lower_handle_t proto_handle,
5384 sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls, int flags,
5385 cred_t *cr)
5386 {
5387 conn_t *connp = (conn_t *)proto_handle;
5388 struct sock_proto_props sopp;
5389
5390 /* All Solaris components should pass a cred for this operation. */
5391 ASSERT(cr != NULL);
5392
5393 connp->conn_upcalls = sock_upcalls;
5394 connp->conn_upper_handle = sock_handle;
5395
5396 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
5397 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
5398 sopp.sopp_wroff = connp->conn_wroff;
5399 sopp.sopp_rxhiwat = connp->conn_rcvbuf;
5400 sopp.sopp_rxlowat = connp->conn_rcvlowat;
5401 sopp.sopp_maxblk = INFPSZ;
5402 sopp.sopp_maxpsz = IP_MAXPACKET;
5403 sopp.sopp_minpsz = (icmp_mod_info.mi_minpsz == 1) ? 0 :
5404 icmp_mod_info.mi_minpsz;
5405
5406 (*connp->conn_upcalls->su_set_proto_props)
5407 (connp->conn_upper_handle, &sopp);
5408
5409 icmp_bind_proto(connp->conn_icmp);
5410 }
5411
5412 /* ARGSUSED3 */
5413 int
5414 rawip_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5415 socklen_t *salenp, cred_t *cr)
5416 {
5417 conn_t *connp = (conn_t *)proto_handle;
5418 icmp_t *icmp = connp->conn_icmp;
5419 int error;
5420
5421 /* All Solaris components should pass a cred for this operation. */
5422 ASSERT(cr != NULL);
5423
5424 mutex_enter(&connp->conn_lock);
5425 if (icmp->icmp_state != TS_DATA_XFER)
5426 error = ENOTCONN;
5427 else
5428 error = conn_getpeername(connp, sa, salenp);
5429 mutex_exit(&connp->conn_lock);
5430 return (error);
5431 }
5432
5433 /* ARGSUSED3 */
5434 int
5435 rawip_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5436 socklen_t *salenp, cred_t *cr)
5437 {
5438 conn_t *connp = (conn_t *)proto_handle;
5439 int error;
5440
5441 /* All Solaris components should pass a cred for this operation. */
5442 ASSERT(cr != NULL);
5443
5444 mutex_enter(&connp->conn_lock);
5445 error = conn_getsockname(connp, sa, salenp);
5446 mutex_exit(&connp->conn_lock);
5447 return (error);
5448 }
5449
5450 int
5451 rawip_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
5452 const void *optvalp, socklen_t optlen, cred_t *cr)
5453 {
5454 conn_t *connp = (conn_t *)proto_handle;
5455 int error;
5456
5457 /* All Solaris components should pass a cred for this operation. */
5458 ASSERT(cr != NULL);
5459
5460 error = proto_opt_check(level, option_name, optlen, NULL,
5461 icmp_opt_obj.odb_opt_des_arr,
5462 icmp_opt_obj.odb_opt_arr_cnt,
5463 B_TRUE, B_FALSE, cr);
5464
5465 if (error != 0) {
5466 /*
5467 * option not recognized
5468 */
5469 if (error < 0) {
5470 error = proto_tlitosyserr(-error);
5471 }
5472 return (error);
5473 }
5474
5475 error = icmp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level,
5476 option_name, optlen, (uchar_t *)optvalp, (uint_t *)&optlen,
5477 (uchar_t *)optvalp, NULL, cr);
5478
5479 ASSERT(error >= 0);
5480
5481 return (error);
5482 }
5483
5484 int
5485 rawip_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
5486 void *optvalp, socklen_t *optlen, cred_t *cr)
5487 {
5488 int error;
5489 conn_t *connp = (conn_t *)proto_handle;
5490 t_uscalar_t max_optbuf_len;
5491 void *optvalp_buf;
5492 int len;
5493
5494 /* All Solaris components should pass a cred for this operation. */
5495 ASSERT(cr != NULL);
5496
5497 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
5498 icmp_opt_obj.odb_opt_des_arr,
5499 icmp_opt_obj.odb_opt_arr_cnt,
5500 B_FALSE, B_TRUE, cr);
5501
5502 if (error != 0) {
5503 if (error < 0) {
5504 error = proto_tlitosyserr(-error);
5505 }
5506 return (error);
5507 }
5508
5509 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
5510 len = icmp_opt_get(connp, level, option_name, optvalp_buf);
5511 if (len == -1) {
5512 kmem_free(optvalp_buf, max_optbuf_len);
5513 return (EINVAL);
5514 }
5515
5516 /*
5517 * update optlen and copy option value
5518 */
5519 t_uscalar_t size = MIN(len, *optlen);
5520
5521 bcopy(optvalp_buf, optvalp, size);
5522 bcopy(&size, optlen, sizeof (size));
5523
5524 kmem_free(optvalp_buf, max_optbuf_len);
5525 return (0);
5526 }
5527
5528 /* ARGSUSED1 */
5529 int
5530 rawip_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
5531 {
5532 conn_t *connp = (conn_t *)proto_handle;
5533
5534 /* All Solaris components should pass a cred for this operation. */
5535 ASSERT(cr != NULL);
5536
5537 (void) rawip_do_close(connp);
5538 return (0);
5539 }
5540
5541 /* ARGSUSED2 */
5542 int
5543 rawip_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
5544 {
5545 conn_t *connp = (conn_t *)proto_handle;
5546
5547 /* All Solaris components should pass a cred for this operation. */
5548 ASSERT(cr != NULL);
5549
5550 /* shut down the send side */
5551 if (how != SHUT_RD)
5552 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
5553 SOCK_OPCTL_SHUT_SEND, 0);
5554 /* shut down the recv side */
5555 if (how != SHUT_WR)
5556 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
5557 SOCK_OPCTL_SHUT_RECV, 0);
5558 return (0);
5559 }
5560
5561 void
5562 rawip_clr_flowctrl(sock_lower_handle_t proto_handle)
5563 {
5564 conn_t *connp = (conn_t *)proto_handle;
5565 icmp_t *icmp = connp->conn_icmp;
5566
5567 mutex_enter(&icmp->icmp_recv_lock);
5568 connp->conn_flow_cntrld = B_FALSE;
5569 mutex_exit(&icmp->icmp_recv_lock);
5570 }
5571
5572 int
5573 rawip_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
5574 int mode, int32_t *rvalp, cred_t *cr)
5575 {
5576 conn_t *connp = (conn_t *)proto_handle;
5577 int error;
5578
5579 /* All Solaris components should pass a cred for this operation. */
5580 ASSERT(cr != NULL);
5581
5582 /*
5583 * If we don't have a helper stream then create one.
5584 * ip_create_helper_stream takes care of locking the conn_t,
5585 * so this check for NULL is just a performance optimization.
5586 */
5587 if (connp->conn_helper_info == NULL) {
5588 icmp_stack_t *is = connp->conn_icmp->icmp_is;
5589
5590 ASSERT(is->is_ldi_ident != NULL);
5591
5592 /*
5593 * Create a helper stream for non-STREAMS socket.
5594 */
5595 error = ip_create_helper_stream(connp, is->is_ldi_ident);
5596 if (error != 0) {
5597 ip0dbg(("rawip_ioctl: create of IP helper stream "
5598 "failed %d\n", error));
5599 return (error);
5600 }
5601 }
5602
5603 switch (cmd) {
5604 case _SIOCSOCKFALLBACK:
5605 case TI_GETPEERNAME:
5606 case TI_GETMYNAME:
5607 #ifdef DEBUG
5608 cmn_err(CE_CONT, "icmp_ioctl cmd 0x%x on non streams"
5609 " socket", cmd);
5610 #endif
5611 error = EINVAL;
5612 break;
5613 default:
5614 /*
5615 * Pass on to IP using helper stream
5616 */
5617 error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
5618 cmd, arg, mode, cr, rvalp);
5619 break;
5620 }
5621 return (error);
5622 }
5623
5624 int
5625 rawip_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
5626 cred_t *cr)
5627 {
5628 sin6_t *sin6;
5629 sin_t *sin = NULL;
5630 uint_t srcid;
5631 conn_t *connp = (conn_t *)proto_handle;
5632 icmp_t *icmp = connp->conn_icmp;
5633 int error = 0;
5634 icmp_stack_t *is = icmp->icmp_is;
5635 pid_t pid = curproc->p_pid;
5636 ip_xmit_attr_t *ixa;
5637
5638 ASSERT(DB_TYPE(mp) == M_DATA);
5639
5640 /* All Solaris components should pass a cred for this operation. */
5641 ASSERT(cr != NULL);
5642
5643 /* do an implicit bind if necessary */
5644 if (icmp->icmp_state == TS_UNBND) {
5645 error = rawip_implicit_bind(connp);
5646 /*
5647 * We could be racing with an actual bind, in which case
5648 * we would see EPROTO. We cross our fingers and try
5649 * to connect.
5650 */
5651 if (!(error == 0 || error == EPROTO)) {
5652 freemsg(mp);
5653 return (error);
5654 }
5655 }
5656
5657 /* Protocol 255 contains full IP headers */
5658 /* Read without holding lock */
5659 if (icmp->icmp_hdrincl) {
5660 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5661 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) {
5662 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) {
5663 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5664 freemsg(mp);
5665 return (EINVAL);
5666 }
5667 }
5668 error = icmp_output_hdrincl(connp, mp, cr, pid);
5669 if (is->is_sendto_ignerr)
5670 return (0);
5671 else
5672 return (error);
5673 }
5674
5675 /* Connected? */
5676 if (msg->msg_name == NULL) {
5677 if (icmp->icmp_state != TS_DATA_XFER) {
5678 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5679 return (EDESTADDRREQ);
5680 }
5681 if (msg->msg_controllen != 0) {
5682 error = icmp_output_ancillary(connp, NULL, NULL, mp,
5683 NULL, msg, cr, pid);
5684 } else {
5685 error = icmp_output_connected(connp, mp, cr, pid);
5686 }
5687 if (is->is_sendto_ignerr)
5688 return (0);
5689 else
5690 return (error);
5691 }
5692 if (icmp->icmp_state == TS_DATA_XFER) {
5693 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5694 return (EISCONN);
5695 }
5696 error = proto_verify_ip_addr(connp->conn_family,
5697 (struct sockaddr *)msg->msg_name, msg->msg_namelen);
5698 if (error != 0) {
5699 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5700 return (error);
5701 }
5702 switch (connp->conn_family) {
5703 case AF_INET6:
5704 sin6 = (sin6_t *)msg->msg_name;
5705
5706 /* No support for mapped addresses on raw sockets */
5707 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
5708 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5709 return (EADDRNOTAVAIL);
5710 }
5711 srcid = sin6->__sin6_src_id;
5712
5713 /*
5714 * If the local address is a mapped address return
5715 * an error.
5716 * It would be possible to send an IPv6 packet but the
5717 * response would never make it back to the application
5718 * since it is bound to a mapped address.
5719 */
5720 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
5721 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5722 return (EADDRNOTAVAIL);
5723 }
5724
5725 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
5726 sin6->sin6_addr = ipv6_loopback;
5727
5728 /*
5729 * We have to allocate an ip_xmit_attr_t before we grab
5730 * conn_lock and we need to hold conn_lock once we've check
5731 * conn_same_as_last_v6 to handle concurrent send* calls on a
5732 * socket.
5733 */
5734 if (msg->msg_controllen == 0) {
5735 ixa = conn_get_ixa(connp, B_FALSE);
5736 if (ixa == NULL) {
5737 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5738 return (ENOMEM);
5739 }
5740 } else {
5741 ixa = NULL;
5742 }
5743 mutex_enter(&connp->conn_lock);
5744 if (icmp->icmp_delayed_error != 0) {
5745 sin6_t *sin2 = (sin6_t *)&icmp->icmp_delayed_addr;
5746
5747 error = icmp->icmp_delayed_error;
5748 icmp->icmp_delayed_error = 0;
5749
5750 /* Compare IP address and family */
5751
5752 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
5753 &sin2->sin6_addr) &&
5754 sin6->sin6_family == sin2->sin6_family) {
5755 mutex_exit(&connp->conn_lock);
5756 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5757 if (ixa != NULL)
5758 ixa_refrele(ixa);
5759 return (error);
5760 }
5761 }
5762 if (msg->msg_controllen != 0) {
5763 mutex_exit(&connp->conn_lock);
5764 ASSERT(ixa == NULL);
5765 error = icmp_output_ancillary(connp, NULL, sin6, mp,
5766 NULL, msg, cr, pid);
5767 } else if (conn_same_as_last_v6(connp, sin6) &&
5768 connp->conn_lastsrcid == srcid &&
5769 ipsec_outbound_policy_current(ixa)) {
5770 /* icmp_output_lastdst drops conn_lock */
5771 error = icmp_output_lastdst(connp, mp, cr, pid, ixa);
5772 } else {
5773 /* icmp_output_newdst drops conn_lock */
5774 error = icmp_output_newdst(connp, mp, NULL, sin6, cr,
5775 pid, ixa);
5776 }
5777 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
5778 if (is->is_sendto_ignerr)
5779 return (0);
5780 else
5781 return (error);
5782 case AF_INET:
5783 sin = (sin_t *)msg->msg_name;
5784
5785 if (sin->sin_addr.s_addr == INADDR_ANY)
5786 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
5787
5788 /*
5789 * We have to allocate an ip_xmit_attr_t before we grab
5790 * conn_lock and we need to hold conn_lock once we've check
5791 * conn_same_as_last_v6 to handle concurrent send* on a socket.
5792 */
5793 if (msg->msg_controllen == 0) {
5794 ixa = conn_get_ixa(connp, B_FALSE);
5795 if (ixa == NULL) {
5796 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5797 return (ENOMEM);
5798 }
5799 } else {
5800 ixa = NULL;
5801 }
5802 mutex_enter(&connp->conn_lock);
5803 if (icmp->icmp_delayed_error != 0) {
5804 sin_t *sin2 = (sin_t *)&icmp->icmp_delayed_addr;
5805
5806 error = icmp->icmp_delayed_error;
5807 icmp->icmp_delayed_error = 0;
5808
5809 /* Compare IP address */
5810
5811 if (sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
5812 mutex_exit(&connp->conn_lock);
5813 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors);
5814 if (ixa != NULL)
5815 ixa_refrele(ixa);
5816 return (error);
5817 }
5818 }
5819
5820 if (msg->msg_controllen != 0) {
5821 mutex_exit(&connp->conn_lock);
5822 ASSERT(ixa == NULL);
5823 error = icmp_output_ancillary(connp, sin, NULL, mp,
5824 NULL, msg, cr, pid);
5825 } else if (conn_same_as_last_v4(connp, sin) &&
5826 ipsec_outbound_policy_current(ixa)) {
5827 /* icmp_output_lastdst drops conn_lock */
5828 error = icmp_output_lastdst(connp, mp, cr, pid, ixa);
5829 } else {
5830 /* icmp_output_newdst drops conn_lock */
5831 error = icmp_output_newdst(connp, mp, sin, NULL, cr,
5832 pid, ixa);
5833 }
5834 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
5835 if (is->is_sendto_ignerr)
5836 return (0);
5837 else
5838 return (error);
5839 default:
5840 return (EINVAL);
5841 }
5842 }
5843
5844 sock_downcalls_t sock_rawip_downcalls = {
5845 rawip_activate,
5846 rawip_accept,
5847 rawip_bind,
5848 rawip_listen,
5849 rawip_connect,
5850 rawip_getpeername,
5851 rawip_getsockname,
5852 rawip_getsockopt,
5853 rawip_setsockopt,
5854 rawip_send,
5855 NULL,
5856 NULL,
5857 NULL,
5858 rawip_shutdown,
5859 rawip_clr_flowctrl,
5860 rawip_ioctl,
5861 rawip_close
5862 };