1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 2015, Joyent, Inc. All rights reserved.
25 */
26 /*
27 * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
28 */
29
30 #include <sys/cmn_err.h>
31 #include <sys/strsun.h>
32 #include <sys/sdt.h>
33 #include <sys/mac.h>
34 #include <sys/mac_impl.h>
35 #include <sys/mac_client_impl.h>
36 #include <sys/mac_client_priv.h>
37 #include <sys/ethernet.h>
38 #include <sys/vlan.h>
39 #include <sys/dlpi.h>
40 #include <sys/avl.h>
41 #include <inet/ip.h>
42 #include <inet/ip6.h>
43 #include <inet/arp.h>
44 #include <netinet/arp.h>
45 #include <netinet/udp.h>
46 #include <netinet/dhcp.h>
47 #include <netinet/dhcp6.h>
48
49 /*
50 * Implementation overview for DHCP address detection
51 *
52 * The purpose of DHCP address detection is to relieve the user of having to
53 * manually configure static IP addresses when ip-nospoof protection is turned
54 * on. To achieve this, the mac layer needs to intercept DHCP packets to
55 * determine the assigned IP addresses.
56 *
57 * A DHCP handshake between client and server typically requires at least
58 * 4 messages:
59 *
60 * 1. DISCOVER - client attempts to locate DHCP servers via a
61 * broadcast message to its subnet.
62 * 2. OFFER - server responds to client with an IP address and
63 * other parameters.
64 * 3. REQUEST - client requests the offered address.
65 * 4. ACK - server verifies that the requested address matches
66 * the one it offered.
67 *
68 * DHCPv6 behaves pretty much the same way aside from different message names.
69 *
70 * Address information is embedded in either the OFFER or REQUEST message.
71 * We chose to intercept REQUEST because this is at the last part of the
72 * handshake and it indicates that the client intends to keep the address.
73 * Intercepting OFFERs is unreliable because the client may receive multiple
74 * offers from different servers, and we can't tell which address the client
75 * will keep.
76 *
77 * Each DHCP message has a transaction ID. We use this transaction ID to match
78 * REQUESTs with ACKs received from servers.
79 *
80 * For IPv4, the process to acquire a DHCP-assigned address is as follows:
81 *
82 * 1. Client sends REQUEST. a new dhcpv4_txn_t object is created and inserted
83 * in the the mci_v4_pending_txn table (keyed by xid). This object represents
84 * a new transaction. It contains the xid, the client ID and requested IP
85 * address.
86 *
87 * 2. Server responds with an ACK. The xid from this ACK is used to lookup the
88 * pending transaction from the mci_v4_pending_txn table. Once the object is
89 * found, it is removed from the pending table and inserted into the
90 * completed table (mci_v4_completed_txn, keyed by client ID) and the dynamic
91 * IP table (mci_v4_dyn_ip, keyed by IP address).
92 *
93 * 3. An outgoing packet that goes through the ip-nospoof path will be checked
94 * against the dynamic IP table. Packets that have the assigned DHCP address
95 * as the source IP address will pass the check and be admitted onto the
96 * network.
97 *
98 * IPv4 notes:
99 *
100 * If the server never responds with an ACK, there is a timer that is set after
101 * the insertion of the transaction into the pending table. When the timer
102 * fires, it will check whether the transaction is old (by comparing current
103 * time and the txn's timestamp), if so the transaction will be freed. along
104 * with this, any transaction in the completed/dyn-ip tables matching the client
105 * ID of this stale transaction will also be freed. If the client fails to
106 * extend a lease, we want to stop the client from using any IP addresses that
107 * were granted previously.
108 *
109 * A RELEASE message from the client will not cause a transaction to be created.
110 * The client ID in the RELEASE message will be used for finding and removing
111 * transactions in the completed and dyn-ip tables.
112 *
113 *
114 * For IPv6, the process to acquire a DHCPv6-assigned address is as follows:
115 *
116 * 1. Client sends REQUEST. The DUID is extracted and stored into a dhcpv6_cid_t
117 * structure. A new transaction structure (dhcpv6_txn_t) is also created and
118 * it will point to the dhcpv6_cid_t. If an existing transaction with a
119 * matching xid is not found, this dhcpv6_txn_t will be inserted into the
120 * mci_v6_pending_txn table (keyed by xid).
121 *
122 * 2. Server responds with a REPLY. If a pending transaction is found, the
123 * addresses in the reply will be placed into the dhcpv6_cid_t pointed to by
124 * the transaction. The dhcpv6_cid_t will then be moved to the mci_v6_cid
125 * table (keyed by cid). The associated addresses will be added to the
126 * mci_v6_dyn_ip table (while still being pointed to by the dhcpv6_cid_t).
127 *
128 * 3. IPv6 ip-nospoof will now check mci_v6_dyn_ip for matching packets.
129 * Packets with a source address matching one of the DHCPv6-assigned
130 * addresses will be allowed through.
131 *
132 * IPv6 notes:
133 *
134 * The v6 code shares the same timer as v4 for scrubbing stale transactions.
135 * Just like v4, as part of removing an expired transaction, a RELEASE will be
136 * be triggered on the cid associated with the expired transaction.
137 *
138 * The data structures used for v6 are slightly different because a v6 client
139 * may have multiple addresses associated with it.
140 */
141
142 /*
143 * These are just arbitrary limits meant for preventing abuse (e.g. a user
144 * flooding the network with bogus transactions). They are not meant to be
145 * user-modifiable so they are not exposed as linkprops.
146 */
147 static ulong_t dhcp_max_pending_txn = 512;
148 static ulong_t dhcp_max_completed_txn = 512;
149 static ulong_t slaac_max_allowed = 512;
150 static hrtime_t txn_cleanup_interval = 60 * NANOSEC;
151
152 /*
153 * DHCPv4 transaction. It may be added to three different tables
154 * (keyed by different fields).
155 */
156 typedef struct dhcpv4_txn {
157 uint32_t dt_xid;
158 hrtime_t dt_timestamp;
159 uint8_t dt_cid[DHCP_MAX_OPT_SIZE];
160 uint8_t dt_cid_len;
161 ipaddr_t dt_ipaddr;
162 avl_node_t dt_node;
163 avl_node_t dt_ipnode;
164 struct dhcpv4_txn *dt_next;
165 } dhcpv4_txn_t;
166
167 /*
168 * DHCPv6 address. May be added to mci_v6_dyn_ip.
169 * It is always pointed to by its parent dhcpv6_cid_t structure.
170 */
171 typedef struct dhcpv6_addr {
172 in6_addr_t da_addr;
173 avl_node_t da_node;
174 struct dhcpv6_addr *da_next;
175 } dhcpv6_addr_t;
176
177 /*
178 * DHCPv6 client ID. May be added to mci_v6_cid.
179 * No dhcpv6_txn_t should be pointing to it after it is added to mci_v6_cid.
180 */
181 typedef struct dhcpv6_cid {
182 uchar_t *dc_cid;
183 uint_t dc_cid_len;
184 dhcpv6_addr_t *dc_addr;
185 uint_t dc_addrcnt;
186 avl_node_t dc_node;
187 } dhcpv6_cid_t;
188
189 /*
190 * DHCPv6 transaction. Unlike its v4 counterpart, this object gets freed up
191 * as soon as the transaction completes or expires.
192 */
193 typedef struct dhcpv6_txn {
194 uint32_t dt_xid;
195 hrtime_t dt_timestamp;
196 dhcpv6_cid_t *dt_cid;
197 avl_node_t dt_node;
198 struct dhcpv6_txn *dt_next;
199 } dhcpv6_txn_t;
200
201 /*
202 * Stateless address autoconfiguration (SLAAC) address. May be added to
203 * mci_v6_slaac_ip.
204 */
205 typedef struct slaac_addr {
206 in6_addr_t sla_prefix;
207 in6_addr_t sla_addr;
208 avl_node_t sla_node;
209 } slaac_addr_t;
210
211 static void start_txn_cleanup_timer(mac_client_impl_t *);
212 static boolean_t allowed_ips_set(mac_resource_props_t *, uint32_t);
213
214 #define BUMP_STAT(m, s) (m)->mci_misc_stat.mms_##s++
215
216 /*
217 * Comparison functions for the 3 AVL trees used:
218 * mci_v4_pending_txn, mci_v4_completed_txn, mci_v4_dyn_ip
219 */
220 static int
221 compare_dhcpv4_xid(const void *arg1, const void *arg2)
222 {
223 const dhcpv4_txn_t *txn1 = arg1, *txn2 = arg2;
224
225 if (txn1->dt_xid < txn2->dt_xid)
226 return (-1);
227 else if (txn1->dt_xid > txn2->dt_xid)
228 return (1);
229 else
230 return (0);
231 }
232
233 static int
234 compare_dhcpv4_cid(const void *arg1, const void *arg2)
235 {
236 const dhcpv4_txn_t *txn1 = arg1, *txn2 = arg2;
237 int ret;
238
239 if (txn1->dt_cid_len < txn2->dt_cid_len)
240 return (-1);
241 else if (txn1->dt_cid_len > txn2->dt_cid_len)
242 return (1);
243
244 if (txn1->dt_cid_len == 0)
245 return (0);
246
247 ret = memcmp(txn1->dt_cid, txn2->dt_cid, txn1->dt_cid_len);
248 if (ret < 0)
249 return (-1);
250 else if (ret > 0)
251 return (1);
252 else
253 return (0);
254 }
255
256 static int
257 compare_dhcpv4_ip(const void *arg1, const void *arg2)
258 {
259 const dhcpv4_txn_t *txn1 = arg1, *txn2 = arg2;
260
261 if (txn1->dt_ipaddr < txn2->dt_ipaddr)
262 return (-1);
263 else if (txn1->dt_ipaddr > txn2->dt_ipaddr)
264 return (1);
265 else
266 return (0);
267 }
268
269 /*
270 * Find the specified DHCPv4 option.
271 */
272 static int
273 get_dhcpv4_option(struct dhcp *dh4, uchar_t *end, uint8_t type,
274 uchar_t **opt, uint8_t *opt_len)
275 {
276 uchar_t *start = (uchar_t *)dh4->options;
277 uint8_t otype, olen;
278
279 while (start < end) {
280 if (*start == CD_PAD) {
281 start++;
282 continue;
283 }
284 if (*start == CD_END)
285 break;
286
287 otype = *start++;
288 olen = *start++;
289 if (otype == type && olen > 0) {
290 *opt = start;
291 *opt_len = olen;
292 return (0);
293 }
294 start += olen;
295 }
296 return (ENOENT);
297 }
298
299 /*
300 * Locate the start of a DHCPv4 header.
301 * The possible return values and associated meanings are:
302 * 0 - packet is DHCP and has a DHCP header.
303 * EINVAL - packet is not DHCP. the recommended action is to let it pass.
304 * ENOSPC - packet is a initial fragment that is DHCP or is unidentifiable.
305 * the recommended action is to drop it.
306 */
307 static int
308 get_dhcpv4_info(ipha_t *ipha, uchar_t *end, struct dhcp **dh4)
309 {
310 uint16_t offset_and_flags, client, server;
311 boolean_t first_frag = B_FALSE;
312 struct udphdr *udph;
313 uchar_t *dh;
314
315 if (ipha->ipha_protocol != IPPROTO_UDP)
316 return (EINVAL);
317
318 offset_and_flags = ntohs(ipha->ipha_fragment_offset_and_flags);
319 if ((offset_and_flags & (IPH_MF | IPH_OFFSET)) != 0) {
320 /*
321 * All non-initial fragments may pass because we cannot
322 * identify their type. It's safe to let them through
323 * because reassembly will fail if we decide to drop the
324 * initial fragment.
325 */
326 if (((offset_and_flags << 3) & 0xffff) != 0)
327 return (EINVAL);
328 first_frag = B_TRUE;
329 }
330 /* drop packets without a udp header */
331 udph = (struct udphdr *)((uchar_t *)ipha + IPH_HDR_LENGTH(ipha));
332 if ((uchar_t *)&udph[1] > end)
333 return (ENOSPC);
334
335 client = htons(IPPORT_BOOTPC);
336 server = htons(IPPORT_BOOTPS);
337 if (udph->uh_sport != client && udph->uh_sport != server &&
338 udph->uh_dport != client && udph->uh_dport != server)
339 return (EINVAL);
340
341 /* drop dhcp fragments */
342 if (first_frag)
343 return (ENOSPC);
344
345 dh = (uchar_t *)&udph[1];
346 if (dh + BASE_PKT_SIZE > end)
347 return (EINVAL);
348
349 *dh4 = (struct dhcp *)dh;
350 return (0);
351 }
352
353 /*
354 * Wrappers for accesses to avl trees to improve readability.
355 * Their purposes are fairly self-explanatory.
356 */
357 static dhcpv4_txn_t *
358 find_dhcpv4_pending_txn(mac_client_impl_t *mcip, uint32_t xid)
359 {
360 dhcpv4_txn_t tmp_txn;
361
362 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
363 tmp_txn.dt_xid = xid;
364 return (avl_find(&mcip->mci_v4_pending_txn, &tmp_txn, NULL));
365 }
366
367 static int
368 insert_dhcpv4_pending_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
369 {
370 avl_index_t where;
371
372 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
373 if (avl_find(&mcip->mci_v4_pending_txn, txn, &where) != NULL)
374 return (EEXIST);
375
376 if (avl_numnodes(&mcip->mci_v4_pending_txn) >= dhcp_max_pending_txn) {
377 BUMP_STAT(mcip, dhcpdropped);
378 return (EAGAIN);
379 }
380 avl_insert(&mcip->mci_v4_pending_txn, txn, where);
381 return (0);
382 }
383
384 static void
385 remove_dhcpv4_pending_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
386 {
387 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
388 avl_remove(&mcip->mci_v4_pending_txn, txn);
389 }
390
391 static dhcpv4_txn_t *
392 find_dhcpv4_completed_txn(mac_client_impl_t *mcip, uint8_t *cid,
393 uint8_t cid_len)
394 {
395 dhcpv4_txn_t tmp_txn;
396
397 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
398 if (cid_len > 0)
399 bcopy(cid, tmp_txn.dt_cid, cid_len);
400 tmp_txn.dt_cid_len = cid_len;
401 return (avl_find(&mcip->mci_v4_completed_txn, &tmp_txn, NULL));
402 }
403
404 /*
405 * After a pending txn is removed from the pending table, it is inserted
406 * into both the completed and dyn-ip tables. These two insertions are
407 * done together because a client ID must have 1:1 correspondence with
408 * an IP address and IP addresses must be unique in the dyn-ip table.
409 */
410 static int
411 insert_dhcpv4_completed_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
412 {
413 avl_index_t where;
414
415 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
416 if (avl_find(&mcip->mci_v4_completed_txn, txn, &where) != NULL)
417 return (EEXIST);
418
419 if (avl_numnodes(&mcip->mci_v4_completed_txn) >=
420 dhcp_max_completed_txn) {
421 BUMP_STAT(mcip, dhcpdropped);
422 return (EAGAIN);
423 }
424
425 avl_insert(&mcip->mci_v4_completed_txn, txn, where);
426 if (avl_find(&mcip->mci_v4_dyn_ip, txn, &where) != NULL) {
427 avl_remove(&mcip->mci_v4_completed_txn, txn);
428 return (EEXIST);
429 }
430 avl_insert(&mcip->mci_v4_dyn_ip, txn, where);
431 return (0);
432 }
433
434 static void
435 remove_dhcpv4_completed_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
436 {
437 dhcpv4_txn_t *ctxn;
438
439 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
440 if ((ctxn = avl_find(&mcip->mci_v4_dyn_ip, txn, NULL)) != NULL &&
441 ctxn == txn)
442 avl_remove(&mcip->mci_v4_dyn_ip, txn);
443
444 avl_remove(&mcip->mci_v4_completed_txn, txn);
445 }
446
447 /*
448 * Check whether an IP address is in the dyn-ip table.
449 */
450 static boolean_t
451 check_dhcpv4_dyn_ip(mac_client_impl_t *mcip, ipaddr_t ipaddr)
452 {
453 dhcpv4_txn_t tmp_txn, *txn;
454
455 mutex_enter(&mcip->mci_protect_lock);
456 tmp_txn.dt_ipaddr = ipaddr;
457 txn = avl_find(&mcip->mci_v4_dyn_ip, &tmp_txn, NULL);
458 mutex_exit(&mcip->mci_protect_lock);
459 return (txn != NULL);
460 }
461
462 /*
463 * Create/destroy a DHCPv4 transaction.
464 */
465 static dhcpv4_txn_t *
466 create_dhcpv4_txn(uint32_t xid, uint8_t *cid, uint8_t cid_len, ipaddr_t ipaddr)
467 {
468 dhcpv4_txn_t *txn;
469
470 if ((txn = kmem_zalloc(sizeof (*txn), KM_NOSLEEP)) == NULL)
471 return (NULL);
472
473 txn->dt_xid = xid;
474 txn->dt_timestamp = gethrtime();
475 if (cid_len > 0)
476 bcopy(cid, &txn->dt_cid, cid_len);
477 txn->dt_cid_len = cid_len;
478 txn->dt_ipaddr = ipaddr;
479 return (txn);
480 }
481
482 static void
483 free_dhcpv4_txn(dhcpv4_txn_t *txn)
484 {
485 kmem_free(txn, sizeof (*txn));
486 }
487
488 /*
489 * Clean up all v4 tables.
490 */
491 static void
492 flush_dhcpv4(mac_client_impl_t *mcip)
493 {
494 void *cookie = NULL;
495 dhcpv4_txn_t *txn;
496
497 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
498 while ((txn = avl_destroy_nodes(&mcip->mci_v4_dyn_ip,
499 &cookie)) != NULL) {
500 /*
501 * No freeing needed here because the same txn exists
502 * in the mci_v4_completed_txn table as well.
503 */
504 }
505 cookie = NULL;
506 while ((txn = avl_destroy_nodes(&mcip->mci_v4_completed_txn,
507 &cookie)) != NULL) {
508 free_dhcpv4_txn(txn);
509 }
510 cookie = NULL;
511 while ((txn = avl_destroy_nodes(&mcip->mci_v4_pending_txn,
512 &cookie)) != NULL) {
513 free_dhcpv4_txn(txn);
514 }
515 }
516
517 /*
518 * Cleanup stale DHCPv4 transactions.
519 */
520 static void
521 txn_cleanup_v4(mac_client_impl_t *mcip)
522 {
523 dhcpv4_txn_t *txn, *ctxn, *next, *txn_list = NULL;
524
525 /*
526 * Find stale pending transactions and place them on a list
527 * to be removed.
528 */
529 for (txn = avl_first(&mcip->mci_v4_pending_txn); txn != NULL;
530 txn = avl_walk(&mcip->mci_v4_pending_txn, txn, AVL_AFTER)) {
531 if (gethrtime() - txn->dt_timestamp > txn_cleanup_interval) {
532 DTRACE_PROBE2(found__expired__txn,
533 mac_client_impl_t *, mcip,
534 dhcpv4_txn_t *, txn);
535
536 txn->dt_next = txn_list;
537 txn_list = txn;
538 }
539 }
540
541 /*
542 * Remove and free stale pending transactions and completed
543 * transactions with the same client IDs as the stale transactions.
544 */
545 for (txn = txn_list; txn != NULL; txn = next) {
546 avl_remove(&mcip->mci_v4_pending_txn, txn);
547
548 ctxn = find_dhcpv4_completed_txn(mcip, txn->dt_cid,
549 txn->dt_cid_len);
550 if (ctxn != NULL) {
551 DTRACE_PROBE2(removing__completed__txn,
552 mac_client_impl_t *, mcip,
553 dhcpv4_txn_t *, ctxn);
554
555 remove_dhcpv4_completed_txn(mcip, ctxn);
556 free_dhcpv4_txn(ctxn);
557 }
558 next = txn->dt_next;
559 txn->dt_next = NULL;
560
561 DTRACE_PROBE2(freeing__txn, mac_client_impl_t *, mcip,
562 dhcpv4_txn_t *, txn);
563 free_dhcpv4_txn(txn);
564 }
565 }
566
567 /*
568 * Core logic for intercepting outbound DHCPv4 packets.
569 */
570 static boolean_t
571 intercept_dhcpv4_outbound(mac_client_impl_t *mcip, ipha_t *ipha, uchar_t *end)
572 {
573 struct dhcp *dh4;
574 uchar_t *opt;
575 dhcpv4_txn_t *txn, *ctxn;
576 ipaddr_t ipaddr;
577 uint8_t opt_len, mtype, cid[DHCP_MAX_OPT_SIZE], cid_len;
578 mac_resource_props_t *mrp = MCIP_RESOURCE_PROPS(mcip);
579
580 if (get_dhcpv4_info(ipha, end, &dh4) != 0)
581 return (B_TRUE);
582
583 /* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
584 if (allowed_ips_set(mrp, IPV4_VERSION))
585 return (B_FALSE);
586
587 if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
588 opt_len != 1) {
589 DTRACE_PROBE2(mtype__not__found, mac_client_impl_t *, mcip,
590 struct dhcp *, dh4);
591 return (B_TRUE);
592 }
593 mtype = *opt;
594 if (mtype != REQUEST && mtype != RELEASE) {
595 DTRACE_PROBE3(ignored__mtype, mac_client_impl_t *, mcip,
596 struct dhcp *, dh4, uint8_t, mtype);
597 return (B_TRUE);
598 }
599
600 /* client ID is optional for IPv4 */
601 if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &opt, &opt_len) == 0 &&
602 opt_len >= 2) {
603 bcopy(opt, cid, opt_len);
604 cid_len = opt_len;
605 } else {
606 bzero(cid, DHCP_MAX_OPT_SIZE);
607 cid_len = 0;
608 }
609
610 mutex_enter(&mcip->mci_protect_lock);
611 if (mtype == RELEASE) {
612 DTRACE_PROBE2(release, mac_client_impl_t *, mcip,
613 struct dhcp *, dh4);
614
615 /* flush any completed txn with this cid */
616 ctxn = find_dhcpv4_completed_txn(mcip, cid, cid_len);
617 if (ctxn != NULL) {
618 DTRACE_PROBE2(release__successful, mac_client_impl_t *,
619 mcip, struct dhcp *, dh4);
620
621 remove_dhcpv4_completed_txn(mcip, ctxn);
622 free_dhcpv4_txn(ctxn);
623 }
624 goto done;
625 }
626
627 /*
628 * If a pending txn already exists, we'll update its timestamp so
629 * it won't get flushed by the timer. We don't need to create new
630 * txns for retransmissions.
631 */
632 if ((txn = find_dhcpv4_pending_txn(mcip, dh4->xid)) != NULL) {
633 DTRACE_PROBE2(update, mac_client_impl_t *, mcip,
634 dhcpv4_txn_t *, txn);
635 txn->dt_timestamp = gethrtime();
636 goto done;
637 }
638
639 if (get_dhcpv4_option(dh4, end, CD_REQUESTED_IP_ADDR,
640 &opt, &opt_len) != 0 || opt_len != sizeof (ipaddr)) {
641 DTRACE_PROBE2(ipaddr__not__found, mac_client_impl_t *, mcip,
642 struct dhcp *, dh4);
643 goto done;
644 }
645 bcopy(opt, &ipaddr, sizeof (ipaddr));
646 if ((txn = create_dhcpv4_txn(dh4->xid, cid, cid_len, ipaddr)) == NULL)
647 goto done;
648
649 if (insert_dhcpv4_pending_txn(mcip, txn) != 0) {
650 DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
651 dhcpv4_txn_t *, txn);
652 free_dhcpv4_txn(txn);
653 goto done;
654 }
655 start_txn_cleanup_timer(mcip);
656
657 DTRACE_PROBE2(txn__pending, mac_client_impl_t *, mcip,
658 dhcpv4_txn_t *, txn);
659
660 done:
661 mutex_exit(&mcip->mci_protect_lock);
662 return (B_TRUE);
663 }
664
665 /*
666 * Core logic for intercepting inbound DHCPv4 packets.
667 */
668 static void
669 intercept_dhcpv4_inbound(mac_client_impl_t *mcip, uchar_t *end,
670 struct dhcp *dh4)
671 {
672 uchar_t *opt;
673 dhcpv4_txn_t *txn, *ctxn;
674 uint8_t opt_len, mtype;
675
676 if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
677 opt_len != 1) {
678 DTRACE_PROBE2(mtype__not__found, mac_client_impl_t *, mcip,
679 struct dhcp *, dh4);
680 return;
681 }
682 mtype = *opt;
683 if (mtype != ACK && mtype != NAK) {
684 DTRACE_PROBE3(ignored__mtype, mac_client_impl_t *, mcip,
685 struct dhcp *, dh4, uint8_t, mtype);
686 return;
687 }
688
689 mutex_enter(&mcip->mci_protect_lock);
690 if ((txn = find_dhcpv4_pending_txn(mcip, dh4->xid)) == NULL) {
691 DTRACE_PROBE2(txn__not__found, mac_client_impl_t *, mcip,
692 struct dhcp *, dh4);
693 goto done;
694 }
695 remove_dhcpv4_pending_txn(mcip, txn);
696
697 /*
698 * We're about to move a txn from the pending table to the completed/
699 * dyn-ip tables. If there is an existing completed txn with the
700 * same cid as our txn, we need to remove and free it.
701 */
702 ctxn = find_dhcpv4_completed_txn(mcip, txn->dt_cid, txn->dt_cid_len);
703 if (ctxn != NULL) {
704 DTRACE_PROBE2(replacing__old__txn, mac_client_impl_t *, mcip,
705 dhcpv4_txn_t *, ctxn);
706 remove_dhcpv4_completed_txn(mcip, ctxn);
707 free_dhcpv4_txn(ctxn);
708 }
709 if (mtype == NAK) {
710 DTRACE_PROBE2(nak__received, mac_client_impl_t *, mcip,
711 dhcpv4_txn_t *, txn);
712 free_dhcpv4_txn(txn);
713 goto done;
714 }
715 if (insert_dhcpv4_completed_txn(mcip, txn) != 0) {
716 DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
717 dhcpv4_txn_t *, txn);
718 free_dhcpv4_txn(txn);
719 goto done;
720 }
721 DTRACE_PROBE2(txn__completed, mac_client_impl_t *, mcip,
722 dhcpv4_txn_t *, txn);
723
724 done:
725 mutex_exit(&mcip->mci_protect_lock);
726 }
727
728
729 /*
730 * Comparison functions for the DHCPv6 AVL trees.
731 */
732 static int
733 compare_dhcpv6_xid(const void *arg1, const void *arg2)
734 {
735 const dhcpv6_txn_t *txn1 = arg1, *txn2 = arg2;
736
737 if (txn1->dt_xid < txn2->dt_xid)
738 return (-1);
739 else if (txn1->dt_xid > txn2->dt_xid)
740 return (1);
741 else
742 return (0);
743 }
744
745 static int
746 compare_dhcpv6_ip(const void *arg1, const void *arg2)
747 {
748 const dhcpv6_addr_t *ip1 = arg1, *ip2 = arg2;
749 int ret;
750
751 ret = memcmp(&ip1->da_addr, &ip2->da_addr, sizeof (in6_addr_t));
752 if (ret < 0)
753 return (-1);
754 else if (ret > 0)
755 return (1);
756 else
757 return (0);
758 }
759
760 static int
761 compare_dhcpv6_cid(const void *arg1, const void *arg2)
762 {
763 const dhcpv6_cid_t *cid1 = arg1, *cid2 = arg2;
764 int ret;
765
766 if (cid1->dc_cid_len < cid2->dc_cid_len)
767 return (-1);
768 else if (cid1->dc_cid_len > cid2->dc_cid_len)
769 return (1);
770
771 if (cid1->dc_cid_len == 0)
772 return (0);
773
774 ret = memcmp(cid1->dc_cid, cid2->dc_cid, cid1->dc_cid_len);
775 if (ret < 0)
776 return (-1);
777 else if (ret > 0)
778 return (1);
779 else
780 return (0);
781 }
782
783 static int
784 compare_slaac_ip(const void *arg1, const void *arg2)
785 {
786 const slaac_addr_t *ip1 = arg1, *ip2 = arg2;
787 int ret;
788
789 ret = memcmp(&ip1->sla_addr, &ip2->sla_addr, sizeof (in6_addr_t));
790 if (ret < 0)
791 return (-1);
792 else if (ret > 0)
793 return (1);
794 else
795 return (0);
796 }
797
798 /*
799 * Locate the start of a DHCPv6 header.
800 * The possible return values and associated meanings are:
801 * 0 - packet is DHCP and has a DHCP header.
802 * EINVAL - packet is not DHCP. the recommended action is to let it pass.
803 * ENOSPC - packet is a initial fragment that is DHCP or is unidentifiable.
804 * the recommended action is to drop it.
805 */
806 static int
807 get_dhcpv6_info(ip6_t *ip6h, uchar_t *end, dhcpv6_message_t **dh6)
808 {
809 uint16_t hdrlen, client, server;
810 boolean_t first_frag = B_FALSE;
811 ip6_frag_t *frag = NULL;
812 uint8_t proto;
813 struct udphdr *udph;
814 uchar_t *dh;
815
816 if (!mac_ip_hdr_length_v6(ip6h, end, &hdrlen, &proto, &frag))
817 return (ENOSPC);
818
819 if (proto != IPPROTO_UDP)
820 return (EINVAL);
821
822 if (frag != NULL) {
823 /*
824 * All non-initial fragments may pass because we cannot
825 * identify their type. It's safe to let them through
826 * because reassembly will fail if we decide to drop the
827 * initial fragment.
828 */
829 if ((ntohs(frag->ip6f_offlg) & ~7) != 0)
830 return (EINVAL);
831 first_frag = B_TRUE;
832 }
833 /* drop packets without a udp header */
834 udph = (struct udphdr *)((uchar_t *)ip6h + hdrlen);
835 if ((uchar_t *)&udph[1] > end)
836 return (ENOSPC);
837
838 client = htons(IPPORT_DHCPV6C);
839 server = htons(IPPORT_DHCPV6S);
840 if (udph->uh_sport != client && udph->uh_sport != server &&
841 udph->uh_dport != client && udph->uh_dport != server)
842 return (EINVAL);
843
844 /* drop dhcp fragments */
845 if (first_frag)
846 return (ENOSPC);
847
848 dh = (uchar_t *)&udph[1];
849 if (dh + sizeof (dhcpv6_message_t) > end)
850 return (EINVAL);
851
852 *dh6 = (dhcpv6_message_t *)dh;
853 return (0);
854 }
855
856 static int
857 get_ra_info(ip6_t *ip6h, uchar_t *end, nd_router_advert_t **ra)
858 {
859 uint16_t hdrlen;
860 ip6_frag_t *frag = NULL;
861 uint8_t proto;
862 uchar_t *hdrp;
863 struct icmp6_hdr *icmp;
864
865 if (!mac_ip_hdr_length_v6(ip6h, end, &hdrlen, &proto, &frag))
866 return (ENOSPC);
867
868 if (proto != IPPROTO_ICMPV6)
869 return (EINVAL);
870
871 if (frag != NULL) {
872 /*
873 * All non-initial fragments may pass because we cannot
874 * identify their type. It's safe to let them through
875 * because reassembly will fail if we decide to drop the
876 * initial fragment.
877 */
878 if ((ntohs(frag->ip6f_offlg) & ~7) != 0)
879 return (EINVAL);
880 return (ENOSPC);
881 }
882
883 /*
884 * Ensure that the ICMP header falls w/in packet boundaries, in case
885 * we've received a malicious packet that reports incorrect lengths.
886 */
887 hdrp = (uchar_t *)ip6h + hdrlen;
888 if ((hdrp + sizeof (struct icmp6_hdr)) > end) {
889 return (EINVAL);
890 }
891 icmp = (struct icmp6_hdr *)hdrp;
892
893 if (icmp->icmp6_type != ND_ROUTER_ADVERT ||
894 icmp->icmp6_code != 0)
895 return (EINVAL);
896
897 *ra = (nd_router_advert_t *)icmp;
898 return (0);
899 }
900
901 /*
902 * Find the specified DHCPv6 option.
903 */
904 static dhcpv6_option_t *
905 get_dhcpv6_option(void *buf, size_t buflen, dhcpv6_option_t *oldopt,
906 uint16_t codenum, uint_t *retlenp)
907 {
908 uchar_t *bp;
909 dhcpv6_option_t d6o;
910 uint_t olen;
911
912 codenum = htons(codenum);
913 bp = buf;
914 while (buflen >= sizeof (dhcpv6_option_t)) {
915 bcopy(bp, &d6o, sizeof (d6o));
916 olen = ntohs(d6o.d6o_len) + sizeof (d6o);
917 if (olen > buflen)
918 break;
919 if (d6o.d6o_code != codenum || d6o.d6o_len == 0 ||
920 (oldopt != NULL && bp <= (uchar_t *)oldopt)) {
921 bp += olen;
922 buflen -= olen;
923 continue;
924 }
925 if (retlenp != NULL)
926 *retlenp = olen;
927 /* LINTED : alignment */
928 return ((dhcpv6_option_t *)bp);
929 }
930 return (NULL);
931 }
932
933 /*
934 * Get the status code from a reply message.
935 */
936 static int
937 get_dhcpv6_status(dhcpv6_message_t *dh6, uchar_t *end, uint16_t *status)
938 {
939 dhcpv6_option_t *d6o;
940 uint_t olen;
941 uint16_t s;
942
943 d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
944 DHCPV6_OPT_STATUS_CODE, &olen);
945
946 /* Success is implied if status code is missing */
947 if (d6o == NULL) {
948 *status = DHCPV6_STAT_SUCCESS;
949 return (0);
950 }
951 if ((uchar_t *)d6o + olen > end)
952 return (EINVAL);
953
954 olen -= sizeof (*d6o);
955 if (olen < sizeof (s))
956 return (EINVAL);
957
958 bcopy(&d6o[1], &s, sizeof (s));
959 *status = ntohs(s);
960 return (0);
961 }
962
963 /*
964 * Get the addresses from a reply message.
965 */
966 static int
967 get_dhcpv6_addrs(dhcpv6_message_t *dh6, uchar_t *end, dhcpv6_cid_t *cid)
968 {
969 dhcpv6_option_t *d6o;
970 dhcpv6_addr_t *next;
971 uint_t olen;
972
973 d6o = NULL;
974 while ((d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1],
975 d6o, DHCPV6_OPT_IA_NA, &olen)) != NULL) {
976 dhcpv6_option_t *d6so;
977 dhcpv6_iaaddr_t d6ia;
978 dhcpv6_addr_t **addrp;
979 uchar_t *obase;
980 uint_t solen;
981
982 if (olen < sizeof (dhcpv6_ia_na_t) ||
983 (uchar_t *)d6o + olen > end)
984 goto fail;
985
986 obase = (uchar_t *)d6o + sizeof (dhcpv6_ia_na_t);
987 olen -= sizeof (dhcpv6_ia_na_t);
988 d6so = NULL;
989 while ((d6so = get_dhcpv6_option(obase, olen, d6so,
990 DHCPV6_OPT_IAADDR, &solen)) != NULL) {
991 if (solen < sizeof (dhcpv6_iaaddr_t) ||
992 (uchar_t *)d6so + solen > end)
993 goto fail;
994
995 bcopy(d6so, &d6ia, sizeof (d6ia));
996 for (addrp = &cid->dc_addr; *addrp != NULL;
997 addrp = &(*addrp)->da_next) {
998 if (bcmp(&(*addrp)->da_addr, &d6ia.d6ia_addr,
999 sizeof (in6_addr_t)) == 0)
1000 goto fail;
1001 }
1002 if ((*addrp = kmem_zalloc(sizeof (dhcpv6_addr_t),
1003 KM_NOSLEEP)) == NULL)
1004 goto fail;
1005
1006 bcopy(&d6ia.d6ia_addr, &(*addrp)->da_addr,
1007 sizeof (in6_addr_t));
1008 cid->dc_addrcnt++;
1009 }
1010 }
1011 if (cid->dc_addrcnt == 0)
1012 return (ENOENT);
1013
1014 return (0);
1015
1016 fail:
1017 for (; cid->dc_addr != NULL; cid->dc_addr = next) {
1018 next = cid->dc_addr->da_next;
1019 kmem_free(cid->dc_addr, sizeof (dhcpv6_addr_t));
1020 cid->dc_addrcnt--;
1021 }
1022 ASSERT(cid->dc_addrcnt == 0);
1023 return (EINVAL);
1024 }
1025
1026 /*
1027 * Free a cid.
1028 * Before this gets called the caller must ensure that all the
1029 * addresses are removed from the mci_v6_dyn_ip table.
1030 */
1031 static void
1032 free_dhcpv6_cid(dhcpv6_cid_t *cid)
1033 {
1034 dhcpv6_addr_t *addr, *next;
1035 uint_t cnt = 0;
1036
1037 kmem_free(cid->dc_cid, cid->dc_cid_len);
1038 for (addr = cid->dc_addr; addr != NULL; addr = next) {
1039 next = addr->da_next;
1040 kmem_free(addr, sizeof (*addr));
1041 cnt++;
1042 }
1043 ASSERT(cnt == cid->dc_addrcnt);
1044 kmem_free(cid, sizeof (*cid));
1045 }
1046
1047 /*
1048 * Extract the DUID from a message. The associated addresses will be
1049 * extracted later from the reply message.
1050 */
1051 static dhcpv6_cid_t *
1052 create_dhcpv6_cid(dhcpv6_message_t *dh6, uchar_t *end)
1053 {
1054 dhcpv6_option_t *d6o;
1055 dhcpv6_cid_t *cid;
1056 uchar_t *rawcid;
1057 uint_t olen, rawcidlen;
1058
1059 d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
1060 DHCPV6_OPT_CLIENTID, &olen);
1061 if (d6o == NULL || (uchar_t *)d6o + olen > end)
1062 return (NULL);
1063
1064 rawcidlen = olen - sizeof (*d6o);
1065 if ((rawcid = kmem_zalloc(rawcidlen, KM_NOSLEEP)) == NULL)
1066 return (NULL);
1067 bcopy(d6o + 1, rawcid, rawcidlen);
1068
1069 if ((cid = kmem_zalloc(sizeof (*cid), KM_NOSLEEP)) == NULL) {
1070 kmem_free(rawcid, rawcidlen);
1071 return (NULL);
1072 }
1073 cid->dc_cid = rawcid;
1074 cid->dc_cid_len = rawcidlen;
1075 return (cid);
1076 }
1077
1078 /*
1079 * Remove a cid from mci_v6_cid. The addresses owned by the cid
1080 * are also removed from mci_v6_dyn_ip.
1081 */
1082 static void
1083 remove_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
1084 {
1085 dhcpv6_addr_t *addr, *tmp_addr;
1086
1087 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1088 avl_remove(&mcip->mci_v6_cid, cid);
1089 for (addr = cid->dc_addr; addr != NULL; addr = addr->da_next) {
1090 tmp_addr = avl_find(&mcip->mci_v6_dyn_ip, addr, NULL);
1091 if (tmp_addr == addr)
1092 avl_remove(&mcip->mci_v6_dyn_ip, addr);
1093 }
1094 }
1095
1096 /*
1097 * Find and remove a matching cid and associated addresses from
1098 * their respective tables.
1099 */
1100 static void
1101 release_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
1102 {
1103 dhcpv6_cid_t *oldcid;
1104
1105 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1106 if ((oldcid = avl_find(&mcip->mci_v6_cid, cid, NULL)) == NULL)
1107 return;
1108
1109 /*
1110 * Since cid belongs to a pending txn, it can't possibly be in
1111 * mci_v6_cid. Anything that's found must be an existing cid.
1112 */
1113 ASSERT(oldcid != cid);
1114 remove_dhcpv6_cid(mcip, oldcid);
1115 free_dhcpv6_cid(oldcid);
1116 }
1117
1118 /*
1119 * Insert cid into mci_v6_cid.
1120 */
1121 static int
1122 insert_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
1123 {
1124 avl_index_t where;
1125 dhcpv6_addr_t *addr;
1126
1127 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1128 if (avl_find(&mcip->mci_v6_cid, cid, &where) != NULL)
1129 return (EEXIST);
1130
1131 if (avl_numnodes(&mcip->mci_v6_cid) >= dhcp_max_completed_txn) {
1132 BUMP_STAT(mcip, dhcpdropped);
1133 return (EAGAIN);
1134 }
1135 avl_insert(&mcip->mci_v6_cid, cid, where);
1136 for (addr = cid->dc_addr; addr != NULL; addr = addr->da_next) {
1137 if (avl_find(&mcip->mci_v6_dyn_ip, addr, &where) != NULL)
1138 goto fail;
1139
1140 avl_insert(&mcip->mci_v6_dyn_ip, addr, where);
1141 }
1142 return (0);
1143
1144 fail:
1145 remove_dhcpv6_cid(mcip, cid);
1146 return (EEXIST);
1147 }
1148
1149 /*
1150 * Check whether an IP address is in the dyn-ip table.
1151 */
1152 static boolean_t
1153 check_dhcpv6_dyn_ip(mac_client_impl_t *mcip, in6_addr_t *addr)
1154 {
1155 dhcpv6_addr_t tmp_addr, *a;
1156
1157 mutex_enter(&mcip->mci_protect_lock);
1158 bcopy(addr, &tmp_addr.da_addr, sizeof (in6_addr_t));
1159 a = avl_find(&mcip->mci_v6_dyn_ip, &tmp_addr, NULL);
1160 mutex_exit(&mcip->mci_protect_lock);
1161 return (a != NULL);
1162 }
1163
1164 static dhcpv6_txn_t *
1165 find_dhcpv6_pending_txn(mac_client_impl_t *mcip, uint32_t xid)
1166 {
1167 dhcpv6_txn_t tmp_txn;
1168
1169 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1170 tmp_txn.dt_xid = xid;
1171 return (avl_find(&mcip->mci_v6_pending_txn, &tmp_txn, NULL));
1172 }
1173
1174 static void
1175 remove_dhcpv6_pending_txn(mac_client_impl_t *mcip, dhcpv6_txn_t *txn)
1176 {
1177 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1178 avl_remove(&mcip->mci_v6_pending_txn, txn);
1179 }
1180
1181 static dhcpv6_txn_t *
1182 create_dhcpv6_txn(uint32_t xid, dhcpv6_cid_t *cid)
1183 {
1184 dhcpv6_txn_t *txn;
1185
1186 if ((txn = kmem_zalloc(sizeof (dhcpv6_txn_t), KM_NOSLEEP)) == NULL)
1187 return (NULL);
1188
1189 txn->dt_xid = xid;
1190 txn->dt_cid = cid;
1191 txn->dt_timestamp = gethrtime();
1192 return (txn);
1193 }
1194
1195 static void
1196 free_dhcpv6_txn(dhcpv6_txn_t *txn)
1197 {
1198 if (txn->dt_cid != NULL)
1199 free_dhcpv6_cid(txn->dt_cid);
1200 kmem_free(txn, sizeof (dhcpv6_txn_t));
1201 }
1202
1203 static int
1204 insert_dhcpv6_pending_txn(mac_client_impl_t *mcip, dhcpv6_txn_t *txn)
1205 {
1206 avl_index_t where;
1207
1208 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1209 if (avl_find(&mcip->mci_v6_pending_txn, txn, &where) != NULL)
1210 return (EEXIST);
1211
1212 if (avl_numnodes(&mcip->mci_v6_pending_txn) >= dhcp_max_pending_txn) {
1213 BUMP_STAT(mcip, dhcpdropped);
1214 return (EAGAIN);
1215 }
1216 avl_insert(&mcip->mci_v6_pending_txn, txn, where);
1217 return (0);
1218 }
1219
1220 /*
1221 * Clean up all v6 tables.
1222 */
1223 static void
1224 flush_dhcpv6(mac_client_impl_t *mcip)
1225 {
1226 void *cookie = NULL;
1227 dhcpv6_cid_t *cid;
1228 dhcpv6_txn_t *txn;
1229
1230 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1231 while (avl_destroy_nodes(&mcip->mci_v6_dyn_ip, &cookie) != NULL) {
1232 }
1233 cookie = NULL;
1234 while ((cid = avl_destroy_nodes(&mcip->mci_v6_cid, &cookie)) != NULL) {
1235 free_dhcpv6_cid(cid);
1236 }
1237 cookie = NULL;
1238 while ((txn = avl_destroy_nodes(&mcip->mci_v6_pending_txn,
1239 &cookie)) != NULL) {
1240 free_dhcpv6_txn(txn);
1241 }
1242 }
1243
1244 void
1245 flush_slaac(mac_client_impl_t *mcip)
1246 {
1247 void *cookie = NULL;
1248 slaac_addr_t *addr = NULL;
1249
1250 while ((addr = avl_destroy_nodes(&mcip->mci_v6_slaac_ip, &cookie)) !=
1251 NULL) {
1252 kmem_free(addr, sizeof (slaac_addr_t));
1253 }
1254 }
1255
1256 /*
1257 * Cleanup stale DHCPv6 transactions.
1258 */
1259 static void
1260 txn_cleanup_v6(mac_client_impl_t *mcip)
1261 {
1262 dhcpv6_txn_t *txn, *next, *txn_list = NULL;
1263
1264 /*
1265 * Find stale pending transactions and place them on a list
1266 * to be removed.
1267 */
1268 for (txn = avl_first(&mcip->mci_v6_pending_txn); txn != NULL;
1269 txn = avl_walk(&mcip->mci_v6_pending_txn, txn, AVL_AFTER)) {
1270 if (gethrtime() - txn->dt_timestamp > txn_cleanup_interval) {
1271 DTRACE_PROBE2(found__expired__txn,
1272 mac_client_impl_t *, mcip,
1273 dhcpv6_txn_t *, txn);
1274
1275 txn->dt_next = txn_list;
1276 txn_list = txn;
1277 }
1278 }
1279
1280 /*
1281 * Remove and free stale pending transactions.
1282 * Release any existing cids matching the stale transactions.
1283 */
1284 for (txn = txn_list; txn != NULL; txn = next) {
1285 avl_remove(&mcip->mci_v6_pending_txn, txn);
1286 release_dhcpv6_cid(mcip, txn->dt_cid);
1287 next = txn->dt_next;
1288 txn->dt_next = NULL;
1289
1290 DTRACE_PROBE2(freeing__txn, mac_client_impl_t *, mcip,
1291 dhcpv6_txn_t *, txn);
1292 free_dhcpv6_txn(txn);
1293 }
1294
1295 }
1296
1297 /*
1298 * Core logic for intercepting outbound DHCPv6 packets.
1299 */
1300 static boolean_t
1301 intercept_dhcpv6_outbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end)
1302 {
1303 dhcpv6_message_t *dh6;
1304 dhcpv6_txn_t *txn;
1305 dhcpv6_cid_t *cid = NULL;
1306 uint32_t xid;
1307 uint8_t mtype;
1308 mac_resource_props_t *mrp = MCIP_RESOURCE_PROPS(mcip);
1309
1310 if (get_dhcpv6_info(ip6h, end, &dh6) != 0)
1311 return (B_TRUE);
1312
1313 /* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
1314 if (allowed_ips_set(mrp, IPV6_VERSION))
1315 return (B_FALSE);
1316
1317 /*
1318 * We want to act on packets that result in DHCPv6 Reply messages, or
1319 * on packets that give up an IPv6 address. For example, a Request or
1320 * Solicit (w/ the Rapid Commit option) will cause the server to send a
1321 * Reply, ending the transaction.
1322 */
1323 mtype = dh6->d6m_msg_type;
1324 if (mtype != DHCPV6_MSG_SOLICIT && mtype != DHCPV6_MSG_REQUEST &&
1325 mtype != DHCPV6_MSG_RENEW && mtype != DHCPV6_MSG_REBIND &&
1326 mtype != DHCPV6_MSG_RELEASE)
1327 return (B_TRUE);
1328
1329 if ((cid = create_dhcpv6_cid(dh6, end)) == NULL)
1330 return (B_TRUE);
1331
1332 mutex_enter(&mcip->mci_protect_lock);
1333 if (mtype == DHCPV6_MSG_RELEASE) {
1334 release_dhcpv6_cid(mcip, cid);
1335 goto done;
1336 }
1337 xid = DHCPV6_GET_TRANSID(dh6);
1338 if ((txn = find_dhcpv6_pending_txn(mcip, xid)) != NULL) {
1339 DTRACE_PROBE2(update, mac_client_impl_t *, mcip,
1340 dhcpv6_txn_t *, txn);
1341 txn->dt_timestamp = gethrtime();
1342 goto done;
1343 }
1344 if ((txn = create_dhcpv6_txn(xid, cid)) == NULL)
1345 goto done;
1346
1347 cid = NULL;
1348 if (insert_dhcpv6_pending_txn(mcip, txn) != 0) {
1349 DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
1350 dhcpv6_txn_t *, txn);
1351 free_dhcpv6_txn(txn);
1352 goto done;
1353 }
1354 start_txn_cleanup_timer(mcip);
1355
1356 DTRACE_PROBE2(txn__pending, mac_client_impl_t *, mcip,
1357 dhcpv6_txn_t *, txn);
1358
1359 done:
1360 if (cid != NULL)
1361 free_dhcpv6_cid(cid);
1362
1363 mutex_exit(&mcip->mci_protect_lock);
1364 return (B_TRUE);
1365 }
1366
1367 /*
1368 * Core logic for intercepting inbound DHCPv6 packets.
1369 */
1370 static void
1371 intercept_dhcpv6_inbound(mac_client_impl_t *mcip, uchar_t *end,
1372 dhcpv6_message_t *dh6)
1373 {
1374 dhcpv6_txn_t *txn;
1375 uint32_t xid;
1376 uint8_t mtype;
1377 uint16_t status;
1378
1379 mtype = dh6->d6m_msg_type;
1380 if (mtype != DHCPV6_MSG_REPLY)
1381 return;
1382
1383 mutex_enter(&mcip->mci_protect_lock);
1384 xid = DHCPV6_GET_TRANSID(dh6);
1385 if ((txn = find_dhcpv6_pending_txn(mcip, xid)) == NULL) {
1386 DTRACE_PROBE2(txn__not__found, mac_client_impl_t *, mcip,
1387 dhcpv6_message_t *, dh6);
1388 goto done;
1389 }
1390 remove_dhcpv6_pending_txn(mcip, txn);
1391 release_dhcpv6_cid(mcip, txn->dt_cid);
1392
1393 if (get_dhcpv6_status(dh6, end, &status) != 0 ||
1394 status != DHCPV6_STAT_SUCCESS) {
1395 DTRACE_PROBE2(error__status, mac_client_impl_t *, mcip,
1396 dhcpv6_txn_t *, txn);
1397 goto done;
1398 }
1399 if (get_dhcpv6_addrs(dh6, end, txn->dt_cid) != 0) {
1400 DTRACE_PROBE2(no__addrs, mac_client_impl_t *, mcip,
1401 dhcpv6_txn_t *, txn);
1402 goto done;
1403 }
1404 if (insert_dhcpv6_cid(mcip, txn->dt_cid) != 0) {
1405 DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
1406 dhcpv6_txn_t *, txn);
1407 goto done;
1408 }
1409 DTRACE_PROBE2(txn__completed, mac_client_impl_t *, mcip,
1410 dhcpv6_txn_t *, txn);
1411
1412 txn->dt_cid = NULL;
1413
1414 done:
1415 if (txn != NULL)
1416 free_dhcpv6_txn(txn);
1417 mutex_exit(&mcip->mci_protect_lock);
1418 }
1419
1420 /*
1421 * Check whether an IP address is in the SLAAC table.
1422 */
1423 static boolean_t
1424 check_slaac_ip(mac_client_impl_t *mcip, in6_addr_t *addr)
1425 {
1426 slaac_addr_t tmp_addr, *a;
1427
1428 mutex_enter(&mcip->mci_protect_lock);
1429 bcopy(addr, &tmp_addr.sla_addr, sizeof (in6_addr_t));
1430 a = avl_find(&mcip->mci_v6_slaac_ip, &tmp_addr, NULL);
1431 mutex_exit(&mcip->mci_protect_lock);
1432 return (a != NULL);
1433 }
1434
1435 static boolean_t
1436 insert_slaac_ip(avl_tree_t *tree, in6_addr_t *token, slaac_addr_t *addr)
1437 {
1438 uint_t i;
1439 avl_index_t where;
1440 in6_addr_t *prefix = &addr->sla_prefix;
1441 in6_addr_t *in6p = &addr->sla_addr;
1442
1443 bcopy(prefix, in6p, sizeof (struct in6_addr));
1444
1445 for (i = 0; i < 4; i++) {
1446 in6p->s6_addr32[i] = token->s6_addr32[i] |
1447 in6p->s6_addr32[i];
1448 }
1449
1450 DTRACE_PROBE1(generated__addr, in6_addr_t *, in6p);
1451
1452 if (avl_find(tree, addr, &where) != NULL)
1453 return (B_FALSE);
1454
1455 avl_insert(tree, addr, where);
1456 return (B_TRUE);
1457 }
1458
1459 static void
1460 insert_slaac_prefix(mac_client_impl_t *mcip, nd_opt_prefix_info_t *po)
1461 {
1462 slaac_addr_t *addr = NULL;
1463 in6_addr_t *token = &mcip->mci_v6_mac_token;
1464
1465 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1466
1467 if (avl_numnodes(&mcip->mci_v6_slaac_ip) >= slaac_max_allowed) {
1468 DTRACE_PROBE(limit__reached);
1469 return;
1470 }
1471
1472 if ((addr = kmem_zalloc(sizeof (slaac_addr_t),
1473 KM_NOSLEEP | KM_NORMALPRI)) == NULL)
1474 return;
1475
1476 bcopy(&po->nd_opt_pi_prefix, &addr->sla_prefix,
1477 sizeof (struct in6_addr));
1478
1479 if (!insert_slaac_ip(&mcip->mci_v6_slaac_ip, token, addr)) {
1480 kmem_free(addr, sizeof (slaac_addr_t));
1481 }
1482 }
1483
1484 static void
1485 intercept_prefix_info(mac_client_impl_t *mcip, nd_opt_prefix_info_t *po)
1486 {
1487 if (8 * po->nd_opt_pi_len != sizeof (nd_opt_prefix_info_t)) {
1488 DTRACE_PROBE(invalid__length);
1489 return;
1490 }
1491
1492 if (po->nd_opt_pi_prefix_len > 128) {
1493 DTRACE_PROBE(invalid__plen);
1494 return;
1495 }
1496
1497 if (IN6_IS_ADDR_LINKLOCAL(&po->nd_opt_pi_prefix)) {
1498 DTRACE_PROBE(link__local);
1499 return;
1500 }
1501
1502 if ((po->nd_opt_pi_flags_reserved & ND_OPT_PI_FLAG_AUTO) == 0)
1503 return;
1504
1505 mutex_enter(&mcip->mci_protect_lock);
1506 insert_slaac_prefix(mcip, po);
1507 mutex_exit(&mcip->mci_protect_lock);
1508 }
1509
1510 /*
1511 * If we receive a Router Advertisement carrying prefix information and
1512 * indicating that SLAAC should be performed, then track the prefix.
1513 */
1514 static void
1515 intercept_ra_inbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end,
1516 nd_router_advert_t *ra)
1517 {
1518 struct nd_opt_hdr *opt;
1519 int len, optlen;
1520
1521 if (ip6h->ip6_hlim != 255) {
1522 DTRACE_PROBE1(invalid__hoplimit, uint8_t, ip6h->ip6_hlim);
1523 return;
1524 }
1525
1526 len = ip6h->ip6_plen - sizeof (nd_router_advert_t);
1527 opt = (struct nd_opt_hdr *)&ra[1];
1528 while (len >= sizeof (struct nd_opt_hdr) &&
1529 ((uchar_t *)opt + sizeof (struct nd_opt_hdr)) <= end) {
1530 optlen = opt->nd_opt_len * 8;
1531
1532 if (optlen < sizeof (struct nd_opt_hdr) ||
1533 ((uchar_t *)opt + optlen) > end) {
1534 DTRACE_PROBE(invalid__length);
1535 return;
1536 }
1537
1538 if (opt->nd_opt_type == ND_OPT_PREFIX_INFORMATION) {
1539 intercept_prefix_info(mcip,
1540 (nd_opt_prefix_info_t *)opt);
1541 }
1542
1543 opt = (struct nd_opt_hdr *)((char *)opt + optlen);
1544 len -= optlen;
1545 }
1546 }
1547
1548 /*
1549 * Timer for cleaning up stale transactions.
1550 */
1551 static void
1552 txn_cleanup_timer(void *arg)
1553 {
1554 mac_client_impl_t *mcip = arg;
1555
1556 mutex_enter(&mcip->mci_protect_lock);
1557 if (mcip->mci_txn_cleanup_tid == 0) {
1558 /* do nothing if timer got cancelled */
1559 mutex_exit(&mcip->mci_protect_lock);
1560 return;
1561 }
1562 mcip->mci_txn_cleanup_tid = 0;
1563
1564 txn_cleanup_v4(mcip);
1565 txn_cleanup_v6(mcip);
1566
1567 /*
1568 * Restart timer if pending transactions still exist.
1569 */
1570 if (!avl_is_empty(&mcip->mci_v4_pending_txn) ||
1571 !avl_is_empty(&mcip->mci_v6_pending_txn)) {
1572 DTRACE_PROBE1(restarting__timer, mac_client_impl_t *, mcip);
1573
1574 mcip->mci_txn_cleanup_tid = timeout(txn_cleanup_timer, mcip,
1575 drv_usectohz(txn_cleanup_interval / (NANOSEC / MICROSEC)));
1576 }
1577 mutex_exit(&mcip->mci_protect_lock);
1578 }
1579
1580 static void
1581 start_txn_cleanup_timer(mac_client_impl_t *mcip)
1582 {
1583 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1584 if (mcip->mci_txn_cleanup_tid == 0) {
1585 mcip->mci_txn_cleanup_tid = timeout(txn_cleanup_timer, mcip,
1586 drv_usectohz(txn_cleanup_interval / (NANOSEC / MICROSEC)));
1587 }
1588 }
1589
1590 static void
1591 cancel_txn_cleanup_timer(mac_client_impl_t *mcip)
1592 {
1593 timeout_id_t tid;
1594
1595 ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
1596
1597 /*
1598 * This needs to be a while loop because the timer could get
1599 * rearmed during untimeout().
1600 */
1601 while ((tid = mcip->mci_txn_cleanup_tid) != 0) {
1602 mcip->mci_txn_cleanup_tid = 0;
1603 mutex_exit(&mcip->mci_protect_lock);
1604 (void) untimeout(tid);
1605 mutex_enter(&mcip->mci_protect_lock);
1606 }
1607 }
1608
1609 /*
1610 * Get the start/end pointers of an L3 packet and also do pullup if needed.
1611 * pulled-up packet needs to be freed by the caller.
1612 */
1613 static int
1614 get_l3_info(mblk_t *mp, size_t hdrsize, uchar_t **start, uchar_t **end,
1615 mblk_t **nmp)
1616 {
1617 uchar_t *s, *e;
1618 mblk_t *newmp = NULL;
1619
1620 /*
1621 * Pullup if necessary but reject packets that do not have
1622 * a proper mac header.
1623 */
1624 s = mp->b_rptr + hdrsize;
1625 e = mp->b_wptr;
1626
1627 if (s > mp->b_wptr)
1628 return (EINVAL);
1629
1630 if (!OK_32PTR(s) || mp->b_cont != NULL) {
1631 /*
1632 * Temporarily adjust mp->b_rptr to ensure proper
1633 * alignment of IP header in newmp.
1634 */
1635 DTRACE_PROBE1(pullup__needed, mblk_t *, mp);
1636
1637 mp->b_rptr += hdrsize;
1638 newmp = msgpullup(mp, -1);
1639 mp->b_rptr -= hdrsize;
1640
1641 if (newmp == NULL)
1642 return (ENOMEM);
1643
1644 s = newmp->b_rptr;
1645 e = newmp->b_wptr;
1646 }
1647
1648 *start = s;
1649 *end = e;
1650 *nmp = newmp;
1651 return (0);
1652 }
1653
1654 void
1655 mac_protect_intercept_dynamic_one(mac_client_impl_t *mcip, mblk_t *mp)
1656 {
1657 mac_impl_t *mip = mcip->mci_mip;
1658 uchar_t *start, *end;
1659 mblk_t *nmp = NULL;
1660 mac_header_info_t mhi;
1661 int err;
1662
1663 err = mac_vlan_header_info((mac_handle_t)mip, mp, &mhi);
1664 if (err != 0) {
1665 DTRACE_PROBE2(invalid__header, mac_client_impl_t *, mcip,
1666 mblk_t *, mp);
1667 return;
1668 }
1669
1670 err = get_l3_info(mp, mhi.mhi_hdrsize, &start, &end, &nmp);
1671 if (err != 0) {
1672 DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
1673 mblk_t *, mp);
1674 return;
1675 }
1676
1677 switch (mhi.mhi_bindsap) {
1678 case ETHERTYPE_IP: {
1679 struct dhcp *dh4;
1680 ipha_t *ipha = (ipha_t *)start;
1681
1682 if (start + sizeof (ipha_t) > end)
1683 return;
1684
1685 if (get_dhcpv4_info(ipha, end, &dh4) == 0) {
1686 intercept_dhcpv4_inbound(mcip, end, dh4);
1687 }
1688 break;
1689 }
1690 case ETHERTYPE_IPV6: {
1691 dhcpv6_message_t *dh6;
1692 nd_router_advert_t *ra;
1693 ip6_t *ip6h = (ip6_t *)start;
1694
1695 if (start + sizeof (ip6_t) > end)
1696 return;
1697
1698 if (get_dhcpv6_info(ip6h, end, &dh6) == 0) {
1699 intercept_dhcpv6_inbound(mcip, end, dh6);
1700 } else if (get_ra_info(ip6h, end, &ra) == 0) {
1701 intercept_ra_inbound(mcip, ip6h, end, ra);
1702 }
1703
1704 break;
1705 }
1706 }
1707 freemsg(nmp);
1708 }
1709
1710 void
1711 mac_protect_intercept_dynamic(mac_client_impl_t *mcip, mblk_t *mp)
1712 {
1713 /*
1714 * Skip checks if we are part of an aggr.
1715 */
1716 if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
1717 return;
1718
1719 for (; mp != NULL; mp = mp->b_next)
1720 mac_protect_intercept_dynamic_one(mcip, mp);
1721 }
1722
1723 void
1724 mac_protect_flush_dynamic(mac_client_impl_t *mcip)
1725 {
1726 mutex_enter(&mcip->mci_protect_lock);
1727 flush_dhcpv4(mcip);
1728 flush_dhcpv6(mcip);
1729 flush_slaac(mcip);
1730 mutex_exit(&mcip->mci_protect_lock);
1731 }
1732
1733 void
1734 mac_protect_cancel_timer(mac_client_impl_t *mcip)
1735 {
1736 mutex_enter(&mcip->mci_protect_lock);
1737 cancel_txn_cleanup_timer(mcip);
1738 mutex_exit(&mcip->mci_protect_lock);
1739 }
1740
1741 /*
1742 * Check if addr is in the 'allowed-ips' list.
1743 */
1744
1745 /* ARGSUSED */
1746 static boolean_t
1747 ipnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *protect,
1748 ipaddr_t *addr)
1749 {
1750 uint_t i;
1751
1752 /*
1753 * The unspecified address is allowed.
1754 */
1755 if (*addr == INADDR_ANY)
1756 return (B_TRUE);
1757
1758 for (i = 0; i < protect->mp_ipaddrcnt; i++) {
1759 mac_ipaddr_t *v4addr = &protect->mp_ipaddrs[i];
1760
1761 if (v4addr->ip_version == IPV4_VERSION) {
1762 uint32_t mask;
1763
1764 /* LINTED E_SUSPICIOUS_COMPARISON */
1765 ASSERT(v4addr->ip_netmask >= 0 &&
1766 v4addr->ip_netmask <= 32);
1767 mask = 0xFFFFFFFFu << (32 - v4addr->ip_netmask);
1768 /*
1769 * Since we have a netmask we know this entry
1770 * signifies the entire subnet. Check if the
1771 * given address is on the subnet.
1772 */
1773 if (htonl(V4_PART_OF_V6(v4addr->ip_addr)) ==
1774 (htonl(*addr) & mask))
1775 return (B_TRUE);
1776 }
1777 }
1778 return (protect->mp_ipaddrcnt == 0 ?
1779 check_dhcpv4_dyn_ip(mcip, *addr) : B_FALSE);
1780 }
1781
1782 static boolean_t
1783 ipnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *protect,
1784 in6_addr_t *addr)
1785 {
1786 uint_t i;
1787
1788 /*
1789 * The unspecified address and the v6 link local address are allowed.
1790 */
1791 if (IN6_IS_ADDR_UNSPECIFIED(addr) ||
1792 ((mcip->mci_protect_flags & MPT_FLAG_V6_LOCAL_ADDR_SET) != 0 &&
1793 IN6_ARE_ADDR_EQUAL(&mcip->mci_v6_local_addr, addr)))
1794 return (B_TRUE);
1795
1796
1797 for (i = 0; i < protect->mp_ipaddrcnt; i++) {
1798 mac_ipaddr_t *v6addr = &protect->mp_ipaddrs[i];
1799
1800 if (v6addr->ip_version == IPV6_VERSION &&
1801 /* LINTED E_SUSPICIOUS_COMPARISON */
1802 IN6_ARE_PREFIXEDADDR_EQUAL(&v6addr->ip_addr, addr,
1803 v6addr->ip_netmask))
1804 return (B_TRUE);
1805 }
1806
1807 if (protect->mp_ipaddrcnt == 0) {
1808 return (check_slaac_ip(mcip, addr) ||
1809 check_dhcpv6_dyn_ip(mcip, addr));
1810 } else {
1811 return (B_FALSE);
1812 }
1813 }
1814
1815 /*
1816 * Checks various fields within an IPv6 NDP packet.
1817 */
1818 static boolean_t
1819 ipnospoof_check_ndp(mac_client_impl_t *mcip, mac_protect_t *protect,
1820 ip6_t *ip6h, uchar_t *end)
1821 {
1822 icmp6_t *icmp_nd = (icmp6_t *)&ip6h[1];
1823 int hdrlen, optlen, opttype, len;
1824 uint_t addrlen, maclen;
1825 uint8_t type;
1826 nd_opt_hdr_t *opt;
1827 struct nd_opt_lla *lla = NULL;
1828
1829 /*
1830 * NDP packets do not have extension headers so the ICMPv6 header
1831 * must immediately follow the IPv6 header.
1832 */
1833 if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
1834 return (B_TRUE);
1835
1836 /* ICMPv6 header missing */
1837 if ((uchar_t *)&icmp_nd[1] > end)
1838 return (B_FALSE);
1839
1840 len = end - (uchar_t *)icmp_nd;
1841 type = icmp_nd->icmp6_type;
1842
1843 switch (type) {
1844 case ND_ROUTER_SOLICIT:
1845 hdrlen = sizeof (nd_router_solicit_t);
1846 break;
1847 case ND_ROUTER_ADVERT:
1848 hdrlen = sizeof (nd_router_advert_t);
1849 break;
1850 case ND_NEIGHBOR_SOLICIT:
1851 hdrlen = sizeof (nd_neighbor_solicit_t);
1852 break;
1853 case ND_NEIGHBOR_ADVERT:
1854 hdrlen = sizeof (nd_neighbor_advert_t);
1855 break;
1856 case ND_REDIRECT:
1857 hdrlen = sizeof (nd_redirect_t);
1858 break;
1859 default:
1860 return (B_TRUE);
1861 }
1862
1863 if (len < hdrlen)
1864 return (B_FALSE);
1865
1866 /* SLLA option checking is needed for RS/RA/NS */
1867 opttype = ND_OPT_SOURCE_LINKADDR;
1868
1869 switch (type) {
1870 case ND_NEIGHBOR_ADVERT: {
1871 nd_neighbor_advert_t *na = (nd_neighbor_advert_t *)icmp_nd;
1872
1873 if (!ipnospoof_check_v6(mcip, protect, &na->nd_na_target)) {
1874 DTRACE_PROBE2(ndp__na__fail,
1875 mac_client_impl_t *, mcip, ip6_t *, ip6h);
1876 return (B_FALSE);
1877 }
1878
1879 /* TLLA option for NA */
1880 opttype = ND_OPT_TARGET_LINKADDR;
1881 break;
1882 }
1883 case ND_REDIRECT: {
1884 /* option checking not needed for RD */
1885 return (B_TRUE);
1886 }
1887 default:
1888 break;
1889 }
1890
1891 if (len == hdrlen) {
1892 /* no options, we're done */
1893 return (B_TRUE);
1894 }
1895 opt = (nd_opt_hdr_t *)((uchar_t *)icmp_nd + hdrlen);
1896 optlen = len - hdrlen;
1897
1898 /* find the option header we need */
1899 while (optlen > sizeof (nd_opt_hdr_t)) {
1900 if (opt->nd_opt_type == opttype) {
1901 lla = (struct nd_opt_lla *)opt;
1902 break;
1903 }
1904 optlen -= 8 * opt->nd_opt_len;
1905 opt = (nd_opt_hdr_t *)
1906 ((uchar_t *)opt + 8 * opt->nd_opt_len);
1907 }
1908 if (lla == NULL)
1909 return (B_TRUE);
1910
1911 addrlen = lla->nd_opt_lla_len * 8 - sizeof (nd_opt_hdr_t);
1912 maclen = mcip->mci_mip->mi_info.mi_addr_length;
1913
1914 if (addrlen != maclen ||
1915 bcmp(mcip->mci_unicast->ma_addr,
1916 lla->nd_opt_lla_hdw_addr, maclen) != 0) {
1917 DTRACE_PROBE2(ndp__lla__fail,
1918 mac_client_impl_t *, mcip, ip6_t *, ip6h);
1919 return (B_FALSE);
1920 }
1921
1922 DTRACE_PROBE2(ndp__lla__ok, mac_client_impl_t *, mcip, ip6_t *, ip6h);
1923 return (B_TRUE);
1924 }
1925
1926 /*
1927 * Enforce ip-nospoof protection.
1928 */
1929 static int
1930 ipnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
1931 mblk_t *mp, mac_header_info_t *mhip)
1932 {
1933 size_t hdrsize = mhip->mhi_hdrsize;
1934 uint32_t sap = mhip->mhi_bindsap;
1935 uchar_t *start, *end;
1936 mblk_t *nmp = NULL;
1937 int err;
1938
1939 err = get_l3_info(mp, hdrsize, &start, &end, &nmp);
1940 if (err != 0) {
1941 DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
1942 mblk_t *, mp);
1943 return (err);
1944 }
1945 err = EINVAL;
1946
1947 switch (sap) {
1948 case ETHERTYPE_IP: {
1949 ipha_t *ipha = (ipha_t *)start;
1950
1951 if (start + sizeof (ipha_t) > end)
1952 goto fail;
1953
1954 if (!ipnospoof_check_v4(mcip, protect, &ipha->ipha_src))
1955 goto fail;
1956
1957 if (!intercept_dhcpv4_outbound(mcip, ipha, end))
1958 goto fail;
1959 break;
1960 }
1961 case ETHERTYPE_ARP: {
1962 arh_t *arh = (arh_t *)start;
1963 uint32_t maclen, hlen, plen, arplen;
1964 ipaddr_t spaddr;
1965 uchar_t *shaddr;
1966
1967 if (start + sizeof (arh_t) > end)
1968 goto fail;
1969
1970 maclen = mcip->mci_mip->mi_info.mi_addr_length;
1971 hlen = arh->arh_hlen;
1972 plen = arh->arh_plen;
1973 if ((hlen != 0 && hlen != maclen) ||
1974 plen != sizeof (ipaddr_t))
1975 goto fail;
1976
1977 arplen = sizeof (arh_t) + 2 * hlen + 2 * plen;
1978 if (start + arplen > end)
1979 goto fail;
1980
1981 shaddr = start + sizeof (arh_t);
1982 if (hlen != 0 &&
1983 bcmp(mcip->mci_unicast->ma_addr, shaddr, maclen) != 0)
1984 goto fail;
1985
1986 bcopy(shaddr + hlen, &spaddr, sizeof (spaddr));
1987 if (!ipnospoof_check_v4(mcip, protect, &spaddr))
1988 goto fail;
1989 break;
1990 }
1991 case ETHERTYPE_IPV6: {
1992 ip6_t *ip6h = (ip6_t *)start;
1993
1994 if (start + sizeof (ip6_t) > end)
1995 goto fail;
1996
1997 if (!ipnospoof_check_v6(mcip, protect, &ip6h->ip6_src))
1998 goto fail;
1999
2000 if (!ipnospoof_check_ndp(mcip, protect, ip6h, end))
2001 goto fail;
2002
2003 if (!intercept_dhcpv6_outbound(mcip, ip6h, end))
2004 goto fail;
2005 break;
2006 }
2007 }
2008 freemsg(nmp);
2009 return (0);
2010
2011 fail:
2012 freemsg(nmp);
2013 return (err);
2014 }
2015
2016 static boolean_t
2017 dhcpnospoof_check_cid(mac_protect_t *p, uchar_t *cid, uint_t cidlen)
2018 {
2019 int i;
2020
2021 for (i = 0; i < p->mp_cidcnt; i++) {
2022 mac_dhcpcid_t *dcid = &p->mp_cids[i];
2023
2024 if (dcid->dc_len == cidlen &&
2025 bcmp(dcid->dc_id, cid, cidlen) == 0)
2026 return (B_TRUE);
2027 }
2028 return (B_FALSE);
2029 }
2030
2031 static boolean_t
2032 dhcpnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *p,
2033 ipha_t *ipha, uchar_t *end)
2034 {
2035 struct dhcp *dh4;
2036 uchar_t *cid;
2037 uint_t maclen, cidlen = 0;
2038 uint8_t optlen;
2039 int err;
2040
2041 if ((err = get_dhcpv4_info(ipha, end, &dh4)) != 0)
2042 return (err == EINVAL);
2043
2044 maclen = mcip->mci_mip->mi_info.mi_addr_length;
2045 if (dh4->hlen == maclen &&
2046 bcmp(mcip->mci_unicast->ma_addr, dh4->chaddr, maclen) != 0) {
2047 return (B_FALSE);
2048 }
2049 if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &cid, &optlen) == 0)
2050 cidlen = optlen;
2051
2052 if (cidlen == 0)
2053 return (B_TRUE);
2054
2055 if (*cid == ARPHRD_ETHER && cidlen - 1 == maclen &&
2056 bcmp(mcip->mci_unicast->ma_addr, cid + 1, maclen) == 0)
2057 return (B_TRUE);
2058
2059 return (dhcpnospoof_check_cid(p, cid, cidlen));
2060 }
2061
2062 static boolean_t
2063 dhcpnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *p,
2064 ip6_t *ip6h, uchar_t *end)
2065 {
2066 dhcpv6_message_t *dh6;
2067 dhcpv6_option_t *d6o;
2068 uint8_t mtype;
2069 uchar_t *cid, *lladdr = NULL;
2070 uint_t cidlen, maclen, addrlen = 0;
2071 uint16_t cidtype;
2072 int err;
2073
2074 if ((err = get_dhcpv6_info(ip6h, end, &dh6)) != 0)
2075 return (err == EINVAL);
2076
2077 /*
2078 * We only check client-generated messages.
2079 */
2080 mtype = dh6->d6m_msg_type;
2081 if (mtype == DHCPV6_MSG_ADVERTISE || mtype == DHCPV6_MSG_REPLY ||
2082 mtype == DHCPV6_MSG_RECONFIGURE)
2083 return (B_TRUE);
2084
2085 d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
2086 DHCPV6_OPT_CLIENTID, &cidlen);
2087 if (d6o == NULL || (uchar_t *)d6o + cidlen > end)
2088 return (B_TRUE);
2089
2090 cid = (uchar_t *)&d6o[1];
2091 cidlen -= sizeof (*d6o);
2092 if (cidlen < sizeof (cidtype))
2093 return (B_TRUE);
2094
2095 bcopy(cid, &cidtype, sizeof (cidtype));
2096 cidtype = ntohs(cidtype);
2097 if (cidtype == DHCPV6_DUID_LLT && cidlen >= sizeof (duid_llt_t)) {
2098 lladdr = cid + sizeof (duid_llt_t);
2099 addrlen = cidlen - sizeof (duid_llt_t);
2100 }
2101 if (cidtype == DHCPV6_DUID_LL && cidlen >= sizeof (duid_ll_t)) {
2102 lladdr = cid + sizeof (duid_ll_t);
2103 addrlen = cidlen - sizeof (duid_ll_t);
2104 }
2105 maclen = mcip->mci_mip->mi_info.mi_addr_length;
2106 if (lladdr != NULL && addrlen == maclen &&
2107 bcmp(mcip->mci_unicast->ma_addr, lladdr, maclen) == 0) {
2108 return (B_TRUE);
2109 }
2110 return (dhcpnospoof_check_cid(p, cid, cidlen));
2111 }
2112
2113 /*
2114 * Enforce dhcp-nospoof protection.
2115 */
2116 static int
2117 dhcpnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
2118 mblk_t *mp, mac_header_info_t *mhip)
2119 {
2120 size_t hdrsize = mhip->mhi_hdrsize;
2121 uint32_t sap = mhip->mhi_bindsap;
2122 uchar_t *start, *end;
2123 mblk_t *nmp = NULL;
2124 int err;
2125
2126 err = get_l3_info(mp, hdrsize, &start, &end, &nmp);
2127 if (err != 0) {
2128 DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
2129 mblk_t *, mp);
2130 return (err);
2131 }
2132 err = EINVAL;
2133
2134 switch (sap) {
2135 case ETHERTYPE_IP: {
2136 ipha_t *ipha = (ipha_t *)start;
2137
2138 if (start + sizeof (ipha_t) > end)
2139 goto fail;
2140
2141 if (!dhcpnospoof_check_v4(mcip, protect, ipha, end))
2142 goto fail;
2143
2144 break;
2145 }
2146 case ETHERTYPE_IPV6: {
2147 ip6_t *ip6h = (ip6_t *)start;
2148
2149 if (start + sizeof (ip6_t) > end)
2150 goto fail;
2151
2152 if (!dhcpnospoof_check_v6(mcip, protect, ip6h, end))
2153 goto fail;
2154
2155 break;
2156 }
2157 }
2158 freemsg(nmp);
2159 return (0);
2160
2161 fail:
2162 /* increment dhcpnospoof stat here */
2163 freemsg(nmp);
2164 return (err);
2165 }
2166
2167 /*
2168 * This is called whenever the mac client's mac address changes, to make sure
2169 * we allow use of the new link-local address.
2170 */
2171 static void
2172 mac_protect_update_v6_local_addr(mac_client_impl_t *mcip)
2173 {
2174 uint_t i;
2175 in6_addr_t *token = &mcip->mci_v6_mac_token;
2176 in6_addr_t *v6addr = &mcip->mci_v6_local_addr;
2177 in6_addr_t ll_template = {{{ (uint32_t)V6_LINKLOCAL, 0, 0, 0 }}};
2178
2179 for (i = 0; i < 4; i++) {
2180 v6addr->s6_addr32[i] = token->s6_addr32[i] |
2181 ll_template.s6_addr32[i];
2182 }
2183 mcip->mci_protect_flags |= MPT_FLAG_V6_LOCAL_ADDR_SET;
2184 }
2185
2186 /*
2187 * This is called whenever the mac client's mac address changes, to make sure
2188 * that any existing addresses gained via SLAAC are appropriately updated.
2189 */
2190 static void
2191 mac_protect_update_v6_slaac_addr(mac_client_impl_t *mcip)
2192 {
2193 void *cookie = NULL;
2194 avl_tree_t temp_tree;
2195 avl_tree_t *ttp = &temp_tree, *sip = &mcip->mci_v6_slaac_ip;
2196 in6_addr_t *token = &mcip->mci_v6_mac_token;
2197 slaac_addr_t *addr = NULL;
2198
2199 avl_create(ttp, compare_slaac_ip, sizeof (slaac_addr_t),
2200 offsetof(slaac_addr_t, sla_node));
2201
2202 /* Copy everything over to the temporary tree, and fix the IP address */
2203 while ((addr = avl_destroy_nodes(sip, &cookie)) != NULL) {
2204 VERIFY(insert_slaac_ip(ttp, token, addr) == B_TRUE);
2205 }
2206
2207 /*
2208 * Now that the tempory tree has all of the modified addresses, we can
2209 * swap them over to the original tree once it's reset.
2210 */
2211 avl_destroy(sip);
2212 avl_create(sip, compare_slaac_ip, sizeof (slaac_addr_t),
2213 offsetof(slaac_addr_t, sla_node));
2214 avl_swap(ttp, sip);
2215 }
2216
2217 /*
2218 * After the unicast MAC address changes, we need to update the derived token,
2219 * and update the IPv6 addresses that use the token.
2220 */
2221 void
2222 mac_protect_update_mac_token(mac_client_impl_t *mcip)
2223 {
2224 uint_t media = mcip->mci_mip->mi_info.mi_media;
2225 uint8_t *p, *macaddr = mcip->mci_unicast->ma_addr;
2226 in6_addr_t *token = &mcip->mci_v6_mac_token;
2227
2228 bzero(token, sizeof (in6_addr_t));
2229 p = (uint8_t *)&token->s6_addr32[2];
2230
2231 switch (media) {
2232 case DL_ETHER:
2233 bcopy(macaddr, p, 3);
2234 p[0] ^= 0x2;
2235 p[3] = 0xff;
2236 p[4] = 0xfe;
2237 bcopy(macaddr + 3, p + 5, 3);
2238 break;
2239 case DL_IB:
2240 ASSERT(mcip->mci_mip->mi_info.mi_addr_length == 20);
2241 bcopy(macaddr + 12, p, 8);
2242 p[0] |= 2;
2243 break;
2244 default:
2245 /*
2246 * We do not need to generate the local address for link types
2247 * that do not support link protection. Wifi pretends to be
2248 * Ethernet so it is covered by the DL_ETHER case (note the
2249 * use of mi_media instead of mi_nativemedia).
2250 */
2251 return;
2252 }
2253
2254 mac_protect_update_v6_local_addr(mcip);
2255 mac_protect_update_v6_slaac_addr(mcip);
2256 }
2257
2258
2259
2260 /*
2261 * Enforce link protection on one packet.
2262 */
2263 static int
2264 mac_protect_check_one(mac_client_impl_t *mcip, mblk_t *mp)
2265 {
2266 mac_impl_t *mip = mcip->mci_mip;
2267 mac_resource_props_t *mrp = MCIP_RESOURCE_PROPS(mcip);
2268 mac_protect_t *protect;
2269 mac_header_info_t mhi;
2270 uint32_t types;
2271 int err;
2272
2273 ASSERT(mp->b_next == NULL);
2274 ASSERT(mrp != NULL);
2275
2276 err = mac_vlan_header_info((mac_handle_t)mip, mp, &mhi);
2277 if (err != 0) {
2278 DTRACE_PROBE2(invalid__header, mac_client_impl_t *, mcip,
2279 mblk_t *, mp);
2280 return (err);
2281 }
2282 protect = &mrp->mrp_protect;
2283 types = protect->mp_types;
2284
2285 if ((types & MPT_MACNOSPOOF) != 0) {
2286 if (mhi.mhi_saddr != NULL &&
2287 bcmp(mcip->mci_unicast->ma_addr, mhi.mhi_saddr,
2288 mip->mi_info.mi_addr_length) != 0) {
2289 BUMP_STAT(mcip, macspoofed);
2290 DTRACE_PROBE2(mac__nospoof__fail,
2291 mac_client_impl_t *, mcip, mblk_t *, mp);
2292 return (EINVAL);
2293 }
2294 }
2295 if ((types & MPT_RESTRICTED) != 0) {
2296 uint32_t vid = VLAN_ID(mhi.mhi_tci);
2297 uint32_t sap = mhi.mhi_bindsap;
2298
2299 /*
2300 * ETHERTYPE_VLAN packets are allowed through, provided that
2301 * the vid is not spoofed.
2302 */
2303 if (vid != 0 && !mac_client_check_flow_vid(mcip, vid)) {
2304 BUMP_STAT(mcip, restricted);
2305 DTRACE_PROBE2(restricted__vid__invalid,
2306 mac_client_impl_t *, mcip, mblk_t *, mp);
2307 return (EINVAL);
2308 }
2309
2310 if (sap != ETHERTYPE_IP && sap != ETHERTYPE_IPV6 &&
2311 sap != ETHERTYPE_ARP) {
2312 BUMP_STAT(mcip, restricted);
2313 DTRACE_PROBE2(restricted__fail,
2314 mac_client_impl_t *, mcip, mblk_t *, mp);
2315 return (EINVAL);
2316 }
2317 }
2318 if ((types & MPT_IPNOSPOOF) != 0) {
2319 if ((err = ipnospoof_check(mcip, protect, mp, &mhi)) != 0) {
2320 BUMP_STAT(mcip, ipspoofed);
2321 DTRACE_PROBE2(ip__nospoof__fail,
2322 mac_client_impl_t *, mcip, mblk_t *, mp);
2323 return (err);
2324 }
2325 }
2326 if ((types & MPT_DHCPNOSPOOF) != 0) {
2327 if ((err = dhcpnospoof_check(mcip, protect, mp, &mhi)) != 0) {
2328 BUMP_STAT(mcip, dhcpspoofed);
2329 DTRACE_PROBE2(dhcp__nospoof__fail,
2330 mac_client_impl_t *, mcip, mblk_t *, mp);
2331 return (err);
2332 }
2333 }
2334 return (0);
2335 }
2336
2337 /*
2338 * Enforce link protection on a packet chain.
2339 * Packets that pass the checks are returned back to the caller.
2340 */
2341 mblk_t *
2342 mac_protect_check(mac_client_handle_t mch, mblk_t *mp)
2343 {
2344 mac_client_impl_t *mcip = (mac_client_impl_t *)mch;
2345 mblk_t *ret_mp = NULL, **tailp = &ret_mp, *next;
2346
2347 /*
2348 * Skip checks if we are part of an aggr.
2349 */
2350 if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
2351 return (mp);
2352
2353 for (; mp != NULL; mp = next) {
2354 next = mp->b_next;
2355 mp->b_next = NULL;
2356
2357 if (mac_protect_check_one(mcip, mp) == 0) {
2358 *tailp = mp;
2359 tailp = &mp->b_next;
2360 } else {
2361 freemsg(mp);
2362 }
2363 }
2364 return (ret_mp);
2365 }
2366
2367 /*
2368 * Check if a particular protection type is enabled.
2369 */
2370 boolean_t
2371 mac_protect_enabled(mac_client_handle_t mch, uint32_t type)
2372 {
2373 return (MAC_PROTECT_ENABLED((mac_client_impl_t *)mch, type));
2374 }
2375
2376 static int
2377 validate_ips(mac_protect_t *p)
2378 {
2379 uint_t i, j;
2380
2381 if (p->mp_ipaddrcnt == MPT_RESET)
2382 return (0);
2383
2384 if (p->mp_ipaddrcnt > MPT_MAXIPADDR)
2385 return (EINVAL);
2386
2387 for (i = 0; i < p->mp_ipaddrcnt; i++) {
2388 mac_ipaddr_t *addr = &p->mp_ipaddrs[i];
2389
2390 /*
2391 * The unspecified address is implicitly allowed so there's no
2392 * need to add it to the list. Also, validate that the netmask,
2393 * if any, is sane for the specific version of IP. A mask of
2394 * some kind is always required.
2395 */
2396 if (addr->ip_netmask == 0)
2397 return (EINVAL);
2398
2399 if (addr->ip_version == IPV4_VERSION) {
2400 if (V4_PART_OF_V6(addr->ip_addr) == INADDR_ANY)
2401 return (EINVAL);
2402 if (addr->ip_netmask > 32)
2403 return (EINVAL);
2404 } else if (addr->ip_version == IPV6_VERSION) {
2405 if (IN6_IS_ADDR_UNSPECIFIED(&addr->ip_addr))
2406 return (EINVAL);
2407
2408 if (IN6_IS_ADDR_V4MAPPED_ANY(&addr->ip_addr))
2409 return (EINVAL);
2410
2411 if (addr->ip_netmask > 128)
2412 return (EINVAL);
2413 } else {
2414 /* invalid ip version */
2415 return (EINVAL);
2416 }
2417
2418 for (j = 0; j < p->mp_ipaddrcnt; j++) {
2419 mac_ipaddr_t *addr1 = &p->mp_ipaddrs[j];
2420
2421 if (i == j || addr->ip_version != addr1->ip_version)
2422 continue;
2423
2424 /* found a duplicate */
2425 if ((addr->ip_version == IPV4_VERSION &&
2426 V4_PART_OF_V6(addr->ip_addr) ==
2427 V4_PART_OF_V6(addr1->ip_addr)) ||
2428 IN6_ARE_ADDR_EQUAL(&addr->ip_addr,
2429 &addr1->ip_addr))
2430 return (EINVAL);
2431 }
2432 }
2433 return (0);
2434 }
2435
2436 /* ARGSUSED */
2437 static int
2438 validate_cids(mac_protect_t *p)
2439 {
2440 uint_t i, j;
2441
2442 if (p->mp_cidcnt == MPT_RESET)
2443 return (0);
2444
2445 if (p->mp_cidcnt > MPT_MAXCID)
2446 return (EINVAL);
2447
2448 for (i = 0; i < p->mp_cidcnt; i++) {
2449 mac_dhcpcid_t *cid = &p->mp_cids[i];
2450
2451 if (cid->dc_len > MPT_MAXCIDLEN ||
2452 (cid->dc_form != CIDFORM_TYPED &&
2453 cid->dc_form != CIDFORM_HEX &&
2454 cid->dc_form != CIDFORM_STR))
2455 return (EINVAL);
2456
2457 for (j = 0; j < p->mp_cidcnt; j++) {
2458 mac_dhcpcid_t *cid1 = &p->mp_cids[j];
2459
2460 if (i == j || cid->dc_len != cid1->dc_len)
2461 continue;
2462
2463 /* found a duplicate */
2464 if (bcmp(cid->dc_id, cid1->dc_id, cid->dc_len) == 0)
2465 return (EINVAL);
2466 }
2467 }
2468 return (0);
2469 }
2470
2471 /*
2472 * Sanity-checks parameters given by userland.
2473 */
2474 int
2475 mac_protect_validate(mac_resource_props_t *mrp)
2476 {
2477 mac_protect_t *p = &mrp->mrp_protect;
2478 int err;
2479
2480 /* check for invalid types */
2481 if (p->mp_types != MPT_RESET && (p->mp_types & ~MPT_ALL) != 0)
2482 return (EINVAL);
2483
2484 if ((err = validate_ips(p)) != 0)
2485 return (err);
2486
2487 if ((err = validate_cids(p)) != 0)
2488 return (err);
2489
2490 return (0);
2491 }
2492
2493 /*
2494 * Enable/disable link protection.
2495 */
2496 int
2497 mac_protect_set(mac_client_handle_t mch, mac_resource_props_t *mrp)
2498 {
2499 mac_client_impl_t *mcip = (mac_client_impl_t *)mch;
2500 mac_impl_t *mip = mcip->mci_mip;
2501 uint_t media = mip->mi_info.mi_nativemedia;
2502 int err;
2503
2504 ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));
2505
2506 /* tunnels are not supported */
2507 if (media == DL_IPV4 || media == DL_IPV6 || media == DL_6TO4)
2508 return (ENOTSUP);
2509
2510 if ((err = mac_protect_validate(mrp)) != 0)
2511 return (err);
2512
2513 if (err != 0)
2514 return (err);
2515
2516 mac_update_resources(mrp, MCIP_RESOURCE_PROPS(mcip), B_FALSE);
2517 i_mac_notify(((mcip->mci_state_flags & MCIS_IS_VNIC) != 0 ?
2518 mcip->mci_upper_mip : mip), MAC_NOTE_ALLOWED_IPS);
2519 return (0);
2520 }
2521
2522 void
2523 mac_protect_update(mac_resource_props_t *new, mac_resource_props_t *curr)
2524 {
2525 mac_protect_t *np = &new->mrp_protect;
2526 mac_protect_t *cp = &curr->mrp_protect;
2527 uint32_t types = np->mp_types;
2528
2529 if (types == MPT_RESET) {
2530 cp->mp_types = 0;
2531 curr->mrp_mask &= ~MRP_PROTECT;
2532 } else {
2533 if (types != 0) {
2534 cp->mp_types = types;
2535 curr->mrp_mask |= MRP_PROTECT;
2536 }
2537 }
2538 if (np->mp_ipaddrcnt != 0) {
2539 if (np->mp_ipaddrcnt <= MPT_MAXIPADDR) {
2540 bcopy(np->mp_ipaddrs, cp->mp_ipaddrs,
2541 sizeof (cp->mp_ipaddrs));
2542 cp->mp_ipaddrcnt = np->mp_ipaddrcnt;
2543 } else if (np->mp_ipaddrcnt == MPT_RESET) {
2544 bzero(cp->mp_ipaddrs, sizeof (cp->mp_ipaddrs));
2545 cp->mp_ipaddrcnt = 0;
2546 }
2547 }
2548 if (np->mp_cidcnt != 0) {
2549 if (np->mp_cidcnt <= MPT_MAXCID) {
2550 bcopy(np->mp_cids, cp->mp_cids, sizeof (cp->mp_cids));
2551 cp->mp_cidcnt = np->mp_cidcnt;
2552 } else if (np->mp_cidcnt == MPT_RESET) {
2553 bzero(cp->mp_cids, sizeof (cp->mp_cids));
2554 cp->mp_cidcnt = 0;
2555 }
2556 }
2557 }
2558
2559 void
2560 mac_protect_init(mac_client_impl_t *mcip)
2561 {
2562 mutex_init(&mcip->mci_protect_lock, NULL, MUTEX_DRIVER, NULL);
2563 mcip->mci_protect_flags = 0;
2564 mcip->mci_txn_cleanup_tid = 0;
2565 avl_create(&mcip->mci_v4_pending_txn, compare_dhcpv4_xid,
2566 sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_node));
2567 avl_create(&mcip->mci_v4_completed_txn, compare_dhcpv4_cid,
2568 sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_node));
2569 avl_create(&mcip->mci_v4_dyn_ip, compare_dhcpv4_ip,
2570 sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_ipnode));
2571 avl_create(&mcip->mci_v6_pending_txn, compare_dhcpv6_xid,
2572 sizeof (dhcpv6_txn_t), offsetof(dhcpv6_txn_t, dt_node));
2573 avl_create(&mcip->mci_v6_cid, compare_dhcpv6_cid,
2574 sizeof (dhcpv6_cid_t), offsetof(dhcpv6_cid_t, dc_node));
2575 avl_create(&mcip->mci_v6_dyn_ip, compare_dhcpv6_ip,
2576 sizeof (dhcpv6_addr_t), offsetof(dhcpv6_addr_t, da_node));
2577 avl_create(&mcip->mci_v6_slaac_ip, compare_slaac_ip,
2578 sizeof (slaac_addr_t), offsetof(slaac_addr_t, sla_node));
2579 }
2580
2581 void
2582 mac_protect_fini(mac_client_impl_t *mcip)
2583 {
2584 avl_destroy(&mcip->mci_v6_dyn_ip);
2585 avl_destroy(&mcip->mci_v6_cid);
2586 avl_destroy(&mcip->mci_v6_pending_txn);
2587 avl_destroy(&mcip->mci_v4_dyn_ip);
2588 avl_destroy(&mcip->mci_v4_completed_txn);
2589 avl_destroy(&mcip->mci_v4_pending_txn);
2590 avl_destroy(&mcip->mci_v6_slaac_ip);
2591 mcip->mci_txn_cleanup_tid = 0;
2592 mcip->mci_protect_flags = 0;
2593 mutex_destroy(&mcip->mci_protect_lock);
2594 }
2595
2596 static boolean_t
2597 allowed_ips_set(mac_resource_props_t *mrp, uint32_t af)
2598 {
2599 int i;
2600
2601 for (i = 0; i < mrp->mrp_protect.mp_ipaddrcnt; i++) {
2602 if (mrp->mrp_protect.mp_ipaddrs[i].ip_version == af)
2603 return (B_TRUE);
2604 }
2605 return (B_FALSE);
2606 }
2607
2608 mac_protect_t *
2609 mac_protect_get(mac_handle_t mh)
2610 {
2611 mac_impl_t *mip = (mac_impl_t *)mh;
2612
2613 return (&mip->mi_resource_props.mrp_protect);
2614 }