1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2013 by Delphix. All rights reserved. 24 */ 25 /* Copyright (c) 1990 Mentat Inc. */ 26 27 #include <sys/types.h> 28 #include <sys/stream.h> 29 #include <sys/stropts.h> 30 #include <sys/strlog.h> 31 #include <sys/strsun.h> 32 #define _SUN_TPI_VERSION 2 33 #include <sys/tihdr.h> 34 #include <sys/timod.h> 35 #include <sys/ddi.h> 36 #include <sys/sunddi.h> 37 #include <sys/strsubr.h> 38 #include <sys/suntpi.h> 39 #include <sys/xti_inet.h> 40 #include <sys/cmn_err.h> 41 #include <sys/kmem.h> 42 #include <sys/cred.h> 43 #include <sys/policy.h> 44 #include <sys/priv.h> 45 #include <sys/ucred.h> 46 #include <sys/zone.h> 47 48 #include <sys/sockio.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/vtrace.h> 52 #include <sys/sdt.h> 53 #include <sys/debug.h> 54 #include <sys/isa_defs.h> 55 #include <sys/random.h> 56 #include <netinet/in.h> 57 #include <netinet/ip6.h> 58 #include <netinet/icmp6.h> 59 #include <netinet/udp.h> 60 61 #include <inet/common.h> 62 #include <inet/ip.h> 63 #include <inet/ip_impl.h> 64 #include <inet/ipsec_impl.h> 65 #include <inet/ip6.h> 66 #include <inet/ip_ire.h> 67 #include <inet/ip_if.h> 68 #include <inet/ip_multi.h> 69 #include <inet/ip_ndp.h> 70 #include <inet/proto_set.h> 71 #include <inet/mib2.h> 72 #include <inet/nd.h> 73 #include <inet/optcom.h> 74 #include <inet/snmpcom.h> 75 #include <inet/kstatcom.h> 76 #include <inet/ipclassifier.h> 77 78 #include <sys/tsol/label.h> 79 #include <sys/tsol/tnet.h> 80 81 #include <inet/rawip_impl.h> 82 83 #include <sys/disp.h> 84 85 /* 86 * Synchronization notes: 87 * 88 * RAWIP is MT and uses the usual kernel synchronization primitives. We use 89 * conn_lock to protect the icmp_t. 90 * 91 * Plumbing notes: 92 * ICMP is always a device driver. For compatibility with mibopen() code 93 * it is possible to I_PUSH "icmp", but that results in pushing a passthrough 94 * dummy module. 95 */ 96 static void icmp_addr_req(queue_t *q, mblk_t *mp); 97 static void icmp_tpi_bind(queue_t *q, mblk_t *mp); 98 static void icmp_bind_proto(icmp_t *icmp); 99 static int icmp_build_hdr_template(conn_t *, const in6_addr_t *, 100 const in6_addr_t *, uint32_t); 101 static void icmp_capability_req(queue_t *q, mblk_t *mp); 102 static int icmp_close(queue_t *q, int flags); 103 static void icmp_close_free(conn_t *); 104 static void icmp_tpi_connect(queue_t *q, mblk_t *mp); 105 static void icmp_tpi_disconnect(queue_t *q, mblk_t *mp); 106 static void icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, 107 int sys_error); 108 static void icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 109 t_scalar_t tlierr, int sys_error); 110 static void icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, 111 ip_recv_attr_t *); 112 static void icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, 113 ip_recv_attr_t *); 114 static void icmp_info_req(queue_t *q, mblk_t *mp); 115 static void icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *); 116 static conn_t *icmp_open(int family, cred_t *credp, int *err, int flags); 117 static int icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, 118 cred_t *credp); 119 static int icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, 120 cred_t *credp); 121 static boolean_t icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name); 122 int icmp_opt_set(conn_t *connp, uint_t optset_context, 123 int level, int name, uint_t inlen, 124 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 125 void *thisdg_attrs, cred_t *cr); 126 int icmp_opt_get(conn_t *connp, int level, int name, 127 uchar_t *ptr); 128 static int icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, 129 sin6_t *sin6, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa); 130 static mblk_t *icmp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *, 131 const in6_addr_t *, const in6_addr_t *, uint32_t, mblk_t *, int *); 132 static mblk_t *icmp_prepend_header_template(conn_t *, ip_xmit_attr_t *, 133 mblk_t *, const in6_addr_t *, uint32_t, int *); 134 static int icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 135 uchar_t *ptr, int len); 136 static void icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err); 137 static void icmp_tpi_unbind(queue_t *q, mblk_t *mp); 138 static void icmp_wput(queue_t *q, mblk_t *mp); 139 static void icmp_wput_fallback(queue_t *q, mblk_t *mp); 140 static void icmp_wput_other(queue_t *q, mblk_t *mp); 141 static void icmp_wput_iocdata(queue_t *q, mblk_t *mp); 142 static void icmp_wput_restricted(queue_t *q, mblk_t *mp); 143 static void icmp_ulp_recv(conn_t *, mblk_t *, uint_t); 144 145 static void *rawip_stack_init(netstackid_t stackid, netstack_t *ns); 146 static void rawip_stack_fini(netstackid_t stackid, void *arg); 147 148 static void *rawip_kstat_init(netstackid_t stackid); 149 static void rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp); 150 static int rawip_kstat_update(kstat_t *kp, int rw); 151 static void rawip_stack_shutdown(netstackid_t stackid, void *arg); 152 153 /* Common routines for TPI and socket module */ 154 static conn_t *rawip_do_open(int, cred_t *, int *, int); 155 static void rawip_do_close(conn_t *); 156 static int rawip_do_bind(conn_t *, struct sockaddr *, socklen_t); 157 static int rawip_do_unbind(conn_t *); 158 static int rawip_do_connect(conn_t *, const struct sockaddr *, socklen_t, 159 cred_t *, pid_t); 160 161 int rawip_getsockname(sock_lower_handle_t, struct sockaddr *, 162 socklen_t *, cred_t *); 163 int rawip_getpeername(sock_lower_handle_t, struct sockaddr *, 164 socklen_t *, cred_t *); 165 166 static struct module_info icmp_mod_info = { 167 5707, "icmp", 1, INFPSZ, 512, 128 168 }; 169 170 /* 171 * Entry points for ICMP as a device. 172 * We have separate open functions for the /dev/icmp and /dev/icmp6 devices. 173 */ 174 static struct qinit icmprinitv4 = { 175 NULL, NULL, icmp_openv4, icmp_close, NULL, &icmp_mod_info 176 }; 177 178 static struct qinit icmprinitv6 = { 179 NULL, NULL, icmp_openv6, icmp_close, NULL, &icmp_mod_info 180 }; 181 182 static struct qinit icmpwinit = { 183 (pfi_t)icmp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &icmp_mod_info 184 }; 185 186 /* ICMP entry point during fallback */ 187 static struct qinit icmp_fallback_sock_winit = { 188 (pfi_t)icmp_wput_fallback, NULL, NULL, NULL, NULL, &icmp_mod_info 189 }; 190 191 /* For AF_INET aka /dev/icmp */ 192 struct streamtab icmpinfov4 = { 193 &icmprinitv4, &icmpwinit 194 }; 195 196 /* For AF_INET6 aka /dev/icmp6 */ 197 struct streamtab icmpinfov6 = { 198 &icmprinitv6, &icmpwinit 199 }; 200 201 /* Default structure copied into T_INFO_ACK messages */ 202 static struct T_info_ack icmp_g_t_info_ack = { 203 T_INFO_ACK, 204 IP_MAXPACKET, /* TSDU_size. icmp allows maximum size messages. */ 205 T_INVALID, /* ETSDU_size. icmp does not support expedited data. */ 206 T_INVALID, /* CDATA_size. icmp does not support connect data. */ 207 T_INVALID, /* DDATA_size. icmp does not support disconnect data. */ 208 0, /* ADDR_size - filled in later. */ 209 0, /* OPT_size - not initialized here */ 210 IP_MAXPACKET, /* TIDU_size. icmp allows maximum size messages. */ 211 T_CLTS, /* SERV_type. icmp supports connection-less. */ 212 TS_UNBND, /* CURRENT_state. This is set from icmp_state. */ 213 (XPG4_1|SENDZERO) /* PROVIDER_flag */ 214 }; 215 216 static int 217 icmp_set_buf_prop(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo, 218 const char *ifname, const void *pval, uint_t flags) 219 { 220 return (mod_set_buf_prop(stack->netstack_icmp->is_propinfo_tbl, 221 stack, cr, pinfo, ifname, pval, flags)); 222 } 223 224 static int 225 icmp_get_buf_prop(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname, 226 void *val, uint_t psize, uint_t flags) 227 { 228 return (mod_get_buf_prop(stack->netstack_icmp->is_propinfo_tbl, stack, 229 pinfo, ifname, val, psize, flags)); 230 } 231 232 /* 233 * All of these are alterable, within the min/max values given, at run time. 234 * 235 * Note: All those tunables which do not start with "icmp_" are Committed and 236 * therefore are public. See PSARC 2010/080. 237 */ 238 static mod_prop_info_t icmp_propinfo_tbl[] = { 239 /* tunable - 0 */ 240 { "_wroff_extra", MOD_PROTO_RAWIP, 241 mod_set_uint32, mod_get_uint32, 242 {0, 128, 32}, {32} }, 243 244 { "_ipv4_ttl", MOD_PROTO_RAWIP, 245 mod_set_uint32, mod_get_uint32, 246 {1, 255, 255}, {255} }, 247 248 { "_ipv6_hoplimit", MOD_PROTO_RAWIP, 249 mod_set_uint32, mod_get_uint32, 250 {0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS}, 251 {IPV6_DEFAULT_HOPS} }, 252 253 { "_bsd_compat", MOD_PROTO_RAWIP, 254 mod_set_boolean, mod_get_boolean, 255 {B_TRUE}, {B_TRUE} }, 256 257 { "send_buf", MOD_PROTO_RAWIP, 258 icmp_set_buf_prop, icmp_get_buf_prop, 259 {4096, 65536, 8192}, {8192} }, 260 261 { "_xmit_lowat", MOD_PROTO_RAWIP, 262 mod_set_uint32, mod_get_uint32, 263 {0, 65536, 1024}, {1024} }, 264 265 { "recv_buf", MOD_PROTO_RAWIP, 266 icmp_set_buf_prop, icmp_get_buf_prop, 267 {4096, 65536, 8192}, {8192} }, 268 269 { "max_buf", MOD_PROTO_RAWIP, 270 mod_set_uint32, mod_get_uint32, 271 {65536, ULP_MAX_BUF, 256*1024}, {256*1024} }, 272 273 { "_pmtu_discovery", MOD_PROTO_RAWIP, 274 mod_set_boolean, mod_get_boolean, 275 {B_FALSE}, {B_FALSE} }, 276 277 { "_sendto_ignerr", MOD_PROTO_RAWIP, 278 mod_set_boolean, mod_get_boolean, 279 {B_FALSE}, {B_FALSE} }, 280 281 { "?", MOD_PROTO_RAWIP, NULL, mod_get_allprop, {0}, {0} }, 282 283 { NULL, 0, NULL, NULL, {0}, {0} } 284 }; 285 286 #define is_wroff_extra is_propinfo_tbl[0].prop_cur_uval 287 #define is_ipv4_ttl is_propinfo_tbl[1].prop_cur_uval 288 #define is_ipv6_hoplimit is_propinfo_tbl[2].prop_cur_uval 289 #define is_bsd_compat is_propinfo_tbl[3].prop_cur_bval 290 #define is_xmit_hiwat is_propinfo_tbl[4].prop_cur_uval 291 #define is_xmit_lowat is_propinfo_tbl[5].prop_cur_uval 292 #define is_recv_hiwat is_propinfo_tbl[6].prop_cur_uval 293 #define is_max_buf is_propinfo_tbl[7].prop_cur_uval 294 #define is_pmtu_discovery is_propinfo_tbl[8].prop_cur_bval 295 #define is_sendto_ignerr is_propinfo_tbl[9].prop_cur_bval 296 297 typedef union T_primitives *t_primp_t; 298 299 /* 300 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message 301 * passed to icmp_wput. 302 * It calls IP to verify the local IP address, and calls IP to insert 303 * the conn_t in the fanout table. 304 * If everything is ok it then sends the T_BIND_ACK back up. 305 */ 306 static void 307 icmp_tpi_bind(queue_t *q, mblk_t *mp) 308 { 309 int error; 310 struct sockaddr *sa; 311 struct T_bind_req *tbr; 312 socklen_t len; 313 sin_t *sin; 314 sin6_t *sin6; 315 icmp_t *icmp; 316 conn_t *connp = Q_TO_CONN(q); 317 mblk_t *mp1; 318 cred_t *cr; 319 320 /* 321 * All Solaris components should pass a db_credp 322 * for this TPI message, hence we ASSERT. 323 * But in case there is some other M_PROTO that looks 324 * like a TPI message sent by some other kernel 325 * component, we check and return an error. 326 */ 327 cr = msg_getcred(mp, NULL); 328 ASSERT(cr != NULL); 329 if (cr == NULL) { 330 icmp_err_ack(q, mp, TSYSERR, EINVAL); 331 return; 332 } 333 334 icmp = connp->conn_icmp; 335 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 336 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 337 "icmp_bind: bad req, len %u", 338 (uint_t)(mp->b_wptr - mp->b_rptr)); 339 icmp_err_ack(q, mp, TPROTO, 0); 340 return; 341 } 342 343 if (icmp->icmp_state != TS_UNBND) { 344 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 345 "icmp_bind: bad state, %u", icmp->icmp_state); 346 icmp_err_ack(q, mp, TOUTSTATE, 0); 347 return; 348 } 349 350 /* 351 * Reallocate the message to make sure we have enough room for an 352 * address. 353 */ 354 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1); 355 if (mp1 == NULL) { 356 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 357 return; 358 } 359 mp = mp1; 360 361 /* Reset the message type in preparation for shipping it back. */ 362 DB_TYPE(mp) = M_PCPROTO; 363 tbr = (struct T_bind_req *)mp->b_rptr; 364 len = tbr->ADDR_length; 365 switch (len) { 366 case 0: /* request for a generic port */ 367 tbr->ADDR_offset = sizeof (struct T_bind_req); 368 if (connp->conn_family == AF_INET) { 369 tbr->ADDR_length = sizeof (sin_t); 370 sin = (sin_t *)&tbr[1]; 371 *sin = sin_null; 372 sin->sin_family = AF_INET; 373 mp->b_wptr = (uchar_t *)&sin[1]; 374 sa = (struct sockaddr *)sin; 375 len = sizeof (sin_t); 376 } else { 377 ASSERT(connp->conn_family == AF_INET6); 378 tbr->ADDR_length = sizeof (sin6_t); 379 sin6 = (sin6_t *)&tbr[1]; 380 *sin6 = sin6_null; 381 sin6->sin6_family = AF_INET6; 382 mp->b_wptr = (uchar_t *)&sin6[1]; 383 sa = (struct sockaddr *)sin6; 384 len = sizeof (sin6_t); 385 } 386 break; 387 388 case sizeof (sin_t): /* Complete IPv4 address */ 389 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset, 390 sizeof (sin_t)); 391 break; 392 393 case sizeof (sin6_t): /* Complete IPv6 address */ 394 sa = (struct sockaddr *)mi_offset_param(mp, 395 tbr->ADDR_offset, sizeof (sin6_t)); 396 break; 397 398 default: 399 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 400 "icmp_bind: bad ADDR_length %u", tbr->ADDR_length); 401 icmp_err_ack(q, mp, TBADADDR, 0); 402 return; 403 } 404 405 error = rawip_do_bind(connp, sa, len); 406 if (error != 0) { 407 if (error > 0) { 408 icmp_err_ack(q, mp, TSYSERR, error); 409 } else { 410 icmp_err_ack(q, mp, -error, 0); 411 } 412 } else { 413 tbr->PRIM_type = T_BIND_ACK; 414 qreply(q, mp); 415 } 416 } 417 418 static int 419 rawip_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len) 420 { 421 sin_t *sin; 422 sin6_t *sin6; 423 icmp_t *icmp = connp->conn_icmp; 424 int error = 0; 425 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */ 426 in_port_t lport; /* Network byte order */ 427 ipaddr_t v4src; /* Set if AF_INET */ 428 in6_addr_t v6src; 429 uint_t scopeid = 0; 430 zoneid_t zoneid = IPCL_ZONEID(connp); 431 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 432 433 if (sa == NULL || !OK_32PTR((char *)sa)) { 434 return (EINVAL); 435 } 436 437 switch (len) { 438 case sizeof (sin_t): /* Complete IPv4 address */ 439 sin = (sin_t *)sa; 440 if (sin->sin_family != AF_INET || 441 connp->conn_family != AF_INET) { 442 /* TSYSERR, EAFNOSUPPORT */ 443 return (EAFNOSUPPORT); 444 } 445 v4src = sin->sin_addr.s_addr; 446 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src); 447 if (v4src != INADDR_ANY) { 448 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst, 449 B_TRUE); 450 } 451 lport = sin->sin_port; 452 break; 453 case sizeof (sin6_t): /* Complete IPv6 address */ 454 sin6 = (sin6_t *)sa; 455 if (sin6->sin6_family != AF_INET6 || 456 connp->conn_family != AF_INET6) { 457 /* TSYSERR, EAFNOSUPPORT */ 458 return (EAFNOSUPPORT); 459 } 460 /* No support for mapped addresses on raw sockets */ 461 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 462 /* TSYSERR, EADDRNOTAVAIL */ 463 return (EADDRNOTAVAIL); 464 } 465 v6src = sin6->sin6_addr; 466 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 467 if (IN6_IS_ADDR_LINKSCOPE(&v6src)) 468 scopeid = sin6->sin6_scope_id; 469 laddr_type = ip_laddr_verify_v6(&v6src, zoneid, ipst, 470 B_TRUE, scopeid); 471 } 472 lport = sin6->sin6_port; 473 break; 474 475 default: 476 /* TBADADDR */ 477 return (EADDRNOTAVAIL); 478 } 479 480 /* Is the local address a valid unicast, multicast, or broadcast? */ 481 if (laddr_type == IPVL_BAD) 482 return (EADDRNOTAVAIL); 483 484 /* 485 * The state must be TS_UNBND. 486 */ 487 mutex_enter(&connp->conn_lock); 488 if (icmp->icmp_state != TS_UNBND) { 489 mutex_exit(&connp->conn_lock); 490 return (-TOUTSTATE); 491 } 492 493 /* 494 * Copy the source address into our icmp structure. This address 495 * may still be zero; if so, ip will fill in the correct address 496 * each time an outbound packet is passed to it. 497 * If we are binding to a broadcast or multicast address then 498 * we just set the conn_bound_addr since we don't want to use 499 * that as the source address when sending. 500 */ 501 connp->conn_bound_addr_v6 = v6src; 502 connp->conn_laddr_v6 = v6src; 503 if (scopeid != 0) { 504 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 505 connp->conn_ixa->ixa_scopeid = scopeid; 506 connp->conn_incoming_ifindex = scopeid; 507 } else { 508 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 509 connp->conn_incoming_ifindex = connp->conn_bound_if; 510 } 511 512 switch (laddr_type) { 513 case IPVL_UNICAST_UP: 514 case IPVL_UNICAST_DOWN: 515 connp->conn_saddr_v6 = v6src; 516 connp->conn_mcbc_bind = B_FALSE; 517 break; 518 case IPVL_MCAST: 519 case IPVL_BCAST: 520 /* ip_set_destination will pick a source address later */ 521 connp->conn_saddr_v6 = ipv6_all_zeros; 522 connp->conn_mcbc_bind = B_TRUE; 523 break; 524 } 525 526 /* Any errors after this point should use late_error */ 527 528 /* 529 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 530 * with IPPROTO_TCP. 531 */ 532 connp->conn_lport = lport; 533 connp->conn_fport = 0; 534 535 if (connp->conn_family == AF_INET) { 536 ASSERT(connp->conn_ipversion == IPV4_VERSION); 537 } else { 538 ASSERT(connp->conn_ipversion == IPV6_VERSION); 539 } 540 541 icmp->icmp_state = TS_IDLE; 542 543 /* 544 * We create an initial header template here to make a subsequent 545 * sendto have a starting point. Since conn_last_dst is zero the 546 * first sendto will always follow the 'dst changed' code path. 547 * Note that we defer massaging options and the related checksum 548 * adjustment until we have a destination address. 549 */ 550 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 551 &connp->conn_faddr_v6, connp->conn_flowinfo); 552 if (error != 0) { 553 mutex_exit(&connp->conn_lock); 554 goto late_error; 555 } 556 /* Just in case */ 557 connp->conn_faddr_v6 = ipv6_all_zeros; 558 connp->conn_v6lastdst = ipv6_all_zeros; 559 mutex_exit(&connp->conn_lock); 560 561 error = ip_laddr_fanout_insert(connp); 562 if (error != 0) 563 goto late_error; 564 565 /* Bind succeeded */ 566 return (0); 567 568 late_error: 569 mutex_enter(&connp->conn_lock); 570 connp->conn_saddr_v6 = ipv6_all_zeros; 571 connp->conn_bound_addr_v6 = ipv6_all_zeros; 572 connp->conn_laddr_v6 = ipv6_all_zeros; 573 if (scopeid != 0) { 574 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 575 connp->conn_incoming_ifindex = connp->conn_bound_if; 576 } 577 icmp->icmp_state = TS_UNBND; 578 connp->conn_v6lastdst = ipv6_all_zeros; 579 connp->conn_lport = 0; 580 581 /* Restore the header that was built above - different source address */ 582 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 583 &connp->conn_faddr_v6, connp->conn_flowinfo); 584 mutex_exit(&connp->conn_lock); 585 return (error); 586 } 587 588 /* 589 * Tell IP to just bind to the protocol. 590 */ 591 static void 592 icmp_bind_proto(icmp_t *icmp) 593 { 594 conn_t *connp = icmp->icmp_connp; 595 596 mutex_enter(&connp->conn_lock); 597 connp->conn_saddr_v6 = ipv6_all_zeros; 598 connp->conn_laddr_v6 = ipv6_all_zeros; 599 connp->conn_faddr_v6 = ipv6_all_zeros; 600 connp->conn_v6lastdst = ipv6_all_zeros; 601 mutex_exit(&connp->conn_lock); 602 603 (void) ip_laddr_fanout_insert(connp); 604 } 605 606 /* 607 * This routine handles each T_CONN_REQ message passed to icmp. It 608 * associates a default destination address with the stream. 609 * 610 * After various error checks are completed, icmp_connect() lays 611 * the target address and port into the composite header template. 612 * Then we ask IP for information, including a source address if we didn't 613 * already have one. Finally we send up the T_OK_ACK reply message. 614 */ 615 static void 616 icmp_tpi_connect(queue_t *q, mblk_t *mp) 617 { 618 conn_t *connp = Q_TO_CONN(q); 619 struct T_conn_req *tcr; 620 struct sockaddr *sa; 621 socklen_t len; 622 int error; 623 cred_t *cr; 624 pid_t pid; 625 /* 626 * All Solaris components should pass a db_credp 627 * for this TPI message, hence we ASSERT. 628 * But in case there is some other M_PROTO that looks 629 * like a TPI message sent by some other kernel 630 * component, we check and return an error. 631 */ 632 cr = msg_getcred(mp, &pid); 633 ASSERT(cr != NULL); 634 if (cr == NULL) { 635 icmp_err_ack(q, mp, TSYSERR, EINVAL); 636 return; 637 } 638 639 tcr = (struct T_conn_req *)mp->b_rptr; 640 /* Sanity checks */ 641 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) { 642 icmp_err_ack(q, mp, TPROTO, 0); 643 return; 644 } 645 646 if (tcr->OPT_length != 0) { 647 icmp_err_ack(q, mp, TBADOPT, 0); 648 return; 649 } 650 651 len = tcr->DEST_length; 652 653 switch (len) { 654 default: 655 icmp_err_ack(q, mp, TBADADDR, 0); 656 return; 657 case sizeof (sin_t): 658 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset, 659 sizeof (sin_t)); 660 break; 661 case sizeof (sin6_t): 662 sa = (struct sockaddr *)mi_offset_param(mp, 663 tcr->DEST_offset, sizeof (sin6_t)); 664 break; 665 } 666 667 error = proto_verify_ip_addr(connp->conn_family, sa, len); 668 if (error != 0) { 669 icmp_err_ack(q, mp, TSYSERR, error); 670 return; 671 } 672 673 error = rawip_do_connect(connp, sa, len, cr, pid); 674 if (error != 0) { 675 if (error < 0) { 676 icmp_err_ack(q, mp, -error, 0); 677 } else { 678 icmp_err_ack(q, mp, 0, error); 679 } 680 } else { 681 mblk_t *mp1; 682 683 /* 684 * We have to send a connection confirmation to 685 * keep TLI happy. 686 */ 687 if (connp->conn_family == AF_INET) { 688 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 689 sizeof (sin_t), NULL, 0); 690 } else { 691 ASSERT(connp->conn_family == AF_INET6); 692 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 693 sizeof (sin6_t), NULL, 0); 694 } 695 if (mp1 == NULL) { 696 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 697 return; 698 } 699 700 /* 701 * Send ok_ack for T_CONN_REQ 702 */ 703 mp = mi_tpi_ok_ack_alloc(mp); 704 if (mp == NULL) { 705 /* Unable to reuse the T_CONN_REQ for the ack. */ 706 icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM); 707 return; 708 } 709 putnext(connp->conn_rq, mp); 710 putnext(connp->conn_rq, mp1); 711 } 712 } 713 714 static int 715 rawip_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 716 cred_t *cr, pid_t pid) 717 { 718 icmp_t *icmp; 719 sin_t *sin; 720 sin6_t *sin6; 721 int error; 722 uint16_t dstport; 723 ipaddr_t v4dst; 724 in6_addr_t v6dst; 725 uint32_t flowinfo; 726 ip_xmit_attr_t *ixa; 727 ip_xmit_attr_t *oldixa; 728 uint_t scopeid = 0; 729 uint_t srcid = 0; 730 in6_addr_t v6src = connp->conn_saddr_v6; 731 732 icmp = connp->conn_icmp; 733 734 if (sa == NULL || !OK_32PTR((char *)sa)) { 735 return (EINVAL); 736 } 737 738 ASSERT(sa != NULL && len != 0); 739 740 /* 741 * Determine packet type based on type of address passed in 742 * the request should contain an IPv4 or IPv6 address. 743 * Make sure that address family matches the type of 744 * family of the address passed down. 745 */ 746 switch (len) { 747 case sizeof (sin_t): 748 sin = (sin_t *)sa; 749 750 v4dst = sin->sin_addr.s_addr; 751 dstport = sin->sin_port; 752 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 753 ASSERT(connp->conn_ipversion == IPV4_VERSION); 754 break; 755 756 case sizeof (sin6_t): 757 sin6 = (sin6_t *)sa; 758 759 /* No support for mapped addresses on raw sockets */ 760 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 761 return (EADDRNOTAVAIL); 762 } 763 v6dst = sin6->sin6_addr; 764 dstport = sin6->sin6_port; 765 ASSERT(connp->conn_ipversion == IPV6_VERSION); 766 flowinfo = sin6->sin6_flowinfo; 767 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 768 scopeid = sin6->sin6_scope_id; 769 srcid = sin6->__sin6_src_id; 770 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 771 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 772 connp->conn_netstack); 773 } 774 break; 775 } 776 777 /* 778 * If there is a different thread using conn_ixa then we get a new 779 * copy and cut the old one loose from conn_ixa. Otherwise we use 780 * conn_ixa and prevent any other thread from using/changing it. 781 * Once connect() is done other threads can use conn_ixa since the 782 * refcnt will be back at one. 783 * We defer updating conn_ixa until later to handle any concurrent 784 * conn_ixa_cleanup thread. 785 */ 786 ixa = conn_get_ixa(connp, B_FALSE); 787 if (ixa == NULL) 788 return (ENOMEM); 789 790 mutex_enter(&connp->conn_lock); 791 /* 792 * This icmp_t must have bound already before doing a connect. 793 * Reject if a connect is in progress (we drop conn_lock during 794 * rawip_do_connect). 795 */ 796 if (icmp->icmp_state == TS_UNBND || icmp->icmp_state == TS_WCON_CREQ) { 797 mutex_exit(&connp->conn_lock); 798 ixa_refrele(ixa); 799 return (-TOUTSTATE); 800 } 801 802 if (icmp->icmp_state == TS_DATA_XFER) { 803 /* Already connected - clear out state */ 804 if (connp->conn_mcbc_bind) 805 connp->conn_saddr_v6 = ipv6_all_zeros; 806 else 807 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 808 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 809 connp->conn_faddr_v6 = ipv6_all_zeros; 810 icmp->icmp_state = TS_IDLE; 811 } 812 813 /* 814 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 815 * with IPPROTO_TCP. 816 */ 817 connp->conn_fport = dstport; 818 if (connp->conn_ipversion == IPV4_VERSION) { 819 /* 820 * Interpret a zero destination to mean loopback. 821 * Update the T_CONN_REQ (sin/sin6) since it is used to 822 * generate the T_CONN_CON. 823 */ 824 if (v4dst == INADDR_ANY) { 825 v4dst = htonl(INADDR_LOOPBACK); 826 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 827 ASSERT(connp->conn_family == AF_INET); 828 sin->sin_addr.s_addr = v4dst; 829 } 830 connp->conn_faddr_v6 = v6dst; 831 connp->conn_flowinfo = 0; 832 } else { 833 ASSERT(connp->conn_ipversion == IPV6_VERSION); 834 /* 835 * Interpret a zero destination to mean loopback. 836 * Update the T_CONN_REQ (sin/sin6) since it is used to 837 * generate the T_CONN_CON. 838 */ 839 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) { 840 v6dst = ipv6_loopback; 841 sin6->sin6_addr = v6dst; 842 } 843 connp->conn_faddr_v6 = v6dst; 844 connp->conn_flowinfo = flowinfo; 845 } 846 847 /* 848 * We update our cred/cpid based on the caller of connect 849 */ 850 if (connp->conn_cred != cr) { 851 crhold(cr); 852 crfree(connp->conn_cred); 853 connp->conn_cred = cr; 854 } 855 connp->conn_cpid = pid; 856 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 857 ixa->ixa_cred = cr; 858 ixa->ixa_cpid = pid; 859 if (is_system_labeled()) { 860 /* We need to restart with a label based on the cred */ 861 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 862 } 863 864 if (scopeid != 0) { 865 ixa->ixa_flags |= IXAF_SCOPEID_SET; 866 ixa->ixa_scopeid = scopeid; 867 connp->conn_incoming_ifindex = scopeid; 868 } else { 869 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 870 connp->conn_incoming_ifindex = connp->conn_bound_if; 871 } 872 873 /* 874 * conn_connect will drop conn_lock and reacquire it. 875 * To prevent a send* from messing with this icmp_t while the lock 876 * is dropped we set icmp_state and clear conn_v6lastdst. 877 * That will make all send* fail with EISCONN. 878 */ 879 connp->conn_v6lastdst = ipv6_all_zeros; 880 icmp->icmp_state = TS_WCON_CREQ; 881 882 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC); 883 mutex_exit(&connp->conn_lock); 884 if (error != 0) 885 goto connect_failed; 886 887 /* 888 * The addresses have been verified. Time to insert in 889 * the correct fanout list. 890 */ 891 error = ipcl_conn_insert(connp); 892 if (error != 0) 893 goto connect_failed; 894 895 mutex_enter(&connp->conn_lock); 896 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 897 &connp->conn_faddr_v6, connp->conn_flowinfo); 898 if (error != 0) { 899 mutex_exit(&connp->conn_lock); 900 goto connect_failed; 901 } 902 903 icmp->icmp_state = TS_DATA_XFER; 904 /* Record this as the "last" send even though we haven't sent any */ 905 connp->conn_v6lastdst = connp->conn_faddr_v6; 906 connp->conn_lastipversion = connp->conn_ipversion; 907 connp->conn_lastdstport = connp->conn_fport; 908 connp->conn_lastflowinfo = connp->conn_flowinfo; 909 connp->conn_lastscopeid = scopeid; 910 connp->conn_lastsrcid = srcid; 911 /* Also remember a source to use together with lastdst */ 912 connp->conn_v6lastsrc = v6src; 913 914 oldixa = conn_replace_ixa(connp, ixa); 915 mutex_exit(&connp->conn_lock); 916 ixa_refrele(oldixa); 917 918 ixa_refrele(ixa); 919 return (0); 920 921 connect_failed: 922 if (ixa != NULL) 923 ixa_refrele(ixa); 924 mutex_enter(&connp->conn_lock); 925 icmp->icmp_state = TS_IDLE; 926 /* In case the source address was set above */ 927 if (connp->conn_mcbc_bind) 928 connp->conn_saddr_v6 = ipv6_all_zeros; 929 else 930 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 931 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 932 connp->conn_faddr_v6 = ipv6_all_zeros; 933 connp->conn_v6lastdst = ipv6_all_zeros; 934 connp->conn_flowinfo = 0; 935 936 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 937 &connp->conn_faddr_v6, connp->conn_flowinfo); 938 mutex_exit(&connp->conn_lock); 939 return (error); 940 } 941 942 static void 943 rawip_do_close(conn_t *connp) 944 { 945 ASSERT(connp != NULL && IPCL_IS_RAWIP(connp)); 946 947 ip_quiesce_conn(connp); 948 949 if (!IPCL_IS_NONSTR(connp)) { 950 qprocsoff(connp->conn_rq); 951 } 952 953 icmp_close_free(connp); 954 955 /* 956 * Now we are truly single threaded on this stream, and can 957 * delete the things hanging off the connp, and finally the connp. 958 * We removed this connp from the fanout list, it cannot be 959 * accessed thru the fanouts, and we already waited for the 960 * conn_ref to drop to 0. We are already in close, so 961 * there cannot be any other thread from the top. qprocsoff 962 * has completed, and service has completed or won't run in 963 * future. 964 */ 965 ASSERT(connp->conn_ref == 1); 966 967 if (!IPCL_IS_NONSTR(connp)) { 968 inet_minor_free(connp->conn_minor_arena, connp->conn_dev); 969 } else { 970 ip_free_helper_stream(connp); 971 } 972 973 connp->conn_ref--; 974 ipcl_conn_destroy(connp); 975 } 976 977 static int 978 icmp_close(queue_t *q, int flags) 979 { 980 conn_t *connp; 981 982 if (flags & SO_FALLBACK) { 983 /* 984 * stream is being closed while in fallback 985 * simply free the resources that were allocated 986 */ 987 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr)); 988 qprocsoff(q); 989 goto done; 990 } 991 992 connp = Q_TO_CONN(q); 993 (void) rawip_do_close(connp); 994 done: 995 q->q_ptr = WR(q)->q_ptr = NULL; 996 return (0); 997 } 998 999 static void 1000 icmp_close_free(conn_t *connp) 1001 { 1002 icmp_t *icmp = connp->conn_icmp; 1003 1004 if (icmp->icmp_filter != NULL) { 1005 kmem_free(icmp->icmp_filter, sizeof (icmp6_filter_t)); 1006 icmp->icmp_filter = NULL; 1007 } 1008 1009 /* 1010 * Clear any fields which the kmem_cache constructor clears. 1011 * Only icmp_connp needs to be preserved. 1012 * TBD: We should make this more efficient to avoid clearing 1013 * everything. 1014 */ 1015 ASSERT(icmp->icmp_connp == connp); 1016 bzero(icmp, sizeof (icmp_t)); 1017 icmp->icmp_connp = connp; 1018 } 1019 1020 /* 1021 * This routine handles each T_DISCON_REQ message passed to icmp 1022 * as an indicating that ICMP is no longer connected. This results 1023 * in telling IP to restore the binding to just the local address. 1024 */ 1025 static int 1026 icmp_do_disconnect(conn_t *connp) 1027 { 1028 icmp_t *icmp = connp->conn_icmp; 1029 int error; 1030 1031 mutex_enter(&connp->conn_lock); 1032 if (icmp->icmp_state != TS_DATA_XFER) { 1033 mutex_exit(&connp->conn_lock); 1034 return (-TOUTSTATE); 1035 } 1036 if (connp->conn_mcbc_bind) 1037 connp->conn_saddr_v6 = ipv6_all_zeros; 1038 else 1039 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 1040 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 1041 connp->conn_faddr_v6 = ipv6_all_zeros; 1042 icmp->icmp_state = TS_IDLE; 1043 1044 connp->conn_v6lastdst = ipv6_all_zeros; 1045 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 1046 &connp->conn_faddr_v6, connp->conn_flowinfo); 1047 mutex_exit(&connp->conn_lock); 1048 if (error != 0) 1049 return (error); 1050 1051 /* 1052 * Tell IP to remove the full binding and revert 1053 * to the local address binding. 1054 */ 1055 return (ip_laddr_fanout_insert(connp)); 1056 } 1057 1058 static void 1059 icmp_tpi_disconnect(queue_t *q, mblk_t *mp) 1060 { 1061 conn_t *connp = Q_TO_CONN(q); 1062 int error; 1063 1064 /* 1065 * Allocate the largest primitive we need to send back 1066 * T_error_ack is > than T_ok_ack 1067 */ 1068 mp = reallocb(mp, sizeof (struct T_error_ack), 1); 1069 if (mp == NULL) { 1070 /* Unable to reuse the T_DISCON_REQ for the ack. */ 1071 icmp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM); 1072 return; 1073 } 1074 1075 error = icmp_do_disconnect(connp); 1076 1077 if (error != 0) { 1078 if (error > 0) { 1079 icmp_err_ack(q, mp, 0, error); 1080 } else { 1081 icmp_err_ack(q, mp, -error, 0); 1082 } 1083 } else { 1084 mp = mi_tpi_ok_ack_alloc(mp); 1085 ASSERT(mp != NULL); 1086 qreply(q, mp); 1087 } 1088 } 1089 1090 static int 1091 icmp_disconnect(conn_t *connp) 1092 { 1093 int error; 1094 1095 connp->conn_dgram_errind = B_FALSE; 1096 1097 error = icmp_do_disconnect(connp); 1098 1099 if (error < 0) 1100 error = proto_tlitosyserr(-error); 1101 return (error); 1102 } 1103 1104 /* This routine creates a T_ERROR_ACK message and passes it upstream. */ 1105 static void 1106 icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error) 1107 { 1108 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 1109 qreply(q, mp); 1110 } 1111 1112 /* Shorthand to generate and send TPI error acks to our client */ 1113 static void 1114 icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 1115 t_scalar_t t_error, int sys_error) 1116 { 1117 struct T_error_ack *teackp; 1118 1119 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 1120 M_PCPROTO, T_ERROR_ACK)) != NULL) { 1121 teackp = (struct T_error_ack *)mp->b_rptr; 1122 teackp->ERROR_prim = primitive; 1123 teackp->TLI_error = t_error; 1124 teackp->UNIX_error = sys_error; 1125 qreply(q, mp); 1126 } 1127 } 1128 1129 /* 1130 * icmp_icmp_input is called as conn_recvicmp to process ICMP messages. 1131 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1132 * Assumes that IP has pulled up everything up to and including the ICMP header. 1133 */ 1134 /* ARGSUSED2 */ 1135 static void 1136 icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 1137 { 1138 conn_t *connp = (conn_t *)arg1; 1139 icmp_t *icmp = connp->conn_icmp; 1140 icmph_t *icmph; 1141 ipha_t *ipha; 1142 int iph_hdr_length; 1143 sin_t sin; 1144 mblk_t *mp1; 1145 int error = 0; 1146 1147 ipha = (ipha_t *)mp->b_rptr; 1148 1149 ASSERT(OK_32PTR(mp->b_rptr)); 1150 1151 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) { 1152 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 1153 icmp_icmp_error_ipv6(connp, mp, ira); 1154 return; 1155 } 1156 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 1157 1158 /* Skip past the outer IP and ICMP headers */ 1159 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length); 1160 iph_hdr_length = ira->ira_ip_hdr_length; 1161 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1162 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */ 1163 1164 iph_hdr_length = IPH_HDR_LENGTH(ipha); 1165 1166 switch (icmph->icmph_type) { 1167 case ICMP_DEST_UNREACHABLE: 1168 switch (icmph->icmph_code) { 1169 case ICMP_FRAGMENTATION_NEEDED: { 1170 ipha_t *ipha; 1171 ip_xmit_attr_t *ixa; 1172 /* 1173 * IP has already adjusted the path MTU. 1174 * But we need to adjust DF for IPv4. 1175 */ 1176 if (connp->conn_ipversion != IPV4_VERSION) 1177 break; 1178 1179 ixa = conn_get_ixa(connp, B_FALSE); 1180 if (ixa == NULL || ixa->ixa_ire == NULL) { 1181 /* 1182 * Some other thread holds conn_ixa. We will 1183 * redo this on the next ICMP too big. 1184 */ 1185 if (ixa != NULL) 1186 ixa_refrele(ixa); 1187 break; 1188 } 1189 (void) ip_get_pmtu(ixa); 1190 1191 mutex_enter(&connp->conn_lock); 1192 ipha = (ipha_t *)connp->conn_ht_iphc; 1193 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 1194 ipha->ipha_fragment_offset_and_flags |= 1195 IPH_DF_HTONS; 1196 } else { 1197 ipha->ipha_fragment_offset_and_flags &= 1198 ~IPH_DF_HTONS; 1199 } 1200 mutex_exit(&connp->conn_lock); 1201 ixa_refrele(ixa); 1202 break; 1203 } 1204 case ICMP_PORT_UNREACHABLE: 1205 case ICMP_PROTOCOL_UNREACHABLE: 1206 error = ECONNREFUSED; 1207 break; 1208 default: 1209 /* Transient errors */ 1210 break; 1211 } 1212 break; 1213 default: 1214 /* Transient errors */ 1215 break; 1216 } 1217 if (error == 0) { 1218 freemsg(mp); 1219 return; 1220 } 1221 1222 /* 1223 * Deliver T_UDERROR_IND when the application has asked for it. 1224 * The socket layer enables this automatically when connected. 1225 */ 1226 if (!connp->conn_dgram_errind) { 1227 freemsg(mp); 1228 return; 1229 } 1230 1231 sin = sin_null; 1232 sin.sin_family = AF_INET; 1233 sin.sin_addr.s_addr = ipha->ipha_dst; 1234 1235 if (IPCL_IS_NONSTR(connp)) { 1236 mutex_enter(&connp->conn_lock); 1237 if (icmp->icmp_state == TS_DATA_XFER) { 1238 if (sin.sin_addr.s_addr == connp->conn_faddr_v4) { 1239 mutex_exit(&connp->conn_lock); 1240 (*connp->conn_upcalls->su_set_error) 1241 (connp->conn_upper_handle, error); 1242 goto done; 1243 } 1244 } else { 1245 icmp->icmp_delayed_error = error; 1246 *((sin_t *)&icmp->icmp_delayed_addr) = sin; 1247 } 1248 mutex_exit(&connp->conn_lock); 1249 } else { 1250 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0, 1251 error); 1252 if (mp1 != NULL) 1253 putnext(connp->conn_rq, mp1); 1254 } 1255 done: 1256 freemsg(mp); 1257 } 1258 1259 /* 1260 * icmp_icmp_error_ipv6 is called by icmp_icmp_error to process ICMP for IPv6. 1261 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1262 * Assumes that IP has pulled up all the extension headers as well as the 1263 * ICMPv6 header. 1264 */ 1265 static void 1266 icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira) 1267 { 1268 icmp6_t *icmp6; 1269 ip6_t *ip6h, *outer_ip6h; 1270 uint16_t iph_hdr_length; 1271 uint8_t *nexthdrp; 1272 sin6_t sin6; 1273 mblk_t *mp1; 1274 int error = 0; 1275 icmp_t *icmp = connp->conn_icmp; 1276 1277 outer_ip6h = (ip6_t *)mp->b_rptr; 1278 #ifdef DEBUG 1279 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6) 1280 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h); 1281 else 1282 iph_hdr_length = IPV6_HDR_LEN; 1283 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length); 1284 #endif 1285 /* Skip past the outer IP and ICMP headers */ 1286 iph_hdr_length = ira->ira_ip_hdr_length; 1287 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 1288 1289 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */ 1290 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) { 1291 freemsg(mp); 1292 return; 1293 } 1294 1295 switch (icmp6->icmp6_type) { 1296 case ICMP6_DST_UNREACH: 1297 switch (icmp6->icmp6_code) { 1298 case ICMP6_DST_UNREACH_NOPORT: 1299 error = ECONNREFUSED; 1300 break; 1301 case ICMP6_DST_UNREACH_ADMIN: 1302 case ICMP6_DST_UNREACH_NOROUTE: 1303 case ICMP6_DST_UNREACH_BEYONDSCOPE: 1304 case ICMP6_DST_UNREACH_ADDR: 1305 /* Transient errors */ 1306 break; 1307 default: 1308 break; 1309 } 1310 break; 1311 case ICMP6_PACKET_TOO_BIG: { 1312 struct T_unitdata_ind *tudi; 1313 struct T_opthdr *toh; 1314 size_t udi_size; 1315 mblk_t *newmp; 1316 t_scalar_t opt_length = sizeof (struct T_opthdr) + 1317 sizeof (struct ip6_mtuinfo); 1318 sin6_t *sin6; 1319 struct ip6_mtuinfo *mtuinfo; 1320 1321 /* 1322 * If the application has requested to receive path mtu 1323 * information, send up an empty message containing an 1324 * IPV6_PATHMTU ancillary data item. 1325 */ 1326 if (!connp->conn_ipv6_recvpathmtu) 1327 break; 1328 1329 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) + 1330 opt_length; 1331 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) { 1332 BUMP_MIB(&icmp->icmp_is->is_rawip_mib, rawipInErrors); 1333 break; 1334 } 1335 1336 /* 1337 * newmp->b_cont is left to NULL on purpose. This is an 1338 * empty message containing only ancillary data. 1339 */ 1340 newmp->b_datap->db_type = M_PROTO; 1341 tudi = (struct T_unitdata_ind *)newmp->b_rptr; 1342 newmp->b_wptr = (uchar_t *)tudi + udi_size; 1343 tudi->PRIM_type = T_UNITDATA_IND; 1344 tudi->SRC_length = sizeof (sin6_t); 1345 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 1346 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t); 1347 tudi->OPT_length = opt_length; 1348 1349 sin6 = (sin6_t *)&tudi[1]; 1350 bzero(sin6, sizeof (sin6_t)); 1351 sin6->sin6_family = AF_INET6; 1352 sin6->sin6_addr = connp->conn_faddr_v6; 1353 1354 toh = (struct T_opthdr *)&sin6[1]; 1355 toh->level = IPPROTO_IPV6; 1356 toh->name = IPV6_PATHMTU; 1357 toh->len = opt_length; 1358 toh->status = 0; 1359 1360 mtuinfo = (struct ip6_mtuinfo *)&toh[1]; 1361 bzero(mtuinfo, sizeof (struct ip6_mtuinfo)); 1362 mtuinfo->ip6m_addr.sin6_family = AF_INET6; 1363 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst; 1364 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu; 1365 /* 1366 * We've consumed everything we need from the original 1367 * message. Free it, then send our empty message. 1368 */ 1369 freemsg(mp); 1370 icmp_ulp_recv(connp, newmp, msgdsize(newmp)); 1371 return; 1372 } 1373 case ICMP6_TIME_EXCEEDED: 1374 /* Transient errors */ 1375 break; 1376 case ICMP6_PARAM_PROB: 1377 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 1378 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 1379 (uchar_t *)ip6h + icmp6->icmp6_pptr == 1380 (uchar_t *)nexthdrp) { 1381 error = ECONNREFUSED; 1382 break; 1383 } 1384 break; 1385 } 1386 if (error == 0) { 1387 freemsg(mp); 1388 return; 1389 } 1390 1391 /* 1392 * Deliver T_UDERROR_IND when the application has asked for it. 1393 * The socket layer enables this automatically when connected. 1394 */ 1395 if (!connp->conn_dgram_errind) { 1396 freemsg(mp); 1397 return; 1398 } 1399 1400 sin6 = sin6_null; 1401 sin6.sin6_family = AF_INET6; 1402 sin6.sin6_addr = ip6h->ip6_dst; 1403 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 1404 if (IPCL_IS_NONSTR(connp)) { 1405 mutex_enter(&connp->conn_lock); 1406 if (icmp->icmp_state == TS_DATA_XFER) { 1407 if (IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr, 1408 &connp->conn_faddr_v6)) { 1409 mutex_exit(&connp->conn_lock); 1410 (*connp->conn_upcalls->su_set_error) 1411 (connp->conn_upper_handle, error); 1412 goto done; 1413 } 1414 } else { 1415 icmp->icmp_delayed_error = error; 1416 *((sin6_t *)&icmp->icmp_delayed_addr) = sin6; 1417 } 1418 mutex_exit(&connp->conn_lock); 1419 } else { 1420 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t), 1421 NULL, 0, error); 1422 if (mp1 != NULL) 1423 putnext(connp->conn_rq, mp1); 1424 } 1425 done: 1426 freemsg(mp); 1427 } 1428 1429 /* 1430 * This routine responds to T_ADDR_REQ messages. It is called by icmp_wput. 1431 * The local address is filled in if endpoint is bound. The remote address 1432 * is filled in if remote address has been precified ("connected endpoint") 1433 * (The concept of connected CLTS sockets is alien to published TPI 1434 * but we support it anyway). 1435 */ 1436 static void 1437 icmp_addr_req(queue_t *q, mblk_t *mp) 1438 { 1439 struct sockaddr *sa; 1440 mblk_t *ackmp; 1441 struct T_addr_ack *taa; 1442 icmp_t *icmp = Q_TO_ICMP(q); 1443 conn_t *connp = icmp->icmp_connp; 1444 uint_t addrlen; 1445 1446 /* Make it large enough for worst case */ 1447 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 1448 2 * sizeof (sin6_t), 1); 1449 if (ackmp == NULL) { 1450 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 1451 return; 1452 } 1453 taa = (struct T_addr_ack *)ackmp->b_rptr; 1454 1455 bzero(taa, sizeof (struct T_addr_ack)); 1456 ackmp->b_wptr = (uchar_t *)&taa[1]; 1457 1458 taa->PRIM_type = T_ADDR_ACK; 1459 ackmp->b_datap->db_type = M_PCPROTO; 1460 1461 if (connp->conn_family == AF_INET) 1462 addrlen = sizeof (sin_t); 1463 else 1464 addrlen = sizeof (sin6_t); 1465 1466 mutex_enter(&connp->conn_lock); 1467 /* 1468 * Note: Following code assumes 32 bit alignment of basic 1469 * data structures like sin_t and struct T_addr_ack. 1470 */ 1471 if (icmp->icmp_state != TS_UNBND) { 1472 /* 1473 * Fill in local address first 1474 */ 1475 taa->LOCADDR_offset = sizeof (*taa); 1476 taa->LOCADDR_length = addrlen; 1477 sa = (struct sockaddr *)&taa[1]; 1478 (void) conn_getsockname(connp, sa, &addrlen); 1479 ackmp->b_wptr += addrlen; 1480 } 1481 if (icmp->icmp_state == TS_DATA_XFER) { 1482 /* 1483 * connected, fill remote address too 1484 */ 1485 taa->REMADDR_length = addrlen; 1486 /* assumed 32-bit alignment */ 1487 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length; 1488 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset); 1489 (void) conn_getpeername(connp, sa, &addrlen); 1490 ackmp->b_wptr += addrlen; 1491 } 1492 mutex_exit(&connp->conn_lock); 1493 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim); 1494 qreply(q, ackmp); 1495 } 1496 1497 static void 1498 icmp_copy_info(struct T_info_ack *tap, icmp_t *icmp) 1499 { 1500 conn_t *connp = icmp->icmp_connp; 1501 1502 *tap = icmp_g_t_info_ack; 1503 1504 if (connp->conn_family == AF_INET6) 1505 tap->ADDR_size = sizeof (sin6_t); 1506 else 1507 tap->ADDR_size = sizeof (sin_t); 1508 tap->CURRENT_state = icmp->icmp_state; 1509 tap->OPT_size = icmp_max_optsize; 1510 } 1511 1512 static void 1513 icmp_do_capability_ack(icmp_t *icmp, struct T_capability_ack *tcap, 1514 t_uscalar_t cap_bits1) 1515 { 1516 tcap->CAP_bits1 = 0; 1517 1518 if (cap_bits1 & TC1_INFO) { 1519 icmp_copy_info(&tcap->INFO_ack, icmp); 1520 tcap->CAP_bits1 |= TC1_INFO; 1521 } 1522 } 1523 1524 /* 1525 * This routine responds to T_CAPABILITY_REQ messages. It is called by 1526 * icmp_wput. Much of the T_CAPABILITY_ACK information is copied from 1527 * icmp_g_t_info_ack. The current state of the stream is copied from 1528 * icmp_state. 1529 */ 1530 static void 1531 icmp_capability_req(queue_t *q, mblk_t *mp) 1532 { 1533 icmp_t *icmp = Q_TO_ICMP(q); 1534 t_uscalar_t cap_bits1; 1535 struct T_capability_ack *tcap; 1536 1537 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 1538 1539 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 1540 mp->b_datap->db_type, T_CAPABILITY_ACK); 1541 if (!mp) 1542 return; 1543 1544 tcap = (struct T_capability_ack *)mp->b_rptr; 1545 1546 icmp_do_capability_ack(icmp, tcap, cap_bits1); 1547 1548 qreply(q, mp); 1549 } 1550 1551 /* 1552 * This routine responds to T_INFO_REQ messages. It is called by icmp_wput. 1553 * Most of the T_INFO_ACK information is copied from icmp_g_t_info_ack. 1554 * The current state of the stream is copied from icmp_state. 1555 */ 1556 static void 1557 icmp_info_req(queue_t *q, mblk_t *mp) 1558 { 1559 icmp_t *icmp = Q_TO_ICMP(q); 1560 1561 /* Create a T_INFO_ACK message. */ 1562 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 1563 T_INFO_ACK); 1564 if (!mp) 1565 return; 1566 icmp_copy_info((struct T_info_ack *)mp->b_rptr, icmp); 1567 qreply(q, mp); 1568 } 1569 1570 static int 1571 icmp_tpi_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 1572 int family) 1573 { 1574 conn_t *connp; 1575 dev_t conn_dev; 1576 int error; 1577 1578 /* If the stream is already open, return immediately. */ 1579 if (q->q_ptr != NULL) 1580 return (0); 1581 1582 if (sflag == MODOPEN) 1583 return (EINVAL); 1584 1585 /* 1586 * Since ICMP is not used so heavily, allocating from the small 1587 * arena should be sufficient. 1588 */ 1589 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 1590 return (EBUSY); 1591 } 1592 1593 if (flag & SO_FALLBACK) { 1594 /* 1595 * Non streams socket needs a stream to fallback to 1596 */ 1597 RD(q)->q_ptr = (void *)conn_dev; 1598 WR(q)->q_qinfo = &icmp_fallback_sock_winit; 1599 WR(q)->q_ptr = (void *)ip_minor_arena_sa; 1600 qprocson(q); 1601 return (0); 1602 } 1603 1604 connp = rawip_do_open(family, credp, &error, KM_SLEEP); 1605 if (connp == NULL) { 1606 ASSERT(error != 0); 1607 inet_minor_free(ip_minor_arena_sa, conn_dev); 1608 return (error); 1609 } 1610 1611 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 1612 connp->conn_dev = conn_dev; 1613 connp->conn_minor_arena = ip_minor_arena_sa; 1614 1615 /* 1616 * Initialize the icmp_t structure for this stream. 1617 */ 1618 q->q_ptr = connp; 1619 WR(q)->q_ptr = connp; 1620 connp->conn_rq = q; 1621 connp->conn_wq = WR(q); 1622 1623 WR(q)->q_hiwat = connp->conn_sndbuf; 1624 WR(q)->q_lowat = connp->conn_sndlowat; 1625 1626 qprocson(q); 1627 1628 /* Set the Stream head write offset. */ 1629 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff); 1630 (void) proto_set_rx_hiwat(connp->conn_rq, connp, connp->conn_rcvbuf); 1631 1632 mutex_enter(&connp->conn_lock); 1633 connp->conn_state_flags &= ~CONN_INCIPIENT; 1634 mutex_exit(&connp->conn_lock); 1635 1636 icmp_bind_proto(connp->conn_icmp); 1637 1638 return (0); 1639 } 1640 1641 /* For /dev/icmp aka AF_INET open */ 1642 static int 1643 icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1644 { 1645 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET)); 1646 } 1647 1648 /* For /dev/icmp6 aka AF_INET6 open */ 1649 static int 1650 icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1651 { 1652 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET6)); 1653 } 1654 1655 /* 1656 * This is the open routine for icmp. It allocates a icmp_t structure for 1657 * the stream and, on the first open of the module, creates an ND table. 1658 */ 1659 static conn_t * 1660 rawip_do_open(int family, cred_t *credp, int *err, int flags) 1661 { 1662 icmp_t *icmp; 1663 conn_t *connp; 1664 zoneid_t zoneid; 1665 netstack_t *ns; 1666 icmp_stack_t *is; 1667 int len; 1668 boolean_t isv6 = B_FALSE; 1669 1670 *err = secpolicy_net_icmpaccess(credp); 1671 if (*err != 0) 1672 return (NULL); 1673 1674 if (family == AF_INET6) 1675 isv6 = B_TRUE; 1676 1677 ns = netstack_find_by_cred(credp); 1678 ASSERT(ns != NULL); 1679 is = ns->netstack_icmp; 1680 ASSERT(is != NULL); 1681 1682 /* 1683 * For exclusive stacks we set the zoneid to zero 1684 * to make ICMP operate as if in the global zone. 1685 */ 1686 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1687 zoneid = GLOBAL_ZONEID; 1688 else 1689 zoneid = crgetzoneid(credp); 1690 1691 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP); 1692 1693 connp = ipcl_conn_create(IPCL_RAWIPCONN, flags, ns); 1694 icmp = connp->conn_icmp; 1695 1696 /* 1697 * ipcl_conn_create did a netstack_hold. Undo the hold that was 1698 * done by netstack_find_by_cred() 1699 */ 1700 netstack_rele(ns); 1701 1702 /* 1703 * Since this conn_t/icmp_t is not yet visible to anybody else we don't 1704 * need to lock anything. 1705 */ 1706 ASSERT(connp->conn_proto == IPPROTO_ICMP); 1707 ASSERT(connp->conn_icmp == icmp); 1708 ASSERT(icmp->icmp_connp == connp); 1709 1710 /* Set the initial state of the stream and the privilege status. */ 1711 icmp->icmp_state = TS_UNBND; 1712 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 1713 if (isv6) { 1714 connp->conn_family = AF_INET6; 1715 connp->conn_ipversion = IPV6_VERSION; 1716 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4; 1717 connp->conn_proto = IPPROTO_ICMPV6; 1718 /* May be changed by a SO_PROTOTYPE socket option. */ 1719 connp->conn_proto = IPPROTO_ICMPV6; 1720 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1721 connp->conn_ixa->ixa_raw_cksum_offset = 2; 1722 connp->conn_default_ttl = is->is_ipv6_hoplimit; 1723 len = sizeof (ip6_t); 1724 } else { 1725 connp->conn_family = AF_INET; 1726 connp->conn_ipversion = IPV4_VERSION; 1727 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4; 1728 /* May be changed by a SO_PROTOTYPE socket option. */ 1729 connp->conn_proto = IPPROTO_ICMP; 1730 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1731 connp->conn_default_ttl = is->is_ipv4_ttl; 1732 len = sizeof (ipha_t); 1733 } 1734 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 1735 1736 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1737 1738 /* 1739 * For the socket of protocol IPPROTO_RAW or when IP_HDRINCL is set, 1740 * the checksum is provided in the pre-built packet. We clear 1741 * IXAF_SET_ULP_CKSUM to tell IP that the application has sent a 1742 * complete IP header and not to compute the transport checksum. 1743 */ 1744 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM; 1745 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 1746 connp->conn_ixa->ixa_zoneid = zoneid; 1747 1748 connp->conn_zoneid = zoneid; 1749 1750 /* 1751 * If the caller has the process-wide flag set, then default to MAC 1752 * exempt mode. This allows read-down to unlabeled hosts. 1753 */ 1754 if (getpflags(NET_MAC_AWARE, credp) != 0) 1755 connp->conn_mac_mode = CONN_MAC_AWARE; 1756 1757 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 1758 1759 icmp->icmp_is = is; 1760 1761 connp->conn_rcvbuf = is->is_recv_hiwat; 1762 connp->conn_sndbuf = is->is_xmit_hiwat; 1763 connp->conn_sndlowat = is->is_xmit_lowat; 1764 connp->conn_rcvlowat = icmp_mod_info.mi_lowat; 1765 1766 connp->conn_wroff = len + is->is_wroff_extra; 1767 connp->conn_so_type = SOCK_RAW; 1768 1769 connp->conn_recv = icmp_input; 1770 connp->conn_recvicmp = icmp_icmp_input; 1771 crhold(credp); 1772 connp->conn_cred = credp; 1773 connp->conn_cpid = curproc->p_pid; 1774 connp->conn_open_time = ddi_get_lbolt64(); 1775 /* Cache things in ixa without an extra refhold */ 1776 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 1777 connp->conn_ixa->ixa_cred = connp->conn_cred; 1778 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 1779 if (is_system_labeled()) 1780 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 1781 1782 connp->conn_flow_cntrld = B_FALSE; 1783 1784 if (is->is_pmtu_discovery) 1785 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 1786 1787 return (connp); 1788 } 1789 1790 /* 1791 * Which ICMP options OK to set through T_UNITDATA_REQ... 1792 */ 1793 /* ARGSUSED */ 1794 static boolean_t 1795 icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name) 1796 { 1797 return (B_TRUE); 1798 } 1799 1800 /* 1801 * This routine gets default values of certain options whose default 1802 * values are maintained by protcol specific code 1803 */ 1804 int 1805 icmp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr) 1806 { 1807 icmp_t *icmp = Q_TO_ICMP(q); 1808 icmp_stack_t *is = icmp->icmp_is; 1809 int *i1 = (int *)ptr; 1810 1811 switch (level) { 1812 case IPPROTO_IP: 1813 switch (name) { 1814 case IP_MULTICAST_TTL: 1815 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL; 1816 return (sizeof (uchar_t)); 1817 case IP_MULTICAST_LOOP: 1818 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP; 1819 return (sizeof (uchar_t)); 1820 } 1821 break; 1822 case IPPROTO_IPV6: 1823 switch (name) { 1824 case IPV6_MULTICAST_HOPS: 1825 *i1 = IP_DEFAULT_MULTICAST_TTL; 1826 return (sizeof (int)); 1827 case IPV6_MULTICAST_LOOP: 1828 *i1 = IP_DEFAULT_MULTICAST_LOOP; 1829 return (sizeof (int)); 1830 case IPV6_UNICAST_HOPS: 1831 *i1 = is->is_ipv6_hoplimit; 1832 return (sizeof (int)); 1833 } 1834 break; 1835 case IPPROTO_ICMPV6: 1836 switch (name) { 1837 case ICMP6_FILTER: 1838 /* Make it look like "pass all" */ 1839 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1840 return (sizeof (icmp6_filter_t)); 1841 } 1842 break; 1843 } 1844 return (-1); 1845 } 1846 1847 /* 1848 * This routine retrieves the current status of socket options. 1849 * It returns the size of the option retrieved, or -1. 1850 */ 1851 int 1852 icmp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr) 1853 { 1854 icmp_t *icmp = connp->conn_icmp; 1855 int *i1 = (int *)ptr; 1856 conn_opt_arg_t coas; 1857 int retval; 1858 1859 coas.coa_connp = connp; 1860 coas.coa_ixa = connp->conn_ixa; 1861 coas.coa_ipp = &connp->conn_xmit_ipp; 1862 coas.coa_ancillary = B_FALSE; 1863 coas.coa_changed = 0; 1864 1865 /* 1866 * We assume that the optcom framework has checked for the set 1867 * of levels and names that are supported, hence we don't worry 1868 * about rejecting based on that. 1869 * First check for ICMP specific handling, then pass to common routine. 1870 */ 1871 switch (level) { 1872 case IPPROTO_IP: 1873 /* 1874 * Only allow IPv4 option processing on IPv4 sockets. 1875 */ 1876 if (connp->conn_family != AF_INET) 1877 return (-1); 1878 1879 switch (name) { 1880 case IP_OPTIONS: 1881 case T_IP_OPTIONS: 1882 /* Options are passed up with each packet */ 1883 return (0); 1884 case IP_HDRINCL: 1885 mutex_enter(&connp->conn_lock); 1886 *i1 = (int)icmp->icmp_hdrincl; 1887 mutex_exit(&connp->conn_lock); 1888 return (sizeof (int)); 1889 } 1890 break; 1891 1892 case IPPROTO_IPV6: 1893 /* 1894 * Only allow IPv6 option processing on native IPv6 sockets. 1895 */ 1896 if (connp->conn_family != AF_INET6) 1897 return (-1); 1898 1899 switch (name) { 1900 case IPV6_CHECKSUM: 1901 /* 1902 * Return offset or -1 if no checksum offset. 1903 * Does not apply to IPPROTO_ICMPV6 1904 */ 1905 if (connp->conn_proto == IPPROTO_ICMPV6) 1906 return (-1); 1907 1908 mutex_enter(&connp->conn_lock); 1909 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) 1910 *i1 = connp->conn_ixa->ixa_raw_cksum_offset; 1911 else 1912 *i1 = -1; 1913 mutex_exit(&connp->conn_lock); 1914 return (sizeof (int)); 1915 } 1916 break; 1917 1918 case IPPROTO_ICMPV6: 1919 /* 1920 * Only allow IPv6 option processing on native IPv6 sockets. 1921 */ 1922 if (connp->conn_family != AF_INET6) 1923 return (-1); 1924 1925 if (connp->conn_proto != IPPROTO_ICMPV6) 1926 return (-1); 1927 1928 switch (name) { 1929 case ICMP6_FILTER: 1930 mutex_enter(&connp->conn_lock); 1931 if (icmp->icmp_filter == NULL) { 1932 /* Make it look like "pass all" */ 1933 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1934 } else { 1935 (void) bcopy(icmp->icmp_filter, ptr, 1936 sizeof (icmp6_filter_t)); 1937 } 1938 mutex_exit(&connp->conn_lock); 1939 return (sizeof (icmp6_filter_t)); 1940 } 1941 } 1942 mutex_enter(&connp->conn_lock); 1943 retval = conn_opt_get(&coas, level, name, ptr); 1944 mutex_exit(&connp->conn_lock); 1945 return (retval); 1946 } 1947 1948 /* 1949 * This routine retrieves the current status of socket options. 1950 * It returns the size of the option retrieved, or -1. 1951 */ 1952 int 1953 icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 1954 { 1955 conn_t *connp = Q_TO_CONN(q); 1956 int err; 1957 1958 err = icmp_opt_get(connp, level, name, ptr); 1959 return (err); 1960 } 1961 1962 /* 1963 * This routine sets socket options. 1964 */ 1965 int 1966 icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name, 1967 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly) 1968 { 1969 conn_t *connp = coa->coa_connp; 1970 ip_xmit_attr_t *ixa = coa->coa_ixa; 1971 icmp_t *icmp = connp->conn_icmp; 1972 icmp_stack_t *is = icmp->icmp_is; 1973 int *i1 = (int *)invalp; 1974 boolean_t onoff = (*i1 == 0) ? 0 : 1; 1975 int error; 1976 1977 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock)); 1978 1979 /* 1980 * For fixed length options, no sanity check 1981 * of passed in length is done. It is assumed *_optcom_req() 1982 * routines do the right thing. 1983 */ 1984 1985 switch (level) { 1986 case SOL_SOCKET: 1987 switch (name) { 1988 case SO_PROTOTYPE: 1989 if ((*i1 & 0xFF) != IPPROTO_ICMP && 1990 (*i1 & 0xFF) != IPPROTO_ICMPV6 && 1991 secpolicy_net_rawaccess(cr) != 0) { 1992 return (EACCES); 1993 } 1994 if (checkonly) 1995 break; 1996 1997 mutex_enter(&connp->conn_lock); 1998 connp->conn_proto = *i1 & 0xFF; 1999 ixa->ixa_protocol = connp->conn_proto; 2000 if ((connp->conn_proto == IPPROTO_RAW || 2001 connp->conn_proto == IPPROTO_IGMP) && 2002 connp->conn_family == AF_INET) { 2003 icmp->icmp_hdrincl = 1; 2004 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2005 } else if (connp->conn_proto == IPPROTO_UDP || 2006 connp->conn_proto == IPPROTO_TCP || 2007 connp->conn_proto == IPPROTO_SCTP) { 2008 /* Used by test applications like psh */ 2009 icmp->icmp_hdrincl = 0; 2010 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2011 } else { 2012 icmp->icmp_hdrincl = 0; 2013 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2014 } 2015 2016 if (connp->conn_family == AF_INET6 && 2017 connp->conn_proto == IPPROTO_ICMPV6) { 2018 /* Set offset for icmp6_cksum */ 2019 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 2020 ixa->ixa_raw_cksum_offset = 2; 2021 } 2022 if (icmp->icmp_filter != NULL && 2023 connp->conn_proto != IPPROTO_ICMPV6) { 2024 kmem_free(icmp->icmp_filter, 2025 sizeof (icmp6_filter_t)); 2026 icmp->icmp_filter = NULL; 2027 } 2028 mutex_exit(&connp->conn_lock); 2029 2030 coa->coa_changed |= COA_HEADER_CHANGED; 2031 /* 2032 * For SCTP, we don't use icmp_bind_proto() for 2033 * raw socket binding. 2034 */ 2035 if (connp->conn_proto == IPPROTO_SCTP) 2036 return (0); 2037 2038 coa->coa_changed |= COA_ICMP_BIND_NEEDED; 2039 return (0); 2040 2041 case SO_SNDBUF: 2042 if (*i1 > is->is_max_buf) { 2043 return (ENOBUFS); 2044 } 2045 break; 2046 case SO_RCVBUF: 2047 if (*i1 > is->is_max_buf) { 2048 return (ENOBUFS); 2049 } 2050 break; 2051 } 2052 break; 2053 2054 case IPPROTO_IP: 2055 /* 2056 * Only allow IPv4 option processing on IPv4 sockets. 2057 */ 2058 if (connp->conn_family != AF_INET) 2059 return (EINVAL); 2060 2061 switch (name) { 2062 case IP_HDRINCL: 2063 if (!checkonly) { 2064 mutex_enter(&connp->conn_lock); 2065 icmp->icmp_hdrincl = onoff; 2066 if (onoff) 2067 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2068 else 2069 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2070 mutex_exit(&connp->conn_lock); 2071 } 2072 break; 2073 } 2074 break; 2075 2076 case IPPROTO_IPV6: 2077 if (connp->conn_family != AF_INET6) 2078 return (EINVAL); 2079 2080 switch (name) { 2081 case IPV6_CHECKSUM: 2082 /* 2083 * Integer offset into the user data of where the 2084 * checksum is located. 2085 * Offset of -1 disables option. 2086 * Does not apply to IPPROTO_ICMPV6. 2087 */ 2088 if (connp->conn_proto == IPPROTO_ICMPV6 || 2089 coa->coa_ancillary) { 2090 return (EINVAL); 2091 } 2092 if ((*i1 != -1) && ((*i1 < 0) || (*i1 & 0x1) != 0)) { 2093 /* Negative or not 16 bit aligned offset */ 2094 return (EINVAL); 2095 } 2096 if (checkonly) 2097 break; 2098 2099 mutex_enter(&connp->conn_lock); 2100 if (*i1 == -1) { 2101 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 2102 ixa->ixa_raw_cksum_offset = 0; 2103 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2104 } else { 2105 ixa->ixa_flags |= IXAF_SET_RAW_CKSUM; 2106 ixa->ixa_raw_cksum_offset = *i1; 2107 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2108 } 2109 mutex_exit(&connp->conn_lock); 2110 break; 2111 } 2112 break; 2113 2114 case IPPROTO_ICMPV6: 2115 /* 2116 * Only allow IPv6 option processing on IPv6 sockets. 2117 */ 2118 if (connp->conn_family != AF_INET6) 2119 return (EINVAL); 2120 if (connp->conn_proto != IPPROTO_ICMPV6) 2121 return (EINVAL); 2122 2123 switch (name) { 2124 case ICMP6_FILTER: 2125 if (checkonly) 2126 break; 2127 2128 if ((inlen != 0) && 2129 (inlen != sizeof (icmp6_filter_t))) 2130 return (EINVAL); 2131 2132 mutex_enter(&connp->conn_lock); 2133 if (inlen == 0) { 2134 if (icmp->icmp_filter != NULL) { 2135 kmem_free(icmp->icmp_filter, 2136 sizeof (icmp6_filter_t)); 2137 icmp->icmp_filter = NULL; 2138 } 2139 } else { 2140 if (icmp->icmp_filter == NULL) { 2141 icmp->icmp_filter = kmem_alloc( 2142 sizeof (icmp6_filter_t), 2143 KM_NOSLEEP); 2144 if (icmp->icmp_filter == NULL) { 2145 mutex_exit(&connp->conn_lock); 2146 return (ENOBUFS); 2147 } 2148 } 2149 (void) bcopy(invalp, icmp->icmp_filter, inlen); 2150 } 2151 mutex_exit(&connp->conn_lock); 2152 break; 2153 } 2154 break; 2155 } 2156 error = conn_opt_set(coa, level, name, inlen, invalp, 2157 checkonly, cr); 2158 return (error); 2159 } 2160 2161 /* 2162 * This routine sets socket options. 2163 */ 2164 int 2165 icmp_opt_set(conn_t *connp, uint_t optset_context, int level, int name, 2166 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2167 void *thisdg_attrs, cred_t *cr) 2168 { 2169 icmp_t *icmp = connp->conn_icmp; 2170 int err; 2171 conn_opt_arg_t coas, *coa; 2172 boolean_t checkonly; 2173 icmp_stack_t *is = icmp->icmp_is; 2174 2175 switch (optset_context) { 2176 case SETFN_OPTCOM_CHECKONLY: 2177 checkonly = B_TRUE; 2178 /* 2179 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 2180 * inlen != 0 implies value supplied and 2181 * we have to "pretend" to set it. 2182 * inlen == 0 implies that there is no 2183 * value part in T_CHECK request and just validation 2184 * done elsewhere should be enough, we just return here. 2185 */ 2186 if (inlen == 0) { 2187 *outlenp = 0; 2188 return (0); 2189 } 2190 break; 2191 case SETFN_OPTCOM_NEGOTIATE: 2192 checkonly = B_FALSE; 2193 break; 2194 case SETFN_UD_NEGOTIATE: 2195 case SETFN_CONN_NEGOTIATE: 2196 checkonly = B_FALSE; 2197 /* 2198 * Negotiating local and "association-related" options 2199 * through T_UNITDATA_REQ. 2200 * 2201 * Following routine can filter out ones we do not 2202 * want to be "set" this way. 2203 */ 2204 if (!icmp_opt_allow_udr_set(level, name)) { 2205 *outlenp = 0; 2206 return (EINVAL); 2207 } 2208 break; 2209 default: 2210 /* 2211 * We should never get here 2212 */ 2213 *outlenp = 0; 2214 return (EINVAL); 2215 } 2216 2217 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 2218 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 2219 2220 if (thisdg_attrs != NULL) { 2221 /* Options from T_UNITDATA_REQ */ 2222 coa = (conn_opt_arg_t *)thisdg_attrs; 2223 ASSERT(coa->coa_connp == connp); 2224 ASSERT(coa->coa_ixa != NULL); 2225 ASSERT(coa->coa_ipp != NULL); 2226 ASSERT(coa->coa_ancillary); 2227 } else { 2228 coa = &coas; 2229 coas.coa_connp = connp; 2230 /* Get a reference on conn_ixa to prevent concurrent mods */ 2231 coas.coa_ixa = conn_get_ixa(connp, B_TRUE); 2232 if (coas.coa_ixa == NULL) { 2233 *outlenp = 0; 2234 return (ENOMEM); 2235 } 2236 coas.coa_ipp = &connp->conn_xmit_ipp; 2237 coas.coa_ancillary = B_FALSE; 2238 coas.coa_changed = 0; 2239 } 2240 2241 err = icmp_do_opt_set(coa, level, name, inlen, invalp, 2242 cr, checkonly); 2243 if (err != 0) { 2244 errout: 2245 if (!coa->coa_ancillary) 2246 ixa_refrele(coa->coa_ixa); 2247 *outlenp = 0; 2248 return (err); 2249 } 2250 2251 /* 2252 * Common case of OK return with outval same as inval. 2253 */ 2254 if (invalp != outvalp) { 2255 /* don't trust bcopy for identical src/dst */ 2256 (void) bcopy(invalp, outvalp, inlen); 2257 } 2258 *outlenp = inlen; 2259 2260 /* 2261 * If this was not ancillary data, then we rebuild the headers, 2262 * update the IRE/NCE, and IPsec as needed. 2263 * Since the label depends on the destination we go through 2264 * ip_set_destination first. 2265 */ 2266 if (coa->coa_ancillary) { 2267 return (0); 2268 } 2269 2270 if (coa->coa_changed & COA_ROUTE_CHANGED) { 2271 in6_addr_t saddr, faddr, nexthop; 2272 in_port_t fport; 2273 2274 /* 2275 * We clear lastdst to make sure we pick up the change 2276 * next time sending. 2277 * If we are connected we re-cache the information. 2278 * We ignore errors to preserve BSD behavior. 2279 * Note that we don't redo IPsec policy lookup here 2280 * since the final destination (or source) didn't change. 2281 */ 2282 mutex_enter(&connp->conn_lock); 2283 connp->conn_v6lastdst = ipv6_all_zeros; 2284 2285 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa, 2286 &connp->conn_faddr_v6, &nexthop); 2287 saddr = connp->conn_saddr_v6; 2288 faddr = connp->conn_faddr_v6; 2289 fport = connp->conn_fport; 2290 mutex_exit(&connp->conn_lock); 2291 2292 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) && 2293 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) { 2294 (void) ip_attr_connect(connp, coa->coa_ixa, 2295 &saddr, &faddr, &nexthop, fport, NULL, NULL, 2296 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 2297 } 2298 } 2299 2300 ixa_refrele(coa->coa_ixa); 2301 2302 if (coa->coa_changed & COA_HEADER_CHANGED) { 2303 /* 2304 * Rebuild the header template if we are connected. 2305 * Otherwise clear conn_v6lastdst so we rebuild the header 2306 * in the data path. 2307 */ 2308 mutex_enter(&connp->conn_lock); 2309 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) && 2310 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) { 2311 err = icmp_build_hdr_template(connp, 2312 &connp->conn_saddr_v6, &connp->conn_faddr_v6, 2313 connp->conn_flowinfo); 2314 if (err != 0) { 2315 mutex_exit(&connp->conn_lock); 2316 return (err); 2317 } 2318 } else { 2319 connp->conn_v6lastdst = ipv6_all_zeros; 2320 } 2321 mutex_exit(&connp->conn_lock); 2322 } 2323 if (coa->coa_changed & COA_RCVBUF_CHANGED) { 2324 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 2325 connp->conn_rcvbuf); 2326 } 2327 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) { 2328 connp->conn_wq->q_hiwat = connp->conn_sndbuf; 2329 } 2330 if (coa->coa_changed & COA_WROFF_CHANGED) { 2331 /* Increase wroff if needed */ 2332 uint_t wroff; 2333 2334 mutex_enter(&connp->conn_lock); 2335 wroff = connp->conn_ht_iphc_allocated + is->is_wroff_extra; 2336 if (wroff > connp->conn_wroff) { 2337 connp->conn_wroff = wroff; 2338 mutex_exit(&connp->conn_lock); 2339 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff); 2340 } else { 2341 mutex_exit(&connp->conn_lock); 2342 } 2343 } 2344 if (coa->coa_changed & COA_ICMP_BIND_NEEDED) { 2345 icmp_bind_proto(icmp); 2346 } 2347 return (err); 2348 } 2349 2350 /* This routine sets socket options. */ 2351 int 2352 icmp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name, 2353 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2354 void *thisdg_attrs, cred_t *cr) 2355 { 2356 conn_t *connp = Q_TO_CONN(q); 2357 int error; 2358 2359 error = icmp_opt_set(connp, optset_context, level, name, inlen, invalp, 2360 outlenp, outvalp, thisdg_attrs, cr); 2361 return (error); 2362 } 2363 2364 /* 2365 * Setup IP headers. 2366 * 2367 * Note that IP_HDRINCL has ipha_protocol that is different than conn_proto, 2368 * but icmp_output_hdrincl restores ipha_protocol once we return. 2369 */ 2370 mblk_t * 2371 icmp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp, 2372 const in6_addr_t *v6src, const in6_addr_t *v6dst, uint32_t flowinfo, 2373 mblk_t *data_mp, int *errorp) 2374 { 2375 mblk_t *mp; 2376 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2377 uint_t data_len; 2378 uint32_t cksum; 2379 2380 data_len = msgdsize(data_mp); 2381 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, connp->conn_proto, 2382 flowinfo, 0, data_mp, data_len, is->is_wroff_extra, &cksum, errorp); 2383 if (mp == NULL) { 2384 ASSERT(*errorp != 0); 2385 return (NULL); 2386 } 2387 2388 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length; 2389 2390 /* 2391 * If there was a routing option/header then conn_prepend_hdr 2392 * has massaged it and placed the pseudo-header checksum difference 2393 * in the cksum argument. 2394 * 2395 * Prepare for ICMPv6 checksum done in IP. 2396 * 2397 * We make it easy for IP to include our pseudo header 2398 * by putting our length (and any routing header adjustment) 2399 * in the ICMPv6 checksum field. 2400 * The IP source, destination, and length have already been set by 2401 * conn_prepend_hdr. 2402 */ 2403 cksum += data_len; 2404 cksum = (cksum >> 16) + (cksum & 0xFFFF); 2405 ASSERT(cksum < 0x10000); 2406 2407 if (ixa->ixa_flags & IXAF_IS_IPV4) { 2408 ipha_t *ipha = (ipha_t *)mp->b_rptr; 2409 2410 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen); 2411 } else { 2412 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 2413 uint_t cksum_offset = 0; 2414 2415 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen); 2416 2417 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 2418 if (connp->conn_proto == IPPROTO_ICMPV6) { 2419 cksum_offset = ixa->ixa_ip_hdr_length + 2420 offsetof(icmp6_t, icmp6_cksum); 2421 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2422 cksum_offset = ixa->ixa_ip_hdr_length + 2423 ixa->ixa_raw_cksum_offset; 2424 } 2425 } 2426 if (cksum_offset != 0) { 2427 uint16_t *ptr; 2428 2429 /* Make sure the checksum fits in the first mblk */ 2430 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 2431 mblk_t *mp1; 2432 2433 mp1 = msgpullup(mp, 2434 cksum_offset + sizeof (short)); 2435 freemsg(mp); 2436 if (mp1 == NULL) { 2437 *errorp = ENOMEM; 2438 return (NULL); 2439 } 2440 mp = mp1; 2441 ip6h = (ip6_t *)mp->b_rptr; 2442 } 2443 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 2444 *ptr = htons(cksum); 2445 } 2446 } 2447 2448 /* Note that we don't try to update wroff due to ancillary data */ 2449 return (mp); 2450 } 2451 2452 static int 2453 icmp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src, 2454 const in6_addr_t *v6dst, uint32_t flowinfo) 2455 { 2456 int error; 2457 2458 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2459 /* 2460 * We clear lastdst to make sure we don't use the lastdst path 2461 * next time sending since we might not have set v6dst yet. 2462 */ 2463 connp->conn_v6lastdst = ipv6_all_zeros; 2464 2465 error = conn_build_hdr_template(connp, 0, 0, v6src, v6dst, flowinfo); 2466 if (error != 0) 2467 return (error); 2468 2469 /* 2470 * Any routing header/option has been massaged. The checksum difference 2471 * is stored in conn_sum. 2472 */ 2473 return (0); 2474 } 2475 2476 static mblk_t * 2477 icmp_queue_fallback(icmp_t *icmp, mblk_t *mp) 2478 { 2479 ASSERT(MUTEX_HELD(&icmp->icmp_recv_lock)); 2480 if (IPCL_IS_NONSTR(icmp->icmp_connp)) { 2481 /* 2482 * fallback has started but messages have not been moved yet 2483 */ 2484 if (icmp->icmp_fallback_queue_head == NULL) { 2485 ASSERT(icmp->icmp_fallback_queue_tail == NULL); 2486 icmp->icmp_fallback_queue_head = mp; 2487 icmp->icmp_fallback_queue_tail = mp; 2488 } else { 2489 ASSERT(icmp->icmp_fallback_queue_tail != NULL); 2490 icmp->icmp_fallback_queue_tail->b_next = mp; 2491 icmp->icmp_fallback_queue_tail = mp; 2492 } 2493 return (NULL); 2494 } else { 2495 /* 2496 * Fallback completed, let the caller putnext() the mblk. 2497 */ 2498 return (mp); 2499 } 2500 } 2501 2502 /* 2503 * Deliver data to ULP. In case we have a socket, and it's falling back to 2504 * TPI, then we'll queue the mp for later processing. 2505 */ 2506 static void 2507 icmp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len) 2508 { 2509 if (IPCL_IS_NONSTR(connp)) { 2510 icmp_t *icmp = connp->conn_icmp; 2511 int error; 2512 2513 ASSERT(len == msgdsize(mp)); 2514 if ((*connp->conn_upcalls->su_recv) 2515 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) { 2516 mutex_enter(&icmp->icmp_recv_lock); 2517 if (error == ENOSPC) { 2518 /* 2519 * let's confirm while holding the lock 2520 */ 2521 if ((*connp->conn_upcalls->su_recv) 2522 (connp->conn_upper_handle, NULL, 0, 0, 2523 &error, NULL) < 0) { 2524 ASSERT(error == ENOSPC); 2525 if (error == ENOSPC) { 2526 connp->conn_flow_cntrld = 2527 B_TRUE; 2528 } 2529 } 2530 mutex_exit(&icmp->icmp_recv_lock); 2531 } else { 2532 ASSERT(error == EOPNOTSUPP); 2533 mp = icmp_queue_fallback(icmp, mp); 2534 mutex_exit(&icmp->icmp_recv_lock); 2535 if (mp != NULL) 2536 putnext(connp->conn_rq, mp); 2537 } 2538 } 2539 ASSERT(MUTEX_NOT_HELD(&icmp->icmp_recv_lock)); 2540 } else { 2541 putnext(connp->conn_rq, mp); 2542 } 2543 } 2544 2545 /* 2546 * This is the inbound data path. 2547 * IP has already pulled up the IP headers and verified alignment 2548 * etc. 2549 */ 2550 /* ARGSUSED2 */ 2551 static void 2552 icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2553 { 2554 conn_t *connp = (conn_t *)arg1; 2555 struct T_unitdata_ind *tudi; 2556 uchar_t *rptr; /* Pointer to IP header */ 2557 int ip_hdr_length; 2558 int udi_size; /* Size of T_unitdata_ind */ 2559 int pkt_len; 2560 icmp_t *icmp; 2561 ip_pkt_t ipps; 2562 ip6_t *ip6h; 2563 mblk_t *mp1; 2564 crb_t recv_ancillary; 2565 icmp_stack_t *is; 2566 sin_t *sin; 2567 sin6_t *sin6; 2568 ipha_t *ipha; 2569 2570 ASSERT(connp->conn_flags & IPCL_RAWIPCONN); 2571 2572 icmp = connp->conn_icmp; 2573 is = icmp->icmp_is; 2574 rptr = mp->b_rptr; 2575 2576 ASSERT(DB_TYPE(mp) == M_DATA); 2577 ASSERT(OK_32PTR(rptr)); 2578 ASSERT(ira->ira_pktlen == msgdsize(mp)); 2579 pkt_len = ira->ira_pktlen; 2580 2581 /* 2582 * Get a snapshot of these and allow other threads to change 2583 * them after that. We need the same recv_ancillary when determining 2584 * the size as when adding the ancillary data items. 2585 */ 2586 mutex_enter(&connp->conn_lock); 2587 recv_ancillary = connp->conn_recv_ancillary; 2588 mutex_exit(&connp->conn_lock); 2589 2590 ip_hdr_length = ira->ira_ip_hdr_length; 2591 ASSERT(MBLKL(mp) >= ip_hdr_length); /* IP did a pullup */ 2592 2593 /* Initialize regardless of IP version */ 2594 ipps.ipp_fields = 0; 2595 2596 if (ira->ira_flags & IRAF_IS_IPV4) { 2597 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION); 2598 ASSERT(MBLKL(mp) >= sizeof (ipha_t)); 2599 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr)); 2600 2601 ipha = (ipha_t *)mp->b_rptr; 2602 if (recv_ancillary.crb_all != 0) 2603 (void) ip_find_hdr_v4(ipha, &ipps, B_FALSE); 2604 2605 /* 2606 * BSD for some reason adjusts ipha_length to exclude the 2607 * IP header length. We do the same. 2608 */ 2609 if (is->is_bsd_compat) { 2610 ushort_t len; 2611 2612 len = ntohs(ipha->ipha_length); 2613 if (mp->b_datap->db_ref > 1) { 2614 /* 2615 * Allocate a new IP header so that we can 2616 * modify ipha_length. 2617 */ 2618 mblk_t *mp1; 2619 2620 mp1 = allocb(ip_hdr_length, BPRI_MED); 2621 if (mp1 == NULL) { 2622 freemsg(mp); 2623 BUMP_MIB(&is->is_rawip_mib, 2624 rawipInErrors); 2625 return; 2626 } 2627 bcopy(rptr, mp1->b_rptr, ip_hdr_length); 2628 mp->b_rptr = rptr + ip_hdr_length; 2629 rptr = mp1->b_rptr; 2630 ipha = (ipha_t *)rptr; 2631 mp1->b_cont = mp; 2632 mp1->b_wptr = rptr + ip_hdr_length; 2633 mp = mp1; 2634 } 2635 len -= ip_hdr_length; 2636 ipha->ipha_length = htons(len); 2637 } 2638 2639 /* 2640 * For RAW sockets we not pass ICMP/IPv4 packets to AF_INET6 2641 * sockets. This is ensured by icmp_bind and the IP fanout code. 2642 */ 2643 ASSERT(connp->conn_family == AF_INET); 2644 2645 /* 2646 * This is the inbound data path. Packets are passed upstream 2647 * as T_UNITDATA_IND messages with full IPv4 headers still 2648 * attached. 2649 */ 2650 2651 /* 2652 * Normally only send up the source address. 2653 * If any ancillary data items are wanted we add those. 2654 */ 2655 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t); 2656 if (recv_ancillary.crb_all != 0) { 2657 udi_size += conn_recvancillary_size(connp, 2658 recv_ancillary, ira, mp, &ipps); 2659 } 2660 2661 /* Allocate a message block for the T_UNITDATA_IND structure. */ 2662 mp1 = allocb(udi_size, BPRI_MED); 2663 if (mp1 == NULL) { 2664 freemsg(mp); 2665 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2666 return; 2667 } 2668 mp1->b_cont = mp; 2669 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2670 mp1->b_datap->db_type = M_PROTO; 2671 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2672 tudi->PRIM_type = T_UNITDATA_IND; 2673 tudi->SRC_length = sizeof (sin_t); 2674 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2675 sin = (sin_t *)&tudi[1]; 2676 *sin = sin_null; 2677 sin->sin_family = AF_INET; 2678 sin->sin_addr.s_addr = ipha->ipha_src; 2679 *(uint32_t *)&sin->sin_zero[0] = 0; 2680 *(uint32_t *)&sin->sin_zero[4] = 0; 2681 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + 2682 sizeof (sin_t); 2683 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t)); 2684 tudi->OPT_length = udi_size; 2685 2686 /* 2687 * Add options if IP_RECVIF etc is set 2688 */ 2689 if (udi_size != 0) { 2690 conn_recvancillary_add(connp, recv_ancillary, ira, 2691 &ipps, (uchar_t *)&sin[1], udi_size); 2692 } 2693 goto deliver; 2694 } 2695 2696 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION); 2697 /* 2698 * IPv6 packets can only be received by applications 2699 * that are prepared to receive IPv6 addresses. 2700 * The IP fanout must ensure this. 2701 */ 2702 ASSERT(connp->conn_family == AF_INET6); 2703 2704 /* 2705 * Handle IPv6 packets. We don't pass up the IP headers with the 2706 * payload for IPv6. 2707 */ 2708 2709 ip6h = (ip6_t *)rptr; 2710 if (recv_ancillary.crb_all != 0) { 2711 /* 2712 * Call on ip_find_hdr_v6 which gets individual lenghts of 2713 * extension headers (and pointers to them). 2714 */ 2715 uint8_t nexthdr; 2716 2717 /* We don't care about the length or nextheader. */ 2718 (void) ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps, &nexthdr); 2719 2720 /* 2721 * We do not pass up hop-by-hop options or any other 2722 * extension header as part of the packet. Applications 2723 * that want to see them have to specify IPV6_RECV* socket 2724 * options. And conn_recvancillary_size/add explicitly 2725 * drops the TX option from IPV6_HOPOPTS as it does for UDP. 2726 * 2727 * If we had multilevel ICMP sockets, then we'd want to 2728 * modify conn_recvancillary_size/add to 2729 * allow the user to see the label. 2730 */ 2731 } 2732 2733 /* 2734 * Check a filter for ICMPv6 types if needed. 2735 * Verify raw checksums if needed. 2736 */ 2737 mutex_enter(&connp->conn_lock); 2738 if (icmp->icmp_filter != NULL) { 2739 int type; 2740 2741 /* Assumes that IP has done the pullupmsg */ 2742 type = mp->b_rptr[ip_hdr_length]; 2743 2744 ASSERT(mp->b_rptr + ip_hdr_length <= mp->b_wptr); 2745 if (ICMP6_FILTER_WILLBLOCK(type, icmp->icmp_filter)) { 2746 mutex_exit(&connp->conn_lock); 2747 freemsg(mp); 2748 return; 2749 } 2750 } 2751 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2752 /* Checksum */ 2753 uint16_t *up; 2754 uint32_t sum; 2755 int remlen; 2756 2757 up = (uint16_t *)&ip6h->ip6_src; 2758 2759 remlen = msgdsize(mp) - ip_hdr_length; 2760 sum = htons(connp->conn_proto + remlen) 2761 + up[0] + up[1] + up[2] + up[3] 2762 + up[4] + up[5] + up[6] + up[7] 2763 + up[8] + up[9] + up[10] + up[11] 2764 + up[12] + up[13] + up[14] + up[15]; 2765 sum = (sum & 0xffff) + (sum >> 16); 2766 sum = IP_CSUM(mp, ip_hdr_length, sum); 2767 if (sum != 0) { 2768 /* IPv6 RAW checksum failed */ 2769 ip0dbg(("icmp_rput: RAW checksum failed %x\n", sum)); 2770 mutex_exit(&connp->conn_lock); 2771 freemsg(mp); 2772 BUMP_MIB(&is->is_rawip_mib, rawipInCksumErrs); 2773 return; 2774 } 2775 } 2776 mutex_exit(&connp->conn_lock); 2777 2778 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2779 2780 if (recv_ancillary.crb_all != 0) { 2781 udi_size += conn_recvancillary_size(connp, 2782 recv_ancillary, ira, mp, &ipps); 2783 } 2784 2785 mp1 = allocb(udi_size, BPRI_MED); 2786 if (mp1 == NULL) { 2787 freemsg(mp); 2788 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2789 return; 2790 } 2791 mp1->b_cont = mp; 2792 mp1->b_datap->db_type = M_PROTO; 2793 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2794 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2795 tudi->PRIM_type = T_UNITDATA_IND; 2796 tudi->SRC_length = sizeof (sin6_t); 2797 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2798 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2799 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t)); 2800 tudi->OPT_length = udi_size; 2801 sin6 = (sin6_t *)&tudi[1]; 2802 *sin6 = sin6_null; 2803 sin6->sin6_port = 0; 2804 sin6->sin6_family = AF_INET6; 2805 2806 sin6->sin6_addr = ip6h->ip6_src; 2807 /* No sin6_flowinfo per API */ 2808 sin6->sin6_flowinfo = 0; 2809 /* For link-scope pass up scope id */ 2810 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) 2811 sin6->sin6_scope_id = ira->ira_ruifindex; 2812 else 2813 sin6->sin6_scope_id = 0; 2814 sin6->__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 2815 IPCL_ZONEID(connp), is->is_netstack); 2816 2817 if (udi_size != 0) { 2818 conn_recvancillary_add(connp, recv_ancillary, ira, 2819 &ipps, (uchar_t *)&sin6[1], udi_size); 2820 } 2821 2822 /* Skip all the IPv6 headers per API */ 2823 mp->b_rptr += ip_hdr_length; 2824 pkt_len -= ip_hdr_length; 2825 2826 deliver: 2827 BUMP_MIB(&is->is_rawip_mib, rawipInDatagrams); 2828 icmp_ulp_recv(connp, mp1, pkt_len); 2829 } 2830 2831 /* 2832 * return SNMP stuff in buffer in mpdata. We don't hold any lock and report 2833 * information that can be changing beneath us. 2834 */ 2835 mblk_t * 2836 icmp_snmp_get(queue_t *q, mblk_t *mpctl) 2837 { 2838 mblk_t *mpdata; 2839 struct opthdr *optp; 2840 conn_t *connp = Q_TO_CONN(q); 2841 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2842 mblk_t *mp2ctl; 2843 2844 /* 2845 * make a copy of the original message 2846 */ 2847 mp2ctl = copymsg(mpctl); 2848 2849 if (mpctl == NULL || 2850 (mpdata = mpctl->b_cont) == NULL) { 2851 freemsg(mpctl); 2852 freemsg(mp2ctl); 2853 return (0); 2854 } 2855 2856 /* fixed length structure for IPv4 and IPv6 counters */ 2857 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 2858 optp->level = EXPER_RAWIP; 2859 optp->name = 0; 2860 (void) snmp_append_data(mpdata, (char *)&is->is_rawip_mib, 2861 sizeof (is->is_rawip_mib)); 2862 optp->len = msgdsize(mpdata); 2863 qreply(q, mpctl); 2864 2865 return (mp2ctl); 2866 } 2867 2868 /* 2869 * Return 0 if invalid set request, 1 otherwise, including non-rawip requests. 2870 * TODO: If this ever actually tries to set anything, it needs to be 2871 * to do the appropriate locking. 2872 */ 2873 /* ARGSUSED */ 2874 int 2875 icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 2876 uchar_t *ptr, int len) 2877 { 2878 switch (level) { 2879 case EXPER_RAWIP: 2880 return (0); 2881 default: 2882 return (1); 2883 } 2884 } 2885 2886 /* 2887 * This routine creates a T_UDERROR_IND message and passes it upstream. 2888 * The address and options are copied from the T_UNITDATA_REQ message 2889 * passed in mp. This message is freed. 2890 */ 2891 static void 2892 icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err) 2893 { 2894 struct T_unitdata_req *tudr; 2895 mblk_t *mp1; 2896 uchar_t *destaddr; 2897 t_scalar_t destlen; 2898 uchar_t *optaddr; 2899 t_scalar_t optlen; 2900 2901 if ((mp->b_wptr < mp->b_rptr) || 2902 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) { 2903 goto done; 2904 } 2905 tudr = (struct T_unitdata_req *)mp->b_rptr; 2906 destaddr = mp->b_rptr + tudr->DEST_offset; 2907 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr || 2908 destaddr + tudr->DEST_length < mp->b_rptr || 2909 destaddr + tudr->DEST_length > mp->b_wptr) { 2910 goto done; 2911 } 2912 optaddr = mp->b_rptr + tudr->OPT_offset; 2913 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr || 2914 optaddr + tudr->OPT_length < mp->b_rptr || 2915 optaddr + tudr->OPT_length > mp->b_wptr) { 2916 goto done; 2917 } 2918 destlen = tudr->DEST_length; 2919 optlen = tudr->OPT_length; 2920 2921 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen, 2922 (char *)optaddr, optlen, err); 2923 if (mp1 != NULL) 2924 qreply(q, mp1); 2925 2926 done: 2927 freemsg(mp); 2928 } 2929 2930 static int 2931 rawip_do_unbind(conn_t *connp) 2932 { 2933 icmp_t *icmp = connp->conn_icmp; 2934 2935 mutex_enter(&connp->conn_lock); 2936 /* If a bind has not been done, we can't unbind. */ 2937 if (icmp->icmp_state == TS_UNBND) { 2938 mutex_exit(&connp->conn_lock); 2939 return (-TOUTSTATE); 2940 } 2941 connp->conn_saddr_v6 = ipv6_all_zeros; 2942 connp->conn_bound_addr_v6 = ipv6_all_zeros; 2943 connp->conn_laddr_v6 = ipv6_all_zeros; 2944 connp->conn_mcbc_bind = B_FALSE; 2945 connp->conn_lport = 0; 2946 connp->conn_fport = 0; 2947 /* In case we were also connected */ 2948 connp->conn_faddr_v6 = ipv6_all_zeros; 2949 connp->conn_v6lastdst = ipv6_all_zeros; 2950 2951 icmp->icmp_state = TS_UNBND; 2952 2953 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 2954 &connp->conn_faddr_v6, connp->conn_flowinfo); 2955 mutex_exit(&connp->conn_lock); 2956 2957 ip_unbind(connp); 2958 return (0); 2959 } 2960 2961 /* 2962 * This routine is called by icmp_wput to handle T_UNBIND_REQ messages. 2963 * After some error checking, the message is passed downstream to ip. 2964 */ 2965 static void 2966 icmp_tpi_unbind(queue_t *q, mblk_t *mp) 2967 { 2968 conn_t *connp = Q_TO_CONN(q); 2969 int error; 2970 2971 ASSERT(mp->b_cont == NULL); 2972 error = rawip_do_unbind(connp); 2973 if (error) { 2974 if (error < 0) { 2975 icmp_err_ack(q, mp, -error, 0); 2976 } else { 2977 icmp_err_ack(q, mp, 0, error); 2978 } 2979 return; 2980 } 2981 2982 /* 2983 * Convert mp into a T_OK_ACK 2984 */ 2985 2986 mp = mi_tpi_ok_ack_alloc(mp); 2987 2988 /* 2989 * should not happen in practice... T_OK_ACK is smaller than the 2990 * original message. 2991 */ 2992 ASSERT(mp != NULL); 2993 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK); 2994 qreply(q, mp); 2995 } 2996 2997 /* 2998 * Process IPv4 packets that already include an IP header. 2999 * Used when IP_HDRINCL has been set (implicit for IPPROTO_RAW and 3000 * IPPROTO_IGMP). 3001 * In this case we ignore the address and any options in the T_UNITDATA_REQ. 3002 * 3003 * The packet is assumed to have a base (20 byte) IP header followed 3004 * by the upper-layer protocol. We include any IP_OPTIONS including a 3005 * CIPSO label but otherwise preserve the base IP header. 3006 */ 3007 static int 3008 icmp_output_hdrincl(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3009 { 3010 icmp_t *icmp = connp->conn_icmp; 3011 icmp_stack_t *is = icmp->icmp_is; 3012 ipha_t iphas; 3013 ipha_t *ipha; 3014 int ip_hdr_length; 3015 int tp_hdr_len; 3016 ip_xmit_attr_t *ixa; 3017 ip_pkt_t *ipp; 3018 in6_addr_t v6src; 3019 in6_addr_t v6dst; 3020 in6_addr_t v6nexthop; 3021 int error; 3022 boolean_t do_ipsec; 3023 3024 /* 3025 * We need an exclusive copy of conn_ixa since the included IP 3026 * header could have any destination. 3027 * That copy has no pointers hence we 3028 * need to set them up once we've parsed the ancillary data. 3029 */ 3030 ixa = conn_get_ixa_exclusive(connp); 3031 if (ixa == NULL) { 3032 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3033 freemsg(mp); 3034 return (ENOMEM); 3035 } 3036 ASSERT(cr != NULL); 3037 /* 3038 * Caller has a reference on cr; from db_credp or because we 3039 * are running in process context. 3040 */ 3041 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3042 ixa->ixa_cred = cr; 3043 ixa->ixa_cpid = pid; 3044 if (is_system_labeled()) { 3045 /* We need to restart with a label based on the cred */ 3046 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3047 } 3048 3049 /* In case previous destination was multicast or multirt */ 3050 ip_attr_newdst(ixa); 3051 3052 /* Get a copy of conn_xmit_ipp since the TX label might change it */ 3053 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3054 if (ipp == NULL) { 3055 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3056 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3057 ixa->ixa_cpid = connp->conn_cpid; 3058 ixa_refrele(ixa); 3059 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3060 freemsg(mp); 3061 return (ENOMEM); 3062 } 3063 mutex_enter(&connp->conn_lock); 3064 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3065 mutex_exit(&connp->conn_lock); 3066 if (error != 0) { 3067 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3068 freemsg(mp); 3069 goto done; 3070 } 3071 3072 /* Sanity check length of packet */ 3073 ipha = (ipha_t *)mp->b_rptr; 3074 3075 ip_hdr_length = IP_SIMPLE_HDR_LENGTH; 3076 if ((mp->b_wptr - mp->b_rptr) < IP_SIMPLE_HDR_LENGTH) { 3077 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 3078 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3079 freemsg(mp); 3080 goto done; 3081 } 3082 ipha = (ipha_t *)mp->b_rptr; 3083 } 3084 ipha->ipha_version_and_hdr_length = 3085 (IP_VERSION<<4) | (ip_hdr_length>>2); 3086 3087 /* 3088 * We set IXAF_DONTFRAG if the application set DF which makes 3089 * IP not fragment. 3090 */ 3091 ipha->ipha_fragment_offset_and_flags &= htons(IPH_DF); 3092 if (ipha->ipha_fragment_offset_and_flags & htons(IPH_DF)) 3093 ixa->ixa_flags |= (IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3094 else 3095 ixa->ixa_flags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3096 3097 /* Even for multicast and broadcast we honor the apps ttl */ 3098 ixa->ixa_flags |= IXAF_NO_TTL_CHANGE; 3099 3100 /* 3101 * No source verification for non-local addresses 3102 */ 3103 if (ipha->ipha_src != INADDR_ANY && 3104 ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid, 3105 is->is_netstack->netstack_ip, B_FALSE) 3106 != IPVL_UNICAST_UP) { 3107 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3108 } 3109 3110 if (ipha->ipha_dst == INADDR_ANY) 3111 ipha->ipha_dst = htonl(INADDR_LOOPBACK); 3112 3113 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src); 3114 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 3115 3116 /* Defer IPsec if it might need to look at ICMP type/code */ 3117 do_ipsec = ipha->ipha_protocol != IPPROTO_ICMP; 3118 ixa->ixa_flags |= IXAF_IS_IPV4; 3119 3120 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3121 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, 3122 connp->conn_fport, &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3123 (do_ipsec ? IPDF_IPSEC : 0)); 3124 switch (error) { 3125 case 0: 3126 break; 3127 case EADDRNOTAVAIL: 3128 /* 3129 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3130 * Don't have the application see that errno 3131 */ 3132 error = ENETUNREACH; 3133 goto failed; 3134 case ENETDOWN: 3135 /* 3136 * Have !ipif_addr_ready address; drop packet silently 3137 * until we can get applications to not send until we 3138 * are ready. 3139 */ 3140 error = 0; 3141 goto failed; 3142 case EHOSTUNREACH: 3143 case ENETUNREACH: 3144 if (ixa->ixa_ire != NULL) { 3145 /* 3146 * Let conn_ip_output/ire_send_noroute return 3147 * the error and send any local ICMP error. 3148 */ 3149 error = 0; 3150 break; 3151 } 3152 /* FALLTHRU */ 3153 default: 3154 failed: 3155 freemsg(mp); 3156 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3157 goto done; 3158 } 3159 if (ipha->ipha_src == INADDR_ANY) 3160 IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src); 3161 3162 /* 3163 * We might be going to a different destination than last time, 3164 * thus check that TX allows the communication and compute any 3165 * needed label. 3166 * 3167 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3168 * don't have to worry about concurrent threads. 3169 */ 3170 if (is_system_labeled()) { 3171 /* 3172 * Check whether Trusted Solaris policy allows communication 3173 * with this host, and pretend that the destination is 3174 * unreachable if not. 3175 * Compute any needed label and place it in ipp_label_v4/v6. 3176 * 3177 * Later conn_build_hdr_template/conn_prepend_hdr takes 3178 * ipp_label_v4/v6 to form the packet. 3179 * 3180 * Tsol note: We have ipp structure local to this thread so 3181 * no locking is needed. 3182 */ 3183 error = conn_update_label(connp, ixa, &v6dst, ipp); 3184 if (error != 0) { 3185 freemsg(mp); 3186 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3187 goto done; 3188 } 3189 } 3190 3191 /* 3192 * Save away a copy of the IPv4 header the application passed down 3193 * and then prepend an IPv4 header complete with any IP options 3194 * including label. 3195 * We need a struct copy since icmp_prepend_hdr will reuse the available 3196 * space in the mblk. 3197 */ 3198 iphas = *ipha; 3199 mp->b_rptr += IP_SIMPLE_HDR_LENGTH; 3200 3201 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, 0, mp, &error); 3202 if (mp == NULL) { 3203 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3204 ASSERT(error != 0); 3205 goto done; 3206 } 3207 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3208 error = EMSGSIZE; 3209 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3210 freemsg(mp); 3211 goto done; 3212 } 3213 /* Restore key parts of the header that the application passed down */ 3214 ipha = (ipha_t *)mp->b_rptr; 3215 ipha->ipha_type_of_service = iphas.ipha_type_of_service; 3216 ipha->ipha_ident = iphas.ipha_ident; 3217 ipha->ipha_fragment_offset_and_flags = 3218 iphas.ipha_fragment_offset_and_flags; 3219 ipha->ipha_ttl = iphas.ipha_ttl; 3220 ipha->ipha_protocol = iphas.ipha_protocol; 3221 ipha->ipha_src = iphas.ipha_src; 3222 ipha->ipha_dst = iphas.ipha_dst; 3223 3224 ixa->ixa_protocol = ipha->ipha_protocol; 3225 3226 /* 3227 * Make sure that the IP header plus any transport header that is 3228 * checksumed by ip_output is in the first mblk. (ip_output assumes 3229 * that at least the checksum field is in the first mblk.) 3230 */ 3231 switch (ipha->ipha_protocol) { 3232 case IPPROTO_UDP: 3233 tp_hdr_len = 8; 3234 break; 3235 case IPPROTO_TCP: 3236 tp_hdr_len = 20; 3237 break; 3238 default: 3239 tp_hdr_len = 0; 3240 break; 3241 } 3242 ip_hdr_length = IPH_HDR_LENGTH(ipha); 3243 if (mp->b_wptr - mp->b_rptr < ip_hdr_length + tp_hdr_len) { 3244 if (!pullupmsg(mp, ip_hdr_length + tp_hdr_len)) { 3245 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3246 if (mp->b_cont == NULL) 3247 error = EINVAL; 3248 else 3249 error = ENOMEM; 3250 freemsg(mp); 3251 goto done; 3252 } 3253 } 3254 3255 if (!do_ipsec) { 3256 /* Policy might differ for different ICMP type/code */ 3257 if (ixa->ixa_ipsec_policy != NULL) { 3258 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3259 ixa->ixa_ipsec_policy = NULL; 3260 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3261 } 3262 mp = ip_output_attach_policy(mp, ipha, NULL, connp, ixa); 3263 if (mp == NULL) { 3264 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3265 error = EHOSTUNREACH; /* IPsec policy failure */ 3266 goto done; 3267 } 3268 } 3269 3270 /* We're done. Pass the packet to ip. */ 3271 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3272 3273 error = conn_ip_output(mp, ixa); 3274 /* No rawipOutErrors if an error since IP increases its error counter */ 3275 switch (error) { 3276 case 0: 3277 break; 3278 case EWOULDBLOCK: 3279 (void) ixa_check_drain_insert(connp, ixa); 3280 error = 0; 3281 break; 3282 case EADDRNOTAVAIL: 3283 /* 3284 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3285 * Don't have the application see that errno 3286 */ 3287 error = ENETUNREACH; 3288 break; 3289 } 3290 done: 3291 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3292 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3293 ixa->ixa_cpid = connp->conn_cpid; 3294 ixa_refrele(ixa); 3295 ip_pkt_free(ipp); 3296 kmem_free(ipp, sizeof (*ipp)); 3297 return (error); 3298 } 3299 3300 static mblk_t * 3301 icmp_output_attach_policy(mblk_t *mp, conn_t *connp, ip_xmit_attr_t *ixa) 3302 { 3303 ipha_t *ipha = NULL; 3304 ip6_t *ip6h = NULL; 3305 3306 if (ixa->ixa_flags & IXAF_IS_IPV4) 3307 ipha = (ipha_t *)mp->b_rptr; 3308 else 3309 ip6h = (ip6_t *)mp->b_rptr; 3310 3311 if (ixa->ixa_ipsec_policy != NULL) { 3312 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3313 ixa->ixa_ipsec_policy = NULL; 3314 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3315 } 3316 return (ip_output_attach_policy(mp, ipha, ip6h, connp, ixa)); 3317 } 3318 3319 /* 3320 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6 3321 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from 3322 * the TPI options, otherwise we take them from msg_control. 3323 * If both sin and sin6 is set it is a connected socket and we use conn_faddr. 3324 * Always consumes mp; never consumes tudr_mp. 3325 */ 3326 static int 3327 icmp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp, 3328 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid) 3329 { 3330 icmp_t *icmp = connp->conn_icmp; 3331 icmp_stack_t *is = icmp->icmp_is; 3332 int error; 3333 ip_xmit_attr_t *ixa; 3334 ip_pkt_t *ipp; 3335 in6_addr_t v6src; 3336 in6_addr_t v6dst; 3337 in6_addr_t v6nexthop; 3338 in_port_t dstport; 3339 uint32_t flowinfo; 3340 uint_t srcid; 3341 int is_absreq_failure = 0; 3342 conn_opt_arg_t coas, *coa; 3343 3344 ASSERT(tudr_mp != NULL || msg != NULL); 3345 3346 /* 3347 * Get ixa before checking state to handle a disconnect race. 3348 * 3349 * We need an exclusive copy of conn_ixa since the ancillary data 3350 * options might modify it. That copy has no pointers hence we 3351 * need to set them up once we've parsed the ancillary data. 3352 */ 3353 ixa = conn_get_ixa_exclusive(connp); 3354 if (ixa == NULL) { 3355 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3356 freemsg(mp); 3357 return (ENOMEM); 3358 } 3359 ASSERT(cr != NULL); 3360 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3361 ixa->ixa_cred = cr; 3362 ixa->ixa_cpid = pid; 3363 if (is_system_labeled()) { 3364 /* We need to restart with a label based on the cred */ 3365 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3366 } 3367 3368 /* In case previous destination was multicast or multirt */ 3369 ip_attr_newdst(ixa); 3370 3371 /* Get a copy of conn_xmit_ipp since the options might change it */ 3372 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3373 if (ipp == NULL) { 3374 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3375 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3376 ixa->ixa_cpid = connp->conn_cpid; 3377 ixa_refrele(ixa); 3378 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3379 freemsg(mp); 3380 return (ENOMEM); 3381 } 3382 mutex_enter(&connp->conn_lock); 3383 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3384 mutex_exit(&connp->conn_lock); 3385 if (error != 0) { 3386 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3387 freemsg(mp); 3388 goto done; 3389 } 3390 3391 /* 3392 * Parse the options and update ixa and ipp as a result. 3393 */ 3394 3395 coa = &coas; 3396 coa->coa_connp = connp; 3397 coa->coa_ixa = ixa; 3398 coa->coa_ipp = ipp; 3399 coa->coa_ancillary = B_TRUE; 3400 coa->coa_changed = 0; 3401 3402 if (msg != NULL) { 3403 error = process_auxiliary_options(connp, msg->msg_control, 3404 msg->msg_controllen, coa, &icmp_opt_obj, icmp_opt_set, cr); 3405 } else { 3406 struct T_unitdata_req *tudr; 3407 3408 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr; 3409 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ); 3410 error = tpi_optcom_buf(connp->conn_wq, tudr_mp, 3411 &tudr->OPT_length, tudr->OPT_offset, cr, &icmp_opt_obj, 3412 coa, &is_absreq_failure); 3413 } 3414 if (error != 0) { 3415 /* 3416 * Note: No special action needed in this 3417 * module for "is_absreq_failure" 3418 */ 3419 freemsg(mp); 3420 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3421 goto done; 3422 } 3423 ASSERT(is_absreq_failure == 0); 3424 3425 mutex_enter(&connp->conn_lock); 3426 /* 3427 * If laddr is unspecified then we look at sin6_src_id. 3428 * We will give precedence to a source address set with IPV6_PKTINFO 3429 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 3430 * want ip_attr_connect to select a source (since it can fail) when 3431 * IPV6_PKTINFO is specified. 3432 * If this doesn't result in a source address then we get a source 3433 * from ip_attr_connect() below. 3434 */ 3435 v6src = connp->conn_saddr_v6; 3436 if (sin != NULL) { 3437 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 3438 dstport = sin->sin_port; 3439 flowinfo = 0; 3440 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3441 ixa->ixa_flags |= IXAF_IS_IPV4; 3442 } else if (sin6 != NULL) { 3443 v6dst = sin6->sin6_addr; 3444 dstport = sin6->sin6_port; 3445 flowinfo = sin6->sin6_flowinfo; 3446 srcid = sin6->__sin6_src_id; 3447 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 3448 ixa->ixa_scopeid = sin6->sin6_scope_id; 3449 ixa->ixa_flags |= IXAF_SCOPEID_SET; 3450 } else { 3451 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3452 } 3453 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 3454 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 3455 connp->conn_netstack); 3456 } 3457 if (IN6_IS_ADDR_V4MAPPED(&v6dst)) 3458 ixa->ixa_flags |= IXAF_IS_IPV4; 3459 else 3460 ixa->ixa_flags &= ~IXAF_IS_IPV4; 3461 } else { 3462 /* Connected case */ 3463 v6dst = connp->conn_faddr_v6; 3464 flowinfo = connp->conn_flowinfo; 3465 } 3466 mutex_exit(&connp->conn_lock); 3467 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */ 3468 if (ipp->ipp_fields & IPPF_ADDR) { 3469 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3470 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3471 v6src = ipp->ipp_addr; 3472 } else { 3473 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3474 v6src = ipp->ipp_addr; 3475 } 3476 } 3477 /* 3478 * Allow source not assigned to the system 3479 * only if it is not a local addresses 3480 */ 3481 if (!V6_OR_V4_INADDR_ANY(v6src)) { 3482 ip_laddr_t laddr_type; 3483 3484 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3485 ipaddr_t v4src; 3486 3487 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src); 3488 laddr_type = ip_laddr_verify_v4(v4src, ixa->ixa_zoneid, 3489 is->is_netstack->netstack_ip, B_FALSE); 3490 } else { 3491 laddr_type = ip_laddr_verify_v6(&v6src, ixa->ixa_zoneid, 3492 is->is_netstack->netstack_ip, B_FALSE, B_FALSE); 3493 } 3494 if (laddr_type != IPVL_UNICAST_UP) 3495 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3496 } 3497 3498 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3499 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 3500 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 3501 3502 switch (error) { 3503 case 0: 3504 break; 3505 case EADDRNOTAVAIL: 3506 /* 3507 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3508 * Don't have the application see that errno 3509 */ 3510 error = ENETUNREACH; 3511 goto failed; 3512 case ENETDOWN: 3513 /* 3514 * Have !ipif_addr_ready address; drop packet silently 3515 * until we can get applications to not send until we 3516 * are ready. 3517 */ 3518 error = 0; 3519 goto failed; 3520 case EHOSTUNREACH: 3521 case ENETUNREACH: 3522 if (ixa->ixa_ire != NULL) { 3523 /* 3524 * Let conn_ip_output/ire_send_noroute return 3525 * the error and send any local ICMP error. 3526 */ 3527 error = 0; 3528 break; 3529 } 3530 /* FALLTHRU */ 3531 default: 3532 failed: 3533 freemsg(mp); 3534 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3535 goto done; 3536 } 3537 3538 /* 3539 * We might be going to a different destination than last time, 3540 * thus check that TX allows the communication and compute any 3541 * needed label. 3542 * 3543 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3544 * don't have to worry about concurrent threads. 3545 */ 3546 if (is_system_labeled()) { 3547 /* 3548 * Check whether Trusted Solaris policy allows communication 3549 * with this host, and pretend that the destination is 3550 * unreachable if not. 3551 * Compute any needed label and place it in ipp_label_v4/v6. 3552 * 3553 * Later conn_build_hdr_template/conn_prepend_hdr takes 3554 * ipp_label_v4/v6 to form the packet. 3555 * 3556 * Tsol note: We have ipp structure local to this thread so 3557 * no locking is needed. 3558 */ 3559 error = conn_update_label(connp, ixa, &v6dst, ipp); 3560 if (error != 0) { 3561 freemsg(mp); 3562 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3563 goto done; 3564 } 3565 } 3566 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, flowinfo, mp, 3567 &error); 3568 if (mp == NULL) { 3569 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3570 ASSERT(error != 0); 3571 goto done; 3572 } 3573 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3574 error = EMSGSIZE; 3575 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3576 freemsg(mp); 3577 goto done; 3578 } 3579 3580 /* Policy might differ for different ICMP type/code */ 3581 mp = icmp_output_attach_policy(mp, connp, ixa); 3582 if (mp == NULL) { 3583 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3584 error = EHOSTUNREACH; /* IPsec policy failure */ 3585 goto done; 3586 } 3587 3588 /* We're done. Pass the packet to ip. */ 3589 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3590 3591 error = conn_ip_output(mp, ixa); 3592 if (!connp->conn_unspec_src) 3593 ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 3594 /* No rawipOutErrors if an error since IP increases its error counter */ 3595 switch (error) { 3596 case 0: 3597 break; 3598 case EWOULDBLOCK: 3599 (void) ixa_check_drain_insert(connp, ixa); 3600 error = 0; 3601 break; 3602 case EADDRNOTAVAIL: 3603 /* 3604 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3605 * Don't have the application see that errno 3606 */ 3607 error = ENETUNREACH; 3608 /* FALLTHRU */ 3609 default: 3610 mutex_enter(&connp->conn_lock); 3611 /* 3612 * Clear the source and v6lastdst so we call ip_attr_connect 3613 * for the next packet and try to pick a better source. 3614 */ 3615 if (connp->conn_mcbc_bind) 3616 connp->conn_saddr_v6 = ipv6_all_zeros; 3617 else 3618 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3619 connp->conn_v6lastdst = ipv6_all_zeros; 3620 mutex_exit(&connp->conn_lock); 3621 break; 3622 } 3623 done: 3624 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3625 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3626 ixa->ixa_cpid = connp->conn_cpid; 3627 ixa_refrele(ixa); 3628 ip_pkt_free(ipp); 3629 kmem_free(ipp, sizeof (*ipp)); 3630 return (error); 3631 } 3632 3633 /* 3634 * Handle sending an M_DATA for a connected socket. 3635 * Handles both IPv4 and IPv6. 3636 */ 3637 int 3638 icmp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3639 { 3640 icmp_t *icmp = connp->conn_icmp; 3641 icmp_stack_t *is = icmp->icmp_is; 3642 int error; 3643 ip_xmit_attr_t *ixa; 3644 boolean_t do_ipsec; 3645 3646 /* 3647 * If no other thread is using conn_ixa this just gets a reference to 3648 * conn_ixa. Otherwise we get a safe copy of conn_ixa. 3649 */ 3650 ixa = conn_get_ixa(connp, B_FALSE); 3651 if (ixa == NULL) { 3652 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3653 freemsg(mp); 3654 return (ENOMEM); 3655 } 3656 3657 ASSERT(cr != NULL); 3658 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3659 ixa->ixa_cred = cr; 3660 ixa->ixa_cpid = pid; 3661 3662 /* Defer IPsec if it might need to look at ICMP type/code */ 3663 switch (ixa->ixa_protocol) { 3664 case IPPROTO_ICMP: 3665 case IPPROTO_ICMPV6: 3666 do_ipsec = B_FALSE; 3667 break; 3668 default: 3669 do_ipsec = B_TRUE; 3670 } 3671 3672 mutex_enter(&connp->conn_lock); 3673 mp = icmp_prepend_header_template(connp, ixa, mp, 3674 &connp->conn_saddr_v6, connp->conn_flowinfo, &error); 3675 3676 if (mp == NULL) { 3677 ASSERT(error != 0); 3678 mutex_exit(&connp->conn_lock); 3679 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3680 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3681 ixa->ixa_cpid = connp->conn_cpid; 3682 ixa_refrele(ixa); 3683 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3684 freemsg(mp); 3685 return (error); 3686 } 3687 3688 if (!do_ipsec) { 3689 /* Policy might differ for different ICMP type/code */ 3690 mp = icmp_output_attach_policy(mp, connp, ixa); 3691 if (mp == NULL) { 3692 mutex_exit(&connp->conn_lock); 3693 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3694 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3695 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3696 ixa->ixa_cpid = connp->conn_cpid; 3697 ixa_refrele(ixa); 3698 return (EHOSTUNREACH); /* IPsec policy failure */ 3699 } 3700 } 3701 3702 /* 3703 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3704 * safe copy, then we need to fill in any pointers in it. 3705 */ 3706 if (ixa->ixa_ire == NULL) { 3707 in6_addr_t faddr, saddr; 3708 in6_addr_t nexthop; 3709 in_port_t fport; 3710 3711 saddr = connp->conn_saddr_v6; 3712 faddr = connp->conn_faddr_v6; 3713 fport = connp->conn_fport; 3714 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop); 3715 mutex_exit(&connp->conn_lock); 3716 3717 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop, 3718 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3719 (do_ipsec ? IPDF_IPSEC : 0)); 3720 switch (error) { 3721 case 0: 3722 break; 3723 case EADDRNOTAVAIL: 3724 /* 3725 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3726 * Don't have the application see that errno 3727 */ 3728 error = ENETUNREACH; 3729 goto failed; 3730 case ENETDOWN: 3731 /* 3732 * Have !ipif_addr_ready address; drop packet silently 3733 * until we can get applications to not send until we 3734 * are ready. 3735 */ 3736 error = 0; 3737 goto failed; 3738 case EHOSTUNREACH: 3739 case ENETUNREACH: 3740 if (ixa->ixa_ire != NULL) { 3741 /* 3742 * Let conn_ip_output/ire_send_noroute return 3743 * the error and send any local ICMP error. 3744 */ 3745 error = 0; 3746 break; 3747 } 3748 /* FALLTHRU */ 3749 default: 3750 failed: 3751 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3752 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3753 ixa->ixa_cpid = connp->conn_cpid; 3754 ixa_refrele(ixa); 3755 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3756 freemsg(mp); 3757 return (error); 3758 } 3759 } else { 3760 /* Done with conn_t */ 3761 mutex_exit(&connp->conn_lock); 3762 } 3763 3764 /* We're done. Pass the packet to ip. */ 3765 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3766 3767 error = conn_ip_output(mp, ixa); 3768 /* No rawipOutErrors if an error since IP increases its error counter */ 3769 switch (error) { 3770 case 0: 3771 break; 3772 case EWOULDBLOCK: 3773 (void) ixa_check_drain_insert(connp, ixa); 3774 error = 0; 3775 break; 3776 case EADDRNOTAVAIL: 3777 /* 3778 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3779 * Don't have the application see that errno 3780 */ 3781 error = ENETUNREACH; 3782 break; 3783 } 3784 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3785 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3786 ixa->ixa_cpid = connp->conn_cpid; 3787 ixa_refrele(ixa); 3788 return (error); 3789 } 3790 3791 /* 3792 * Handle sending an M_DATA to the last destination. 3793 * Handles both IPv4 and IPv6. 3794 * 3795 * NOTE: The caller must hold conn_lock and we drop it here. 3796 */ 3797 int 3798 icmp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid, 3799 ip_xmit_attr_t *ixa) 3800 { 3801 icmp_t *icmp = connp->conn_icmp; 3802 icmp_stack_t *is = icmp->icmp_is; 3803 int error; 3804 boolean_t do_ipsec; 3805 3806 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3807 ASSERT(ixa != NULL); 3808 3809 ASSERT(cr != NULL); 3810 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3811 ixa->ixa_cred = cr; 3812 ixa->ixa_cpid = pid; 3813 3814 /* Defer IPsec if it might need to look at ICMP type/code */ 3815 switch (ixa->ixa_protocol) { 3816 case IPPROTO_ICMP: 3817 case IPPROTO_ICMPV6: 3818 do_ipsec = B_FALSE; 3819 break; 3820 default: 3821 do_ipsec = B_TRUE; 3822 } 3823 3824 3825 mp = icmp_prepend_header_template(connp, ixa, mp, 3826 &connp->conn_v6lastsrc, connp->conn_lastflowinfo, &error); 3827 3828 if (mp == NULL) { 3829 ASSERT(error != 0); 3830 mutex_exit(&connp->conn_lock); 3831 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3832 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3833 ixa->ixa_cpid = connp->conn_cpid; 3834 ixa_refrele(ixa); 3835 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3836 freemsg(mp); 3837 return (error); 3838 } 3839 3840 if (!do_ipsec) { 3841 /* Policy might differ for different ICMP type/code */ 3842 mp = icmp_output_attach_policy(mp, connp, ixa); 3843 if (mp == NULL) { 3844 mutex_exit(&connp->conn_lock); 3845 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3846 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3847 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3848 ixa->ixa_cpid = connp->conn_cpid; 3849 ixa_refrele(ixa); 3850 return (EHOSTUNREACH); /* IPsec policy failure */ 3851 } 3852 } 3853 3854 /* 3855 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3856 * safe copy, then we need to fill in any pointers in it. 3857 */ 3858 if (ixa->ixa_ire == NULL) { 3859 in6_addr_t lastdst, lastsrc; 3860 in6_addr_t nexthop; 3861 in_port_t lastport; 3862 3863 lastsrc = connp->conn_v6lastsrc; 3864 lastdst = connp->conn_v6lastdst; 3865 lastport = connp->conn_lastdstport; 3866 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop); 3867 mutex_exit(&connp->conn_lock); 3868 3869 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst, 3870 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC | 3871 IPDF_VERIFY_DST | (do_ipsec ? IPDF_IPSEC : 0)); 3872 switch (error) { 3873 case 0: 3874 break; 3875 case EADDRNOTAVAIL: 3876 /* 3877 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3878 * Don't have the application see that errno 3879 */ 3880 error = ENETUNREACH; 3881 goto failed; 3882 case ENETDOWN: 3883 /* 3884 * Have !ipif_addr_ready address; drop packet silently 3885 * until we can get applications to not send until we 3886 * are ready. 3887 */ 3888 error = 0; 3889 goto failed; 3890 case EHOSTUNREACH: 3891 case ENETUNREACH: 3892 if (ixa->ixa_ire != NULL) { 3893 /* 3894 * Let conn_ip_output/ire_send_noroute return 3895 * the error and send any local ICMP error. 3896 */ 3897 error = 0; 3898 break; 3899 } 3900 /* FALLTHRU */ 3901 default: 3902 failed: 3903 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3904 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3905 ixa->ixa_cpid = connp->conn_cpid; 3906 ixa_refrele(ixa); 3907 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3908 freemsg(mp); 3909 return (error); 3910 } 3911 } else { 3912 /* Done with conn_t */ 3913 mutex_exit(&connp->conn_lock); 3914 } 3915 3916 /* We're done. Pass the packet to ip. */ 3917 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3918 error = conn_ip_output(mp, ixa); 3919 /* No rawipOutErrors if an error since IP increases its error counter */ 3920 switch (error) { 3921 case 0: 3922 break; 3923 case EWOULDBLOCK: 3924 (void) ixa_check_drain_insert(connp, ixa); 3925 error = 0; 3926 break; 3927 case EADDRNOTAVAIL: 3928 /* 3929 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3930 * Don't have the application see that errno 3931 */ 3932 error = ENETUNREACH; 3933 /* FALLTHRU */ 3934 default: 3935 mutex_enter(&connp->conn_lock); 3936 /* 3937 * Clear the source and v6lastdst so we call ip_attr_connect 3938 * for the next packet and try to pick a better source. 3939 */ 3940 if (connp->conn_mcbc_bind) 3941 connp->conn_saddr_v6 = ipv6_all_zeros; 3942 else 3943 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3944 connp->conn_v6lastdst = ipv6_all_zeros; 3945 mutex_exit(&connp->conn_lock); 3946 break; 3947 } 3948 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3949 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3950 ixa->ixa_cpid = connp->conn_cpid; 3951 ixa_refrele(ixa); 3952 return (error); 3953 } 3954 3955 3956 /* 3957 * Prepend the header template and then fill in the source and 3958 * flowinfo. The caller needs to handle the destination address since 3959 * it's setting is different if rthdr or source route. 3960 * 3961 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET. 3962 * When it returns NULL it sets errorp. 3963 */ 3964 static mblk_t * 3965 icmp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp, 3966 const in6_addr_t *v6src, uint32_t flowinfo, int *errorp) 3967 { 3968 icmp_t *icmp = connp->conn_icmp; 3969 icmp_stack_t *is = icmp->icmp_is; 3970 uint_t pktlen; 3971 uint_t copylen; 3972 uint8_t *iph; 3973 uint_t ip_hdr_length; 3974 uint32_t cksum; 3975 ip_pkt_t *ipp; 3976 3977 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3978 3979 /* 3980 * Copy the header template. 3981 */ 3982 copylen = connp->conn_ht_iphc_len; 3983 pktlen = copylen + msgdsize(mp); 3984 if (pktlen > IP_MAXPACKET) { 3985 freemsg(mp); 3986 *errorp = EMSGSIZE; 3987 return (NULL); 3988 } 3989 ixa->ixa_pktlen = pktlen; 3990 3991 /* check/fix buffer config, setup pointers into it */ 3992 iph = mp->b_rptr - copylen; 3993 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) { 3994 mblk_t *mp1; 3995 3996 mp1 = allocb(copylen + is->is_wroff_extra, BPRI_MED); 3997 if (mp1 == NULL) { 3998 freemsg(mp); 3999 *errorp = ENOMEM; 4000 return (NULL); 4001 } 4002 mp1->b_wptr = DB_LIM(mp1); 4003 mp1->b_cont = mp; 4004 mp = mp1; 4005 iph = (mp->b_wptr - copylen); 4006 } 4007 mp->b_rptr = iph; 4008 bcopy(connp->conn_ht_iphc, iph, copylen); 4009 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc); 4010 4011 ixa->ixa_ip_hdr_length = ip_hdr_length; 4012 4013 /* 4014 * Prepare for ICMPv6 checksum done in IP. 4015 * 4016 * icmp_build_hdr_template has already massaged any routing header 4017 * and placed the result in conn_sum. 4018 * 4019 * We make it easy for IP to include our pseudo header 4020 * by putting our length (and any routing header adjustment) 4021 * in the ICMPv6 checksum field. 4022 */ 4023 cksum = pktlen - ip_hdr_length; 4024 4025 cksum += connp->conn_sum; 4026 cksum = (cksum >> 16) + (cksum & 0xFFFF); 4027 ASSERT(cksum < 0x10000); 4028 4029 ipp = &connp->conn_xmit_ipp; 4030 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4031 ipha_t *ipha = (ipha_t *)iph; 4032 4033 ipha->ipha_length = htons((uint16_t)pktlen); 4034 4035 /* if IP_PKTINFO specified an addres it wins over bind() */ 4036 if ((ipp->ipp_fields & IPPF_ADDR) && 4037 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4038 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY); 4039 ipha->ipha_src = ipp->ipp_addr_v4; 4040 } else { 4041 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src); 4042 } 4043 } else { 4044 ip6_t *ip6h = (ip6_t *)iph; 4045 uint_t cksum_offset = 0; 4046 4047 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN)); 4048 4049 /* if IP_PKTINFO specified an addres it wins over bind() */ 4050 if ((ipp->ipp_fields & IPPF_ADDR) && 4051 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4052 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)); 4053 ip6h->ip6_src = ipp->ipp_addr; 4054 } else { 4055 ip6h->ip6_src = *v6src; 4056 } 4057 ip6h->ip6_vcf = 4058 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 4059 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 4060 if (ipp->ipp_fields & IPPF_TCLASS) { 4061 /* Overrides the class part of flowinfo */ 4062 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf, 4063 ipp->ipp_tclass); 4064 } 4065 4066 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 4067 if (connp->conn_proto == IPPROTO_ICMPV6) { 4068 cksum_offset = ixa->ixa_ip_hdr_length + 4069 offsetof(icmp6_t, icmp6_cksum); 4070 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 4071 cksum_offset = ixa->ixa_ip_hdr_length + 4072 ixa->ixa_raw_cksum_offset; 4073 } 4074 } 4075 if (cksum_offset != 0) { 4076 uint16_t *ptr; 4077 4078 /* Make sure the checksum fits in the first mblk */ 4079 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 4080 mblk_t *mp1; 4081 4082 mp1 = msgpullup(mp, 4083 cksum_offset + sizeof (short)); 4084 freemsg(mp); 4085 if (mp1 == NULL) { 4086 *errorp = ENOMEM; 4087 return (NULL); 4088 } 4089 mp = mp1; 4090 iph = mp->b_rptr; 4091 ip6h = (ip6_t *)iph; 4092 } 4093 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 4094 *ptr = htons(cksum); 4095 } 4096 } 4097 4098 return (mp); 4099 } 4100 4101 /* 4102 * This routine handles all messages passed downstream. It either 4103 * consumes the message or passes it downstream; it never queues a 4104 * a message. 4105 */ 4106 void 4107 icmp_wput(queue_t *q, mblk_t *mp) 4108 { 4109 sin6_t *sin6; 4110 sin_t *sin = NULL; 4111 uint_t srcid; 4112 conn_t *connp = Q_TO_CONN(q); 4113 icmp_t *icmp = connp->conn_icmp; 4114 int error = 0; 4115 struct sockaddr *addr = NULL; 4116 socklen_t addrlen; 4117 icmp_stack_t *is = icmp->icmp_is; 4118 struct T_unitdata_req *tudr; 4119 mblk_t *data_mp; 4120 cred_t *cr; 4121 pid_t pid; 4122 4123 /* 4124 * We directly handle several cases here: T_UNITDATA_REQ message 4125 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected 4126 * socket. 4127 */ 4128 switch (DB_TYPE(mp)) { 4129 case M_DATA: 4130 /* sockfs never sends down M_DATA */ 4131 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4132 freemsg(mp); 4133 return; 4134 4135 case M_PROTO: 4136 case M_PCPROTO: 4137 tudr = (struct T_unitdata_req *)mp->b_rptr; 4138 if (MBLKL(mp) < sizeof (*tudr) || 4139 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) { 4140 icmp_wput_other(q, mp); 4141 return; 4142 } 4143 break; 4144 4145 default: 4146 icmp_wput_other(q, mp); 4147 return; 4148 } 4149 4150 /* Handle valid T_UNITDATA_REQ here */ 4151 data_mp = mp->b_cont; 4152 if (data_mp == NULL) { 4153 error = EPROTO; 4154 goto ud_error2; 4155 } 4156 mp->b_cont = NULL; 4157 4158 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) { 4159 error = EADDRNOTAVAIL; 4160 goto ud_error2; 4161 } 4162 4163 /* 4164 * All Solaris components should pass a db_credp 4165 * for this message, hence we ASSERT. 4166 * On production kernels we return an error to be robust against 4167 * random streams modules sitting on top of us. 4168 */ 4169 cr = msg_getcred(mp, &pid); 4170 ASSERT(cr != NULL); 4171 if (cr == NULL) { 4172 error = EINVAL; 4173 goto ud_error2; 4174 } 4175 4176 /* 4177 * If a port has not been bound to the stream, fail. 4178 * This is not a problem when sockfs is directly 4179 * above us, because it will ensure that the socket 4180 * is first bound before allowing data to be sent. 4181 */ 4182 if (icmp->icmp_state == TS_UNBND) { 4183 error = EPROTO; 4184 goto ud_error2; 4185 } 4186 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset]; 4187 addrlen = tudr->DEST_length; 4188 4189 switch (connp->conn_family) { 4190 case AF_INET6: 4191 sin6 = (sin6_t *)addr; 4192 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) || 4193 (sin6->sin6_family != AF_INET6)) { 4194 error = EADDRNOTAVAIL; 4195 goto ud_error2; 4196 } 4197 4198 /* No support for mapped addresses on raw sockets */ 4199 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4200 error = EADDRNOTAVAIL; 4201 goto ud_error2; 4202 } 4203 srcid = sin6->__sin6_src_id; 4204 4205 /* 4206 * If the local address is a mapped address return 4207 * an error. 4208 * It would be possible to send an IPv6 packet but the 4209 * response would never make it back to the application 4210 * since it is bound to a mapped address. 4211 */ 4212 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 4213 error = EADDRNOTAVAIL; 4214 goto ud_error2; 4215 } 4216 4217 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 4218 sin6->sin6_addr = ipv6_loopback; 4219 4220 if (tudr->OPT_length != 0) { 4221 /* 4222 * If we are connected then the destination needs to be 4223 * the same as the connected one. 4224 */ 4225 if (icmp->icmp_state == TS_DATA_XFER && 4226 !conn_same_as_last_v6(connp, sin6)) { 4227 error = EISCONN; 4228 goto ud_error2; 4229 } 4230 error = icmp_output_ancillary(connp, NULL, sin6, 4231 data_mp, mp, NULL, cr, pid); 4232 } else { 4233 ip_xmit_attr_t *ixa; 4234 4235 /* 4236 * We have to allocate an ip_xmit_attr_t before we grab 4237 * conn_lock and we need to hold conn_lock once we've 4238 * checked conn_same_as_last_v6 to handle concurrent 4239 * send* calls on a socket. 4240 */ 4241 ixa = conn_get_ixa(connp, B_FALSE); 4242 if (ixa == NULL) { 4243 error = ENOMEM; 4244 goto ud_error2; 4245 } 4246 mutex_enter(&connp->conn_lock); 4247 4248 if (conn_same_as_last_v6(connp, sin6) && 4249 connp->conn_lastsrcid == srcid && 4250 ipsec_outbound_policy_current(ixa)) { 4251 /* icmp_output_lastdst drops conn_lock */ 4252 error = icmp_output_lastdst(connp, data_mp, cr, 4253 pid, ixa); 4254 } else { 4255 /* icmp_output_newdst drops conn_lock */ 4256 error = icmp_output_newdst(connp, data_mp, NULL, 4257 sin6, cr, pid, ixa); 4258 } 4259 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4260 } 4261 if (error == 0) { 4262 freeb(mp); 4263 return; 4264 } 4265 break; 4266 4267 case AF_INET: 4268 sin = (sin_t *)addr; 4269 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) || 4270 (sin->sin_family != AF_INET)) { 4271 error = EADDRNOTAVAIL; 4272 goto ud_error2; 4273 } 4274 if (sin->sin_addr.s_addr == INADDR_ANY) 4275 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 4276 4277 /* Protocol 255 contains full IP headers */ 4278 /* Read without holding lock */ 4279 if (icmp->icmp_hdrincl) { 4280 if (MBLKL(data_mp) < IP_SIMPLE_HDR_LENGTH) { 4281 if (!pullupmsg(data_mp, IP_SIMPLE_HDR_LENGTH)) { 4282 error = EINVAL; 4283 goto ud_error2; 4284 } 4285 } 4286 error = icmp_output_hdrincl(connp, data_mp, cr, pid); 4287 if (error == 0) { 4288 freeb(mp); 4289 return; 4290 } 4291 /* data_mp consumed above */ 4292 data_mp = NULL; 4293 goto ud_error2; 4294 } 4295 4296 if (tudr->OPT_length != 0) { 4297 /* 4298 * If we are connected then the destination needs to be 4299 * the same as the connected one. 4300 */ 4301 if (icmp->icmp_state == TS_DATA_XFER && 4302 !conn_same_as_last_v4(connp, sin)) { 4303 error = EISCONN; 4304 goto ud_error2; 4305 } 4306 error = icmp_output_ancillary(connp, sin, NULL, 4307 data_mp, mp, NULL, cr, pid); 4308 } else { 4309 ip_xmit_attr_t *ixa; 4310 4311 /* 4312 * We have to allocate an ip_xmit_attr_t before we grab 4313 * conn_lock and we need to hold conn_lock once we've 4314 * checked conn_same_as_last_v4 to handle concurrent 4315 * send* calls on a socket. 4316 */ 4317 ixa = conn_get_ixa(connp, B_FALSE); 4318 if (ixa == NULL) { 4319 error = ENOMEM; 4320 goto ud_error2; 4321 } 4322 mutex_enter(&connp->conn_lock); 4323 4324 if (conn_same_as_last_v4(connp, sin) && 4325 ipsec_outbound_policy_current(ixa)) { 4326 /* icmp_output_lastdst drops conn_lock */ 4327 error = icmp_output_lastdst(connp, data_mp, cr, 4328 pid, ixa); 4329 } else { 4330 /* icmp_output_newdst drops conn_lock */ 4331 error = icmp_output_newdst(connp, data_mp, sin, 4332 NULL, cr, pid, ixa); 4333 } 4334 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4335 } 4336 if (error == 0) { 4337 freeb(mp); 4338 return; 4339 } 4340 break; 4341 } 4342 ASSERT(mp != NULL); 4343 /* mp is freed by the following routine */ 4344 icmp_ud_err(q, mp, (t_scalar_t)error); 4345 return; 4346 4347 ud_error2: 4348 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4349 freemsg(data_mp); 4350 ASSERT(mp != NULL); 4351 /* mp is freed by the following routine */ 4352 icmp_ud_err(q, mp, (t_scalar_t)error); 4353 } 4354 4355 /* 4356 * Handle the case of the IP address or flow label being different 4357 * for both IPv4 and IPv6. 4358 * 4359 * NOTE: The caller must hold conn_lock and we drop it here. 4360 */ 4361 static int 4362 icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6, 4363 cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa) 4364 { 4365 icmp_t *icmp = connp->conn_icmp; 4366 icmp_stack_t *is = icmp->icmp_is; 4367 int error; 4368 ip_xmit_attr_t *oldixa; 4369 boolean_t do_ipsec; 4370 uint_t srcid; 4371 uint32_t flowinfo; 4372 in6_addr_t v6src; 4373 in6_addr_t v6dst; 4374 in6_addr_t v6nexthop; 4375 in_port_t dstport; 4376 4377 ASSERT(MUTEX_HELD(&connp->conn_lock)); 4378 ASSERT(ixa != NULL); 4379 4380 /* 4381 * We hold conn_lock across all the use and modifications of 4382 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they 4383 * stay consistent. 4384 */ 4385 4386 ASSERT(cr != NULL); 4387 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4388 ixa->ixa_cred = cr; 4389 ixa->ixa_cpid = pid; 4390 if (is_system_labeled()) { 4391 /* We need to restart with a label based on the cred */ 4392 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4393 } 4394 /* 4395 * If we are connected then the destination needs to be the 4396 * same as the connected one, which is not the case here since we 4397 * checked for that above. 4398 */ 4399 if (icmp->icmp_state == TS_DATA_XFER) { 4400 mutex_exit(&connp->conn_lock); 4401 error = EISCONN; 4402 goto ud_error; 4403 } 4404 4405 /* In case previous destination was multicast or multirt */ 4406 ip_attr_newdst(ixa); 4407 4408 /* 4409 * If laddr is unspecified then we look at sin6_src_id. 4410 * We will give precedence to a source address set with IPV6_PKTINFO 4411 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 4412 * want ip_attr_connect to select a source (since it can fail) when 4413 * IPV6_PKTINFO is specified. 4414 * If this doesn't result in a source address then we get a source 4415 * from ip_attr_connect() below. 4416 */ 4417 v6src = connp->conn_saddr_v6; 4418 if (sin != NULL) { 4419 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 4420 dstport = sin->sin_port; 4421 flowinfo = 0; 4422 srcid = 0; 4423 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4424 if (srcid != 0 && V4_PART_OF_V6(&v6src) == INADDR_ANY) { 4425 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4426 connp->conn_netstack); 4427 } 4428 ixa->ixa_flags |= IXAF_IS_IPV4; 4429 } else { 4430 v6dst = sin6->sin6_addr; 4431 dstport = sin6->sin6_port; 4432 flowinfo = sin6->sin6_flowinfo; 4433 srcid = sin6->__sin6_src_id; 4434 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 4435 ixa->ixa_scopeid = sin6->sin6_scope_id; 4436 ixa->ixa_flags |= IXAF_SCOPEID_SET; 4437 } else { 4438 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4439 } 4440 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 4441 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4442 connp->conn_netstack); 4443 } 4444 if (IN6_IS_ADDR_V4MAPPED(&v6dst)) 4445 ixa->ixa_flags |= IXAF_IS_IPV4; 4446 else 4447 ixa->ixa_flags &= ~IXAF_IS_IPV4; 4448 } 4449 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */ 4450 if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) { 4451 ip_pkt_t *ipp = &connp->conn_xmit_ipp; 4452 4453 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4454 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4455 v6src = ipp->ipp_addr; 4456 } else { 4457 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4458 v6src = ipp->ipp_addr; 4459 } 4460 } 4461 4462 /* Defer IPsec if it might need to look at ICMP type/code */ 4463 switch (ixa->ixa_protocol) { 4464 case IPPROTO_ICMP: 4465 case IPPROTO_ICMPV6: 4466 do_ipsec = B_FALSE; 4467 break; 4468 default: 4469 do_ipsec = B_TRUE; 4470 } 4471 4472 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop); 4473 mutex_exit(&connp->conn_lock); 4474 4475 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 4476 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 4477 (do_ipsec ? IPDF_IPSEC : 0)); 4478 switch (error) { 4479 case 0: 4480 break; 4481 case EADDRNOTAVAIL: 4482 /* 4483 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4484 * Don't have the application see that errno 4485 */ 4486 error = ENETUNREACH; 4487 goto failed; 4488 case ENETDOWN: 4489 /* 4490 * Have !ipif_addr_ready address; drop packet silently 4491 * until we can get applications to not send until we 4492 * are ready. 4493 */ 4494 error = 0; 4495 goto failed; 4496 case EHOSTUNREACH: 4497 case ENETUNREACH: 4498 if (ixa->ixa_ire != NULL) { 4499 /* 4500 * Let conn_ip_output/ire_send_noroute return 4501 * the error and send any local ICMP error. 4502 */ 4503 error = 0; 4504 break; 4505 } 4506 /* FALLTHRU */ 4507 default: 4508 failed: 4509 goto ud_error; 4510 } 4511 4512 mutex_enter(&connp->conn_lock); 4513 /* 4514 * While we dropped the lock some other thread might have connected 4515 * this socket. If so we bail out with EISCONN to ensure that the 4516 * connecting thread is the one that updates conn_ixa, conn_ht_* 4517 * and conn_*last*. 4518 */ 4519 if (icmp->icmp_state == TS_DATA_XFER) { 4520 mutex_exit(&connp->conn_lock); 4521 error = EISCONN; 4522 goto ud_error; 4523 } 4524 4525 /* 4526 * We need to rebuild the headers if 4527 * - we are labeling packets (could be different for different 4528 * destinations) 4529 * - we have a source route (or routing header) since we need to 4530 * massage that to get the pseudo-header checksum 4531 * - a socket option with COA_HEADER_CHANGED has been set which 4532 * set conn_v6lastdst to zero. 4533 * 4534 * Otherwise the prepend function will just update the src, dst, 4535 * and flow label. 4536 */ 4537 if (is_system_labeled()) { 4538 /* TX MLP requires SCM_UCRED and don't have that here */ 4539 if (connp->conn_mlp_type != mlptSingle) { 4540 mutex_exit(&connp->conn_lock); 4541 error = ECONNREFUSED; 4542 goto ud_error; 4543 } 4544 /* 4545 * Check whether Trusted Solaris policy allows communication 4546 * with this host, and pretend that the destination is 4547 * unreachable if not. 4548 * Compute any needed label and place it in ipp_label_v4/v6. 4549 * 4550 * Later conn_build_hdr_template/conn_prepend_hdr takes 4551 * ipp_label_v4/v6 to form the packet. 4552 * 4553 * Tsol note: Since we hold conn_lock we know no other 4554 * thread manipulates conn_xmit_ipp. 4555 */ 4556 error = conn_update_label(connp, ixa, &v6dst, 4557 &connp->conn_xmit_ipp); 4558 if (error != 0) { 4559 mutex_exit(&connp->conn_lock); 4560 goto ud_error; 4561 } 4562 /* Rebuild the header template */ 4563 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4564 flowinfo); 4565 if (error != 0) { 4566 mutex_exit(&connp->conn_lock); 4567 goto ud_error; 4568 } 4569 } else if (connp->conn_xmit_ipp.ipp_fields & 4570 (IPPF_IPV4_OPTIONS|IPPF_RTHDR) || 4571 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) { 4572 /* Rebuild the header template */ 4573 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4574 flowinfo); 4575 if (error != 0) { 4576 mutex_exit(&connp->conn_lock); 4577 goto ud_error; 4578 } 4579 } else { 4580 /* Simply update the destination address if no source route */ 4581 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4582 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc; 4583 4584 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst); 4585 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 4586 ipha->ipha_fragment_offset_and_flags |= 4587 IPH_DF_HTONS; 4588 } else { 4589 ipha->ipha_fragment_offset_and_flags &= 4590 ~IPH_DF_HTONS; 4591 } 4592 } else { 4593 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc; 4594 ip6h->ip6_dst = v6dst; 4595 } 4596 } 4597 4598 /* 4599 * Remember the dst etc which corresponds to the built header 4600 * template and conn_ixa. 4601 */ 4602 oldixa = conn_replace_ixa(connp, ixa); 4603 connp->conn_v6lastdst = v6dst; 4604 connp->conn_lastflowinfo = flowinfo; 4605 connp->conn_lastscopeid = ixa->ixa_scopeid; 4606 connp->conn_lastsrcid = srcid; 4607 /* Also remember a source to use together with lastdst */ 4608 connp->conn_v6lastsrc = v6src; 4609 4610 data_mp = icmp_prepend_header_template(connp, ixa, data_mp, &v6src, 4611 flowinfo, &error); 4612 4613 /* Done with conn_t */ 4614 mutex_exit(&connp->conn_lock); 4615 ixa_refrele(oldixa); 4616 4617 if (data_mp == NULL) { 4618 ASSERT(error != 0); 4619 goto ud_error; 4620 } 4621 4622 if (!do_ipsec) { 4623 /* Policy might differ for different ICMP type/code */ 4624 data_mp = icmp_output_attach_policy(data_mp, connp, ixa); 4625 if (data_mp == NULL) { 4626 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4627 error = EHOSTUNREACH; /* IPsec policy failure */ 4628 goto done; 4629 } 4630 } 4631 4632 /* We're done. Pass the packet to ip. */ 4633 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 4634 4635 error = conn_ip_output(data_mp, ixa); 4636 /* No rawipOutErrors if an error since IP increases its error counter */ 4637 switch (error) { 4638 case 0: 4639 break; 4640 case EWOULDBLOCK: 4641 (void) ixa_check_drain_insert(connp, ixa); 4642 error = 0; 4643 break; 4644 case EADDRNOTAVAIL: 4645 /* 4646 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4647 * Don't have the application see that errno 4648 */ 4649 error = ENETUNREACH; 4650 /* FALLTHRU */ 4651 default: 4652 mutex_enter(&connp->conn_lock); 4653 /* 4654 * Clear the source and v6lastdst so we call ip_attr_connect 4655 * for the next packet and try to pick a better source. 4656 */ 4657 if (connp->conn_mcbc_bind) 4658 connp->conn_saddr_v6 = ipv6_all_zeros; 4659 else 4660 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 4661 connp->conn_v6lastdst = ipv6_all_zeros; 4662 mutex_exit(&connp->conn_lock); 4663 break; 4664 } 4665 done: 4666 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4667 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4668 ixa->ixa_cpid = connp->conn_cpid; 4669 ixa_refrele(ixa); 4670 return (error); 4671 4672 ud_error: 4673 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4674 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4675 ixa->ixa_cpid = connp->conn_cpid; 4676 ixa_refrele(ixa); 4677 4678 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4679 freemsg(data_mp); 4680 return (error); 4681 } 4682 4683 /* ARGSUSED */ 4684 static void 4685 icmp_wput_fallback(queue_t *q, mblk_t *mp) 4686 { 4687 #ifdef DEBUG 4688 cmn_err(CE_CONT, "icmp_wput_fallback: Message during fallback \n"); 4689 #endif 4690 freemsg(mp); 4691 } 4692 4693 static void 4694 icmp_wput_other(queue_t *q, mblk_t *mp) 4695 { 4696 uchar_t *rptr = mp->b_rptr; 4697 struct iocblk *iocp; 4698 conn_t *connp = Q_TO_CONN(q); 4699 icmp_t *icmp = connp->conn_icmp; 4700 cred_t *cr; 4701 4702 switch (mp->b_datap->db_type) { 4703 case M_PROTO: 4704 case M_PCPROTO: 4705 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) { 4706 /* 4707 * If the message does not contain a PRIM_type, 4708 * throw it away. 4709 */ 4710 freemsg(mp); 4711 return; 4712 } 4713 switch (((t_primp_t)rptr)->type) { 4714 case T_ADDR_REQ: 4715 icmp_addr_req(q, mp); 4716 return; 4717 case O_T_BIND_REQ: 4718 case T_BIND_REQ: 4719 icmp_tpi_bind(q, mp); 4720 return; 4721 case T_CONN_REQ: 4722 icmp_tpi_connect(q, mp); 4723 return; 4724 case T_CAPABILITY_REQ: 4725 icmp_capability_req(q, mp); 4726 return; 4727 case T_INFO_REQ: 4728 icmp_info_req(q, mp); 4729 return; 4730 case T_UNITDATA_REQ: 4731 /* 4732 * If a T_UNITDATA_REQ gets here, the address must 4733 * be bad. Valid T_UNITDATA_REQs are handled 4734 * in icmp_wput. 4735 */ 4736 icmp_ud_err(q, mp, EADDRNOTAVAIL); 4737 return; 4738 case T_UNBIND_REQ: 4739 icmp_tpi_unbind(q, mp); 4740 return; 4741 case T_SVR4_OPTMGMT_REQ: 4742 /* 4743 * All Solaris components should pass a db_credp 4744 * for this TPI message, hence we ASSERT. 4745 * But in case there is some other M_PROTO that looks 4746 * like a TPI message sent by some other kernel 4747 * component, we check and return an error. 4748 */ 4749 cr = msg_getcred(mp, NULL); 4750 ASSERT(cr != NULL); 4751 if (cr == NULL) { 4752 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4753 return; 4754 } 4755 4756 if (!snmpcom_req(q, mp, icmp_snmp_set, ip_snmp_get, 4757 cr)) { 4758 svr4_optcom_req(q, mp, cr, &icmp_opt_obj); 4759 } 4760 return; 4761 4762 case T_OPTMGMT_REQ: 4763 /* 4764 * All Solaris components should pass a db_credp 4765 * for this TPI message, hence we ASSERT. 4766 * But in case there is some other M_PROTO that looks 4767 * like a TPI message sent by some other kernel 4768 * component, we check and return an error. 4769 */ 4770 cr = msg_getcred(mp, NULL); 4771 ASSERT(cr != NULL); 4772 if (cr == NULL) { 4773 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4774 return; 4775 } 4776 tpi_optcom_req(q, mp, cr, &icmp_opt_obj); 4777 return; 4778 4779 case T_DISCON_REQ: 4780 icmp_tpi_disconnect(q, mp); 4781 return; 4782 4783 /* The following TPI message is not supported by icmp. */ 4784 case O_T_CONN_RES: 4785 case T_CONN_RES: 4786 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4787 return; 4788 4789 /* The following 3 TPI requests are illegal for icmp. */ 4790 case T_DATA_REQ: 4791 case T_EXDATA_REQ: 4792 case T_ORDREL_REQ: 4793 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4794 return; 4795 default: 4796 break; 4797 } 4798 break; 4799 case M_FLUSH: 4800 if (*rptr & FLUSHW) 4801 flushq(q, FLUSHDATA); 4802 break; 4803 case M_IOCTL: 4804 iocp = (struct iocblk *)mp->b_rptr; 4805 switch (iocp->ioc_cmd) { 4806 case TI_GETPEERNAME: 4807 if (icmp->icmp_state != TS_DATA_XFER) { 4808 /* 4809 * If a default destination address has not 4810 * been associated with the stream, then we 4811 * don't know the peer's name. 4812 */ 4813 iocp->ioc_error = ENOTCONN; 4814 iocp->ioc_count = 0; 4815 mp->b_datap->db_type = M_IOCACK; 4816 qreply(q, mp); 4817 return; 4818 } 4819 /* FALLTHRU */ 4820 case TI_GETMYNAME: 4821 /* 4822 * For TI_GETPEERNAME and TI_GETMYNAME, we first 4823 * need to copyin the user's strbuf structure. 4824 * Processing will continue in the M_IOCDATA case 4825 * below. 4826 */ 4827 mi_copyin(q, mp, NULL, 4828 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 4829 return; 4830 default: 4831 break; 4832 } 4833 break; 4834 case M_IOCDATA: 4835 icmp_wput_iocdata(q, mp); 4836 return; 4837 default: 4838 /* Unrecognized messages are passed through without change. */ 4839 break; 4840 } 4841 ip_wput_nondata(q, mp); 4842 } 4843 4844 /* 4845 * icmp_wput_iocdata is called by icmp_wput_other to handle all M_IOCDATA 4846 * messages. 4847 */ 4848 static void 4849 icmp_wput_iocdata(queue_t *q, mblk_t *mp) 4850 { 4851 mblk_t *mp1; 4852 STRUCT_HANDLE(strbuf, sb); 4853 uint_t addrlen; 4854 conn_t *connp = Q_TO_CONN(q); 4855 icmp_t *icmp = connp->conn_icmp; 4856 4857 /* Make sure it is one of ours. */ 4858 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4859 case TI_GETMYNAME: 4860 case TI_GETPEERNAME: 4861 break; 4862 default: 4863 ip_wput_nondata(q, mp); 4864 return; 4865 } 4866 4867 switch (mi_copy_state(q, mp, &mp1)) { 4868 case -1: 4869 return; 4870 case MI_COPY_CASE(MI_COPY_IN, 1): 4871 break; 4872 case MI_COPY_CASE(MI_COPY_OUT, 1): 4873 /* 4874 * The address has been copied out, so now 4875 * copyout the strbuf. 4876 */ 4877 mi_copyout(q, mp); 4878 return; 4879 case MI_COPY_CASE(MI_COPY_OUT, 2): 4880 /* 4881 * The address and strbuf have been copied out. 4882 * We're done, so just acknowledge the original 4883 * M_IOCTL. 4884 */ 4885 mi_copy_done(q, mp, 0); 4886 return; 4887 default: 4888 /* 4889 * Something strange has happened, so acknowledge 4890 * the original M_IOCTL with an EPROTO error. 4891 */ 4892 mi_copy_done(q, mp, EPROTO); 4893 return; 4894 } 4895 4896 /* 4897 * Now we have the strbuf structure for TI_GETMYNAME 4898 * and TI_GETPEERNAME. Next we copyout the requested 4899 * address and then we'll copyout the strbuf. 4900 */ 4901 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 4902 (void *)mp1->b_rptr); 4903 4904 if (connp->conn_family == AF_INET) 4905 addrlen = sizeof (sin_t); 4906 else 4907 addrlen = sizeof (sin6_t); 4908 4909 if (STRUCT_FGET(sb, maxlen) < addrlen) { 4910 mi_copy_done(q, mp, EINVAL); 4911 return; 4912 } 4913 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4914 case TI_GETMYNAME: 4915 break; 4916 case TI_GETPEERNAME: 4917 if (icmp->icmp_state != TS_DATA_XFER) { 4918 mi_copy_done(q, mp, ENOTCONN); 4919 return; 4920 } 4921 break; 4922 default: 4923 mi_copy_done(q, mp, EPROTO); 4924 return; 4925 } 4926 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 4927 if (!mp1) 4928 return; 4929 4930 STRUCT_FSET(sb, len, addrlen); 4931 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4932 case TI_GETMYNAME: 4933 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr, 4934 &addrlen); 4935 break; 4936 case TI_GETPEERNAME: 4937 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr, 4938 &addrlen); 4939 break; 4940 } 4941 mp1->b_wptr += addrlen; 4942 /* Copy out the address */ 4943 mi_copyout(q, mp); 4944 } 4945 4946 void 4947 icmp_ddi_g_init(void) 4948 { 4949 icmp_max_optsize = optcom_max_optsize(icmp_opt_obj.odb_opt_des_arr, 4950 icmp_opt_obj.odb_opt_arr_cnt); 4951 4952 /* 4953 * We want to be informed each time a stack is created or 4954 * destroyed in the kernel, so we can maintain the 4955 * set of icmp_stack_t's. 4956 */ 4957 netstack_register(NS_ICMP, rawip_stack_init, NULL, rawip_stack_fini); 4958 } 4959 4960 void 4961 icmp_ddi_g_destroy(void) 4962 { 4963 netstack_unregister(NS_ICMP); 4964 } 4965 4966 #define INET_NAME "ip" 4967 4968 /* 4969 * Initialize the ICMP stack instance. 4970 */ 4971 static void * 4972 rawip_stack_init(netstackid_t stackid, netstack_t *ns) 4973 { 4974 icmp_stack_t *is; 4975 int error = 0; 4976 size_t arrsz; 4977 major_t major; 4978 4979 is = (icmp_stack_t *)kmem_zalloc(sizeof (*is), KM_SLEEP); 4980 is->is_netstack = ns; 4981 4982 arrsz = sizeof (icmp_propinfo_tbl); 4983 is->is_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP); 4984 bcopy(icmp_propinfo_tbl, is->is_propinfo_tbl, arrsz); 4985 4986 is->is_ksp = rawip_kstat_init(stackid); 4987 4988 major = mod_name_to_major(INET_NAME); 4989 error = ldi_ident_from_major(major, &is->is_ldi_ident); 4990 ASSERT(error == 0); 4991 return (is); 4992 } 4993 4994 /* 4995 * Free the ICMP stack instance. 4996 */ 4997 static void 4998 rawip_stack_fini(netstackid_t stackid, void *arg) 4999 { 5000 icmp_stack_t *is = (icmp_stack_t *)arg; 5001 5002 kmem_free(is->is_propinfo_tbl, sizeof (icmp_propinfo_tbl)); 5003 is->is_propinfo_tbl = NULL; 5004 5005 rawip_kstat_fini(stackid, is->is_ksp); 5006 is->is_ksp = NULL; 5007 ldi_ident_release(is->is_ldi_ident); 5008 kmem_free(is, sizeof (*is)); 5009 } 5010 5011 static void * 5012 rawip_kstat_init(netstackid_t stackid) { 5013 kstat_t *ksp; 5014 5015 rawip_named_kstat_t template = { 5016 { "inDatagrams", KSTAT_DATA_UINT32, 0 }, 5017 { "inCksumErrs", KSTAT_DATA_UINT32, 0 }, 5018 { "inErrors", KSTAT_DATA_UINT32, 0 }, 5019 { "outDatagrams", KSTAT_DATA_UINT32, 0 }, 5020 { "outErrors", KSTAT_DATA_UINT32, 0 }, 5021 }; 5022 5023 ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2", 5024 KSTAT_TYPE_NAMED, 5025 NUM_OF_FIELDS(rawip_named_kstat_t), 5026 0, stackid); 5027 if (ksp == NULL || ksp->ks_data == NULL) 5028 return (NULL); 5029 5030 bcopy(&template, ksp->ks_data, sizeof (template)); 5031 ksp->ks_update = rawip_kstat_update; 5032 ksp->ks_private = (void *)(uintptr_t)stackid; 5033 5034 kstat_install(ksp); 5035 return (ksp); 5036 } 5037 5038 static void 5039 rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp) 5040 { 5041 if (ksp != NULL) { 5042 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 5043 kstat_delete_netstack(ksp, stackid); 5044 } 5045 } 5046 5047 static int 5048 rawip_kstat_update(kstat_t *ksp, int rw) 5049 { 5050 rawip_named_kstat_t *rawipkp; 5051 netstackid_t stackid = (netstackid_t)(uintptr_t)ksp->ks_private; 5052 netstack_t *ns; 5053 icmp_stack_t *is; 5054 5055 if ((ksp == NULL) || (ksp->ks_data == NULL)) 5056 return (EIO); 5057 5058 if (rw == KSTAT_WRITE) 5059 return (EACCES); 5060 5061 rawipkp = (rawip_named_kstat_t *)ksp->ks_data; 5062 5063 ns = netstack_find_by_stackid(stackid); 5064 if (ns == NULL) 5065 return (-1); 5066 is = ns->netstack_icmp; 5067 if (is == NULL) { 5068 netstack_rele(ns); 5069 return (-1); 5070 } 5071 rawipkp->inDatagrams.value.ui32 = is->is_rawip_mib.rawipInDatagrams; 5072 rawipkp->inCksumErrs.value.ui32 = is->is_rawip_mib.rawipInCksumErrs; 5073 rawipkp->inErrors.value.ui32 = is->is_rawip_mib.rawipInErrors; 5074 rawipkp->outDatagrams.value.ui32 = is->is_rawip_mib.rawipOutDatagrams; 5075 rawipkp->outErrors.value.ui32 = is->is_rawip_mib.rawipOutErrors; 5076 netstack_rele(ns); 5077 return (0); 5078 } 5079 5080 /* ARGSUSED */ 5081 int 5082 rawip_accept(sock_lower_handle_t lproto_handle, 5083 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle, 5084 cred_t *cr) 5085 { 5086 return (EOPNOTSUPP); 5087 } 5088 5089 /* ARGSUSED */ 5090 int 5091 rawip_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5092 socklen_t len, cred_t *cr) 5093 { 5094 conn_t *connp = (conn_t *)proto_handle; 5095 int error; 5096 5097 /* All Solaris components should pass a cred for this operation. */ 5098 ASSERT(cr != NULL); 5099 5100 /* Binding to a NULL address really means unbind */ 5101 if (sa == NULL) 5102 error = rawip_do_unbind(connp); 5103 else 5104 error = rawip_do_bind(connp, sa, len); 5105 5106 if (error < 0) { 5107 if (error == -TOUTSTATE) 5108 error = EINVAL; 5109 else 5110 error = proto_tlitosyserr(-error); 5111 } 5112 return (error); 5113 } 5114 5115 static int 5116 rawip_implicit_bind(conn_t *connp) 5117 { 5118 sin6_t sin6addr; 5119 sin_t *sin; 5120 sin6_t *sin6; 5121 socklen_t len; 5122 int error; 5123 5124 if (connp->conn_family == AF_INET) { 5125 len = sizeof (struct sockaddr_in); 5126 sin = (sin_t *)&sin6addr; 5127 *sin = sin_null; 5128 sin->sin_family = AF_INET; 5129 sin->sin_addr.s_addr = INADDR_ANY; 5130 } else { 5131 ASSERT(connp->conn_family == AF_INET6); 5132 len = sizeof (sin6_t); 5133 sin6 = (sin6_t *)&sin6addr; 5134 *sin6 = sin6_null; 5135 sin6->sin6_family = AF_INET6; 5136 V6_SET_ZERO(sin6->sin6_addr); 5137 } 5138 5139 error = rawip_do_bind(connp, (struct sockaddr *)&sin6addr, len); 5140 5141 return ((error < 0) ? proto_tlitosyserr(-error) : error); 5142 } 5143 5144 static int 5145 rawip_unbind(conn_t *connp) 5146 { 5147 int error; 5148 5149 error = rawip_do_unbind(connp); 5150 if (error < 0) { 5151 error = proto_tlitosyserr(-error); 5152 } 5153 return (error); 5154 } 5155 5156 /* ARGSUSED */ 5157 int 5158 rawip_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr) 5159 { 5160 return (EOPNOTSUPP); 5161 } 5162 5163 int 5164 rawip_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa, 5165 socklen_t len, sock_connid_t *id, cred_t *cr) 5166 { 5167 conn_t *connp = (conn_t *)proto_handle; 5168 icmp_t *icmp = connp->conn_icmp; 5169 int error; 5170 boolean_t did_bind = B_FALSE; 5171 pid_t pid = curproc->p_pid; 5172 5173 /* All Solaris components should pass a cred for this operation. */ 5174 ASSERT(cr != NULL); 5175 5176 if (sa == NULL) { 5177 /* 5178 * Disconnect 5179 * Make sure we are connected 5180 */ 5181 if (icmp->icmp_state != TS_DATA_XFER) 5182 return (EINVAL); 5183 5184 error = icmp_disconnect(connp); 5185 return (error); 5186 } 5187 5188 error = proto_verify_ip_addr(connp->conn_family, sa, len); 5189 if (error != 0) 5190 return (error); 5191 5192 /* do an implicit bind if necessary */ 5193 if (icmp->icmp_state == TS_UNBND) { 5194 error = rawip_implicit_bind(connp); 5195 /* 5196 * We could be racing with an actual bind, in which case 5197 * we would see EPROTO. We cross our fingers and try 5198 * to connect. 5199 */ 5200 if (!(error == 0 || error == EPROTO)) 5201 return (error); 5202 did_bind = B_TRUE; 5203 } 5204 5205 /* 5206 * set SO_DGRAM_ERRIND 5207 */ 5208 connp->conn_dgram_errind = B_TRUE; 5209 5210 error = rawip_do_connect(connp, sa, len, cr, pid); 5211 if (error != 0 && did_bind) { 5212 int unbind_err; 5213 5214 unbind_err = rawip_unbind(connp); 5215 ASSERT(unbind_err == 0); 5216 } 5217 5218 if (error == 0) { 5219 *id = 0; 5220 (*connp->conn_upcalls->su_connected)(connp->conn_upper_handle, 5221 0, NULL, -1); 5222 } else if (error < 0) { 5223 error = proto_tlitosyserr(-error); 5224 } 5225 return (error); 5226 } 5227 5228 /* ARGSUSED2 */ 5229 int 5230 rawip_fallback(sock_lower_handle_t proto_handle, queue_t *q, 5231 boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb, 5232 sock_quiesce_arg_t *arg) 5233 { 5234 conn_t *connp = (conn_t *)proto_handle; 5235 icmp_t *icmp; 5236 struct T_capability_ack tca; 5237 struct sockaddr_in6 laddr, faddr; 5238 socklen_t laddrlen, faddrlen; 5239 short opts; 5240 struct stroptions *stropt; 5241 mblk_t *mp, *stropt_mp; 5242 int error; 5243 5244 icmp = connp->conn_icmp; 5245 5246 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL); 5247 5248 /* 5249 * setup the fallback stream that was allocated 5250 */ 5251 connp->conn_dev = (dev_t)RD(q)->q_ptr; 5252 connp->conn_minor_arena = WR(q)->q_ptr; 5253 5254 RD(q)->q_ptr = WR(q)->q_ptr = connp; 5255 5256 WR(q)->q_qinfo = &icmpwinit; 5257 5258 connp->conn_rq = RD(q); 5259 connp->conn_wq = WR(q); 5260 5261 /* Notify stream head about options before sending up data */ 5262 stropt_mp->b_datap->db_type = M_SETOPTS; 5263 stropt_mp->b_wptr += sizeof (*stropt); 5264 stropt = (struct stroptions *)stropt_mp->b_rptr; 5265 stropt->so_flags = SO_WROFF | SO_HIWAT; 5266 stropt->so_wroff = connp->conn_wroff; 5267 stropt->so_hiwat = connp->conn_rcvbuf; 5268 putnext(RD(q), stropt_mp); 5269 5270 /* 5271 * free helper stream 5272 */ 5273 ip_free_helper_stream(connp); 5274 5275 /* 5276 * Collect the information needed to sync with the sonode 5277 */ 5278 icmp_do_capability_ack(icmp, &tca, TC1_INFO); 5279 5280 laddrlen = faddrlen = sizeof (sin6_t); 5281 (void) rawip_getsockname((sock_lower_handle_t)connp, 5282 (struct sockaddr *)&laddr, &laddrlen, CRED()); 5283 error = rawip_getpeername((sock_lower_handle_t)connp, 5284 (struct sockaddr *)&faddr, &faddrlen, CRED()); 5285 if (error != 0) 5286 faddrlen = 0; 5287 opts = 0; 5288 if (connp->conn_dgram_errind) 5289 opts |= SO_DGRAM_ERRIND; 5290 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE) 5291 opts |= SO_DONTROUTE; 5292 5293 mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca, 5294 (struct sockaddr *)&laddr, laddrlen, 5295 (struct sockaddr *)&faddr, faddrlen, opts); 5296 5297 /* 5298 * Attempts to send data up during fallback will result in it being 5299 * queued in icmp_t. Now we push up any queued packets. 5300 */ 5301 mutex_enter(&icmp->icmp_recv_lock); 5302 if (mp != NULL) { 5303 mp->b_next = icmp->icmp_fallback_queue_head; 5304 icmp->icmp_fallback_queue_head = mp; 5305 } 5306 while (icmp->icmp_fallback_queue_head != NULL) { 5307 mp = icmp->icmp_fallback_queue_head; 5308 icmp->icmp_fallback_queue_head = mp->b_next; 5309 mp->b_next = NULL; 5310 mutex_exit(&icmp->icmp_recv_lock); 5311 putnext(RD(q), mp); 5312 mutex_enter(&icmp->icmp_recv_lock); 5313 } 5314 icmp->icmp_fallback_queue_tail = icmp->icmp_fallback_queue_head; 5315 5316 /* 5317 * No longer a streams less socket 5318 */ 5319 mutex_enter(&connp->conn_lock); 5320 connp->conn_flags &= ~IPCL_NONSTR; 5321 mutex_exit(&connp->conn_lock); 5322 5323 mutex_exit(&icmp->icmp_recv_lock); 5324 5325 ASSERT(icmp->icmp_fallback_queue_head == NULL && 5326 icmp->icmp_fallback_queue_tail == NULL); 5327 5328 ASSERT(connp->conn_ref >= 1); 5329 5330 return (0); 5331 } 5332 5333 /* ARGSUSED2 */ 5334 sock_lower_handle_t 5335 rawip_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls, 5336 uint_t *smodep, int *errorp, int flags, cred_t *credp) 5337 { 5338 conn_t *connp; 5339 5340 if (type != SOCK_RAW || (family != AF_INET && family != AF_INET6)) { 5341 *errorp = EPROTONOSUPPORT; 5342 return (NULL); 5343 } 5344 5345 connp = rawip_do_open(family, credp, errorp, flags); 5346 if (connp != NULL) { 5347 connp->conn_flags |= IPCL_NONSTR; 5348 5349 mutex_enter(&connp->conn_lock); 5350 connp->conn_state_flags &= ~CONN_INCIPIENT; 5351 mutex_exit(&connp->conn_lock); 5352 *sock_downcalls = &sock_rawip_downcalls; 5353 *smodep = SM_ATOMIC; 5354 } else { 5355 ASSERT(*errorp != 0); 5356 } 5357 5358 return ((sock_lower_handle_t)connp); 5359 } 5360 5361 /* ARGSUSED3 */ 5362 void 5363 rawip_activate(sock_lower_handle_t proto_handle, 5364 sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls, int flags, 5365 cred_t *cr) 5366 { 5367 conn_t *connp = (conn_t *)proto_handle; 5368 struct sock_proto_props sopp; 5369 5370 /* All Solaris components should pass a cred for this operation. */ 5371 ASSERT(cr != NULL); 5372 5373 connp->conn_upcalls = sock_upcalls; 5374 connp->conn_upper_handle = sock_handle; 5375 5376 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT | 5377 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ; 5378 sopp.sopp_wroff = connp->conn_wroff; 5379 sopp.sopp_rxhiwat = connp->conn_rcvbuf; 5380 sopp.sopp_rxlowat = connp->conn_rcvlowat; 5381 sopp.sopp_maxblk = INFPSZ; 5382 sopp.sopp_maxpsz = IP_MAXPACKET; 5383 sopp.sopp_minpsz = (icmp_mod_info.mi_minpsz == 1) ? 0 : 5384 icmp_mod_info.mi_minpsz; 5385 5386 (*connp->conn_upcalls->su_set_proto_props) 5387 (connp->conn_upper_handle, &sopp); 5388 5389 icmp_bind_proto(connp->conn_icmp); 5390 } 5391 5392 /* ARGSUSED3 */ 5393 int 5394 rawip_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5395 socklen_t *salenp, cred_t *cr) 5396 { 5397 conn_t *connp = (conn_t *)proto_handle; 5398 icmp_t *icmp = connp->conn_icmp; 5399 int error; 5400 5401 /* All Solaris components should pass a cred for this operation. */ 5402 ASSERT(cr != NULL); 5403 5404 mutex_enter(&connp->conn_lock); 5405 if (icmp->icmp_state != TS_DATA_XFER) 5406 error = ENOTCONN; 5407 else 5408 error = conn_getpeername(connp, sa, salenp); 5409 mutex_exit(&connp->conn_lock); 5410 return (error); 5411 } 5412 5413 /* ARGSUSED3 */ 5414 int 5415 rawip_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5416 socklen_t *salenp, cred_t *cr) 5417 { 5418 conn_t *connp = (conn_t *)proto_handle; 5419 int error; 5420 5421 /* All Solaris components should pass a cred for this operation. */ 5422 ASSERT(cr != NULL); 5423 5424 mutex_enter(&connp->conn_lock); 5425 error = conn_getsockname(connp, sa, salenp); 5426 mutex_exit(&connp->conn_lock); 5427 return (error); 5428 } 5429 5430 int 5431 rawip_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5432 const void *optvalp, socklen_t optlen, cred_t *cr) 5433 { 5434 conn_t *connp = (conn_t *)proto_handle; 5435 int error; 5436 5437 /* All Solaris components should pass a cred for this operation. */ 5438 ASSERT(cr != NULL); 5439 5440 error = proto_opt_check(level, option_name, optlen, NULL, 5441 icmp_opt_obj.odb_opt_des_arr, 5442 icmp_opt_obj.odb_opt_arr_cnt, 5443 B_TRUE, B_FALSE, cr); 5444 5445 if (error != 0) { 5446 /* 5447 * option not recognized 5448 */ 5449 if (error < 0) { 5450 error = proto_tlitosyserr(-error); 5451 } 5452 return (error); 5453 } 5454 5455 error = icmp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, 5456 option_name, optlen, (uchar_t *)optvalp, (uint_t *)&optlen, 5457 (uchar_t *)optvalp, NULL, cr); 5458 5459 ASSERT(error >= 0); 5460 5461 return (error); 5462 } 5463 5464 int 5465 rawip_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5466 void *optvalp, socklen_t *optlen, cred_t *cr) 5467 { 5468 int error; 5469 conn_t *connp = (conn_t *)proto_handle; 5470 t_uscalar_t max_optbuf_len; 5471 void *optvalp_buf; 5472 int len; 5473 5474 /* All Solaris components should pass a cred for this operation. */ 5475 ASSERT(cr != NULL); 5476 5477 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len, 5478 icmp_opt_obj.odb_opt_des_arr, 5479 icmp_opt_obj.odb_opt_arr_cnt, 5480 B_FALSE, B_TRUE, cr); 5481 5482 if (error != 0) { 5483 if (error < 0) { 5484 error = proto_tlitosyserr(-error); 5485 } 5486 return (error); 5487 } 5488 5489 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP); 5490 len = icmp_opt_get(connp, level, option_name, optvalp_buf); 5491 if (len == -1) { 5492 kmem_free(optvalp_buf, max_optbuf_len); 5493 return (EINVAL); 5494 } 5495 5496 /* 5497 * update optlen and copy option value 5498 */ 5499 t_uscalar_t size = MIN(len, *optlen); 5500 5501 bcopy(optvalp_buf, optvalp, size); 5502 bcopy(&size, optlen, sizeof (size)); 5503 5504 kmem_free(optvalp_buf, max_optbuf_len); 5505 return (0); 5506 } 5507 5508 /* ARGSUSED1 */ 5509 int 5510 rawip_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr) 5511 { 5512 conn_t *connp = (conn_t *)proto_handle; 5513 5514 /* All Solaris components should pass a cred for this operation. */ 5515 ASSERT(cr != NULL); 5516 5517 (void) rawip_do_close(connp); 5518 return (0); 5519 } 5520 5521 /* ARGSUSED2 */ 5522 int 5523 rawip_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr) 5524 { 5525 conn_t *connp = (conn_t *)proto_handle; 5526 5527 /* All Solaris components should pass a cred for this operation. */ 5528 ASSERT(cr != NULL); 5529 5530 /* shut down the send side */ 5531 if (how != SHUT_RD) 5532 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5533 SOCK_OPCTL_SHUT_SEND, 0); 5534 /* shut down the recv side */ 5535 if (how != SHUT_WR) 5536 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5537 SOCK_OPCTL_SHUT_RECV, 0); 5538 return (0); 5539 } 5540 5541 void 5542 rawip_clr_flowctrl(sock_lower_handle_t proto_handle) 5543 { 5544 conn_t *connp = (conn_t *)proto_handle; 5545 icmp_t *icmp = connp->conn_icmp; 5546 5547 mutex_enter(&icmp->icmp_recv_lock); 5548 connp->conn_flow_cntrld = B_FALSE; 5549 mutex_exit(&icmp->icmp_recv_lock); 5550 } 5551 5552 int 5553 rawip_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg, 5554 int mode, int32_t *rvalp, cred_t *cr) 5555 { 5556 conn_t *connp = (conn_t *)proto_handle; 5557 int error; 5558 5559 /* All Solaris components should pass a cred for this operation. */ 5560 ASSERT(cr != NULL); 5561 5562 /* 5563 * If we don't have a helper stream then create one. 5564 * ip_create_helper_stream takes care of locking the conn_t, 5565 * so this check for NULL is just a performance optimization. 5566 */ 5567 if (connp->conn_helper_info == NULL) { 5568 icmp_stack_t *is = connp->conn_icmp->icmp_is; 5569 5570 ASSERT(is->is_ldi_ident != NULL); 5571 5572 /* 5573 * Create a helper stream for non-STREAMS socket. 5574 */ 5575 error = ip_create_helper_stream(connp, is->is_ldi_ident); 5576 if (error != 0) { 5577 ip0dbg(("rawip_ioctl: create of IP helper stream " 5578 "failed %d\n", error)); 5579 return (error); 5580 } 5581 } 5582 5583 switch (cmd) { 5584 case _SIOCSOCKFALLBACK: 5585 case TI_GETPEERNAME: 5586 case TI_GETMYNAME: 5587 #ifdef DEBUG 5588 cmn_err(CE_CONT, "icmp_ioctl cmd 0x%x on non streams" 5589 " socket", cmd); 5590 #endif 5591 error = EINVAL; 5592 break; 5593 default: 5594 /* 5595 * Pass on to IP using helper stream 5596 */ 5597 error = ldi_ioctl(connp->conn_helper_info->iphs_handle, 5598 cmd, arg, mode, cr, rvalp); 5599 break; 5600 } 5601 return (error); 5602 } 5603 5604 int 5605 rawip_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg, 5606 cred_t *cr) 5607 { 5608 sin6_t *sin6; 5609 sin_t *sin = NULL; 5610 uint_t srcid; 5611 conn_t *connp = (conn_t *)proto_handle; 5612 icmp_t *icmp = connp->conn_icmp; 5613 int error = 0; 5614 icmp_stack_t *is = icmp->icmp_is; 5615 pid_t pid = curproc->p_pid; 5616 ip_xmit_attr_t *ixa; 5617 5618 ASSERT(DB_TYPE(mp) == M_DATA); 5619 5620 /* All Solaris components should pass a cred for this operation. */ 5621 ASSERT(cr != NULL); 5622 5623 /* do an implicit bind if necessary */ 5624 if (icmp->icmp_state == TS_UNBND) { 5625 error = rawip_implicit_bind(connp); 5626 /* 5627 * We could be racing with an actual bind, in which case 5628 * we would see EPROTO. We cross our fingers and try 5629 * to connect. 5630 */ 5631 if (!(error == 0 || error == EPROTO)) { 5632 freemsg(mp); 5633 return (error); 5634 } 5635 } 5636 5637 /* Protocol 255 contains full IP headers */ 5638 /* Read without holding lock */ 5639 if (icmp->icmp_hdrincl) { 5640 ASSERT(connp->conn_ipversion == IPV4_VERSION); 5641 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) { 5642 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 5643 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5644 freemsg(mp); 5645 return (EINVAL); 5646 } 5647 } 5648 error = icmp_output_hdrincl(connp, mp, cr, pid); 5649 if (is->is_sendto_ignerr) 5650 return (0); 5651 else 5652 return (error); 5653 } 5654 5655 /* Connected? */ 5656 if (msg->msg_name == NULL) { 5657 if (icmp->icmp_state != TS_DATA_XFER) { 5658 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5659 return (EDESTADDRREQ); 5660 } 5661 if (msg->msg_controllen != 0) { 5662 error = icmp_output_ancillary(connp, NULL, NULL, mp, 5663 NULL, msg, cr, pid); 5664 } else { 5665 error = icmp_output_connected(connp, mp, cr, pid); 5666 } 5667 if (is->is_sendto_ignerr) 5668 return (0); 5669 else 5670 return (error); 5671 } 5672 if (icmp->icmp_state == TS_DATA_XFER) { 5673 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5674 return (EISCONN); 5675 } 5676 error = proto_verify_ip_addr(connp->conn_family, 5677 (struct sockaddr *)msg->msg_name, msg->msg_namelen); 5678 if (error != 0) { 5679 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5680 return (error); 5681 } 5682 switch (connp->conn_family) { 5683 case AF_INET6: 5684 sin6 = (sin6_t *)msg->msg_name; 5685 5686 /* No support for mapped addresses on raw sockets */ 5687 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 5688 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5689 return (EADDRNOTAVAIL); 5690 } 5691 srcid = sin6->__sin6_src_id; 5692 5693 /* 5694 * If the local address is a mapped address return 5695 * an error. 5696 * It would be possible to send an IPv6 packet but the 5697 * response would never make it back to the application 5698 * since it is bound to a mapped address. 5699 */ 5700 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 5701 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5702 return (EADDRNOTAVAIL); 5703 } 5704 5705 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 5706 sin6->sin6_addr = ipv6_loopback; 5707 5708 /* 5709 * We have to allocate an ip_xmit_attr_t before we grab 5710 * conn_lock and we need to hold conn_lock once we've check 5711 * conn_same_as_last_v6 to handle concurrent send* calls on a 5712 * socket. 5713 */ 5714 if (msg->msg_controllen == 0) { 5715 ixa = conn_get_ixa(connp, B_FALSE); 5716 if (ixa == NULL) { 5717 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5718 return (ENOMEM); 5719 } 5720 } else { 5721 ixa = NULL; 5722 } 5723 mutex_enter(&connp->conn_lock); 5724 if (icmp->icmp_delayed_error != 0) { 5725 sin6_t *sin2 = (sin6_t *)&icmp->icmp_delayed_addr; 5726 5727 error = icmp->icmp_delayed_error; 5728 icmp->icmp_delayed_error = 0; 5729 5730 /* Compare IP address and family */ 5731 5732 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 5733 &sin2->sin6_addr) && 5734 sin6->sin6_family == sin2->sin6_family) { 5735 mutex_exit(&connp->conn_lock); 5736 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5737 if (ixa != NULL) 5738 ixa_refrele(ixa); 5739 return (error); 5740 } 5741 } 5742 if (msg->msg_controllen != 0) { 5743 mutex_exit(&connp->conn_lock); 5744 ASSERT(ixa == NULL); 5745 error = icmp_output_ancillary(connp, NULL, sin6, mp, 5746 NULL, msg, cr, pid); 5747 } else if (conn_same_as_last_v6(connp, sin6) && 5748 connp->conn_lastsrcid == srcid && 5749 ipsec_outbound_policy_current(ixa)) { 5750 /* icmp_output_lastdst drops conn_lock */ 5751 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5752 } else { 5753 /* icmp_output_newdst drops conn_lock */ 5754 error = icmp_output_newdst(connp, mp, NULL, sin6, cr, 5755 pid, ixa); 5756 } 5757 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5758 if (is->is_sendto_ignerr) 5759 return (0); 5760 else 5761 return (error); 5762 case AF_INET: 5763 sin = (sin_t *)msg->msg_name; 5764 5765 if (sin->sin_addr.s_addr == INADDR_ANY) 5766 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 5767 5768 /* 5769 * We have to allocate an ip_xmit_attr_t before we grab 5770 * conn_lock and we need to hold conn_lock once we've check 5771 * conn_same_as_last_v6 to handle concurrent send* on a socket. 5772 */ 5773 if (msg->msg_controllen == 0) { 5774 ixa = conn_get_ixa(connp, B_FALSE); 5775 if (ixa == NULL) { 5776 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5777 return (ENOMEM); 5778 } 5779 } else { 5780 ixa = NULL; 5781 } 5782 mutex_enter(&connp->conn_lock); 5783 if (icmp->icmp_delayed_error != 0) { 5784 sin_t *sin2 = (sin_t *)&icmp->icmp_delayed_addr; 5785 5786 error = icmp->icmp_delayed_error; 5787 icmp->icmp_delayed_error = 0; 5788 5789 /* Compare IP address */ 5790 5791 if (sin->sin_addr.s_addr == sin2->sin_addr.s_addr) { 5792 mutex_exit(&connp->conn_lock); 5793 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5794 if (ixa != NULL) 5795 ixa_refrele(ixa); 5796 return (error); 5797 } 5798 } 5799 5800 if (msg->msg_controllen != 0) { 5801 mutex_exit(&connp->conn_lock); 5802 ASSERT(ixa == NULL); 5803 error = icmp_output_ancillary(connp, sin, NULL, mp, 5804 NULL, msg, cr, pid); 5805 } else if (conn_same_as_last_v4(connp, sin) && 5806 ipsec_outbound_policy_current(ixa)) { 5807 /* icmp_output_lastdst drops conn_lock */ 5808 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5809 } else { 5810 /* icmp_output_newdst drops conn_lock */ 5811 error = icmp_output_newdst(connp, mp, sin, NULL, cr, 5812 pid, ixa); 5813 } 5814 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5815 if (is->is_sendto_ignerr) 5816 return (0); 5817 else 5818 return (error); 5819 default: 5820 return (EINVAL); 5821 } 5822 } 5823 5824 sock_downcalls_t sock_rawip_downcalls = { 5825 rawip_activate, 5826 rawip_accept, 5827 rawip_bind, 5828 rawip_listen, 5829 rawip_connect, 5830 rawip_getpeername, 5831 rawip_getsockname, 5832 rawip_getsockopt, 5833 rawip_setsockopt, 5834 rawip_send, 5835 NULL, 5836 NULL, 5837 NULL, 5838 rawip_shutdown, 5839 rawip_clr_flowctrl, 5840 rawip_ioctl, 5841 rawip_close 5842 }; 5843