1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* Copyright (c) 1990 Mentat Inc. */ 26 27 #include <sys/types.h> 28 #include <sys/stream.h> 29 #include <sys/stropts.h> 30 #include <sys/strlog.h> 31 #include <sys/strsun.h> 32 #define _SUN_TPI_VERSION 2 33 #include <sys/tihdr.h> 34 #include <sys/timod.h> 35 #include <sys/ddi.h> 36 #include <sys/sunddi.h> 37 #include <sys/strsubr.h> 38 #include <sys/suntpi.h> 39 #include <sys/xti_inet.h> 40 #include <sys/cmn_err.h> 41 #include <sys/kmem.h> 42 #include <sys/cred_impl.h> 43 #include <sys/policy.h> 44 #include <sys/priv.h> 45 #include <sys/ucred.h> 46 #include <sys/zone.h> 47 48 #include <sys/sockio.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/vtrace.h> 52 #include <sys/sdt.h> 53 #include <sys/debug.h> 54 #include <sys/isa_defs.h> 55 #include <sys/random.h> 56 #include <netinet/in.h> 57 #include <netinet/ip6.h> 58 #include <netinet/icmp6.h> 59 #include <netinet/udp.h> 60 61 #include <inet/common.h> 62 #include <inet/ip.h> 63 #include <inet/ip_impl.h> 64 #include <inet/ipsec_impl.h> 65 #include <inet/ip6.h> 66 #include <inet/ip_ire.h> 67 #include <inet/ip_if.h> 68 #include <inet/ip_multi.h> 69 #include <inet/ip_ndp.h> 70 #include <inet/proto_set.h> 71 #include <inet/mib2.h> 72 #include <inet/nd.h> 73 #include <inet/optcom.h> 74 #include <inet/snmpcom.h> 75 #include <inet/kstatcom.h> 76 #include <inet/ipclassifier.h> 77 78 #include <sys/tsol/label.h> 79 #include <sys/tsol/tnet.h> 80 81 #include <inet/rawip_impl.h> 82 83 #include <sys/disp.h> 84 85 /* 86 * Synchronization notes: 87 * 88 * RAWIP is MT and uses the usual kernel synchronization primitives. We use 89 * conn_lock to protect the icmp_t. 90 * 91 * Plumbing notes: 92 * ICMP is always a device driver. For compatibility with mibopen() code 93 * it is possible to I_PUSH "icmp", but that results in pushing a passthrough 94 * dummy module. 95 */ 96 97 static void icmp_addr_req(queue_t *q, mblk_t *mp); 98 static void icmp_tpi_bind(queue_t *q, mblk_t *mp); 99 static void icmp_bind_proto(icmp_t *icmp); 100 static int icmp_build_hdr_template(conn_t *, const in6_addr_t *, 101 const in6_addr_t *, uint32_t); 102 static void icmp_capability_req(queue_t *q, mblk_t *mp); 103 static int icmp_close(queue_t *q, int flags); 104 static void icmp_close_free(conn_t *); 105 static void icmp_tpi_connect(queue_t *q, mblk_t *mp); 106 static void icmp_tpi_disconnect(queue_t *q, mblk_t *mp); 107 static void icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, 108 int sys_error); 109 static void icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 110 t_scalar_t tlierr, int sys_error); 111 static void icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, 112 ip_recv_attr_t *); 113 static void icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, 114 ip_recv_attr_t *); 115 static void icmp_info_req(queue_t *q, mblk_t *mp); 116 static void icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *); 117 static conn_t *icmp_open(int family, cred_t *credp, int *err, int flags); 118 static int icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, 119 cred_t *credp); 120 static int icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, 121 cred_t *credp); 122 static boolean_t icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name); 123 int icmp_opt_set(conn_t *connp, uint_t optset_context, 124 int level, int name, uint_t inlen, 125 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 126 void *thisdg_attrs, cred_t *cr); 127 int icmp_opt_get(conn_t *connp, int level, int name, 128 uchar_t *ptr); 129 static int icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, 130 sin6_t *sin6, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa); 131 static int icmp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 132 static boolean_t icmp_param_register(IDP *ndp, icmpparam_t *icmppa, int cnt); 133 static int icmp_param_set(queue_t *q, mblk_t *mp, char *value, 134 caddr_t cp, cred_t *cr); 135 static mblk_t *icmp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *, 136 const in6_addr_t *, const in6_addr_t *, uint32_t, mblk_t *, int *); 137 static mblk_t *icmp_prepend_header_template(conn_t *, ip_xmit_attr_t *, 138 mblk_t *, const in6_addr_t *, uint32_t, int *); 139 static int icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 140 uchar_t *ptr, int len); 141 static void icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err); 142 static void icmp_tpi_unbind(queue_t *q, mblk_t *mp); 143 static void icmp_wput(queue_t *q, mblk_t *mp); 144 static void icmp_wput_fallback(queue_t *q, mblk_t *mp); 145 static void icmp_wput_other(queue_t *q, mblk_t *mp); 146 static void icmp_wput_iocdata(queue_t *q, mblk_t *mp); 147 static void icmp_wput_restricted(queue_t *q, mblk_t *mp); 148 static void icmp_ulp_recv(conn_t *, mblk_t *, uint_t); 149 150 static void *rawip_stack_init(netstackid_t stackid, netstack_t *ns); 151 static void rawip_stack_fini(netstackid_t stackid, void *arg); 152 153 static void *rawip_kstat_init(netstackid_t stackid); 154 static void rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp); 155 static int rawip_kstat_update(kstat_t *kp, int rw); 156 static void rawip_stack_shutdown(netstackid_t stackid, void *arg); 157 158 /* Common routines for TPI and socket module */ 159 static conn_t *rawip_do_open(int, cred_t *, int *, int); 160 static void rawip_do_close(conn_t *); 161 static int rawip_do_bind(conn_t *, struct sockaddr *, socklen_t); 162 static int rawip_do_unbind(conn_t *); 163 static int rawip_do_connect(conn_t *, const struct sockaddr *, socklen_t, 164 cred_t *, pid_t); 165 166 int rawip_getsockname(sock_lower_handle_t, struct sockaddr *, 167 socklen_t *, cred_t *); 168 int rawip_getpeername(sock_lower_handle_t, struct sockaddr *, 169 socklen_t *, cred_t *); 170 171 static struct module_info icmp_mod_info = { 172 5707, "icmp", 1, INFPSZ, 512, 128 173 }; 174 175 /* 176 * Entry points for ICMP as a device. 177 * We have separate open functions for the /dev/icmp and /dev/icmp6 devices. 178 */ 179 static struct qinit icmprinitv4 = { 180 NULL, NULL, icmp_openv4, icmp_close, NULL, &icmp_mod_info 181 }; 182 183 static struct qinit icmprinitv6 = { 184 NULL, NULL, icmp_openv6, icmp_close, NULL, &icmp_mod_info 185 }; 186 187 static struct qinit icmpwinit = { 188 (pfi_t)icmp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &icmp_mod_info 189 }; 190 191 /* ICMP entry point during fallback */ 192 static struct qinit icmp_fallback_sock_winit = { 193 (pfi_t)icmp_wput_fallback, NULL, NULL, NULL, NULL, &icmp_mod_info 194 }; 195 196 /* For AF_INET aka /dev/icmp */ 197 struct streamtab icmpinfov4 = { 198 &icmprinitv4, &icmpwinit 199 }; 200 201 /* For AF_INET6 aka /dev/icmp6 */ 202 struct streamtab icmpinfov6 = { 203 &icmprinitv6, &icmpwinit 204 }; 205 206 static sin_t sin_null; /* Zero address for quick clears */ 207 static sin6_t sin6_null; /* Zero address for quick clears */ 208 209 /* Default structure copied into T_INFO_ACK messages */ 210 static struct T_info_ack icmp_g_t_info_ack = { 211 T_INFO_ACK, 212 IP_MAXPACKET, /* TSDU_size. icmp allows maximum size messages. */ 213 T_INVALID, /* ETSDU_size. icmp does not support expedited data. */ 214 T_INVALID, /* CDATA_size. icmp does not support connect data. */ 215 T_INVALID, /* DDATA_size. icmp does not support disconnect data. */ 216 0, /* ADDR_size - filled in later. */ 217 0, /* OPT_size - not initialized here */ 218 IP_MAXPACKET, /* TIDU_size. icmp allows maximum size messages. */ 219 T_CLTS, /* SERV_type. icmp supports connection-less. */ 220 TS_UNBND, /* CURRENT_state. This is set from icmp_state. */ 221 (XPG4_1|SENDZERO) /* PROVIDER_flag */ 222 }; 223 224 /* 225 * Table of ND variables supported by icmp. These are loaded into is_nd 226 * when the stack instance is created. 227 * All of these are alterable, within the min/max values given, at run time. 228 */ 229 static icmpparam_t icmp_param_arr[] = { 230 /* min max value name */ 231 { 0, 128, 32, "icmp_wroff_extra" }, 232 { 1, 255, 255, "icmp_ipv4_ttl" }, 233 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "icmp_ipv6_hoplimit"}, 234 { 0, 1, 1, "icmp_bsd_compat" }, 235 { 4096, 65536, 8192, "icmp_xmit_hiwat"}, 236 { 0, 65536, 1024, "icmp_xmit_lowat"}, 237 { 4096, 65536, 8192, "icmp_recv_hiwat"}, 238 { 65536, 1024*1024*1024, 256*1024, "icmp_max_buf"}, 239 { 0, 1, 0, "icmp_pmtu_discovery" }, 240 { 0, 1, 0, "icmp_sendto_ignerr" }, 241 }; 242 #define is_wroff_extra is_param_arr[0].icmp_param_value 243 #define is_ipv4_ttl is_param_arr[1].icmp_param_value 244 #define is_ipv6_hoplimit is_param_arr[2].icmp_param_value 245 #define is_bsd_compat is_param_arr[3].icmp_param_value 246 #define is_xmit_hiwat is_param_arr[4].icmp_param_value 247 #define is_xmit_lowat is_param_arr[5].icmp_param_value 248 #define is_recv_hiwat is_param_arr[6].icmp_param_value 249 #define is_max_buf is_param_arr[7].icmp_param_value 250 #define is_pmtu_discovery is_param_arr[8].icmp_param_value 251 #define is_sendto_ignerr is_param_arr[9].icmp_param_value 252 253 typedef union T_primitives *t_primp_t; 254 255 /* 256 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message 257 * passed to icmp_wput. 258 * It calls IP to verify the local IP address, and calls IP to insert 259 * the conn_t in the fanout table. 260 * If everything is ok it then sends the T_BIND_ACK back up. 261 */ 262 static void 263 icmp_tpi_bind(queue_t *q, mblk_t *mp) 264 { 265 int error; 266 struct sockaddr *sa; 267 struct T_bind_req *tbr; 268 socklen_t len; 269 sin_t *sin; 270 sin6_t *sin6; 271 icmp_t *icmp; 272 conn_t *connp = Q_TO_CONN(q); 273 mblk_t *mp1; 274 cred_t *cr; 275 276 /* 277 * All Solaris components should pass a db_credp 278 * for this TPI message, hence we ASSERT. 279 * But in case there is some other M_PROTO that looks 280 * like a TPI message sent by some other kernel 281 * component, we check and return an error. 282 */ 283 cr = msg_getcred(mp, NULL); 284 ASSERT(cr != NULL); 285 if (cr == NULL) { 286 icmp_err_ack(q, mp, TSYSERR, EINVAL); 287 return; 288 } 289 290 icmp = connp->conn_icmp; 291 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 292 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 293 "icmp_bind: bad req, len %u", 294 (uint_t)(mp->b_wptr - mp->b_rptr)); 295 icmp_err_ack(q, mp, TPROTO, 0); 296 return; 297 } 298 299 if (icmp->icmp_state != TS_UNBND) { 300 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 301 "icmp_bind: bad state, %u", icmp->icmp_state); 302 icmp_err_ack(q, mp, TOUTSTATE, 0); 303 return; 304 } 305 306 /* 307 * Reallocate the message to make sure we have enough room for an 308 * address. 309 */ 310 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1); 311 if (mp1 == NULL) { 312 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 313 return; 314 } 315 mp = mp1; 316 317 /* Reset the message type in preparation for shipping it back. */ 318 DB_TYPE(mp) = M_PCPROTO; 319 tbr = (struct T_bind_req *)mp->b_rptr; 320 len = tbr->ADDR_length; 321 switch (len) { 322 case 0: /* request for a generic port */ 323 tbr->ADDR_offset = sizeof (struct T_bind_req); 324 if (connp->conn_family == AF_INET) { 325 tbr->ADDR_length = sizeof (sin_t); 326 sin = (sin_t *)&tbr[1]; 327 *sin = sin_null; 328 sin->sin_family = AF_INET; 329 mp->b_wptr = (uchar_t *)&sin[1]; 330 sa = (struct sockaddr *)sin; 331 len = sizeof (sin_t); 332 } else { 333 ASSERT(connp->conn_family == AF_INET6); 334 tbr->ADDR_length = sizeof (sin6_t); 335 sin6 = (sin6_t *)&tbr[1]; 336 *sin6 = sin6_null; 337 sin6->sin6_family = AF_INET6; 338 mp->b_wptr = (uchar_t *)&sin6[1]; 339 sa = (struct sockaddr *)sin6; 340 len = sizeof (sin6_t); 341 } 342 break; 343 344 case sizeof (sin_t): /* Complete IPv4 address */ 345 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset, 346 sizeof (sin_t)); 347 break; 348 349 case sizeof (sin6_t): /* Complete IPv6 address */ 350 sa = (struct sockaddr *)mi_offset_param(mp, 351 tbr->ADDR_offset, sizeof (sin6_t)); 352 break; 353 354 default: 355 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 356 "icmp_bind: bad ADDR_length %u", tbr->ADDR_length); 357 icmp_err_ack(q, mp, TBADADDR, 0); 358 return; 359 } 360 361 error = rawip_do_bind(connp, sa, len); 362 if (error != 0) { 363 if (error > 0) { 364 icmp_err_ack(q, mp, TSYSERR, error); 365 } else { 366 icmp_err_ack(q, mp, -error, 0); 367 } 368 } else { 369 tbr->PRIM_type = T_BIND_ACK; 370 qreply(q, mp); 371 } 372 } 373 374 static int 375 rawip_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len) 376 { 377 sin_t *sin; 378 sin6_t *sin6; 379 icmp_t *icmp = connp->conn_icmp; 380 int error = 0; 381 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */ 382 in_port_t lport; /* Network byte order */ 383 ipaddr_t v4src; /* Set if AF_INET */ 384 in6_addr_t v6src; 385 uint_t scopeid = 0; 386 zoneid_t zoneid = IPCL_ZONEID(connp); 387 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 388 389 if (sa == NULL || !OK_32PTR((char *)sa)) { 390 return (EINVAL); 391 } 392 393 switch (len) { 394 case sizeof (sin_t): /* Complete IPv4 address */ 395 sin = (sin_t *)sa; 396 if (sin->sin_family != AF_INET || 397 connp->conn_family != AF_INET) { 398 /* TSYSERR, EAFNOSUPPORT */ 399 return (EAFNOSUPPORT); 400 } 401 v4src = sin->sin_addr.s_addr; 402 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src); 403 if (v4src != INADDR_ANY) { 404 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst, 405 B_TRUE); 406 } 407 lport = sin->sin_port; 408 break; 409 case sizeof (sin6_t): /* Complete IPv6 address */ 410 sin6 = (sin6_t *)sa; 411 if (sin6->sin6_family != AF_INET6 || 412 connp->conn_family != AF_INET6) { 413 /* TSYSERR, EAFNOSUPPORT */ 414 return (EAFNOSUPPORT); 415 } 416 /* No support for mapped addresses on raw sockets */ 417 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 418 /* TSYSERR, EADDRNOTAVAIL */ 419 return (EADDRNOTAVAIL); 420 } 421 v6src = sin6->sin6_addr; 422 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 423 if (IN6_IS_ADDR_LINKSCOPE(&v6src)) 424 scopeid = sin6->sin6_scope_id; 425 laddr_type = ip_laddr_verify_v6(&v6src, zoneid, ipst, 426 B_TRUE, scopeid); 427 } 428 lport = sin6->sin6_port; 429 break; 430 431 default: 432 /* TBADADDR */ 433 return (EADDRNOTAVAIL); 434 } 435 436 /* Is the local address a valid unicast, multicast, or broadcast? */ 437 if (laddr_type == IPVL_BAD) 438 return (EADDRNOTAVAIL); 439 440 /* 441 * The state must be TS_UNBND. 442 */ 443 mutex_enter(&connp->conn_lock); 444 if (icmp->icmp_state != TS_UNBND) { 445 mutex_exit(&connp->conn_lock); 446 return (-TOUTSTATE); 447 } 448 449 /* 450 * Copy the source address into our icmp structure. This address 451 * may still be zero; if so, ip will fill in the correct address 452 * each time an outbound packet is passed to it. 453 * If we are binding to a broadcast or multicast address then 454 * we just set the conn_bound_addr since we don't want to use 455 * that as the source address when sending. 456 */ 457 connp->conn_bound_addr_v6 = v6src; 458 connp->conn_laddr_v6 = v6src; 459 if (scopeid != 0) { 460 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 461 connp->conn_ixa->ixa_scopeid = scopeid; 462 connp->conn_incoming_ifindex = scopeid; 463 } else { 464 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 465 connp->conn_incoming_ifindex = connp->conn_bound_if; 466 } 467 468 switch (laddr_type) { 469 case IPVL_UNICAST_UP: 470 case IPVL_UNICAST_DOWN: 471 connp->conn_saddr_v6 = v6src; 472 connp->conn_mcbc_bind = B_FALSE; 473 break; 474 case IPVL_MCAST: 475 case IPVL_BCAST: 476 /* ip_set_destination will pick a source address later */ 477 connp->conn_saddr_v6 = ipv6_all_zeros; 478 connp->conn_mcbc_bind = B_TRUE; 479 break; 480 } 481 482 /* Any errors after this point should use late_error */ 483 484 /* 485 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 486 * with IPPROTO_TCP. 487 */ 488 connp->conn_lport = lport; 489 connp->conn_fport = 0; 490 491 if (connp->conn_family == AF_INET) { 492 ASSERT(connp->conn_ipversion == IPV4_VERSION); 493 } else { 494 ASSERT(connp->conn_ipversion == IPV6_VERSION); 495 } 496 497 icmp->icmp_state = TS_IDLE; 498 499 /* 500 * We create an initial header template here to make a subsequent 501 * sendto have a starting point. Since conn_last_dst is zero the 502 * first sendto will always follow the 'dst changed' code path. 503 * Note that we defer massaging options and the related checksum 504 * adjustment until we have a destination address. 505 */ 506 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 507 &connp->conn_faddr_v6, connp->conn_flowinfo); 508 if (error != 0) { 509 mutex_exit(&connp->conn_lock); 510 goto late_error; 511 } 512 /* Just in case */ 513 connp->conn_faddr_v6 = ipv6_all_zeros; 514 connp->conn_v6lastdst = ipv6_all_zeros; 515 mutex_exit(&connp->conn_lock); 516 517 error = ip_laddr_fanout_insert(connp); 518 if (error != 0) 519 goto late_error; 520 521 /* Bind succeeded */ 522 return (0); 523 524 late_error: 525 mutex_enter(&connp->conn_lock); 526 connp->conn_saddr_v6 = ipv6_all_zeros; 527 connp->conn_bound_addr_v6 = ipv6_all_zeros; 528 connp->conn_laddr_v6 = ipv6_all_zeros; 529 if (scopeid != 0) { 530 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 531 connp->conn_incoming_ifindex = connp->conn_bound_if; 532 } 533 icmp->icmp_state = TS_UNBND; 534 connp->conn_v6lastdst = ipv6_all_zeros; 535 connp->conn_lport = 0; 536 537 /* Restore the header that was built above - different source address */ 538 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 539 &connp->conn_faddr_v6, connp->conn_flowinfo); 540 mutex_exit(&connp->conn_lock); 541 return (error); 542 } 543 544 /* 545 * Tell IP to just bind to the protocol. 546 */ 547 static void 548 icmp_bind_proto(icmp_t *icmp) 549 { 550 conn_t *connp = icmp->icmp_connp; 551 552 mutex_enter(&connp->conn_lock); 553 connp->conn_saddr_v6 = ipv6_all_zeros; 554 connp->conn_laddr_v6 = ipv6_all_zeros; 555 connp->conn_faddr_v6 = ipv6_all_zeros; 556 connp->conn_v6lastdst = ipv6_all_zeros; 557 mutex_exit(&connp->conn_lock); 558 559 (void) ip_laddr_fanout_insert(connp); 560 } 561 562 /* 563 * This routine handles each T_CONN_REQ message passed to icmp. It 564 * associates a default destination address with the stream. 565 * 566 * After various error checks are completed, icmp_connect() lays 567 * the target address and port into the composite header template. 568 * Then we ask IP for information, including a source address if we didn't 569 * already have one. Finally we send up the T_OK_ACK reply message. 570 */ 571 static void 572 icmp_tpi_connect(queue_t *q, mblk_t *mp) 573 { 574 conn_t *connp = Q_TO_CONN(q); 575 struct T_conn_req *tcr; 576 struct sockaddr *sa; 577 socklen_t len; 578 int error; 579 cred_t *cr; 580 pid_t pid; 581 /* 582 * All Solaris components should pass a db_credp 583 * for this TPI message, hence we ASSERT. 584 * But in case there is some other M_PROTO that looks 585 * like a TPI message sent by some other kernel 586 * component, we check and return an error. 587 */ 588 cr = msg_getcred(mp, &pid); 589 ASSERT(cr != NULL); 590 if (cr == NULL) { 591 icmp_err_ack(q, mp, TSYSERR, EINVAL); 592 return; 593 } 594 595 tcr = (struct T_conn_req *)mp->b_rptr; 596 /* Sanity checks */ 597 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) { 598 icmp_err_ack(q, mp, TPROTO, 0); 599 return; 600 } 601 602 if (tcr->OPT_length != 0) { 603 icmp_err_ack(q, mp, TBADOPT, 0); 604 return; 605 } 606 607 len = tcr->DEST_length; 608 609 switch (len) { 610 default: 611 icmp_err_ack(q, mp, TBADADDR, 0); 612 return; 613 case sizeof (sin_t): 614 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset, 615 sizeof (sin_t)); 616 break; 617 case sizeof (sin6_t): 618 sa = (struct sockaddr *)mi_offset_param(mp, 619 tcr->DEST_offset, sizeof (sin6_t)); 620 break; 621 } 622 623 error = proto_verify_ip_addr(connp->conn_family, sa, len); 624 if (error != 0) { 625 icmp_err_ack(q, mp, TSYSERR, error); 626 return; 627 } 628 629 error = rawip_do_connect(connp, sa, len, cr, pid); 630 if (error != 0) { 631 if (error < 0) { 632 icmp_err_ack(q, mp, -error, 0); 633 } else { 634 icmp_err_ack(q, mp, 0, error); 635 } 636 } else { 637 mblk_t *mp1; 638 639 /* 640 * We have to send a connection confirmation to 641 * keep TLI happy. 642 */ 643 if (connp->conn_family == AF_INET) { 644 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 645 sizeof (sin_t), NULL, 0); 646 } else { 647 ASSERT(connp->conn_family == AF_INET6); 648 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 649 sizeof (sin6_t), NULL, 0); 650 } 651 if (mp1 == NULL) { 652 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 653 return; 654 } 655 656 /* 657 * Send ok_ack for T_CONN_REQ 658 */ 659 mp = mi_tpi_ok_ack_alloc(mp); 660 if (mp == NULL) { 661 /* Unable to reuse the T_CONN_REQ for the ack. */ 662 icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM); 663 return; 664 } 665 putnext(connp->conn_rq, mp); 666 putnext(connp->conn_rq, mp1); 667 } 668 } 669 670 static int 671 rawip_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 672 cred_t *cr, pid_t pid) 673 { 674 icmp_t *icmp; 675 sin_t *sin; 676 sin6_t *sin6; 677 int error; 678 uint16_t dstport; 679 ipaddr_t v4dst; 680 in6_addr_t v6dst; 681 uint32_t flowinfo; 682 ip_xmit_attr_t *ixa; 683 uint_t scopeid = 0; 684 uint_t srcid = 0; 685 in6_addr_t v6src = connp->conn_saddr_v6; 686 687 icmp = connp->conn_icmp; 688 689 if (sa == NULL || !OK_32PTR((char *)sa)) { 690 return (EINVAL); 691 } 692 693 ASSERT(sa != NULL && len != 0); 694 695 /* 696 * Determine packet type based on type of address passed in 697 * the request should contain an IPv4 or IPv6 address. 698 * Make sure that address family matches the type of 699 * family of the address passed down. 700 */ 701 switch (len) { 702 case sizeof (sin_t): 703 sin = (sin_t *)sa; 704 705 v4dst = sin->sin_addr.s_addr; 706 dstport = sin->sin_port; 707 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 708 ASSERT(connp->conn_ipversion == IPV4_VERSION); 709 break; 710 711 case sizeof (sin6_t): 712 sin6 = (sin6_t *)sa; 713 714 /* No support for mapped addresses on raw sockets */ 715 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 716 return (EADDRNOTAVAIL); 717 } 718 v6dst = sin6->sin6_addr; 719 dstport = sin6->sin6_port; 720 ASSERT(connp->conn_ipversion == IPV6_VERSION); 721 flowinfo = sin6->sin6_flowinfo; 722 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 723 scopeid = sin6->sin6_scope_id; 724 srcid = sin6->__sin6_src_id; 725 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 726 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 727 connp->conn_netstack); 728 } 729 break; 730 } 731 732 /* 733 * If there is a different thread using conn_ixa then we get a new 734 * copy and cut the old one loose from conn_ixa. Otherwise we use 735 * conn_ixa and prevent any other thread from using/changing it. 736 * Once connect() is done other threads can use conn_ixa since the 737 * refcnt will be back at one. 738 */ 739 ixa = conn_get_ixa(connp, B_TRUE); 740 if (ixa == NULL) 741 return (ENOMEM); 742 743 ASSERT(ixa->ixa_refcnt >= 2); 744 ASSERT(ixa == connp->conn_ixa); 745 746 mutex_enter(&connp->conn_lock); 747 /* 748 * This icmp_t must have bound already before doing a connect. 749 * Reject if a connect is in progress (we drop conn_lock during 750 * rawip_do_connect). 751 */ 752 if (icmp->icmp_state == TS_UNBND || icmp->icmp_state == TS_WCON_CREQ) { 753 mutex_exit(&connp->conn_lock); 754 ixa_refrele(ixa); 755 return (-TOUTSTATE); 756 } 757 758 if (icmp->icmp_state == TS_DATA_XFER) { 759 /* Already connected - clear out state */ 760 if (connp->conn_mcbc_bind) 761 connp->conn_saddr_v6 = ipv6_all_zeros; 762 else 763 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 764 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 765 connp->conn_faddr_v6 = ipv6_all_zeros; 766 icmp->icmp_state = TS_IDLE; 767 } 768 769 /* 770 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 771 * with IPPROTO_TCP. 772 */ 773 connp->conn_fport = dstport; 774 if (connp->conn_ipversion == IPV4_VERSION) { 775 /* 776 * Interpret a zero destination to mean loopback. 777 * Update the T_CONN_REQ (sin/sin6) since it is used to 778 * generate the T_CONN_CON. 779 */ 780 if (v4dst == INADDR_ANY) { 781 v4dst = htonl(INADDR_LOOPBACK); 782 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 783 ASSERT(connp->conn_family == AF_INET); 784 sin->sin_addr.s_addr = v4dst; 785 } 786 connp->conn_faddr_v6 = v6dst; 787 connp->conn_flowinfo = 0; 788 } else { 789 ASSERT(connp->conn_ipversion == IPV6_VERSION); 790 /* 791 * Interpret a zero destination to mean loopback. 792 * Update the T_CONN_REQ (sin/sin6) since it is used to 793 * generate the T_CONN_CON. 794 */ 795 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) { 796 v6dst = ipv6_loopback; 797 sin6->sin6_addr = v6dst; 798 } 799 connp->conn_faddr_v6 = v6dst; 800 connp->conn_flowinfo = flowinfo; 801 } 802 803 /* 804 * We update our cred/cpid based on the caller of connect 805 */ 806 if (connp->conn_cred != cr) { 807 crhold(cr); 808 crfree(connp->conn_cred); 809 connp->conn_cred = cr; 810 } 811 connp->conn_cpid = pid; 812 ixa->ixa_cred = cr; 813 ixa->ixa_cpid = pid; 814 if (is_system_labeled()) { 815 /* We need to restart with a label based on the cred */ 816 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 817 } 818 819 if (scopeid != 0) { 820 ixa->ixa_flags |= IXAF_SCOPEID_SET; 821 ixa->ixa_scopeid = scopeid; 822 connp->conn_incoming_ifindex = scopeid; 823 } else { 824 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 825 connp->conn_incoming_ifindex = connp->conn_bound_if; 826 } 827 828 /* 829 * conn_connect will drop conn_lock and reacquire it. 830 * To prevent a send* from messing with this icmp_t while the lock 831 * is dropped we set icmp_state and clear conn_v6lastdst. 832 * That will make all send* fail with EISCONN. 833 */ 834 connp->conn_v6lastdst = ipv6_all_zeros; 835 icmp->icmp_state = TS_WCON_CREQ; 836 837 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC); 838 mutex_exit(&connp->conn_lock); 839 if (error != 0) 840 goto connect_failed; 841 842 /* 843 * The addresses have been verified. Time to insert in 844 * the correct fanout list. 845 */ 846 error = ipcl_conn_insert(connp); 847 if (error != 0) 848 goto connect_failed; 849 850 mutex_enter(&connp->conn_lock); 851 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 852 &connp->conn_faddr_v6, connp->conn_flowinfo); 853 if (error != 0) { 854 mutex_exit(&connp->conn_lock); 855 goto connect_failed; 856 } 857 858 icmp->icmp_state = TS_DATA_XFER; 859 /* Record this as the "last" send even though we haven't sent any */ 860 connp->conn_v6lastdst = connp->conn_faddr_v6; 861 connp->conn_lastipversion = connp->conn_ipversion; 862 connp->conn_lastdstport = connp->conn_fport; 863 connp->conn_lastflowinfo = connp->conn_flowinfo; 864 connp->conn_lastscopeid = scopeid; 865 connp->conn_lastsrcid = srcid; 866 /* Also remember a source to use together with lastdst */ 867 connp->conn_v6lastsrc = v6src; 868 mutex_exit(&connp->conn_lock); 869 870 ixa_refrele(ixa); 871 return (0); 872 873 connect_failed: 874 if (ixa != NULL) 875 ixa_refrele(ixa); 876 mutex_enter(&connp->conn_lock); 877 icmp->icmp_state = TS_IDLE; 878 /* In case the source address was set above */ 879 if (connp->conn_mcbc_bind) 880 connp->conn_saddr_v6 = ipv6_all_zeros; 881 else 882 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 883 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 884 connp->conn_faddr_v6 = ipv6_all_zeros; 885 connp->conn_v6lastdst = ipv6_all_zeros; 886 connp->conn_flowinfo = 0; 887 888 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 889 &connp->conn_faddr_v6, connp->conn_flowinfo); 890 mutex_exit(&connp->conn_lock); 891 return (error); 892 } 893 894 static void 895 rawip_do_close(conn_t *connp) 896 { 897 ASSERT(connp != NULL && IPCL_IS_RAWIP(connp)); 898 899 ip_quiesce_conn(connp); 900 901 if (!IPCL_IS_NONSTR(connp)) { 902 qprocsoff(connp->conn_rq); 903 } 904 905 icmp_close_free(connp); 906 907 /* 908 * Now we are truly single threaded on this stream, and can 909 * delete the things hanging off the connp, and finally the connp. 910 * We removed this connp from the fanout list, it cannot be 911 * accessed thru the fanouts, and we already waited for the 912 * conn_ref to drop to 0. We are already in close, so 913 * there cannot be any other thread from the top. qprocsoff 914 * has completed, and service has completed or won't run in 915 * future. 916 */ 917 ASSERT(connp->conn_ref == 1); 918 919 if (!IPCL_IS_NONSTR(connp)) { 920 inet_minor_free(connp->conn_minor_arena, connp->conn_dev); 921 } else { 922 ip_free_helper_stream(connp); 923 } 924 925 connp->conn_ref--; 926 ipcl_conn_destroy(connp); 927 } 928 929 static int 930 icmp_close(queue_t *q, int flags) 931 { 932 conn_t *connp; 933 934 if (flags & SO_FALLBACK) { 935 /* 936 * stream is being closed while in fallback 937 * simply free the resources that were allocated 938 */ 939 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr)); 940 qprocsoff(q); 941 goto done; 942 } 943 944 connp = Q_TO_CONN(q); 945 (void) rawip_do_close(connp); 946 done: 947 q->q_ptr = WR(q)->q_ptr = NULL; 948 return (0); 949 } 950 951 static void 952 icmp_close_free(conn_t *connp) 953 { 954 icmp_t *icmp = connp->conn_icmp; 955 956 if (icmp->icmp_filter != NULL) { 957 kmem_free(icmp->icmp_filter, sizeof (icmp6_filter_t)); 958 icmp->icmp_filter = NULL; 959 } 960 961 /* 962 * Clear any fields which the kmem_cache constructor clears. 963 * Only icmp_connp needs to be preserved. 964 * TBD: We should make this more efficient to avoid clearing 965 * everything. 966 */ 967 ASSERT(icmp->icmp_connp == connp); 968 bzero(icmp, sizeof (icmp_t)); 969 icmp->icmp_connp = connp; 970 } 971 972 /* 973 * This routine handles each T_DISCON_REQ message passed to icmp 974 * as an indicating that ICMP is no longer connected. This results 975 * in telling IP to restore the binding to just the local address. 976 */ 977 static int 978 icmp_do_disconnect(conn_t *connp) 979 { 980 icmp_t *icmp = connp->conn_icmp; 981 int error; 982 983 mutex_enter(&connp->conn_lock); 984 if (icmp->icmp_state != TS_DATA_XFER) { 985 mutex_exit(&connp->conn_lock); 986 return (-TOUTSTATE); 987 } 988 if (connp->conn_mcbc_bind) 989 connp->conn_saddr_v6 = ipv6_all_zeros; 990 else 991 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 992 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 993 connp->conn_faddr_v6 = ipv6_all_zeros; 994 icmp->icmp_state = TS_IDLE; 995 996 connp->conn_v6lastdst = ipv6_all_zeros; 997 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 998 &connp->conn_faddr_v6, connp->conn_flowinfo); 999 mutex_exit(&connp->conn_lock); 1000 if (error != 0) 1001 return (error); 1002 1003 /* 1004 * Tell IP to remove the full binding and revert 1005 * to the local address binding. 1006 */ 1007 return (ip_laddr_fanout_insert(connp)); 1008 } 1009 1010 static void 1011 icmp_tpi_disconnect(queue_t *q, mblk_t *mp) 1012 { 1013 conn_t *connp = Q_TO_CONN(q); 1014 int error; 1015 1016 /* 1017 * Allocate the largest primitive we need to send back 1018 * T_error_ack is > than T_ok_ack 1019 */ 1020 mp = reallocb(mp, sizeof (struct T_error_ack), 1); 1021 if (mp == NULL) { 1022 /* Unable to reuse the T_DISCON_REQ for the ack. */ 1023 icmp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM); 1024 return; 1025 } 1026 1027 error = icmp_do_disconnect(connp); 1028 1029 if (error != 0) { 1030 if (error > 0) { 1031 icmp_err_ack(q, mp, 0, error); 1032 } else { 1033 icmp_err_ack(q, mp, -error, 0); 1034 } 1035 } else { 1036 mp = mi_tpi_ok_ack_alloc(mp); 1037 ASSERT(mp != NULL); 1038 qreply(q, mp); 1039 } 1040 } 1041 1042 static int 1043 icmp_disconnect(conn_t *connp) 1044 { 1045 int error; 1046 1047 connp->conn_dgram_errind = B_FALSE; 1048 1049 error = icmp_do_disconnect(connp); 1050 1051 if (error < 0) 1052 error = proto_tlitosyserr(-error); 1053 return (error); 1054 } 1055 1056 /* This routine creates a T_ERROR_ACK message and passes it upstream. */ 1057 static void 1058 icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error) 1059 { 1060 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 1061 qreply(q, mp); 1062 } 1063 1064 /* Shorthand to generate and send TPI error acks to our client */ 1065 static void 1066 icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 1067 t_scalar_t t_error, int sys_error) 1068 { 1069 struct T_error_ack *teackp; 1070 1071 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 1072 M_PCPROTO, T_ERROR_ACK)) != NULL) { 1073 teackp = (struct T_error_ack *)mp->b_rptr; 1074 teackp->ERROR_prim = primitive; 1075 teackp->TLI_error = t_error; 1076 teackp->UNIX_error = sys_error; 1077 qreply(q, mp); 1078 } 1079 } 1080 1081 /* 1082 * icmp_icmp_input is called as conn_recvicmp to process ICMP messages. 1083 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1084 * Assumes that IP has pulled up everything up to and including the ICMP header. 1085 */ 1086 /* ARGSUSED2 */ 1087 static void 1088 icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 1089 { 1090 conn_t *connp = (conn_t *)arg1; 1091 icmp_t *icmp = connp->conn_icmp; 1092 icmph_t *icmph; 1093 ipha_t *ipha; 1094 int iph_hdr_length; 1095 sin_t sin; 1096 mblk_t *mp1; 1097 int error = 0; 1098 1099 ipha = (ipha_t *)mp->b_rptr; 1100 1101 ASSERT(OK_32PTR(mp->b_rptr)); 1102 1103 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) { 1104 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 1105 icmp_icmp_error_ipv6(connp, mp, ira); 1106 return; 1107 } 1108 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 1109 1110 /* Skip past the outer IP and ICMP headers */ 1111 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length); 1112 iph_hdr_length = ira->ira_ip_hdr_length; 1113 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1114 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */ 1115 1116 iph_hdr_length = IPH_HDR_LENGTH(ipha); 1117 1118 switch (icmph->icmph_type) { 1119 case ICMP_DEST_UNREACHABLE: 1120 switch (icmph->icmph_code) { 1121 case ICMP_FRAGMENTATION_NEEDED: { 1122 ipha_t *ipha; 1123 ip_xmit_attr_t *ixa; 1124 /* 1125 * IP has already adjusted the path MTU. 1126 * But we need to adjust DF for IPv4. 1127 */ 1128 if (connp->conn_ipversion != IPV4_VERSION) 1129 break; 1130 1131 ixa = conn_get_ixa(connp, B_FALSE); 1132 if (ixa == NULL || ixa->ixa_ire == NULL) { 1133 /* 1134 * Some other thread holds conn_ixa. We will 1135 * redo this on the next ICMP too big. 1136 */ 1137 if (ixa != NULL) 1138 ixa_refrele(ixa); 1139 break; 1140 } 1141 (void) ip_get_pmtu(ixa); 1142 1143 mutex_enter(&connp->conn_lock); 1144 ipha = (ipha_t *)connp->conn_ht_iphc; 1145 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 1146 ipha->ipha_fragment_offset_and_flags |= 1147 IPH_DF_HTONS; 1148 } else { 1149 ipha->ipha_fragment_offset_and_flags &= 1150 ~IPH_DF_HTONS; 1151 } 1152 mutex_exit(&connp->conn_lock); 1153 ixa_refrele(ixa); 1154 break; 1155 } 1156 case ICMP_PORT_UNREACHABLE: 1157 case ICMP_PROTOCOL_UNREACHABLE: 1158 error = ECONNREFUSED; 1159 break; 1160 default: 1161 /* Transient errors */ 1162 break; 1163 } 1164 break; 1165 default: 1166 /* Transient errors */ 1167 break; 1168 } 1169 if (error == 0) { 1170 freemsg(mp); 1171 return; 1172 } 1173 1174 /* 1175 * Deliver T_UDERROR_IND when the application has asked for it. 1176 * The socket layer enables this automatically when connected. 1177 */ 1178 if (!connp->conn_dgram_errind) { 1179 freemsg(mp); 1180 return; 1181 } 1182 1183 sin = sin_null; 1184 sin.sin_family = AF_INET; 1185 sin.sin_addr.s_addr = ipha->ipha_dst; 1186 1187 if (IPCL_IS_NONSTR(connp)) { 1188 mutex_enter(&connp->conn_lock); 1189 if (icmp->icmp_state == TS_DATA_XFER) { 1190 if (sin.sin_addr.s_addr == connp->conn_faddr_v4) { 1191 mutex_exit(&connp->conn_lock); 1192 (*connp->conn_upcalls->su_set_error) 1193 (connp->conn_upper_handle, error); 1194 goto done; 1195 } 1196 } else { 1197 icmp->icmp_delayed_error = error; 1198 *((sin_t *)&icmp->icmp_delayed_addr) = sin; 1199 } 1200 mutex_exit(&connp->conn_lock); 1201 } else { 1202 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0, 1203 error); 1204 if (mp1 != NULL) 1205 putnext(connp->conn_rq, mp1); 1206 } 1207 done: 1208 freemsg(mp); 1209 } 1210 1211 /* 1212 * icmp_icmp_error_ipv6 is called by icmp_icmp_error to process ICMP for IPv6. 1213 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1214 * Assumes that IP has pulled up all the extension headers as well as the 1215 * ICMPv6 header. 1216 */ 1217 static void 1218 icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira) 1219 { 1220 icmp6_t *icmp6; 1221 ip6_t *ip6h, *outer_ip6h; 1222 uint16_t iph_hdr_length; 1223 uint8_t *nexthdrp; 1224 sin6_t sin6; 1225 mblk_t *mp1; 1226 int error = 0; 1227 icmp_t *icmp = connp->conn_icmp; 1228 1229 outer_ip6h = (ip6_t *)mp->b_rptr; 1230 #ifdef DEBUG 1231 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6) 1232 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h); 1233 else 1234 iph_hdr_length = IPV6_HDR_LEN; 1235 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length); 1236 #endif 1237 /* Skip past the outer IP and ICMP headers */ 1238 iph_hdr_length = ira->ira_ip_hdr_length; 1239 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 1240 1241 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */ 1242 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) { 1243 freemsg(mp); 1244 return; 1245 } 1246 1247 switch (icmp6->icmp6_type) { 1248 case ICMP6_DST_UNREACH: 1249 switch (icmp6->icmp6_code) { 1250 case ICMP6_DST_UNREACH_NOPORT: 1251 error = ECONNREFUSED; 1252 break; 1253 case ICMP6_DST_UNREACH_ADMIN: 1254 case ICMP6_DST_UNREACH_NOROUTE: 1255 case ICMP6_DST_UNREACH_BEYONDSCOPE: 1256 case ICMP6_DST_UNREACH_ADDR: 1257 /* Transient errors */ 1258 break; 1259 default: 1260 break; 1261 } 1262 break; 1263 case ICMP6_PACKET_TOO_BIG: { 1264 struct T_unitdata_ind *tudi; 1265 struct T_opthdr *toh; 1266 size_t udi_size; 1267 mblk_t *newmp; 1268 t_scalar_t opt_length = sizeof (struct T_opthdr) + 1269 sizeof (struct ip6_mtuinfo); 1270 sin6_t *sin6; 1271 struct ip6_mtuinfo *mtuinfo; 1272 1273 /* 1274 * If the application has requested to receive path mtu 1275 * information, send up an empty message containing an 1276 * IPV6_PATHMTU ancillary data item. 1277 */ 1278 if (!connp->conn_ipv6_recvpathmtu) 1279 break; 1280 1281 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) + 1282 opt_length; 1283 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) { 1284 BUMP_MIB(&icmp->icmp_is->is_rawip_mib, rawipInErrors); 1285 break; 1286 } 1287 1288 /* 1289 * newmp->b_cont is left to NULL on purpose. This is an 1290 * empty message containing only ancillary data. 1291 */ 1292 newmp->b_datap->db_type = M_PROTO; 1293 tudi = (struct T_unitdata_ind *)newmp->b_rptr; 1294 newmp->b_wptr = (uchar_t *)tudi + udi_size; 1295 tudi->PRIM_type = T_UNITDATA_IND; 1296 tudi->SRC_length = sizeof (sin6_t); 1297 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 1298 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t); 1299 tudi->OPT_length = opt_length; 1300 1301 sin6 = (sin6_t *)&tudi[1]; 1302 bzero(sin6, sizeof (sin6_t)); 1303 sin6->sin6_family = AF_INET6; 1304 sin6->sin6_addr = connp->conn_faddr_v6; 1305 1306 toh = (struct T_opthdr *)&sin6[1]; 1307 toh->level = IPPROTO_IPV6; 1308 toh->name = IPV6_PATHMTU; 1309 toh->len = opt_length; 1310 toh->status = 0; 1311 1312 mtuinfo = (struct ip6_mtuinfo *)&toh[1]; 1313 bzero(mtuinfo, sizeof (struct ip6_mtuinfo)); 1314 mtuinfo->ip6m_addr.sin6_family = AF_INET6; 1315 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst; 1316 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu; 1317 /* 1318 * We've consumed everything we need from the original 1319 * message. Free it, then send our empty message. 1320 */ 1321 freemsg(mp); 1322 icmp_ulp_recv(connp, newmp, msgdsize(newmp)); 1323 return; 1324 } 1325 case ICMP6_TIME_EXCEEDED: 1326 /* Transient errors */ 1327 break; 1328 case ICMP6_PARAM_PROB: 1329 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 1330 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 1331 (uchar_t *)ip6h + icmp6->icmp6_pptr == 1332 (uchar_t *)nexthdrp) { 1333 error = ECONNREFUSED; 1334 break; 1335 } 1336 break; 1337 } 1338 if (error == 0) { 1339 freemsg(mp); 1340 return; 1341 } 1342 1343 /* 1344 * Deliver T_UDERROR_IND when the application has asked for it. 1345 * The socket layer enables this automatically when connected. 1346 */ 1347 if (!connp->conn_dgram_errind) { 1348 freemsg(mp); 1349 return; 1350 } 1351 1352 sin6 = sin6_null; 1353 sin6.sin6_family = AF_INET6; 1354 sin6.sin6_addr = ip6h->ip6_dst; 1355 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 1356 if (IPCL_IS_NONSTR(connp)) { 1357 mutex_enter(&connp->conn_lock); 1358 if (icmp->icmp_state == TS_DATA_XFER) { 1359 if (IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr, 1360 &connp->conn_faddr_v6)) { 1361 mutex_exit(&connp->conn_lock); 1362 (*connp->conn_upcalls->su_set_error) 1363 (connp->conn_upper_handle, error); 1364 goto done; 1365 } 1366 } else { 1367 icmp->icmp_delayed_error = error; 1368 *((sin6_t *)&icmp->icmp_delayed_addr) = sin6; 1369 } 1370 mutex_exit(&connp->conn_lock); 1371 } else { 1372 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t), 1373 NULL, 0, error); 1374 if (mp1 != NULL) 1375 putnext(connp->conn_rq, mp1); 1376 } 1377 done: 1378 freemsg(mp); 1379 } 1380 1381 /* 1382 * This routine responds to T_ADDR_REQ messages. It is called by icmp_wput. 1383 * The local address is filled in if endpoint is bound. The remote address 1384 * is filled in if remote address has been precified ("connected endpoint") 1385 * (The concept of connected CLTS sockets is alien to published TPI 1386 * but we support it anyway). 1387 */ 1388 static void 1389 icmp_addr_req(queue_t *q, mblk_t *mp) 1390 { 1391 struct sockaddr *sa; 1392 mblk_t *ackmp; 1393 struct T_addr_ack *taa; 1394 icmp_t *icmp = Q_TO_ICMP(q); 1395 conn_t *connp = icmp->icmp_connp; 1396 uint_t addrlen; 1397 1398 /* Make it large enough for worst case */ 1399 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 1400 2 * sizeof (sin6_t), 1); 1401 if (ackmp == NULL) { 1402 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 1403 return; 1404 } 1405 taa = (struct T_addr_ack *)ackmp->b_rptr; 1406 1407 bzero(taa, sizeof (struct T_addr_ack)); 1408 ackmp->b_wptr = (uchar_t *)&taa[1]; 1409 1410 taa->PRIM_type = T_ADDR_ACK; 1411 ackmp->b_datap->db_type = M_PCPROTO; 1412 1413 if (connp->conn_family == AF_INET) 1414 addrlen = sizeof (sin_t); 1415 else 1416 addrlen = sizeof (sin6_t); 1417 1418 mutex_enter(&connp->conn_lock); 1419 /* 1420 * Note: Following code assumes 32 bit alignment of basic 1421 * data structures like sin_t and struct T_addr_ack. 1422 */ 1423 if (icmp->icmp_state != TS_UNBND) { 1424 /* 1425 * Fill in local address first 1426 */ 1427 taa->LOCADDR_offset = sizeof (*taa); 1428 taa->LOCADDR_length = addrlen; 1429 sa = (struct sockaddr *)&taa[1]; 1430 (void) conn_getsockname(connp, sa, &addrlen); 1431 ackmp->b_wptr += addrlen; 1432 } 1433 if (icmp->icmp_state == TS_DATA_XFER) { 1434 /* 1435 * connected, fill remote address too 1436 */ 1437 taa->REMADDR_length = addrlen; 1438 /* assumed 32-bit alignment */ 1439 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length; 1440 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset); 1441 (void) conn_getpeername(connp, sa, &addrlen); 1442 ackmp->b_wptr += addrlen; 1443 } 1444 mutex_exit(&connp->conn_lock); 1445 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim); 1446 qreply(q, ackmp); 1447 } 1448 1449 static void 1450 icmp_copy_info(struct T_info_ack *tap, icmp_t *icmp) 1451 { 1452 conn_t *connp = icmp->icmp_connp; 1453 1454 *tap = icmp_g_t_info_ack; 1455 1456 if (connp->conn_family == AF_INET6) 1457 tap->ADDR_size = sizeof (sin6_t); 1458 else 1459 tap->ADDR_size = sizeof (sin_t); 1460 tap->CURRENT_state = icmp->icmp_state; 1461 tap->OPT_size = icmp_max_optsize; 1462 } 1463 1464 static void 1465 icmp_do_capability_ack(icmp_t *icmp, struct T_capability_ack *tcap, 1466 t_uscalar_t cap_bits1) 1467 { 1468 tcap->CAP_bits1 = 0; 1469 1470 if (cap_bits1 & TC1_INFO) { 1471 icmp_copy_info(&tcap->INFO_ack, icmp); 1472 tcap->CAP_bits1 |= TC1_INFO; 1473 } 1474 } 1475 1476 /* 1477 * This routine responds to T_CAPABILITY_REQ messages. It is called by 1478 * icmp_wput. Much of the T_CAPABILITY_ACK information is copied from 1479 * icmp_g_t_info_ack. The current state of the stream is copied from 1480 * icmp_state. 1481 */ 1482 static void 1483 icmp_capability_req(queue_t *q, mblk_t *mp) 1484 { 1485 icmp_t *icmp = Q_TO_ICMP(q); 1486 t_uscalar_t cap_bits1; 1487 struct T_capability_ack *tcap; 1488 1489 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 1490 1491 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 1492 mp->b_datap->db_type, T_CAPABILITY_ACK); 1493 if (!mp) 1494 return; 1495 1496 tcap = (struct T_capability_ack *)mp->b_rptr; 1497 1498 icmp_do_capability_ack(icmp, tcap, cap_bits1); 1499 1500 qreply(q, mp); 1501 } 1502 1503 /* 1504 * This routine responds to T_INFO_REQ messages. It is called by icmp_wput. 1505 * Most of the T_INFO_ACK information is copied from icmp_g_t_info_ack. 1506 * The current state of the stream is copied from icmp_state. 1507 */ 1508 static void 1509 icmp_info_req(queue_t *q, mblk_t *mp) 1510 { 1511 icmp_t *icmp = Q_TO_ICMP(q); 1512 1513 /* Create a T_INFO_ACK message. */ 1514 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 1515 T_INFO_ACK); 1516 if (!mp) 1517 return; 1518 icmp_copy_info((struct T_info_ack *)mp->b_rptr, icmp); 1519 qreply(q, mp); 1520 } 1521 1522 static int 1523 icmp_tpi_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 1524 int family) 1525 { 1526 conn_t *connp; 1527 dev_t conn_dev; 1528 int error; 1529 1530 /* If the stream is already open, return immediately. */ 1531 if (q->q_ptr != NULL) 1532 return (0); 1533 1534 if (sflag == MODOPEN) 1535 return (EINVAL); 1536 1537 /* 1538 * Since ICMP is not used so heavily, allocating from the small 1539 * arena should be sufficient. 1540 */ 1541 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 1542 return (EBUSY); 1543 } 1544 1545 if (flag & SO_FALLBACK) { 1546 /* 1547 * Non streams socket needs a stream to fallback to 1548 */ 1549 RD(q)->q_ptr = (void *)conn_dev; 1550 WR(q)->q_qinfo = &icmp_fallback_sock_winit; 1551 WR(q)->q_ptr = (void *)ip_minor_arena_sa; 1552 qprocson(q); 1553 return (0); 1554 } 1555 1556 connp = rawip_do_open(family, credp, &error, KM_SLEEP); 1557 if (connp == NULL) { 1558 ASSERT(error != 0); 1559 inet_minor_free(ip_minor_arena_sa, connp->conn_dev); 1560 return (error); 1561 } 1562 1563 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 1564 connp->conn_dev = conn_dev; 1565 connp->conn_minor_arena = ip_minor_arena_sa; 1566 1567 /* 1568 * Initialize the icmp_t structure for this stream. 1569 */ 1570 q->q_ptr = connp; 1571 WR(q)->q_ptr = connp; 1572 connp->conn_rq = q; 1573 connp->conn_wq = WR(q); 1574 1575 WR(q)->q_hiwat = connp->conn_sndbuf; 1576 WR(q)->q_lowat = connp->conn_sndlowat; 1577 1578 qprocson(q); 1579 1580 /* Set the Stream head write offset. */ 1581 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff); 1582 (void) proto_set_rx_hiwat(connp->conn_rq, connp, connp->conn_rcvbuf); 1583 1584 mutex_enter(&connp->conn_lock); 1585 connp->conn_state_flags &= ~CONN_INCIPIENT; 1586 mutex_exit(&connp->conn_lock); 1587 1588 icmp_bind_proto(connp->conn_icmp); 1589 1590 return (0); 1591 } 1592 1593 /* For /dev/icmp aka AF_INET open */ 1594 static int 1595 icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1596 { 1597 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET)); 1598 } 1599 1600 /* For /dev/icmp6 aka AF_INET6 open */ 1601 static int 1602 icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1603 { 1604 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET6)); 1605 } 1606 1607 /* 1608 * This is the open routine for icmp. It allocates a icmp_t structure for 1609 * the stream and, on the first open of the module, creates an ND table. 1610 */ 1611 static conn_t * 1612 rawip_do_open(int family, cred_t *credp, int *err, int flags) 1613 { 1614 icmp_t *icmp; 1615 conn_t *connp; 1616 zoneid_t zoneid; 1617 netstack_t *ns; 1618 icmp_stack_t *is; 1619 int len; 1620 boolean_t isv6 = B_FALSE; 1621 1622 *err = secpolicy_net_icmpaccess(credp); 1623 if (*err != 0) 1624 return (NULL); 1625 1626 if (family == AF_INET6) 1627 isv6 = B_TRUE; 1628 1629 ns = netstack_find_by_cred(credp); 1630 ASSERT(ns != NULL); 1631 is = ns->netstack_icmp; 1632 ASSERT(is != NULL); 1633 1634 /* 1635 * For exclusive stacks we set the zoneid to zero 1636 * to make ICMP operate as if in the global zone. 1637 */ 1638 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1639 zoneid = GLOBAL_ZONEID; 1640 else 1641 zoneid = crgetzoneid(credp); 1642 1643 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP); 1644 1645 connp = ipcl_conn_create(IPCL_RAWIPCONN, flags, ns); 1646 icmp = connp->conn_icmp; 1647 1648 /* 1649 * ipcl_conn_create did a netstack_hold. Undo the hold that was 1650 * done by netstack_find_by_cred() 1651 */ 1652 netstack_rele(ns); 1653 1654 /* 1655 * Since this conn_t/icmp_t is not yet visible to anybody else we don't 1656 * need to lock anything. 1657 */ 1658 ASSERT(connp->conn_proto == IPPROTO_ICMP); 1659 ASSERT(connp->conn_icmp == icmp); 1660 ASSERT(icmp->icmp_connp == connp); 1661 1662 /* Set the initial state of the stream and the privilege status. */ 1663 icmp->icmp_state = TS_UNBND; 1664 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 1665 if (isv6) { 1666 connp->conn_family = AF_INET6; 1667 connp->conn_ipversion = IPV6_VERSION; 1668 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4; 1669 connp->conn_proto = IPPROTO_ICMPV6; 1670 /* May be changed by a SO_PROTOTYPE socket option. */ 1671 connp->conn_proto = IPPROTO_ICMPV6; 1672 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1673 connp->conn_ixa->ixa_raw_cksum_offset = 2; 1674 connp->conn_default_ttl = is->is_ipv6_hoplimit; 1675 len = sizeof (ip6_t); 1676 } else { 1677 connp->conn_family = AF_INET; 1678 connp->conn_ipversion = IPV4_VERSION; 1679 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4; 1680 /* May be changed by a SO_PROTOTYPE socket option. */ 1681 connp->conn_proto = IPPROTO_ICMP; 1682 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1683 connp->conn_default_ttl = is->is_ipv4_ttl; 1684 len = sizeof (ipha_t); 1685 } 1686 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 1687 1688 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1689 1690 /* 1691 * For the socket of protocol IPPROTO_RAW or when IP_HDRINCL is set, 1692 * the checksum is provided in the pre-built packet. We clear 1693 * IXAF_SET_ULP_CKSUM to tell IP that the application has sent a 1694 * complete IP header and not to compute the transport checksum. 1695 */ 1696 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM; 1697 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 1698 connp->conn_ixa->ixa_zoneid = zoneid; 1699 1700 connp->conn_zoneid = zoneid; 1701 1702 /* 1703 * If the caller has the process-wide flag set, then default to MAC 1704 * exempt mode. This allows read-down to unlabeled hosts. 1705 */ 1706 if (getpflags(NET_MAC_AWARE, credp) != 0) 1707 connp->conn_mac_mode = CONN_MAC_AWARE; 1708 1709 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 1710 1711 icmp->icmp_is = is; 1712 1713 connp->conn_rcvbuf = is->is_recv_hiwat; 1714 connp->conn_sndbuf = is->is_xmit_hiwat; 1715 connp->conn_sndlowat = is->is_xmit_lowat; 1716 connp->conn_rcvlowat = icmp_mod_info.mi_lowat; 1717 1718 connp->conn_wroff = len + is->is_wroff_extra; 1719 connp->conn_so_type = SOCK_RAW; 1720 1721 connp->conn_recv = icmp_input; 1722 connp->conn_recvicmp = icmp_icmp_input; 1723 crhold(credp); 1724 connp->conn_cred = credp; 1725 connp->conn_cpid = curproc->p_pid; 1726 connp->conn_open_time = ddi_get_lbolt64(); 1727 /* Cache things in ixa without an extra refhold */ 1728 connp->conn_ixa->ixa_cred = connp->conn_cred; 1729 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 1730 if (is_system_labeled()) 1731 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 1732 1733 connp->conn_flow_cntrld = B_FALSE; 1734 1735 if (is->is_pmtu_discovery) 1736 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 1737 1738 return (connp); 1739 } 1740 1741 /* 1742 * Which ICMP options OK to set through T_UNITDATA_REQ... 1743 */ 1744 /* ARGSUSED */ 1745 static boolean_t 1746 icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name) 1747 { 1748 return (B_TRUE); 1749 } 1750 1751 /* 1752 * This routine gets default values of certain options whose default 1753 * values are maintained by protcol specific code 1754 */ 1755 int 1756 icmp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr) 1757 { 1758 icmp_t *icmp = Q_TO_ICMP(q); 1759 icmp_stack_t *is = icmp->icmp_is; 1760 int *i1 = (int *)ptr; 1761 1762 switch (level) { 1763 case IPPROTO_IP: 1764 switch (name) { 1765 case IP_MULTICAST_TTL: 1766 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL; 1767 return (sizeof (uchar_t)); 1768 case IP_MULTICAST_LOOP: 1769 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP; 1770 return (sizeof (uchar_t)); 1771 } 1772 break; 1773 case IPPROTO_IPV6: 1774 switch (name) { 1775 case IPV6_MULTICAST_HOPS: 1776 *i1 = IP_DEFAULT_MULTICAST_TTL; 1777 return (sizeof (int)); 1778 case IPV6_MULTICAST_LOOP: 1779 *i1 = IP_DEFAULT_MULTICAST_LOOP; 1780 return (sizeof (int)); 1781 case IPV6_UNICAST_HOPS: 1782 *i1 = is->is_ipv6_hoplimit; 1783 return (sizeof (int)); 1784 } 1785 break; 1786 case IPPROTO_ICMPV6: 1787 switch (name) { 1788 case ICMP6_FILTER: 1789 /* Make it look like "pass all" */ 1790 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1791 return (sizeof (icmp6_filter_t)); 1792 } 1793 break; 1794 } 1795 return (-1); 1796 } 1797 1798 /* 1799 * This routine retrieves the current status of socket options. 1800 * It returns the size of the option retrieved, or -1. 1801 */ 1802 int 1803 icmp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr) 1804 { 1805 icmp_t *icmp = connp->conn_icmp; 1806 int *i1 = (int *)ptr; 1807 conn_opt_arg_t coas; 1808 int retval; 1809 1810 coas.coa_connp = connp; 1811 coas.coa_ixa = connp->conn_ixa; 1812 coas.coa_ipp = &connp->conn_xmit_ipp; 1813 coas.coa_ancillary = B_FALSE; 1814 coas.coa_changed = 0; 1815 1816 /* 1817 * We assume that the optcom framework has checked for the set 1818 * of levels and names that are supported, hence we don't worry 1819 * about rejecting based on that. 1820 * First check for ICMP specific handling, then pass to common routine. 1821 */ 1822 switch (level) { 1823 case IPPROTO_IP: 1824 /* 1825 * Only allow IPv4 option processing on IPv4 sockets. 1826 */ 1827 if (connp->conn_family != AF_INET) 1828 return (-1); 1829 1830 switch (name) { 1831 case IP_OPTIONS: 1832 case T_IP_OPTIONS: 1833 /* Options are passed up with each packet */ 1834 return (0); 1835 case IP_HDRINCL: 1836 mutex_enter(&connp->conn_lock); 1837 *i1 = (int)icmp->icmp_hdrincl; 1838 mutex_exit(&connp->conn_lock); 1839 return (sizeof (int)); 1840 } 1841 break; 1842 1843 case IPPROTO_IPV6: 1844 /* 1845 * Only allow IPv6 option processing on native IPv6 sockets. 1846 */ 1847 if (connp->conn_family != AF_INET6) 1848 return (-1); 1849 1850 switch (name) { 1851 case IPV6_CHECKSUM: 1852 /* 1853 * Return offset or -1 if no checksum offset. 1854 * Does not apply to IPPROTO_ICMPV6 1855 */ 1856 if (connp->conn_proto == IPPROTO_ICMPV6) 1857 return (-1); 1858 1859 mutex_enter(&connp->conn_lock); 1860 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) 1861 *i1 = connp->conn_ixa->ixa_raw_cksum_offset; 1862 else 1863 *i1 = -1; 1864 mutex_exit(&connp->conn_lock); 1865 return (sizeof (int)); 1866 } 1867 break; 1868 1869 case IPPROTO_ICMPV6: 1870 /* 1871 * Only allow IPv6 option processing on native IPv6 sockets. 1872 */ 1873 if (connp->conn_family != AF_INET6) 1874 return (-1); 1875 1876 if (connp->conn_proto != IPPROTO_ICMPV6) 1877 return (-1); 1878 1879 switch (name) { 1880 case ICMP6_FILTER: 1881 mutex_enter(&connp->conn_lock); 1882 if (icmp->icmp_filter == NULL) { 1883 /* Make it look like "pass all" */ 1884 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1885 } else { 1886 (void) bcopy(icmp->icmp_filter, ptr, 1887 sizeof (icmp6_filter_t)); 1888 } 1889 mutex_exit(&connp->conn_lock); 1890 return (sizeof (icmp6_filter_t)); 1891 } 1892 } 1893 mutex_enter(&connp->conn_lock); 1894 retval = conn_opt_get(&coas, level, name, ptr); 1895 mutex_exit(&connp->conn_lock); 1896 return (retval); 1897 } 1898 1899 /* 1900 * This routine retrieves the current status of socket options. 1901 * It returns the size of the option retrieved, or -1. 1902 */ 1903 int 1904 icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 1905 { 1906 conn_t *connp = Q_TO_CONN(q); 1907 int err; 1908 1909 err = icmp_opt_get(connp, level, name, ptr); 1910 return (err); 1911 } 1912 1913 /* 1914 * This routine sets socket options. 1915 */ 1916 int 1917 icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name, 1918 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly) 1919 { 1920 conn_t *connp = coa->coa_connp; 1921 ip_xmit_attr_t *ixa = coa->coa_ixa; 1922 icmp_t *icmp = connp->conn_icmp; 1923 icmp_stack_t *is = icmp->icmp_is; 1924 int *i1 = (int *)invalp; 1925 boolean_t onoff = (*i1 == 0) ? 0 : 1; 1926 int error; 1927 1928 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock)); 1929 1930 /* 1931 * For fixed length options, no sanity check 1932 * of passed in length is done. It is assumed *_optcom_req() 1933 * routines do the right thing. 1934 */ 1935 1936 switch (level) { 1937 case SOL_SOCKET: 1938 switch (name) { 1939 case SO_PROTOTYPE: 1940 if ((*i1 & 0xFF) != IPPROTO_ICMP && 1941 (*i1 & 0xFF) != IPPROTO_ICMPV6 && 1942 secpolicy_net_rawaccess(cr) != 0) { 1943 return (EACCES); 1944 } 1945 if (checkonly) 1946 break; 1947 1948 mutex_enter(&connp->conn_lock); 1949 connp->conn_proto = *i1 & 0xFF; 1950 ixa->ixa_protocol = connp->conn_proto; 1951 if ((connp->conn_proto == IPPROTO_RAW || 1952 connp->conn_proto == IPPROTO_IGMP) && 1953 connp->conn_family == AF_INET) { 1954 icmp->icmp_hdrincl = 1; 1955 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 1956 } else if (connp->conn_proto == IPPROTO_UDP || 1957 connp->conn_proto == IPPROTO_TCP || 1958 connp->conn_proto == IPPROTO_SCTP) { 1959 /* Used by test applications like psh */ 1960 icmp->icmp_hdrincl = 0; 1961 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 1962 } else { 1963 icmp->icmp_hdrincl = 0; 1964 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 1965 } 1966 1967 if (connp->conn_family == AF_INET6 && 1968 connp->conn_proto == IPPROTO_ICMPV6) { 1969 /* Set offset for icmp6_cksum */ 1970 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 1971 ixa->ixa_raw_cksum_offset = 2; 1972 } 1973 if (icmp->icmp_filter != NULL && 1974 connp->conn_proto != IPPROTO_ICMPV6) { 1975 kmem_free(icmp->icmp_filter, 1976 sizeof (icmp6_filter_t)); 1977 icmp->icmp_filter = NULL; 1978 } 1979 mutex_exit(&connp->conn_lock); 1980 1981 coa->coa_changed |= COA_HEADER_CHANGED; 1982 /* 1983 * For SCTP, we don't use icmp_bind_proto() for 1984 * raw socket binding. 1985 */ 1986 if (connp->conn_proto == IPPROTO_SCTP) 1987 return (0); 1988 1989 coa->coa_changed |= COA_ICMP_BIND_NEEDED; 1990 return (0); 1991 1992 case SO_SNDBUF: 1993 if (*i1 > is->is_max_buf) { 1994 return (ENOBUFS); 1995 } 1996 break; 1997 case SO_RCVBUF: 1998 if (*i1 > is->is_max_buf) { 1999 return (ENOBUFS); 2000 } 2001 break; 2002 } 2003 break; 2004 2005 case IPPROTO_IP: 2006 /* 2007 * Only allow IPv4 option processing on IPv4 sockets. 2008 */ 2009 if (connp->conn_family != AF_INET) 2010 return (EINVAL); 2011 2012 switch (name) { 2013 case IP_HDRINCL: 2014 if (!checkonly) { 2015 mutex_enter(&connp->conn_lock); 2016 icmp->icmp_hdrincl = onoff; 2017 if (onoff) 2018 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2019 else 2020 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2021 mutex_exit(&connp->conn_lock); 2022 } 2023 break; 2024 } 2025 break; 2026 2027 case IPPROTO_IPV6: 2028 if (connp->conn_family != AF_INET6) 2029 return (EINVAL); 2030 2031 switch (name) { 2032 case IPV6_CHECKSUM: 2033 /* 2034 * Integer offset into the user data of where the 2035 * checksum is located. 2036 * Offset of -1 disables option. 2037 * Does not apply to IPPROTO_ICMPV6. 2038 */ 2039 if (connp->conn_proto == IPPROTO_ICMPV6 || 2040 coa->coa_ancillary) { 2041 return (EINVAL); 2042 } 2043 if ((*i1 != -1) && ((*i1 < 0) || (*i1 & 0x1) != 0)) { 2044 /* Negative or not 16 bit aligned offset */ 2045 return (EINVAL); 2046 } 2047 if (checkonly) 2048 break; 2049 2050 mutex_enter(&connp->conn_lock); 2051 if (*i1 == -1) { 2052 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 2053 ixa->ixa_raw_cksum_offset = 0; 2054 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2055 } else { 2056 ixa->ixa_flags |= IXAF_SET_RAW_CKSUM; 2057 ixa->ixa_raw_cksum_offset = *i1; 2058 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2059 } 2060 mutex_exit(&connp->conn_lock); 2061 break; 2062 } 2063 break; 2064 2065 case IPPROTO_ICMPV6: 2066 /* 2067 * Only allow IPv6 option processing on IPv6 sockets. 2068 */ 2069 if (connp->conn_family != AF_INET6) 2070 return (EINVAL); 2071 if (connp->conn_proto != IPPROTO_ICMPV6) 2072 return (EINVAL); 2073 2074 switch (name) { 2075 case ICMP6_FILTER: 2076 if (checkonly) 2077 break; 2078 2079 if ((inlen != 0) && 2080 (inlen != sizeof (icmp6_filter_t))) 2081 return (EINVAL); 2082 2083 mutex_enter(&connp->conn_lock); 2084 if (inlen == 0) { 2085 if (icmp->icmp_filter != NULL) { 2086 kmem_free(icmp->icmp_filter, 2087 sizeof (icmp6_filter_t)); 2088 icmp->icmp_filter = NULL; 2089 } 2090 } else { 2091 if (icmp->icmp_filter == NULL) { 2092 icmp->icmp_filter = kmem_alloc( 2093 sizeof (icmp6_filter_t), 2094 KM_NOSLEEP); 2095 if (icmp->icmp_filter == NULL) { 2096 mutex_exit(&connp->conn_lock); 2097 return (ENOBUFS); 2098 } 2099 } 2100 (void) bcopy(invalp, icmp->icmp_filter, inlen); 2101 } 2102 mutex_exit(&connp->conn_lock); 2103 break; 2104 } 2105 break; 2106 } 2107 error = conn_opt_set(coa, level, name, inlen, invalp, 2108 checkonly, cr); 2109 return (error); 2110 } 2111 2112 /* 2113 * This routine sets socket options. 2114 */ 2115 int 2116 icmp_opt_set(conn_t *connp, uint_t optset_context, int level, int name, 2117 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2118 void *thisdg_attrs, cred_t *cr) 2119 { 2120 icmp_t *icmp = connp->conn_icmp; 2121 int err; 2122 conn_opt_arg_t coas, *coa; 2123 boolean_t checkonly; 2124 icmp_stack_t *is = icmp->icmp_is; 2125 2126 switch (optset_context) { 2127 case SETFN_OPTCOM_CHECKONLY: 2128 checkonly = B_TRUE; 2129 /* 2130 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 2131 * inlen != 0 implies value supplied and 2132 * we have to "pretend" to set it. 2133 * inlen == 0 implies that there is no 2134 * value part in T_CHECK request and just validation 2135 * done elsewhere should be enough, we just return here. 2136 */ 2137 if (inlen == 0) { 2138 *outlenp = 0; 2139 return (0); 2140 } 2141 break; 2142 case SETFN_OPTCOM_NEGOTIATE: 2143 checkonly = B_FALSE; 2144 break; 2145 case SETFN_UD_NEGOTIATE: 2146 case SETFN_CONN_NEGOTIATE: 2147 checkonly = B_FALSE; 2148 /* 2149 * Negotiating local and "association-related" options 2150 * through T_UNITDATA_REQ. 2151 * 2152 * Following routine can filter out ones we do not 2153 * want to be "set" this way. 2154 */ 2155 if (!icmp_opt_allow_udr_set(level, name)) { 2156 *outlenp = 0; 2157 return (EINVAL); 2158 } 2159 break; 2160 default: 2161 /* 2162 * We should never get here 2163 */ 2164 *outlenp = 0; 2165 return (EINVAL); 2166 } 2167 2168 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 2169 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 2170 2171 if (thisdg_attrs != NULL) { 2172 /* Options from T_UNITDATA_REQ */ 2173 coa = (conn_opt_arg_t *)thisdg_attrs; 2174 ASSERT(coa->coa_connp == connp); 2175 ASSERT(coa->coa_ixa != NULL); 2176 ASSERT(coa->coa_ipp != NULL); 2177 ASSERT(coa->coa_ancillary); 2178 } else { 2179 coa = &coas; 2180 coas.coa_connp = connp; 2181 /* Get a reference on conn_ixa to prevent concurrent mods */ 2182 coas.coa_ixa = conn_get_ixa(connp, B_TRUE); 2183 if (coas.coa_ixa == NULL) { 2184 *outlenp = 0; 2185 return (ENOMEM); 2186 } 2187 coas.coa_ipp = &connp->conn_xmit_ipp; 2188 coas.coa_ancillary = B_FALSE; 2189 coas.coa_changed = 0; 2190 } 2191 2192 err = icmp_do_opt_set(coa, level, name, inlen, invalp, 2193 cr, checkonly); 2194 if (err != 0) { 2195 errout: 2196 if (!coa->coa_ancillary) 2197 ixa_refrele(coa->coa_ixa); 2198 *outlenp = 0; 2199 return (err); 2200 } 2201 2202 /* 2203 * Common case of OK return with outval same as inval. 2204 */ 2205 if (invalp != outvalp) { 2206 /* don't trust bcopy for identical src/dst */ 2207 (void) bcopy(invalp, outvalp, inlen); 2208 } 2209 *outlenp = inlen; 2210 2211 /* 2212 * If this was not ancillary data, then we rebuild the headers, 2213 * update the IRE/NCE, and IPsec as needed. 2214 * Since the label depends on the destination we go through 2215 * ip_set_destination first. 2216 */ 2217 if (coa->coa_ancillary) { 2218 return (0); 2219 } 2220 2221 if (coa->coa_changed & COA_ROUTE_CHANGED) { 2222 in6_addr_t saddr, faddr, nexthop; 2223 in_port_t fport; 2224 2225 /* 2226 * We clear lastdst to make sure we pick up the change 2227 * next time sending. 2228 * If we are connected we re-cache the information. 2229 * We ignore errors to preserve BSD behavior. 2230 * Note that we don't redo IPsec policy lookup here 2231 * since the final destination (or source) didn't change. 2232 */ 2233 mutex_enter(&connp->conn_lock); 2234 connp->conn_v6lastdst = ipv6_all_zeros; 2235 2236 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa, 2237 &connp->conn_faddr_v6, &nexthop); 2238 saddr = connp->conn_saddr_v6; 2239 faddr = connp->conn_faddr_v6; 2240 fport = connp->conn_fport; 2241 mutex_exit(&connp->conn_lock); 2242 2243 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) && 2244 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) { 2245 (void) ip_attr_connect(connp, coa->coa_ixa, 2246 &saddr, &faddr, &nexthop, fport, NULL, NULL, 2247 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 2248 } 2249 } 2250 2251 ixa_refrele(coa->coa_ixa); 2252 2253 if (coa->coa_changed & COA_HEADER_CHANGED) { 2254 /* 2255 * Rebuild the header template if we are connected. 2256 * Otherwise clear conn_v6lastdst so we rebuild the header 2257 * in the data path. 2258 */ 2259 mutex_enter(&connp->conn_lock); 2260 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) && 2261 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) { 2262 err = icmp_build_hdr_template(connp, 2263 &connp->conn_saddr_v6, &connp->conn_faddr_v6, 2264 connp->conn_flowinfo); 2265 if (err != 0) { 2266 mutex_exit(&connp->conn_lock); 2267 return (err); 2268 } 2269 } else { 2270 connp->conn_v6lastdst = ipv6_all_zeros; 2271 } 2272 mutex_exit(&connp->conn_lock); 2273 } 2274 if (coa->coa_changed & COA_RCVBUF_CHANGED) { 2275 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 2276 connp->conn_rcvbuf); 2277 } 2278 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) { 2279 connp->conn_wq->q_hiwat = connp->conn_sndbuf; 2280 } 2281 if (coa->coa_changed & COA_WROFF_CHANGED) { 2282 /* Increase wroff if needed */ 2283 uint_t wroff; 2284 2285 mutex_enter(&connp->conn_lock); 2286 wroff = connp->conn_ht_iphc_allocated + is->is_wroff_extra; 2287 if (wroff > connp->conn_wroff) { 2288 connp->conn_wroff = wroff; 2289 mutex_exit(&connp->conn_lock); 2290 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff); 2291 } else { 2292 mutex_exit(&connp->conn_lock); 2293 } 2294 } 2295 if (coa->coa_changed & COA_ICMP_BIND_NEEDED) { 2296 icmp_bind_proto(icmp); 2297 } 2298 return (err); 2299 } 2300 2301 /* This routine sets socket options. */ 2302 int 2303 icmp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name, 2304 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2305 void *thisdg_attrs, cred_t *cr) 2306 { 2307 conn_t *connp = Q_TO_CONN(q); 2308 int error; 2309 2310 error = icmp_opt_set(connp, optset_context, level, name, inlen, invalp, 2311 outlenp, outvalp, thisdg_attrs, cr); 2312 return (error); 2313 } 2314 2315 /* 2316 * Setup IP headers. 2317 * 2318 * Note that IP_HDRINCL has ipha_protocol that is different than conn_proto, 2319 * but icmp_output_hdrincl restores ipha_protocol once we return. 2320 */ 2321 mblk_t * 2322 icmp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp, 2323 const in6_addr_t *v6src, const in6_addr_t *v6dst, uint32_t flowinfo, 2324 mblk_t *data_mp, int *errorp) 2325 { 2326 mblk_t *mp; 2327 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2328 uint_t data_len; 2329 uint32_t cksum; 2330 2331 data_len = msgdsize(data_mp); 2332 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, connp->conn_proto, 2333 flowinfo, 0, data_mp, data_len, is->is_wroff_extra, &cksum, errorp); 2334 if (mp == NULL) { 2335 ASSERT(*errorp != 0); 2336 return (NULL); 2337 } 2338 2339 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length; 2340 2341 /* 2342 * If there was a routing option/header then conn_prepend_hdr 2343 * has massaged it and placed the pseudo-header checksum difference 2344 * in the cksum argument. 2345 * 2346 * Prepare for ICMPv6 checksum done in IP. 2347 * 2348 * We make it easy for IP to include our pseudo header 2349 * by putting our length (and any routing header adjustment) 2350 * in the ICMPv6 checksum field. 2351 * The IP source, destination, and length have already been set by 2352 * conn_prepend_hdr. 2353 */ 2354 cksum += data_len; 2355 cksum = (cksum >> 16) + (cksum & 0xFFFF); 2356 ASSERT(cksum < 0x10000); 2357 2358 if (ixa->ixa_flags & IXAF_IS_IPV4) { 2359 ipha_t *ipha = (ipha_t *)mp->b_rptr; 2360 2361 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen); 2362 } else { 2363 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 2364 uint_t cksum_offset = 0; 2365 2366 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen); 2367 2368 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 2369 if (connp->conn_proto == IPPROTO_ICMPV6) { 2370 cksum_offset = ixa->ixa_ip_hdr_length + 2371 offsetof(icmp6_t, icmp6_cksum); 2372 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2373 cksum_offset = ixa->ixa_ip_hdr_length + 2374 ixa->ixa_raw_cksum_offset; 2375 } 2376 } 2377 if (cksum_offset != 0) { 2378 uint16_t *ptr; 2379 2380 /* Make sure the checksum fits in the first mblk */ 2381 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 2382 mblk_t *mp1; 2383 2384 mp1 = msgpullup(mp, 2385 cksum_offset + sizeof (short)); 2386 freemsg(mp); 2387 if (mp1 == NULL) { 2388 *errorp = ENOMEM; 2389 return (NULL); 2390 } 2391 mp = mp1; 2392 ip6h = (ip6_t *)mp->b_rptr; 2393 } 2394 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 2395 *ptr = htons(cksum); 2396 } 2397 } 2398 2399 /* Note that we don't try to update wroff due to ancillary data */ 2400 return (mp); 2401 } 2402 2403 static int 2404 icmp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src, 2405 const in6_addr_t *v6dst, uint32_t flowinfo) 2406 { 2407 int error; 2408 2409 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2410 /* 2411 * We clear lastdst to make sure we don't use the lastdst path 2412 * next time sending since we might not have set v6dst yet. 2413 */ 2414 connp->conn_v6lastdst = ipv6_all_zeros; 2415 2416 error = conn_build_hdr_template(connp, 0, 0, v6src, v6dst, flowinfo); 2417 if (error != 0) 2418 return (error); 2419 2420 /* 2421 * Any routing header/option has been massaged. The checksum difference 2422 * is stored in conn_sum. 2423 */ 2424 return (0); 2425 } 2426 2427 /* 2428 * This routine retrieves the value of an ND variable in a icmpparam_t 2429 * structure. It is called through nd_getset when a user reads the 2430 * variable. 2431 */ 2432 /* ARGSUSED */ 2433 static int 2434 icmp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 2435 { 2436 icmpparam_t *icmppa = (icmpparam_t *)cp; 2437 2438 (void) mi_mpprintf(mp, "%d", icmppa->icmp_param_value); 2439 return (0); 2440 } 2441 2442 /* 2443 * Walk through the param array specified registering each element with the 2444 * named dispatch (ND) handler. 2445 */ 2446 static boolean_t 2447 icmp_param_register(IDP *ndp, icmpparam_t *icmppa, int cnt) 2448 { 2449 for (; cnt-- > 0; icmppa++) { 2450 if (icmppa->icmp_param_name && icmppa->icmp_param_name[0]) { 2451 if (!nd_load(ndp, icmppa->icmp_param_name, 2452 icmp_param_get, icmp_param_set, 2453 (caddr_t)icmppa)) { 2454 nd_free(ndp); 2455 return (B_FALSE); 2456 } 2457 } 2458 } 2459 return (B_TRUE); 2460 } 2461 2462 /* This routine sets an ND variable in a icmpparam_t structure. */ 2463 /* ARGSUSED */ 2464 static int 2465 icmp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 2466 { 2467 long new_value; 2468 icmpparam_t *icmppa = (icmpparam_t *)cp; 2469 2470 /* 2471 * Fail the request if the new value does not lie within the 2472 * required bounds. 2473 */ 2474 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 2475 new_value < icmppa->icmp_param_min || 2476 new_value > icmppa->icmp_param_max) { 2477 return (EINVAL); 2478 } 2479 /* Set the new value */ 2480 icmppa->icmp_param_value = new_value; 2481 return (0); 2482 } 2483 2484 static mblk_t * 2485 icmp_queue_fallback(icmp_t *icmp, mblk_t *mp) 2486 { 2487 ASSERT(MUTEX_HELD(&icmp->icmp_recv_lock)); 2488 if (IPCL_IS_NONSTR(icmp->icmp_connp)) { 2489 /* 2490 * fallback has started but messages have not been moved yet 2491 */ 2492 if (icmp->icmp_fallback_queue_head == NULL) { 2493 ASSERT(icmp->icmp_fallback_queue_tail == NULL); 2494 icmp->icmp_fallback_queue_head = mp; 2495 icmp->icmp_fallback_queue_tail = mp; 2496 } else { 2497 ASSERT(icmp->icmp_fallback_queue_tail != NULL); 2498 icmp->icmp_fallback_queue_tail->b_next = mp; 2499 icmp->icmp_fallback_queue_tail = mp; 2500 } 2501 return (NULL); 2502 } else { 2503 /* 2504 * Fallback completed, let the caller putnext() the mblk. 2505 */ 2506 return (mp); 2507 } 2508 } 2509 2510 /* 2511 * Deliver data to ULP. In case we have a socket, and it's falling back to 2512 * TPI, then we'll queue the mp for later processing. 2513 */ 2514 static void 2515 icmp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len) 2516 { 2517 if (IPCL_IS_NONSTR(connp)) { 2518 icmp_t *icmp = connp->conn_icmp; 2519 int error; 2520 2521 ASSERT(len == msgdsize(mp)); 2522 if ((*connp->conn_upcalls->su_recv) 2523 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) { 2524 mutex_enter(&icmp->icmp_recv_lock); 2525 if (error == ENOSPC) { 2526 /* 2527 * let's confirm while holding the lock 2528 */ 2529 if ((*connp->conn_upcalls->su_recv) 2530 (connp->conn_upper_handle, NULL, 0, 0, 2531 &error, NULL) < 0) { 2532 ASSERT(error == ENOSPC); 2533 if (error == ENOSPC) { 2534 connp->conn_flow_cntrld = 2535 B_TRUE; 2536 } 2537 } 2538 mutex_exit(&icmp->icmp_recv_lock); 2539 } else { 2540 ASSERT(error == EOPNOTSUPP); 2541 mp = icmp_queue_fallback(icmp, mp); 2542 mutex_exit(&icmp->icmp_recv_lock); 2543 if (mp != NULL) 2544 putnext(connp->conn_rq, mp); 2545 } 2546 } 2547 ASSERT(MUTEX_NOT_HELD(&icmp->icmp_recv_lock)); 2548 } else { 2549 putnext(connp->conn_rq, mp); 2550 } 2551 } 2552 2553 /* 2554 * This is the inbound data path. 2555 * IP has already pulled up the IP headers and verified alignment 2556 * etc. 2557 */ 2558 /* ARGSUSED2 */ 2559 static void 2560 icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2561 { 2562 conn_t *connp = (conn_t *)arg1; 2563 struct T_unitdata_ind *tudi; 2564 uchar_t *rptr; /* Pointer to IP header */ 2565 int ip_hdr_length; 2566 int udi_size; /* Size of T_unitdata_ind */ 2567 int pkt_len; 2568 icmp_t *icmp; 2569 ip_pkt_t ipps; 2570 ip6_t *ip6h; 2571 mblk_t *mp1; 2572 crb_t recv_ancillary; 2573 icmp_stack_t *is; 2574 sin_t *sin; 2575 sin6_t *sin6; 2576 ipha_t *ipha; 2577 2578 ASSERT(connp->conn_flags & IPCL_RAWIPCONN); 2579 2580 icmp = connp->conn_icmp; 2581 is = icmp->icmp_is; 2582 rptr = mp->b_rptr; 2583 2584 ASSERT(DB_TYPE(mp) == M_DATA); 2585 ASSERT(OK_32PTR(rptr)); 2586 ASSERT(ira->ira_pktlen == msgdsize(mp)); 2587 pkt_len = ira->ira_pktlen; 2588 2589 /* 2590 * Get a snapshot of these and allow other threads to change 2591 * them after that. We need the same recv_ancillary when determining 2592 * the size as when adding the ancillary data items. 2593 */ 2594 mutex_enter(&connp->conn_lock); 2595 recv_ancillary = connp->conn_recv_ancillary; 2596 mutex_exit(&connp->conn_lock); 2597 2598 ip_hdr_length = ira->ira_ip_hdr_length; 2599 ASSERT(MBLKL(mp) >= ip_hdr_length); /* IP did a pullup */ 2600 2601 /* Initialize regardless of IP version */ 2602 ipps.ipp_fields = 0; 2603 2604 if (ira->ira_flags & IRAF_IS_IPV4) { 2605 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION); 2606 ASSERT(MBLKL(mp) >= sizeof (ipha_t)); 2607 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr)); 2608 2609 ipha = (ipha_t *)mp->b_rptr; 2610 if (recv_ancillary.crb_all != 0) 2611 (void) ip_find_hdr_v4(ipha, &ipps, B_FALSE); 2612 2613 /* 2614 * BSD for some reason adjusts ipha_length to exclude the 2615 * IP header length. We do the same. 2616 */ 2617 if (is->is_bsd_compat) { 2618 ushort_t len; 2619 2620 len = ntohs(ipha->ipha_length); 2621 if (mp->b_datap->db_ref > 1) { 2622 /* 2623 * Allocate a new IP header so that we can 2624 * modify ipha_length. 2625 */ 2626 mblk_t *mp1; 2627 2628 mp1 = allocb(ip_hdr_length, BPRI_MED); 2629 if (mp1 == NULL) { 2630 freemsg(mp); 2631 BUMP_MIB(&is->is_rawip_mib, 2632 rawipInErrors); 2633 return; 2634 } 2635 bcopy(rptr, mp1->b_rptr, ip_hdr_length); 2636 mp->b_rptr = rptr + ip_hdr_length; 2637 rptr = mp1->b_rptr; 2638 ipha = (ipha_t *)rptr; 2639 mp1->b_cont = mp; 2640 mp1->b_wptr = rptr + ip_hdr_length; 2641 mp = mp1; 2642 } 2643 len -= ip_hdr_length; 2644 ipha->ipha_length = htons(len); 2645 } 2646 2647 /* 2648 * For RAW sockets we not pass ICMP/IPv4 packets to AF_INET6 2649 * sockets. This is ensured by icmp_bind and the IP fanout code. 2650 */ 2651 ASSERT(connp->conn_family == AF_INET); 2652 2653 /* 2654 * This is the inbound data path. Packets are passed upstream 2655 * as T_UNITDATA_IND messages with full IPv4 headers still 2656 * attached. 2657 */ 2658 2659 /* 2660 * Normally only send up the source address. 2661 * If any ancillary data items are wanted we add those. 2662 */ 2663 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t); 2664 if (recv_ancillary.crb_all != 0) { 2665 udi_size += conn_recvancillary_size(connp, 2666 recv_ancillary, ira, mp, &ipps); 2667 } 2668 2669 /* Allocate a message block for the T_UNITDATA_IND structure. */ 2670 mp1 = allocb(udi_size, BPRI_MED); 2671 if (mp1 == NULL) { 2672 freemsg(mp); 2673 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2674 return; 2675 } 2676 mp1->b_cont = mp; 2677 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2678 mp1->b_datap->db_type = M_PROTO; 2679 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2680 tudi->PRIM_type = T_UNITDATA_IND; 2681 tudi->SRC_length = sizeof (sin_t); 2682 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2683 sin = (sin_t *)&tudi[1]; 2684 *sin = sin_null; 2685 sin->sin_family = AF_INET; 2686 sin->sin_addr.s_addr = ipha->ipha_src; 2687 *(uint32_t *)&sin->sin_zero[0] = 0; 2688 *(uint32_t *)&sin->sin_zero[4] = 0; 2689 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + 2690 sizeof (sin_t); 2691 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t)); 2692 tudi->OPT_length = udi_size; 2693 2694 /* 2695 * Add options if IP_RECVIF etc is set 2696 */ 2697 if (udi_size != 0) { 2698 conn_recvancillary_add(connp, recv_ancillary, ira, 2699 &ipps, (uchar_t *)&sin[1], udi_size); 2700 } 2701 goto deliver; 2702 } 2703 2704 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION); 2705 /* 2706 * IPv6 packets can only be received by applications 2707 * that are prepared to receive IPv6 addresses. 2708 * The IP fanout must ensure this. 2709 */ 2710 ASSERT(connp->conn_family == AF_INET6); 2711 2712 /* 2713 * Handle IPv6 packets. We don't pass up the IP headers with the 2714 * payload for IPv6. 2715 */ 2716 2717 ip6h = (ip6_t *)rptr; 2718 if (recv_ancillary.crb_all != 0) { 2719 /* 2720 * Call on ip_find_hdr_v6 which gets individual lenghts of 2721 * extension headers (and pointers to them). 2722 */ 2723 uint8_t nexthdr; 2724 2725 /* We don't care about the length or nextheader. */ 2726 (void) ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps, &nexthdr); 2727 2728 /* 2729 * We do not pass up hop-by-hop options or any other 2730 * extension header as part of the packet. Applications 2731 * that want to see them have to specify IPV6_RECV* socket 2732 * options. And conn_recvancillary_size/add explicitly 2733 * drops the TX option from IPV6_HOPOPTS as it does for UDP. 2734 * 2735 * If we had multilevel ICMP sockets, then we'd want to 2736 * modify conn_recvancillary_size/add to 2737 * allow the user to see the label. 2738 */ 2739 } 2740 2741 /* 2742 * Check a filter for ICMPv6 types if needed. 2743 * Verify raw checksums if needed. 2744 */ 2745 mutex_enter(&connp->conn_lock); 2746 if (icmp->icmp_filter != NULL) { 2747 int type; 2748 2749 /* Assumes that IP has done the pullupmsg */ 2750 type = mp->b_rptr[ip_hdr_length]; 2751 2752 ASSERT(mp->b_rptr + ip_hdr_length <= mp->b_wptr); 2753 if (ICMP6_FILTER_WILLBLOCK(type, icmp->icmp_filter)) { 2754 mutex_exit(&connp->conn_lock); 2755 freemsg(mp); 2756 return; 2757 } 2758 } 2759 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2760 /* Checksum */ 2761 uint16_t *up; 2762 uint32_t sum; 2763 int remlen; 2764 2765 up = (uint16_t *)&ip6h->ip6_src; 2766 2767 remlen = msgdsize(mp) - ip_hdr_length; 2768 sum = htons(connp->conn_proto + remlen) 2769 + up[0] + up[1] + up[2] + up[3] 2770 + up[4] + up[5] + up[6] + up[7] 2771 + up[8] + up[9] + up[10] + up[11] 2772 + up[12] + up[13] + up[14] + up[15]; 2773 sum = (sum & 0xffff) + (sum >> 16); 2774 sum = IP_CSUM(mp, ip_hdr_length, sum); 2775 if (sum != 0) { 2776 /* IPv6 RAW checksum failed */ 2777 ip0dbg(("icmp_rput: RAW checksum failed %x\n", sum)); 2778 mutex_exit(&connp->conn_lock); 2779 freemsg(mp); 2780 BUMP_MIB(&is->is_rawip_mib, rawipInCksumErrs); 2781 return; 2782 } 2783 } 2784 mutex_exit(&connp->conn_lock); 2785 2786 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2787 2788 if (recv_ancillary.crb_all != 0) { 2789 udi_size += conn_recvancillary_size(connp, 2790 recv_ancillary, ira, mp, &ipps); 2791 } 2792 2793 mp1 = allocb(udi_size, BPRI_MED); 2794 if (mp1 == NULL) { 2795 freemsg(mp); 2796 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2797 return; 2798 } 2799 mp1->b_cont = mp; 2800 mp1->b_datap->db_type = M_PROTO; 2801 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2802 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2803 tudi->PRIM_type = T_UNITDATA_IND; 2804 tudi->SRC_length = sizeof (sin6_t); 2805 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2806 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2807 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t)); 2808 tudi->OPT_length = udi_size; 2809 sin6 = (sin6_t *)&tudi[1]; 2810 *sin6 = sin6_null; 2811 sin6->sin6_port = 0; 2812 sin6->sin6_family = AF_INET6; 2813 2814 sin6->sin6_addr = ip6h->ip6_src; 2815 /* No sin6_flowinfo per API */ 2816 sin6->sin6_flowinfo = 0; 2817 /* For link-scope pass up scope id */ 2818 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) 2819 sin6->sin6_scope_id = ira->ira_ruifindex; 2820 else 2821 sin6->sin6_scope_id = 0; 2822 sin6->__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 2823 IPCL_ZONEID(connp), is->is_netstack); 2824 2825 if (udi_size != 0) { 2826 conn_recvancillary_add(connp, recv_ancillary, ira, 2827 &ipps, (uchar_t *)&sin6[1], udi_size); 2828 } 2829 2830 /* Skip all the IPv6 headers per API */ 2831 mp->b_rptr += ip_hdr_length; 2832 pkt_len -= ip_hdr_length; 2833 2834 deliver: 2835 BUMP_MIB(&is->is_rawip_mib, rawipInDatagrams); 2836 icmp_ulp_recv(connp, mp1, pkt_len); 2837 } 2838 2839 /* 2840 * return SNMP stuff in buffer in mpdata. We don't hold any lock and report 2841 * information that can be changing beneath us. 2842 */ 2843 mblk_t * 2844 icmp_snmp_get(queue_t *q, mblk_t *mpctl) 2845 { 2846 mblk_t *mpdata; 2847 struct opthdr *optp; 2848 conn_t *connp = Q_TO_CONN(q); 2849 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2850 mblk_t *mp2ctl; 2851 2852 /* 2853 * make a copy of the original message 2854 */ 2855 mp2ctl = copymsg(mpctl); 2856 2857 if (mpctl == NULL || 2858 (mpdata = mpctl->b_cont) == NULL) { 2859 freemsg(mpctl); 2860 freemsg(mp2ctl); 2861 return (0); 2862 } 2863 2864 /* fixed length structure for IPv4 and IPv6 counters */ 2865 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 2866 optp->level = EXPER_RAWIP; 2867 optp->name = 0; 2868 (void) snmp_append_data(mpdata, (char *)&is->is_rawip_mib, 2869 sizeof (is->is_rawip_mib)); 2870 optp->len = msgdsize(mpdata); 2871 qreply(q, mpctl); 2872 2873 return (mp2ctl); 2874 } 2875 2876 /* 2877 * Return 0 if invalid set request, 1 otherwise, including non-rawip requests. 2878 * TODO: If this ever actually tries to set anything, it needs to be 2879 * to do the appropriate locking. 2880 */ 2881 /* ARGSUSED */ 2882 int 2883 icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 2884 uchar_t *ptr, int len) 2885 { 2886 switch (level) { 2887 case EXPER_RAWIP: 2888 return (0); 2889 default: 2890 return (1); 2891 } 2892 } 2893 2894 /* 2895 * This routine creates a T_UDERROR_IND message and passes it upstream. 2896 * The address and options are copied from the T_UNITDATA_REQ message 2897 * passed in mp. This message is freed. 2898 */ 2899 static void 2900 icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err) 2901 { 2902 struct T_unitdata_req *tudr; 2903 mblk_t *mp1; 2904 uchar_t *destaddr; 2905 t_scalar_t destlen; 2906 uchar_t *optaddr; 2907 t_scalar_t optlen; 2908 2909 if ((mp->b_wptr < mp->b_rptr) || 2910 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) { 2911 goto done; 2912 } 2913 tudr = (struct T_unitdata_req *)mp->b_rptr; 2914 destaddr = mp->b_rptr + tudr->DEST_offset; 2915 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr || 2916 destaddr + tudr->DEST_length < mp->b_rptr || 2917 destaddr + tudr->DEST_length > mp->b_wptr) { 2918 goto done; 2919 } 2920 optaddr = mp->b_rptr + tudr->OPT_offset; 2921 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr || 2922 optaddr + tudr->OPT_length < mp->b_rptr || 2923 optaddr + tudr->OPT_length > mp->b_wptr) { 2924 goto done; 2925 } 2926 destlen = tudr->DEST_length; 2927 optlen = tudr->OPT_length; 2928 2929 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen, 2930 (char *)optaddr, optlen, err); 2931 if (mp1 != NULL) 2932 qreply(q, mp1); 2933 2934 done: 2935 freemsg(mp); 2936 } 2937 2938 static int 2939 rawip_do_unbind(conn_t *connp) 2940 { 2941 icmp_t *icmp = connp->conn_icmp; 2942 2943 mutex_enter(&connp->conn_lock); 2944 /* If a bind has not been done, we can't unbind. */ 2945 if (icmp->icmp_state == TS_UNBND) { 2946 mutex_exit(&connp->conn_lock); 2947 return (-TOUTSTATE); 2948 } 2949 connp->conn_saddr_v6 = ipv6_all_zeros; 2950 connp->conn_bound_addr_v6 = ipv6_all_zeros; 2951 connp->conn_laddr_v6 = ipv6_all_zeros; 2952 connp->conn_mcbc_bind = B_FALSE; 2953 connp->conn_lport = 0; 2954 connp->conn_fport = 0; 2955 /* In case we were also connected */ 2956 connp->conn_faddr_v6 = ipv6_all_zeros; 2957 connp->conn_v6lastdst = ipv6_all_zeros; 2958 2959 icmp->icmp_state = TS_UNBND; 2960 2961 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 2962 &connp->conn_faddr_v6, connp->conn_flowinfo); 2963 mutex_exit(&connp->conn_lock); 2964 2965 ip_unbind(connp); 2966 return (0); 2967 } 2968 2969 /* 2970 * This routine is called by icmp_wput to handle T_UNBIND_REQ messages. 2971 * After some error checking, the message is passed downstream to ip. 2972 */ 2973 static void 2974 icmp_tpi_unbind(queue_t *q, mblk_t *mp) 2975 { 2976 conn_t *connp = Q_TO_CONN(q); 2977 int error; 2978 2979 ASSERT(mp->b_cont == NULL); 2980 error = rawip_do_unbind(connp); 2981 if (error) { 2982 if (error < 0) { 2983 icmp_err_ack(q, mp, -error, 0); 2984 } else { 2985 icmp_err_ack(q, mp, 0, error); 2986 } 2987 return; 2988 } 2989 2990 /* 2991 * Convert mp into a T_OK_ACK 2992 */ 2993 2994 mp = mi_tpi_ok_ack_alloc(mp); 2995 2996 /* 2997 * should not happen in practice... T_OK_ACK is smaller than the 2998 * original message. 2999 */ 3000 ASSERT(mp != NULL); 3001 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK); 3002 qreply(q, mp); 3003 } 3004 3005 /* 3006 * Process IPv4 packets that already include an IP header. 3007 * Used when IP_HDRINCL has been set (implicit for IPPROTO_RAW and 3008 * IPPROTO_IGMP). 3009 * In this case we ignore the address and any options in the T_UNITDATA_REQ. 3010 * 3011 * The packet is assumed to have a base (20 byte) IP header followed 3012 * by the upper-layer protocol. We include any IP_OPTIONS including a 3013 * CIPSO label but otherwise preserve the base IP header. 3014 */ 3015 static int 3016 icmp_output_hdrincl(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3017 { 3018 icmp_t *icmp = connp->conn_icmp; 3019 icmp_stack_t *is = icmp->icmp_is; 3020 ipha_t iphas; 3021 ipha_t *ipha; 3022 int ip_hdr_length; 3023 int tp_hdr_len; 3024 ip_xmit_attr_t *ixa; 3025 ip_pkt_t *ipp; 3026 in6_addr_t v6src; 3027 in6_addr_t v6dst; 3028 in6_addr_t v6nexthop; 3029 int error; 3030 boolean_t do_ipsec; 3031 3032 /* 3033 * We need an exclusive copy of conn_ixa since the included IP 3034 * header could have any destination. 3035 * That copy has no pointers hence we 3036 * need to set them up once we've parsed the ancillary data. 3037 */ 3038 ixa = conn_get_ixa_exclusive(connp); 3039 if (ixa == NULL) { 3040 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3041 freemsg(mp); 3042 return (ENOMEM); 3043 } 3044 ASSERT(cr != NULL); 3045 /* 3046 * Caller has a reference on cr; from db_credp or because we 3047 * are running in process context. 3048 */ 3049 ixa->ixa_cred = cr; 3050 ixa->ixa_cpid = pid; 3051 if (is_system_labeled()) { 3052 /* We need to restart with a label based on the cred */ 3053 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3054 } 3055 3056 /* In case previous destination was multicast or multirt */ 3057 ip_attr_newdst(ixa); 3058 3059 /* Get a copy of conn_xmit_ipp since the TX label might change it */ 3060 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3061 if (ipp == NULL) { 3062 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3063 ixa->ixa_cpid = connp->conn_cpid; 3064 ixa_refrele(ixa); 3065 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3066 freemsg(mp); 3067 return (ENOMEM); 3068 } 3069 mutex_enter(&connp->conn_lock); 3070 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3071 mutex_exit(&connp->conn_lock); 3072 if (error != 0) { 3073 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3074 freemsg(mp); 3075 goto done; 3076 } 3077 3078 /* Sanity check length of packet */ 3079 ipha = (ipha_t *)mp->b_rptr; 3080 3081 ip_hdr_length = IP_SIMPLE_HDR_LENGTH; 3082 if ((mp->b_wptr - mp->b_rptr) < IP_SIMPLE_HDR_LENGTH) { 3083 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 3084 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3085 freemsg(mp); 3086 goto done; 3087 } 3088 ipha = (ipha_t *)mp->b_rptr; 3089 } 3090 ipha->ipha_version_and_hdr_length = 3091 (IP_VERSION<<4) | (ip_hdr_length>>2); 3092 3093 /* 3094 * We set IXAF_DONTFRAG if the application set DF which makes 3095 * IP not fragment. 3096 */ 3097 ipha->ipha_fragment_offset_and_flags &= htons(IPH_DF); 3098 if (ipha->ipha_fragment_offset_and_flags & htons(IPH_DF)) 3099 ixa->ixa_flags |= (IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3100 else 3101 ixa->ixa_flags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3102 3103 /* Even for multicast and broadcast we honor the apps ttl */ 3104 ixa->ixa_flags |= IXAF_NO_TTL_CHANGE; 3105 3106 /* 3107 * No source verification for non-local addresses 3108 */ 3109 if (ipha->ipha_src != INADDR_ANY && 3110 ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid, 3111 is->is_netstack->netstack_ip, B_FALSE) 3112 != IPVL_UNICAST_UP) { 3113 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3114 } 3115 3116 if (ipha->ipha_dst == INADDR_ANY) 3117 ipha->ipha_dst = htonl(INADDR_LOOPBACK); 3118 3119 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src); 3120 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 3121 3122 /* Defer IPsec if it might need to look at ICMP type/code */ 3123 do_ipsec = ipha->ipha_protocol != IPPROTO_ICMP; 3124 ixa->ixa_flags |= IXAF_IS_IPV4; 3125 3126 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3127 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, 3128 connp->conn_fport, &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3129 (do_ipsec ? IPDF_IPSEC : 0)); 3130 switch (error) { 3131 case 0: 3132 break; 3133 case EADDRNOTAVAIL: 3134 /* 3135 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3136 * Don't have the application see that errno 3137 */ 3138 error = ENETUNREACH; 3139 goto failed; 3140 case ENETDOWN: 3141 /* 3142 * Have !ipif_addr_ready address; drop packet silently 3143 * until we can get applications to not send until we 3144 * are ready. 3145 */ 3146 error = 0; 3147 goto failed; 3148 case EHOSTUNREACH: 3149 case ENETUNREACH: 3150 if (ixa->ixa_ire != NULL) { 3151 /* 3152 * Let conn_ip_output/ire_send_noroute return 3153 * the error and send any local ICMP error. 3154 */ 3155 error = 0; 3156 break; 3157 } 3158 /* FALLTHRU */ 3159 default: 3160 failed: 3161 freemsg(mp); 3162 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3163 goto done; 3164 } 3165 if (ipha->ipha_src == INADDR_ANY) 3166 IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src); 3167 3168 /* 3169 * We might be going to a different destination than last time, 3170 * thus check that TX allows the communication and compute any 3171 * needed label. 3172 * 3173 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3174 * don't have to worry about concurrent threads. 3175 */ 3176 if (is_system_labeled()) { 3177 /* 3178 * Check whether Trusted Solaris policy allows communication 3179 * with this host, and pretend that the destination is 3180 * unreachable if not. 3181 * Compute any needed label and place it in ipp_label_v4/v6. 3182 * 3183 * Later conn_build_hdr_template/conn_prepend_hdr takes 3184 * ipp_label_v4/v6 to form the packet. 3185 * 3186 * Tsol note: We have ipp structure local to this thread so 3187 * no locking is needed. 3188 */ 3189 error = conn_update_label(connp, ixa, &v6dst, ipp); 3190 if (error != 0) { 3191 freemsg(mp); 3192 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3193 goto done; 3194 } 3195 } 3196 3197 /* 3198 * Save away a copy of the IPv4 header the application passed down 3199 * and then prepend an IPv4 header complete with any IP options 3200 * including label. 3201 * We need a struct copy since icmp_prepend_hdr will reuse the available 3202 * space in the mblk. 3203 */ 3204 iphas = *ipha; 3205 mp->b_rptr += IP_SIMPLE_HDR_LENGTH; 3206 3207 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, 0, mp, &error); 3208 if (mp == NULL) { 3209 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3210 ASSERT(error != 0); 3211 goto done; 3212 } 3213 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3214 error = EMSGSIZE; 3215 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3216 freemsg(mp); 3217 goto done; 3218 } 3219 /* Restore key parts of the header that the application passed down */ 3220 ipha = (ipha_t *)mp->b_rptr; 3221 ipha->ipha_type_of_service = iphas.ipha_type_of_service; 3222 ipha->ipha_ident = iphas.ipha_ident; 3223 ipha->ipha_fragment_offset_and_flags = 3224 iphas.ipha_fragment_offset_and_flags; 3225 ipha->ipha_ttl = iphas.ipha_ttl; 3226 ipha->ipha_protocol = iphas.ipha_protocol; 3227 ipha->ipha_src = iphas.ipha_src; 3228 ipha->ipha_dst = iphas.ipha_dst; 3229 3230 ixa->ixa_protocol = ipha->ipha_protocol; 3231 3232 /* 3233 * Make sure that the IP header plus any transport header that is 3234 * checksumed by ip_output is in the first mblk. (ip_output assumes 3235 * that at least the checksum field is in the first mblk.) 3236 */ 3237 switch (ipha->ipha_protocol) { 3238 case IPPROTO_UDP: 3239 tp_hdr_len = 8; 3240 break; 3241 case IPPROTO_TCP: 3242 tp_hdr_len = 20; 3243 break; 3244 default: 3245 tp_hdr_len = 0; 3246 break; 3247 } 3248 ip_hdr_length = IPH_HDR_LENGTH(ipha); 3249 if (mp->b_wptr - mp->b_rptr < ip_hdr_length + tp_hdr_len) { 3250 if (!pullupmsg(mp, ip_hdr_length + tp_hdr_len)) { 3251 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3252 if (mp->b_cont == NULL) 3253 error = EINVAL; 3254 else 3255 error = ENOMEM; 3256 freemsg(mp); 3257 goto done; 3258 } 3259 } 3260 3261 if (!do_ipsec) { 3262 /* Policy might differ for different ICMP type/code */ 3263 if (ixa->ixa_ipsec_policy != NULL) { 3264 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3265 ixa->ixa_ipsec_policy = NULL; 3266 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3267 } 3268 mp = ip_output_attach_policy(mp, ipha, NULL, connp, ixa); 3269 if (mp == NULL) { 3270 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3271 error = EHOSTUNREACH; /* IPsec policy failure */ 3272 goto done; 3273 } 3274 } 3275 3276 /* We're done. Pass the packet to ip. */ 3277 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3278 3279 error = conn_ip_output(mp, ixa); 3280 /* No rawipOutErrors if an error since IP increases its error counter */ 3281 switch (error) { 3282 case 0: 3283 break; 3284 case EWOULDBLOCK: 3285 (void) ixa_check_drain_insert(connp, ixa); 3286 error = 0; 3287 break; 3288 case EADDRNOTAVAIL: 3289 /* 3290 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3291 * Don't have the application see that errno 3292 */ 3293 error = ENETUNREACH; 3294 break; 3295 } 3296 done: 3297 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3298 ixa->ixa_cpid = connp->conn_cpid; 3299 ixa_refrele(ixa); 3300 ip_pkt_free(ipp); 3301 kmem_free(ipp, sizeof (*ipp)); 3302 return (error); 3303 } 3304 3305 static mblk_t * 3306 icmp_output_attach_policy(mblk_t *mp, conn_t *connp, ip_xmit_attr_t *ixa) 3307 { 3308 ipha_t *ipha = NULL; 3309 ip6_t *ip6h = NULL; 3310 3311 if (ixa->ixa_flags & IXAF_IS_IPV4) 3312 ipha = (ipha_t *)mp->b_rptr; 3313 else 3314 ip6h = (ip6_t *)mp->b_rptr; 3315 3316 if (ixa->ixa_ipsec_policy != NULL) { 3317 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3318 ixa->ixa_ipsec_policy = NULL; 3319 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3320 } 3321 return (ip_output_attach_policy(mp, ipha, ip6h, connp, ixa)); 3322 } 3323 3324 /* 3325 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6 3326 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from 3327 * the TPI options, otherwise we take them from msg_control. 3328 * If both sin and sin6 is set it is a connected socket and we use conn_faddr. 3329 * Always consumes mp; never consumes tudr_mp. 3330 */ 3331 static int 3332 icmp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp, 3333 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid) 3334 { 3335 icmp_t *icmp = connp->conn_icmp; 3336 icmp_stack_t *is = icmp->icmp_is; 3337 int error; 3338 ip_xmit_attr_t *ixa; 3339 ip_pkt_t *ipp; 3340 in6_addr_t v6src; 3341 in6_addr_t v6dst; 3342 in6_addr_t v6nexthop; 3343 in_port_t dstport; 3344 uint32_t flowinfo; 3345 uint_t srcid; 3346 int is_absreq_failure = 0; 3347 conn_opt_arg_t coas, *coa; 3348 3349 ASSERT(tudr_mp != NULL || msg != NULL); 3350 3351 /* 3352 * Get ixa before checking state to handle a disconnect race. 3353 * 3354 * We need an exclusive copy of conn_ixa since the ancillary data 3355 * options might modify it. That copy has no pointers hence we 3356 * need to set them up once we've parsed the ancillary data. 3357 */ 3358 ixa = conn_get_ixa_exclusive(connp); 3359 if (ixa == NULL) { 3360 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3361 freemsg(mp); 3362 return (ENOMEM); 3363 } 3364 ASSERT(cr != NULL); 3365 ixa->ixa_cred = cr; 3366 ixa->ixa_cpid = pid; 3367 if (is_system_labeled()) { 3368 /* We need to restart with a label based on the cred */ 3369 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3370 } 3371 3372 /* In case previous destination was multicast or multirt */ 3373 ip_attr_newdst(ixa); 3374 3375 /* Get a copy of conn_xmit_ipp since the options might change it */ 3376 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3377 if (ipp == NULL) { 3378 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3379 ixa->ixa_cpid = connp->conn_cpid; 3380 ixa_refrele(ixa); 3381 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3382 freemsg(mp); 3383 return (ENOMEM); 3384 } 3385 mutex_enter(&connp->conn_lock); 3386 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3387 mutex_exit(&connp->conn_lock); 3388 if (error != 0) { 3389 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3390 freemsg(mp); 3391 goto done; 3392 } 3393 3394 /* 3395 * Parse the options and update ixa and ipp as a result. 3396 */ 3397 3398 coa = &coas; 3399 coa->coa_connp = connp; 3400 coa->coa_ixa = ixa; 3401 coa->coa_ipp = ipp; 3402 coa->coa_ancillary = B_TRUE; 3403 coa->coa_changed = 0; 3404 3405 if (msg != NULL) { 3406 error = process_auxiliary_options(connp, msg->msg_control, 3407 msg->msg_controllen, coa, &icmp_opt_obj, icmp_opt_set, cr); 3408 } else { 3409 struct T_unitdata_req *tudr; 3410 3411 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr; 3412 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ); 3413 error = tpi_optcom_buf(connp->conn_wq, tudr_mp, 3414 &tudr->OPT_length, tudr->OPT_offset, cr, &icmp_opt_obj, 3415 coa, &is_absreq_failure); 3416 } 3417 if (error != 0) { 3418 /* 3419 * Note: No special action needed in this 3420 * module for "is_absreq_failure" 3421 */ 3422 freemsg(mp); 3423 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3424 goto done; 3425 } 3426 ASSERT(is_absreq_failure == 0); 3427 3428 mutex_enter(&connp->conn_lock); 3429 /* 3430 * If laddr is unspecified then we look at sin6_src_id. 3431 * We will give precedence to a source address set with IPV6_PKTINFO 3432 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 3433 * want ip_attr_connect to select a source (since it can fail) when 3434 * IPV6_PKTINFO is specified. 3435 * If this doesn't result in a source address then we get a source 3436 * from ip_attr_connect() below. 3437 */ 3438 v6src = connp->conn_saddr_v6; 3439 if (sin != NULL) { 3440 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 3441 dstport = sin->sin_port; 3442 flowinfo = 0; 3443 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3444 ixa->ixa_flags |= IXAF_IS_IPV4; 3445 } else if (sin6 != NULL) { 3446 v6dst = sin6->sin6_addr; 3447 dstport = sin6->sin6_port; 3448 flowinfo = sin6->sin6_flowinfo; 3449 srcid = sin6->__sin6_src_id; 3450 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 3451 ixa->ixa_scopeid = sin6->sin6_scope_id; 3452 ixa->ixa_flags |= IXAF_SCOPEID_SET; 3453 } else { 3454 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3455 } 3456 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 3457 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 3458 connp->conn_netstack); 3459 } 3460 if (IN6_IS_ADDR_V4MAPPED(&v6dst)) 3461 ixa->ixa_flags |= IXAF_IS_IPV4; 3462 else 3463 ixa->ixa_flags &= ~IXAF_IS_IPV4; 3464 } else { 3465 /* Connected case */ 3466 v6dst = connp->conn_faddr_v6; 3467 flowinfo = connp->conn_flowinfo; 3468 } 3469 mutex_exit(&connp->conn_lock); 3470 /* Handle IPV6_PKTINFO setting source address. */ 3471 if (IN6_IS_ADDR_UNSPECIFIED(&v6src) && 3472 (ipp->ipp_fields & IPPF_ADDR)) { 3473 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3474 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3475 v6src = ipp->ipp_addr; 3476 } else { 3477 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3478 v6src = ipp->ipp_addr; 3479 } 3480 } 3481 /* 3482 * Allow source not assigned to the system 3483 * only if it is not a local addresses 3484 */ 3485 if (!V6_OR_V4_INADDR_ANY(v6src)) { 3486 ip_laddr_t laddr_type; 3487 3488 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3489 ipaddr_t v4src; 3490 3491 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src); 3492 laddr_type = ip_laddr_verify_v4(v4src, ixa->ixa_zoneid, 3493 is->is_netstack->netstack_ip, B_FALSE); 3494 } else { 3495 laddr_type = ip_laddr_verify_v6(&v6src, ixa->ixa_zoneid, 3496 is->is_netstack->netstack_ip, B_FALSE, B_FALSE); 3497 } 3498 if (laddr_type != IPVL_UNICAST_UP) 3499 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3500 } 3501 3502 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3503 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 3504 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 3505 3506 switch (error) { 3507 case 0: 3508 break; 3509 case EADDRNOTAVAIL: 3510 /* 3511 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3512 * Don't have the application see that errno 3513 */ 3514 error = ENETUNREACH; 3515 goto failed; 3516 case ENETDOWN: 3517 /* 3518 * Have !ipif_addr_ready address; drop packet silently 3519 * until we can get applications to not send until we 3520 * are ready. 3521 */ 3522 error = 0; 3523 goto failed; 3524 case EHOSTUNREACH: 3525 case ENETUNREACH: 3526 if (ixa->ixa_ire != NULL) { 3527 /* 3528 * Let conn_ip_output/ire_send_noroute return 3529 * the error and send any local ICMP error. 3530 */ 3531 error = 0; 3532 break; 3533 } 3534 /* FALLTHRU */ 3535 default: 3536 failed: 3537 freemsg(mp); 3538 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3539 goto done; 3540 } 3541 3542 /* 3543 * We might be going to a different destination than last time, 3544 * thus check that TX allows the communication and compute any 3545 * needed label. 3546 * 3547 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3548 * don't have to worry about concurrent threads. 3549 */ 3550 if (is_system_labeled()) { 3551 /* 3552 * Check whether Trusted Solaris policy allows communication 3553 * with this host, and pretend that the destination is 3554 * unreachable if not. 3555 * Compute any needed label and place it in ipp_label_v4/v6. 3556 * 3557 * Later conn_build_hdr_template/conn_prepend_hdr takes 3558 * ipp_label_v4/v6 to form the packet. 3559 * 3560 * Tsol note: We have ipp structure local to this thread so 3561 * no locking is needed. 3562 */ 3563 error = conn_update_label(connp, ixa, &v6dst, ipp); 3564 if (error != 0) { 3565 freemsg(mp); 3566 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3567 goto done; 3568 } 3569 } 3570 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, flowinfo, mp, 3571 &error); 3572 if (mp == NULL) { 3573 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3574 ASSERT(error != 0); 3575 goto done; 3576 } 3577 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3578 error = EMSGSIZE; 3579 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3580 freemsg(mp); 3581 goto done; 3582 } 3583 3584 /* Policy might differ for different ICMP type/code */ 3585 mp = icmp_output_attach_policy(mp, connp, ixa); 3586 if (mp == NULL) { 3587 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3588 error = EHOSTUNREACH; /* IPsec policy failure */ 3589 goto done; 3590 } 3591 3592 /* We're done. Pass the packet to ip. */ 3593 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3594 3595 error = conn_ip_output(mp, ixa); 3596 if (!connp->conn_unspec_src) 3597 ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 3598 /* No rawipOutErrors if an error since IP increases its error counter */ 3599 switch (error) { 3600 case 0: 3601 break; 3602 case EWOULDBLOCK: 3603 (void) ixa_check_drain_insert(connp, ixa); 3604 error = 0; 3605 break; 3606 case EADDRNOTAVAIL: 3607 /* 3608 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3609 * Don't have the application see that errno 3610 */ 3611 error = ENETUNREACH; 3612 /* FALLTHRU */ 3613 default: 3614 mutex_enter(&connp->conn_lock); 3615 /* 3616 * Clear the source and v6lastdst so we call ip_attr_connect 3617 * for the next packet and try to pick a better source. 3618 */ 3619 if (connp->conn_mcbc_bind) 3620 connp->conn_saddr_v6 = ipv6_all_zeros; 3621 else 3622 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3623 connp->conn_v6lastdst = ipv6_all_zeros; 3624 mutex_exit(&connp->conn_lock); 3625 break; 3626 } 3627 done: 3628 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3629 ixa->ixa_cpid = connp->conn_cpid; 3630 ixa_refrele(ixa); 3631 ip_pkt_free(ipp); 3632 kmem_free(ipp, sizeof (*ipp)); 3633 return (error); 3634 } 3635 3636 /* 3637 * Handle sending an M_DATA for a connected socket. 3638 * Handles both IPv4 and IPv6. 3639 */ 3640 int 3641 icmp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3642 { 3643 icmp_t *icmp = connp->conn_icmp; 3644 icmp_stack_t *is = icmp->icmp_is; 3645 int error; 3646 ip_xmit_attr_t *ixa; 3647 boolean_t do_ipsec; 3648 3649 /* 3650 * If no other thread is using conn_ixa this just gets a reference to 3651 * conn_ixa. Otherwise we get a safe copy of conn_ixa. 3652 */ 3653 ixa = conn_get_ixa(connp, B_FALSE); 3654 if (ixa == NULL) { 3655 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3656 freemsg(mp); 3657 return (ENOMEM); 3658 } 3659 3660 ASSERT(cr != NULL); 3661 ixa->ixa_cred = cr; 3662 ixa->ixa_cpid = pid; 3663 3664 /* Defer IPsec if it might need to look at ICMP type/code */ 3665 switch (ixa->ixa_protocol) { 3666 case IPPROTO_ICMP: 3667 case IPPROTO_ICMPV6: 3668 do_ipsec = B_FALSE; 3669 break; 3670 default: 3671 do_ipsec = B_TRUE; 3672 } 3673 3674 mutex_enter(&connp->conn_lock); 3675 mp = icmp_prepend_header_template(connp, ixa, mp, 3676 &connp->conn_saddr_v6, connp->conn_flowinfo, &error); 3677 3678 if (mp == NULL) { 3679 ASSERT(error != 0); 3680 mutex_exit(&connp->conn_lock); 3681 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3682 ixa->ixa_cpid = connp->conn_cpid; 3683 ixa_refrele(ixa); 3684 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3685 freemsg(mp); 3686 return (error); 3687 } 3688 3689 if (!do_ipsec) { 3690 /* Policy might differ for different ICMP type/code */ 3691 mp = icmp_output_attach_policy(mp, connp, ixa); 3692 if (mp == NULL) { 3693 mutex_exit(&connp->conn_lock); 3694 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3695 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3696 ixa->ixa_cpid = connp->conn_cpid; 3697 ixa_refrele(ixa); 3698 return (EHOSTUNREACH); /* IPsec policy failure */ 3699 } 3700 } 3701 3702 /* 3703 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3704 * safe copy, then we need to fill in any pointers in it. 3705 */ 3706 if (ixa->ixa_ire == NULL) { 3707 in6_addr_t faddr, saddr; 3708 in6_addr_t nexthop; 3709 in_port_t fport; 3710 3711 saddr = connp->conn_saddr_v6; 3712 faddr = connp->conn_faddr_v6; 3713 fport = connp->conn_fport; 3714 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop); 3715 mutex_exit(&connp->conn_lock); 3716 3717 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop, 3718 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3719 (do_ipsec ? IPDF_IPSEC : 0)); 3720 switch (error) { 3721 case 0: 3722 break; 3723 case EADDRNOTAVAIL: 3724 /* 3725 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3726 * Don't have the application see that errno 3727 */ 3728 error = ENETUNREACH; 3729 goto failed; 3730 case ENETDOWN: 3731 /* 3732 * Have !ipif_addr_ready address; drop packet silently 3733 * until we can get applications to not send until we 3734 * are ready. 3735 */ 3736 error = 0; 3737 goto failed; 3738 case EHOSTUNREACH: 3739 case ENETUNREACH: 3740 if (ixa->ixa_ire != NULL) { 3741 /* 3742 * Let conn_ip_output/ire_send_noroute return 3743 * the error and send any local ICMP error. 3744 */ 3745 error = 0; 3746 break; 3747 } 3748 /* FALLTHRU */ 3749 default: 3750 failed: 3751 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3752 ixa->ixa_cpid = connp->conn_cpid; 3753 ixa_refrele(ixa); 3754 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3755 freemsg(mp); 3756 return (error); 3757 } 3758 } else { 3759 /* Done with conn_t */ 3760 mutex_exit(&connp->conn_lock); 3761 } 3762 3763 /* We're done. Pass the packet to ip. */ 3764 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3765 3766 error = conn_ip_output(mp, ixa); 3767 /* No rawipOutErrors if an error since IP increases its error counter */ 3768 switch (error) { 3769 case 0: 3770 break; 3771 case EWOULDBLOCK: 3772 (void) ixa_check_drain_insert(connp, ixa); 3773 error = 0; 3774 break; 3775 case EADDRNOTAVAIL: 3776 /* 3777 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3778 * Don't have the application see that errno 3779 */ 3780 error = ENETUNREACH; 3781 break; 3782 } 3783 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3784 ixa->ixa_cpid = connp->conn_cpid; 3785 ixa_refrele(ixa); 3786 return (error); 3787 } 3788 3789 /* 3790 * Handle sending an M_DATA to the last destination. 3791 * Handles both IPv4 and IPv6. 3792 * 3793 * NOTE: The caller must hold conn_lock and we drop it here. 3794 */ 3795 int 3796 icmp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid, 3797 ip_xmit_attr_t *ixa) 3798 { 3799 icmp_t *icmp = connp->conn_icmp; 3800 icmp_stack_t *is = icmp->icmp_is; 3801 int error; 3802 boolean_t do_ipsec; 3803 3804 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3805 ASSERT(ixa != NULL); 3806 3807 ASSERT(cr != NULL); 3808 ixa->ixa_cred = cr; 3809 ixa->ixa_cpid = pid; 3810 3811 /* Defer IPsec if it might need to look at ICMP type/code */ 3812 switch (ixa->ixa_protocol) { 3813 case IPPROTO_ICMP: 3814 case IPPROTO_ICMPV6: 3815 do_ipsec = B_FALSE; 3816 break; 3817 default: 3818 do_ipsec = B_TRUE; 3819 } 3820 3821 3822 mp = icmp_prepend_header_template(connp, ixa, mp, 3823 &connp->conn_v6lastsrc, connp->conn_lastflowinfo, &error); 3824 3825 if (mp == NULL) { 3826 ASSERT(error != 0); 3827 mutex_exit(&connp->conn_lock); 3828 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3829 ixa->ixa_cpid = connp->conn_cpid; 3830 ixa_refrele(ixa); 3831 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3832 freemsg(mp); 3833 return (error); 3834 } 3835 3836 if (!do_ipsec) { 3837 /* Policy might differ for different ICMP type/code */ 3838 mp = icmp_output_attach_policy(mp, connp, ixa); 3839 if (mp == NULL) { 3840 mutex_exit(&connp->conn_lock); 3841 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3842 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3843 ixa->ixa_cpid = connp->conn_cpid; 3844 ixa_refrele(ixa); 3845 return (EHOSTUNREACH); /* IPsec policy failure */ 3846 } 3847 } 3848 3849 /* 3850 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3851 * safe copy, then we need to fill in any pointers in it. 3852 */ 3853 if (ixa->ixa_ire == NULL) { 3854 in6_addr_t lastdst, lastsrc; 3855 in6_addr_t nexthop; 3856 in_port_t lastport; 3857 3858 lastsrc = connp->conn_v6lastsrc; 3859 lastdst = connp->conn_v6lastdst; 3860 lastport = connp->conn_lastdstport; 3861 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop); 3862 mutex_exit(&connp->conn_lock); 3863 3864 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst, 3865 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC | 3866 IPDF_VERIFY_DST | (do_ipsec ? IPDF_IPSEC : 0)); 3867 switch (error) { 3868 case 0: 3869 break; 3870 case EADDRNOTAVAIL: 3871 /* 3872 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3873 * Don't have the application see that errno 3874 */ 3875 error = ENETUNREACH; 3876 goto failed; 3877 case ENETDOWN: 3878 /* 3879 * Have !ipif_addr_ready address; drop packet silently 3880 * until we can get applications to not send until we 3881 * are ready. 3882 */ 3883 error = 0; 3884 goto failed; 3885 case EHOSTUNREACH: 3886 case ENETUNREACH: 3887 if (ixa->ixa_ire != NULL) { 3888 /* 3889 * Let conn_ip_output/ire_send_noroute return 3890 * the error and send any local ICMP error. 3891 */ 3892 error = 0; 3893 break; 3894 } 3895 /* FALLTHRU */ 3896 default: 3897 failed: 3898 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3899 ixa->ixa_cpid = connp->conn_cpid; 3900 ixa_refrele(ixa); 3901 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3902 freemsg(mp); 3903 return (error); 3904 } 3905 } else { 3906 /* Done with conn_t */ 3907 mutex_exit(&connp->conn_lock); 3908 } 3909 3910 /* We're done. Pass the packet to ip. */ 3911 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3912 error = conn_ip_output(mp, ixa); 3913 /* No rawipOutErrors if an error since IP increases its error counter */ 3914 switch (error) { 3915 case 0: 3916 break; 3917 case EWOULDBLOCK: 3918 (void) ixa_check_drain_insert(connp, ixa); 3919 error = 0; 3920 break; 3921 case EADDRNOTAVAIL: 3922 /* 3923 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3924 * Don't have the application see that errno 3925 */ 3926 error = ENETUNREACH; 3927 /* FALLTHRU */ 3928 default: 3929 mutex_enter(&connp->conn_lock); 3930 /* 3931 * Clear the source and v6lastdst so we call ip_attr_connect 3932 * for the next packet and try to pick a better source. 3933 */ 3934 if (connp->conn_mcbc_bind) 3935 connp->conn_saddr_v6 = ipv6_all_zeros; 3936 else 3937 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3938 connp->conn_v6lastdst = ipv6_all_zeros; 3939 mutex_exit(&connp->conn_lock); 3940 break; 3941 } 3942 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3943 ixa->ixa_cpid = connp->conn_cpid; 3944 ixa_refrele(ixa); 3945 return (error); 3946 } 3947 3948 3949 /* 3950 * Prepend the header template and then fill in the source and 3951 * flowinfo. The caller needs to handle the destination address since 3952 * it's setting is different if rthdr or source route. 3953 * 3954 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET. 3955 * When it returns NULL it sets errorp. 3956 */ 3957 static mblk_t * 3958 icmp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp, 3959 const in6_addr_t *v6src, uint32_t flowinfo, int *errorp) 3960 { 3961 icmp_t *icmp = connp->conn_icmp; 3962 icmp_stack_t *is = icmp->icmp_is; 3963 uint_t pktlen; 3964 uint_t copylen; 3965 uint8_t *iph; 3966 uint_t ip_hdr_length; 3967 uint32_t cksum; 3968 ip_pkt_t *ipp; 3969 3970 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3971 3972 /* 3973 * Copy the header template. 3974 */ 3975 copylen = connp->conn_ht_iphc_len; 3976 pktlen = copylen + msgdsize(mp); 3977 if (pktlen > IP_MAXPACKET) { 3978 freemsg(mp); 3979 *errorp = EMSGSIZE; 3980 return (NULL); 3981 } 3982 ixa->ixa_pktlen = pktlen; 3983 3984 /* check/fix buffer config, setup pointers into it */ 3985 iph = mp->b_rptr - copylen; 3986 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) { 3987 mblk_t *mp1; 3988 3989 mp1 = allocb(copylen + is->is_wroff_extra, BPRI_MED); 3990 if (mp1 == NULL) { 3991 freemsg(mp); 3992 *errorp = ENOMEM; 3993 return (NULL); 3994 } 3995 mp1->b_wptr = DB_LIM(mp1); 3996 mp1->b_cont = mp; 3997 mp = mp1; 3998 iph = (mp->b_wptr - copylen); 3999 } 4000 mp->b_rptr = iph; 4001 bcopy(connp->conn_ht_iphc, iph, copylen); 4002 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc); 4003 4004 ixa->ixa_ip_hdr_length = ip_hdr_length; 4005 4006 /* 4007 * Prepare for ICMPv6 checksum done in IP. 4008 * 4009 * icmp_build_hdr_template has already massaged any routing header 4010 * and placed the result in conn_sum. 4011 * 4012 * We make it easy for IP to include our pseudo header 4013 * by putting our length (and any routing header adjustment) 4014 * in the ICMPv6 checksum field. 4015 */ 4016 cksum = pktlen - ip_hdr_length; 4017 4018 cksum += connp->conn_sum; 4019 cksum = (cksum >> 16) + (cksum & 0xFFFF); 4020 ASSERT(cksum < 0x10000); 4021 4022 ipp = &connp->conn_xmit_ipp; 4023 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4024 ipha_t *ipha = (ipha_t *)iph; 4025 4026 ipha->ipha_length = htons((uint16_t)pktlen); 4027 4028 /* if IP_PKTINFO specified an addres it wins over bind() */ 4029 if ((ipp->ipp_fields & IPPF_ADDR) && 4030 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4031 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY); 4032 ipha->ipha_src = ipp->ipp_addr_v4; 4033 } else { 4034 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src); 4035 } 4036 } else { 4037 ip6_t *ip6h = (ip6_t *)iph; 4038 uint_t cksum_offset = 0; 4039 4040 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN)); 4041 4042 /* if IP_PKTINFO specified an addres it wins over bind() */ 4043 if ((ipp->ipp_fields & IPPF_ADDR) && 4044 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4045 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)); 4046 ip6h->ip6_src = ipp->ipp_addr; 4047 } else { 4048 ip6h->ip6_src = *v6src; 4049 } 4050 ip6h->ip6_vcf = 4051 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 4052 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 4053 if (ipp->ipp_fields & IPPF_TCLASS) { 4054 /* Overrides the class part of flowinfo */ 4055 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf, 4056 ipp->ipp_tclass); 4057 } 4058 4059 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 4060 if (connp->conn_proto == IPPROTO_ICMPV6) { 4061 cksum_offset = ixa->ixa_ip_hdr_length + 4062 offsetof(icmp6_t, icmp6_cksum); 4063 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 4064 cksum_offset = ixa->ixa_ip_hdr_length + 4065 ixa->ixa_raw_cksum_offset; 4066 } 4067 } 4068 if (cksum_offset != 0) { 4069 uint16_t *ptr; 4070 4071 /* Make sure the checksum fits in the first mblk */ 4072 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 4073 mblk_t *mp1; 4074 4075 mp1 = msgpullup(mp, 4076 cksum_offset + sizeof (short)); 4077 freemsg(mp); 4078 if (mp1 == NULL) { 4079 *errorp = ENOMEM; 4080 return (NULL); 4081 } 4082 mp = mp1; 4083 iph = mp->b_rptr; 4084 ip6h = (ip6_t *)iph; 4085 } 4086 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 4087 *ptr = htons(cksum); 4088 } 4089 } 4090 4091 return (mp); 4092 } 4093 4094 /* 4095 * This routine handles all messages passed downstream. It either 4096 * consumes the message or passes it downstream; it never queues a 4097 * a message. 4098 */ 4099 void 4100 icmp_wput(queue_t *q, mblk_t *mp) 4101 { 4102 sin6_t *sin6; 4103 sin_t *sin = NULL; 4104 uint_t srcid; 4105 conn_t *connp = Q_TO_CONN(q); 4106 icmp_t *icmp = connp->conn_icmp; 4107 int error = 0; 4108 struct sockaddr *addr = NULL; 4109 socklen_t addrlen; 4110 icmp_stack_t *is = icmp->icmp_is; 4111 struct T_unitdata_req *tudr; 4112 mblk_t *data_mp; 4113 cred_t *cr; 4114 pid_t pid; 4115 4116 /* 4117 * We directly handle several cases here: T_UNITDATA_REQ message 4118 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected 4119 * socket. 4120 */ 4121 switch (DB_TYPE(mp)) { 4122 case M_DATA: 4123 /* sockfs never sends down M_DATA */ 4124 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4125 freemsg(mp); 4126 return; 4127 4128 case M_PROTO: 4129 case M_PCPROTO: 4130 tudr = (struct T_unitdata_req *)mp->b_rptr; 4131 if (MBLKL(mp) < sizeof (*tudr) || 4132 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) { 4133 icmp_wput_other(q, mp); 4134 return; 4135 } 4136 break; 4137 4138 default: 4139 icmp_wput_other(q, mp); 4140 return; 4141 } 4142 4143 /* Handle valid T_UNITDATA_REQ here */ 4144 data_mp = mp->b_cont; 4145 if (data_mp == NULL) { 4146 error = EPROTO; 4147 goto ud_error2; 4148 } 4149 mp->b_cont = NULL; 4150 4151 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) { 4152 error = EADDRNOTAVAIL; 4153 goto ud_error2; 4154 } 4155 4156 /* 4157 * All Solaris components should pass a db_credp 4158 * for this message, hence we ASSERT. 4159 * On production kernels we return an error to be robust against 4160 * random streams modules sitting on top of us. 4161 */ 4162 cr = msg_getcred(mp, &pid); 4163 ASSERT(cr != NULL); 4164 if (cr == NULL) { 4165 error = EINVAL; 4166 goto ud_error2; 4167 } 4168 4169 /* 4170 * If a port has not been bound to the stream, fail. 4171 * This is not a problem when sockfs is directly 4172 * above us, because it will ensure that the socket 4173 * is first bound before allowing data to be sent. 4174 */ 4175 if (icmp->icmp_state == TS_UNBND) { 4176 error = EPROTO; 4177 goto ud_error2; 4178 } 4179 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset]; 4180 addrlen = tudr->DEST_length; 4181 4182 switch (connp->conn_family) { 4183 case AF_INET6: 4184 sin6 = (sin6_t *)addr; 4185 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) || 4186 (sin6->sin6_family != AF_INET6)) { 4187 error = EADDRNOTAVAIL; 4188 goto ud_error2; 4189 } 4190 4191 /* No support for mapped addresses on raw sockets */ 4192 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4193 error = EADDRNOTAVAIL; 4194 goto ud_error2; 4195 } 4196 srcid = sin6->__sin6_src_id; 4197 4198 /* 4199 * If the local address is a mapped address return 4200 * an error. 4201 * It would be possible to send an IPv6 packet but the 4202 * response would never make it back to the application 4203 * since it is bound to a mapped address. 4204 */ 4205 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 4206 error = EADDRNOTAVAIL; 4207 goto ud_error2; 4208 } 4209 4210 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 4211 sin6->sin6_addr = ipv6_loopback; 4212 4213 if (tudr->OPT_length != 0) { 4214 /* 4215 * If we are connected then the destination needs to be 4216 * the same as the connected one. 4217 */ 4218 if (icmp->icmp_state == TS_DATA_XFER && 4219 !conn_same_as_last_v6(connp, sin6)) { 4220 error = EISCONN; 4221 goto ud_error2; 4222 } 4223 error = icmp_output_ancillary(connp, NULL, sin6, 4224 data_mp, mp, NULL, cr, pid); 4225 } else { 4226 ip_xmit_attr_t *ixa; 4227 4228 /* 4229 * We have to allocate an ip_xmit_attr_t before we grab 4230 * conn_lock and we need to hold conn_lock once we've 4231 * checked conn_same_as_last_v6 to handle concurrent 4232 * send* calls on a socket. 4233 */ 4234 ixa = conn_get_ixa(connp, B_FALSE); 4235 if (ixa == NULL) { 4236 error = ENOMEM; 4237 goto ud_error2; 4238 } 4239 mutex_enter(&connp->conn_lock); 4240 4241 if (conn_same_as_last_v6(connp, sin6) && 4242 connp->conn_lastsrcid == srcid && 4243 ipsec_outbound_policy_current(ixa)) { 4244 /* icmp_output_lastdst drops conn_lock */ 4245 error = icmp_output_lastdst(connp, data_mp, cr, 4246 pid, ixa); 4247 } else { 4248 /* icmp_output_newdst drops conn_lock */ 4249 error = icmp_output_newdst(connp, data_mp, NULL, 4250 sin6, cr, pid, ixa); 4251 } 4252 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4253 } 4254 if (error == 0) { 4255 freeb(mp); 4256 return; 4257 } 4258 break; 4259 4260 case AF_INET: 4261 sin = (sin_t *)addr; 4262 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) || 4263 (sin->sin_family != AF_INET)) { 4264 error = EADDRNOTAVAIL; 4265 goto ud_error2; 4266 } 4267 if (sin->sin_addr.s_addr == INADDR_ANY) 4268 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 4269 4270 /* Protocol 255 contains full IP headers */ 4271 /* Read without holding lock */ 4272 if (icmp->icmp_hdrincl) { 4273 if (MBLKL(data_mp) < IP_SIMPLE_HDR_LENGTH) { 4274 if (!pullupmsg(data_mp, IP_SIMPLE_HDR_LENGTH)) { 4275 error = EINVAL; 4276 goto ud_error2; 4277 } 4278 } 4279 error = icmp_output_hdrincl(connp, data_mp, cr, pid); 4280 if (error == 0) { 4281 freeb(mp); 4282 return; 4283 } 4284 /* data_mp consumed above */ 4285 data_mp = NULL; 4286 goto ud_error2; 4287 } 4288 4289 if (tudr->OPT_length != 0) { 4290 /* 4291 * If we are connected then the destination needs to be 4292 * the same as the connected one. 4293 */ 4294 if (icmp->icmp_state == TS_DATA_XFER && 4295 !conn_same_as_last_v4(connp, sin)) { 4296 error = EISCONN; 4297 goto ud_error2; 4298 } 4299 error = icmp_output_ancillary(connp, sin, NULL, 4300 data_mp, mp, NULL, cr, pid); 4301 } else { 4302 ip_xmit_attr_t *ixa; 4303 4304 /* 4305 * We have to allocate an ip_xmit_attr_t before we grab 4306 * conn_lock and we need to hold conn_lock once we've 4307 * checked conn_same_as_last_v4 to handle concurrent 4308 * send* calls on a socket. 4309 */ 4310 ixa = conn_get_ixa(connp, B_FALSE); 4311 if (ixa == NULL) { 4312 error = ENOMEM; 4313 goto ud_error2; 4314 } 4315 mutex_enter(&connp->conn_lock); 4316 4317 if (conn_same_as_last_v4(connp, sin) && 4318 ipsec_outbound_policy_current(ixa)) { 4319 /* icmp_output_lastdst drops conn_lock */ 4320 error = icmp_output_lastdst(connp, data_mp, cr, 4321 pid, ixa); 4322 } else { 4323 /* icmp_output_newdst drops conn_lock */ 4324 error = icmp_output_newdst(connp, data_mp, sin, 4325 NULL, cr, pid, ixa); 4326 } 4327 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4328 } 4329 if (error == 0) { 4330 freeb(mp); 4331 return; 4332 } 4333 break; 4334 } 4335 ASSERT(mp != NULL); 4336 /* mp is freed by the following routine */ 4337 icmp_ud_err(q, mp, (t_scalar_t)error); 4338 return; 4339 4340 ud_error2: 4341 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4342 freemsg(data_mp); 4343 ASSERT(mp != NULL); 4344 /* mp is freed by the following routine */ 4345 icmp_ud_err(q, mp, (t_scalar_t)error); 4346 } 4347 4348 /* 4349 * Handle the case of the IP address or flow label being different 4350 * for both IPv4 and IPv6. 4351 * 4352 * NOTE: The caller must hold conn_lock and we drop it here. 4353 */ 4354 static int 4355 icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6, 4356 cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa) 4357 { 4358 icmp_t *icmp = connp->conn_icmp; 4359 icmp_stack_t *is = icmp->icmp_is; 4360 int error; 4361 ip_xmit_attr_t *oldixa; 4362 boolean_t do_ipsec; 4363 uint_t srcid; 4364 uint32_t flowinfo; 4365 in6_addr_t v6src; 4366 in6_addr_t v6dst; 4367 in6_addr_t v6nexthop; 4368 in_port_t dstport; 4369 4370 ASSERT(MUTEX_HELD(&connp->conn_lock)); 4371 ASSERT(ixa != NULL); 4372 4373 /* 4374 * We hold conn_lock across all the use and modifications of 4375 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they 4376 * stay consistent. 4377 */ 4378 4379 ASSERT(cr != NULL); 4380 ixa->ixa_cred = cr; 4381 ixa->ixa_cpid = pid; 4382 if (is_system_labeled()) { 4383 /* We need to restart with a label based on the cred */ 4384 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4385 } 4386 /* 4387 * If we are connected then the destination needs to be the 4388 * same as the connected one, which is not the case here since we 4389 * checked for that above. 4390 */ 4391 if (icmp->icmp_state == TS_DATA_XFER) { 4392 mutex_exit(&connp->conn_lock); 4393 error = EISCONN; 4394 goto ud_error; 4395 } 4396 4397 /* In case previous destination was multicast or multirt */ 4398 ip_attr_newdst(ixa); 4399 4400 /* 4401 * If laddr is unspecified then we look at sin6_src_id. 4402 * We will give precedence to a source address set with IPV6_PKTINFO 4403 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 4404 * want ip_attr_connect to select a source (since it can fail) when 4405 * IPV6_PKTINFO is specified. 4406 * If this doesn't result in a source address then we get a source 4407 * from ip_attr_connect() below. 4408 */ 4409 v6src = connp->conn_saddr_v6; 4410 if (sin != NULL) { 4411 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 4412 dstport = sin->sin_port; 4413 flowinfo = 0; 4414 srcid = 0; 4415 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4416 if (srcid != 0 && V4_PART_OF_V6(&v6src) == INADDR_ANY) { 4417 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4418 connp->conn_netstack); 4419 } 4420 ixa->ixa_flags |= IXAF_IS_IPV4; 4421 } else { 4422 v6dst = sin6->sin6_addr; 4423 dstport = sin6->sin6_port; 4424 flowinfo = sin6->sin6_flowinfo; 4425 srcid = sin6->__sin6_src_id; 4426 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 4427 ixa->ixa_scopeid = sin6->sin6_scope_id; 4428 ixa->ixa_flags |= IXAF_SCOPEID_SET; 4429 } else { 4430 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4431 } 4432 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 4433 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4434 connp->conn_netstack); 4435 } 4436 if (IN6_IS_ADDR_V4MAPPED(&v6dst)) 4437 ixa->ixa_flags |= IXAF_IS_IPV4; 4438 else 4439 ixa->ixa_flags &= ~IXAF_IS_IPV4; 4440 } 4441 /* Handle IPV6_PKTINFO setting source address. */ 4442 if (IN6_IS_ADDR_UNSPECIFIED(&v6src) && 4443 (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR)) { 4444 ip_pkt_t *ipp = &connp->conn_xmit_ipp; 4445 4446 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4447 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4448 v6src = ipp->ipp_addr; 4449 } else { 4450 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4451 v6src = ipp->ipp_addr; 4452 } 4453 } 4454 4455 /* Defer IPsec if it might need to look at ICMP type/code */ 4456 switch (ixa->ixa_protocol) { 4457 case IPPROTO_ICMP: 4458 case IPPROTO_ICMPV6: 4459 do_ipsec = B_FALSE; 4460 break; 4461 default: 4462 do_ipsec = B_TRUE; 4463 } 4464 4465 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop); 4466 mutex_exit(&connp->conn_lock); 4467 4468 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 4469 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 4470 (do_ipsec ? IPDF_IPSEC : 0)); 4471 switch (error) { 4472 case 0: 4473 break; 4474 case EADDRNOTAVAIL: 4475 /* 4476 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4477 * Don't have the application see that errno 4478 */ 4479 error = ENETUNREACH; 4480 goto failed; 4481 case ENETDOWN: 4482 /* 4483 * Have !ipif_addr_ready address; drop packet silently 4484 * until we can get applications to not send until we 4485 * are ready. 4486 */ 4487 error = 0; 4488 goto failed; 4489 case EHOSTUNREACH: 4490 case ENETUNREACH: 4491 if (ixa->ixa_ire != NULL) { 4492 /* 4493 * Let conn_ip_output/ire_send_noroute return 4494 * the error and send any local ICMP error. 4495 */ 4496 error = 0; 4497 break; 4498 } 4499 /* FALLTHRU */ 4500 default: 4501 failed: 4502 goto ud_error; 4503 } 4504 4505 mutex_enter(&connp->conn_lock); 4506 /* 4507 * While we dropped the lock some other thread might have connected 4508 * this socket. If so we bail out with EISCONN to ensure that the 4509 * connecting thread is the one that updates conn_ixa, conn_ht_* 4510 * and conn_*last*. 4511 */ 4512 if (icmp->icmp_state == TS_DATA_XFER) { 4513 mutex_exit(&connp->conn_lock); 4514 error = EISCONN; 4515 goto ud_error; 4516 } 4517 4518 /* 4519 * We need to rebuild the headers if 4520 * - we are labeling packets (could be different for different 4521 * destinations) 4522 * - we have a source route (or routing header) since we need to 4523 * massage that to get the pseudo-header checksum 4524 * - a socket option with COA_HEADER_CHANGED has been set which 4525 * set conn_v6lastdst to zero. 4526 * 4527 * Otherwise the prepend function will just update the src, dst, 4528 * and flow label. 4529 */ 4530 if (is_system_labeled()) { 4531 /* TX MLP requires SCM_UCRED and don't have that here */ 4532 if (connp->conn_mlp_type != mlptSingle) { 4533 mutex_exit(&connp->conn_lock); 4534 error = ECONNREFUSED; 4535 goto ud_error; 4536 } 4537 /* 4538 * Check whether Trusted Solaris policy allows communication 4539 * with this host, and pretend that the destination is 4540 * unreachable if not. 4541 * Compute any needed label and place it in ipp_label_v4/v6. 4542 * 4543 * Later conn_build_hdr_template/conn_prepend_hdr takes 4544 * ipp_label_v4/v6 to form the packet. 4545 * 4546 * Tsol note: Since we hold conn_lock we know no other 4547 * thread manipulates conn_xmit_ipp. 4548 */ 4549 error = conn_update_label(connp, ixa, &v6dst, 4550 &connp->conn_xmit_ipp); 4551 if (error != 0) { 4552 mutex_exit(&connp->conn_lock); 4553 goto ud_error; 4554 } 4555 /* Rebuild the header template */ 4556 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4557 flowinfo); 4558 if (error != 0) { 4559 mutex_exit(&connp->conn_lock); 4560 goto ud_error; 4561 } 4562 } else if (connp->conn_xmit_ipp.ipp_fields & 4563 (IPPF_IPV4_OPTIONS|IPPF_RTHDR) || 4564 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) { 4565 /* Rebuild the header template */ 4566 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4567 flowinfo); 4568 if (error != 0) { 4569 mutex_exit(&connp->conn_lock); 4570 goto ud_error; 4571 } 4572 } else { 4573 /* Simply update the destination address if no source route */ 4574 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4575 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc; 4576 4577 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst); 4578 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 4579 ipha->ipha_fragment_offset_and_flags |= 4580 IPH_DF_HTONS; 4581 } else { 4582 ipha->ipha_fragment_offset_and_flags &= 4583 ~IPH_DF_HTONS; 4584 } 4585 } else { 4586 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc; 4587 ip6h->ip6_dst = v6dst; 4588 } 4589 } 4590 4591 /* 4592 * Remember the dst etc which corresponds to the built header 4593 * template and conn_ixa. 4594 */ 4595 oldixa = conn_replace_ixa(connp, ixa); 4596 connp->conn_v6lastdst = v6dst; 4597 connp->conn_lastflowinfo = flowinfo; 4598 connp->conn_lastscopeid = ixa->ixa_scopeid; 4599 connp->conn_lastsrcid = srcid; 4600 /* Also remember a source to use together with lastdst */ 4601 connp->conn_v6lastsrc = v6src; 4602 4603 data_mp = icmp_prepend_header_template(connp, ixa, data_mp, &v6src, 4604 flowinfo, &error); 4605 4606 /* Done with conn_t */ 4607 mutex_exit(&connp->conn_lock); 4608 ixa_refrele(oldixa); 4609 4610 if (data_mp == NULL) { 4611 ASSERT(error != 0); 4612 goto ud_error; 4613 } 4614 4615 if (!do_ipsec) { 4616 /* Policy might differ for different ICMP type/code */ 4617 data_mp = icmp_output_attach_policy(data_mp, connp, ixa); 4618 if (data_mp == NULL) { 4619 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4620 error = EHOSTUNREACH; /* IPsec policy failure */ 4621 goto done; 4622 } 4623 } 4624 4625 /* We're done. Pass the packet to ip. */ 4626 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 4627 4628 error = conn_ip_output(data_mp, ixa); 4629 /* No rawipOutErrors if an error since IP increases its error counter */ 4630 switch (error) { 4631 case 0: 4632 break; 4633 case EWOULDBLOCK: 4634 (void) ixa_check_drain_insert(connp, ixa); 4635 error = 0; 4636 break; 4637 case EADDRNOTAVAIL: 4638 /* 4639 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4640 * Don't have the application see that errno 4641 */ 4642 error = ENETUNREACH; 4643 /* FALLTHRU */ 4644 default: 4645 mutex_enter(&connp->conn_lock); 4646 /* 4647 * Clear the source and v6lastdst so we call ip_attr_connect 4648 * for the next packet and try to pick a better source. 4649 */ 4650 if (connp->conn_mcbc_bind) 4651 connp->conn_saddr_v6 = ipv6_all_zeros; 4652 else 4653 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 4654 connp->conn_v6lastdst = ipv6_all_zeros; 4655 mutex_exit(&connp->conn_lock); 4656 break; 4657 } 4658 done: 4659 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4660 ixa->ixa_cpid = connp->conn_cpid; 4661 ixa_refrele(ixa); 4662 return (error); 4663 4664 ud_error: 4665 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4666 ixa->ixa_cpid = connp->conn_cpid; 4667 ixa_refrele(ixa); 4668 4669 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4670 freemsg(data_mp); 4671 return (error); 4672 } 4673 4674 /* ARGSUSED */ 4675 static void 4676 icmp_wput_fallback(queue_t *q, mblk_t *mp) 4677 { 4678 #ifdef DEBUG 4679 cmn_err(CE_CONT, "icmp_wput_fallback: Message during fallback \n"); 4680 #endif 4681 freemsg(mp); 4682 } 4683 4684 static void 4685 icmp_wput_other(queue_t *q, mblk_t *mp) 4686 { 4687 uchar_t *rptr = mp->b_rptr; 4688 struct iocblk *iocp; 4689 conn_t *connp = Q_TO_CONN(q); 4690 icmp_t *icmp = connp->conn_icmp; 4691 icmp_stack_t *is = icmp->icmp_is; 4692 cred_t *cr; 4693 4694 switch (mp->b_datap->db_type) { 4695 case M_PROTO: 4696 case M_PCPROTO: 4697 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) { 4698 /* 4699 * If the message does not contain a PRIM_type, 4700 * throw it away. 4701 */ 4702 freemsg(mp); 4703 return; 4704 } 4705 switch (((t_primp_t)rptr)->type) { 4706 case T_ADDR_REQ: 4707 icmp_addr_req(q, mp); 4708 return; 4709 case O_T_BIND_REQ: 4710 case T_BIND_REQ: 4711 icmp_tpi_bind(q, mp); 4712 return; 4713 case T_CONN_REQ: 4714 icmp_tpi_connect(q, mp); 4715 return; 4716 case T_CAPABILITY_REQ: 4717 icmp_capability_req(q, mp); 4718 return; 4719 case T_INFO_REQ: 4720 icmp_info_req(q, mp); 4721 return; 4722 case T_UNITDATA_REQ: 4723 /* 4724 * If a T_UNITDATA_REQ gets here, the address must 4725 * be bad. Valid T_UNITDATA_REQs are handled 4726 * in icmp_wput. 4727 */ 4728 icmp_ud_err(q, mp, EADDRNOTAVAIL); 4729 return; 4730 case T_UNBIND_REQ: 4731 icmp_tpi_unbind(q, mp); 4732 return; 4733 case T_SVR4_OPTMGMT_REQ: 4734 /* 4735 * All Solaris components should pass a db_credp 4736 * for this TPI message, hence we ASSERT. 4737 * But in case there is some other M_PROTO that looks 4738 * like a TPI message sent by some other kernel 4739 * component, we check and return an error. 4740 */ 4741 cr = msg_getcred(mp, NULL); 4742 ASSERT(cr != NULL); 4743 if (cr == NULL) { 4744 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4745 return; 4746 } 4747 4748 if (!snmpcom_req(q, mp, icmp_snmp_set, ip_snmp_get, 4749 cr)) { 4750 svr4_optcom_req(q, mp, cr, &icmp_opt_obj); 4751 } 4752 return; 4753 4754 case T_OPTMGMT_REQ: 4755 /* 4756 * All Solaris components should pass a db_credp 4757 * for this TPI message, hence we ASSERT. 4758 * But in case there is some other M_PROTO that looks 4759 * like a TPI message sent by some other kernel 4760 * component, we check and return an error. 4761 */ 4762 cr = msg_getcred(mp, NULL); 4763 ASSERT(cr != NULL); 4764 if (cr == NULL) { 4765 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4766 return; 4767 } 4768 tpi_optcom_req(q, mp, cr, &icmp_opt_obj); 4769 return; 4770 4771 case T_DISCON_REQ: 4772 icmp_tpi_disconnect(q, mp); 4773 return; 4774 4775 /* The following TPI message is not supported by icmp. */ 4776 case O_T_CONN_RES: 4777 case T_CONN_RES: 4778 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4779 return; 4780 4781 /* The following 3 TPI requests are illegal for icmp. */ 4782 case T_DATA_REQ: 4783 case T_EXDATA_REQ: 4784 case T_ORDREL_REQ: 4785 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4786 return; 4787 default: 4788 break; 4789 } 4790 break; 4791 case M_FLUSH: 4792 if (*rptr & FLUSHW) 4793 flushq(q, FLUSHDATA); 4794 break; 4795 case M_IOCTL: 4796 iocp = (struct iocblk *)mp->b_rptr; 4797 switch (iocp->ioc_cmd) { 4798 case TI_GETPEERNAME: 4799 if (icmp->icmp_state != TS_DATA_XFER) { 4800 /* 4801 * If a default destination address has not 4802 * been associated with the stream, then we 4803 * don't know the peer's name. 4804 */ 4805 iocp->ioc_error = ENOTCONN; 4806 iocp->ioc_count = 0; 4807 mp->b_datap->db_type = M_IOCACK; 4808 qreply(q, mp); 4809 return; 4810 } 4811 /* FALLTHRU */ 4812 case TI_GETMYNAME: 4813 /* 4814 * For TI_GETPEERNAME and TI_GETMYNAME, we first 4815 * need to copyin the user's strbuf structure. 4816 * Processing will continue in the M_IOCDATA case 4817 * below. 4818 */ 4819 mi_copyin(q, mp, NULL, 4820 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 4821 return; 4822 case ND_SET: 4823 /* nd_getset performs the necessary checking */ 4824 case ND_GET: 4825 if (nd_getset(q, is->is_nd, mp)) { 4826 qreply(q, mp); 4827 return; 4828 } 4829 break; 4830 default: 4831 break; 4832 } 4833 break; 4834 case M_IOCDATA: 4835 icmp_wput_iocdata(q, mp); 4836 return; 4837 default: 4838 /* Unrecognized messages are passed through without change. */ 4839 break; 4840 } 4841 ip_wput_nondata(q, mp); 4842 } 4843 4844 /* 4845 * icmp_wput_iocdata is called by icmp_wput_other to handle all M_IOCDATA 4846 * messages. 4847 */ 4848 static void 4849 icmp_wput_iocdata(queue_t *q, mblk_t *mp) 4850 { 4851 mblk_t *mp1; 4852 STRUCT_HANDLE(strbuf, sb); 4853 uint_t addrlen; 4854 conn_t *connp = Q_TO_CONN(q); 4855 icmp_t *icmp = connp->conn_icmp; 4856 4857 /* Make sure it is one of ours. */ 4858 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4859 case TI_GETMYNAME: 4860 case TI_GETPEERNAME: 4861 break; 4862 default: 4863 ip_wput_nondata(q, mp); 4864 return; 4865 } 4866 4867 switch (mi_copy_state(q, mp, &mp1)) { 4868 case -1: 4869 return; 4870 case MI_COPY_CASE(MI_COPY_IN, 1): 4871 break; 4872 case MI_COPY_CASE(MI_COPY_OUT, 1): 4873 /* 4874 * The address has been copied out, so now 4875 * copyout the strbuf. 4876 */ 4877 mi_copyout(q, mp); 4878 return; 4879 case MI_COPY_CASE(MI_COPY_OUT, 2): 4880 /* 4881 * The address and strbuf have been copied out. 4882 * We're done, so just acknowledge the original 4883 * M_IOCTL. 4884 */ 4885 mi_copy_done(q, mp, 0); 4886 return; 4887 default: 4888 /* 4889 * Something strange has happened, so acknowledge 4890 * the original M_IOCTL with an EPROTO error. 4891 */ 4892 mi_copy_done(q, mp, EPROTO); 4893 return; 4894 } 4895 4896 /* 4897 * Now we have the strbuf structure for TI_GETMYNAME 4898 * and TI_GETPEERNAME. Next we copyout the requested 4899 * address and then we'll copyout the strbuf. 4900 */ 4901 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 4902 (void *)mp1->b_rptr); 4903 4904 if (connp->conn_family == AF_INET) 4905 addrlen = sizeof (sin_t); 4906 else 4907 addrlen = sizeof (sin6_t); 4908 4909 if (STRUCT_FGET(sb, maxlen) < addrlen) { 4910 mi_copy_done(q, mp, EINVAL); 4911 return; 4912 } 4913 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4914 case TI_GETMYNAME: 4915 break; 4916 case TI_GETPEERNAME: 4917 if (icmp->icmp_state != TS_DATA_XFER) { 4918 mi_copy_done(q, mp, ENOTCONN); 4919 return; 4920 } 4921 break; 4922 default: 4923 mi_copy_done(q, mp, EPROTO); 4924 return; 4925 } 4926 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 4927 if (!mp1) 4928 return; 4929 4930 STRUCT_FSET(sb, len, addrlen); 4931 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4932 case TI_GETMYNAME: 4933 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr, 4934 &addrlen); 4935 break; 4936 case TI_GETPEERNAME: 4937 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr, 4938 &addrlen); 4939 break; 4940 } 4941 mp1->b_wptr += addrlen; 4942 /* Copy out the address */ 4943 mi_copyout(q, mp); 4944 } 4945 4946 void 4947 icmp_ddi_g_init(void) 4948 { 4949 icmp_max_optsize = optcom_max_optsize(icmp_opt_obj.odb_opt_des_arr, 4950 icmp_opt_obj.odb_opt_arr_cnt); 4951 4952 /* 4953 * We want to be informed each time a stack is created or 4954 * destroyed in the kernel, so we can maintain the 4955 * set of icmp_stack_t's. 4956 */ 4957 netstack_register(NS_ICMP, rawip_stack_init, NULL, rawip_stack_fini); 4958 } 4959 4960 void 4961 icmp_ddi_g_destroy(void) 4962 { 4963 netstack_unregister(NS_ICMP); 4964 } 4965 4966 #define INET_NAME "ip" 4967 4968 /* 4969 * Initialize the ICMP stack instance. 4970 */ 4971 static void * 4972 rawip_stack_init(netstackid_t stackid, netstack_t *ns) 4973 { 4974 icmp_stack_t *is; 4975 icmpparam_t *pa; 4976 int error = 0; 4977 major_t major; 4978 4979 is = (icmp_stack_t *)kmem_zalloc(sizeof (*is), KM_SLEEP); 4980 is->is_netstack = ns; 4981 4982 pa = (icmpparam_t *)kmem_alloc(sizeof (icmp_param_arr), KM_SLEEP); 4983 is->is_param_arr = pa; 4984 bcopy(icmp_param_arr, is->is_param_arr, sizeof (icmp_param_arr)); 4985 4986 (void) icmp_param_register(&is->is_nd, 4987 is->is_param_arr, A_CNT(icmp_param_arr)); 4988 is->is_ksp = rawip_kstat_init(stackid); 4989 4990 major = mod_name_to_major(INET_NAME); 4991 error = ldi_ident_from_major(major, &is->is_ldi_ident); 4992 ASSERT(error == 0); 4993 return (is); 4994 } 4995 4996 /* 4997 * Free the ICMP stack instance. 4998 */ 4999 static void 5000 rawip_stack_fini(netstackid_t stackid, void *arg) 5001 { 5002 icmp_stack_t *is = (icmp_stack_t *)arg; 5003 5004 nd_free(&is->is_nd); 5005 kmem_free(is->is_param_arr, sizeof (icmp_param_arr)); 5006 is->is_param_arr = NULL; 5007 5008 rawip_kstat_fini(stackid, is->is_ksp); 5009 is->is_ksp = NULL; 5010 ldi_ident_release(is->is_ldi_ident); 5011 kmem_free(is, sizeof (*is)); 5012 } 5013 5014 static void * 5015 rawip_kstat_init(netstackid_t stackid) { 5016 kstat_t *ksp; 5017 5018 rawip_named_kstat_t template = { 5019 { "inDatagrams", KSTAT_DATA_UINT32, 0 }, 5020 { "inCksumErrs", KSTAT_DATA_UINT32, 0 }, 5021 { "inErrors", KSTAT_DATA_UINT32, 0 }, 5022 { "outDatagrams", KSTAT_DATA_UINT32, 0 }, 5023 { "outErrors", KSTAT_DATA_UINT32, 0 }, 5024 }; 5025 5026 ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2", 5027 KSTAT_TYPE_NAMED, 5028 NUM_OF_FIELDS(rawip_named_kstat_t), 5029 0, stackid); 5030 if (ksp == NULL || ksp->ks_data == NULL) 5031 return (NULL); 5032 5033 bcopy(&template, ksp->ks_data, sizeof (template)); 5034 ksp->ks_update = rawip_kstat_update; 5035 ksp->ks_private = (void *)(uintptr_t)stackid; 5036 5037 kstat_install(ksp); 5038 return (ksp); 5039 } 5040 5041 static void 5042 rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp) 5043 { 5044 if (ksp != NULL) { 5045 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 5046 kstat_delete_netstack(ksp, stackid); 5047 } 5048 } 5049 5050 static int 5051 rawip_kstat_update(kstat_t *ksp, int rw) 5052 { 5053 rawip_named_kstat_t *rawipkp; 5054 netstackid_t stackid = (netstackid_t)(uintptr_t)ksp->ks_private; 5055 netstack_t *ns; 5056 icmp_stack_t *is; 5057 5058 if ((ksp == NULL) || (ksp->ks_data == NULL)) 5059 return (EIO); 5060 5061 if (rw == KSTAT_WRITE) 5062 return (EACCES); 5063 5064 rawipkp = (rawip_named_kstat_t *)ksp->ks_data; 5065 5066 ns = netstack_find_by_stackid(stackid); 5067 if (ns == NULL) 5068 return (-1); 5069 is = ns->netstack_icmp; 5070 if (is == NULL) { 5071 netstack_rele(ns); 5072 return (-1); 5073 } 5074 rawipkp->inDatagrams.value.ui32 = is->is_rawip_mib.rawipInDatagrams; 5075 rawipkp->inCksumErrs.value.ui32 = is->is_rawip_mib.rawipInCksumErrs; 5076 rawipkp->inErrors.value.ui32 = is->is_rawip_mib.rawipInErrors; 5077 rawipkp->outDatagrams.value.ui32 = is->is_rawip_mib.rawipOutDatagrams; 5078 rawipkp->outErrors.value.ui32 = is->is_rawip_mib.rawipOutErrors; 5079 netstack_rele(ns); 5080 return (0); 5081 } 5082 5083 /* ARGSUSED */ 5084 int 5085 rawip_accept(sock_lower_handle_t lproto_handle, 5086 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle, 5087 cred_t *cr) 5088 { 5089 return (EOPNOTSUPP); 5090 } 5091 5092 /* ARGSUSED */ 5093 int 5094 rawip_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5095 socklen_t len, cred_t *cr) 5096 { 5097 conn_t *connp = (conn_t *)proto_handle; 5098 int error; 5099 5100 /* All Solaris components should pass a cred for this operation. */ 5101 ASSERT(cr != NULL); 5102 5103 /* Binding to a NULL address really means unbind */ 5104 if (sa == NULL) 5105 error = rawip_do_unbind(connp); 5106 else 5107 error = rawip_do_bind(connp, sa, len); 5108 5109 if (error < 0) { 5110 if (error == -TOUTSTATE) 5111 error = EINVAL; 5112 else 5113 error = proto_tlitosyserr(-error); 5114 } 5115 return (error); 5116 } 5117 5118 static int 5119 rawip_implicit_bind(conn_t *connp) 5120 { 5121 sin6_t sin6addr; 5122 sin_t *sin; 5123 sin6_t *sin6; 5124 socklen_t len; 5125 int error; 5126 5127 if (connp->conn_family == AF_INET) { 5128 len = sizeof (struct sockaddr_in); 5129 sin = (sin_t *)&sin6addr; 5130 *sin = sin_null; 5131 sin->sin_family = AF_INET; 5132 sin->sin_addr.s_addr = INADDR_ANY; 5133 } else { 5134 ASSERT(connp->conn_family == AF_INET6); 5135 len = sizeof (sin6_t); 5136 sin6 = (sin6_t *)&sin6addr; 5137 *sin6 = sin6_null; 5138 sin6->sin6_family = AF_INET6; 5139 V6_SET_ZERO(sin6->sin6_addr); 5140 } 5141 5142 error = rawip_do_bind(connp, (struct sockaddr *)&sin6addr, len); 5143 5144 return ((error < 0) ? proto_tlitosyserr(-error) : error); 5145 } 5146 5147 static int 5148 rawip_unbind(conn_t *connp) 5149 { 5150 int error; 5151 5152 error = rawip_do_unbind(connp); 5153 if (error < 0) { 5154 error = proto_tlitosyserr(-error); 5155 } 5156 return (error); 5157 } 5158 5159 /* ARGSUSED */ 5160 int 5161 rawip_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr) 5162 { 5163 return (EOPNOTSUPP); 5164 } 5165 5166 int 5167 rawip_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa, 5168 socklen_t len, sock_connid_t *id, cred_t *cr) 5169 { 5170 conn_t *connp = (conn_t *)proto_handle; 5171 icmp_t *icmp = connp->conn_icmp; 5172 int error; 5173 boolean_t did_bind = B_FALSE; 5174 pid_t pid = curproc->p_pid; 5175 5176 /* All Solaris components should pass a cred for this operation. */ 5177 ASSERT(cr != NULL); 5178 5179 if (sa == NULL) { 5180 /* 5181 * Disconnect 5182 * Make sure we are connected 5183 */ 5184 if (icmp->icmp_state != TS_DATA_XFER) 5185 return (EINVAL); 5186 5187 error = icmp_disconnect(connp); 5188 return (error); 5189 } 5190 5191 error = proto_verify_ip_addr(connp->conn_family, sa, len); 5192 if (error != 0) 5193 return (error); 5194 5195 /* do an implicit bind if necessary */ 5196 if (icmp->icmp_state == TS_UNBND) { 5197 error = rawip_implicit_bind(connp); 5198 /* 5199 * We could be racing with an actual bind, in which case 5200 * we would see EPROTO. We cross our fingers and try 5201 * to connect. 5202 */ 5203 if (!(error == 0 || error == EPROTO)) 5204 return (error); 5205 did_bind = B_TRUE; 5206 } 5207 5208 /* 5209 * set SO_DGRAM_ERRIND 5210 */ 5211 connp->conn_dgram_errind = B_TRUE; 5212 5213 error = rawip_do_connect(connp, sa, len, cr, pid); 5214 if (error != 0 && did_bind) { 5215 int unbind_err; 5216 5217 unbind_err = rawip_unbind(connp); 5218 ASSERT(unbind_err == 0); 5219 } 5220 5221 if (error == 0) { 5222 *id = 0; 5223 (*connp->conn_upcalls->su_connected)(connp->conn_upper_handle, 5224 0, NULL, -1); 5225 } else if (error < 0) { 5226 error = proto_tlitosyserr(-error); 5227 } 5228 return (error); 5229 } 5230 5231 /* ARGSUSED2 */ 5232 int 5233 rawip_fallback(sock_lower_handle_t proto_handle, queue_t *q, 5234 boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb) 5235 { 5236 conn_t *connp = (conn_t *)proto_handle; 5237 icmp_t *icmp; 5238 struct T_capability_ack tca; 5239 struct sockaddr_in6 laddr, faddr; 5240 socklen_t laddrlen, faddrlen; 5241 short opts; 5242 struct stroptions *stropt; 5243 mblk_t *stropt_mp; 5244 int error; 5245 5246 icmp = connp->conn_icmp; 5247 5248 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL); 5249 5250 /* 5251 * setup the fallback stream that was allocated 5252 */ 5253 connp->conn_dev = (dev_t)RD(q)->q_ptr; 5254 connp->conn_minor_arena = WR(q)->q_ptr; 5255 5256 RD(q)->q_ptr = WR(q)->q_ptr = connp; 5257 5258 WR(q)->q_qinfo = &icmpwinit; 5259 5260 connp->conn_rq = RD(q); 5261 connp->conn_wq = WR(q); 5262 5263 /* Notify stream head about options before sending up data */ 5264 stropt_mp->b_datap->db_type = M_SETOPTS; 5265 stropt_mp->b_wptr += sizeof (*stropt); 5266 stropt = (struct stroptions *)stropt_mp->b_rptr; 5267 stropt->so_flags = SO_WROFF | SO_HIWAT; 5268 stropt->so_wroff = connp->conn_wroff; 5269 stropt->so_hiwat = connp->conn_rcvbuf; 5270 putnext(RD(q), stropt_mp); 5271 5272 /* 5273 * free helper stream 5274 */ 5275 ip_free_helper_stream(connp); 5276 5277 /* 5278 * Collect the information needed to sync with the sonode 5279 */ 5280 icmp_do_capability_ack(icmp, &tca, TC1_INFO); 5281 5282 laddrlen = faddrlen = sizeof (sin6_t); 5283 (void) rawip_getsockname((sock_lower_handle_t)connp, 5284 (struct sockaddr *)&laddr, &laddrlen, CRED()); 5285 error = rawip_getpeername((sock_lower_handle_t)connp, 5286 (struct sockaddr *)&faddr, &faddrlen, CRED()); 5287 if (error != 0) 5288 faddrlen = 0; 5289 opts = 0; 5290 if (connp->conn_dgram_errind) 5291 opts |= SO_DGRAM_ERRIND; 5292 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE) 5293 opts |= SO_DONTROUTE; 5294 5295 (*quiesced_cb)(connp->conn_upper_handle, q, &tca, 5296 (struct sockaddr *)&laddr, laddrlen, 5297 (struct sockaddr *)&faddr, faddrlen, opts); 5298 5299 /* 5300 * Attempts to send data up during fallback will result in it being 5301 * queued in icmp_t. Now we push up any queued packets. 5302 */ 5303 mutex_enter(&icmp->icmp_recv_lock); 5304 while (icmp->icmp_fallback_queue_head != NULL) { 5305 mblk_t *mp; 5306 5307 mp = icmp->icmp_fallback_queue_head; 5308 icmp->icmp_fallback_queue_head = mp->b_next; 5309 mp->b_next = NULL; 5310 mutex_exit(&icmp->icmp_recv_lock); 5311 putnext(RD(q), mp); 5312 mutex_enter(&icmp->icmp_recv_lock); 5313 } 5314 icmp->icmp_fallback_queue_tail = icmp->icmp_fallback_queue_head; 5315 5316 /* 5317 * No longer a streams less socket 5318 */ 5319 mutex_enter(&connp->conn_lock); 5320 connp->conn_flags &= ~IPCL_NONSTR; 5321 mutex_exit(&connp->conn_lock); 5322 5323 mutex_exit(&icmp->icmp_recv_lock); 5324 5325 ASSERT(icmp->icmp_fallback_queue_head == NULL && 5326 icmp->icmp_fallback_queue_tail == NULL); 5327 5328 ASSERT(connp->conn_ref >= 1); 5329 5330 return (0); 5331 } 5332 5333 /* ARGSUSED2 */ 5334 sock_lower_handle_t 5335 rawip_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls, 5336 uint_t *smodep, int *errorp, int flags, cred_t *credp) 5337 { 5338 conn_t *connp; 5339 5340 if (type != SOCK_RAW || (family != AF_INET && family != AF_INET6)) { 5341 *errorp = EPROTONOSUPPORT; 5342 return (NULL); 5343 } 5344 5345 connp = rawip_do_open(family, credp, errorp, flags); 5346 if (connp != NULL) { 5347 connp->conn_flags |= IPCL_NONSTR; 5348 5349 mutex_enter(&connp->conn_lock); 5350 connp->conn_state_flags &= ~CONN_INCIPIENT; 5351 mutex_exit(&connp->conn_lock); 5352 *sock_downcalls = &sock_rawip_downcalls; 5353 *smodep = SM_ATOMIC; 5354 } else { 5355 ASSERT(*errorp != 0); 5356 } 5357 5358 return ((sock_lower_handle_t)connp); 5359 } 5360 5361 /* ARGSUSED3 */ 5362 void 5363 rawip_activate(sock_lower_handle_t proto_handle, 5364 sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls, int flags, 5365 cred_t *cr) 5366 { 5367 conn_t *connp = (conn_t *)proto_handle; 5368 struct sock_proto_props sopp; 5369 5370 /* All Solaris components should pass a cred for this operation. */ 5371 ASSERT(cr != NULL); 5372 5373 connp->conn_upcalls = sock_upcalls; 5374 connp->conn_upper_handle = sock_handle; 5375 5376 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT | 5377 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ; 5378 sopp.sopp_wroff = connp->conn_wroff; 5379 sopp.sopp_rxhiwat = connp->conn_rcvbuf; 5380 sopp.sopp_rxlowat = connp->conn_rcvlowat; 5381 sopp.sopp_maxblk = INFPSZ; 5382 sopp.sopp_maxpsz = IP_MAXPACKET; 5383 sopp.sopp_minpsz = (icmp_mod_info.mi_minpsz == 1) ? 0 : 5384 icmp_mod_info.mi_minpsz; 5385 5386 (*connp->conn_upcalls->su_set_proto_props) 5387 (connp->conn_upper_handle, &sopp); 5388 5389 icmp_bind_proto(connp->conn_icmp); 5390 } 5391 5392 /* ARGSUSED3 */ 5393 int 5394 rawip_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5395 socklen_t *salenp, cred_t *cr) 5396 { 5397 conn_t *connp = (conn_t *)proto_handle; 5398 icmp_t *icmp = connp->conn_icmp; 5399 int error; 5400 5401 /* All Solaris components should pass a cred for this operation. */ 5402 ASSERT(cr != NULL); 5403 5404 mutex_enter(&connp->conn_lock); 5405 if (icmp->icmp_state != TS_DATA_XFER) 5406 error = ENOTCONN; 5407 else 5408 error = conn_getpeername(connp, sa, salenp); 5409 mutex_exit(&connp->conn_lock); 5410 return (error); 5411 } 5412 5413 /* ARGSUSED3 */ 5414 int 5415 rawip_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5416 socklen_t *salenp, cred_t *cr) 5417 { 5418 conn_t *connp = (conn_t *)proto_handle; 5419 int error; 5420 5421 /* All Solaris components should pass a cred for this operation. */ 5422 ASSERT(cr != NULL); 5423 5424 mutex_enter(&connp->conn_lock); 5425 error = conn_getsockname(connp, sa, salenp); 5426 mutex_exit(&connp->conn_lock); 5427 return (error); 5428 } 5429 5430 int 5431 rawip_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5432 const void *optvalp, socklen_t optlen, cred_t *cr) 5433 { 5434 conn_t *connp = (conn_t *)proto_handle; 5435 int error; 5436 5437 /* All Solaris components should pass a cred for this operation. */ 5438 ASSERT(cr != NULL); 5439 5440 error = proto_opt_check(level, option_name, optlen, NULL, 5441 icmp_opt_obj.odb_opt_des_arr, 5442 icmp_opt_obj.odb_opt_arr_cnt, 5443 B_TRUE, B_FALSE, cr); 5444 5445 if (error != 0) { 5446 /* 5447 * option not recognized 5448 */ 5449 if (error < 0) { 5450 error = proto_tlitosyserr(-error); 5451 } 5452 return (error); 5453 } 5454 5455 error = icmp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, 5456 option_name, optlen, (uchar_t *)optvalp, (uint_t *)&optlen, 5457 (uchar_t *)optvalp, NULL, cr); 5458 5459 ASSERT(error >= 0); 5460 5461 return (error); 5462 } 5463 5464 int 5465 rawip_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5466 void *optvalp, socklen_t *optlen, cred_t *cr) 5467 { 5468 int error; 5469 conn_t *connp = (conn_t *)proto_handle; 5470 t_uscalar_t max_optbuf_len; 5471 void *optvalp_buf; 5472 int len; 5473 5474 /* All Solaris components should pass a cred for this operation. */ 5475 ASSERT(cr != NULL); 5476 5477 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len, 5478 icmp_opt_obj.odb_opt_des_arr, 5479 icmp_opt_obj.odb_opt_arr_cnt, 5480 B_FALSE, B_TRUE, cr); 5481 5482 if (error != 0) { 5483 if (error < 0) { 5484 error = proto_tlitosyserr(-error); 5485 } 5486 return (error); 5487 } 5488 5489 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP); 5490 len = icmp_opt_get(connp, level, option_name, optvalp_buf); 5491 if (len == -1) { 5492 kmem_free(optvalp_buf, max_optbuf_len); 5493 return (EINVAL); 5494 } 5495 5496 /* 5497 * update optlen and copy option value 5498 */ 5499 t_uscalar_t size = MIN(len, *optlen); 5500 5501 bcopy(optvalp_buf, optvalp, size); 5502 bcopy(&size, optlen, sizeof (size)); 5503 5504 kmem_free(optvalp_buf, max_optbuf_len); 5505 return (0); 5506 } 5507 5508 /* ARGSUSED1 */ 5509 int 5510 rawip_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr) 5511 { 5512 conn_t *connp = (conn_t *)proto_handle; 5513 5514 /* All Solaris components should pass a cred for this operation. */ 5515 ASSERT(cr != NULL); 5516 5517 (void) rawip_do_close(connp); 5518 return (0); 5519 } 5520 5521 /* ARGSUSED2 */ 5522 int 5523 rawip_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr) 5524 { 5525 conn_t *connp = (conn_t *)proto_handle; 5526 5527 /* All Solaris components should pass a cred for this operation. */ 5528 ASSERT(cr != NULL); 5529 5530 /* shut down the send side */ 5531 if (how != SHUT_RD) 5532 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5533 SOCK_OPCTL_SHUT_SEND, 0); 5534 /* shut down the recv side */ 5535 if (how != SHUT_WR) 5536 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5537 SOCK_OPCTL_SHUT_RECV, 0); 5538 return (0); 5539 } 5540 5541 void 5542 rawip_clr_flowctrl(sock_lower_handle_t proto_handle) 5543 { 5544 conn_t *connp = (conn_t *)proto_handle; 5545 icmp_t *icmp = connp->conn_icmp; 5546 5547 mutex_enter(&icmp->icmp_recv_lock); 5548 connp->conn_flow_cntrld = B_FALSE; 5549 mutex_exit(&icmp->icmp_recv_lock); 5550 } 5551 5552 int 5553 rawip_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg, 5554 int mode, int32_t *rvalp, cred_t *cr) 5555 { 5556 conn_t *connp = (conn_t *)proto_handle; 5557 int error; 5558 5559 /* All Solaris components should pass a cred for this operation. */ 5560 ASSERT(cr != NULL); 5561 5562 /* 5563 * If we don't have a helper stream then create one. 5564 * ip_create_helper_stream takes care of locking the conn_t, 5565 * so this check for NULL is just a performance optimization. 5566 */ 5567 if (connp->conn_helper_info == NULL) { 5568 icmp_stack_t *is = connp->conn_icmp->icmp_is; 5569 5570 ASSERT(is->is_ldi_ident != NULL); 5571 5572 /* 5573 * Create a helper stream for non-STREAMS socket. 5574 */ 5575 error = ip_create_helper_stream(connp, is->is_ldi_ident); 5576 if (error != 0) { 5577 ip0dbg(("rawip_ioctl: create of IP helper stream " 5578 "failed %d\n", error)); 5579 return (error); 5580 } 5581 } 5582 5583 switch (cmd) { 5584 case ND_SET: 5585 case ND_GET: 5586 case _SIOCSOCKFALLBACK: 5587 case TI_GETPEERNAME: 5588 case TI_GETMYNAME: 5589 #ifdef DEBUG 5590 cmn_err(CE_CONT, "icmp_ioctl cmd 0x%x on non streams" 5591 " socket", cmd); 5592 #endif 5593 error = EINVAL; 5594 break; 5595 default: 5596 /* 5597 * Pass on to IP using helper stream 5598 */ 5599 error = ldi_ioctl(connp->conn_helper_info->iphs_handle, 5600 cmd, arg, mode, cr, rvalp); 5601 break; 5602 } 5603 return (error); 5604 } 5605 5606 int 5607 rawip_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg, 5608 cred_t *cr) 5609 { 5610 sin6_t *sin6; 5611 sin_t *sin = NULL; 5612 uint_t srcid; 5613 conn_t *connp = (conn_t *)proto_handle; 5614 icmp_t *icmp = connp->conn_icmp; 5615 int error = 0; 5616 icmp_stack_t *is = icmp->icmp_is; 5617 pid_t pid = curproc->p_pid; 5618 ip_xmit_attr_t *ixa; 5619 5620 ASSERT(DB_TYPE(mp) == M_DATA); 5621 5622 /* All Solaris components should pass a cred for this operation. */ 5623 ASSERT(cr != NULL); 5624 5625 /* do an implicit bind if necessary */ 5626 if (icmp->icmp_state == TS_UNBND) { 5627 error = rawip_implicit_bind(connp); 5628 /* 5629 * We could be racing with an actual bind, in which case 5630 * we would see EPROTO. We cross our fingers and try 5631 * to connect. 5632 */ 5633 if (!(error == 0 || error == EPROTO)) { 5634 freemsg(mp); 5635 return (error); 5636 } 5637 } 5638 5639 /* Protocol 255 contains full IP headers */ 5640 /* Read without holding lock */ 5641 if (icmp->icmp_hdrincl) { 5642 ASSERT(connp->conn_ipversion == IPV4_VERSION); 5643 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) { 5644 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 5645 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5646 freemsg(mp); 5647 return (EINVAL); 5648 } 5649 } 5650 error = icmp_output_hdrincl(connp, mp, cr, pid); 5651 if (is->is_sendto_ignerr) 5652 return (0); 5653 else 5654 return (error); 5655 } 5656 5657 /* Connected? */ 5658 if (msg->msg_name == NULL) { 5659 if (icmp->icmp_state != TS_DATA_XFER) { 5660 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5661 return (EDESTADDRREQ); 5662 } 5663 if (msg->msg_controllen != 0) { 5664 error = icmp_output_ancillary(connp, NULL, NULL, mp, 5665 NULL, msg, cr, pid); 5666 } else { 5667 error = icmp_output_connected(connp, mp, cr, pid); 5668 } 5669 if (is->is_sendto_ignerr) 5670 return (0); 5671 else 5672 return (error); 5673 } 5674 if (icmp->icmp_state == TS_DATA_XFER) { 5675 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5676 return (EISCONN); 5677 } 5678 error = proto_verify_ip_addr(connp->conn_family, 5679 (struct sockaddr *)msg->msg_name, msg->msg_namelen); 5680 if (error != 0) { 5681 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5682 return (error); 5683 } 5684 switch (connp->conn_family) { 5685 case AF_INET6: 5686 sin6 = (sin6_t *)msg->msg_name; 5687 5688 /* No support for mapped addresses on raw sockets */ 5689 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 5690 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5691 return (EADDRNOTAVAIL); 5692 } 5693 srcid = sin6->__sin6_src_id; 5694 5695 /* 5696 * If the local address is a mapped address return 5697 * an error. 5698 * It would be possible to send an IPv6 packet but the 5699 * response would never make it back to the application 5700 * since it is bound to a mapped address. 5701 */ 5702 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 5703 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5704 return (EADDRNOTAVAIL); 5705 } 5706 5707 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 5708 sin6->sin6_addr = ipv6_loopback; 5709 5710 /* 5711 * We have to allocate an ip_xmit_attr_t before we grab 5712 * conn_lock and we need to hold conn_lock once we've check 5713 * conn_same_as_last_v6 to handle concurrent send* calls on a 5714 * socket. 5715 */ 5716 if (msg->msg_controllen == 0) { 5717 ixa = conn_get_ixa(connp, B_FALSE); 5718 if (ixa == NULL) { 5719 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5720 return (ENOMEM); 5721 } 5722 } else { 5723 ixa = NULL; 5724 } 5725 mutex_enter(&connp->conn_lock); 5726 if (icmp->icmp_delayed_error != 0) { 5727 sin6_t *sin2 = (sin6_t *)&icmp->icmp_delayed_addr; 5728 5729 error = icmp->icmp_delayed_error; 5730 icmp->icmp_delayed_error = 0; 5731 5732 /* Compare IP address and family */ 5733 5734 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 5735 &sin2->sin6_addr) && 5736 sin6->sin6_family == sin2->sin6_family) { 5737 mutex_exit(&connp->conn_lock); 5738 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5739 if (ixa != NULL) 5740 ixa_refrele(ixa); 5741 return (error); 5742 } 5743 } 5744 if (msg->msg_controllen != 0) { 5745 mutex_exit(&connp->conn_lock); 5746 ASSERT(ixa == NULL); 5747 error = icmp_output_ancillary(connp, NULL, sin6, mp, 5748 NULL, msg, cr, pid); 5749 } else if (conn_same_as_last_v6(connp, sin6) && 5750 connp->conn_lastsrcid == srcid && 5751 ipsec_outbound_policy_current(ixa)) { 5752 /* icmp_output_lastdst drops conn_lock */ 5753 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5754 } else { 5755 /* icmp_output_newdst drops conn_lock */ 5756 error = icmp_output_newdst(connp, mp, NULL, sin6, cr, 5757 pid, ixa); 5758 } 5759 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5760 if (is->is_sendto_ignerr) 5761 return (0); 5762 else 5763 return (error); 5764 case AF_INET: 5765 sin = (sin_t *)msg->msg_name; 5766 5767 if (sin->sin_addr.s_addr == INADDR_ANY) 5768 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 5769 5770 /* 5771 * We have to allocate an ip_xmit_attr_t before we grab 5772 * conn_lock and we need to hold conn_lock once we've check 5773 * conn_same_as_last_v6 to handle concurrent send* on a socket. 5774 */ 5775 if (msg->msg_controllen == 0) { 5776 ixa = conn_get_ixa(connp, B_FALSE); 5777 if (ixa == NULL) { 5778 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5779 return (ENOMEM); 5780 } 5781 } else { 5782 ixa = NULL; 5783 } 5784 mutex_enter(&connp->conn_lock); 5785 if (icmp->icmp_delayed_error != 0) { 5786 sin_t *sin2 = (sin_t *)&icmp->icmp_delayed_addr; 5787 5788 error = icmp->icmp_delayed_error; 5789 icmp->icmp_delayed_error = 0; 5790 5791 /* Compare IP address */ 5792 5793 if (sin->sin_addr.s_addr == sin2->sin_addr.s_addr) { 5794 mutex_exit(&connp->conn_lock); 5795 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5796 if (ixa != NULL) 5797 ixa_refrele(ixa); 5798 return (error); 5799 } 5800 } 5801 5802 if (msg->msg_controllen != 0) { 5803 mutex_exit(&connp->conn_lock); 5804 ASSERT(ixa == NULL); 5805 error = icmp_output_ancillary(connp, sin, NULL, mp, 5806 NULL, msg, cr, pid); 5807 } else if (conn_same_as_last_v4(connp, sin) && 5808 ipsec_outbound_policy_current(ixa)) { 5809 /* icmp_output_lastdst drops conn_lock */ 5810 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5811 } else { 5812 /* icmp_output_newdst drops conn_lock */ 5813 error = icmp_output_newdst(connp, mp, sin, NULL, cr, 5814 pid, ixa); 5815 } 5816 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5817 if (is->is_sendto_ignerr) 5818 return (0); 5819 else 5820 return (error); 5821 default: 5822 return (EINVAL); 5823 } 5824 } 5825 5826 sock_downcalls_t sock_rawip_downcalls = { 5827 rawip_activate, 5828 rawip_accept, 5829 rawip_bind, 5830 rawip_listen, 5831 rawip_connect, 5832 rawip_getpeername, 5833 rawip_getsockname, 5834 rawip_getsockopt, 5835 rawip_setsockopt, 5836 rawip_send, 5837 NULL, 5838 NULL, 5839 NULL, 5840 rawip_shutdown, 5841 rawip_clr_flowctrl, 5842 rawip_ioctl, 5843 rawip_close 5844 }; 5845