1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* Copyright (c) 1990 Mentat Inc. */ 26 27 #include <sys/types.h> 28 #include <sys/stream.h> 29 #include <sys/stropts.h> 30 #include <sys/strlog.h> 31 #include <sys/strsun.h> 32 #define _SUN_TPI_VERSION 2 33 #include <sys/tihdr.h> 34 #include <sys/timod.h> 35 #include <sys/ddi.h> 36 #include <sys/sunddi.h> 37 #include <sys/strsubr.h> 38 #include <sys/suntpi.h> 39 #include <sys/xti_inet.h> 40 #include <sys/cmn_err.h> 41 #include <sys/kmem.h> 42 #include <sys/cred_impl.h> 43 #include <sys/policy.h> 44 #include <sys/priv.h> 45 #include <sys/ucred.h> 46 #include <sys/zone.h> 47 48 #include <sys/sockio.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/vtrace.h> 52 #include <sys/sdt.h> 53 #include <sys/debug.h> 54 #include <sys/isa_defs.h> 55 #include <sys/random.h> 56 #include <netinet/in.h> 57 #include <netinet/ip6.h> 58 #include <netinet/icmp6.h> 59 #include <netinet/udp.h> 60 61 #include <inet/common.h> 62 #include <inet/ip.h> 63 #include <inet/ip_impl.h> 64 #include <inet/ipsec_impl.h> 65 #include <inet/ip6.h> 66 #include <inet/ip_ire.h> 67 #include <inet/ip_if.h> 68 #include <inet/ip_multi.h> 69 #include <inet/ip_ndp.h> 70 #include <inet/proto_set.h> 71 #include <inet/mib2.h> 72 #include <inet/nd.h> 73 #include <inet/optcom.h> 74 #include <inet/snmpcom.h> 75 #include <inet/kstatcom.h> 76 #include <inet/ipclassifier.h> 77 78 #include <sys/tsol/label.h> 79 #include <sys/tsol/tnet.h> 80 81 #include <inet/rawip_impl.h> 82 83 #include <sys/disp.h> 84 85 /* 86 * Synchronization notes: 87 * 88 * RAWIP is MT and uses the usual kernel synchronization primitives. We use 89 * conn_lock to protect the icmp_t. 90 * 91 * Plumbing notes: 92 * ICMP is always a device driver. For compatibility with mibopen() code 93 * it is possible to I_PUSH "icmp", but that results in pushing a passthrough 94 * dummy module. 95 */ 96 97 static void icmp_addr_req(queue_t *q, mblk_t *mp); 98 static void icmp_tpi_bind(queue_t *q, mblk_t *mp); 99 static void icmp_bind_proto(icmp_t *icmp); 100 static int icmp_build_hdr_template(conn_t *, const in6_addr_t *, 101 const in6_addr_t *, uint32_t); 102 static void icmp_capability_req(queue_t *q, mblk_t *mp); 103 static int icmp_close(queue_t *q, int flags); 104 static void icmp_close_free(conn_t *); 105 static void icmp_tpi_connect(queue_t *q, mblk_t *mp); 106 static void icmp_tpi_disconnect(queue_t *q, mblk_t *mp); 107 static void icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, 108 int sys_error); 109 static void icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 110 t_scalar_t tlierr, int sys_error); 111 static void icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, 112 ip_recv_attr_t *); 113 static void icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, 114 ip_recv_attr_t *); 115 static void icmp_info_req(queue_t *q, mblk_t *mp); 116 static void icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *); 117 static conn_t *icmp_open(int family, cred_t *credp, int *err, int flags); 118 static int icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, 119 cred_t *credp); 120 static int icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, 121 cred_t *credp); 122 static boolean_t icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name); 123 int icmp_opt_set(conn_t *connp, uint_t optset_context, 124 int level, int name, uint_t inlen, 125 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 126 void *thisdg_attrs, cred_t *cr); 127 int icmp_opt_get(conn_t *connp, int level, int name, 128 uchar_t *ptr); 129 static int icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, 130 sin6_t *sin6, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa); 131 static int icmp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 132 static boolean_t icmp_param_register(IDP *ndp, icmpparam_t *icmppa, int cnt); 133 static int icmp_param_set(queue_t *q, mblk_t *mp, char *value, 134 caddr_t cp, cred_t *cr); 135 static mblk_t *icmp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *, 136 const in6_addr_t *, const in6_addr_t *, uint32_t, mblk_t *, int *); 137 static mblk_t *icmp_prepend_header_template(conn_t *, ip_xmit_attr_t *, 138 mblk_t *, const in6_addr_t *, uint32_t, int *); 139 static int icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 140 uchar_t *ptr, int len); 141 static void icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err); 142 static void icmp_tpi_unbind(queue_t *q, mblk_t *mp); 143 static void icmp_wput(queue_t *q, mblk_t *mp); 144 static void icmp_wput_fallback(queue_t *q, mblk_t *mp); 145 static void icmp_wput_other(queue_t *q, mblk_t *mp); 146 static void icmp_wput_iocdata(queue_t *q, mblk_t *mp); 147 static void icmp_wput_restricted(queue_t *q, mblk_t *mp); 148 static void icmp_ulp_recv(conn_t *, mblk_t *, uint_t); 149 150 static void *rawip_stack_init(netstackid_t stackid, netstack_t *ns); 151 static void rawip_stack_fini(netstackid_t stackid, void *arg); 152 153 static void *rawip_kstat_init(netstackid_t stackid); 154 static void rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp); 155 static int rawip_kstat_update(kstat_t *kp, int rw); 156 static void rawip_stack_shutdown(netstackid_t stackid, void *arg); 157 158 /* Common routines for TPI and socket module */ 159 static conn_t *rawip_do_open(int, cred_t *, int *, int); 160 static void rawip_do_close(conn_t *); 161 static int rawip_do_bind(conn_t *, struct sockaddr *, socklen_t); 162 static int rawip_do_unbind(conn_t *); 163 static int rawip_do_connect(conn_t *, const struct sockaddr *, socklen_t, 164 cred_t *, pid_t); 165 166 int rawip_getsockname(sock_lower_handle_t, struct sockaddr *, 167 socklen_t *, cred_t *); 168 int rawip_getpeername(sock_lower_handle_t, struct sockaddr *, 169 socklen_t *, cred_t *); 170 171 static struct module_info icmp_mod_info = { 172 5707, "icmp", 1, INFPSZ, 512, 128 173 }; 174 175 /* 176 * Entry points for ICMP as a device. 177 * We have separate open functions for the /dev/icmp and /dev/icmp6 devices. 178 */ 179 static struct qinit icmprinitv4 = { 180 NULL, NULL, icmp_openv4, icmp_close, NULL, &icmp_mod_info 181 }; 182 183 static struct qinit icmprinitv6 = { 184 NULL, NULL, icmp_openv6, icmp_close, NULL, &icmp_mod_info 185 }; 186 187 static struct qinit icmpwinit = { 188 (pfi_t)icmp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &icmp_mod_info 189 }; 190 191 /* ICMP entry point during fallback */ 192 static struct qinit icmp_fallback_sock_winit = { 193 (pfi_t)icmp_wput_fallback, NULL, NULL, NULL, NULL, &icmp_mod_info 194 }; 195 196 /* For AF_INET aka /dev/icmp */ 197 struct streamtab icmpinfov4 = { 198 &icmprinitv4, &icmpwinit 199 }; 200 201 /* For AF_INET6 aka /dev/icmp6 */ 202 struct streamtab icmpinfov6 = { 203 &icmprinitv6, &icmpwinit 204 }; 205 206 /* Default structure copied into T_INFO_ACK messages */ 207 static struct T_info_ack icmp_g_t_info_ack = { 208 T_INFO_ACK, 209 IP_MAXPACKET, /* TSDU_size. icmp allows maximum size messages. */ 210 T_INVALID, /* ETSDU_size. icmp does not support expedited data. */ 211 T_INVALID, /* CDATA_size. icmp does not support connect data. */ 212 T_INVALID, /* DDATA_size. icmp does not support disconnect data. */ 213 0, /* ADDR_size - filled in later. */ 214 0, /* OPT_size - not initialized here */ 215 IP_MAXPACKET, /* TIDU_size. icmp allows maximum size messages. */ 216 T_CLTS, /* SERV_type. icmp supports connection-less. */ 217 TS_UNBND, /* CURRENT_state. This is set from icmp_state. */ 218 (XPG4_1|SENDZERO) /* PROVIDER_flag */ 219 }; 220 221 /* 222 * Table of ND variables supported by icmp. These are loaded into is_nd 223 * when the stack instance is created. 224 * All of these are alterable, within the min/max values given, at run time. 225 */ 226 static icmpparam_t icmp_param_arr[] = { 227 /* min max value name */ 228 { 0, 128, 32, "icmp_wroff_extra" }, 229 { 1, 255, 255, "icmp_ipv4_ttl" }, 230 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "icmp_ipv6_hoplimit"}, 231 { 0, 1, 1, "icmp_bsd_compat" }, 232 { 4096, 65536, 8192, "icmp_xmit_hiwat"}, 233 { 0, 65536, 1024, "icmp_xmit_lowat"}, 234 { 4096, 65536, 8192, "icmp_recv_hiwat"}, 235 { 65536, 1024*1024*1024, 256*1024, "icmp_max_buf"}, 236 { 0, 1, 0, "icmp_pmtu_discovery" }, 237 { 0, 1, 0, "icmp_sendto_ignerr" }, 238 }; 239 #define is_wroff_extra is_param_arr[0].icmp_param_value 240 #define is_ipv4_ttl is_param_arr[1].icmp_param_value 241 #define is_ipv6_hoplimit is_param_arr[2].icmp_param_value 242 #define is_bsd_compat is_param_arr[3].icmp_param_value 243 #define is_xmit_hiwat is_param_arr[4].icmp_param_value 244 #define is_xmit_lowat is_param_arr[5].icmp_param_value 245 #define is_recv_hiwat is_param_arr[6].icmp_param_value 246 #define is_max_buf is_param_arr[7].icmp_param_value 247 #define is_pmtu_discovery is_param_arr[8].icmp_param_value 248 #define is_sendto_ignerr is_param_arr[9].icmp_param_value 249 250 typedef union T_primitives *t_primp_t; 251 252 /* 253 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message 254 * passed to icmp_wput. 255 * It calls IP to verify the local IP address, and calls IP to insert 256 * the conn_t in the fanout table. 257 * If everything is ok it then sends the T_BIND_ACK back up. 258 */ 259 static void 260 icmp_tpi_bind(queue_t *q, mblk_t *mp) 261 { 262 int error; 263 struct sockaddr *sa; 264 struct T_bind_req *tbr; 265 socklen_t len; 266 sin_t *sin; 267 sin6_t *sin6; 268 icmp_t *icmp; 269 conn_t *connp = Q_TO_CONN(q); 270 mblk_t *mp1; 271 cred_t *cr; 272 273 /* 274 * All Solaris components should pass a db_credp 275 * for this TPI message, hence we ASSERT. 276 * But in case there is some other M_PROTO that looks 277 * like a TPI message sent by some other kernel 278 * component, we check and return an error. 279 */ 280 cr = msg_getcred(mp, NULL); 281 ASSERT(cr != NULL); 282 if (cr == NULL) { 283 icmp_err_ack(q, mp, TSYSERR, EINVAL); 284 return; 285 } 286 287 icmp = connp->conn_icmp; 288 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 289 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 290 "icmp_bind: bad req, len %u", 291 (uint_t)(mp->b_wptr - mp->b_rptr)); 292 icmp_err_ack(q, mp, TPROTO, 0); 293 return; 294 } 295 296 if (icmp->icmp_state != TS_UNBND) { 297 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 298 "icmp_bind: bad state, %u", icmp->icmp_state); 299 icmp_err_ack(q, mp, TOUTSTATE, 0); 300 return; 301 } 302 303 /* 304 * Reallocate the message to make sure we have enough room for an 305 * address. 306 */ 307 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1); 308 if (mp1 == NULL) { 309 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 310 return; 311 } 312 mp = mp1; 313 314 /* Reset the message type in preparation for shipping it back. */ 315 DB_TYPE(mp) = M_PCPROTO; 316 tbr = (struct T_bind_req *)mp->b_rptr; 317 len = tbr->ADDR_length; 318 switch (len) { 319 case 0: /* request for a generic port */ 320 tbr->ADDR_offset = sizeof (struct T_bind_req); 321 if (connp->conn_family == AF_INET) { 322 tbr->ADDR_length = sizeof (sin_t); 323 sin = (sin_t *)&tbr[1]; 324 *sin = sin_null; 325 sin->sin_family = AF_INET; 326 mp->b_wptr = (uchar_t *)&sin[1]; 327 sa = (struct sockaddr *)sin; 328 len = sizeof (sin_t); 329 } else { 330 ASSERT(connp->conn_family == AF_INET6); 331 tbr->ADDR_length = sizeof (sin6_t); 332 sin6 = (sin6_t *)&tbr[1]; 333 *sin6 = sin6_null; 334 sin6->sin6_family = AF_INET6; 335 mp->b_wptr = (uchar_t *)&sin6[1]; 336 sa = (struct sockaddr *)sin6; 337 len = sizeof (sin6_t); 338 } 339 break; 340 341 case sizeof (sin_t): /* Complete IPv4 address */ 342 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset, 343 sizeof (sin_t)); 344 break; 345 346 case sizeof (sin6_t): /* Complete IPv6 address */ 347 sa = (struct sockaddr *)mi_offset_param(mp, 348 tbr->ADDR_offset, sizeof (sin6_t)); 349 break; 350 351 default: 352 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 353 "icmp_bind: bad ADDR_length %u", tbr->ADDR_length); 354 icmp_err_ack(q, mp, TBADADDR, 0); 355 return; 356 } 357 358 error = rawip_do_bind(connp, sa, len); 359 if (error != 0) { 360 if (error > 0) { 361 icmp_err_ack(q, mp, TSYSERR, error); 362 } else { 363 icmp_err_ack(q, mp, -error, 0); 364 } 365 } else { 366 tbr->PRIM_type = T_BIND_ACK; 367 qreply(q, mp); 368 } 369 } 370 371 static int 372 rawip_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len) 373 { 374 sin_t *sin; 375 sin6_t *sin6; 376 icmp_t *icmp = connp->conn_icmp; 377 int error = 0; 378 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */ 379 in_port_t lport; /* Network byte order */ 380 ipaddr_t v4src; /* Set if AF_INET */ 381 in6_addr_t v6src; 382 uint_t scopeid = 0; 383 zoneid_t zoneid = IPCL_ZONEID(connp); 384 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 385 386 if (sa == NULL || !OK_32PTR((char *)sa)) { 387 return (EINVAL); 388 } 389 390 switch (len) { 391 case sizeof (sin_t): /* Complete IPv4 address */ 392 sin = (sin_t *)sa; 393 if (sin->sin_family != AF_INET || 394 connp->conn_family != AF_INET) { 395 /* TSYSERR, EAFNOSUPPORT */ 396 return (EAFNOSUPPORT); 397 } 398 v4src = sin->sin_addr.s_addr; 399 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src); 400 if (v4src != INADDR_ANY) { 401 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst, 402 B_TRUE); 403 } 404 lport = sin->sin_port; 405 break; 406 case sizeof (sin6_t): /* Complete IPv6 address */ 407 sin6 = (sin6_t *)sa; 408 if (sin6->sin6_family != AF_INET6 || 409 connp->conn_family != AF_INET6) { 410 /* TSYSERR, EAFNOSUPPORT */ 411 return (EAFNOSUPPORT); 412 } 413 /* No support for mapped addresses on raw sockets */ 414 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 415 /* TSYSERR, EADDRNOTAVAIL */ 416 return (EADDRNOTAVAIL); 417 } 418 v6src = sin6->sin6_addr; 419 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 420 if (IN6_IS_ADDR_LINKSCOPE(&v6src)) 421 scopeid = sin6->sin6_scope_id; 422 laddr_type = ip_laddr_verify_v6(&v6src, zoneid, ipst, 423 B_TRUE, scopeid); 424 } 425 lport = sin6->sin6_port; 426 break; 427 428 default: 429 /* TBADADDR */ 430 return (EADDRNOTAVAIL); 431 } 432 433 /* Is the local address a valid unicast, multicast, or broadcast? */ 434 if (laddr_type == IPVL_BAD) 435 return (EADDRNOTAVAIL); 436 437 /* 438 * The state must be TS_UNBND. 439 */ 440 mutex_enter(&connp->conn_lock); 441 if (icmp->icmp_state != TS_UNBND) { 442 mutex_exit(&connp->conn_lock); 443 return (-TOUTSTATE); 444 } 445 446 /* 447 * Copy the source address into our icmp structure. This address 448 * may still be zero; if so, ip will fill in the correct address 449 * each time an outbound packet is passed to it. 450 * If we are binding to a broadcast or multicast address then 451 * we just set the conn_bound_addr since we don't want to use 452 * that as the source address when sending. 453 */ 454 connp->conn_bound_addr_v6 = v6src; 455 connp->conn_laddr_v6 = v6src; 456 if (scopeid != 0) { 457 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 458 connp->conn_ixa->ixa_scopeid = scopeid; 459 connp->conn_incoming_ifindex = scopeid; 460 } else { 461 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 462 connp->conn_incoming_ifindex = connp->conn_bound_if; 463 } 464 465 switch (laddr_type) { 466 case IPVL_UNICAST_UP: 467 case IPVL_UNICAST_DOWN: 468 connp->conn_saddr_v6 = v6src; 469 connp->conn_mcbc_bind = B_FALSE; 470 break; 471 case IPVL_MCAST: 472 case IPVL_BCAST: 473 /* ip_set_destination will pick a source address later */ 474 connp->conn_saddr_v6 = ipv6_all_zeros; 475 connp->conn_mcbc_bind = B_TRUE; 476 break; 477 } 478 479 /* Any errors after this point should use late_error */ 480 481 /* 482 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 483 * with IPPROTO_TCP. 484 */ 485 connp->conn_lport = lport; 486 connp->conn_fport = 0; 487 488 if (connp->conn_family == AF_INET) { 489 ASSERT(connp->conn_ipversion == IPV4_VERSION); 490 } else { 491 ASSERT(connp->conn_ipversion == IPV6_VERSION); 492 } 493 494 icmp->icmp_state = TS_IDLE; 495 496 /* 497 * We create an initial header template here to make a subsequent 498 * sendto have a starting point. Since conn_last_dst is zero the 499 * first sendto will always follow the 'dst changed' code path. 500 * Note that we defer massaging options and the related checksum 501 * adjustment until we have a destination address. 502 */ 503 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 504 &connp->conn_faddr_v6, connp->conn_flowinfo); 505 if (error != 0) { 506 mutex_exit(&connp->conn_lock); 507 goto late_error; 508 } 509 /* Just in case */ 510 connp->conn_faddr_v6 = ipv6_all_zeros; 511 connp->conn_v6lastdst = ipv6_all_zeros; 512 mutex_exit(&connp->conn_lock); 513 514 error = ip_laddr_fanout_insert(connp); 515 if (error != 0) 516 goto late_error; 517 518 /* Bind succeeded */ 519 return (0); 520 521 late_error: 522 mutex_enter(&connp->conn_lock); 523 connp->conn_saddr_v6 = ipv6_all_zeros; 524 connp->conn_bound_addr_v6 = ipv6_all_zeros; 525 connp->conn_laddr_v6 = ipv6_all_zeros; 526 if (scopeid != 0) { 527 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 528 connp->conn_incoming_ifindex = connp->conn_bound_if; 529 } 530 icmp->icmp_state = TS_UNBND; 531 connp->conn_v6lastdst = ipv6_all_zeros; 532 connp->conn_lport = 0; 533 534 /* Restore the header that was built above - different source address */ 535 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 536 &connp->conn_faddr_v6, connp->conn_flowinfo); 537 mutex_exit(&connp->conn_lock); 538 return (error); 539 } 540 541 /* 542 * Tell IP to just bind to the protocol. 543 */ 544 static void 545 icmp_bind_proto(icmp_t *icmp) 546 { 547 conn_t *connp = icmp->icmp_connp; 548 549 mutex_enter(&connp->conn_lock); 550 connp->conn_saddr_v6 = ipv6_all_zeros; 551 connp->conn_laddr_v6 = ipv6_all_zeros; 552 connp->conn_faddr_v6 = ipv6_all_zeros; 553 connp->conn_v6lastdst = ipv6_all_zeros; 554 mutex_exit(&connp->conn_lock); 555 556 (void) ip_laddr_fanout_insert(connp); 557 } 558 559 /* 560 * This routine handles each T_CONN_REQ message passed to icmp. It 561 * associates a default destination address with the stream. 562 * 563 * After various error checks are completed, icmp_connect() lays 564 * the target address and port into the composite header template. 565 * Then we ask IP for information, including a source address if we didn't 566 * already have one. Finally we send up the T_OK_ACK reply message. 567 */ 568 static void 569 icmp_tpi_connect(queue_t *q, mblk_t *mp) 570 { 571 conn_t *connp = Q_TO_CONN(q); 572 struct T_conn_req *tcr; 573 struct sockaddr *sa; 574 socklen_t len; 575 int error; 576 cred_t *cr; 577 pid_t pid; 578 /* 579 * All Solaris components should pass a db_credp 580 * for this TPI message, hence we ASSERT. 581 * But in case there is some other M_PROTO that looks 582 * like a TPI message sent by some other kernel 583 * component, we check and return an error. 584 */ 585 cr = msg_getcred(mp, &pid); 586 ASSERT(cr != NULL); 587 if (cr == NULL) { 588 icmp_err_ack(q, mp, TSYSERR, EINVAL); 589 return; 590 } 591 592 tcr = (struct T_conn_req *)mp->b_rptr; 593 /* Sanity checks */ 594 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) { 595 icmp_err_ack(q, mp, TPROTO, 0); 596 return; 597 } 598 599 if (tcr->OPT_length != 0) { 600 icmp_err_ack(q, mp, TBADOPT, 0); 601 return; 602 } 603 604 len = tcr->DEST_length; 605 606 switch (len) { 607 default: 608 icmp_err_ack(q, mp, TBADADDR, 0); 609 return; 610 case sizeof (sin_t): 611 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset, 612 sizeof (sin_t)); 613 break; 614 case sizeof (sin6_t): 615 sa = (struct sockaddr *)mi_offset_param(mp, 616 tcr->DEST_offset, sizeof (sin6_t)); 617 break; 618 } 619 620 error = proto_verify_ip_addr(connp->conn_family, sa, len); 621 if (error != 0) { 622 icmp_err_ack(q, mp, TSYSERR, error); 623 return; 624 } 625 626 error = rawip_do_connect(connp, sa, len, cr, pid); 627 if (error != 0) { 628 if (error < 0) { 629 icmp_err_ack(q, mp, -error, 0); 630 } else { 631 icmp_err_ack(q, mp, 0, error); 632 } 633 } else { 634 mblk_t *mp1; 635 636 /* 637 * We have to send a connection confirmation to 638 * keep TLI happy. 639 */ 640 if (connp->conn_family == AF_INET) { 641 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 642 sizeof (sin_t), NULL, 0); 643 } else { 644 ASSERT(connp->conn_family == AF_INET6); 645 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 646 sizeof (sin6_t), NULL, 0); 647 } 648 if (mp1 == NULL) { 649 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 650 return; 651 } 652 653 /* 654 * Send ok_ack for T_CONN_REQ 655 */ 656 mp = mi_tpi_ok_ack_alloc(mp); 657 if (mp == NULL) { 658 /* Unable to reuse the T_CONN_REQ for the ack. */ 659 icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM); 660 return; 661 } 662 putnext(connp->conn_rq, mp); 663 putnext(connp->conn_rq, mp1); 664 } 665 } 666 667 static int 668 rawip_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 669 cred_t *cr, pid_t pid) 670 { 671 icmp_t *icmp; 672 sin_t *sin; 673 sin6_t *sin6; 674 int error; 675 uint16_t dstport; 676 ipaddr_t v4dst; 677 in6_addr_t v6dst; 678 uint32_t flowinfo; 679 ip_xmit_attr_t *ixa; 680 uint_t scopeid = 0; 681 uint_t srcid = 0; 682 in6_addr_t v6src = connp->conn_saddr_v6; 683 684 icmp = connp->conn_icmp; 685 686 if (sa == NULL || !OK_32PTR((char *)sa)) { 687 return (EINVAL); 688 } 689 690 ASSERT(sa != NULL && len != 0); 691 692 /* 693 * Determine packet type based on type of address passed in 694 * the request should contain an IPv4 or IPv6 address. 695 * Make sure that address family matches the type of 696 * family of the address passed down. 697 */ 698 switch (len) { 699 case sizeof (sin_t): 700 sin = (sin_t *)sa; 701 702 v4dst = sin->sin_addr.s_addr; 703 dstport = sin->sin_port; 704 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 705 ASSERT(connp->conn_ipversion == IPV4_VERSION); 706 break; 707 708 case sizeof (sin6_t): 709 sin6 = (sin6_t *)sa; 710 711 /* No support for mapped addresses on raw sockets */ 712 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 713 return (EADDRNOTAVAIL); 714 } 715 v6dst = sin6->sin6_addr; 716 dstport = sin6->sin6_port; 717 ASSERT(connp->conn_ipversion == IPV6_VERSION); 718 flowinfo = sin6->sin6_flowinfo; 719 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 720 scopeid = sin6->sin6_scope_id; 721 srcid = sin6->__sin6_src_id; 722 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 723 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 724 connp->conn_netstack); 725 } 726 break; 727 } 728 729 /* 730 * If there is a different thread using conn_ixa then we get a new 731 * copy and cut the old one loose from conn_ixa. Otherwise we use 732 * conn_ixa and prevent any other thread from using/changing it. 733 * Once connect() is done other threads can use conn_ixa since the 734 * refcnt will be back at one. 735 */ 736 ixa = conn_get_ixa(connp, B_TRUE); 737 if (ixa == NULL) 738 return (ENOMEM); 739 740 ASSERT(ixa->ixa_refcnt >= 2); 741 ASSERT(ixa == connp->conn_ixa); 742 743 mutex_enter(&connp->conn_lock); 744 /* 745 * This icmp_t must have bound already before doing a connect. 746 * Reject if a connect is in progress (we drop conn_lock during 747 * rawip_do_connect). 748 */ 749 if (icmp->icmp_state == TS_UNBND || icmp->icmp_state == TS_WCON_CREQ) { 750 mutex_exit(&connp->conn_lock); 751 ixa_refrele(ixa); 752 return (-TOUTSTATE); 753 } 754 755 if (icmp->icmp_state == TS_DATA_XFER) { 756 /* Already connected - clear out state */ 757 if (connp->conn_mcbc_bind) 758 connp->conn_saddr_v6 = ipv6_all_zeros; 759 else 760 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 761 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 762 connp->conn_faddr_v6 = ipv6_all_zeros; 763 icmp->icmp_state = TS_IDLE; 764 } 765 766 /* 767 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 768 * with IPPROTO_TCP. 769 */ 770 connp->conn_fport = dstport; 771 if (connp->conn_ipversion == IPV4_VERSION) { 772 /* 773 * Interpret a zero destination to mean loopback. 774 * Update the T_CONN_REQ (sin/sin6) since it is used to 775 * generate the T_CONN_CON. 776 */ 777 if (v4dst == INADDR_ANY) { 778 v4dst = htonl(INADDR_LOOPBACK); 779 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 780 ASSERT(connp->conn_family == AF_INET); 781 sin->sin_addr.s_addr = v4dst; 782 } 783 connp->conn_faddr_v6 = v6dst; 784 connp->conn_flowinfo = 0; 785 } else { 786 ASSERT(connp->conn_ipversion == IPV6_VERSION); 787 /* 788 * Interpret a zero destination to mean loopback. 789 * Update the T_CONN_REQ (sin/sin6) since it is used to 790 * generate the T_CONN_CON. 791 */ 792 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) { 793 v6dst = ipv6_loopback; 794 sin6->sin6_addr = v6dst; 795 } 796 connp->conn_faddr_v6 = v6dst; 797 connp->conn_flowinfo = flowinfo; 798 } 799 800 /* 801 * We update our cred/cpid based on the caller of connect 802 */ 803 if (connp->conn_cred != cr) { 804 crhold(cr); 805 crfree(connp->conn_cred); 806 connp->conn_cred = cr; 807 } 808 connp->conn_cpid = pid; 809 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 810 ixa->ixa_cred = cr; 811 ixa->ixa_cpid = pid; 812 if (is_system_labeled()) { 813 /* We need to restart with a label based on the cred */ 814 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 815 } 816 817 if (scopeid != 0) { 818 ixa->ixa_flags |= IXAF_SCOPEID_SET; 819 ixa->ixa_scopeid = scopeid; 820 connp->conn_incoming_ifindex = scopeid; 821 } else { 822 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 823 connp->conn_incoming_ifindex = connp->conn_bound_if; 824 } 825 826 /* 827 * conn_connect will drop conn_lock and reacquire it. 828 * To prevent a send* from messing with this icmp_t while the lock 829 * is dropped we set icmp_state and clear conn_v6lastdst. 830 * That will make all send* fail with EISCONN. 831 */ 832 connp->conn_v6lastdst = ipv6_all_zeros; 833 icmp->icmp_state = TS_WCON_CREQ; 834 835 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC); 836 mutex_exit(&connp->conn_lock); 837 if (error != 0) 838 goto connect_failed; 839 840 /* 841 * The addresses have been verified. Time to insert in 842 * the correct fanout list. 843 */ 844 error = ipcl_conn_insert(connp); 845 if (error != 0) 846 goto connect_failed; 847 848 mutex_enter(&connp->conn_lock); 849 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 850 &connp->conn_faddr_v6, connp->conn_flowinfo); 851 if (error != 0) { 852 mutex_exit(&connp->conn_lock); 853 goto connect_failed; 854 } 855 856 icmp->icmp_state = TS_DATA_XFER; 857 /* Record this as the "last" send even though we haven't sent any */ 858 connp->conn_v6lastdst = connp->conn_faddr_v6; 859 connp->conn_lastipversion = connp->conn_ipversion; 860 connp->conn_lastdstport = connp->conn_fport; 861 connp->conn_lastflowinfo = connp->conn_flowinfo; 862 connp->conn_lastscopeid = scopeid; 863 connp->conn_lastsrcid = srcid; 864 /* Also remember a source to use together with lastdst */ 865 connp->conn_v6lastsrc = v6src; 866 mutex_exit(&connp->conn_lock); 867 868 ixa_refrele(ixa); 869 return (0); 870 871 connect_failed: 872 if (ixa != NULL) 873 ixa_refrele(ixa); 874 mutex_enter(&connp->conn_lock); 875 icmp->icmp_state = TS_IDLE; 876 /* In case the source address was set above */ 877 if (connp->conn_mcbc_bind) 878 connp->conn_saddr_v6 = ipv6_all_zeros; 879 else 880 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 881 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 882 connp->conn_faddr_v6 = ipv6_all_zeros; 883 connp->conn_v6lastdst = ipv6_all_zeros; 884 connp->conn_flowinfo = 0; 885 886 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 887 &connp->conn_faddr_v6, connp->conn_flowinfo); 888 mutex_exit(&connp->conn_lock); 889 return (error); 890 } 891 892 static void 893 rawip_do_close(conn_t *connp) 894 { 895 ASSERT(connp != NULL && IPCL_IS_RAWIP(connp)); 896 897 ip_quiesce_conn(connp); 898 899 if (!IPCL_IS_NONSTR(connp)) { 900 qprocsoff(connp->conn_rq); 901 } 902 903 icmp_close_free(connp); 904 905 /* 906 * Now we are truly single threaded on this stream, and can 907 * delete the things hanging off the connp, and finally the connp. 908 * We removed this connp from the fanout list, it cannot be 909 * accessed thru the fanouts, and we already waited for the 910 * conn_ref to drop to 0. We are already in close, so 911 * there cannot be any other thread from the top. qprocsoff 912 * has completed, and service has completed or won't run in 913 * future. 914 */ 915 ASSERT(connp->conn_ref == 1); 916 917 if (!IPCL_IS_NONSTR(connp)) { 918 inet_minor_free(connp->conn_minor_arena, connp->conn_dev); 919 } else { 920 ip_free_helper_stream(connp); 921 } 922 923 connp->conn_ref--; 924 ipcl_conn_destroy(connp); 925 } 926 927 static int 928 icmp_close(queue_t *q, int flags) 929 { 930 conn_t *connp; 931 932 if (flags & SO_FALLBACK) { 933 /* 934 * stream is being closed while in fallback 935 * simply free the resources that were allocated 936 */ 937 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr)); 938 qprocsoff(q); 939 goto done; 940 } 941 942 connp = Q_TO_CONN(q); 943 (void) rawip_do_close(connp); 944 done: 945 q->q_ptr = WR(q)->q_ptr = NULL; 946 return (0); 947 } 948 949 static void 950 icmp_close_free(conn_t *connp) 951 { 952 icmp_t *icmp = connp->conn_icmp; 953 954 if (icmp->icmp_filter != NULL) { 955 kmem_free(icmp->icmp_filter, sizeof (icmp6_filter_t)); 956 icmp->icmp_filter = NULL; 957 } 958 959 /* 960 * Clear any fields which the kmem_cache constructor clears. 961 * Only icmp_connp needs to be preserved. 962 * TBD: We should make this more efficient to avoid clearing 963 * everything. 964 */ 965 ASSERT(icmp->icmp_connp == connp); 966 bzero(icmp, sizeof (icmp_t)); 967 icmp->icmp_connp = connp; 968 } 969 970 /* 971 * This routine handles each T_DISCON_REQ message passed to icmp 972 * as an indicating that ICMP is no longer connected. This results 973 * in telling IP to restore the binding to just the local address. 974 */ 975 static int 976 icmp_do_disconnect(conn_t *connp) 977 { 978 icmp_t *icmp = connp->conn_icmp; 979 int error; 980 981 mutex_enter(&connp->conn_lock); 982 if (icmp->icmp_state != TS_DATA_XFER) { 983 mutex_exit(&connp->conn_lock); 984 return (-TOUTSTATE); 985 } 986 if (connp->conn_mcbc_bind) 987 connp->conn_saddr_v6 = ipv6_all_zeros; 988 else 989 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 990 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 991 connp->conn_faddr_v6 = ipv6_all_zeros; 992 icmp->icmp_state = TS_IDLE; 993 994 connp->conn_v6lastdst = ipv6_all_zeros; 995 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 996 &connp->conn_faddr_v6, connp->conn_flowinfo); 997 mutex_exit(&connp->conn_lock); 998 if (error != 0) 999 return (error); 1000 1001 /* 1002 * Tell IP to remove the full binding and revert 1003 * to the local address binding. 1004 */ 1005 return (ip_laddr_fanout_insert(connp)); 1006 } 1007 1008 static void 1009 icmp_tpi_disconnect(queue_t *q, mblk_t *mp) 1010 { 1011 conn_t *connp = Q_TO_CONN(q); 1012 int error; 1013 1014 /* 1015 * Allocate the largest primitive we need to send back 1016 * T_error_ack is > than T_ok_ack 1017 */ 1018 mp = reallocb(mp, sizeof (struct T_error_ack), 1); 1019 if (mp == NULL) { 1020 /* Unable to reuse the T_DISCON_REQ for the ack. */ 1021 icmp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM); 1022 return; 1023 } 1024 1025 error = icmp_do_disconnect(connp); 1026 1027 if (error != 0) { 1028 if (error > 0) { 1029 icmp_err_ack(q, mp, 0, error); 1030 } else { 1031 icmp_err_ack(q, mp, -error, 0); 1032 } 1033 } else { 1034 mp = mi_tpi_ok_ack_alloc(mp); 1035 ASSERT(mp != NULL); 1036 qreply(q, mp); 1037 } 1038 } 1039 1040 static int 1041 icmp_disconnect(conn_t *connp) 1042 { 1043 int error; 1044 1045 connp->conn_dgram_errind = B_FALSE; 1046 1047 error = icmp_do_disconnect(connp); 1048 1049 if (error < 0) 1050 error = proto_tlitosyserr(-error); 1051 return (error); 1052 } 1053 1054 /* This routine creates a T_ERROR_ACK message and passes it upstream. */ 1055 static void 1056 icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error) 1057 { 1058 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 1059 qreply(q, mp); 1060 } 1061 1062 /* Shorthand to generate and send TPI error acks to our client */ 1063 static void 1064 icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 1065 t_scalar_t t_error, int sys_error) 1066 { 1067 struct T_error_ack *teackp; 1068 1069 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 1070 M_PCPROTO, T_ERROR_ACK)) != NULL) { 1071 teackp = (struct T_error_ack *)mp->b_rptr; 1072 teackp->ERROR_prim = primitive; 1073 teackp->TLI_error = t_error; 1074 teackp->UNIX_error = sys_error; 1075 qreply(q, mp); 1076 } 1077 } 1078 1079 /* 1080 * icmp_icmp_input is called as conn_recvicmp to process ICMP messages. 1081 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1082 * Assumes that IP has pulled up everything up to and including the ICMP header. 1083 */ 1084 /* ARGSUSED2 */ 1085 static void 1086 icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 1087 { 1088 conn_t *connp = (conn_t *)arg1; 1089 icmp_t *icmp = connp->conn_icmp; 1090 icmph_t *icmph; 1091 ipha_t *ipha; 1092 int iph_hdr_length; 1093 sin_t sin; 1094 mblk_t *mp1; 1095 int error = 0; 1096 1097 ipha = (ipha_t *)mp->b_rptr; 1098 1099 ASSERT(OK_32PTR(mp->b_rptr)); 1100 1101 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) { 1102 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 1103 icmp_icmp_error_ipv6(connp, mp, ira); 1104 return; 1105 } 1106 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 1107 1108 /* Skip past the outer IP and ICMP headers */ 1109 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length); 1110 iph_hdr_length = ira->ira_ip_hdr_length; 1111 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1112 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */ 1113 1114 iph_hdr_length = IPH_HDR_LENGTH(ipha); 1115 1116 switch (icmph->icmph_type) { 1117 case ICMP_DEST_UNREACHABLE: 1118 switch (icmph->icmph_code) { 1119 case ICMP_FRAGMENTATION_NEEDED: { 1120 ipha_t *ipha; 1121 ip_xmit_attr_t *ixa; 1122 /* 1123 * IP has already adjusted the path MTU. 1124 * But we need to adjust DF for IPv4. 1125 */ 1126 if (connp->conn_ipversion != IPV4_VERSION) 1127 break; 1128 1129 ixa = conn_get_ixa(connp, B_FALSE); 1130 if (ixa == NULL || ixa->ixa_ire == NULL) { 1131 /* 1132 * Some other thread holds conn_ixa. We will 1133 * redo this on the next ICMP too big. 1134 */ 1135 if (ixa != NULL) 1136 ixa_refrele(ixa); 1137 break; 1138 } 1139 (void) ip_get_pmtu(ixa); 1140 1141 mutex_enter(&connp->conn_lock); 1142 ipha = (ipha_t *)connp->conn_ht_iphc; 1143 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 1144 ipha->ipha_fragment_offset_and_flags |= 1145 IPH_DF_HTONS; 1146 } else { 1147 ipha->ipha_fragment_offset_and_flags &= 1148 ~IPH_DF_HTONS; 1149 } 1150 mutex_exit(&connp->conn_lock); 1151 ixa_refrele(ixa); 1152 break; 1153 } 1154 case ICMP_PORT_UNREACHABLE: 1155 case ICMP_PROTOCOL_UNREACHABLE: 1156 error = ECONNREFUSED; 1157 break; 1158 default: 1159 /* Transient errors */ 1160 break; 1161 } 1162 break; 1163 default: 1164 /* Transient errors */ 1165 break; 1166 } 1167 if (error == 0) { 1168 freemsg(mp); 1169 return; 1170 } 1171 1172 /* 1173 * Deliver T_UDERROR_IND when the application has asked for it. 1174 * The socket layer enables this automatically when connected. 1175 */ 1176 if (!connp->conn_dgram_errind) { 1177 freemsg(mp); 1178 return; 1179 } 1180 1181 sin = sin_null; 1182 sin.sin_family = AF_INET; 1183 sin.sin_addr.s_addr = ipha->ipha_dst; 1184 1185 if (IPCL_IS_NONSTR(connp)) { 1186 mutex_enter(&connp->conn_lock); 1187 if (icmp->icmp_state == TS_DATA_XFER) { 1188 if (sin.sin_addr.s_addr == connp->conn_faddr_v4) { 1189 mutex_exit(&connp->conn_lock); 1190 (*connp->conn_upcalls->su_set_error) 1191 (connp->conn_upper_handle, error); 1192 goto done; 1193 } 1194 } else { 1195 icmp->icmp_delayed_error = error; 1196 *((sin_t *)&icmp->icmp_delayed_addr) = sin; 1197 } 1198 mutex_exit(&connp->conn_lock); 1199 } else { 1200 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0, 1201 error); 1202 if (mp1 != NULL) 1203 putnext(connp->conn_rq, mp1); 1204 } 1205 done: 1206 freemsg(mp); 1207 } 1208 1209 /* 1210 * icmp_icmp_error_ipv6 is called by icmp_icmp_error to process ICMP for IPv6. 1211 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1212 * Assumes that IP has pulled up all the extension headers as well as the 1213 * ICMPv6 header. 1214 */ 1215 static void 1216 icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira) 1217 { 1218 icmp6_t *icmp6; 1219 ip6_t *ip6h, *outer_ip6h; 1220 uint16_t iph_hdr_length; 1221 uint8_t *nexthdrp; 1222 sin6_t sin6; 1223 mblk_t *mp1; 1224 int error = 0; 1225 icmp_t *icmp = connp->conn_icmp; 1226 1227 outer_ip6h = (ip6_t *)mp->b_rptr; 1228 #ifdef DEBUG 1229 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6) 1230 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h); 1231 else 1232 iph_hdr_length = IPV6_HDR_LEN; 1233 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length); 1234 #endif 1235 /* Skip past the outer IP and ICMP headers */ 1236 iph_hdr_length = ira->ira_ip_hdr_length; 1237 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 1238 1239 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */ 1240 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) { 1241 freemsg(mp); 1242 return; 1243 } 1244 1245 switch (icmp6->icmp6_type) { 1246 case ICMP6_DST_UNREACH: 1247 switch (icmp6->icmp6_code) { 1248 case ICMP6_DST_UNREACH_NOPORT: 1249 error = ECONNREFUSED; 1250 break; 1251 case ICMP6_DST_UNREACH_ADMIN: 1252 case ICMP6_DST_UNREACH_NOROUTE: 1253 case ICMP6_DST_UNREACH_BEYONDSCOPE: 1254 case ICMP6_DST_UNREACH_ADDR: 1255 /* Transient errors */ 1256 break; 1257 default: 1258 break; 1259 } 1260 break; 1261 case ICMP6_PACKET_TOO_BIG: { 1262 struct T_unitdata_ind *tudi; 1263 struct T_opthdr *toh; 1264 size_t udi_size; 1265 mblk_t *newmp; 1266 t_scalar_t opt_length = sizeof (struct T_opthdr) + 1267 sizeof (struct ip6_mtuinfo); 1268 sin6_t *sin6; 1269 struct ip6_mtuinfo *mtuinfo; 1270 1271 /* 1272 * If the application has requested to receive path mtu 1273 * information, send up an empty message containing an 1274 * IPV6_PATHMTU ancillary data item. 1275 */ 1276 if (!connp->conn_ipv6_recvpathmtu) 1277 break; 1278 1279 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) + 1280 opt_length; 1281 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) { 1282 BUMP_MIB(&icmp->icmp_is->is_rawip_mib, rawipInErrors); 1283 break; 1284 } 1285 1286 /* 1287 * newmp->b_cont is left to NULL on purpose. This is an 1288 * empty message containing only ancillary data. 1289 */ 1290 newmp->b_datap->db_type = M_PROTO; 1291 tudi = (struct T_unitdata_ind *)newmp->b_rptr; 1292 newmp->b_wptr = (uchar_t *)tudi + udi_size; 1293 tudi->PRIM_type = T_UNITDATA_IND; 1294 tudi->SRC_length = sizeof (sin6_t); 1295 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 1296 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t); 1297 tudi->OPT_length = opt_length; 1298 1299 sin6 = (sin6_t *)&tudi[1]; 1300 bzero(sin6, sizeof (sin6_t)); 1301 sin6->sin6_family = AF_INET6; 1302 sin6->sin6_addr = connp->conn_faddr_v6; 1303 1304 toh = (struct T_opthdr *)&sin6[1]; 1305 toh->level = IPPROTO_IPV6; 1306 toh->name = IPV6_PATHMTU; 1307 toh->len = opt_length; 1308 toh->status = 0; 1309 1310 mtuinfo = (struct ip6_mtuinfo *)&toh[1]; 1311 bzero(mtuinfo, sizeof (struct ip6_mtuinfo)); 1312 mtuinfo->ip6m_addr.sin6_family = AF_INET6; 1313 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst; 1314 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu; 1315 /* 1316 * We've consumed everything we need from the original 1317 * message. Free it, then send our empty message. 1318 */ 1319 freemsg(mp); 1320 icmp_ulp_recv(connp, newmp, msgdsize(newmp)); 1321 return; 1322 } 1323 case ICMP6_TIME_EXCEEDED: 1324 /* Transient errors */ 1325 break; 1326 case ICMP6_PARAM_PROB: 1327 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 1328 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 1329 (uchar_t *)ip6h + icmp6->icmp6_pptr == 1330 (uchar_t *)nexthdrp) { 1331 error = ECONNREFUSED; 1332 break; 1333 } 1334 break; 1335 } 1336 if (error == 0) { 1337 freemsg(mp); 1338 return; 1339 } 1340 1341 /* 1342 * Deliver T_UDERROR_IND when the application has asked for it. 1343 * The socket layer enables this automatically when connected. 1344 */ 1345 if (!connp->conn_dgram_errind) { 1346 freemsg(mp); 1347 return; 1348 } 1349 1350 sin6 = sin6_null; 1351 sin6.sin6_family = AF_INET6; 1352 sin6.sin6_addr = ip6h->ip6_dst; 1353 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 1354 if (IPCL_IS_NONSTR(connp)) { 1355 mutex_enter(&connp->conn_lock); 1356 if (icmp->icmp_state == TS_DATA_XFER) { 1357 if (IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr, 1358 &connp->conn_faddr_v6)) { 1359 mutex_exit(&connp->conn_lock); 1360 (*connp->conn_upcalls->su_set_error) 1361 (connp->conn_upper_handle, error); 1362 goto done; 1363 } 1364 } else { 1365 icmp->icmp_delayed_error = error; 1366 *((sin6_t *)&icmp->icmp_delayed_addr) = sin6; 1367 } 1368 mutex_exit(&connp->conn_lock); 1369 } else { 1370 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t), 1371 NULL, 0, error); 1372 if (mp1 != NULL) 1373 putnext(connp->conn_rq, mp1); 1374 } 1375 done: 1376 freemsg(mp); 1377 } 1378 1379 /* 1380 * This routine responds to T_ADDR_REQ messages. It is called by icmp_wput. 1381 * The local address is filled in if endpoint is bound. The remote address 1382 * is filled in if remote address has been precified ("connected endpoint") 1383 * (The concept of connected CLTS sockets is alien to published TPI 1384 * but we support it anyway). 1385 */ 1386 static void 1387 icmp_addr_req(queue_t *q, mblk_t *mp) 1388 { 1389 struct sockaddr *sa; 1390 mblk_t *ackmp; 1391 struct T_addr_ack *taa; 1392 icmp_t *icmp = Q_TO_ICMP(q); 1393 conn_t *connp = icmp->icmp_connp; 1394 uint_t addrlen; 1395 1396 /* Make it large enough for worst case */ 1397 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 1398 2 * sizeof (sin6_t), 1); 1399 if (ackmp == NULL) { 1400 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 1401 return; 1402 } 1403 taa = (struct T_addr_ack *)ackmp->b_rptr; 1404 1405 bzero(taa, sizeof (struct T_addr_ack)); 1406 ackmp->b_wptr = (uchar_t *)&taa[1]; 1407 1408 taa->PRIM_type = T_ADDR_ACK; 1409 ackmp->b_datap->db_type = M_PCPROTO; 1410 1411 if (connp->conn_family == AF_INET) 1412 addrlen = sizeof (sin_t); 1413 else 1414 addrlen = sizeof (sin6_t); 1415 1416 mutex_enter(&connp->conn_lock); 1417 /* 1418 * Note: Following code assumes 32 bit alignment of basic 1419 * data structures like sin_t and struct T_addr_ack. 1420 */ 1421 if (icmp->icmp_state != TS_UNBND) { 1422 /* 1423 * Fill in local address first 1424 */ 1425 taa->LOCADDR_offset = sizeof (*taa); 1426 taa->LOCADDR_length = addrlen; 1427 sa = (struct sockaddr *)&taa[1]; 1428 (void) conn_getsockname(connp, sa, &addrlen); 1429 ackmp->b_wptr += addrlen; 1430 } 1431 if (icmp->icmp_state == TS_DATA_XFER) { 1432 /* 1433 * connected, fill remote address too 1434 */ 1435 taa->REMADDR_length = addrlen; 1436 /* assumed 32-bit alignment */ 1437 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length; 1438 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset); 1439 (void) conn_getpeername(connp, sa, &addrlen); 1440 ackmp->b_wptr += addrlen; 1441 } 1442 mutex_exit(&connp->conn_lock); 1443 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim); 1444 qreply(q, ackmp); 1445 } 1446 1447 static void 1448 icmp_copy_info(struct T_info_ack *tap, icmp_t *icmp) 1449 { 1450 conn_t *connp = icmp->icmp_connp; 1451 1452 *tap = icmp_g_t_info_ack; 1453 1454 if (connp->conn_family == AF_INET6) 1455 tap->ADDR_size = sizeof (sin6_t); 1456 else 1457 tap->ADDR_size = sizeof (sin_t); 1458 tap->CURRENT_state = icmp->icmp_state; 1459 tap->OPT_size = icmp_max_optsize; 1460 } 1461 1462 static void 1463 icmp_do_capability_ack(icmp_t *icmp, struct T_capability_ack *tcap, 1464 t_uscalar_t cap_bits1) 1465 { 1466 tcap->CAP_bits1 = 0; 1467 1468 if (cap_bits1 & TC1_INFO) { 1469 icmp_copy_info(&tcap->INFO_ack, icmp); 1470 tcap->CAP_bits1 |= TC1_INFO; 1471 } 1472 } 1473 1474 /* 1475 * This routine responds to T_CAPABILITY_REQ messages. It is called by 1476 * icmp_wput. Much of the T_CAPABILITY_ACK information is copied from 1477 * icmp_g_t_info_ack. The current state of the stream is copied from 1478 * icmp_state. 1479 */ 1480 static void 1481 icmp_capability_req(queue_t *q, mblk_t *mp) 1482 { 1483 icmp_t *icmp = Q_TO_ICMP(q); 1484 t_uscalar_t cap_bits1; 1485 struct T_capability_ack *tcap; 1486 1487 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 1488 1489 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 1490 mp->b_datap->db_type, T_CAPABILITY_ACK); 1491 if (!mp) 1492 return; 1493 1494 tcap = (struct T_capability_ack *)mp->b_rptr; 1495 1496 icmp_do_capability_ack(icmp, tcap, cap_bits1); 1497 1498 qreply(q, mp); 1499 } 1500 1501 /* 1502 * This routine responds to T_INFO_REQ messages. It is called by icmp_wput. 1503 * Most of the T_INFO_ACK information is copied from icmp_g_t_info_ack. 1504 * The current state of the stream is copied from icmp_state. 1505 */ 1506 static void 1507 icmp_info_req(queue_t *q, mblk_t *mp) 1508 { 1509 icmp_t *icmp = Q_TO_ICMP(q); 1510 1511 /* Create a T_INFO_ACK message. */ 1512 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 1513 T_INFO_ACK); 1514 if (!mp) 1515 return; 1516 icmp_copy_info((struct T_info_ack *)mp->b_rptr, icmp); 1517 qreply(q, mp); 1518 } 1519 1520 static int 1521 icmp_tpi_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 1522 int family) 1523 { 1524 conn_t *connp; 1525 dev_t conn_dev; 1526 int error; 1527 1528 /* If the stream is already open, return immediately. */ 1529 if (q->q_ptr != NULL) 1530 return (0); 1531 1532 if (sflag == MODOPEN) 1533 return (EINVAL); 1534 1535 /* 1536 * Since ICMP is not used so heavily, allocating from the small 1537 * arena should be sufficient. 1538 */ 1539 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 1540 return (EBUSY); 1541 } 1542 1543 if (flag & SO_FALLBACK) { 1544 /* 1545 * Non streams socket needs a stream to fallback to 1546 */ 1547 RD(q)->q_ptr = (void *)conn_dev; 1548 WR(q)->q_qinfo = &icmp_fallback_sock_winit; 1549 WR(q)->q_ptr = (void *)ip_minor_arena_sa; 1550 qprocson(q); 1551 return (0); 1552 } 1553 1554 connp = rawip_do_open(family, credp, &error, KM_SLEEP); 1555 if (connp == NULL) { 1556 ASSERT(error != 0); 1557 inet_minor_free(ip_minor_arena_sa, connp->conn_dev); 1558 return (error); 1559 } 1560 1561 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 1562 connp->conn_dev = conn_dev; 1563 connp->conn_minor_arena = ip_minor_arena_sa; 1564 1565 /* 1566 * Initialize the icmp_t structure for this stream. 1567 */ 1568 q->q_ptr = connp; 1569 WR(q)->q_ptr = connp; 1570 connp->conn_rq = q; 1571 connp->conn_wq = WR(q); 1572 1573 WR(q)->q_hiwat = connp->conn_sndbuf; 1574 WR(q)->q_lowat = connp->conn_sndlowat; 1575 1576 qprocson(q); 1577 1578 /* Set the Stream head write offset. */ 1579 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff); 1580 (void) proto_set_rx_hiwat(connp->conn_rq, connp, connp->conn_rcvbuf); 1581 1582 mutex_enter(&connp->conn_lock); 1583 connp->conn_state_flags &= ~CONN_INCIPIENT; 1584 mutex_exit(&connp->conn_lock); 1585 1586 icmp_bind_proto(connp->conn_icmp); 1587 1588 return (0); 1589 } 1590 1591 /* For /dev/icmp aka AF_INET open */ 1592 static int 1593 icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1594 { 1595 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET)); 1596 } 1597 1598 /* For /dev/icmp6 aka AF_INET6 open */ 1599 static int 1600 icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1601 { 1602 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET6)); 1603 } 1604 1605 /* 1606 * This is the open routine for icmp. It allocates a icmp_t structure for 1607 * the stream and, on the first open of the module, creates an ND table. 1608 */ 1609 static conn_t * 1610 rawip_do_open(int family, cred_t *credp, int *err, int flags) 1611 { 1612 icmp_t *icmp; 1613 conn_t *connp; 1614 zoneid_t zoneid; 1615 netstack_t *ns; 1616 icmp_stack_t *is; 1617 int len; 1618 boolean_t isv6 = B_FALSE; 1619 1620 *err = secpolicy_net_icmpaccess(credp); 1621 if (*err != 0) 1622 return (NULL); 1623 1624 if (family == AF_INET6) 1625 isv6 = B_TRUE; 1626 1627 ns = netstack_find_by_cred(credp); 1628 ASSERT(ns != NULL); 1629 is = ns->netstack_icmp; 1630 ASSERT(is != NULL); 1631 1632 /* 1633 * For exclusive stacks we set the zoneid to zero 1634 * to make ICMP operate as if in the global zone. 1635 */ 1636 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1637 zoneid = GLOBAL_ZONEID; 1638 else 1639 zoneid = crgetzoneid(credp); 1640 1641 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP); 1642 1643 connp = ipcl_conn_create(IPCL_RAWIPCONN, flags, ns); 1644 icmp = connp->conn_icmp; 1645 1646 /* 1647 * ipcl_conn_create did a netstack_hold. Undo the hold that was 1648 * done by netstack_find_by_cred() 1649 */ 1650 netstack_rele(ns); 1651 1652 /* 1653 * Since this conn_t/icmp_t is not yet visible to anybody else we don't 1654 * need to lock anything. 1655 */ 1656 ASSERT(connp->conn_proto == IPPROTO_ICMP); 1657 ASSERT(connp->conn_icmp == icmp); 1658 ASSERT(icmp->icmp_connp == connp); 1659 1660 /* Set the initial state of the stream and the privilege status. */ 1661 icmp->icmp_state = TS_UNBND; 1662 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 1663 if (isv6) { 1664 connp->conn_family = AF_INET6; 1665 connp->conn_ipversion = IPV6_VERSION; 1666 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4; 1667 connp->conn_proto = IPPROTO_ICMPV6; 1668 /* May be changed by a SO_PROTOTYPE socket option. */ 1669 connp->conn_proto = IPPROTO_ICMPV6; 1670 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1671 connp->conn_ixa->ixa_raw_cksum_offset = 2; 1672 connp->conn_default_ttl = is->is_ipv6_hoplimit; 1673 len = sizeof (ip6_t); 1674 } else { 1675 connp->conn_family = AF_INET; 1676 connp->conn_ipversion = IPV4_VERSION; 1677 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4; 1678 /* May be changed by a SO_PROTOTYPE socket option. */ 1679 connp->conn_proto = IPPROTO_ICMP; 1680 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1681 connp->conn_default_ttl = is->is_ipv4_ttl; 1682 len = sizeof (ipha_t); 1683 } 1684 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 1685 1686 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1687 1688 /* 1689 * For the socket of protocol IPPROTO_RAW or when IP_HDRINCL is set, 1690 * the checksum is provided in the pre-built packet. We clear 1691 * IXAF_SET_ULP_CKSUM to tell IP that the application has sent a 1692 * complete IP header and not to compute the transport checksum. 1693 */ 1694 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM; 1695 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 1696 connp->conn_ixa->ixa_zoneid = zoneid; 1697 1698 connp->conn_zoneid = zoneid; 1699 1700 /* 1701 * If the caller has the process-wide flag set, then default to MAC 1702 * exempt mode. This allows read-down to unlabeled hosts. 1703 */ 1704 if (getpflags(NET_MAC_AWARE, credp) != 0) 1705 connp->conn_mac_mode = CONN_MAC_AWARE; 1706 1707 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 1708 1709 icmp->icmp_is = is; 1710 1711 connp->conn_rcvbuf = is->is_recv_hiwat; 1712 connp->conn_sndbuf = is->is_xmit_hiwat; 1713 connp->conn_sndlowat = is->is_xmit_lowat; 1714 connp->conn_rcvlowat = icmp_mod_info.mi_lowat; 1715 1716 connp->conn_wroff = len + is->is_wroff_extra; 1717 connp->conn_so_type = SOCK_RAW; 1718 1719 connp->conn_recv = icmp_input; 1720 connp->conn_recvicmp = icmp_icmp_input; 1721 crhold(credp); 1722 connp->conn_cred = credp; 1723 connp->conn_cpid = curproc->p_pid; 1724 connp->conn_open_time = ddi_get_lbolt64(); 1725 /* Cache things in ixa without an extra refhold */ 1726 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 1727 connp->conn_ixa->ixa_cred = connp->conn_cred; 1728 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 1729 if (is_system_labeled()) 1730 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 1731 1732 connp->conn_flow_cntrld = B_FALSE; 1733 1734 if (is->is_pmtu_discovery) 1735 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 1736 1737 return (connp); 1738 } 1739 1740 /* 1741 * Which ICMP options OK to set through T_UNITDATA_REQ... 1742 */ 1743 /* ARGSUSED */ 1744 static boolean_t 1745 icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name) 1746 { 1747 return (B_TRUE); 1748 } 1749 1750 /* 1751 * This routine gets default values of certain options whose default 1752 * values are maintained by protcol specific code 1753 */ 1754 int 1755 icmp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr) 1756 { 1757 icmp_t *icmp = Q_TO_ICMP(q); 1758 icmp_stack_t *is = icmp->icmp_is; 1759 int *i1 = (int *)ptr; 1760 1761 switch (level) { 1762 case IPPROTO_IP: 1763 switch (name) { 1764 case IP_MULTICAST_TTL: 1765 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL; 1766 return (sizeof (uchar_t)); 1767 case IP_MULTICAST_LOOP: 1768 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP; 1769 return (sizeof (uchar_t)); 1770 } 1771 break; 1772 case IPPROTO_IPV6: 1773 switch (name) { 1774 case IPV6_MULTICAST_HOPS: 1775 *i1 = IP_DEFAULT_MULTICAST_TTL; 1776 return (sizeof (int)); 1777 case IPV6_MULTICAST_LOOP: 1778 *i1 = IP_DEFAULT_MULTICAST_LOOP; 1779 return (sizeof (int)); 1780 case IPV6_UNICAST_HOPS: 1781 *i1 = is->is_ipv6_hoplimit; 1782 return (sizeof (int)); 1783 } 1784 break; 1785 case IPPROTO_ICMPV6: 1786 switch (name) { 1787 case ICMP6_FILTER: 1788 /* Make it look like "pass all" */ 1789 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1790 return (sizeof (icmp6_filter_t)); 1791 } 1792 break; 1793 } 1794 return (-1); 1795 } 1796 1797 /* 1798 * This routine retrieves the current status of socket options. 1799 * It returns the size of the option retrieved, or -1. 1800 */ 1801 int 1802 icmp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr) 1803 { 1804 icmp_t *icmp = connp->conn_icmp; 1805 int *i1 = (int *)ptr; 1806 conn_opt_arg_t coas; 1807 int retval; 1808 1809 coas.coa_connp = connp; 1810 coas.coa_ixa = connp->conn_ixa; 1811 coas.coa_ipp = &connp->conn_xmit_ipp; 1812 coas.coa_ancillary = B_FALSE; 1813 coas.coa_changed = 0; 1814 1815 /* 1816 * We assume that the optcom framework has checked for the set 1817 * of levels and names that are supported, hence we don't worry 1818 * about rejecting based on that. 1819 * First check for ICMP specific handling, then pass to common routine. 1820 */ 1821 switch (level) { 1822 case IPPROTO_IP: 1823 /* 1824 * Only allow IPv4 option processing on IPv4 sockets. 1825 */ 1826 if (connp->conn_family != AF_INET) 1827 return (-1); 1828 1829 switch (name) { 1830 case IP_OPTIONS: 1831 case T_IP_OPTIONS: 1832 /* Options are passed up with each packet */ 1833 return (0); 1834 case IP_HDRINCL: 1835 mutex_enter(&connp->conn_lock); 1836 *i1 = (int)icmp->icmp_hdrincl; 1837 mutex_exit(&connp->conn_lock); 1838 return (sizeof (int)); 1839 } 1840 break; 1841 1842 case IPPROTO_IPV6: 1843 /* 1844 * Only allow IPv6 option processing on native IPv6 sockets. 1845 */ 1846 if (connp->conn_family != AF_INET6) 1847 return (-1); 1848 1849 switch (name) { 1850 case IPV6_CHECKSUM: 1851 /* 1852 * Return offset or -1 if no checksum offset. 1853 * Does not apply to IPPROTO_ICMPV6 1854 */ 1855 if (connp->conn_proto == IPPROTO_ICMPV6) 1856 return (-1); 1857 1858 mutex_enter(&connp->conn_lock); 1859 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) 1860 *i1 = connp->conn_ixa->ixa_raw_cksum_offset; 1861 else 1862 *i1 = -1; 1863 mutex_exit(&connp->conn_lock); 1864 return (sizeof (int)); 1865 } 1866 break; 1867 1868 case IPPROTO_ICMPV6: 1869 /* 1870 * Only allow IPv6 option processing on native IPv6 sockets. 1871 */ 1872 if (connp->conn_family != AF_INET6) 1873 return (-1); 1874 1875 if (connp->conn_proto != IPPROTO_ICMPV6) 1876 return (-1); 1877 1878 switch (name) { 1879 case ICMP6_FILTER: 1880 mutex_enter(&connp->conn_lock); 1881 if (icmp->icmp_filter == NULL) { 1882 /* Make it look like "pass all" */ 1883 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1884 } else { 1885 (void) bcopy(icmp->icmp_filter, ptr, 1886 sizeof (icmp6_filter_t)); 1887 } 1888 mutex_exit(&connp->conn_lock); 1889 return (sizeof (icmp6_filter_t)); 1890 } 1891 } 1892 mutex_enter(&connp->conn_lock); 1893 retval = conn_opt_get(&coas, level, name, ptr); 1894 mutex_exit(&connp->conn_lock); 1895 return (retval); 1896 } 1897 1898 /* 1899 * This routine retrieves the current status of socket options. 1900 * It returns the size of the option retrieved, or -1. 1901 */ 1902 int 1903 icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 1904 { 1905 conn_t *connp = Q_TO_CONN(q); 1906 int err; 1907 1908 err = icmp_opt_get(connp, level, name, ptr); 1909 return (err); 1910 } 1911 1912 /* 1913 * This routine sets socket options. 1914 */ 1915 int 1916 icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name, 1917 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly) 1918 { 1919 conn_t *connp = coa->coa_connp; 1920 ip_xmit_attr_t *ixa = coa->coa_ixa; 1921 icmp_t *icmp = connp->conn_icmp; 1922 icmp_stack_t *is = icmp->icmp_is; 1923 int *i1 = (int *)invalp; 1924 boolean_t onoff = (*i1 == 0) ? 0 : 1; 1925 int error; 1926 1927 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock)); 1928 1929 /* 1930 * For fixed length options, no sanity check 1931 * of passed in length is done. It is assumed *_optcom_req() 1932 * routines do the right thing. 1933 */ 1934 1935 switch (level) { 1936 case SOL_SOCKET: 1937 switch (name) { 1938 case SO_PROTOTYPE: 1939 if ((*i1 & 0xFF) != IPPROTO_ICMP && 1940 (*i1 & 0xFF) != IPPROTO_ICMPV6 && 1941 secpolicy_net_rawaccess(cr) != 0) { 1942 return (EACCES); 1943 } 1944 if (checkonly) 1945 break; 1946 1947 mutex_enter(&connp->conn_lock); 1948 connp->conn_proto = *i1 & 0xFF; 1949 ixa->ixa_protocol = connp->conn_proto; 1950 if ((connp->conn_proto == IPPROTO_RAW || 1951 connp->conn_proto == IPPROTO_IGMP) && 1952 connp->conn_family == AF_INET) { 1953 icmp->icmp_hdrincl = 1; 1954 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 1955 } else if (connp->conn_proto == IPPROTO_UDP || 1956 connp->conn_proto == IPPROTO_TCP || 1957 connp->conn_proto == IPPROTO_SCTP) { 1958 /* Used by test applications like psh */ 1959 icmp->icmp_hdrincl = 0; 1960 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 1961 } else { 1962 icmp->icmp_hdrincl = 0; 1963 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 1964 } 1965 1966 if (connp->conn_family == AF_INET6 && 1967 connp->conn_proto == IPPROTO_ICMPV6) { 1968 /* Set offset for icmp6_cksum */ 1969 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 1970 ixa->ixa_raw_cksum_offset = 2; 1971 } 1972 if (icmp->icmp_filter != NULL && 1973 connp->conn_proto != IPPROTO_ICMPV6) { 1974 kmem_free(icmp->icmp_filter, 1975 sizeof (icmp6_filter_t)); 1976 icmp->icmp_filter = NULL; 1977 } 1978 mutex_exit(&connp->conn_lock); 1979 1980 coa->coa_changed |= COA_HEADER_CHANGED; 1981 /* 1982 * For SCTP, we don't use icmp_bind_proto() for 1983 * raw socket binding. 1984 */ 1985 if (connp->conn_proto == IPPROTO_SCTP) 1986 return (0); 1987 1988 coa->coa_changed |= COA_ICMP_BIND_NEEDED; 1989 return (0); 1990 1991 case SO_SNDBUF: 1992 if (*i1 > is->is_max_buf) { 1993 return (ENOBUFS); 1994 } 1995 break; 1996 case SO_RCVBUF: 1997 if (*i1 > is->is_max_buf) { 1998 return (ENOBUFS); 1999 } 2000 break; 2001 } 2002 break; 2003 2004 case IPPROTO_IP: 2005 /* 2006 * Only allow IPv4 option processing on IPv4 sockets. 2007 */ 2008 if (connp->conn_family != AF_INET) 2009 return (EINVAL); 2010 2011 switch (name) { 2012 case IP_HDRINCL: 2013 if (!checkonly) { 2014 mutex_enter(&connp->conn_lock); 2015 icmp->icmp_hdrincl = onoff; 2016 if (onoff) 2017 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2018 else 2019 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2020 mutex_exit(&connp->conn_lock); 2021 } 2022 break; 2023 } 2024 break; 2025 2026 case IPPROTO_IPV6: 2027 if (connp->conn_family != AF_INET6) 2028 return (EINVAL); 2029 2030 switch (name) { 2031 case IPV6_CHECKSUM: 2032 /* 2033 * Integer offset into the user data of where the 2034 * checksum is located. 2035 * Offset of -1 disables option. 2036 * Does not apply to IPPROTO_ICMPV6. 2037 */ 2038 if (connp->conn_proto == IPPROTO_ICMPV6 || 2039 coa->coa_ancillary) { 2040 return (EINVAL); 2041 } 2042 if ((*i1 != -1) && ((*i1 < 0) || (*i1 & 0x1) != 0)) { 2043 /* Negative or not 16 bit aligned offset */ 2044 return (EINVAL); 2045 } 2046 if (checkonly) 2047 break; 2048 2049 mutex_enter(&connp->conn_lock); 2050 if (*i1 == -1) { 2051 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 2052 ixa->ixa_raw_cksum_offset = 0; 2053 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2054 } else { 2055 ixa->ixa_flags |= IXAF_SET_RAW_CKSUM; 2056 ixa->ixa_raw_cksum_offset = *i1; 2057 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2058 } 2059 mutex_exit(&connp->conn_lock); 2060 break; 2061 } 2062 break; 2063 2064 case IPPROTO_ICMPV6: 2065 /* 2066 * Only allow IPv6 option processing on IPv6 sockets. 2067 */ 2068 if (connp->conn_family != AF_INET6) 2069 return (EINVAL); 2070 if (connp->conn_proto != IPPROTO_ICMPV6) 2071 return (EINVAL); 2072 2073 switch (name) { 2074 case ICMP6_FILTER: 2075 if (checkonly) 2076 break; 2077 2078 if ((inlen != 0) && 2079 (inlen != sizeof (icmp6_filter_t))) 2080 return (EINVAL); 2081 2082 mutex_enter(&connp->conn_lock); 2083 if (inlen == 0) { 2084 if (icmp->icmp_filter != NULL) { 2085 kmem_free(icmp->icmp_filter, 2086 sizeof (icmp6_filter_t)); 2087 icmp->icmp_filter = NULL; 2088 } 2089 } else { 2090 if (icmp->icmp_filter == NULL) { 2091 icmp->icmp_filter = kmem_alloc( 2092 sizeof (icmp6_filter_t), 2093 KM_NOSLEEP); 2094 if (icmp->icmp_filter == NULL) { 2095 mutex_exit(&connp->conn_lock); 2096 return (ENOBUFS); 2097 } 2098 } 2099 (void) bcopy(invalp, icmp->icmp_filter, inlen); 2100 } 2101 mutex_exit(&connp->conn_lock); 2102 break; 2103 } 2104 break; 2105 } 2106 error = conn_opt_set(coa, level, name, inlen, invalp, 2107 checkonly, cr); 2108 return (error); 2109 } 2110 2111 /* 2112 * This routine sets socket options. 2113 */ 2114 int 2115 icmp_opt_set(conn_t *connp, uint_t optset_context, int level, int name, 2116 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2117 void *thisdg_attrs, cred_t *cr) 2118 { 2119 icmp_t *icmp = connp->conn_icmp; 2120 int err; 2121 conn_opt_arg_t coas, *coa; 2122 boolean_t checkonly; 2123 icmp_stack_t *is = icmp->icmp_is; 2124 2125 switch (optset_context) { 2126 case SETFN_OPTCOM_CHECKONLY: 2127 checkonly = B_TRUE; 2128 /* 2129 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 2130 * inlen != 0 implies value supplied and 2131 * we have to "pretend" to set it. 2132 * inlen == 0 implies that there is no 2133 * value part in T_CHECK request and just validation 2134 * done elsewhere should be enough, we just return here. 2135 */ 2136 if (inlen == 0) { 2137 *outlenp = 0; 2138 return (0); 2139 } 2140 break; 2141 case SETFN_OPTCOM_NEGOTIATE: 2142 checkonly = B_FALSE; 2143 break; 2144 case SETFN_UD_NEGOTIATE: 2145 case SETFN_CONN_NEGOTIATE: 2146 checkonly = B_FALSE; 2147 /* 2148 * Negotiating local and "association-related" options 2149 * through T_UNITDATA_REQ. 2150 * 2151 * Following routine can filter out ones we do not 2152 * want to be "set" this way. 2153 */ 2154 if (!icmp_opt_allow_udr_set(level, name)) { 2155 *outlenp = 0; 2156 return (EINVAL); 2157 } 2158 break; 2159 default: 2160 /* 2161 * We should never get here 2162 */ 2163 *outlenp = 0; 2164 return (EINVAL); 2165 } 2166 2167 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 2168 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 2169 2170 if (thisdg_attrs != NULL) { 2171 /* Options from T_UNITDATA_REQ */ 2172 coa = (conn_opt_arg_t *)thisdg_attrs; 2173 ASSERT(coa->coa_connp == connp); 2174 ASSERT(coa->coa_ixa != NULL); 2175 ASSERT(coa->coa_ipp != NULL); 2176 ASSERT(coa->coa_ancillary); 2177 } else { 2178 coa = &coas; 2179 coas.coa_connp = connp; 2180 /* Get a reference on conn_ixa to prevent concurrent mods */ 2181 coas.coa_ixa = conn_get_ixa(connp, B_TRUE); 2182 if (coas.coa_ixa == NULL) { 2183 *outlenp = 0; 2184 return (ENOMEM); 2185 } 2186 coas.coa_ipp = &connp->conn_xmit_ipp; 2187 coas.coa_ancillary = B_FALSE; 2188 coas.coa_changed = 0; 2189 } 2190 2191 err = icmp_do_opt_set(coa, level, name, inlen, invalp, 2192 cr, checkonly); 2193 if (err != 0) { 2194 errout: 2195 if (!coa->coa_ancillary) 2196 ixa_refrele(coa->coa_ixa); 2197 *outlenp = 0; 2198 return (err); 2199 } 2200 2201 /* 2202 * Common case of OK return with outval same as inval. 2203 */ 2204 if (invalp != outvalp) { 2205 /* don't trust bcopy for identical src/dst */ 2206 (void) bcopy(invalp, outvalp, inlen); 2207 } 2208 *outlenp = inlen; 2209 2210 /* 2211 * If this was not ancillary data, then we rebuild the headers, 2212 * update the IRE/NCE, and IPsec as needed. 2213 * Since the label depends on the destination we go through 2214 * ip_set_destination first. 2215 */ 2216 if (coa->coa_ancillary) { 2217 return (0); 2218 } 2219 2220 if (coa->coa_changed & COA_ROUTE_CHANGED) { 2221 in6_addr_t saddr, faddr, nexthop; 2222 in_port_t fport; 2223 2224 /* 2225 * We clear lastdst to make sure we pick up the change 2226 * next time sending. 2227 * If we are connected we re-cache the information. 2228 * We ignore errors to preserve BSD behavior. 2229 * Note that we don't redo IPsec policy lookup here 2230 * since the final destination (or source) didn't change. 2231 */ 2232 mutex_enter(&connp->conn_lock); 2233 connp->conn_v6lastdst = ipv6_all_zeros; 2234 2235 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa, 2236 &connp->conn_faddr_v6, &nexthop); 2237 saddr = connp->conn_saddr_v6; 2238 faddr = connp->conn_faddr_v6; 2239 fport = connp->conn_fport; 2240 mutex_exit(&connp->conn_lock); 2241 2242 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) && 2243 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) { 2244 (void) ip_attr_connect(connp, coa->coa_ixa, 2245 &saddr, &faddr, &nexthop, fport, NULL, NULL, 2246 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 2247 } 2248 } 2249 2250 ixa_refrele(coa->coa_ixa); 2251 2252 if (coa->coa_changed & COA_HEADER_CHANGED) { 2253 /* 2254 * Rebuild the header template if we are connected. 2255 * Otherwise clear conn_v6lastdst so we rebuild the header 2256 * in the data path. 2257 */ 2258 mutex_enter(&connp->conn_lock); 2259 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) && 2260 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) { 2261 err = icmp_build_hdr_template(connp, 2262 &connp->conn_saddr_v6, &connp->conn_faddr_v6, 2263 connp->conn_flowinfo); 2264 if (err != 0) { 2265 mutex_exit(&connp->conn_lock); 2266 return (err); 2267 } 2268 } else { 2269 connp->conn_v6lastdst = ipv6_all_zeros; 2270 } 2271 mutex_exit(&connp->conn_lock); 2272 } 2273 if (coa->coa_changed & COA_RCVBUF_CHANGED) { 2274 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 2275 connp->conn_rcvbuf); 2276 } 2277 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) { 2278 connp->conn_wq->q_hiwat = connp->conn_sndbuf; 2279 } 2280 if (coa->coa_changed & COA_WROFF_CHANGED) { 2281 /* Increase wroff if needed */ 2282 uint_t wroff; 2283 2284 mutex_enter(&connp->conn_lock); 2285 wroff = connp->conn_ht_iphc_allocated + is->is_wroff_extra; 2286 if (wroff > connp->conn_wroff) { 2287 connp->conn_wroff = wroff; 2288 mutex_exit(&connp->conn_lock); 2289 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff); 2290 } else { 2291 mutex_exit(&connp->conn_lock); 2292 } 2293 } 2294 if (coa->coa_changed & COA_ICMP_BIND_NEEDED) { 2295 icmp_bind_proto(icmp); 2296 } 2297 return (err); 2298 } 2299 2300 /* This routine sets socket options. */ 2301 int 2302 icmp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name, 2303 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2304 void *thisdg_attrs, cred_t *cr) 2305 { 2306 conn_t *connp = Q_TO_CONN(q); 2307 int error; 2308 2309 error = icmp_opt_set(connp, optset_context, level, name, inlen, invalp, 2310 outlenp, outvalp, thisdg_attrs, cr); 2311 return (error); 2312 } 2313 2314 /* 2315 * Setup IP headers. 2316 * 2317 * Note that IP_HDRINCL has ipha_protocol that is different than conn_proto, 2318 * but icmp_output_hdrincl restores ipha_protocol once we return. 2319 */ 2320 mblk_t * 2321 icmp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp, 2322 const in6_addr_t *v6src, const in6_addr_t *v6dst, uint32_t flowinfo, 2323 mblk_t *data_mp, int *errorp) 2324 { 2325 mblk_t *mp; 2326 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2327 uint_t data_len; 2328 uint32_t cksum; 2329 2330 data_len = msgdsize(data_mp); 2331 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, connp->conn_proto, 2332 flowinfo, 0, data_mp, data_len, is->is_wroff_extra, &cksum, errorp); 2333 if (mp == NULL) { 2334 ASSERT(*errorp != 0); 2335 return (NULL); 2336 } 2337 2338 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length; 2339 2340 /* 2341 * If there was a routing option/header then conn_prepend_hdr 2342 * has massaged it and placed the pseudo-header checksum difference 2343 * in the cksum argument. 2344 * 2345 * Prepare for ICMPv6 checksum done in IP. 2346 * 2347 * We make it easy for IP to include our pseudo header 2348 * by putting our length (and any routing header adjustment) 2349 * in the ICMPv6 checksum field. 2350 * The IP source, destination, and length have already been set by 2351 * conn_prepend_hdr. 2352 */ 2353 cksum += data_len; 2354 cksum = (cksum >> 16) + (cksum & 0xFFFF); 2355 ASSERT(cksum < 0x10000); 2356 2357 if (ixa->ixa_flags & IXAF_IS_IPV4) { 2358 ipha_t *ipha = (ipha_t *)mp->b_rptr; 2359 2360 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen); 2361 } else { 2362 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 2363 uint_t cksum_offset = 0; 2364 2365 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen); 2366 2367 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 2368 if (connp->conn_proto == IPPROTO_ICMPV6) { 2369 cksum_offset = ixa->ixa_ip_hdr_length + 2370 offsetof(icmp6_t, icmp6_cksum); 2371 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2372 cksum_offset = ixa->ixa_ip_hdr_length + 2373 ixa->ixa_raw_cksum_offset; 2374 } 2375 } 2376 if (cksum_offset != 0) { 2377 uint16_t *ptr; 2378 2379 /* Make sure the checksum fits in the first mblk */ 2380 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 2381 mblk_t *mp1; 2382 2383 mp1 = msgpullup(mp, 2384 cksum_offset + sizeof (short)); 2385 freemsg(mp); 2386 if (mp1 == NULL) { 2387 *errorp = ENOMEM; 2388 return (NULL); 2389 } 2390 mp = mp1; 2391 ip6h = (ip6_t *)mp->b_rptr; 2392 } 2393 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 2394 *ptr = htons(cksum); 2395 } 2396 } 2397 2398 /* Note that we don't try to update wroff due to ancillary data */ 2399 return (mp); 2400 } 2401 2402 static int 2403 icmp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src, 2404 const in6_addr_t *v6dst, uint32_t flowinfo) 2405 { 2406 int error; 2407 2408 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2409 /* 2410 * We clear lastdst to make sure we don't use the lastdst path 2411 * next time sending since we might not have set v6dst yet. 2412 */ 2413 connp->conn_v6lastdst = ipv6_all_zeros; 2414 2415 error = conn_build_hdr_template(connp, 0, 0, v6src, v6dst, flowinfo); 2416 if (error != 0) 2417 return (error); 2418 2419 /* 2420 * Any routing header/option has been massaged. The checksum difference 2421 * is stored in conn_sum. 2422 */ 2423 return (0); 2424 } 2425 2426 /* 2427 * This routine retrieves the value of an ND variable in a icmpparam_t 2428 * structure. It is called through nd_getset when a user reads the 2429 * variable. 2430 */ 2431 /* ARGSUSED */ 2432 static int 2433 icmp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 2434 { 2435 icmpparam_t *icmppa = (icmpparam_t *)cp; 2436 2437 (void) mi_mpprintf(mp, "%d", icmppa->icmp_param_value); 2438 return (0); 2439 } 2440 2441 /* 2442 * Walk through the param array specified registering each element with the 2443 * named dispatch (ND) handler. 2444 */ 2445 static boolean_t 2446 icmp_param_register(IDP *ndp, icmpparam_t *icmppa, int cnt) 2447 { 2448 for (; cnt-- > 0; icmppa++) { 2449 if (icmppa->icmp_param_name && icmppa->icmp_param_name[0]) { 2450 if (!nd_load(ndp, icmppa->icmp_param_name, 2451 icmp_param_get, icmp_param_set, 2452 (caddr_t)icmppa)) { 2453 nd_free(ndp); 2454 return (B_FALSE); 2455 } 2456 } 2457 } 2458 return (B_TRUE); 2459 } 2460 2461 /* This routine sets an ND variable in a icmpparam_t structure. */ 2462 /* ARGSUSED */ 2463 static int 2464 icmp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 2465 { 2466 long new_value; 2467 icmpparam_t *icmppa = (icmpparam_t *)cp; 2468 2469 /* 2470 * Fail the request if the new value does not lie within the 2471 * required bounds. 2472 */ 2473 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 2474 new_value < icmppa->icmp_param_min || 2475 new_value > icmppa->icmp_param_max) { 2476 return (EINVAL); 2477 } 2478 /* Set the new value */ 2479 icmppa->icmp_param_value = new_value; 2480 return (0); 2481 } 2482 2483 static mblk_t * 2484 icmp_queue_fallback(icmp_t *icmp, mblk_t *mp) 2485 { 2486 ASSERT(MUTEX_HELD(&icmp->icmp_recv_lock)); 2487 if (IPCL_IS_NONSTR(icmp->icmp_connp)) { 2488 /* 2489 * fallback has started but messages have not been moved yet 2490 */ 2491 if (icmp->icmp_fallback_queue_head == NULL) { 2492 ASSERT(icmp->icmp_fallback_queue_tail == NULL); 2493 icmp->icmp_fallback_queue_head = mp; 2494 icmp->icmp_fallback_queue_tail = mp; 2495 } else { 2496 ASSERT(icmp->icmp_fallback_queue_tail != NULL); 2497 icmp->icmp_fallback_queue_tail->b_next = mp; 2498 icmp->icmp_fallback_queue_tail = mp; 2499 } 2500 return (NULL); 2501 } else { 2502 /* 2503 * Fallback completed, let the caller putnext() the mblk. 2504 */ 2505 return (mp); 2506 } 2507 } 2508 2509 /* 2510 * Deliver data to ULP. In case we have a socket, and it's falling back to 2511 * TPI, then we'll queue the mp for later processing. 2512 */ 2513 static void 2514 icmp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len) 2515 { 2516 if (IPCL_IS_NONSTR(connp)) { 2517 icmp_t *icmp = connp->conn_icmp; 2518 int error; 2519 2520 ASSERT(len == msgdsize(mp)); 2521 if ((*connp->conn_upcalls->su_recv) 2522 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) { 2523 mutex_enter(&icmp->icmp_recv_lock); 2524 if (error == ENOSPC) { 2525 /* 2526 * let's confirm while holding the lock 2527 */ 2528 if ((*connp->conn_upcalls->su_recv) 2529 (connp->conn_upper_handle, NULL, 0, 0, 2530 &error, NULL) < 0) { 2531 ASSERT(error == ENOSPC); 2532 if (error == ENOSPC) { 2533 connp->conn_flow_cntrld = 2534 B_TRUE; 2535 } 2536 } 2537 mutex_exit(&icmp->icmp_recv_lock); 2538 } else { 2539 ASSERT(error == EOPNOTSUPP); 2540 mp = icmp_queue_fallback(icmp, mp); 2541 mutex_exit(&icmp->icmp_recv_lock); 2542 if (mp != NULL) 2543 putnext(connp->conn_rq, mp); 2544 } 2545 } 2546 ASSERT(MUTEX_NOT_HELD(&icmp->icmp_recv_lock)); 2547 } else { 2548 putnext(connp->conn_rq, mp); 2549 } 2550 } 2551 2552 /* 2553 * This is the inbound data path. 2554 * IP has already pulled up the IP headers and verified alignment 2555 * etc. 2556 */ 2557 /* ARGSUSED2 */ 2558 static void 2559 icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2560 { 2561 conn_t *connp = (conn_t *)arg1; 2562 struct T_unitdata_ind *tudi; 2563 uchar_t *rptr; /* Pointer to IP header */ 2564 int ip_hdr_length; 2565 int udi_size; /* Size of T_unitdata_ind */ 2566 int pkt_len; 2567 icmp_t *icmp; 2568 ip_pkt_t ipps; 2569 ip6_t *ip6h; 2570 mblk_t *mp1; 2571 crb_t recv_ancillary; 2572 icmp_stack_t *is; 2573 sin_t *sin; 2574 sin6_t *sin6; 2575 ipha_t *ipha; 2576 2577 ASSERT(connp->conn_flags & IPCL_RAWIPCONN); 2578 2579 icmp = connp->conn_icmp; 2580 is = icmp->icmp_is; 2581 rptr = mp->b_rptr; 2582 2583 ASSERT(DB_TYPE(mp) == M_DATA); 2584 ASSERT(OK_32PTR(rptr)); 2585 ASSERT(ira->ira_pktlen == msgdsize(mp)); 2586 pkt_len = ira->ira_pktlen; 2587 2588 /* 2589 * Get a snapshot of these and allow other threads to change 2590 * them after that. We need the same recv_ancillary when determining 2591 * the size as when adding the ancillary data items. 2592 */ 2593 mutex_enter(&connp->conn_lock); 2594 recv_ancillary = connp->conn_recv_ancillary; 2595 mutex_exit(&connp->conn_lock); 2596 2597 ip_hdr_length = ira->ira_ip_hdr_length; 2598 ASSERT(MBLKL(mp) >= ip_hdr_length); /* IP did a pullup */ 2599 2600 /* Initialize regardless of IP version */ 2601 ipps.ipp_fields = 0; 2602 2603 if (ira->ira_flags & IRAF_IS_IPV4) { 2604 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION); 2605 ASSERT(MBLKL(mp) >= sizeof (ipha_t)); 2606 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr)); 2607 2608 ipha = (ipha_t *)mp->b_rptr; 2609 if (recv_ancillary.crb_all != 0) 2610 (void) ip_find_hdr_v4(ipha, &ipps, B_FALSE); 2611 2612 /* 2613 * BSD for some reason adjusts ipha_length to exclude the 2614 * IP header length. We do the same. 2615 */ 2616 if (is->is_bsd_compat) { 2617 ushort_t len; 2618 2619 len = ntohs(ipha->ipha_length); 2620 if (mp->b_datap->db_ref > 1) { 2621 /* 2622 * Allocate a new IP header so that we can 2623 * modify ipha_length. 2624 */ 2625 mblk_t *mp1; 2626 2627 mp1 = allocb(ip_hdr_length, BPRI_MED); 2628 if (mp1 == NULL) { 2629 freemsg(mp); 2630 BUMP_MIB(&is->is_rawip_mib, 2631 rawipInErrors); 2632 return; 2633 } 2634 bcopy(rptr, mp1->b_rptr, ip_hdr_length); 2635 mp->b_rptr = rptr + ip_hdr_length; 2636 rptr = mp1->b_rptr; 2637 ipha = (ipha_t *)rptr; 2638 mp1->b_cont = mp; 2639 mp1->b_wptr = rptr + ip_hdr_length; 2640 mp = mp1; 2641 } 2642 len -= ip_hdr_length; 2643 ipha->ipha_length = htons(len); 2644 } 2645 2646 /* 2647 * For RAW sockets we not pass ICMP/IPv4 packets to AF_INET6 2648 * sockets. This is ensured by icmp_bind and the IP fanout code. 2649 */ 2650 ASSERT(connp->conn_family == AF_INET); 2651 2652 /* 2653 * This is the inbound data path. Packets are passed upstream 2654 * as T_UNITDATA_IND messages with full IPv4 headers still 2655 * attached. 2656 */ 2657 2658 /* 2659 * Normally only send up the source address. 2660 * If any ancillary data items are wanted we add those. 2661 */ 2662 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t); 2663 if (recv_ancillary.crb_all != 0) { 2664 udi_size += conn_recvancillary_size(connp, 2665 recv_ancillary, ira, mp, &ipps); 2666 } 2667 2668 /* Allocate a message block for the T_UNITDATA_IND structure. */ 2669 mp1 = allocb(udi_size, BPRI_MED); 2670 if (mp1 == NULL) { 2671 freemsg(mp); 2672 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2673 return; 2674 } 2675 mp1->b_cont = mp; 2676 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2677 mp1->b_datap->db_type = M_PROTO; 2678 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2679 tudi->PRIM_type = T_UNITDATA_IND; 2680 tudi->SRC_length = sizeof (sin_t); 2681 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2682 sin = (sin_t *)&tudi[1]; 2683 *sin = sin_null; 2684 sin->sin_family = AF_INET; 2685 sin->sin_addr.s_addr = ipha->ipha_src; 2686 *(uint32_t *)&sin->sin_zero[0] = 0; 2687 *(uint32_t *)&sin->sin_zero[4] = 0; 2688 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + 2689 sizeof (sin_t); 2690 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t)); 2691 tudi->OPT_length = udi_size; 2692 2693 /* 2694 * Add options if IP_RECVIF etc is set 2695 */ 2696 if (udi_size != 0) { 2697 conn_recvancillary_add(connp, recv_ancillary, ira, 2698 &ipps, (uchar_t *)&sin[1], udi_size); 2699 } 2700 goto deliver; 2701 } 2702 2703 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION); 2704 /* 2705 * IPv6 packets can only be received by applications 2706 * that are prepared to receive IPv6 addresses. 2707 * The IP fanout must ensure this. 2708 */ 2709 ASSERT(connp->conn_family == AF_INET6); 2710 2711 /* 2712 * Handle IPv6 packets. We don't pass up the IP headers with the 2713 * payload for IPv6. 2714 */ 2715 2716 ip6h = (ip6_t *)rptr; 2717 if (recv_ancillary.crb_all != 0) { 2718 /* 2719 * Call on ip_find_hdr_v6 which gets individual lenghts of 2720 * extension headers (and pointers to them). 2721 */ 2722 uint8_t nexthdr; 2723 2724 /* We don't care about the length or nextheader. */ 2725 (void) ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps, &nexthdr); 2726 2727 /* 2728 * We do not pass up hop-by-hop options or any other 2729 * extension header as part of the packet. Applications 2730 * that want to see them have to specify IPV6_RECV* socket 2731 * options. And conn_recvancillary_size/add explicitly 2732 * drops the TX option from IPV6_HOPOPTS as it does for UDP. 2733 * 2734 * If we had multilevel ICMP sockets, then we'd want to 2735 * modify conn_recvancillary_size/add to 2736 * allow the user to see the label. 2737 */ 2738 } 2739 2740 /* 2741 * Check a filter for ICMPv6 types if needed. 2742 * Verify raw checksums if needed. 2743 */ 2744 mutex_enter(&connp->conn_lock); 2745 if (icmp->icmp_filter != NULL) { 2746 int type; 2747 2748 /* Assumes that IP has done the pullupmsg */ 2749 type = mp->b_rptr[ip_hdr_length]; 2750 2751 ASSERT(mp->b_rptr + ip_hdr_length <= mp->b_wptr); 2752 if (ICMP6_FILTER_WILLBLOCK(type, icmp->icmp_filter)) { 2753 mutex_exit(&connp->conn_lock); 2754 freemsg(mp); 2755 return; 2756 } 2757 } 2758 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2759 /* Checksum */ 2760 uint16_t *up; 2761 uint32_t sum; 2762 int remlen; 2763 2764 up = (uint16_t *)&ip6h->ip6_src; 2765 2766 remlen = msgdsize(mp) - ip_hdr_length; 2767 sum = htons(connp->conn_proto + remlen) 2768 + up[0] + up[1] + up[2] + up[3] 2769 + up[4] + up[5] + up[6] + up[7] 2770 + up[8] + up[9] + up[10] + up[11] 2771 + up[12] + up[13] + up[14] + up[15]; 2772 sum = (sum & 0xffff) + (sum >> 16); 2773 sum = IP_CSUM(mp, ip_hdr_length, sum); 2774 if (sum != 0) { 2775 /* IPv6 RAW checksum failed */ 2776 ip0dbg(("icmp_rput: RAW checksum failed %x\n", sum)); 2777 mutex_exit(&connp->conn_lock); 2778 freemsg(mp); 2779 BUMP_MIB(&is->is_rawip_mib, rawipInCksumErrs); 2780 return; 2781 } 2782 } 2783 mutex_exit(&connp->conn_lock); 2784 2785 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2786 2787 if (recv_ancillary.crb_all != 0) { 2788 udi_size += conn_recvancillary_size(connp, 2789 recv_ancillary, ira, mp, &ipps); 2790 } 2791 2792 mp1 = allocb(udi_size, BPRI_MED); 2793 if (mp1 == NULL) { 2794 freemsg(mp); 2795 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2796 return; 2797 } 2798 mp1->b_cont = mp; 2799 mp1->b_datap->db_type = M_PROTO; 2800 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2801 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2802 tudi->PRIM_type = T_UNITDATA_IND; 2803 tudi->SRC_length = sizeof (sin6_t); 2804 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2805 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2806 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t)); 2807 tudi->OPT_length = udi_size; 2808 sin6 = (sin6_t *)&tudi[1]; 2809 *sin6 = sin6_null; 2810 sin6->sin6_port = 0; 2811 sin6->sin6_family = AF_INET6; 2812 2813 sin6->sin6_addr = ip6h->ip6_src; 2814 /* No sin6_flowinfo per API */ 2815 sin6->sin6_flowinfo = 0; 2816 /* For link-scope pass up scope id */ 2817 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) 2818 sin6->sin6_scope_id = ira->ira_ruifindex; 2819 else 2820 sin6->sin6_scope_id = 0; 2821 sin6->__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 2822 IPCL_ZONEID(connp), is->is_netstack); 2823 2824 if (udi_size != 0) { 2825 conn_recvancillary_add(connp, recv_ancillary, ira, 2826 &ipps, (uchar_t *)&sin6[1], udi_size); 2827 } 2828 2829 /* Skip all the IPv6 headers per API */ 2830 mp->b_rptr += ip_hdr_length; 2831 pkt_len -= ip_hdr_length; 2832 2833 deliver: 2834 BUMP_MIB(&is->is_rawip_mib, rawipInDatagrams); 2835 icmp_ulp_recv(connp, mp1, pkt_len); 2836 } 2837 2838 /* 2839 * return SNMP stuff in buffer in mpdata. We don't hold any lock and report 2840 * information that can be changing beneath us. 2841 */ 2842 mblk_t * 2843 icmp_snmp_get(queue_t *q, mblk_t *mpctl) 2844 { 2845 mblk_t *mpdata; 2846 struct opthdr *optp; 2847 conn_t *connp = Q_TO_CONN(q); 2848 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2849 mblk_t *mp2ctl; 2850 2851 /* 2852 * make a copy of the original message 2853 */ 2854 mp2ctl = copymsg(mpctl); 2855 2856 if (mpctl == NULL || 2857 (mpdata = mpctl->b_cont) == NULL) { 2858 freemsg(mpctl); 2859 freemsg(mp2ctl); 2860 return (0); 2861 } 2862 2863 /* fixed length structure for IPv4 and IPv6 counters */ 2864 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 2865 optp->level = EXPER_RAWIP; 2866 optp->name = 0; 2867 (void) snmp_append_data(mpdata, (char *)&is->is_rawip_mib, 2868 sizeof (is->is_rawip_mib)); 2869 optp->len = msgdsize(mpdata); 2870 qreply(q, mpctl); 2871 2872 return (mp2ctl); 2873 } 2874 2875 /* 2876 * Return 0 if invalid set request, 1 otherwise, including non-rawip requests. 2877 * TODO: If this ever actually tries to set anything, it needs to be 2878 * to do the appropriate locking. 2879 */ 2880 /* ARGSUSED */ 2881 int 2882 icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 2883 uchar_t *ptr, int len) 2884 { 2885 switch (level) { 2886 case EXPER_RAWIP: 2887 return (0); 2888 default: 2889 return (1); 2890 } 2891 } 2892 2893 /* 2894 * This routine creates a T_UDERROR_IND message and passes it upstream. 2895 * The address and options are copied from the T_UNITDATA_REQ message 2896 * passed in mp. This message is freed. 2897 */ 2898 static void 2899 icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err) 2900 { 2901 struct T_unitdata_req *tudr; 2902 mblk_t *mp1; 2903 uchar_t *destaddr; 2904 t_scalar_t destlen; 2905 uchar_t *optaddr; 2906 t_scalar_t optlen; 2907 2908 if ((mp->b_wptr < mp->b_rptr) || 2909 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) { 2910 goto done; 2911 } 2912 tudr = (struct T_unitdata_req *)mp->b_rptr; 2913 destaddr = mp->b_rptr + tudr->DEST_offset; 2914 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr || 2915 destaddr + tudr->DEST_length < mp->b_rptr || 2916 destaddr + tudr->DEST_length > mp->b_wptr) { 2917 goto done; 2918 } 2919 optaddr = mp->b_rptr + tudr->OPT_offset; 2920 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr || 2921 optaddr + tudr->OPT_length < mp->b_rptr || 2922 optaddr + tudr->OPT_length > mp->b_wptr) { 2923 goto done; 2924 } 2925 destlen = tudr->DEST_length; 2926 optlen = tudr->OPT_length; 2927 2928 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen, 2929 (char *)optaddr, optlen, err); 2930 if (mp1 != NULL) 2931 qreply(q, mp1); 2932 2933 done: 2934 freemsg(mp); 2935 } 2936 2937 static int 2938 rawip_do_unbind(conn_t *connp) 2939 { 2940 icmp_t *icmp = connp->conn_icmp; 2941 2942 mutex_enter(&connp->conn_lock); 2943 /* If a bind has not been done, we can't unbind. */ 2944 if (icmp->icmp_state == TS_UNBND) { 2945 mutex_exit(&connp->conn_lock); 2946 return (-TOUTSTATE); 2947 } 2948 connp->conn_saddr_v6 = ipv6_all_zeros; 2949 connp->conn_bound_addr_v6 = ipv6_all_zeros; 2950 connp->conn_laddr_v6 = ipv6_all_zeros; 2951 connp->conn_mcbc_bind = B_FALSE; 2952 connp->conn_lport = 0; 2953 connp->conn_fport = 0; 2954 /* In case we were also connected */ 2955 connp->conn_faddr_v6 = ipv6_all_zeros; 2956 connp->conn_v6lastdst = ipv6_all_zeros; 2957 2958 icmp->icmp_state = TS_UNBND; 2959 2960 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 2961 &connp->conn_faddr_v6, connp->conn_flowinfo); 2962 mutex_exit(&connp->conn_lock); 2963 2964 ip_unbind(connp); 2965 return (0); 2966 } 2967 2968 /* 2969 * This routine is called by icmp_wput to handle T_UNBIND_REQ messages. 2970 * After some error checking, the message is passed downstream to ip. 2971 */ 2972 static void 2973 icmp_tpi_unbind(queue_t *q, mblk_t *mp) 2974 { 2975 conn_t *connp = Q_TO_CONN(q); 2976 int error; 2977 2978 ASSERT(mp->b_cont == NULL); 2979 error = rawip_do_unbind(connp); 2980 if (error) { 2981 if (error < 0) { 2982 icmp_err_ack(q, mp, -error, 0); 2983 } else { 2984 icmp_err_ack(q, mp, 0, error); 2985 } 2986 return; 2987 } 2988 2989 /* 2990 * Convert mp into a T_OK_ACK 2991 */ 2992 2993 mp = mi_tpi_ok_ack_alloc(mp); 2994 2995 /* 2996 * should not happen in practice... T_OK_ACK is smaller than the 2997 * original message. 2998 */ 2999 ASSERT(mp != NULL); 3000 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK); 3001 qreply(q, mp); 3002 } 3003 3004 /* 3005 * Process IPv4 packets that already include an IP header. 3006 * Used when IP_HDRINCL has been set (implicit for IPPROTO_RAW and 3007 * IPPROTO_IGMP). 3008 * In this case we ignore the address and any options in the T_UNITDATA_REQ. 3009 * 3010 * The packet is assumed to have a base (20 byte) IP header followed 3011 * by the upper-layer protocol. We include any IP_OPTIONS including a 3012 * CIPSO label but otherwise preserve the base IP header. 3013 */ 3014 static int 3015 icmp_output_hdrincl(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3016 { 3017 icmp_t *icmp = connp->conn_icmp; 3018 icmp_stack_t *is = icmp->icmp_is; 3019 ipha_t iphas; 3020 ipha_t *ipha; 3021 int ip_hdr_length; 3022 int tp_hdr_len; 3023 ip_xmit_attr_t *ixa; 3024 ip_pkt_t *ipp; 3025 in6_addr_t v6src; 3026 in6_addr_t v6dst; 3027 in6_addr_t v6nexthop; 3028 int error; 3029 boolean_t do_ipsec; 3030 3031 /* 3032 * We need an exclusive copy of conn_ixa since the included IP 3033 * header could have any destination. 3034 * That copy has no pointers hence we 3035 * need to set them up once we've parsed the ancillary data. 3036 */ 3037 ixa = conn_get_ixa_exclusive(connp); 3038 if (ixa == NULL) { 3039 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3040 freemsg(mp); 3041 return (ENOMEM); 3042 } 3043 ASSERT(cr != NULL); 3044 /* 3045 * Caller has a reference on cr; from db_credp or because we 3046 * are running in process context. 3047 */ 3048 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3049 ixa->ixa_cred = cr; 3050 ixa->ixa_cpid = pid; 3051 if (is_system_labeled()) { 3052 /* We need to restart with a label based on the cred */ 3053 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3054 } 3055 3056 /* In case previous destination was multicast or multirt */ 3057 ip_attr_newdst(ixa); 3058 3059 /* Get a copy of conn_xmit_ipp since the TX label might change it */ 3060 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3061 if (ipp == NULL) { 3062 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3063 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3064 ixa->ixa_cpid = connp->conn_cpid; 3065 ixa_refrele(ixa); 3066 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3067 freemsg(mp); 3068 return (ENOMEM); 3069 } 3070 mutex_enter(&connp->conn_lock); 3071 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3072 mutex_exit(&connp->conn_lock); 3073 if (error != 0) { 3074 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3075 freemsg(mp); 3076 goto done; 3077 } 3078 3079 /* Sanity check length of packet */ 3080 ipha = (ipha_t *)mp->b_rptr; 3081 3082 ip_hdr_length = IP_SIMPLE_HDR_LENGTH; 3083 if ((mp->b_wptr - mp->b_rptr) < IP_SIMPLE_HDR_LENGTH) { 3084 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 3085 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3086 freemsg(mp); 3087 goto done; 3088 } 3089 ipha = (ipha_t *)mp->b_rptr; 3090 } 3091 ipha->ipha_version_and_hdr_length = 3092 (IP_VERSION<<4) | (ip_hdr_length>>2); 3093 3094 /* 3095 * We set IXAF_DONTFRAG if the application set DF which makes 3096 * IP not fragment. 3097 */ 3098 ipha->ipha_fragment_offset_and_flags &= htons(IPH_DF); 3099 if (ipha->ipha_fragment_offset_and_flags & htons(IPH_DF)) 3100 ixa->ixa_flags |= (IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3101 else 3102 ixa->ixa_flags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3103 3104 /* Even for multicast and broadcast we honor the apps ttl */ 3105 ixa->ixa_flags |= IXAF_NO_TTL_CHANGE; 3106 3107 /* 3108 * No source verification for non-local addresses 3109 */ 3110 if (ipha->ipha_src != INADDR_ANY && 3111 ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid, 3112 is->is_netstack->netstack_ip, B_FALSE) 3113 != IPVL_UNICAST_UP) { 3114 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3115 } 3116 3117 if (ipha->ipha_dst == INADDR_ANY) 3118 ipha->ipha_dst = htonl(INADDR_LOOPBACK); 3119 3120 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src); 3121 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 3122 3123 /* Defer IPsec if it might need to look at ICMP type/code */ 3124 do_ipsec = ipha->ipha_protocol != IPPROTO_ICMP; 3125 ixa->ixa_flags |= IXAF_IS_IPV4; 3126 3127 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3128 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, 3129 connp->conn_fport, &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3130 (do_ipsec ? IPDF_IPSEC : 0)); 3131 switch (error) { 3132 case 0: 3133 break; 3134 case EADDRNOTAVAIL: 3135 /* 3136 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3137 * Don't have the application see that errno 3138 */ 3139 error = ENETUNREACH; 3140 goto failed; 3141 case ENETDOWN: 3142 /* 3143 * Have !ipif_addr_ready address; drop packet silently 3144 * until we can get applications to not send until we 3145 * are ready. 3146 */ 3147 error = 0; 3148 goto failed; 3149 case EHOSTUNREACH: 3150 case ENETUNREACH: 3151 if (ixa->ixa_ire != NULL) { 3152 /* 3153 * Let conn_ip_output/ire_send_noroute return 3154 * the error and send any local ICMP error. 3155 */ 3156 error = 0; 3157 break; 3158 } 3159 /* FALLTHRU */ 3160 default: 3161 failed: 3162 freemsg(mp); 3163 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3164 goto done; 3165 } 3166 if (ipha->ipha_src == INADDR_ANY) 3167 IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src); 3168 3169 /* 3170 * We might be going to a different destination than last time, 3171 * thus check that TX allows the communication and compute any 3172 * needed label. 3173 * 3174 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3175 * don't have to worry about concurrent threads. 3176 */ 3177 if (is_system_labeled()) { 3178 /* 3179 * Check whether Trusted Solaris policy allows communication 3180 * with this host, and pretend that the destination is 3181 * unreachable if not. 3182 * Compute any needed label and place it in ipp_label_v4/v6. 3183 * 3184 * Later conn_build_hdr_template/conn_prepend_hdr takes 3185 * ipp_label_v4/v6 to form the packet. 3186 * 3187 * Tsol note: We have ipp structure local to this thread so 3188 * no locking is needed. 3189 */ 3190 error = conn_update_label(connp, ixa, &v6dst, ipp); 3191 if (error != 0) { 3192 freemsg(mp); 3193 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3194 goto done; 3195 } 3196 } 3197 3198 /* 3199 * Save away a copy of the IPv4 header the application passed down 3200 * and then prepend an IPv4 header complete with any IP options 3201 * including label. 3202 * We need a struct copy since icmp_prepend_hdr will reuse the available 3203 * space in the mblk. 3204 */ 3205 iphas = *ipha; 3206 mp->b_rptr += IP_SIMPLE_HDR_LENGTH; 3207 3208 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, 0, mp, &error); 3209 if (mp == NULL) { 3210 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3211 ASSERT(error != 0); 3212 goto done; 3213 } 3214 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3215 error = EMSGSIZE; 3216 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3217 freemsg(mp); 3218 goto done; 3219 } 3220 /* Restore key parts of the header that the application passed down */ 3221 ipha = (ipha_t *)mp->b_rptr; 3222 ipha->ipha_type_of_service = iphas.ipha_type_of_service; 3223 ipha->ipha_ident = iphas.ipha_ident; 3224 ipha->ipha_fragment_offset_and_flags = 3225 iphas.ipha_fragment_offset_and_flags; 3226 ipha->ipha_ttl = iphas.ipha_ttl; 3227 ipha->ipha_protocol = iphas.ipha_protocol; 3228 ipha->ipha_src = iphas.ipha_src; 3229 ipha->ipha_dst = iphas.ipha_dst; 3230 3231 ixa->ixa_protocol = ipha->ipha_protocol; 3232 3233 /* 3234 * Make sure that the IP header plus any transport header that is 3235 * checksumed by ip_output is in the first mblk. (ip_output assumes 3236 * that at least the checksum field is in the first mblk.) 3237 */ 3238 switch (ipha->ipha_protocol) { 3239 case IPPROTO_UDP: 3240 tp_hdr_len = 8; 3241 break; 3242 case IPPROTO_TCP: 3243 tp_hdr_len = 20; 3244 break; 3245 default: 3246 tp_hdr_len = 0; 3247 break; 3248 } 3249 ip_hdr_length = IPH_HDR_LENGTH(ipha); 3250 if (mp->b_wptr - mp->b_rptr < ip_hdr_length + tp_hdr_len) { 3251 if (!pullupmsg(mp, ip_hdr_length + tp_hdr_len)) { 3252 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3253 if (mp->b_cont == NULL) 3254 error = EINVAL; 3255 else 3256 error = ENOMEM; 3257 freemsg(mp); 3258 goto done; 3259 } 3260 } 3261 3262 if (!do_ipsec) { 3263 /* Policy might differ for different ICMP type/code */ 3264 if (ixa->ixa_ipsec_policy != NULL) { 3265 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3266 ixa->ixa_ipsec_policy = NULL; 3267 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3268 } 3269 mp = ip_output_attach_policy(mp, ipha, NULL, connp, ixa); 3270 if (mp == NULL) { 3271 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3272 error = EHOSTUNREACH; /* IPsec policy failure */ 3273 goto done; 3274 } 3275 } 3276 3277 /* We're done. Pass the packet to ip. */ 3278 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3279 3280 error = conn_ip_output(mp, ixa); 3281 /* No rawipOutErrors if an error since IP increases its error counter */ 3282 switch (error) { 3283 case 0: 3284 break; 3285 case EWOULDBLOCK: 3286 (void) ixa_check_drain_insert(connp, ixa); 3287 error = 0; 3288 break; 3289 case EADDRNOTAVAIL: 3290 /* 3291 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3292 * Don't have the application see that errno 3293 */ 3294 error = ENETUNREACH; 3295 break; 3296 } 3297 done: 3298 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3299 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3300 ixa->ixa_cpid = connp->conn_cpid; 3301 ixa_refrele(ixa); 3302 ip_pkt_free(ipp); 3303 kmem_free(ipp, sizeof (*ipp)); 3304 return (error); 3305 } 3306 3307 static mblk_t * 3308 icmp_output_attach_policy(mblk_t *mp, conn_t *connp, ip_xmit_attr_t *ixa) 3309 { 3310 ipha_t *ipha = NULL; 3311 ip6_t *ip6h = NULL; 3312 3313 if (ixa->ixa_flags & IXAF_IS_IPV4) 3314 ipha = (ipha_t *)mp->b_rptr; 3315 else 3316 ip6h = (ip6_t *)mp->b_rptr; 3317 3318 if (ixa->ixa_ipsec_policy != NULL) { 3319 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3320 ixa->ixa_ipsec_policy = NULL; 3321 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3322 } 3323 return (ip_output_attach_policy(mp, ipha, ip6h, connp, ixa)); 3324 } 3325 3326 /* 3327 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6 3328 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from 3329 * the TPI options, otherwise we take them from msg_control. 3330 * If both sin and sin6 is set it is a connected socket and we use conn_faddr. 3331 * Always consumes mp; never consumes tudr_mp. 3332 */ 3333 static int 3334 icmp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp, 3335 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid) 3336 { 3337 icmp_t *icmp = connp->conn_icmp; 3338 icmp_stack_t *is = icmp->icmp_is; 3339 int error; 3340 ip_xmit_attr_t *ixa; 3341 ip_pkt_t *ipp; 3342 in6_addr_t v6src; 3343 in6_addr_t v6dst; 3344 in6_addr_t v6nexthop; 3345 in_port_t dstport; 3346 uint32_t flowinfo; 3347 uint_t srcid; 3348 int is_absreq_failure = 0; 3349 conn_opt_arg_t coas, *coa; 3350 3351 ASSERT(tudr_mp != NULL || msg != NULL); 3352 3353 /* 3354 * Get ixa before checking state to handle a disconnect race. 3355 * 3356 * We need an exclusive copy of conn_ixa since the ancillary data 3357 * options might modify it. That copy has no pointers hence we 3358 * need to set them up once we've parsed the ancillary data. 3359 */ 3360 ixa = conn_get_ixa_exclusive(connp); 3361 if (ixa == NULL) { 3362 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3363 freemsg(mp); 3364 return (ENOMEM); 3365 } 3366 ASSERT(cr != NULL); 3367 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3368 ixa->ixa_cred = cr; 3369 ixa->ixa_cpid = pid; 3370 if (is_system_labeled()) { 3371 /* We need to restart with a label based on the cred */ 3372 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3373 } 3374 3375 /* In case previous destination was multicast or multirt */ 3376 ip_attr_newdst(ixa); 3377 3378 /* Get a copy of conn_xmit_ipp since the options might change it */ 3379 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3380 if (ipp == NULL) { 3381 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3382 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3383 ixa->ixa_cpid = connp->conn_cpid; 3384 ixa_refrele(ixa); 3385 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3386 freemsg(mp); 3387 return (ENOMEM); 3388 } 3389 mutex_enter(&connp->conn_lock); 3390 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3391 mutex_exit(&connp->conn_lock); 3392 if (error != 0) { 3393 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3394 freemsg(mp); 3395 goto done; 3396 } 3397 3398 /* 3399 * Parse the options and update ixa and ipp as a result. 3400 */ 3401 3402 coa = &coas; 3403 coa->coa_connp = connp; 3404 coa->coa_ixa = ixa; 3405 coa->coa_ipp = ipp; 3406 coa->coa_ancillary = B_TRUE; 3407 coa->coa_changed = 0; 3408 3409 if (msg != NULL) { 3410 error = process_auxiliary_options(connp, msg->msg_control, 3411 msg->msg_controllen, coa, &icmp_opt_obj, icmp_opt_set, cr); 3412 } else { 3413 struct T_unitdata_req *tudr; 3414 3415 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr; 3416 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ); 3417 error = tpi_optcom_buf(connp->conn_wq, tudr_mp, 3418 &tudr->OPT_length, tudr->OPT_offset, cr, &icmp_opt_obj, 3419 coa, &is_absreq_failure); 3420 } 3421 if (error != 0) { 3422 /* 3423 * Note: No special action needed in this 3424 * module for "is_absreq_failure" 3425 */ 3426 freemsg(mp); 3427 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3428 goto done; 3429 } 3430 ASSERT(is_absreq_failure == 0); 3431 3432 mutex_enter(&connp->conn_lock); 3433 /* 3434 * If laddr is unspecified then we look at sin6_src_id. 3435 * We will give precedence to a source address set with IPV6_PKTINFO 3436 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 3437 * want ip_attr_connect to select a source (since it can fail) when 3438 * IPV6_PKTINFO is specified. 3439 * If this doesn't result in a source address then we get a source 3440 * from ip_attr_connect() below. 3441 */ 3442 v6src = connp->conn_saddr_v6; 3443 if (sin != NULL) { 3444 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 3445 dstport = sin->sin_port; 3446 flowinfo = 0; 3447 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3448 ixa->ixa_flags |= IXAF_IS_IPV4; 3449 } else if (sin6 != NULL) { 3450 v6dst = sin6->sin6_addr; 3451 dstport = sin6->sin6_port; 3452 flowinfo = sin6->sin6_flowinfo; 3453 srcid = sin6->__sin6_src_id; 3454 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 3455 ixa->ixa_scopeid = sin6->sin6_scope_id; 3456 ixa->ixa_flags |= IXAF_SCOPEID_SET; 3457 } else { 3458 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3459 } 3460 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 3461 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 3462 connp->conn_netstack); 3463 } 3464 if (IN6_IS_ADDR_V4MAPPED(&v6dst)) 3465 ixa->ixa_flags |= IXAF_IS_IPV4; 3466 else 3467 ixa->ixa_flags &= ~IXAF_IS_IPV4; 3468 } else { 3469 /* Connected case */ 3470 v6dst = connp->conn_faddr_v6; 3471 flowinfo = connp->conn_flowinfo; 3472 } 3473 mutex_exit(&connp->conn_lock); 3474 /* Handle IPV6_PKTINFO setting source address. */ 3475 if (IN6_IS_ADDR_UNSPECIFIED(&v6src) && 3476 (ipp->ipp_fields & IPPF_ADDR)) { 3477 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3478 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3479 v6src = ipp->ipp_addr; 3480 } else { 3481 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3482 v6src = ipp->ipp_addr; 3483 } 3484 } 3485 /* 3486 * Allow source not assigned to the system 3487 * only if it is not a local addresses 3488 */ 3489 if (!V6_OR_V4_INADDR_ANY(v6src)) { 3490 ip_laddr_t laddr_type; 3491 3492 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3493 ipaddr_t v4src; 3494 3495 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src); 3496 laddr_type = ip_laddr_verify_v4(v4src, ixa->ixa_zoneid, 3497 is->is_netstack->netstack_ip, B_FALSE); 3498 } else { 3499 laddr_type = ip_laddr_verify_v6(&v6src, ixa->ixa_zoneid, 3500 is->is_netstack->netstack_ip, B_FALSE, B_FALSE); 3501 } 3502 if (laddr_type != IPVL_UNICAST_UP) 3503 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3504 } 3505 3506 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3507 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 3508 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 3509 3510 switch (error) { 3511 case 0: 3512 break; 3513 case EADDRNOTAVAIL: 3514 /* 3515 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3516 * Don't have the application see that errno 3517 */ 3518 error = ENETUNREACH; 3519 goto failed; 3520 case ENETDOWN: 3521 /* 3522 * Have !ipif_addr_ready address; drop packet silently 3523 * until we can get applications to not send until we 3524 * are ready. 3525 */ 3526 error = 0; 3527 goto failed; 3528 case EHOSTUNREACH: 3529 case ENETUNREACH: 3530 if (ixa->ixa_ire != NULL) { 3531 /* 3532 * Let conn_ip_output/ire_send_noroute return 3533 * the error and send any local ICMP error. 3534 */ 3535 error = 0; 3536 break; 3537 } 3538 /* FALLTHRU */ 3539 default: 3540 failed: 3541 freemsg(mp); 3542 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3543 goto done; 3544 } 3545 3546 /* 3547 * We might be going to a different destination than last time, 3548 * thus check that TX allows the communication and compute any 3549 * needed label. 3550 * 3551 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3552 * don't have to worry about concurrent threads. 3553 */ 3554 if (is_system_labeled()) { 3555 /* 3556 * Check whether Trusted Solaris policy allows communication 3557 * with this host, and pretend that the destination is 3558 * unreachable if not. 3559 * Compute any needed label and place it in ipp_label_v4/v6. 3560 * 3561 * Later conn_build_hdr_template/conn_prepend_hdr takes 3562 * ipp_label_v4/v6 to form the packet. 3563 * 3564 * Tsol note: We have ipp structure local to this thread so 3565 * no locking is needed. 3566 */ 3567 error = conn_update_label(connp, ixa, &v6dst, ipp); 3568 if (error != 0) { 3569 freemsg(mp); 3570 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3571 goto done; 3572 } 3573 } 3574 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, flowinfo, mp, 3575 &error); 3576 if (mp == NULL) { 3577 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3578 ASSERT(error != 0); 3579 goto done; 3580 } 3581 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3582 error = EMSGSIZE; 3583 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3584 freemsg(mp); 3585 goto done; 3586 } 3587 3588 /* Policy might differ for different ICMP type/code */ 3589 mp = icmp_output_attach_policy(mp, connp, ixa); 3590 if (mp == NULL) { 3591 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3592 error = EHOSTUNREACH; /* IPsec policy failure */ 3593 goto done; 3594 } 3595 3596 /* We're done. Pass the packet to ip. */ 3597 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3598 3599 error = conn_ip_output(mp, ixa); 3600 if (!connp->conn_unspec_src) 3601 ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 3602 /* No rawipOutErrors if an error since IP increases its error counter */ 3603 switch (error) { 3604 case 0: 3605 break; 3606 case EWOULDBLOCK: 3607 (void) ixa_check_drain_insert(connp, ixa); 3608 error = 0; 3609 break; 3610 case EADDRNOTAVAIL: 3611 /* 3612 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3613 * Don't have the application see that errno 3614 */ 3615 error = ENETUNREACH; 3616 /* FALLTHRU */ 3617 default: 3618 mutex_enter(&connp->conn_lock); 3619 /* 3620 * Clear the source and v6lastdst so we call ip_attr_connect 3621 * for the next packet and try to pick a better source. 3622 */ 3623 if (connp->conn_mcbc_bind) 3624 connp->conn_saddr_v6 = ipv6_all_zeros; 3625 else 3626 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3627 connp->conn_v6lastdst = ipv6_all_zeros; 3628 mutex_exit(&connp->conn_lock); 3629 break; 3630 } 3631 done: 3632 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3633 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3634 ixa->ixa_cpid = connp->conn_cpid; 3635 ixa_refrele(ixa); 3636 ip_pkt_free(ipp); 3637 kmem_free(ipp, sizeof (*ipp)); 3638 return (error); 3639 } 3640 3641 /* 3642 * Handle sending an M_DATA for a connected socket. 3643 * Handles both IPv4 and IPv6. 3644 */ 3645 int 3646 icmp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3647 { 3648 icmp_t *icmp = connp->conn_icmp; 3649 icmp_stack_t *is = icmp->icmp_is; 3650 int error; 3651 ip_xmit_attr_t *ixa; 3652 boolean_t do_ipsec; 3653 3654 /* 3655 * If no other thread is using conn_ixa this just gets a reference to 3656 * conn_ixa. Otherwise we get a safe copy of conn_ixa. 3657 */ 3658 ixa = conn_get_ixa(connp, B_FALSE); 3659 if (ixa == NULL) { 3660 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3661 freemsg(mp); 3662 return (ENOMEM); 3663 } 3664 3665 ASSERT(cr != NULL); 3666 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3667 ixa->ixa_cred = cr; 3668 ixa->ixa_cpid = pid; 3669 3670 /* Defer IPsec if it might need to look at ICMP type/code */ 3671 switch (ixa->ixa_protocol) { 3672 case IPPROTO_ICMP: 3673 case IPPROTO_ICMPV6: 3674 do_ipsec = B_FALSE; 3675 break; 3676 default: 3677 do_ipsec = B_TRUE; 3678 } 3679 3680 mutex_enter(&connp->conn_lock); 3681 mp = icmp_prepend_header_template(connp, ixa, mp, 3682 &connp->conn_saddr_v6, connp->conn_flowinfo, &error); 3683 3684 if (mp == NULL) { 3685 ASSERT(error != 0); 3686 mutex_exit(&connp->conn_lock); 3687 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3688 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3689 ixa->ixa_cpid = connp->conn_cpid; 3690 ixa_refrele(ixa); 3691 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3692 freemsg(mp); 3693 return (error); 3694 } 3695 3696 if (!do_ipsec) { 3697 /* Policy might differ for different ICMP type/code */ 3698 mp = icmp_output_attach_policy(mp, connp, ixa); 3699 if (mp == NULL) { 3700 mutex_exit(&connp->conn_lock); 3701 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3702 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3703 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3704 ixa->ixa_cpid = connp->conn_cpid; 3705 ixa_refrele(ixa); 3706 return (EHOSTUNREACH); /* IPsec policy failure */ 3707 } 3708 } 3709 3710 /* 3711 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3712 * safe copy, then we need to fill in any pointers in it. 3713 */ 3714 if (ixa->ixa_ire == NULL) { 3715 in6_addr_t faddr, saddr; 3716 in6_addr_t nexthop; 3717 in_port_t fport; 3718 3719 saddr = connp->conn_saddr_v6; 3720 faddr = connp->conn_faddr_v6; 3721 fport = connp->conn_fport; 3722 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop); 3723 mutex_exit(&connp->conn_lock); 3724 3725 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop, 3726 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3727 (do_ipsec ? IPDF_IPSEC : 0)); 3728 switch (error) { 3729 case 0: 3730 break; 3731 case EADDRNOTAVAIL: 3732 /* 3733 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3734 * Don't have the application see that errno 3735 */ 3736 error = ENETUNREACH; 3737 goto failed; 3738 case ENETDOWN: 3739 /* 3740 * Have !ipif_addr_ready address; drop packet silently 3741 * until we can get applications to not send until we 3742 * are ready. 3743 */ 3744 error = 0; 3745 goto failed; 3746 case EHOSTUNREACH: 3747 case ENETUNREACH: 3748 if (ixa->ixa_ire != NULL) { 3749 /* 3750 * Let conn_ip_output/ire_send_noroute return 3751 * the error and send any local ICMP error. 3752 */ 3753 error = 0; 3754 break; 3755 } 3756 /* FALLTHRU */ 3757 default: 3758 failed: 3759 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3760 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3761 ixa->ixa_cpid = connp->conn_cpid; 3762 ixa_refrele(ixa); 3763 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3764 freemsg(mp); 3765 return (error); 3766 } 3767 } else { 3768 /* Done with conn_t */ 3769 mutex_exit(&connp->conn_lock); 3770 } 3771 3772 /* We're done. Pass the packet to ip. */ 3773 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3774 3775 error = conn_ip_output(mp, ixa); 3776 /* No rawipOutErrors if an error since IP increases its error counter */ 3777 switch (error) { 3778 case 0: 3779 break; 3780 case EWOULDBLOCK: 3781 (void) ixa_check_drain_insert(connp, ixa); 3782 error = 0; 3783 break; 3784 case EADDRNOTAVAIL: 3785 /* 3786 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3787 * Don't have the application see that errno 3788 */ 3789 error = ENETUNREACH; 3790 break; 3791 } 3792 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3793 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3794 ixa->ixa_cpid = connp->conn_cpid; 3795 ixa_refrele(ixa); 3796 return (error); 3797 } 3798 3799 /* 3800 * Handle sending an M_DATA to the last destination. 3801 * Handles both IPv4 and IPv6. 3802 * 3803 * NOTE: The caller must hold conn_lock and we drop it here. 3804 */ 3805 int 3806 icmp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid, 3807 ip_xmit_attr_t *ixa) 3808 { 3809 icmp_t *icmp = connp->conn_icmp; 3810 icmp_stack_t *is = icmp->icmp_is; 3811 int error; 3812 boolean_t do_ipsec; 3813 3814 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3815 ASSERT(ixa != NULL); 3816 3817 ASSERT(cr != NULL); 3818 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3819 ixa->ixa_cred = cr; 3820 ixa->ixa_cpid = pid; 3821 3822 /* Defer IPsec if it might need to look at ICMP type/code */ 3823 switch (ixa->ixa_protocol) { 3824 case IPPROTO_ICMP: 3825 case IPPROTO_ICMPV6: 3826 do_ipsec = B_FALSE; 3827 break; 3828 default: 3829 do_ipsec = B_TRUE; 3830 } 3831 3832 3833 mp = icmp_prepend_header_template(connp, ixa, mp, 3834 &connp->conn_v6lastsrc, connp->conn_lastflowinfo, &error); 3835 3836 if (mp == NULL) { 3837 ASSERT(error != 0); 3838 mutex_exit(&connp->conn_lock); 3839 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3840 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3841 ixa->ixa_cpid = connp->conn_cpid; 3842 ixa_refrele(ixa); 3843 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3844 freemsg(mp); 3845 return (error); 3846 } 3847 3848 if (!do_ipsec) { 3849 /* Policy might differ for different ICMP type/code */ 3850 mp = icmp_output_attach_policy(mp, connp, ixa); 3851 if (mp == NULL) { 3852 mutex_exit(&connp->conn_lock); 3853 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3854 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3855 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3856 ixa->ixa_cpid = connp->conn_cpid; 3857 ixa_refrele(ixa); 3858 return (EHOSTUNREACH); /* IPsec policy failure */ 3859 } 3860 } 3861 3862 /* 3863 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3864 * safe copy, then we need to fill in any pointers in it. 3865 */ 3866 if (ixa->ixa_ire == NULL) { 3867 in6_addr_t lastdst, lastsrc; 3868 in6_addr_t nexthop; 3869 in_port_t lastport; 3870 3871 lastsrc = connp->conn_v6lastsrc; 3872 lastdst = connp->conn_v6lastdst; 3873 lastport = connp->conn_lastdstport; 3874 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop); 3875 mutex_exit(&connp->conn_lock); 3876 3877 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst, 3878 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC | 3879 IPDF_VERIFY_DST | (do_ipsec ? IPDF_IPSEC : 0)); 3880 switch (error) { 3881 case 0: 3882 break; 3883 case EADDRNOTAVAIL: 3884 /* 3885 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3886 * Don't have the application see that errno 3887 */ 3888 error = ENETUNREACH; 3889 goto failed; 3890 case ENETDOWN: 3891 /* 3892 * Have !ipif_addr_ready address; drop packet silently 3893 * until we can get applications to not send until we 3894 * are ready. 3895 */ 3896 error = 0; 3897 goto failed; 3898 case EHOSTUNREACH: 3899 case ENETUNREACH: 3900 if (ixa->ixa_ire != NULL) { 3901 /* 3902 * Let conn_ip_output/ire_send_noroute return 3903 * the error and send any local ICMP error. 3904 */ 3905 error = 0; 3906 break; 3907 } 3908 /* FALLTHRU */ 3909 default: 3910 failed: 3911 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3912 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3913 ixa->ixa_cpid = connp->conn_cpid; 3914 ixa_refrele(ixa); 3915 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3916 freemsg(mp); 3917 return (error); 3918 } 3919 } else { 3920 /* Done with conn_t */ 3921 mutex_exit(&connp->conn_lock); 3922 } 3923 3924 /* We're done. Pass the packet to ip. */ 3925 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3926 error = conn_ip_output(mp, ixa); 3927 /* No rawipOutErrors if an error since IP increases its error counter */ 3928 switch (error) { 3929 case 0: 3930 break; 3931 case EWOULDBLOCK: 3932 (void) ixa_check_drain_insert(connp, ixa); 3933 error = 0; 3934 break; 3935 case EADDRNOTAVAIL: 3936 /* 3937 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3938 * Don't have the application see that errno 3939 */ 3940 error = ENETUNREACH; 3941 /* FALLTHRU */ 3942 default: 3943 mutex_enter(&connp->conn_lock); 3944 /* 3945 * Clear the source and v6lastdst so we call ip_attr_connect 3946 * for the next packet and try to pick a better source. 3947 */ 3948 if (connp->conn_mcbc_bind) 3949 connp->conn_saddr_v6 = ipv6_all_zeros; 3950 else 3951 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3952 connp->conn_v6lastdst = ipv6_all_zeros; 3953 mutex_exit(&connp->conn_lock); 3954 break; 3955 } 3956 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3957 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3958 ixa->ixa_cpid = connp->conn_cpid; 3959 ixa_refrele(ixa); 3960 return (error); 3961 } 3962 3963 3964 /* 3965 * Prepend the header template and then fill in the source and 3966 * flowinfo. The caller needs to handle the destination address since 3967 * it's setting is different if rthdr or source route. 3968 * 3969 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET. 3970 * When it returns NULL it sets errorp. 3971 */ 3972 static mblk_t * 3973 icmp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp, 3974 const in6_addr_t *v6src, uint32_t flowinfo, int *errorp) 3975 { 3976 icmp_t *icmp = connp->conn_icmp; 3977 icmp_stack_t *is = icmp->icmp_is; 3978 uint_t pktlen; 3979 uint_t copylen; 3980 uint8_t *iph; 3981 uint_t ip_hdr_length; 3982 uint32_t cksum; 3983 ip_pkt_t *ipp; 3984 3985 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3986 3987 /* 3988 * Copy the header template. 3989 */ 3990 copylen = connp->conn_ht_iphc_len; 3991 pktlen = copylen + msgdsize(mp); 3992 if (pktlen > IP_MAXPACKET) { 3993 freemsg(mp); 3994 *errorp = EMSGSIZE; 3995 return (NULL); 3996 } 3997 ixa->ixa_pktlen = pktlen; 3998 3999 /* check/fix buffer config, setup pointers into it */ 4000 iph = mp->b_rptr - copylen; 4001 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) { 4002 mblk_t *mp1; 4003 4004 mp1 = allocb(copylen + is->is_wroff_extra, BPRI_MED); 4005 if (mp1 == NULL) { 4006 freemsg(mp); 4007 *errorp = ENOMEM; 4008 return (NULL); 4009 } 4010 mp1->b_wptr = DB_LIM(mp1); 4011 mp1->b_cont = mp; 4012 mp = mp1; 4013 iph = (mp->b_wptr - copylen); 4014 } 4015 mp->b_rptr = iph; 4016 bcopy(connp->conn_ht_iphc, iph, copylen); 4017 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc); 4018 4019 ixa->ixa_ip_hdr_length = ip_hdr_length; 4020 4021 /* 4022 * Prepare for ICMPv6 checksum done in IP. 4023 * 4024 * icmp_build_hdr_template has already massaged any routing header 4025 * and placed the result in conn_sum. 4026 * 4027 * We make it easy for IP to include our pseudo header 4028 * by putting our length (and any routing header adjustment) 4029 * in the ICMPv6 checksum field. 4030 */ 4031 cksum = pktlen - ip_hdr_length; 4032 4033 cksum += connp->conn_sum; 4034 cksum = (cksum >> 16) + (cksum & 0xFFFF); 4035 ASSERT(cksum < 0x10000); 4036 4037 ipp = &connp->conn_xmit_ipp; 4038 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4039 ipha_t *ipha = (ipha_t *)iph; 4040 4041 ipha->ipha_length = htons((uint16_t)pktlen); 4042 4043 /* if IP_PKTINFO specified an addres it wins over bind() */ 4044 if ((ipp->ipp_fields & IPPF_ADDR) && 4045 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4046 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY); 4047 ipha->ipha_src = ipp->ipp_addr_v4; 4048 } else { 4049 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src); 4050 } 4051 } else { 4052 ip6_t *ip6h = (ip6_t *)iph; 4053 uint_t cksum_offset = 0; 4054 4055 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN)); 4056 4057 /* if IP_PKTINFO specified an addres it wins over bind() */ 4058 if ((ipp->ipp_fields & IPPF_ADDR) && 4059 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4060 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)); 4061 ip6h->ip6_src = ipp->ipp_addr; 4062 } else { 4063 ip6h->ip6_src = *v6src; 4064 } 4065 ip6h->ip6_vcf = 4066 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 4067 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 4068 if (ipp->ipp_fields & IPPF_TCLASS) { 4069 /* Overrides the class part of flowinfo */ 4070 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf, 4071 ipp->ipp_tclass); 4072 } 4073 4074 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 4075 if (connp->conn_proto == IPPROTO_ICMPV6) { 4076 cksum_offset = ixa->ixa_ip_hdr_length + 4077 offsetof(icmp6_t, icmp6_cksum); 4078 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 4079 cksum_offset = ixa->ixa_ip_hdr_length + 4080 ixa->ixa_raw_cksum_offset; 4081 } 4082 } 4083 if (cksum_offset != 0) { 4084 uint16_t *ptr; 4085 4086 /* Make sure the checksum fits in the first mblk */ 4087 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 4088 mblk_t *mp1; 4089 4090 mp1 = msgpullup(mp, 4091 cksum_offset + sizeof (short)); 4092 freemsg(mp); 4093 if (mp1 == NULL) { 4094 *errorp = ENOMEM; 4095 return (NULL); 4096 } 4097 mp = mp1; 4098 iph = mp->b_rptr; 4099 ip6h = (ip6_t *)iph; 4100 } 4101 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 4102 *ptr = htons(cksum); 4103 } 4104 } 4105 4106 return (mp); 4107 } 4108 4109 /* 4110 * This routine handles all messages passed downstream. It either 4111 * consumes the message or passes it downstream; it never queues a 4112 * a message. 4113 */ 4114 void 4115 icmp_wput(queue_t *q, mblk_t *mp) 4116 { 4117 sin6_t *sin6; 4118 sin_t *sin = NULL; 4119 uint_t srcid; 4120 conn_t *connp = Q_TO_CONN(q); 4121 icmp_t *icmp = connp->conn_icmp; 4122 int error = 0; 4123 struct sockaddr *addr = NULL; 4124 socklen_t addrlen; 4125 icmp_stack_t *is = icmp->icmp_is; 4126 struct T_unitdata_req *tudr; 4127 mblk_t *data_mp; 4128 cred_t *cr; 4129 pid_t pid; 4130 4131 /* 4132 * We directly handle several cases here: T_UNITDATA_REQ message 4133 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected 4134 * socket. 4135 */ 4136 switch (DB_TYPE(mp)) { 4137 case M_DATA: 4138 /* sockfs never sends down M_DATA */ 4139 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4140 freemsg(mp); 4141 return; 4142 4143 case M_PROTO: 4144 case M_PCPROTO: 4145 tudr = (struct T_unitdata_req *)mp->b_rptr; 4146 if (MBLKL(mp) < sizeof (*tudr) || 4147 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) { 4148 icmp_wput_other(q, mp); 4149 return; 4150 } 4151 break; 4152 4153 default: 4154 icmp_wput_other(q, mp); 4155 return; 4156 } 4157 4158 /* Handle valid T_UNITDATA_REQ here */ 4159 data_mp = mp->b_cont; 4160 if (data_mp == NULL) { 4161 error = EPROTO; 4162 goto ud_error2; 4163 } 4164 mp->b_cont = NULL; 4165 4166 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) { 4167 error = EADDRNOTAVAIL; 4168 goto ud_error2; 4169 } 4170 4171 /* 4172 * All Solaris components should pass a db_credp 4173 * for this message, hence we ASSERT. 4174 * On production kernels we return an error to be robust against 4175 * random streams modules sitting on top of us. 4176 */ 4177 cr = msg_getcred(mp, &pid); 4178 ASSERT(cr != NULL); 4179 if (cr == NULL) { 4180 error = EINVAL; 4181 goto ud_error2; 4182 } 4183 4184 /* 4185 * If a port has not been bound to the stream, fail. 4186 * This is not a problem when sockfs is directly 4187 * above us, because it will ensure that the socket 4188 * is first bound before allowing data to be sent. 4189 */ 4190 if (icmp->icmp_state == TS_UNBND) { 4191 error = EPROTO; 4192 goto ud_error2; 4193 } 4194 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset]; 4195 addrlen = tudr->DEST_length; 4196 4197 switch (connp->conn_family) { 4198 case AF_INET6: 4199 sin6 = (sin6_t *)addr; 4200 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) || 4201 (sin6->sin6_family != AF_INET6)) { 4202 error = EADDRNOTAVAIL; 4203 goto ud_error2; 4204 } 4205 4206 /* No support for mapped addresses on raw sockets */ 4207 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4208 error = EADDRNOTAVAIL; 4209 goto ud_error2; 4210 } 4211 srcid = sin6->__sin6_src_id; 4212 4213 /* 4214 * If the local address is a mapped address return 4215 * an error. 4216 * It would be possible to send an IPv6 packet but the 4217 * response would never make it back to the application 4218 * since it is bound to a mapped address. 4219 */ 4220 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 4221 error = EADDRNOTAVAIL; 4222 goto ud_error2; 4223 } 4224 4225 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 4226 sin6->sin6_addr = ipv6_loopback; 4227 4228 if (tudr->OPT_length != 0) { 4229 /* 4230 * If we are connected then the destination needs to be 4231 * the same as the connected one. 4232 */ 4233 if (icmp->icmp_state == TS_DATA_XFER && 4234 !conn_same_as_last_v6(connp, sin6)) { 4235 error = EISCONN; 4236 goto ud_error2; 4237 } 4238 error = icmp_output_ancillary(connp, NULL, sin6, 4239 data_mp, mp, NULL, cr, pid); 4240 } else { 4241 ip_xmit_attr_t *ixa; 4242 4243 /* 4244 * We have to allocate an ip_xmit_attr_t before we grab 4245 * conn_lock and we need to hold conn_lock once we've 4246 * checked conn_same_as_last_v6 to handle concurrent 4247 * send* calls on a socket. 4248 */ 4249 ixa = conn_get_ixa(connp, B_FALSE); 4250 if (ixa == NULL) { 4251 error = ENOMEM; 4252 goto ud_error2; 4253 } 4254 mutex_enter(&connp->conn_lock); 4255 4256 if (conn_same_as_last_v6(connp, sin6) && 4257 connp->conn_lastsrcid == srcid && 4258 ipsec_outbound_policy_current(ixa)) { 4259 /* icmp_output_lastdst drops conn_lock */ 4260 error = icmp_output_lastdst(connp, data_mp, cr, 4261 pid, ixa); 4262 } else { 4263 /* icmp_output_newdst drops conn_lock */ 4264 error = icmp_output_newdst(connp, data_mp, NULL, 4265 sin6, cr, pid, ixa); 4266 } 4267 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4268 } 4269 if (error == 0) { 4270 freeb(mp); 4271 return; 4272 } 4273 break; 4274 4275 case AF_INET: 4276 sin = (sin_t *)addr; 4277 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) || 4278 (sin->sin_family != AF_INET)) { 4279 error = EADDRNOTAVAIL; 4280 goto ud_error2; 4281 } 4282 if (sin->sin_addr.s_addr == INADDR_ANY) 4283 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 4284 4285 /* Protocol 255 contains full IP headers */ 4286 /* Read without holding lock */ 4287 if (icmp->icmp_hdrincl) { 4288 if (MBLKL(data_mp) < IP_SIMPLE_HDR_LENGTH) { 4289 if (!pullupmsg(data_mp, IP_SIMPLE_HDR_LENGTH)) { 4290 error = EINVAL; 4291 goto ud_error2; 4292 } 4293 } 4294 error = icmp_output_hdrincl(connp, data_mp, cr, pid); 4295 if (error == 0) { 4296 freeb(mp); 4297 return; 4298 } 4299 /* data_mp consumed above */ 4300 data_mp = NULL; 4301 goto ud_error2; 4302 } 4303 4304 if (tudr->OPT_length != 0) { 4305 /* 4306 * If we are connected then the destination needs to be 4307 * the same as the connected one. 4308 */ 4309 if (icmp->icmp_state == TS_DATA_XFER && 4310 !conn_same_as_last_v4(connp, sin)) { 4311 error = EISCONN; 4312 goto ud_error2; 4313 } 4314 error = icmp_output_ancillary(connp, sin, NULL, 4315 data_mp, mp, NULL, cr, pid); 4316 } else { 4317 ip_xmit_attr_t *ixa; 4318 4319 /* 4320 * We have to allocate an ip_xmit_attr_t before we grab 4321 * conn_lock and we need to hold conn_lock once we've 4322 * checked conn_same_as_last_v4 to handle concurrent 4323 * send* calls on a socket. 4324 */ 4325 ixa = conn_get_ixa(connp, B_FALSE); 4326 if (ixa == NULL) { 4327 error = ENOMEM; 4328 goto ud_error2; 4329 } 4330 mutex_enter(&connp->conn_lock); 4331 4332 if (conn_same_as_last_v4(connp, sin) && 4333 ipsec_outbound_policy_current(ixa)) { 4334 /* icmp_output_lastdst drops conn_lock */ 4335 error = icmp_output_lastdst(connp, data_mp, cr, 4336 pid, ixa); 4337 } else { 4338 /* icmp_output_newdst drops conn_lock */ 4339 error = icmp_output_newdst(connp, data_mp, sin, 4340 NULL, cr, pid, ixa); 4341 } 4342 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4343 } 4344 if (error == 0) { 4345 freeb(mp); 4346 return; 4347 } 4348 break; 4349 } 4350 ASSERT(mp != NULL); 4351 /* mp is freed by the following routine */ 4352 icmp_ud_err(q, mp, (t_scalar_t)error); 4353 return; 4354 4355 ud_error2: 4356 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4357 freemsg(data_mp); 4358 ASSERT(mp != NULL); 4359 /* mp is freed by the following routine */ 4360 icmp_ud_err(q, mp, (t_scalar_t)error); 4361 } 4362 4363 /* 4364 * Handle the case of the IP address or flow label being different 4365 * for both IPv4 and IPv6. 4366 * 4367 * NOTE: The caller must hold conn_lock and we drop it here. 4368 */ 4369 static int 4370 icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6, 4371 cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa) 4372 { 4373 icmp_t *icmp = connp->conn_icmp; 4374 icmp_stack_t *is = icmp->icmp_is; 4375 int error; 4376 ip_xmit_attr_t *oldixa; 4377 boolean_t do_ipsec; 4378 uint_t srcid; 4379 uint32_t flowinfo; 4380 in6_addr_t v6src; 4381 in6_addr_t v6dst; 4382 in6_addr_t v6nexthop; 4383 in_port_t dstport; 4384 4385 ASSERT(MUTEX_HELD(&connp->conn_lock)); 4386 ASSERT(ixa != NULL); 4387 4388 /* 4389 * We hold conn_lock across all the use and modifications of 4390 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they 4391 * stay consistent. 4392 */ 4393 4394 ASSERT(cr != NULL); 4395 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4396 ixa->ixa_cred = cr; 4397 ixa->ixa_cpid = pid; 4398 if (is_system_labeled()) { 4399 /* We need to restart with a label based on the cred */ 4400 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4401 } 4402 /* 4403 * If we are connected then the destination needs to be the 4404 * same as the connected one, which is not the case here since we 4405 * checked for that above. 4406 */ 4407 if (icmp->icmp_state == TS_DATA_XFER) { 4408 mutex_exit(&connp->conn_lock); 4409 error = EISCONN; 4410 goto ud_error; 4411 } 4412 4413 /* In case previous destination was multicast or multirt */ 4414 ip_attr_newdst(ixa); 4415 4416 /* 4417 * If laddr is unspecified then we look at sin6_src_id. 4418 * We will give precedence to a source address set with IPV6_PKTINFO 4419 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 4420 * want ip_attr_connect to select a source (since it can fail) when 4421 * IPV6_PKTINFO is specified. 4422 * If this doesn't result in a source address then we get a source 4423 * from ip_attr_connect() below. 4424 */ 4425 v6src = connp->conn_saddr_v6; 4426 if (sin != NULL) { 4427 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 4428 dstport = sin->sin_port; 4429 flowinfo = 0; 4430 srcid = 0; 4431 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4432 if (srcid != 0 && V4_PART_OF_V6(&v6src) == INADDR_ANY) { 4433 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4434 connp->conn_netstack); 4435 } 4436 ixa->ixa_flags |= IXAF_IS_IPV4; 4437 } else { 4438 v6dst = sin6->sin6_addr; 4439 dstport = sin6->sin6_port; 4440 flowinfo = sin6->sin6_flowinfo; 4441 srcid = sin6->__sin6_src_id; 4442 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 4443 ixa->ixa_scopeid = sin6->sin6_scope_id; 4444 ixa->ixa_flags |= IXAF_SCOPEID_SET; 4445 } else { 4446 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4447 } 4448 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 4449 ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4450 connp->conn_netstack); 4451 } 4452 if (IN6_IS_ADDR_V4MAPPED(&v6dst)) 4453 ixa->ixa_flags |= IXAF_IS_IPV4; 4454 else 4455 ixa->ixa_flags &= ~IXAF_IS_IPV4; 4456 } 4457 /* Handle IPV6_PKTINFO setting source address. */ 4458 if (IN6_IS_ADDR_UNSPECIFIED(&v6src) && 4459 (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR)) { 4460 ip_pkt_t *ipp = &connp->conn_xmit_ipp; 4461 4462 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4463 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4464 v6src = ipp->ipp_addr; 4465 } else { 4466 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4467 v6src = ipp->ipp_addr; 4468 } 4469 } 4470 4471 /* Defer IPsec if it might need to look at ICMP type/code */ 4472 switch (ixa->ixa_protocol) { 4473 case IPPROTO_ICMP: 4474 case IPPROTO_ICMPV6: 4475 do_ipsec = B_FALSE; 4476 break; 4477 default: 4478 do_ipsec = B_TRUE; 4479 } 4480 4481 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop); 4482 mutex_exit(&connp->conn_lock); 4483 4484 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 4485 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 4486 (do_ipsec ? IPDF_IPSEC : 0)); 4487 switch (error) { 4488 case 0: 4489 break; 4490 case EADDRNOTAVAIL: 4491 /* 4492 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4493 * Don't have the application see that errno 4494 */ 4495 error = ENETUNREACH; 4496 goto failed; 4497 case ENETDOWN: 4498 /* 4499 * Have !ipif_addr_ready address; drop packet silently 4500 * until we can get applications to not send until we 4501 * are ready. 4502 */ 4503 error = 0; 4504 goto failed; 4505 case EHOSTUNREACH: 4506 case ENETUNREACH: 4507 if (ixa->ixa_ire != NULL) { 4508 /* 4509 * Let conn_ip_output/ire_send_noroute return 4510 * the error and send any local ICMP error. 4511 */ 4512 error = 0; 4513 break; 4514 } 4515 /* FALLTHRU */ 4516 default: 4517 failed: 4518 goto ud_error; 4519 } 4520 4521 mutex_enter(&connp->conn_lock); 4522 /* 4523 * While we dropped the lock some other thread might have connected 4524 * this socket. If so we bail out with EISCONN to ensure that the 4525 * connecting thread is the one that updates conn_ixa, conn_ht_* 4526 * and conn_*last*. 4527 */ 4528 if (icmp->icmp_state == TS_DATA_XFER) { 4529 mutex_exit(&connp->conn_lock); 4530 error = EISCONN; 4531 goto ud_error; 4532 } 4533 4534 /* 4535 * We need to rebuild the headers if 4536 * - we are labeling packets (could be different for different 4537 * destinations) 4538 * - we have a source route (or routing header) since we need to 4539 * massage that to get the pseudo-header checksum 4540 * - a socket option with COA_HEADER_CHANGED has been set which 4541 * set conn_v6lastdst to zero. 4542 * 4543 * Otherwise the prepend function will just update the src, dst, 4544 * and flow label. 4545 */ 4546 if (is_system_labeled()) { 4547 /* TX MLP requires SCM_UCRED and don't have that here */ 4548 if (connp->conn_mlp_type != mlptSingle) { 4549 mutex_exit(&connp->conn_lock); 4550 error = ECONNREFUSED; 4551 goto ud_error; 4552 } 4553 /* 4554 * Check whether Trusted Solaris policy allows communication 4555 * with this host, and pretend that the destination is 4556 * unreachable if not. 4557 * Compute any needed label and place it in ipp_label_v4/v6. 4558 * 4559 * Later conn_build_hdr_template/conn_prepend_hdr takes 4560 * ipp_label_v4/v6 to form the packet. 4561 * 4562 * Tsol note: Since we hold conn_lock we know no other 4563 * thread manipulates conn_xmit_ipp. 4564 */ 4565 error = conn_update_label(connp, ixa, &v6dst, 4566 &connp->conn_xmit_ipp); 4567 if (error != 0) { 4568 mutex_exit(&connp->conn_lock); 4569 goto ud_error; 4570 } 4571 /* Rebuild the header template */ 4572 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4573 flowinfo); 4574 if (error != 0) { 4575 mutex_exit(&connp->conn_lock); 4576 goto ud_error; 4577 } 4578 } else if (connp->conn_xmit_ipp.ipp_fields & 4579 (IPPF_IPV4_OPTIONS|IPPF_RTHDR) || 4580 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) { 4581 /* Rebuild the header template */ 4582 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4583 flowinfo); 4584 if (error != 0) { 4585 mutex_exit(&connp->conn_lock); 4586 goto ud_error; 4587 } 4588 } else { 4589 /* Simply update the destination address if no source route */ 4590 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4591 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc; 4592 4593 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst); 4594 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 4595 ipha->ipha_fragment_offset_and_flags |= 4596 IPH_DF_HTONS; 4597 } else { 4598 ipha->ipha_fragment_offset_and_flags &= 4599 ~IPH_DF_HTONS; 4600 } 4601 } else { 4602 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc; 4603 ip6h->ip6_dst = v6dst; 4604 } 4605 } 4606 4607 /* 4608 * Remember the dst etc which corresponds to the built header 4609 * template and conn_ixa. 4610 */ 4611 oldixa = conn_replace_ixa(connp, ixa); 4612 connp->conn_v6lastdst = v6dst; 4613 connp->conn_lastflowinfo = flowinfo; 4614 connp->conn_lastscopeid = ixa->ixa_scopeid; 4615 connp->conn_lastsrcid = srcid; 4616 /* Also remember a source to use together with lastdst */ 4617 connp->conn_v6lastsrc = v6src; 4618 4619 data_mp = icmp_prepend_header_template(connp, ixa, data_mp, &v6src, 4620 flowinfo, &error); 4621 4622 /* Done with conn_t */ 4623 mutex_exit(&connp->conn_lock); 4624 ixa_refrele(oldixa); 4625 4626 if (data_mp == NULL) { 4627 ASSERT(error != 0); 4628 goto ud_error; 4629 } 4630 4631 if (!do_ipsec) { 4632 /* Policy might differ for different ICMP type/code */ 4633 data_mp = icmp_output_attach_policy(data_mp, connp, ixa); 4634 if (data_mp == NULL) { 4635 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4636 error = EHOSTUNREACH; /* IPsec policy failure */ 4637 goto done; 4638 } 4639 } 4640 4641 /* We're done. Pass the packet to ip. */ 4642 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 4643 4644 error = conn_ip_output(data_mp, ixa); 4645 /* No rawipOutErrors if an error since IP increases its error counter */ 4646 switch (error) { 4647 case 0: 4648 break; 4649 case EWOULDBLOCK: 4650 (void) ixa_check_drain_insert(connp, ixa); 4651 error = 0; 4652 break; 4653 case EADDRNOTAVAIL: 4654 /* 4655 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4656 * Don't have the application see that errno 4657 */ 4658 error = ENETUNREACH; 4659 /* FALLTHRU */ 4660 default: 4661 mutex_enter(&connp->conn_lock); 4662 /* 4663 * Clear the source and v6lastdst so we call ip_attr_connect 4664 * for the next packet and try to pick a better source. 4665 */ 4666 if (connp->conn_mcbc_bind) 4667 connp->conn_saddr_v6 = ipv6_all_zeros; 4668 else 4669 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 4670 connp->conn_v6lastdst = ipv6_all_zeros; 4671 mutex_exit(&connp->conn_lock); 4672 break; 4673 } 4674 done: 4675 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4676 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4677 ixa->ixa_cpid = connp->conn_cpid; 4678 ixa_refrele(ixa); 4679 return (error); 4680 4681 ud_error: 4682 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4683 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4684 ixa->ixa_cpid = connp->conn_cpid; 4685 ixa_refrele(ixa); 4686 4687 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4688 freemsg(data_mp); 4689 return (error); 4690 } 4691 4692 /* ARGSUSED */ 4693 static void 4694 icmp_wput_fallback(queue_t *q, mblk_t *mp) 4695 { 4696 #ifdef DEBUG 4697 cmn_err(CE_CONT, "icmp_wput_fallback: Message during fallback \n"); 4698 #endif 4699 freemsg(mp); 4700 } 4701 4702 static void 4703 icmp_wput_other(queue_t *q, mblk_t *mp) 4704 { 4705 uchar_t *rptr = mp->b_rptr; 4706 struct iocblk *iocp; 4707 conn_t *connp = Q_TO_CONN(q); 4708 icmp_t *icmp = connp->conn_icmp; 4709 icmp_stack_t *is = icmp->icmp_is; 4710 cred_t *cr; 4711 4712 switch (mp->b_datap->db_type) { 4713 case M_PROTO: 4714 case M_PCPROTO: 4715 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) { 4716 /* 4717 * If the message does not contain a PRIM_type, 4718 * throw it away. 4719 */ 4720 freemsg(mp); 4721 return; 4722 } 4723 switch (((t_primp_t)rptr)->type) { 4724 case T_ADDR_REQ: 4725 icmp_addr_req(q, mp); 4726 return; 4727 case O_T_BIND_REQ: 4728 case T_BIND_REQ: 4729 icmp_tpi_bind(q, mp); 4730 return; 4731 case T_CONN_REQ: 4732 icmp_tpi_connect(q, mp); 4733 return; 4734 case T_CAPABILITY_REQ: 4735 icmp_capability_req(q, mp); 4736 return; 4737 case T_INFO_REQ: 4738 icmp_info_req(q, mp); 4739 return; 4740 case T_UNITDATA_REQ: 4741 /* 4742 * If a T_UNITDATA_REQ gets here, the address must 4743 * be bad. Valid T_UNITDATA_REQs are handled 4744 * in icmp_wput. 4745 */ 4746 icmp_ud_err(q, mp, EADDRNOTAVAIL); 4747 return; 4748 case T_UNBIND_REQ: 4749 icmp_tpi_unbind(q, mp); 4750 return; 4751 case T_SVR4_OPTMGMT_REQ: 4752 /* 4753 * All Solaris components should pass a db_credp 4754 * for this TPI message, hence we ASSERT. 4755 * But in case there is some other M_PROTO that looks 4756 * like a TPI message sent by some other kernel 4757 * component, we check and return an error. 4758 */ 4759 cr = msg_getcred(mp, NULL); 4760 ASSERT(cr != NULL); 4761 if (cr == NULL) { 4762 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4763 return; 4764 } 4765 4766 if (!snmpcom_req(q, mp, icmp_snmp_set, ip_snmp_get, 4767 cr)) { 4768 svr4_optcom_req(q, mp, cr, &icmp_opt_obj); 4769 } 4770 return; 4771 4772 case T_OPTMGMT_REQ: 4773 /* 4774 * All Solaris components should pass a db_credp 4775 * for this TPI message, hence we ASSERT. 4776 * But in case there is some other M_PROTO that looks 4777 * like a TPI message sent by some other kernel 4778 * component, we check and return an error. 4779 */ 4780 cr = msg_getcred(mp, NULL); 4781 ASSERT(cr != NULL); 4782 if (cr == NULL) { 4783 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4784 return; 4785 } 4786 tpi_optcom_req(q, mp, cr, &icmp_opt_obj); 4787 return; 4788 4789 case T_DISCON_REQ: 4790 icmp_tpi_disconnect(q, mp); 4791 return; 4792 4793 /* The following TPI message is not supported by icmp. */ 4794 case O_T_CONN_RES: 4795 case T_CONN_RES: 4796 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4797 return; 4798 4799 /* The following 3 TPI requests are illegal for icmp. */ 4800 case T_DATA_REQ: 4801 case T_EXDATA_REQ: 4802 case T_ORDREL_REQ: 4803 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4804 return; 4805 default: 4806 break; 4807 } 4808 break; 4809 case M_FLUSH: 4810 if (*rptr & FLUSHW) 4811 flushq(q, FLUSHDATA); 4812 break; 4813 case M_IOCTL: 4814 iocp = (struct iocblk *)mp->b_rptr; 4815 switch (iocp->ioc_cmd) { 4816 case TI_GETPEERNAME: 4817 if (icmp->icmp_state != TS_DATA_XFER) { 4818 /* 4819 * If a default destination address has not 4820 * been associated with the stream, then we 4821 * don't know the peer's name. 4822 */ 4823 iocp->ioc_error = ENOTCONN; 4824 iocp->ioc_count = 0; 4825 mp->b_datap->db_type = M_IOCACK; 4826 qreply(q, mp); 4827 return; 4828 } 4829 /* FALLTHRU */ 4830 case TI_GETMYNAME: 4831 /* 4832 * For TI_GETPEERNAME and TI_GETMYNAME, we first 4833 * need to copyin the user's strbuf structure. 4834 * Processing will continue in the M_IOCDATA case 4835 * below. 4836 */ 4837 mi_copyin(q, mp, NULL, 4838 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 4839 return; 4840 case ND_SET: 4841 /* nd_getset performs the necessary checking */ 4842 case ND_GET: 4843 if (nd_getset(q, is->is_nd, mp)) { 4844 qreply(q, mp); 4845 return; 4846 } 4847 break; 4848 default: 4849 break; 4850 } 4851 break; 4852 case M_IOCDATA: 4853 icmp_wput_iocdata(q, mp); 4854 return; 4855 default: 4856 /* Unrecognized messages are passed through without change. */ 4857 break; 4858 } 4859 ip_wput_nondata(q, mp); 4860 } 4861 4862 /* 4863 * icmp_wput_iocdata is called by icmp_wput_other to handle all M_IOCDATA 4864 * messages. 4865 */ 4866 static void 4867 icmp_wput_iocdata(queue_t *q, mblk_t *mp) 4868 { 4869 mblk_t *mp1; 4870 STRUCT_HANDLE(strbuf, sb); 4871 uint_t addrlen; 4872 conn_t *connp = Q_TO_CONN(q); 4873 icmp_t *icmp = connp->conn_icmp; 4874 4875 /* Make sure it is one of ours. */ 4876 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4877 case TI_GETMYNAME: 4878 case TI_GETPEERNAME: 4879 break; 4880 default: 4881 ip_wput_nondata(q, mp); 4882 return; 4883 } 4884 4885 switch (mi_copy_state(q, mp, &mp1)) { 4886 case -1: 4887 return; 4888 case MI_COPY_CASE(MI_COPY_IN, 1): 4889 break; 4890 case MI_COPY_CASE(MI_COPY_OUT, 1): 4891 /* 4892 * The address has been copied out, so now 4893 * copyout the strbuf. 4894 */ 4895 mi_copyout(q, mp); 4896 return; 4897 case MI_COPY_CASE(MI_COPY_OUT, 2): 4898 /* 4899 * The address and strbuf have been copied out. 4900 * We're done, so just acknowledge the original 4901 * M_IOCTL. 4902 */ 4903 mi_copy_done(q, mp, 0); 4904 return; 4905 default: 4906 /* 4907 * Something strange has happened, so acknowledge 4908 * the original M_IOCTL with an EPROTO error. 4909 */ 4910 mi_copy_done(q, mp, EPROTO); 4911 return; 4912 } 4913 4914 /* 4915 * Now we have the strbuf structure for TI_GETMYNAME 4916 * and TI_GETPEERNAME. Next we copyout the requested 4917 * address and then we'll copyout the strbuf. 4918 */ 4919 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 4920 (void *)mp1->b_rptr); 4921 4922 if (connp->conn_family == AF_INET) 4923 addrlen = sizeof (sin_t); 4924 else 4925 addrlen = sizeof (sin6_t); 4926 4927 if (STRUCT_FGET(sb, maxlen) < addrlen) { 4928 mi_copy_done(q, mp, EINVAL); 4929 return; 4930 } 4931 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4932 case TI_GETMYNAME: 4933 break; 4934 case TI_GETPEERNAME: 4935 if (icmp->icmp_state != TS_DATA_XFER) { 4936 mi_copy_done(q, mp, ENOTCONN); 4937 return; 4938 } 4939 break; 4940 default: 4941 mi_copy_done(q, mp, EPROTO); 4942 return; 4943 } 4944 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 4945 if (!mp1) 4946 return; 4947 4948 STRUCT_FSET(sb, len, addrlen); 4949 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4950 case TI_GETMYNAME: 4951 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr, 4952 &addrlen); 4953 break; 4954 case TI_GETPEERNAME: 4955 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr, 4956 &addrlen); 4957 break; 4958 } 4959 mp1->b_wptr += addrlen; 4960 /* Copy out the address */ 4961 mi_copyout(q, mp); 4962 } 4963 4964 void 4965 icmp_ddi_g_init(void) 4966 { 4967 icmp_max_optsize = optcom_max_optsize(icmp_opt_obj.odb_opt_des_arr, 4968 icmp_opt_obj.odb_opt_arr_cnt); 4969 4970 /* 4971 * We want to be informed each time a stack is created or 4972 * destroyed in the kernel, so we can maintain the 4973 * set of icmp_stack_t's. 4974 */ 4975 netstack_register(NS_ICMP, rawip_stack_init, NULL, rawip_stack_fini); 4976 } 4977 4978 void 4979 icmp_ddi_g_destroy(void) 4980 { 4981 netstack_unregister(NS_ICMP); 4982 } 4983 4984 #define INET_NAME "ip" 4985 4986 /* 4987 * Initialize the ICMP stack instance. 4988 */ 4989 static void * 4990 rawip_stack_init(netstackid_t stackid, netstack_t *ns) 4991 { 4992 icmp_stack_t *is; 4993 icmpparam_t *pa; 4994 int error = 0; 4995 major_t major; 4996 4997 is = (icmp_stack_t *)kmem_zalloc(sizeof (*is), KM_SLEEP); 4998 is->is_netstack = ns; 4999 5000 pa = (icmpparam_t *)kmem_alloc(sizeof (icmp_param_arr), KM_SLEEP); 5001 is->is_param_arr = pa; 5002 bcopy(icmp_param_arr, is->is_param_arr, sizeof (icmp_param_arr)); 5003 5004 (void) icmp_param_register(&is->is_nd, 5005 is->is_param_arr, A_CNT(icmp_param_arr)); 5006 is->is_ksp = rawip_kstat_init(stackid); 5007 5008 major = mod_name_to_major(INET_NAME); 5009 error = ldi_ident_from_major(major, &is->is_ldi_ident); 5010 ASSERT(error == 0); 5011 return (is); 5012 } 5013 5014 /* 5015 * Free the ICMP stack instance. 5016 */ 5017 static void 5018 rawip_stack_fini(netstackid_t stackid, void *arg) 5019 { 5020 icmp_stack_t *is = (icmp_stack_t *)arg; 5021 5022 nd_free(&is->is_nd); 5023 kmem_free(is->is_param_arr, sizeof (icmp_param_arr)); 5024 is->is_param_arr = NULL; 5025 5026 rawip_kstat_fini(stackid, is->is_ksp); 5027 is->is_ksp = NULL; 5028 ldi_ident_release(is->is_ldi_ident); 5029 kmem_free(is, sizeof (*is)); 5030 } 5031 5032 static void * 5033 rawip_kstat_init(netstackid_t stackid) { 5034 kstat_t *ksp; 5035 5036 rawip_named_kstat_t template = { 5037 { "inDatagrams", KSTAT_DATA_UINT32, 0 }, 5038 { "inCksumErrs", KSTAT_DATA_UINT32, 0 }, 5039 { "inErrors", KSTAT_DATA_UINT32, 0 }, 5040 { "outDatagrams", KSTAT_DATA_UINT32, 0 }, 5041 { "outErrors", KSTAT_DATA_UINT32, 0 }, 5042 }; 5043 5044 ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2", 5045 KSTAT_TYPE_NAMED, 5046 NUM_OF_FIELDS(rawip_named_kstat_t), 5047 0, stackid); 5048 if (ksp == NULL || ksp->ks_data == NULL) 5049 return (NULL); 5050 5051 bcopy(&template, ksp->ks_data, sizeof (template)); 5052 ksp->ks_update = rawip_kstat_update; 5053 ksp->ks_private = (void *)(uintptr_t)stackid; 5054 5055 kstat_install(ksp); 5056 return (ksp); 5057 } 5058 5059 static void 5060 rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp) 5061 { 5062 if (ksp != NULL) { 5063 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 5064 kstat_delete_netstack(ksp, stackid); 5065 } 5066 } 5067 5068 static int 5069 rawip_kstat_update(kstat_t *ksp, int rw) 5070 { 5071 rawip_named_kstat_t *rawipkp; 5072 netstackid_t stackid = (netstackid_t)(uintptr_t)ksp->ks_private; 5073 netstack_t *ns; 5074 icmp_stack_t *is; 5075 5076 if ((ksp == NULL) || (ksp->ks_data == NULL)) 5077 return (EIO); 5078 5079 if (rw == KSTAT_WRITE) 5080 return (EACCES); 5081 5082 rawipkp = (rawip_named_kstat_t *)ksp->ks_data; 5083 5084 ns = netstack_find_by_stackid(stackid); 5085 if (ns == NULL) 5086 return (-1); 5087 is = ns->netstack_icmp; 5088 if (is == NULL) { 5089 netstack_rele(ns); 5090 return (-1); 5091 } 5092 rawipkp->inDatagrams.value.ui32 = is->is_rawip_mib.rawipInDatagrams; 5093 rawipkp->inCksumErrs.value.ui32 = is->is_rawip_mib.rawipInCksumErrs; 5094 rawipkp->inErrors.value.ui32 = is->is_rawip_mib.rawipInErrors; 5095 rawipkp->outDatagrams.value.ui32 = is->is_rawip_mib.rawipOutDatagrams; 5096 rawipkp->outErrors.value.ui32 = is->is_rawip_mib.rawipOutErrors; 5097 netstack_rele(ns); 5098 return (0); 5099 } 5100 5101 /* ARGSUSED */ 5102 int 5103 rawip_accept(sock_lower_handle_t lproto_handle, 5104 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle, 5105 cred_t *cr) 5106 { 5107 return (EOPNOTSUPP); 5108 } 5109 5110 /* ARGSUSED */ 5111 int 5112 rawip_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5113 socklen_t len, cred_t *cr) 5114 { 5115 conn_t *connp = (conn_t *)proto_handle; 5116 int error; 5117 5118 /* All Solaris components should pass a cred for this operation. */ 5119 ASSERT(cr != NULL); 5120 5121 /* Binding to a NULL address really means unbind */ 5122 if (sa == NULL) 5123 error = rawip_do_unbind(connp); 5124 else 5125 error = rawip_do_bind(connp, sa, len); 5126 5127 if (error < 0) { 5128 if (error == -TOUTSTATE) 5129 error = EINVAL; 5130 else 5131 error = proto_tlitosyserr(-error); 5132 } 5133 return (error); 5134 } 5135 5136 static int 5137 rawip_implicit_bind(conn_t *connp) 5138 { 5139 sin6_t sin6addr; 5140 sin_t *sin; 5141 sin6_t *sin6; 5142 socklen_t len; 5143 int error; 5144 5145 if (connp->conn_family == AF_INET) { 5146 len = sizeof (struct sockaddr_in); 5147 sin = (sin_t *)&sin6addr; 5148 *sin = sin_null; 5149 sin->sin_family = AF_INET; 5150 sin->sin_addr.s_addr = INADDR_ANY; 5151 } else { 5152 ASSERT(connp->conn_family == AF_INET6); 5153 len = sizeof (sin6_t); 5154 sin6 = (sin6_t *)&sin6addr; 5155 *sin6 = sin6_null; 5156 sin6->sin6_family = AF_INET6; 5157 V6_SET_ZERO(sin6->sin6_addr); 5158 } 5159 5160 error = rawip_do_bind(connp, (struct sockaddr *)&sin6addr, len); 5161 5162 return ((error < 0) ? proto_tlitosyserr(-error) : error); 5163 } 5164 5165 static int 5166 rawip_unbind(conn_t *connp) 5167 { 5168 int error; 5169 5170 error = rawip_do_unbind(connp); 5171 if (error < 0) { 5172 error = proto_tlitosyserr(-error); 5173 } 5174 return (error); 5175 } 5176 5177 /* ARGSUSED */ 5178 int 5179 rawip_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr) 5180 { 5181 return (EOPNOTSUPP); 5182 } 5183 5184 int 5185 rawip_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa, 5186 socklen_t len, sock_connid_t *id, cred_t *cr) 5187 { 5188 conn_t *connp = (conn_t *)proto_handle; 5189 icmp_t *icmp = connp->conn_icmp; 5190 int error; 5191 boolean_t did_bind = B_FALSE; 5192 pid_t pid = curproc->p_pid; 5193 5194 /* All Solaris components should pass a cred for this operation. */ 5195 ASSERT(cr != NULL); 5196 5197 if (sa == NULL) { 5198 /* 5199 * Disconnect 5200 * Make sure we are connected 5201 */ 5202 if (icmp->icmp_state != TS_DATA_XFER) 5203 return (EINVAL); 5204 5205 error = icmp_disconnect(connp); 5206 return (error); 5207 } 5208 5209 error = proto_verify_ip_addr(connp->conn_family, sa, len); 5210 if (error != 0) 5211 return (error); 5212 5213 /* do an implicit bind if necessary */ 5214 if (icmp->icmp_state == TS_UNBND) { 5215 error = rawip_implicit_bind(connp); 5216 /* 5217 * We could be racing with an actual bind, in which case 5218 * we would see EPROTO. We cross our fingers and try 5219 * to connect. 5220 */ 5221 if (!(error == 0 || error == EPROTO)) 5222 return (error); 5223 did_bind = B_TRUE; 5224 } 5225 5226 /* 5227 * set SO_DGRAM_ERRIND 5228 */ 5229 connp->conn_dgram_errind = B_TRUE; 5230 5231 error = rawip_do_connect(connp, sa, len, cr, pid); 5232 if (error != 0 && did_bind) { 5233 int unbind_err; 5234 5235 unbind_err = rawip_unbind(connp); 5236 ASSERT(unbind_err == 0); 5237 } 5238 5239 if (error == 0) { 5240 *id = 0; 5241 (*connp->conn_upcalls->su_connected)(connp->conn_upper_handle, 5242 0, NULL, -1); 5243 } else if (error < 0) { 5244 error = proto_tlitosyserr(-error); 5245 } 5246 return (error); 5247 } 5248 5249 /* ARGSUSED2 */ 5250 int 5251 rawip_fallback(sock_lower_handle_t proto_handle, queue_t *q, 5252 boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb) 5253 { 5254 conn_t *connp = (conn_t *)proto_handle; 5255 icmp_t *icmp; 5256 struct T_capability_ack tca; 5257 struct sockaddr_in6 laddr, faddr; 5258 socklen_t laddrlen, faddrlen; 5259 short opts; 5260 struct stroptions *stropt; 5261 mblk_t *stropt_mp; 5262 int error; 5263 5264 icmp = connp->conn_icmp; 5265 5266 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL); 5267 5268 /* 5269 * setup the fallback stream that was allocated 5270 */ 5271 connp->conn_dev = (dev_t)RD(q)->q_ptr; 5272 connp->conn_minor_arena = WR(q)->q_ptr; 5273 5274 RD(q)->q_ptr = WR(q)->q_ptr = connp; 5275 5276 WR(q)->q_qinfo = &icmpwinit; 5277 5278 connp->conn_rq = RD(q); 5279 connp->conn_wq = WR(q); 5280 5281 /* Notify stream head about options before sending up data */ 5282 stropt_mp->b_datap->db_type = M_SETOPTS; 5283 stropt_mp->b_wptr += sizeof (*stropt); 5284 stropt = (struct stroptions *)stropt_mp->b_rptr; 5285 stropt->so_flags = SO_WROFF | SO_HIWAT; 5286 stropt->so_wroff = connp->conn_wroff; 5287 stropt->so_hiwat = connp->conn_rcvbuf; 5288 putnext(RD(q), stropt_mp); 5289 5290 /* 5291 * free helper stream 5292 */ 5293 ip_free_helper_stream(connp); 5294 5295 /* 5296 * Collect the information needed to sync with the sonode 5297 */ 5298 icmp_do_capability_ack(icmp, &tca, TC1_INFO); 5299 5300 laddrlen = faddrlen = sizeof (sin6_t); 5301 (void) rawip_getsockname((sock_lower_handle_t)connp, 5302 (struct sockaddr *)&laddr, &laddrlen, CRED()); 5303 error = rawip_getpeername((sock_lower_handle_t)connp, 5304 (struct sockaddr *)&faddr, &faddrlen, CRED()); 5305 if (error != 0) 5306 faddrlen = 0; 5307 opts = 0; 5308 if (connp->conn_dgram_errind) 5309 opts |= SO_DGRAM_ERRIND; 5310 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE) 5311 opts |= SO_DONTROUTE; 5312 5313 (*quiesced_cb)(connp->conn_upper_handle, q, &tca, 5314 (struct sockaddr *)&laddr, laddrlen, 5315 (struct sockaddr *)&faddr, faddrlen, opts); 5316 5317 /* 5318 * Attempts to send data up during fallback will result in it being 5319 * queued in icmp_t. Now we push up any queued packets. 5320 */ 5321 mutex_enter(&icmp->icmp_recv_lock); 5322 while (icmp->icmp_fallback_queue_head != NULL) { 5323 mblk_t *mp; 5324 5325 mp = icmp->icmp_fallback_queue_head; 5326 icmp->icmp_fallback_queue_head = mp->b_next; 5327 mp->b_next = NULL; 5328 mutex_exit(&icmp->icmp_recv_lock); 5329 putnext(RD(q), mp); 5330 mutex_enter(&icmp->icmp_recv_lock); 5331 } 5332 icmp->icmp_fallback_queue_tail = icmp->icmp_fallback_queue_head; 5333 5334 /* 5335 * No longer a streams less socket 5336 */ 5337 mutex_enter(&connp->conn_lock); 5338 connp->conn_flags &= ~IPCL_NONSTR; 5339 mutex_exit(&connp->conn_lock); 5340 5341 mutex_exit(&icmp->icmp_recv_lock); 5342 5343 ASSERT(icmp->icmp_fallback_queue_head == NULL && 5344 icmp->icmp_fallback_queue_tail == NULL); 5345 5346 ASSERT(connp->conn_ref >= 1); 5347 5348 return (0); 5349 } 5350 5351 /* ARGSUSED2 */ 5352 sock_lower_handle_t 5353 rawip_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls, 5354 uint_t *smodep, int *errorp, int flags, cred_t *credp) 5355 { 5356 conn_t *connp; 5357 5358 if (type != SOCK_RAW || (family != AF_INET && family != AF_INET6)) { 5359 *errorp = EPROTONOSUPPORT; 5360 return (NULL); 5361 } 5362 5363 connp = rawip_do_open(family, credp, errorp, flags); 5364 if (connp != NULL) { 5365 connp->conn_flags |= IPCL_NONSTR; 5366 5367 mutex_enter(&connp->conn_lock); 5368 connp->conn_state_flags &= ~CONN_INCIPIENT; 5369 mutex_exit(&connp->conn_lock); 5370 *sock_downcalls = &sock_rawip_downcalls; 5371 *smodep = SM_ATOMIC; 5372 } else { 5373 ASSERT(*errorp != 0); 5374 } 5375 5376 return ((sock_lower_handle_t)connp); 5377 } 5378 5379 /* ARGSUSED3 */ 5380 void 5381 rawip_activate(sock_lower_handle_t proto_handle, 5382 sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls, int flags, 5383 cred_t *cr) 5384 { 5385 conn_t *connp = (conn_t *)proto_handle; 5386 struct sock_proto_props sopp; 5387 5388 /* All Solaris components should pass a cred for this operation. */ 5389 ASSERT(cr != NULL); 5390 5391 connp->conn_upcalls = sock_upcalls; 5392 connp->conn_upper_handle = sock_handle; 5393 5394 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT | 5395 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ; 5396 sopp.sopp_wroff = connp->conn_wroff; 5397 sopp.sopp_rxhiwat = connp->conn_rcvbuf; 5398 sopp.sopp_rxlowat = connp->conn_rcvlowat; 5399 sopp.sopp_maxblk = INFPSZ; 5400 sopp.sopp_maxpsz = IP_MAXPACKET; 5401 sopp.sopp_minpsz = (icmp_mod_info.mi_minpsz == 1) ? 0 : 5402 icmp_mod_info.mi_minpsz; 5403 5404 (*connp->conn_upcalls->su_set_proto_props) 5405 (connp->conn_upper_handle, &sopp); 5406 5407 icmp_bind_proto(connp->conn_icmp); 5408 } 5409 5410 /* ARGSUSED3 */ 5411 int 5412 rawip_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5413 socklen_t *salenp, cred_t *cr) 5414 { 5415 conn_t *connp = (conn_t *)proto_handle; 5416 icmp_t *icmp = connp->conn_icmp; 5417 int error; 5418 5419 /* All Solaris components should pass a cred for this operation. */ 5420 ASSERT(cr != NULL); 5421 5422 mutex_enter(&connp->conn_lock); 5423 if (icmp->icmp_state != TS_DATA_XFER) 5424 error = ENOTCONN; 5425 else 5426 error = conn_getpeername(connp, sa, salenp); 5427 mutex_exit(&connp->conn_lock); 5428 return (error); 5429 } 5430 5431 /* ARGSUSED3 */ 5432 int 5433 rawip_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5434 socklen_t *salenp, cred_t *cr) 5435 { 5436 conn_t *connp = (conn_t *)proto_handle; 5437 int error; 5438 5439 /* All Solaris components should pass a cred for this operation. */ 5440 ASSERT(cr != NULL); 5441 5442 mutex_enter(&connp->conn_lock); 5443 error = conn_getsockname(connp, sa, salenp); 5444 mutex_exit(&connp->conn_lock); 5445 return (error); 5446 } 5447 5448 int 5449 rawip_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5450 const void *optvalp, socklen_t optlen, cred_t *cr) 5451 { 5452 conn_t *connp = (conn_t *)proto_handle; 5453 int error; 5454 5455 /* All Solaris components should pass a cred for this operation. */ 5456 ASSERT(cr != NULL); 5457 5458 error = proto_opt_check(level, option_name, optlen, NULL, 5459 icmp_opt_obj.odb_opt_des_arr, 5460 icmp_opt_obj.odb_opt_arr_cnt, 5461 B_TRUE, B_FALSE, cr); 5462 5463 if (error != 0) { 5464 /* 5465 * option not recognized 5466 */ 5467 if (error < 0) { 5468 error = proto_tlitosyserr(-error); 5469 } 5470 return (error); 5471 } 5472 5473 error = icmp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, 5474 option_name, optlen, (uchar_t *)optvalp, (uint_t *)&optlen, 5475 (uchar_t *)optvalp, NULL, cr); 5476 5477 ASSERT(error >= 0); 5478 5479 return (error); 5480 } 5481 5482 int 5483 rawip_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5484 void *optvalp, socklen_t *optlen, cred_t *cr) 5485 { 5486 int error; 5487 conn_t *connp = (conn_t *)proto_handle; 5488 t_uscalar_t max_optbuf_len; 5489 void *optvalp_buf; 5490 int len; 5491 5492 /* All Solaris components should pass a cred for this operation. */ 5493 ASSERT(cr != NULL); 5494 5495 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len, 5496 icmp_opt_obj.odb_opt_des_arr, 5497 icmp_opt_obj.odb_opt_arr_cnt, 5498 B_FALSE, B_TRUE, cr); 5499 5500 if (error != 0) { 5501 if (error < 0) { 5502 error = proto_tlitosyserr(-error); 5503 } 5504 return (error); 5505 } 5506 5507 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP); 5508 len = icmp_opt_get(connp, level, option_name, optvalp_buf); 5509 if (len == -1) { 5510 kmem_free(optvalp_buf, max_optbuf_len); 5511 return (EINVAL); 5512 } 5513 5514 /* 5515 * update optlen and copy option value 5516 */ 5517 t_uscalar_t size = MIN(len, *optlen); 5518 5519 bcopy(optvalp_buf, optvalp, size); 5520 bcopy(&size, optlen, sizeof (size)); 5521 5522 kmem_free(optvalp_buf, max_optbuf_len); 5523 return (0); 5524 } 5525 5526 /* ARGSUSED1 */ 5527 int 5528 rawip_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr) 5529 { 5530 conn_t *connp = (conn_t *)proto_handle; 5531 5532 /* All Solaris components should pass a cred for this operation. */ 5533 ASSERT(cr != NULL); 5534 5535 (void) rawip_do_close(connp); 5536 return (0); 5537 } 5538 5539 /* ARGSUSED2 */ 5540 int 5541 rawip_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr) 5542 { 5543 conn_t *connp = (conn_t *)proto_handle; 5544 5545 /* All Solaris components should pass a cred for this operation. */ 5546 ASSERT(cr != NULL); 5547 5548 /* shut down the send side */ 5549 if (how != SHUT_RD) 5550 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5551 SOCK_OPCTL_SHUT_SEND, 0); 5552 /* shut down the recv side */ 5553 if (how != SHUT_WR) 5554 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5555 SOCK_OPCTL_SHUT_RECV, 0); 5556 return (0); 5557 } 5558 5559 void 5560 rawip_clr_flowctrl(sock_lower_handle_t proto_handle) 5561 { 5562 conn_t *connp = (conn_t *)proto_handle; 5563 icmp_t *icmp = connp->conn_icmp; 5564 5565 mutex_enter(&icmp->icmp_recv_lock); 5566 connp->conn_flow_cntrld = B_FALSE; 5567 mutex_exit(&icmp->icmp_recv_lock); 5568 } 5569 5570 int 5571 rawip_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg, 5572 int mode, int32_t *rvalp, cred_t *cr) 5573 { 5574 conn_t *connp = (conn_t *)proto_handle; 5575 int error; 5576 5577 /* All Solaris components should pass a cred for this operation. */ 5578 ASSERT(cr != NULL); 5579 5580 /* 5581 * If we don't have a helper stream then create one. 5582 * ip_create_helper_stream takes care of locking the conn_t, 5583 * so this check for NULL is just a performance optimization. 5584 */ 5585 if (connp->conn_helper_info == NULL) { 5586 icmp_stack_t *is = connp->conn_icmp->icmp_is; 5587 5588 ASSERT(is->is_ldi_ident != NULL); 5589 5590 /* 5591 * Create a helper stream for non-STREAMS socket. 5592 */ 5593 error = ip_create_helper_stream(connp, is->is_ldi_ident); 5594 if (error != 0) { 5595 ip0dbg(("rawip_ioctl: create of IP helper stream " 5596 "failed %d\n", error)); 5597 return (error); 5598 } 5599 } 5600 5601 switch (cmd) { 5602 case ND_SET: 5603 case ND_GET: 5604 case _SIOCSOCKFALLBACK: 5605 case TI_GETPEERNAME: 5606 case TI_GETMYNAME: 5607 #ifdef DEBUG 5608 cmn_err(CE_CONT, "icmp_ioctl cmd 0x%x on non streams" 5609 " socket", cmd); 5610 #endif 5611 error = EINVAL; 5612 break; 5613 default: 5614 /* 5615 * Pass on to IP using helper stream 5616 */ 5617 error = ldi_ioctl(connp->conn_helper_info->iphs_handle, 5618 cmd, arg, mode, cr, rvalp); 5619 break; 5620 } 5621 return (error); 5622 } 5623 5624 int 5625 rawip_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg, 5626 cred_t *cr) 5627 { 5628 sin6_t *sin6; 5629 sin_t *sin = NULL; 5630 uint_t srcid; 5631 conn_t *connp = (conn_t *)proto_handle; 5632 icmp_t *icmp = connp->conn_icmp; 5633 int error = 0; 5634 icmp_stack_t *is = icmp->icmp_is; 5635 pid_t pid = curproc->p_pid; 5636 ip_xmit_attr_t *ixa; 5637 5638 ASSERT(DB_TYPE(mp) == M_DATA); 5639 5640 /* All Solaris components should pass a cred for this operation. */ 5641 ASSERT(cr != NULL); 5642 5643 /* do an implicit bind if necessary */ 5644 if (icmp->icmp_state == TS_UNBND) { 5645 error = rawip_implicit_bind(connp); 5646 /* 5647 * We could be racing with an actual bind, in which case 5648 * we would see EPROTO. We cross our fingers and try 5649 * to connect. 5650 */ 5651 if (!(error == 0 || error == EPROTO)) { 5652 freemsg(mp); 5653 return (error); 5654 } 5655 } 5656 5657 /* Protocol 255 contains full IP headers */ 5658 /* Read without holding lock */ 5659 if (icmp->icmp_hdrincl) { 5660 ASSERT(connp->conn_ipversion == IPV4_VERSION); 5661 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) { 5662 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 5663 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5664 freemsg(mp); 5665 return (EINVAL); 5666 } 5667 } 5668 error = icmp_output_hdrincl(connp, mp, cr, pid); 5669 if (is->is_sendto_ignerr) 5670 return (0); 5671 else 5672 return (error); 5673 } 5674 5675 /* Connected? */ 5676 if (msg->msg_name == NULL) { 5677 if (icmp->icmp_state != TS_DATA_XFER) { 5678 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5679 return (EDESTADDRREQ); 5680 } 5681 if (msg->msg_controllen != 0) { 5682 error = icmp_output_ancillary(connp, NULL, NULL, mp, 5683 NULL, msg, cr, pid); 5684 } else { 5685 error = icmp_output_connected(connp, mp, cr, pid); 5686 } 5687 if (is->is_sendto_ignerr) 5688 return (0); 5689 else 5690 return (error); 5691 } 5692 if (icmp->icmp_state == TS_DATA_XFER) { 5693 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5694 return (EISCONN); 5695 } 5696 error = proto_verify_ip_addr(connp->conn_family, 5697 (struct sockaddr *)msg->msg_name, msg->msg_namelen); 5698 if (error != 0) { 5699 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5700 return (error); 5701 } 5702 switch (connp->conn_family) { 5703 case AF_INET6: 5704 sin6 = (sin6_t *)msg->msg_name; 5705 5706 /* No support for mapped addresses on raw sockets */ 5707 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 5708 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5709 return (EADDRNOTAVAIL); 5710 } 5711 srcid = sin6->__sin6_src_id; 5712 5713 /* 5714 * If the local address is a mapped address return 5715 * an error. 5716 * It would be possible to send an IPv6 packet but the 5717 * response would never make it back to the application 5718 * since it is bound to a mapped address. 5719 */ 5720 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 5721 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5722 return (EADDRNOTAVAIL); 5723 } 5724 5725 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 5726 sin6->sin6_addr = ipv6_loopback; 5727 5728 /* 5729 * We have to allocate an ip_xmit_attr_t before we grab 5730 * conn_lock and we need to hold conn_lock once we've check 5731 * conn_same_as_last_v6 to handle concurrent send* calls on a 5732 * socket. 5733 */ 5734 if (msg->msg_controllen == 0) { 5735 ixa = conn_get_ixa(connp, B_FALSE); 5736 if (ixa == NULL) { 5737 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5738 return (ENOMEM); 5739 } 5740 } else { 5741 ixa = NULL; 5742 } 5743 mutex_enter(&connp->conn_lock); 5744 if (icmp->icmp_delayed_error != 0) { 5745 sin6_t *sin2 = (sin6_t *)&icmp->icmp_delayed_addr; 5746 5747 error = icmp->icmp_delayed_error; 5748 icmp->icmp_delayed_error = 0; 5749 5750 /* Compare IP address and family */ 5751 5752 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 5753 &sin2->sin6_addr) && 5754 sin6->sin6_family == sin2->sin6_family) { 5755 mutex_exit(&connp->conn_lock); 5756 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5757 if (ixa != NULL) 5758 ixa_refrele(ixa); 5759 return (error); 5760 } 5761 } 5762 if (msg->msg_controllen != 0) { 5763 mutex_exit(&connp->conn_lock); 5764 ASSERT(ixa == NULL); 5765 error = icmp_output_ancillary(connp, NULL, sin6, mp, 5766 NULL, msg, cr, pid); 5767 } else if (conn_same_as_last_v6(connp, sin6) && 5768 connp->conn_lastsrcid == srcid && 5769 ipsec_outbound_policy_current(ixa)) { 5770 /* icmp_output_lastdst drops conn_lock */ 5771 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5772 } else { 5773 /* icmp_output_newdst drops conn_lock */ 5774 error = icmp_output_newdst(connp, mp, NULL, sin6, cr, 5775 pid, ixa); 5776 } 5777 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5778 if (is->is_sendto_ignerr) 5779 return (0); 5780 else 5781 return (error); 5782 case AF_INET: 5783 sin = (sin_t *)msg->msg_name; 5784 5785 if (sin->sin_addr.s_addr == INADDR_ANY) 5786 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 5787 5788 /* 5789 * We have to allocate an ip_xmit_attr_t before we grab 5790 * conn_lock and we need to hold conn_lock once we've check 5791 * conn_same_as_last_v6 to handle concurrent send* on a socket. 5792 */ 5793 if (msg->msg_controllen == 0) { 5794 ixa = conn_get_ixa(connp, B_FALSE); 5795 if (ixa == NULL) { 5796 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5797 return (ENOMEM); 5798 } 5799 } else { 5800 ixa = NULL; 5801 } 5802 mutex_enter(&connp->conn_lock); 5803 if (icmp->icmp_delayed_error != 0) { 5804 sin_t *sin2 = (sin_t *)&icmp->icmp_delayed_addr; 5805 5806 error = icmp->icmp_delayed_error; 5807 icmp->icmp_delayed_error = 0; 5808 5809 /* Compare IP address */ 5810 5811 if (sin->sin_addr.s_addr == sin2->sin_addr.s_addr) { 5812 mutex_exit(&connp->conn_lock); 5813 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5814 if (ixa != NULL) 5815 ixa_refrele(ixa); 5816 return (error); 5817 } 5818 } 5819 5820 if (msg->msg_controllen != 0) { 5821 mutex_exit(&connp->conn_lock); 5822 ASSERT(ixa == NULL); 5823 error = icmp_output_ancillary(connp, sin, NULL, mp, 5824 NULL, msg, cr, pid); 5825 } else if (conn_same_as_last_v4(connp, sin) && 5826 ipsec_outbound_policy_current(ixa)) { 5827 /* icmp_output_lastdst drops conn_lock */ 5828 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5829 } else { 5830 /* icmp_output_newdst drops conn_lock */ 5831 error = icmp_output_newdst(connp, mp, sin, NULL, cr, 5832 pid, ixa); 5833 } 5834 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5835 if (is->is_sendto_ignerr) 5836 return (0); 5837 else 5838 return (error); 5839 default: 5840 return (EINVAL); 5841 } 5842 } 5843 5844 sock_downcalls_t sock_rawip_downcalls = { 5845 rawip_activate, 5846 rawip_accept, 5847 rawip_bind, 5848 rawip_listen, 5849 rawip_connect, 5850 rawip_getpeername, 5851 rawip_getsockname, 5852 rawip_getsockopt, 5853 rawip_setsockopt, 5854 rawip_send, 5855 NULL, 5856 NULL, 5857 NULL, 5858 rawip_shutdown, 5859 rawip_clr_flowctrl, 5860 rawip_ioctl, 5861 rawip_close 5862 }; 5863