1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #pragma ident "%Z%%M% %I% %E% SMI" 29 30 #include <sys/types.h> 31 #include <sys/stream.h> 32 #include <sys/dlpi.h> 33 #include <sys/stropts.h> 34 #include <sys/sysmacros.h> 35 #include <sys/strsubr.h> 36 #include <sys/strlog.h> 37 #include <sys/strsun.h> 38 #include <sys/zone.h> 39 #define _SUN_TPI_VERSION 2 40 #include <sys/tihdr.h> 41 #include <sys/xti_inet.h> 42 #include <sys/ddi.h> 43 #include <sys/sunddi.h> 44 #include <sys/cmn_err.h> 45 #include <sys/debug.h> 46 #include <sys/kobj.h> 47 #include <sys/modctl.h> 48 #include <sys/atomic.h> 49 #include <sys/policy.h> 50 #include <sys/priv.h> 51 52 #include <sys/systm.h> 53 #include <sys/param.h> 54 #include <sys/kmem.h> 55 #include <sys/sdt.h> 56 #include <sys/socket.h> 57 #include <sys/vtrace.h> 58 #include <sys/isa_defs.h> 59 #include <net/if.h> 60 #include <net/if_arp.h> 61 #include <net/route.h> 62 #include <sys/sockio.h> 63 #include <netinet/in.h> 64 #include <net/if_dl.h> 65 66 #include <inet/common.h> 67 #include <inet/mi.h> 68 #include <inet/mib2.h> 69 #include <inet/nd.h> 70 #include <inet/arp.h> 71 #include <inet/snmpcom.h> 72 #include <inet/kstatcom.h> 73 74 #include <netinet/igmp_var.h> 75 #include <netinet/ip6.h> 76 #include <netinet/icmp6.h> 77 #include <netinet/sctp.h> 78 79 #include <inet/ip.h> 80 #include <inet/ip_impl.h> 81 #include <inet/ip6.h> 82 #include <inet/ip6_asp.h> 83 #include <inet/tcp.h> 84 #include <inet/tcp_impl.h> 85 #include <inet/ip_multi.h> 86 #include <inet/ip_if.h> 87 #include <inet/ip_ire.h> 88 #include <inet/ip_ftable.h> 89 #include <inet/ip_rts.h> 90 #include <inet/optcom.h> 91 #include <inet/ip_ndp.h> 92 #include <inet/ip_listutils.h> 93 #include <netinet/igmp.h> 94 #include <netinet/ip_mroute.h> 95 #include <inet/ipp_common.h> 96 97 #include <net/pfkeyv2.h> 98 #include <inet/ipsec_info.h> 99 #include <inet/sadb.h> 100 #include <inet/ipsec_impl.h> 101 #include <sys/iphada.h> 102 #include <inet/tun.h> 103 #include <inet/ipdrop.h> 104 #include <inet/ip_netinfo.h> 105 106 #include <sys/ethernet.h> 107 #include <net/if_types.h> 108 #include <sys/cpuvar.h> 109 110 #include <ipp/ipp.h> 111 #include <ipp/ipp_impl.h> 112 #include <ipp/ipgpc/ipgpc.h> 113 114 #include <sys/multidata.h> 115 #include <sys/pattr.h> 116 117 #include <inet/ipclassifier.h> 118 #include <inet/sctp_ip.h> 119 #include <inet/sctp/sctp_impl.h> 120 #include <inet/udp_impl.h> 121 #include <sys/sunddi.h> 122 123 #include <sys/tsol/label.h> 124 #include <sys/tsol/tnet.h> 125 126 #include <rpc/pmap_prot.h> 127 128 /* 129 * Values for squeue switch: 130 * IP_SQUEUE_ENTER_NODRAIN: squeue_enter_nodrain 131 * IP_SQUEUE_ENTER: squeue_enter 132 * IP_SQUEUE_FILL: squeue_fill 133 */ 134 int ip_squeue_enter = 2; /* Setable in /etc/system */ 135 136 squeue_func_t ip_input_proc; 137 #define SET_BPREV_FLAG(x) ((mblk_t *)(uintptr_t)(x)) 138 139 #define TCP6 "tcp6" 140 #define TCP "tcp" 141 #define SCTP "sctp" 142 #define SCTP6 "sctp6" 143 144 major_t TCP6_MAJ; 145 major_t TCP_MAJ; 146 major_t SCTP_MAJ; 147 major_t SCTP6_MAJ; 148 149 /* 150 * Setable in /etc/system 151 */ 152 int ip_poll_normal_ms = 100; 153 int ip_poll_normal_ticks = 0; 154 int ip_modclose_ackwait_ms = 3000; 155 156 /* 157 * Structure to represent a linked list of msgblks. Used by ip_snmp_ functions. 158 */ 159 160 struct listptr_s { 161 mblk_t *lp_head; /* pointer to the head of the list */ 162 mblk_t *lp_tail; /* pointer to the tail of the list */ 163 }; 164 165 typedef struct listptr_s listptr_t; 166 167 /* 168 * This is used by ip_snmp_get_mib2_ip_route_media and 169 * ip_snmp_get_mib2_ip6_route_media to carry the lists of return data. 170 */ 171 typedef struct iproutedata_s { 172 uint_t ird_idx; 173 listptr_t ird_route; /* ipRouteEntryTable */ 174 listptr_t ird_netmedia; /* ipNetToMediaEntryTable */ 175 listptr_t ird_attrs; /* ipRouteAttributeTable */ 176 } iproutedata_t; 177 178 /* 179 * Cluster specific hooks. These should be NULL when booted as a non-cluster 180 */ 181 182 /* 183 * Hook functions to enable cluster networking 184 * On non-clustered systems these vectors must always be NULL. 185 * 186 * Hook function to Check ip specified ip address is a shared ip address 187 * in the cluster 188 * 189 */ 190 int (*cl_inet_isclusterwide)(uint8_t protocol, 191 sa_family_t addr_family, uint8_t *laddrp) = NULL; 192 193 /* 194 * Hook function to generate cluster wide ip fragment identifier 195 */ 196 uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family, 197 uint8_t *laddrp, uint8_t *faddrp) = NULL; 198 199 /* 200 * Synchronization notes: 201 * 202 * IP is a fully D_MP STREAMS module/driver. Thus it does not depend on any 203 * MT level protection given by STREAMS. IP uses a combination of its own 204 * internal serialization mechanism and standard Solaris locking techniques. 205 * The internal serialization is per phyint (no IPMP) or per IPMP group. 206 * This is used to serialize plumbing operations, IPMP operations, certain 207 * multicast operations, most set ioctls, igmp/mld timers etc. 208 * 209 * Plumbing is a long sequence of operations involving message 210 * exchanges between IP, ARP and device drivers. Many set ioctls are typically 211 * involved in plumbing operations. A natural model is to serialize these 212 * ioctls one per ill. For example plumbing of hme0 and qfe0 can go on in 213 * parallel without any interference. But various set ioctls on hme0 are best 214 * serialized. However if the system uses IPMP, the operations are easier if 215 * they are serialized on a per IPMP group basis since IPMP operations 216 * happen across ill's of a group. Thus the lowest common denominator is to 217 * serialize most set ioctls, multicast join/leave operations, IPMP operations 218 * igmp/mld timer operations, and processing of DLPI control messages received 219 * from drivers on a per IPMP group basis. If the system does not employ 220 * IPMP the serialization is on a per phyint basis. This serialization is 221 * provided by the ipsq_t and primitives operating on this. Details can 222 * be found in ip_if.c above the core primitives operating on ipsq_t. 223 * 224 * Lookups of an ipif or ill by a thread return a refheld ipif / ill. 225 * Simiarly lookup of an ire by a thread also returns a refheld ire. 226 * In addition ipif's and ill's referenced by the ire are also indirectly 227 * refheld. Thus no ipif or ill can vanish nor can critical parameters like 228 * the ipif's address or netmask change as long as an ipif is refheld 229 * directly or indirectly. For example an SIOCLIFADDR ioctl that changes the 230 * address of an ipif has to go through the ipsq_t. This ensures that only 231 * 1 such exclusive operation proceeds at any time on the ipif. It then 232 * deletes all ires associated with this ipif, and waits for all refcnts 233 * associated with this ipif to come down to zero. The address is changed 234 * only after the ipif has been quiesced. Then the ipif is brought up again. 235 * More details are described above the comment in ip_sioctl_flags. 236 * 237 * Packet processing is based mostly on IREs and are fully multi-threaded 238 * using standard Solaris MT techniques. 239 * 240 * There are explicit locks in IP to handle: 241 * - The ip_g_head list maintained by mi_open_link() and friends. 242 * 243 * - The reassembly data structures (one lock per hash bucket) 244 * 245 * - conn_lock is meant to protect conn_t fields. The fields actually 246 * protected by conn_lock are documented in the conn_t definition. 247 * 248 * - ire_lock to protect some of the fields of the ire, IRE tables 249 * (one lock per hash bucket). Refer to ip_ire.c for details. 250 * 251 * - ndp_g_lock and nce_lock for protecting NCEs. 252 * 253 * - ill_lock protects fields of the ill and ipif. Details in ip.h 254 * 255 * - ill_g_lock: This is a global reader/writer lock. Protects the following 256 * * The AVL tree based global multi list of all ills. 257 * * The linked list of all ipifs of an ill 258 * * The <ill-ipsq> mapping 259 * * The ipsq->ipsq_phyint_list threaded by phyint_ipsq_next 260 * * The illgroup list threaded by ill_group_next. 261 * * <ill-phyint> association 262 * Insertion/deletion of an ill in the system, insertion/deletion of an ipif 263 * into an ill, changing the <ill-ipsq> mapping of an ill, insertion/deletion 264 * of an ill into the illgrp list, changing the <ill-phyint> assoc of an ill 265 * will all have to hold the ill_g_lock as writer for the actual duration 266 * of the insertion/deletion/change. More details about the <ill-ipsq> mapping 267 * may be found in the IPMP section. 268 * 269 * - ill_lock: This is a per ill mutex. 270 * It protects some members of the ill and is documented below. 271 * It also protects the <ill-ipsq> mapping 272 * It also protects the illgroup list threaded by ill_group_next. 273 * It also protects the <ill-phyint> assoc. 274 * It also protects the list of ipifs hanging off the ill. 275 * 276 * - ipsq_lock: This is a per ipsq_t mutex lock. 277 * This protects all the other members of the ipsq struct except 278 * ipsq_refs and ipsq_phyint_list which are protected by ill_g_lock 279 * 280 * - illgrp_lock: This is a per ill_group mutex lock. 281 * The only thing it protects is the illgrp_ill_schednext member of ill_group 282 * which dictates which is the next ill in an ill_group that is to be chosen 283 * for sending outgoing packets, through creation of an IRE_CACHE that 284 * references this ill. 285 * 286 * - phyint_lock: This is a per phyint mutex lock. Protects just the 287 * phyint_flags 288 * 289 * - ip_g_nd_lock: This is a global reader/writer lock. 290 * Any call to nd_load to load a new parameter to the ND table must hold the 291 * lock as writer. ND_GET/ND_SET routines that read the ND table hold the lock 292 * as reader. 293 * 294 * - ip_addr_avail_lock: This is used to ensure the uniqueness of IP addresses. 295 * This lock is held in ipif_up_done and the ipif is marked IPIF_UP and the 296 * uniqueness check also done atomically. 297 * 298 * - ipsec_capab_ills_lock: This readers/writer lock protects the global 299 * lists of IPsec capable ills (ipsec_capab_ills_{ah,esp}). It is taken 300 * as a writer when adding or deleting elements from these lists, and 301 * as a reader when walking these lists to send a SADB update to the 302 * IPsec capable ills. 303 * 304 * - ill_g_usesrc_lock: This readers/writer lock protects the usesrc 305 * group list linked by ill_usesrc_grp_next. It also protects the 306 * ill_usesrc_ifindex field. It is taken as a writer when a member of the 307 * group is being added or deleted. This lock is taken as a reader when 308 * walking the list/group(eg: to get the number of members in a usesrc group). 309 * Note, it is only necessary to take this lock if the ill_usesrc_grp_next 310 * field is changing state i.e from NULL to non-NULL or vice-versa. For 311 * example, it is not necessary to take this lock in the initial portion 312 * of ip_sioctl_slifusesrc or at all in ip_sioctl_groupname and 313 * ip_sioctl_flags since the these operations are executed exclusively and 314 * that ensures that the "usesrc group state" cannot change. The "usesrc 315 * group state" change can happen only in the latter part of 316 * ip_sioctl_slifusesrc and in ill_delete. 317 * 318 * Changing <ill-phyint>, <ill-ipsq>, <ill-illgroup> assocications. 319 * 320 * To change the <ill-phyint> association, the ill_g_lock must be held 321 * as writer, and the ill_locks of both the v4 and v6 instance of the ill 322 * must be held. 323 * 324 * To change the <ill-ipsq> association the ill_g_lock must be held as writer 325 * and the ill_lock of the ill in question must be held. 326 * 327 * To change the <ill-illgroup> association the ill_g_lock must be held as 328 * writer and the ill_lock of the ill in question must be held. 329 * 330 * To add or delete an ipif from the list of ipifs hanging off the ill, 331 * ill_g_lock (writer) and ill_lock must be held and the thread must be 332 * a writer on the associated ipsq,. 333 * 334 * To add or delete an ill to the system, the ill_g_lock must be held as 335 * writer and the thread must be a writer on the associated ipsq. 336 * 337 * To add or delete an ilm to an ill, the ill_lock must be held and the thread 338 * must be a writer on the associated ipsq. 339 * 340 * Lock hierarchy 341 * 342 * Some lock hierarchy scenarios are listed below. 343 * 344 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock 345 * ill_g_lock -> illgrp_lock -> ill_lock 346 * ill_g_lock -> ill_lock(s) -> phyint_lock 347 * ill_g_lock -> ndp_g_lock -> ill_lock -> nce_lock 348 * ill_g_lock -> ip_addr_avail_lock 349 * conn_lock -> irb_lock -> ill_lock -> ire_lock 350 * ill_g_lock -> ip_g_nd_lock 351 * 352 * When more than 1 ill lock is needed to be held, all ill lock addresses 353 * are sorted on address and locked starting from highest addressed lock 354 * downward. 355 * 356 * Mobile-IP scenarios 357 * 358 * irb_lock -> ill_lock -> ire_mrtun_lock 359 * irb_lock -> ill_lock -> ire_srcif_table_lock 360 * 361 * IPsec scenarios 362 * 363 * ipsa_lock -> ill_g_lock -> ill_lock 364 * ipsec_capab_ills_lock -> ill_g_lock -> ill_lock 365 * ipsec_capab_ills_lock -> ipsa_lock 366 * ill_g_usesrc_lock -> ill_g_lock -> ill_lock 367 * 368 * Trusted Solaris scenarios 369 * 370 * igsa_lock -> gcgrp_rwlock -> gcgrp_lock 371 * igsa_lock -> gcdb_lock 372 * gcgrp_rwlock -> ire_lock 373 * gcgrp_rwlock -> gcdb_lock 374 * 375 * 376 * Routing/forwarding table locking notes: 377 * 378 * Lock acquisition order: Radix tree lock, irb_lock. 379 * Requirements: 380 * i. Walker must not hold any locks during the walker callback. 381 * ii Walker must not see a truncated tree during the walk because of any node 382 * deletion. 383 * iii Existing code assumes ire_bucket is valid if it is non-null and is used 384 * in many places in the code to walk the irb list. Thus even if all the 385 * ires in a bucket have been deleted, we still can't free the radix node 386 * until the ires have actually been inactive'd (freed). 387 * 388 * Tree traversal - Need to hold the global tree lock in read mode. 389 * Before dropping the global tree lock, need to either increment the ire_refcnt 390 * to ensure that the radix node can't be deleted. 391 * 392 * Tree add - Need to hold the global tree lock in write mode to add a 393 * radix node. To prevent the node from being deleted, increment the 394 * irb_refcnt, after the node is added to the tree. The ire itself is 395 * added later while holding the irb_lock, but not the tree lock. 396 * 397 * Tree delete - Need to hold the global tree lock and irb_lock in write mode. 398 * All associated ires must be inactive (i.e. freed), and irb_refcnt 399 * must be zero. 400 * 401 * Walker - Increment irb_refcnt before calling the walker callback. Hold the 402 * global tree lock (read mode) for traversal. 403 * 404 * IPSEC notes : 405 * 406 * IP interacts with the IPSEC code (AH/ESP) by tagging a M_CTL message 407 * in front of the actual packet. For outbound datagrams, the M_CTL 408 * contains a ipsec_out_t (defined in ipsec_info.h), which has the 409 * information used by the IPSEC code for applying the right level of 410 * protection. The information initialized by IP in the ipsec_out_t 411 * is determined by the per-socket policy or global policy in the system. 412 * For inbound datagrams, the M_CTL contains a ipsec_in_t (defined in 413 * ipsec_info.h) which starts out with nothing in it. It gets filled 414 * with the right information if it goes through the AH/ESP code, which 415 * happens if the incoming packet is secure. The information initialized 416 * by AH/ESP, is later used by IP(during fanouts to ULP) to see whether 417 * the policy requirements needed by per-socket policy or global policy 418 * is met or not. 419 * 420 * If there is both per-socket policy (set using setsockopt) and there 421 * is also global policy match for the 5 tuples of the socket, 422 * ipsec_override_policy() makes the decision of which one to use. 423 * 424 * For fully connected sockets i.e dst, src [addr, port] is known, 425 * conn_policy_cached is set indicating that policy has been cached. 426 * conn_in_enforce_policy may or may not be set depending on whether 427 * there is a global policy match or per-socket policy match. 428 * Policy inheriting happpens in ip_bind during the ipa_conn_t bind. 429 * Once the right policy is set on the conn_t, policy cannot change for 430 * this socket. This makes life simpler for TCP (UDP ?) where 431 * re-transmissions go out with the same policy. For symmetry, policy 432 * is cached for fully connected UDP sockets also. Thus if policy is cached, 433 * it also implies that policy is latched i.e policy cannot change 434 * on these sockets. As we have the right policy on the conn, we don't 435 * have to lookup global policy for every outbound and inbound datagram 436 * and thus serving as an optimization. Note that a global policy change 437 * does not affect fully connected sockets if they have policy. If fully 438 * connected sockets did not have any policy associated with it, global 439 * policy change may affect them. 440 * 441 * IP Flow control notes: 442 * 443 * Non-TCP streams are flow controlled by IP. On the send side, if the packet 444 * cannot be sent down to the driver by IP, because of a canput failure, IP 445 * does a putq on the conn_wq. This will cause ip_wsrv to run on the conn_wq. 446 * ip_wsrv in turn, inserts the conn in a list of conn's that need to be drained 447 * when the flowcontrol condition subsides. Ultimately STREAMS backenables the 448 * ip_wsrv on the IP module, which in turn does a qenable of the conn_wq of the 449 * first conn in the list of conn's to be drained. ip_wsrv on this conn drains 450 * the queued messages, and removes the conn from the drain list, if all 451 * messages were drained. It also qenables the next conn in the drain list to 452 * continue the drain process. 453 * 454 * In reality the drain list is not a single list, but a configurable number 455 * of lists. The ip_wsrv on the IP module, qenables the first conn in each 456 * list. If the ip_wsrv of the next qenabled conn does not run, because the 457 * stream closes, ip_close takes responsibility to qenable the next conn in 458 * the drain list. The directly called ip_wput path always does a putq, if 459 * it cannot putnext. Thus synchronization problems are handled between 460 * ip_wsrv and ip_close. conn_drain_insert and conn_drain_tail are the only 461 * functions that manipulate this drain list. Furthermore conn_drain_insert 462 * is called only from ip_wsrv, and there can be only 1 instance of ip_wsrv 463 * running on a queue at any time. conn_drain_tail can be simultaneously called 464 * from both ip_wsrv and ip_close. 465 * 466 * IPQOS notes: 467 * 468 * IPQoS Policies are applied to packets using IPPF (IP Policy framework) 469 * and IPQoS modules. IPPF includes hooks in IP at different control points 470 * (callout positions) which direct packets to IPQoS modules for policy 471 * processing. Policies, if present, are global. 472 * 473 * The callout positions are located in the following paths: 474 * o local_in (packets destined for this host) 475 * o local_out (packets orginating from this host ) 476 * o fwd_in (packets forwarded by this m/c - inbound) 477 * o fwd_out (packets forwarded by this m/c - outbound) 478 * Hooks at these callout points can be enabled/disabled using the ndd variable 479 * ip_policy_mask (a bit mask with the 4 LSB indicating the callout positions). 480 * By default all the callout positions are enabled. 481 * 482 * Outbound (local_out) 483 * Hooks are placed in ip_wput_ire and ipsec_out_process. 484 * 485 * Inbound (local_in) 486 * Hooks are placed in ip_proto_input, icmp_inbound, ip_fanout_proto and 487 * TCP and UDP fanout routines. 488 * 489 * Forwarding (in and out) 490 * Hooks are placed in ip_rput_forward and ip_mrtun_forward. 491 * 492 * IP Policy Framework processing (IPPF processing) 493 * Policy processing for a packet is initiated by ip_process, which ascertains 494 * that the classifier (ipgpc) is loaded and configured, failing which the 495 * packet resumes normal processing in IP. If the clasifier is present, the 496 * packet is acted upon by one or more IPQoS modules (action instances), per 497 * filters configured in ipgpc and resumes normal IP processing thereafter. 498 * An action instance can drop a packet in course of its processing. 499 * 500 * A boolean variable, ip_policy, is used in all the fanout routines that can 501 * invoke ip_process for a packet. This variable indicates if the packet should 502 * to be sent for policy processing. The variable is set to B_TRUE by default, 503 * i.e. when the routines are invoked in the normal ip procesing path for a 504 * packet. The two exceptions being ip_wput_local and icmp_inbound_error_fanout; 505 * ip_policy is set to B_FALSE for all the routines called in these two 506 * functions because, in the former case, we don't process loopback traffic 507 * currently while in the latter, the packets have already been processed in 508 * icmp_inbound. 509 * 510 * Zones notes: 511 * 512 * The partitioning rules for networking are as follows: 513 * 1) Packets coming from a zone must have a source address belonging to that 514 * zone. 515 * 2) Packets coming from a zone can only be sent on a physical interface on 516 * which the zone has an IP address. 517 * 3) Between two zones on the same machine, packet delivery is only allowed if 518 * there's a matching route for the destination and zone in the forwarding 519 * table. 520 * 4) The TCP and UDP port spaces are per-zone; that is, two processes in 521 * different zones can bind to the same port with the wildcard address 522 * (INADDR_ANY). 523 * 524 * The granularity of interface partitioning is at the logical interface level. 525 * Therefore, every zone has its own IP addresses, and incoming packets can be 526 * attributed to a zone unambiguously. A logical interface is placed into a zone 527 * using the SIOCSLIFZONE ioctl; this sets the ipif_zoneid field in the ipif_t 528 * structure. Rule (1) is implemented by modifying the source address selection 529 * algorithm so that the list of eligible addresses is filtered based on the 530 * sending process zone. 531 * 532 * The Internet Routing Entries (IREs) are either exclusive to a zone or shared 533 * across all zones, depending on their type. Here is the break-up: 534 * 535 * IRE type Shared/exclusive 536 * -------- ---------------- 537 * IRE_BROADCAST Exclusive 538 * IRE_DEFAULT (default routes) Shared (*) 539 * IRE_LOCAL Exclusive (x) 540 * IRE_LOOPBACK Exclusive 541 * IRE_PREFIX (net routes) Shared (*) 542 * IRE_CACHE Exclusive 543 * IRE_IF_NORESOLVER (interface routes) Exclusive 544 * IRE_IF_RESOLVER (interface routes) Exclusive 545 * IRE_HOST (host routes) Shared (*) 546 * 547 * (*) A zone can only use a default or off-subnet route if the gateway is 548 * directly reachable from the zone, that is, if the gateway's address matches 549 * one of the zone's logical interfaces. 550 * 551 * (x) IRE_LOCAL are handled a bit differently, since for all other entries 552 * in ire_ctable and IRE_INTERFACE, ire_src_addr is what can be used as source 553 * when sending packets using the IRE. For IRE_LOCAL ire_src_addr is the IP 554 * address of the zone itself (the destination). Since IRE_LOCAL is used 555 * for communication between zones, ip_wput_ire has special logic to set 556 * the right source address when sending using an IRE_LOCAL. 557 * 558 * Furthermore, when ip_restrict_interzone_loopback is set (the default), 559 * ire_cache_lookup restricts loopback using an IRE_LOCAL 560 * between zone to the case when L2 would have conceptually looped the packet 561 * back, i.e. the loopback which is required since neither Ethernet drivers 562 * nor Ethernet hardware loops them back. This is the case when the normal 563 * routes (ignoring IREs with different zoneids) would send out the packet on 564 * the same ill (or ill group) as the ill with which is IRE_LOCAL is 565 * associated. 566 * 567 * Multiple zones can share a common broadcast address; typically all zones 568 * share the 255.255.255.255 address. Incoming as well as locally originated 569 * broadcast packets must be dispatched to all the zones on the broadcast 570 * network. For directed broadcasts (e.g. 10.16.72.255) this is not trivial 571 * since some zones may not be on the 10.16.72/24 network. To handle this, each 572 * zone has its own set of IRE_BROADCAST entries; then, broadcast packets are 573 * sent to every zone that has an IRE_BROADCAST entry for the destination 574 * address on the input ill, see conn_wantpacket(). 575 * 576 * Applications in different zones can join the same multicast group address. 577 * For IPv4, group memberships are per-logical interface, so they're already 578 * inherently part of a zone. For IPv6, group memberships are per-physical 579 * interface, so we distinguish IPv6 group memberships based on group address, 580 * interface and zoneid. In both cases, received multicast packets are sent to 581 * every zone for which a group membership entry exists. On IPv6 we need to 582 * check that the target zone still has an address on the receiving physical 583 * interface; it could have been removed since the application issued the 584 * IPV6_JOIN_GROUP. 585 */ 586 587 /* 588 * Squeue Fanout flags: 589 * 0: No fanout. 590 * 1: Fanout across all squeues 591 */ 592 boolean_t ip_squeue_fanout = 0; 593 594 /* 595 * Maximum dups allowed per packet. 596 */ 597 uint_t ip_max_frag_dups = 10; 598 599 #define IS_SIMPLE_IPH(ipha) \ 600 ((ipha)->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION) 601 602 /* RFC1122 Conformance */ 603 #define IP_FORWARD_DEFAULT IP_FORWARD_NEVER 604 605 #define ILL_MAX_NAMELEN LIFNAMSIZ 606 607 static int conn_set_held_ipif(conn_t *, ipif_t **, ipif_t *); 608 609 static mblk_t *ip_wput_attach_llhdr(mblk_t *, ire_t *, ip_proc_t, uint32_t); 610 static void ip_ipsec_out_prepend(mblk_t *, mblk_t *, ill_t *); 611 612 static void icmp_frag_needed(queue_t *, mblk_t *, int, zoneid_t, 613 ip_stack_t *); 614 static void icmp_inbound(queue_t *, mblk_t *, boolean_t, ill_t *, int, 615 uint32_t, boolean_t, boolean_t, ill_t *, zoneid_t); 616 static ipaddr_t icmp_get_nexthop_addr(ipha_t *, ill_t *, zoneid_t, mblk_t *mp); 617 static boolean_t icmp_inbound_too_big(icmph_t *, ipha_t *, ill_t *, zoneid_t, 618 mblk_t *, int, ip_stack_t *); 619 static void icmp_inbound_error_fanout(queue_t *, ill_t *, mblk_t *, 620 icmph_t *, ipha_t *, int, int, boolean_t, boolean_t, 621 ill_t *, zoneid_t); 622 static void icmp_options_update(ipha_t *); 623 static void icmp_param_problem(queue_t *, mblk_t *, uint8_t, zoneid_t, 624 ip_stack_t *); 625 static void icmp_pkt(queue_t *, mblk_t *, void *, size_t, boolean_t, 626 zoneid_t zoneid, ip_stack_t *); 627 static mblk_t *icmp_pkt_err_ok(mblk_t *, ip_stack_t *); 628 static void icmp_redirect(ill_t *, mblk_t *); 629 static void icmp_send_redirect(queue_t *, mblk_t *, ipaddr_t, 630 ip_stack_t *); 631 632 static void ip_arp_news(queue_t *, mblk_t *); 633 static boolean_t ip_bind_insert_ire(mblk_t *, ire_t *, iulp_t *, 634 ip_stack_t *); 635 mblk_t *ip_dlpi_alloc(size_t, t_uscalar_t); 636 char *ip_dot_addr(ipaddr_t, char *); 637 mblk_t *ip_carve_mp(mblk_t **, ssize_t); 638 int ip_close(queue_t *, int); 639 static char *ip_dot_saddr(uchar_t *, char *); 640 static void ip_fanout_proto(queue_t *, mblk_t *, ill_t *, ipha_t *, uint_t, 641 boolean_t, boolean_t, ill_t *, zoneid_t); 642 static void ip_fanout_tcp(queue_t *, mblk_t *, ill_t *, ipha_t *, uint_t, 643 boolean_t, boolean_t, zoneid_t); 644 static void ip_fanout_udp(queue_t *, mblk_t *, ill_t *, ipha_t *, uint32_t, 645 boolean_t, uint_t, boolean_t, boolean_t, ill_t *, zoneid_t); 646 static void ip_lrput(queue_t *, mblk_t *); 647 static void ip_mrtun_forward(ire_t *, ill_t *, mblk_t *); 648 ipaddr_t ip_net_mask(ipaddr_t); 649 void ip_newroute(queue_t *, mblk_t *, ipaddr_t, ill_t *, conn_t *, 650 zoneid_t, ip_stack_t *); 651 static void ip_newroute_ipif(queue_t *, mblk_t *, ipif_t *, ipaddr_t, 652 conn_t *, uint32_t, zoneid_t, ip_opt_info_t *); 653 char *ip_nv_lookup(nv_t *, int); 654 static boolean_t ip_check_for_ipsec_opt(queue_t *, mblk_t *); 655 static int ip_param_get(queue_t *, mblk_t *, caddr_t, cred_t *); 656 static int ip_param_generic_get(queue_t *, mblk_t *, caddr_t, cred_t *); 657 static boolean_t ip_param_register(IDP *ndp, ipparam_t *, size_t, 658 ipndp_t *, size_t); 659 static int ip_param_set(queue_t *, mblk_t *, char *, caddr_t, cred_t *); 660 void ip_rput(queue_t *, mblk_t *); 661 static void ip_rput_dlpi_writer(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp, 662 void *dummy_arg); 663 void ip_rput_forward(ire_t *, ipha_t *, mblk_t *, ill_t *); 664 static int ip_rput_forward_options(mblk_t *, ipha_t *, ire_t *, 665 ip_stack_t *); 666 static boolean_t ip_rput_local_options(queue_t *, mblk_t *, ipha_t *, 667 ire_t *, ip_stack_t *); 668 static boolean_t ip_rput_multimblk_ipoptions(queue_t *, ill_t *, 669 mblk_t *, ipha_t **, ipaddr_t *, ip_stack_t *); 670 static int ip_rput_options(queue_t *, mblk_t *, ipha_t *, ipaddr_t *, 671 ip_stack_t *); 672 static boolean_t ip_rput_fragment(queue_t *, mblk_t **, ipha_t *, uint32_t *, 673 uint16_t *); 674 int ip_snmp_get(queue_t *, mblk_t *); 675 static mblk_t *ip_snmp_get_mib2_ip(queue_t *, mblk_t *, 676 mib2_ipIfStatsEntry_t *, ip_stack_t *); 677 static mblk_t *ip_snmp_get_mib2_ip_traffic_stats(queue_t *, mblk_t *, 678 ip_stack_t *); 679 static mblk_t *ip_snmp_get_mib2_ip6(queue_t *, mblk_t *, ip_stack_t *); 680 static mblk_t *ip_snmp_get_mib2_icmp(queue_t *, mblk_t *, ip_stack_t *ipst); 681 static mblk_t *ip_snmp_get_mib2_icmp6(queue_t *, mblk_t *, ip_stack_t *ipst); 682 static mblk_t *ip_snmp_get_mib2_igmp(queue_t *, mblk_t *, ip_stack_t *ipst); 683 static mblk_t *ip_snmp_get_mib2_multi(queue_t *, mblk_t *, ip_stack_t *ipst); 684 static mblk_t *ip_snmp_get_mib2_ip_addr(queue_t *, mblk_t *, 685 ip_stack_t *ipst); 686 static mblk_t *ip_snmp_get_mib2_ip6_addr(queue_t *, mblk_t *, 687 ip_stack_t *ipst); 688 static mblk_t *ip_snmp_get_mib2_ip_group_src(queue_t *, mblk_t *, 689 ip_stack_t *ipst); 690 static mblk_t *ip_snmp_get_mib2_ip6_group_src(queue_t *, mblk_t *, 691 ip_stack_t *ipst); 692 static mblk_t *ip_snmp_get_mib2_ip_group_mem(queue_t *, mblk_t *, 693 ip_stack_t *ipst); 694 static mblk_t *ip_snmp_get_mib2_ip6_group_mem(queue_t *, mblk_t *, 695 ip_stack_t *ipst); 696 static mblk_t *ip_snmp_get_mib2_virt_multi(queue_t *, mblk_t *, 697 ip_stack_t *ipst); 698 static mblk_t *ip_snmp_get_mib2_multi_rtable(queue_t *, mblk_t *, 699 ip_stack_t *ipst); 700 static mblk_t *ip_snmp_get_mib2_ip_route_media(queue_t *, mblk_t *, 701 ip_stack_t *ipst); 702 static mblk_t *ip_snmp_get_mib2_ip6_route_media(queue_t *, mblk_t *, 703 ip_stack_t *ipst); 704 static void ip_snmp_get2_v4(ire_t *, iproutedata_t *); 705 static void ip_snmp_get2_v6_route(ire_t *, iproutedata_t *); 706 static int ip_snmp_get2_v6_media(nce_t *, iproutedata_t *); 707 int ip_snmp_set(queue_t *, int, int, uchar_t *, int); 708 static boolean_t ip_source_routed(ipha_t *, ip_stack_t *); 709 static boolean_t ip_source_route_included(ipha_t *); 710 static void ip_trash_ire_reclaim_stack(ip_stack_t *); 711 712 static void ip_wput_frag(ire_t *, mblk_t *, ip_pkt_t, uint32_t, uint32_t, 713 zoneid_t, ip_stack_t *); 714 static mblk_t *ip_wput_frag_copyhdr(uchar_t *, int, int, ip_stack_t *); 715 static void ip_wput_local_options(ipha_t *, ip_stack_t *); 716 static int ip_wput_options(queue_t *, mblk_t *, ipha_t *, boolean_t, 717 zoneid_t, ip_stack_t *); 718 719 static void conn_drain_init(ip_stack_t *); 720 static void conn_drain_fini(ip_stack_t *); 721 static void conn_drain_tail(conn_t *connp, boolean_t closing); 722 723 static void conn_walk_drain(ip_stack_t *); 724 static void conn_walk_fanout_table(connf_t *, uint_t, pfv_t, void *, 725 zoneid_t); 726 727 static void *ip_stack_init(netstackid_t stackid, netstack_t *ns); 728 static void ip_stack_shutdown(netstackid_t stackid, void *arg); 729 static void ip_stack_fini(netstackid_t stackid, void *arg); 730 731 static boolean_t conn_wantpacket(conn_t *, ill_t *, ipha_t *, int, 732 zoneid_t); 733 static void ip_arp_done(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp, 734 void *dummy_arg); 735 736 static int ip_forward_set(queue_t *, mblk_t *, char *, caddr_t, cred_t *); 737 738 static int ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t, 739 ipaddr_t, ipaddr_t, uint_t *, mcast_record_t, ipaddr_t, mblk_t *), ire_t *, 740 conn_t *, boolean_t, ipaddr_t, mcast_record_t, ipaddr_t, mblk_t *); 741 static void ip_multirt_bad_mtu(ire_t *, uint32_t); 742 743 static int ip_cgtp_filter_get(queue_t *, mblk_t *, caddr_t, cred_t *); 744 static int ip_cgtp_filter_set(queue_t *, mblk_t *, char *, 745 caddr_t, cred_t *); 746 extern int ip_squeue_bind_set(queue_t *q, mblk_t *mp, char *value, 747 caddr_t cp, cred_t *cr); 748 extern int ip_squeue_profile_set(queue_t *, mblk_t *, char *, caddr_t, 749 cred_t *); 750 static int ip_input_proc_set(queue_t *q, mblk_t *mp, char *value, 751 caddr_t cp, cred_t *cr); 752 static int ip_int_set(queue_t *, mblk_t *, char *, caddr_t, 753 cred_t *); 754 static squeue_func_t ip_squeue_switch(int); 755 756 static void *ip_kstat_init(netstackid_t, ip_stack_t *); 757 static void ip_kstat_fini(netstackid_t, kstat_t *); 758 static int ip_kstat_update(kstat_t *kp, int rw); 759 static void *icmp_kstat_init(netstackid_t); 760 static void icmp_kstat_fini(netstackid_t, kstat_t *); 761 static int icmp_kstat_update(kstat_t *kp, int rw); 762 static void *ip_kstat2_init(netstackid_t, ip_stat_t *); 763 static void ip_kstat2_fini(netstackid_t, kstat_t *); 764 765 static int ip_conn_report(queue_t *, mblk_t *, caddr_t, cred_t *); 766 767 static mblk_t *ip_tcp_input(mblk_t *, ipha_t *, ill_t *, boolean_t, 768 ire_t *, mblk_t *, uint_t, queue_t *, ill_rx_ring_t *); 769 770 static void ip_rput_process_forward(queue_t *, mblk_t *, ire_t *, 771 ipha_t *, ill_t *, boolean_t); 772 773 static void ip_rput_process_forward(queue_t *, mblk_t *, ire_t *, 774 ipha_t *, ill_t *, boolean_t); 775 ipaddr_t ip_g_all_ones = IP_HOST_MASK; 776 777 /* How long, in seconds, we allow frags to hang around. */ 778 #define IP_FRAG_TIMEOUT 60 779 780 /* 781 * Threshold which determines whether MDT should be used when 782 * generating IP fragments; payload size must be greater than 783 * this threshold for MDT to take place. 784 */ 785 #define IP_WPUT_FRAG_MDT_MIN 32768 786 787 /* Setable in /etc/system only */ 788 int ip_wput_frag_mdt_min = IP_WPUT_FRAG_MDT_MIN; 789 790 static long ip_rput_pullups; 791 int dohwcksum = 1; /* use h/w cksum if supported by the hardware */ 792 793 vmem_t *ip_minor_arena; 794 795 int ip_debug; 796 797 #ifdef DEBUG 798 uint32_t ipsechw_debug = 0; 799 #endif 800 801 /* 802 * Multirouting/CGTP stuff 803 */ 804 cgtp_filter_ops_t *ip_cgtp_filter_ops; /* CGTP hooks */ 805 int ip_cgtp_filter_rev = CGTP_FILTER_REV; /* CGTP hooks version */ 806 boolean_t ip_cgtp_filter; /* Enable/disable CGTP hooks */ 807 808 /* 809 * XXX following really should only be in a header. Would need more 810 * header and .c clean up first. 811 */ 812 extern optdb_obj_t ip_opt_obj; 813 814 ulong_t ip_squeue_enter_unbound = 0; 815 816 /* 817 * Named Dispatch Parameter Table. 818 * All of these are alterable, within the min/max values given, at run time. 819 */ 820 static ipparam_t lcl_param_arr[] = { 821 /* min max value name */ 822 { 0, 1, 0, "ip_respond_to_address_mask_broadcast"}, 823 { 0, 1, 1, "ip_respond_to_echo_broadcast"}, 824 { 0, 1, 1, "ip_respond_to_echo_multicast"}, 825 { 0, 1, 0, "ip_respond_to_timestamp"}, 826 { 0, 1, 0, "ip_respond_to_timestamp_broadcast"}, 827 { 0, 1, 1, "ip_send_redirects"}, 828 { 0, 1, 0, "ip_forward_directed_broadcasts"}, 829 { 0, 10, 0, "ip_debug"}, 830 { 0, 10, 0, "ip_mrtdebug"}, 831 { 5000, 999999999, 60000, "ip_ire_timer_interval" }, 832 { 60000, 999999999, 1200000, "ip_ire_arp_interval" }, 833 { 60000, 999999999, 60000, "ip_ire_redirect_interval" }, 834 { 1, 255, 255, "ip_def_ttl" }, 835 { 0, 1, 0, "ip_forward_src_routed"}, 836 { 0, 256, 32, "ip_wroff_extra" }, 837 { 5000, 999999999, 600000, "ip_ire_pathmtu_interval" }, 838 { 8, 65536, 64, "ip_icmp_return_data_bytes" }, 839 { 0, 1, 1, "ip_path_mtu_discovery" }, 840 { 0, 240, 30, "ip_ignore_delete_time" }, 841 { 0, 1, 0, "ip_ignore_redirect" }, 842 { 0, 1, 1, "ip_output_queue" }, 843 { 1, 254, 1, "ip_broadcast_ttl" }, 844 { 0, 99999, 100, "ip_icmp_err_interval" }, 845 { 1, 99999, 10, "ip_icmp_err_burst" }, 846 { 0, 999999999, 1000000, "ip_reass_queue_bytes" }, 847 { 0, 1, 0, "ip_strict_dst_multihoming" }, 848 { 1, MAX_ADDRS_PER_IF, 256, "ip_addrs_per_if"}, 849 { 0, 1, 0, "ipsec_override_persocket_policy" }, 850 { 0, 1, 1, "icmp_accept_clear_messages" }, 851 { 0, 1, 1, "igmp_accept_clear_messages" }, 852 { 2, 999999999, ND_DELAY_FIRST_PROBE_TIME, 853 "ip_ndp_delay_first_probe_time"}, 854 { 1, 999999999, ND_MAX_UNICAST_SOLICIT, 855 "ip_ndp_max_unicast_solicit"}, 856 { 1, 255, IPV6_MAX_HOPS, "ip6_def_hops" }, 857 { 8, IPV6_MIN_MTU, IPV6_MIN_MTU, "ip6_icmp_return_data_bytes" }, 858 { 0, 1, 0, "ip6_forward_src_routed"}, 859 { 0, 1, 1, "ip6_respond_to_echo_multicast"}, 860 { 0, 1, 1, "ip6_send_redirects"}, 861 { 0, 1, 0, "ip6_ignore_redirect" }, 862 { 0, 1, 0, "ip6_strict_dst_multihoming" }, 863 864 { 1, 8, 3, "ip_ire_reclaim_fraction" }, 865 866 { 0, 999999, 1000, "ipsec_policy_log_interval" }, 867 868 { 0, 1, 1, "pim_accept_clear_messages" }, 869 { 1000, 20000, 2000, "ip_ndp_unsolicit_interval" }, 870 { 1, 20, 3, "ip_ndp_unsolicit_count" }, 871 { 0, 1, 1, "ip6_ignore_home_address_opt" }, 872 { 0, 15, 0, "ip_policy_mask" }, 873 { 1000, 60000, 1000, "ip_multirt_resolution_interval" }, 874 { 0, 255, 1, "ip_multirt_ttl" }, 875 { 0, 1, 1, "ip_multidata_outbound" }, 876 { 0, 3600000, 300000, "ip_ndp_defense_interval" }, 877 { 0, 999999, 60*60*24, "ip_max_temp_idle" }, 878 { 0, 1000, 1, "ip_max_temp_defend" }, 879 { 0, 1000, 3, "ip_max_defend" }, 880 { 0, 999999, 30, "ip_defend_interval" }, 881 { 0, 3600000, 300000, "ip_dup_recovery" }, 882 { 0, 1, 1, "ip_restrict_interzone_loopback" }, 883 { 0, 1, 1, "ip_lso_outbound" }, 884 #ifdef DEBUG 885 { 0, 1, 0, "ip6_drop_inbound_icmpv6" }, 886 #else 887 { 0, 0, 0, "" }, 888 #endif 889 }; 890 891 /* 892 * Extended NDP table 893 * The addresses for the first two are filled in to be ips_ip_g_forward 894 * and ips_ipv6_forward at init time. 895 */ 896 static ipndp_t lcl_ndp_arr[] = { 897 /* getf setf data name */ 898 #define IPNDP_IP_FORWARDING_OFFSET 0 899 { ip_param_generic_get, ip_forward_set, NULL, 900 "ip_forwarding" }, 901 #define IPNDP_IP6_FORWARDING_OFFSET 1 902 { ip_param_generic_get, ip_forward_set, NULL, 903 "ip6_forwarding" }, 904 { ip_ill_report, NULL, NULL, 905 "ip_ill_status" }, 906 { ip_ipif_report, NULL, NULL, 907 "ip_ipif_status" }, 908 { ip_ire_report, NULL, NULL, 909 "ipv4_ire_status" }, 910 { ip_ire_report_mrtun, NULL, NULL, 911 "ipv4_mrtun_ire_status" }, 912 { ip_ire_report_srcif, NULL, NULL, 913 "ipv4_srcif_ire_status" }, 914 { ip_ire_report_v6, NULL, NULL, 915 "ipv6_ire_status" }, 916 { ip_conn_report, NULL, NULL, 917 "ip_conn_status" }, 918 { nd_get_long, nd_set_long, (caddr_t)&ip_rput_pullups, 919 "ip_rput_pullups" }, 920 { ndp_report, NULL, NULL, 921 "ip_ndp_cache_report" }, 922 { ip_srcid_report, NULL, NULL, 923 "ip_srcid_status" }, 924 { ip_param_generic_get, ip_squeue_profile_set, 925 (caddr_t)&ip_squeue_profile, "ip_squeue_profile" }, 926 { ip_param_generic_get, ip_squeue_bind_set, 927 (caddr_t)&ip_squeue_bind, "ip_squeue_bind" }, 928 { ip_param_generic_get, ip_input_proc_set, 929 (caddr_t)&ip_squeue_enter, "ip_squeue_enter" }, 930 { ip_param_generic_get, ip_int_set, 931 (caddr_t)&ip_squeue_fanout, "ip_squeue_fanout" }, 932 #define IPNDP_CGTP_FILTER_OFFSET 16 933 { ip_cgtp_filter_get, ip_cgtp_filter_set, NULL, 934 "ip_cgtp_filter" }, 935 { ip_param_generic_get, ip_int_set, 936 (caddr_t)&ip_soft_rings_cnt, "ip_soft_rings_cnt" }, 937 }; 938 939 /* 940 * Table of IP ioctls encoding the various properties of the ioctl and 941 * indexed based on the last byte of the ioctl command. Occasionally there 942 * is a clash, and there is more than 1 ioctl with the same last byte. 943 * In such a case 1 ioctl is encoded in the ndx table and the remaining 944 * ioctls are encoded in the misc table. An entry in the ndx table is 945 * retrieved by indexing on the last byte of the ioctl command and comparing 946 * the ioctl command with the value in the ndx table. In the event of a 947 * mismatch the misc table is then searched sequentially for the desired 948 * ioctl command. 949 * 950 * Entry: <command> <copyin_size> <flags> <cmd_type> <function> <restart_func> 951 */ 952 ip_ioctl_cmd_t ip_ndx_ioctl_table[] = { 953 /* 000 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 954 /* 001 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 955 /* 002 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 956 /* 003 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 957 /* 004 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 958 /* 005 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 959 /* 006 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 960 /* 007 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 961 /* 008 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 962 /* 009 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 963 964 /* 010 */ { SIOCADDRT, sizeof (struct rtentry), IPI_PRIV, 965 MISC_CMD, ip_siocaddrt, NULL }, 966 /* 011 */ { SIOCDELRT, sizeof (struct rtentry), IPI_PRIV, 967 MISC_CMD, ip_siocdelrt, NULL }, 968 969 /* 012 */ { SIOCSIFADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 970 IF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart }, 971 /* 013 */ { SIOCGIFADDR, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL, 972 IF_CMD, ip_sioctl_get_addr, NULL }, 973 974 /* 014 */ { SIOCSIFDSTADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 975 IF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart }, 976 /* 015 */ { SIOCGIFDSTADDR, sizeof (struct ifreq), 977 IPI_GET_CMD | IPI_REPL, 978 IF_CMD, ip_sioctl_get_dstaddr, NULL }, 979 980 /* 016 */ { SIOCSIFFLAGS, sizeof (struct ifreq), 981 IPI_PRIV | IPI_WR | IPI_REPL, 982 IF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart }, 983 /* 017 */ { SIOCGIFFLAGS, sizeof (struct ifreq), 984 IPI_MODOK | IPI_GET_CMD | IPI_REPL, 985 IF_CMD, ip_sioctl_get_flags, NULL }, 986 987 /* 018 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 988 /* 019 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 989 990 /* copyin size cannot be coded for SIOCGIFCONF */ 991 /* 020 */ { O_SIOCGIFCONF, 0, IPI_GET_CMD | IPI_REPL, 992 MISC_CMD, ip_sioctl_get_ifconf, NULL }, 993 994 /* 021 */ { SIOCSIFMTU, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 995 IF_CMD, ip_sioctl_mtu, NULL }, 996 /* 022 */ { SIOCGIFMTU, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL, 997 IF_CMD, ip_sioctl_get_mtu, NULL }, 998 /* 023 */ { SIOCGIFBRDADDR, sizeof (struct ifreq), 999 IPI_GET_CMD | IPI_REPL, 1000 IF_CMD, ip_sioctl_get_brdaddr, NULL }, 1001 /* 024 */ { SIOCSIFBRDADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 1002 IF_CMD, ip_sioctl_brdaddr, NULL }, 1003 /* 025 */ { SIOCGIFNETMASK, sizeof (struct ifreq), 1004 IPI_GET_CMD | IPI_REPL, 1005 IF_CMD, ip_sioctl_get_netmask, NULL }, 1006 /* 026 */ { SIOCSIFNETMASK, sizeof (struct ifreq), IPI_PRIV | IPI_WR, 1007 IF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart }, 1008 /* 027 */ { SIOCGIFMETRIC, sizeof (struct ifreq), 1009 IPI_GET_CMD | IPI_REPL, 1010 IF_CMD, ip_sioctl_get_metric, NULL }, 1011 /* 028 */ { SIOCSIFMETRIC, sizeof (struct ifreq), IPI_PRIV, 1012 IF_CMD, ip_sioctl_metric, NULL }, 1013 /* 029 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1014 1015 /* See 166-168 below for extended SIOC*XARP ioctls */ 1016 /* 030 */ { SIOCSARP, sizeof (struct arpreq), IPI_PRIV, 1017 MISC_CMD, ip_sioctl_arp, NULL }, 1018 /* 031 */ { SIOCGARP, sizeof (struct arpreq), IPI_GET_CMD | IPI_REPL, 1019 MISC_CMD, ip_sioctl_arp, NULL }, 1020 /* 032 */ { SIOCDARP, sizeof (struct arpreq), IPI_PRIV, 1021 MISC_CMD, ip_sioctl_arp, NULL }, 1022 1023 /* 033 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1024 /* 034 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1025 /* 035 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1026 /* 036 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1027 /* 037 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1028 /* 038 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1029 /* 039 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1030 /* 040 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1031 /* 041 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1032 /* 042 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1033 /* 043 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1034 /* 044 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1035 /* 045 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1036 /* 046 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1037 /* 047 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1038 /* 048 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1039 /* 049 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1040 /* 050 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1041 /* 051 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1042 /* 052 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1043 /* 053 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1044 1045 /* 054 */ { IF_UNITSEL, sizeof (int), IPI_PRIV | IPI_WR | IPI_MODOK, 1046 MISC_CMD, if_unitsel, if_unitsel_restart }, 1047 1048 /* 055 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1049 /* 056 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1050 /* 057 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1051 /* 058 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1052 /* 059 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1053 /* 060 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1054 /* 061 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1055 /* 062 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1056 /* 063 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1057 /* 064 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1058 /* 065 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1059 /* 066 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1060 /* 067 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1061 /* 068 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1062 /* 069 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1063 /* 070 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1064 /* 071 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1065 /* 072 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1066 1067 /* 073 */ { SIOCSIFNAME, sizeof (struct ifreq), 1068 IPI_PRIV | IPI_WR | IPI_MODOK, 1069 IF_CMD, ip_sioctl_sifname, NULL }, 1070 1071 /* 074 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1072 /* 075 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1073 /* 076 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1074 /* 077 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1075 /* 078 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1076 /* 079 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1077 /* 080 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1078 /* 081 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1079 /* 082 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1080 /* 083 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1081 /* 084 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1082 /* 085 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1083 /* 086 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1084 1085 /* 087 */ { SIOCGIFNUM, sizeof (int), IPI_GET_CMD | IPI_REPL, 1086 MISC_CMD, ip_sioctl_get_ifnum, NULL }, 1087 /* 088 */ { SIOCGIFMUXID, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL, 1088 IF_CMD, ip_sioctl_get_muxid, NULL }, 1089 /* 089 */ { SIOCSIFMUXID, sizeof (struct ifreq), 1090 IPI_PRIV | IPI_WR | IPI_REPL, 1091 IF_CMD, ip_sioctl_muxid, NULL }, 1092 1093 /* Both if and lif variants share same func */ 1094 /* 090 */ { SIOCGIFINDEX, sizeof (struct ifreq), IPI_GET_CMD | IPI_REPL, 1095 IF_CMD, ip_sioctl_get_lifindex, NULL }, 1096 /* Both if and lif variants share same func */ 1097 /* 091 */ { SIOCSIFINDEX, sizeof (struct ifreq), 1098 IPI_PRIV | IPI_WR | IPI_REPL, 1099 IF_CMD, ip_sioctl_slifindex, NULL }, 1100 1101 /* copyin size cannot be coded for SIOCGIFCONF */ 1102 /* 092 */ { SIOCGIFCONF, 0, IPI_GET_CMD | IPI_REPL, 1103 MISC_CMD, ip_sioctl_get_ifconf, NULL }, 1104 /* 093 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1105 /* 094 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1106 /* 095 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1107 /* 096 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1108 /* 097 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1109 /* 098 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1110 /* 099 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1111 /* 100 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1112 /* 101 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1113 /* 102 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1114 /* 103 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1115 /* 104 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1116 /* 105 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1117 /* 106 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1118 /* 107 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1119 /* 108 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1120 /* 109 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1121 1122 /* 110 */ { SIOCLIFREMOVEIF, sizeof (struct lifreq), 1123 IPI_PRIV | IPI_WR | IPI_REPL, 1124 LIF_CMD, ip_sioctl_removeif, 1125 ip_sioctl_removeif_restart }, 1126 /* 111 */ { SIOCLIFADDIF, sizeof (struct lifreq), 1127 IPI_GET_CMD | IPI_PRIV | IPI_WR | IPI_REPL, 1128 LIF_CMD, ip_sioctl_addif, NULL }, 1129 #define SIOCLIFADDR_NDX 112 1130 /* 112 */ { SIOCSLIFADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1131 LIF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart }, 1132 /* 113 */ { SIOCGLIFADDR, sizeof (struct lifreq), 1133 IPI_GET_CMD | IPI_REPL, 1134 LIF_CMD, ip_sioctl_get_addr, NULL }, 1135 /* 114 */ { SIOCSLIFDSTADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1136 LIF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart }, 1137 /* 115 */ { SIOCGLIFDSTADDR, sizeof (struct lifreq), 1138 IPI_GET_CMD | IPI_REPL, 1139 LIF_CMD, ip_sioctl_get_dstaddr, NULL }, 1140 /* 116 */ { SIOCSLIFFLAGS, sizeof (struct lifreq), 1141 IPI_PRIV | IPI_WR | IPI_REPL, 1142 LIF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart }, 1143 /* 117 */ { SIOCGLIFFLAGS, sizeof (struct lifreq), 1144 IPI_GET_CMD | IPI_MODOK | IPI_REPL, 1145 LIF_CMD, ip_sioctl_get_flags, NULL }, 1146 1147 /* 118 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1148 /* 119 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1149 1150 /* 120 */ { O_SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD | IPI_REPL, 1151 ip_sioctl_get_lifconf, NULL }, 1152 /* 121 */ { SIOCSLIFMTU, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1153 LIF_CMD, ip_sioctl_mtu, NULL }, 1154 /* 122 */ { SIOCGLIFMTU, sizeof (struct lifreq), IPI_GET_CMD | IPI_REPL, 1155 LIF_CMD, ip_sioctl_get_mtu, NULL }, 1156 /* 123 */ { SIOCGLIFBRDADDR, sizeof (struct lifreq), 1157 IPI_GET_CMD | IPI_REPL, 1158 LIF_CMD, ip_sioctl_get_brdaddr, NULL }, 1159 /* 124 */ { SIOCSLIFBRDADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1160 LIF_CMD, ip_sioctl_brdaddr, NULL }, 1161 /* 125 */ { SIOCGLIFNETMASK, sizeof (struct lifreq), 1162 IPI_GET_CMD | IPI_REPL, 1163 LIF_CMD, ip_sioctl_get_netmask, NULL }, 1164 /* 126 */ { SIOCSLIFNETMASK, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1165 LIF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart }, 1166 /* 127 */ { SIOCGLIFMETRIC, sizeof (struct lifreq), 1167 IPI_GET_CMD | IPI_REPL, 1168 LIF_CMD, ip_sioctl_get_metric, NULL }, 1169 /* 128 */ { SIOCSLIFMETRIC, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1170 LIF_CMD, ip_sioctl_metric, NULL }, 1171 /* 129 */ { SIOCSLIFNAME, sizeof (struct lifreq), 1172 IPI_PRIV | IPI_WR | IPI_MODOK | IPI_REPL, 1173 LIF_CMD, ip_sioctl_slifname, 1174 ip_sioctl_slifname_restart }, 1175 1176 /* 130 */ { SIOCGLIFNUM, sizeof (struct lifnum), IPI_GET_CMD | IPI_REPL, 1177 MISC_CMD, ip_sioctl_get_lifnum, NULL }, 1178 /* 131 */ { SIOCGLIFMUXID, sizeof (struct lifreq), 1179 IPI_GET_CMD | IPI_REPL, 1180 LIF_CMD, ip_sioctl_get_muxid, NULL }, 1181 /* 132 */ { SIOCSLIFMUXID, sizeof (struct lifreq), 1182 IPI_PRIV | IPI_WR | IPI_REPL, 1183 LIF_CMD, ip_sioctl_muxid, NULL }, 1184 /* 133 */ { SIOCGLIFINDEX, sizeof (struct lifreq), 1185 IPI_GET_CMD | IPI_REPL, 1186 LIF_CMD, ip_sioctl_get_lifindex, 0 }, 1187 /* 134 */ { SIOCSLIFINDEX, sizeof (struct lifreq), 1188 IPI_PRIV | IPI_WR | IPI_REPL, 1189 LIF_CMD, ip_sioctl_slifindex, 0 }, 1190 /* 135 */ { SIOCSLIFTOKEN, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1191 LIF_CMD, ip_sioctl_token, NULL }, 1192 /* 136 */ { SIOCGLIFTOKEN, sizeof (struct lifreq), 1193 IPI_GET_CMD | IPI_REPL, 1194 LIF_CMD, ip_sioctl_get_token, NULL }, 1195 /* 137 */ { SIOCSLIFSUBNET, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1196 LIF_CMD, ip_sioctl_subnet, ip_sioctl_subnet_restart }, 1197 /* 138 */ { SIOCGLIFSUBNET, sizeof (struct lifreq), 1198 IPI_GET_CMD | IPI_REPL, 1199 LIF_CMD, ip_sioctl_get_subnet, NULL }, 1200 /* 139 */ { SIOCSLIFLNKINFO, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1201 LIF_CMD, ip_sioctl_lnkinfo, NULL }, 1202 1203 /* 140 */ { SIOCGLIFLNKINFO, sizeof (struct lifreq), 1204 IPI_GET_CMD | IPI_REPL, 1205 LIF_CMD, ip_sioctl_get_lnkinfo, NULL }, 1206 /* 141 */ { SIOCLIFDELND, sizeof (struct lifreq), IPI_PRIV, 1207 LIF_CMD, ip_siocdelndp_v6, NULL }, 1208 /* 142 */ { SIOCLIFGETND, sizeof (struct lifreq), IPI_GET_CMD, 1209 LIF_CMD, ip_siocqueryndp_v6, NULL }, 1210 /* 143 */ { SIOCLIFSETND, sizeof (struct lifreq), IPI_PRIV, 1211 LIF_CMD, ip_siocsetndp_v6, NULL }, 1212 /* 144 */ { SIOCTMYADDR, sizeof (struct sioc_addrreq), IPI_GET_CMD, 1213 MISC_CMD, ip_sioctl_tmyaddr, NULL }, 1214 /* 145 */ { SIOCTONLINK, sizeof (struct sioc_addrreq), IPI_GET_CMD, 1215 MISC_CMD, ip_sioctl_tonlink, NULL }, 1216 /* 146 */ { SIOCTMYSITE, sizeof (struct sioc_addrreq), 0, 1217 MISC_CMD, ip_sioctl_tmysite, NULL }, 1218 /* 147 */ { SIOCGTUNPARAM, sizeof (struct iftun_req), IPI_REPL, 1219 TUN_CMD, ip_sioctl_tunparam, NULL }, 1220 /* 148 */ { SIOCSTUNPARAM, sizeof (struct iftun_req), 1221 IPI_PRIV | IPI_WR, 1222 TUN_CMD, ip_sioctl_tunparam, NULL }, 1223 1224 /* IPSECioctls handled in ip_sioctl_copyin_setup itself */ 1225 /* 149 */ { SIOCFIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1226 /* 150 */ { SIOCSIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1227 /* 151 */ { SIOCDIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1228 /* 152 */ { SIOCLIPSECONFIG, 0, IPI_PRIV, MISC_CMD, NULL, NULL }, 1229 1230 /* 153 */ { SIOCLIFFAILOVER, sizeof (struct lifreq), 1231 IPI_PRIV | IPI_WR | IPI_REPL, 1232 LIF_CMD, ip_sioctl_move, ip_sioctl_move }, 1233 /* 154 */ { SIOCLIFFAILBACK, sizeof (struct lifreq), 1234 IPI_PRIV | IPI_WR | IPI_REPL, 1235 LIF_CMD, ip_sioctl_move, ip_sioctl_move }, 1236 /* 155 */ { SIOCSLIFGROUPNAME, sizeof (struct lifreq), 1237 IPI_PRIV | IPI_WR, 1238 LIF_CMD, ip_sioctl_groupname, ip_sioctl_groupname }, 1239 /* 156 */ { SIOCGLIFGROUPNAME, sizeof (struct lifreq), 1240 IPI_GET_CMD | IPI_REPL, 1241 LIF_CMD, ip_sioctl_get_groupname, NULL }, 1242 /* 157 */ { SIOCGLIFOINDEX, sizeof (struct lifreq), 1243 IPI_GET_CMD | IPI_REPL, 1244 LIF_CMD, ip_sioctl_get_oindex, NULL }, 1245 1246 /* Leave 158-160 unused; used to be SIOC*IFARP ioctls */ 1247 /* 158 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1248 /* 159 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1249 /* 160 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1250 1251 /* 161 */ { SIOCSLIFOINDEX, sizeof (struct lifreq), IPI_PRIV | IPI_WR, 1252 LIF_CMD, ip_sioctl_slifoindex, NULL }, 1253 1254 /* These are handled in ip_sioctl_copyin_setup itself */ 1255 /* 162 */ { SIOCGIP6ADDRPOLICY, 0, IPI_NULL_BCONT, 1256 MISC_CMD, NULL, NULL }, 1257 /* 163 */ { SIOCSIP6ADDRPOLICY, 0, IPI_PRIV | IPI_NULL_BCONT, 1258 MISC_CMD, NULL, NULL }, 1259 /* 164 */ { SIOCGDSTINFO, 0, IPI_GET_CMD, MISC_CMD, NULL, NULL }, 1260 1261 /* 165 */ { SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD | IPI_REPL, 1262 ip_sioctl_get_lifconf, NULL }, 1263 1264 /* 166 */ { SIOCSXARP, sizeof (struct xarpreq), IPI_PRIV, 1265 MISC_CMD, ip_sioctl_xarp, NULL }, 1266 /* 167 */ { SIOCGXARP, sizeof (struct xarpreq), IPI_GET_CMD | IPI_REPL, 1267 MISC_CMD, ip_sioctl_xarp, NULL }, 1268 /* 168 */ { SIOCDXARP, sizeof (struct xarpreq), IPI_PRIV, 1269 MISC_CMD, ip_sioctl_xarp, NULL }, 1270 1271 /* SIOCPOPSOCKFS is not handled by IP */ 1272 /* 169 */ { IPI_DONTCARE /* SIOCPOPSOCKFS */, 0, 0, 0, NULL, NULL }, 1273 1274 /* 170 */ { SIOCGLIFZONE, sizeof (struct lifreq), 1275 IPI_GET_CMD | IPI_REPL, 1276 LIF_CMD, ip_sioctl_get_lifzone, NULL }, 1277 /* 171 */ { SIOCSLIFZONE, sizeof (struct lifreq), 1278 IPI_PRIV | IPI_WR | IPI_REPL, 1279 LIF_CMD, ip_sioctl_slifzone, 1280 ip_sioctl_slifzone_restart }, 1281 /* 172-174 are SCTP ioctls and not handled by IP */ 1282 /* 172 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1283 /* 173 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1284 /* 174 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL }, 1285 /* 175 */ { SIOCGLIFUSESRC, sizeof (struct lifreq), 1286 IPI_GET_CMD, LIF_CMD, 1287 ip_sioctl_get_lifusesrc, 0 }, 1288 /* 176 */ { SIOCSLIFUSESRC, sizeof (struct lifreq), 1289 IPI_PRIV | IPI_WR, 1290 LIF_CMD, ip_sioctl_slifusesrc, 1291 NULL }, 1292 /* 177 */ { SIOCGLIFSRCOF, 0, IPI_GET_CMD, MISC_CMD, 1293 ip_sioctl_get_lifsrcof, NULL }, 1294 /* 178 */ { SIOCGMSFILTER, sizeof (struct group_filter), IPI_GET_CMD, 1295 MISC_CMD, ip_sioctl_msfilter, NULL }, 1296 /* 179 */ { SIOCSMSFILTER, sizeof (struct group_filter), IPI_WR, 1297 MISC_CMD, ip_sioctl_msfilter, NULL }, 1298 /* 180 */ { SIOCGIPMSFILTER, sizeof (struct ip_msfilter), IPI_GET_CMD, 1299 MISC_CMD, ip_sioctl_msfilter, NULL }, 1300 /* 181 */ { SIOCSIPMSFILTER, sizeof (struct ip_msfilter), IPI_WR, 1301 MISC_CMD, ip_sioctl_msfilter, NULL }, 1302 /* 182 */ { SIOCSIPMPFAILBACK, sizeof (int), IPI_PRIV, MISC_CMD, 1303 ip_sioctl_set_ipmpfailback, NULL } 1304 }; 1305 1306 int ip_ndx_ioctl_count = sizeof (ip_ndx_ioctl_table) / sizeof (ip_ioctl_cmd_t); 1307 1308 ip_ioctl_cmd_t ip_misc_ioctl_table[] = { 1309 { OSIOCGTUNPARAM, sizeof (struct old_iftun_req), 1310 IPI_GET_CMD | IPI_REPL, TUN_CMD, ip_sioctl_tunparam, NULL }, 1311 { OSIOCSTUNPARAM, sizeof (struct old_iftun_req), IPI_PRIV | IPI_WR, 1312 TUN_CMD, ip_sioctl_tunparam, NULL }, 1313 { I_LINK, 0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL }, 1314 { I_UNLINK, 0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL }, 1315 { I_PLINK, 0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL }, 1316 { I_PUNLINK, 0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL }, 1317 { ND_GET, 0, IPI_PASS_DOWN, 0, NULL, NULL }, 1318 { ND_SET, 0, IPI_PRIV | IPI_WR | IPI_PASS_DOWN, 0, NULL, NULL }, 1319 { IP_IOCTL, 0, 0, 0, NULL, NULL }, 1320 { SIOCGETVIFCNT, sizeof (struct sioc_vif_req), IPI_REPL | IPI_GET_CMD, 1321 MISC_CMD, mrt_ioctl}, 1322 { SIOCGETSGCNT, sizeof (struct sioc_sg_req), IPI_REPL | IPI_GET_CMD, 1323 MISC_CMD, mrt_ioctl}, 1324 { SIOCGETLSGCNT, sizeof (struct sioc_lsg_req), IPI_REPL | IPI_GET_CMD, 1325 MISC_CMD, mrt_ioctl} 1326 }; 1327 1328 int ip_misc_ioctl_count = 1329 sizeof (ip_misc_ioctl_table) / sizeof (ip_ioctl_cmd_t); 1330 1331 int conn_drain_nthreads; /* Number of drainers reqd. */ 1332 /* Settable in /etc/system */ 1333 /* Defined in ip_ire.c */ 1334 extern uint32_t ip_ire_max_bucket_cnt, ip6_ire_max_bucket_cnt; 1335 extern uint32_t ip_ire_min_bucket_cnt, ip6_ire_min_bucket_cnt; 1336 extern uint32_t ip_ire_mem_ratio, ip_ire_cpu_ratio; 1337 1338 static nv_t ire_nv_arr[] = { 1339 { IRE_BROADCAST, "BROADCAST" }, 1340 { IRE_LOCAL, "LOCAL" }, 1341 { IRE_LOOPBACK, "LOOPBACK" }, 1342 { IRE_CACHE, "CACHE" }, 1343 { IRE_DEFAULT, "DEFAULT" }, 1344 { IRE_PREFIX, "PREFIX" }, 1345 { IRE_IF_NORESOLVER, "IF_NORESOL" }, 1346 { IRE_IF_RESOLVER, "IF_RESOLV" }, 1347 { IRE_HOST, "HOST" }, 1348 { 0 } 1349 }; 1350 1351 nv_t *ire_nv_tbl = ire_nv_arr; 1352 1353 /* Defined in ip_netinfo.c */ 1354 extern ddi_taskq_t *eventq_queue_nic; 1355 1356 /* Simple ICMP IP Header Template */ 1357 static ipha_t icmp_ipha = { 1358 IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP 1359 }; 1360 1361 struct module_info ip_mod_info = { 1362 IP_MOD_ID, IP_MOD_NAME, 1, INFPSZ, 65536, 1024 1363 }; 1364 1365 /* 1366 * Duplicate static symbols within a module confuses mdb; so we avoid the 1367 * problem by making the symbols here distinct from those in udp.c. 1368 */ 1369 1370 static struct qinit iprinit = { 1371 (pfi_t)ip_rput, NULL, ip_open, ip_close, NULL, 1372 &ip_mod_info 1373 }; 1374 1375 static struct qinit ipwinit = { 1376 (pfi_t)ip_wput, (pfi_t)ip_wsrv, ip_open, ip_close, NULL, 1377 &ip_mod_info 1378 }; 1379 1380 static struct qinit iplrinit = { 1381 (pfi_t)ip_lrput, NULL, ip_open, ip_close, NULL, 1382 &ip_mod_info 1383 }; 1384 1385 static struct qinit iplwinit = { 1386 (pfi_t)ip_lwput, NULL, ip_open, ip_close, NULL, 1387 &ip_mod_info 1388 }; 1389 1390 struct streamtab ipinfo = { 1391 &iprinit, &ipwinit, &iplrinit, &iplwinit 1392 }; 1393 1394 #ifdef DEBUG 1395 static boolean_t skip_sctp_cksum = B_FALSE; 1396 #endif 1397 1398 /* 1399 * Prepend the zoneid using an ipsec_out_t for later use by functions like 1400 * ip_rput_v6(), ip_output(), etc. If the message 1401 * block already has a M_CTL at the front of it, then simply set the zoneid 1402 * appropriately. 1403 */ 1404 mblk_t * 1405 ip_prepend_zoneid(mblk_t *mp, zoneid_t zoneid, ip_stack_t *ipst) 1406 { 1407 mblk_t *first_mp; 1408 ipsec_out_t *io; 1409 1410 ASSERT(zoneid != ALL_ZONES); 1411 if (mp->b_datap->db_type == M_CTL) { 1412 io = (ipsec_out_t *)mp->b_rptr; 1413 ASSERT(io->ipsec_out_type == IPSEC_OUT); 1414 io->ipsec_out_zoneid = zoneid; 1415 return (mp); 1416 } 1417 1418 first_mp = ipsec_alloc_ipsec_out(ipst->ips_netstack); 1419 if (first_mp == NULL) 1420 return (NULL); 1421 io = (ipsec_out_t *)first_mp->b_rptr; 1422 /* This is not a secure packet */ 1423 io->ipsec_out_secure = B_FALSE; 1424 io->ipsec_out_zoneid = zoneid; 1425 first_mp->b_cont = mp; 1426 return (first_mp); 1427 } 1428 1429 /* 1430 * Copy an M_CTL-tagged message, preserving reference counts appropriately. 1431 */ 1432 mblk_t * 1433 ip_copymsg(mblk_t *mp) 1434 { 1435 mblk_t *nmp; 1436 ipsec_info_t *in; 1437 1438 if (mp->b_datap->db_type != M_CTL) 1439 return (copymsg(mp)); 1440 1441 in = (ipsec_info_t *)mp->b_rptr; 1442 1443 /* 1444 * Note that M_CTL is also used for delivering ICMP error messages 1445 * upstream to transport layers. 1446 */ 1447 if (in->ipsec_info_type != IPSEC_OUT && 1448 in->ipsec_info_type != IPSEC_IN) 1449 return (copymsg(mp)); 1450 1451 nmp = copymsg(mp->b_cont); 1452 1453 if (in->ipsec_info_type == IPSEC_OUT) { 1454 return (ipsec_out_tag(mp, nmp, 1455 ((ipsec_out_t *)in)->ipsec_out_ns)); 1456 } else { 1457 return (ipsec_in_tag(mp, nmp, 1458 ((ipsec_in_t *)in)->ipsec_in_ns)); 1459 } 1460 } 1461 1462 /* Generate an ICMP fragmentation needed message. */ 1463 static void 1464 icmp_frag_needed(queue_t *q, mblk_t *mp, int mtu, zoneid_t zoneid, 1465 ip_stack_t *ipst) 1466 { 1467 icmph_t icmph; 1468 mblk_t *first_mp; 1469 boolean_t mctl_present; 1470 1471 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 1472 1473 if (!(mp = icmp_pkt_err_ok(mp, ipst))) { 1474 if (mctl_present) 1475 freeb(first_mp); 1476 return; 1477 } 1478 1479 bzero(&icmph, sizeof (icmph_t)); 1480 icmph.icmph_type = ICMP_DEST_UNREACHABLE; 1481 icmph.icmph_code = ICMP_FRAGMENTATION_NEEDED; 1482 icmph.icmph_du_mtu = htons((uint16_t)mtu); 1483 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutFragNeeded); 1484 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs); 1485 icmp_pkt(q, first_mp, &icmph, sizeof (icmph_t), mctl_present, zoneid, 1486 ipst); 1487 } 1488 1489 /* 1490 * icmp_inbound deals with ICMP messages in the following ways. 1491 * 1492 * 1) It needs to send a reply back and possibly delivering it 1493 * to the "interested" upper clients. 1494 * 2) It needs to send it to the upper clients only. 1495 * 3) It needs to change some values in IP only. 1496 * 4) It needs to change some values in IP and upper layers e.g TCP. 1497 * 1498 * We need to accomodate icmp messages coming in clear until we get 1499 * everything secure from the wire. If icmp_accept_clear_messages 1500 * is zero we check with the global policy and act accordingly. If 1501 * it is non-zero, we accept the message without any checks. But 1502 * *this does not mean* that this will be delivered to the upper 1503 * clients. By accepting we might send replies back, change our MTU 1504 * value etc. but delivery to the ULP/clients depends on their policy 1505 * dispositions. 1506 * 1507 * We handle the above 4 cases in the context of IPSEC in the 1508 * following way : 1509 * 1510 * 1) Send the reply back in the same way as the request came in. 1511 * If it came in encrypted, it goes out encrypted. If it came in 1512 * clear, it goes out in clear. Thus, this will prevent chosen 1513 * plain text attack. 1514 * 2) The client may or may not expect things to come in secure. 1515 * If it comes in secure, the policy constraints are checked 1516 * before delivering it to the upper layers. If it comes in 1517 * clear, ipsec_inbound_accept_clear will decide whether to 1518 * accept this in clear or not. In both the cases, if the returned 1519 * message (IP header + 8 bytes) that caused the icmp message has 1520 * AH/ESP headers, it is sent up to AH/ESP for validation before 1521 * sending up. If there are only 8 bytes of returned message, then 1522 * upper client will not be notified. 1523 * 3) Check with global policy to see whether it matches the constaints. 1524 * But this will be done only if icmp_accept_messages_in_clear is 1525 * zero. 1526 * 4) If we need to change both in IP and ULP, then the decision taken 1527 * while affecting the values in IP and while delivering up to TCP 1528 * should be the same. 1529 * 1530 * There are two cases. 1531 * 1532 * a) If we reject data at the IP layer (ipsec_check_global_policy() 1533 * failed), we will not deliver it to the ULP, even though they 1534 * are *willing* to accept in *clear*. This is fine as our global 1535 * disposition to icmp messages asks us reject the datagram. 1536 * 1537 * b) If we accept data at the IP layer (ipsec_check_global_policy() 1538 * succeeded or icmp_accept_messages_in_clear is 1), and not able 1539 * to deliver it to ULP (policy failed), it can lead to 1540 * consistency problems. The cases known at this time are 1541 * ICMP_DESTINATION_UNREACHABLE messages with following code 1542 * values : 1543 * 1544 * - ICMP_FRAGMENTATION_NEEDED : IP adapts to the new value 1545 * and Upper layer rejects. Then the communication will 1546 * come to a stop. This is solved by making similar decisions 1547 * at both levels. Currently, when we are unable to deliver 1548 * to the Upper Layer (due to policy failures) while IP has 1549 * adjusted ire_max_frag, the next outbound datagram would 1550 * generate a local ICMP_FRAGMENTATION_NEEDED message - which 1551 * will be with the right level of protection. Thus the right 1552 * value will be communicated even if we are not able to 1553 * communicate when we get from the wire initially. But this 1554 * assumes there would be at least one outbound datagram after 1555 * IP has adjusted its ire_max_frag value. To make things 1556 * simpler, we accept in clear after the validation of 1557 * AH/ESP headers. 1558 * 1559 * - Other ICMP ERRORS : We may not be able to deliver it to the 1560 * upper layer depending on the level of protection the upper 1561 * layer expects and the disposition in ipsec_inbound_accept_clear(). 1562 * ipsec_inbound_accept_clear() decides whether a given ICMP error 1563 * should be accepted in clear when the Upper layer expects secure. 1564 * Thus the communication may get aborted by some bad ICMP 1565 * packets. 1566 * 1567 * IPQoS Notes: 1568 * The only instance when a packet is sent for processing is when there 1569 * isn't an ICMP client and if we are interested in it. 1570 * If there is a client, IPPF processing will take place in the 1571 * ip_fanout_proto routine. 1572 * 1573 * Zones notes: 1574 * The packet is only processed in the context of the specified zone: typically 1575 * only this zone will reply to an echo request, and only interested clients in 1576 * this zone will receive a copy of the packet. This means that the caller must 1577 * call icmp_inbound() for each relevant zone. 1578 */ 1579 static void 1580 icmp_inbound(queue_t *q, mblk_t *mp, boolean_t broadcast, ill_t *ill, 1581 int sum_valid, uint32_t sum, boolean_t mctl_present, boolean_t ip_policy, 1582 ill_t *recv_ill, zoneid_t zoneid) 1583 { 1584 icmph_t *icmph; 1585 ipha_t *ipha; 1586 int iph_hdr_length; 1587 int hdr_length; 1588 boolean_t interested; 1589 uint32_t ts; 1590 uchar_t *wptr; 1591 ipif_t *ipif; 1592 mblk_t *first_mp; 1593 ipsec_in_t *ii; 1594 ire_t *src_ire; 1595 boolean_t onlink; 1596 timestruc_t now; 1597 uint32_t ill_index; 1598 ip_stack_t *ipst; 1599 1600 ASSERT(ill != NULL); 1601 ipst = ill->ill_ipst; 1602 1603 first_mp = mp; 1604 if (mctl_present) { 1605 mp = first_mp->b_cont; 1606 ASSERT(mp != NULL); 1607 } 1608 1609 ipha = (ipha_t *)mp->b_rptr; 1610 if (ipst->ips_icmp_accept_clear_messages == 0) { 1611 first_mp = ipsec_check_global_policy(first_mp, NULL, 1612 ipha, NULL, mctl_present, ipst->ips_netstack); 1613 if (first_mp == NULL) 1614 return; 1615 } 1616 1617 /* 1618 * On a labeled system, we have to check whether the zone itself is 1619 * permitted to receive raw traffic. 1620 */ 1621 if (is_system_labeled()) { 1622 if (zoneid == ALL_ZONES) 1623 zoneid = tsol_packet_to_zoneid(mp); 1624 if (!tsol_can_accept_raw(mp, B_FALSE)) { 1625 ip1dbg(("icmp_inbound: zone %d can't receive raw", 1626 zoneid)); 1627 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 1628 freemsg(first_mp); 1629 return; 1630 } 1631 } 1632 1633 /* 1634 * We have accepted the ICMP message. It means that we will 1635 * respond to the packet if needed. It may not be delivered 1636 * to the upper client depending on the policy constraints 1637 * and the disposition in ipsec_inbound_accept_clear. 1638 */ 1639 1640 ASSERT(ill != NULL); 1641 1642 BUMP_MIB(&ipst->ips_icmp_mib, icmpInMsgs); 1643 iph_hdr_length = IPH_HDR_LENGTH(ipha); 1644 if ((mp->b_wptr - mp->b_rptr) < (iph_hdr_length + ICMPH_SIZE)) { 1645 /* Last chance to get real. */ 1646 if (!pullupmsg(mp, iph_hdr_length + ICMPH_SIZE)) { 1647 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 1648 freemsg(first_mp); 1649 return; 1650 } 1651 /* Refresh iph following the pullup. */ 1652 ipha = (ipha_t *)mp->b_rptr; 1653 } 1654 /* ICMP header checksum, including checksum field, should be zero. */ 1655 if (sum_valid ? (sum != 0 && sum != 0xFFFF) : 1656 IP_CSUM(mp, iph_hdr_length, 0)) { 1657 BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs); 1658 freemsg(first_mp); 1659 return; 1660 } 1661 /* The IP header will always be a multiple of four bytes */ 1662 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1663 ip2dbg(("icmp_inbound: type %d code %d\n", icmph->icmph_type, 1664 icmph->icmph_code)); 1665 wptr = (uchar_t *)icmph + ICMPH_SIZE; 1666 /* We will set "interested" to "true" if we want a copy */ 1667 interested = B_FALSE; 1668 switch (icmph->icmph_type) { 1669 case ICMP_ECHO_REPLY: 1670 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchoReps); 1671 break; 1672 case ICMP_DEST_UNREACHABLE: 1673 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) 1674 BUMP_MIB(&ipst->ips_icmp_mib, icmpInFragNeeded); 1675 interested = B_TRUE; /* Pass up to transport */ 1676 BUMP_MIB(&ipst->ips_icmp_mib, icmpInDestUnreachs); 1677 break; 1678 case ICMP_SOURCE_QUENCH: 1679 interested = B_TRUE; /* Pass up to transport */ 1680 BUMP_MIB(&ipst->ips_icmp_mib, icmpInSrcQuenchs); 1681 break; 1682 case ICMP_REDIRECT: 1683 if (!ipst->ips_ip_ignore_redirect) 1684 interested = B_TRUE; 1685 BUMP_MIB(&ipst->ips_icmp_mib, icmpInRedirects); 1686 break; 1687 case ICMP_ECHO_REQUEST: 1688 /* 1689 * Whether to respond to echo requests that come in as IP 1690 * broadcasts or as IP multicast is subject to debate 1691 * (what isn't?). We aim to please, you pick it. 1692 * Default is do it. 1693 */ 1694 if (!broadcast && !CLASSD(ipha->ipha_dst)) { 1695 /* unicast: always respond */ 1696 interested = B_TRUE; 1697 } else if (CLASSD(ipha->ipha_dst)) { 1698 /* multicast: respond based on tunable */ 1699 interested = ipst->ips_ip_g_resp_to_echo_mcast; 1700 } else if (broadcast) { 1701 /* broadcast: respond based on tunable */ 1702 interested = ipst->ips_ip_g_resp_to_echo_bcast; 1703 } 1704 BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchos); 1705 break; 1706 case ICMP_ROUTER_ADVERTISEMENT: 1707 case ICMP_ROUTER_SOLICITATION: 1708 break; 1709 case ICMP_TIME_EXCEEDED: 1710 interested = B_TRUE; /* Pass up to transport */ 1711 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimeExcds); 1712 break; 1713 case ICMP_PARAM_PROBLEM: 1714 interested = B_TRUE; /* Pass up to transport */ 1715 BUMP_MIB(&ipst->ips_icmp_mib, icmpInParmProbs); 1716 break; 1717 case ICMP_TIME_STAMP_REQUEST: 1718 /* Response to Time Stamp Requests is local policy. */ 1719 if (ipst->ips_ip_g_resp_to_timestamp && 1720 /* So is whether to respond if it was an IP broadcast. */ 1721 (!broadcast || ipst->ips_ip_g_resp_to_timestamp_bcast)) { 1722 int tstamp_len = 3 * sizeof (uint32_t); 1723 1724 if (wptr + tstamp_len > mp->b_wptr) { 1725 if (!pullupmsg(mp, wptr + tstamp_len - 1726 mp->b_rptr)) { 1727 BUMP_MIB(ill->ill_ip_mib, 1728 ipIfStatsInDiscards); 1729 freemsg(first_mp); 1730 return; 1731 } 1732 /* Refresh ipha following the pullup. */ 1733 ipha = (ipha_t *)mp->b_rptr; 1734 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1735 wptr = (uchar_t *)icmph + ICMPH_SIZE; 1736 } 1737 interested = B_TRUE; 1738 } 1739 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestamps); 1740 break; 1741 case ICMP_TIME_STAMP_REPLY: 1742 BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestampReps); 1743 break; 1744 case ICMP_INFO_REQUEST: 1745 /* Per RFC 1122 3.2.2.7, ignore this. */ 1746 case ICMP_INFO_REPLY: 1747 break; 1748 case ICMP_ADDRESS_MASK_REQUEST: 1749 if ((ipst->ips_ip_respond_to_address_mask_broadcast || 1750 !broadcast) && 1751 /* TODO m_pullup of complete header? */ 1752 (mp->b_datap->db_lim - wptr) >= IP_ADDR_LEN) 1753 interested = B_TRUE; 1754 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMasks); 1755 break; 1756 case ICMP_ADDRESS_MASK_REPLY: 1757 BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMaskReps); 1758 break; 1759 default: 1760 interested = B_TRUE; /* Pass up to transport */ 1761 BUMP_MIB(&ipst->ips_icmp_mib, icmpInUnknowns); 1762 break; 1763 } 1764 /* See if there is an ICMP client. */ 1765 if (ipst->ips_ipcl_proto_fanout[IPPROTO_ICMP].connf_head != NULL) { 1766 /* If there is an ICMP client and we want one too, copy it. */ 1767 mblk_t *first_mp1; 1768 1769 if (!interested) { 1770 ip_fanout_proto(q, first_mp, ill, ipha, 0, mctl_present, 1771 ip_policy, recv_ill, zoneid); 1772 return; 1773 } 1774 first_mp1 = ip_copymsg(first_mp); 1775 if (first_mp1 != NULL) { 1776 ip_fanout_proto(q, first_mp1, ill, ipha, 1777 0, mctl_present, ip_policy, recv_ill, zoneid); 1778 } 1779 } else if (!interested) { 1780 freemsg(first_mp); 1781 return; 1782 } else { 1783 /* 1784 * Initiate policy processing for this packet if ip_policy 1785 * is true. 1786 */ 1787 if (IPP_ENABLED(IPP_LOCAL_IN, ipst) && ip_policy) { 1788 ill_index = ill->ill_phyint->phyint_ifindex; 1789 ip_process(IPP_LOCAL_IN, &mp, ill_index); 1790 if (mp == NULL) { 1791 if (mctl_present) { 1792 freeb(first_mp); 1793 } 1794 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 1795 return; 1796 } 1797 } 1798 } 1799 /* We want to do something with it. */ 1800 /* Check db_ref to make sure we can modify the packet. */ 1801 if (mp->b_datap->db_ref > 1) { 1802 mblk_t *first_mp1; 1803 1804 first_mp1 = ip_copymsg(first_mp); 1805 freemsg(first_mp); 1806 if (!first_mp1) { 1807 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 1808 return; 1809 } 1810 first_mp = first_mp1; 1811 if (mctl_present) { 1812 mp = first_mp->b_cont; 1813 ASSERT(mp != NULL); 1814 } else { 1815 mp = first_mp; 1816 } 1817 ipha = (ipha_t *)mp->b_rptr; 1818 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1819 wptr = (uchar_t *)icmph + ICMPH_SIZE; 1820 } 1821 switch (icmph->icmph_type) { 1822 case ICMP_ADDRESS_MASK_REQUEST: 1823 ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid); 1824 if (ipif == NULL) { 1825 freemsg(first_mp); 1826 return; 1827 } 1828 /* 1829 * outging interface must be IPv4 1830 */ 1831 ASSERT(ipif != NULL && !ipif->ipif_isv6); 1832 icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY; 1833 bcopy(&ipif->ipif_net_mask, wptr, IP_ADDR_LEN); 1834 ipif_refrele(ipif); 1835 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutAddrMaskReps); 1836 break; 1837 case ICMP_ECHO_REQUEST: 1838 icmph->icmph_type = ICMP_ECHO_REPLY; 1839 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutEchoReps); 1840 break; 1841 case ICMP_TIME_STAMP_REQUEST: { 1842 uint32_t *tsp; 1843 1844 icmph->icmph_type = ICMP_TIME_STAMP_REPLY; 1845 tsp = (uint32_t *)wptr; 1846 tsp++; /* Skip past 'originate time' */ 1847 /* Compute # of milliseconds since midnight */ 1848 gethrestime(&now); 1849 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 1850 now.tv_nsec / (NANOSEC / MILLISEC); 1851 *tsp++ = htonl(ts); /* Lay in 'receive time' */ 1852 *tsp++ = htonl(ts); /* Lay in 'send time' */ 1853 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimestampReps); 1854 break; 1855 } 1856 default: 1857 ipha = (ipha_t *)&icmph[1]; 1858 if ((uchar_t *)&ipha[1] > mp->b_wptr) { 1859 if (!pullupmsg(mp, (uchar_t *)&ipha[1] - mp->b_rptr)) { 1860 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1861 freemsg(first_mp); 1862 return; 1863 } 1864 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1865 ipha = (ipha_t *)&icmph[1]; 1866 } 1867 if ((IPH_HDR_VERSION(ipha) != IPV4_VERSION)) { 1868 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1869 freemsg(first_mp); 1870 return; 1871 } 1872 hdr_length = IPH_HDR_LENGTH(ipha); 1873 if (hdr_length < sizeof (ipha_t)) { 1874 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1875 freemsg(first_mp); 1876 return; 1877 } 1878 if ((uchar_t *)ipha + hdr_length > mp->b_wptr) { 1879 if (!pullupmsg(mp, 1880 (uchar_t *)ipha + hdr_length - mp->b_rptr)) { 1881 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 1882 freemsg(first_mp); 1883 return; 1884 } 1885 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1886 ipha = (ipha_t *)&icmph[1]; 1887 } 1888 switch (icmph->icmph_type) { 1889 case ICMP_REDIRECT: 1890 /* 1891 * As there is no upper client to deliver, we don't 1892 * need the first_mp any more. 1893 */ 1894 if (mctl_present) { 1895 freeb(first_mp); 1896 } 1897 icmp_redirect(ill, mp); 1898 return; 1899 case ICMP_DEST_UNREACHABLE: 1900 if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) { 1901 if (!icmp_inbound_too_big(icmph, ipha, ill, 1902 zoneid, mp, iph_hdr_length, ipst)) { 1903 freemsg(first_mp); 1904 return; 1905 } 1906 /* 1907 * icmp_inbound_too_big() may alter mp. 1908 * Resynch ipha and icmph accordingly. 1909 */ 1910 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1911 ipha = (ipha_t *)&icmph[1]; 1912 } 1913 /* FALLTHRU */ 1914 default : 1915 /* 1916 * IPQoS notes: Since we have already done IPQoS 1917 * processing we don't want to do it again in 1918 * the fanout routines called by 1919 * icmp_inbound_error_fanout, hence the last 1920 * argument, ip_policy, is B_FALSE. 1921 */ 1922 icmp_inbound_error_fanout(q, ill, first_mp, icmph, 1923 ipha, iph_hdr_length, hdr_length, mctl_present, 1924 B_FALSE, recv_ill, zoneid); 1925 } 1926 return; 1927 } 1928 /* Send out an ICMP packet */ 1929 icmph->icmph_checksum = 0; 1930 icmph->icmph_checksum = IP_CSUM(mp, iph_hdr_length, 0); 1931 if (icmph->icmph_checksum == 0) 1932 icmph->icmph_checksum = 0xFFFF; 1933 if (broadcast || CLASSD(ipha->ipha_dst)) { 1934 ipif_t *ipif_chosen; 1935 /* 1936 * Make it look like it was directed to us, so we don't look 1937 * like a fool with a broadcast or multicast source address. 1938 */ 1939 ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid); 1940 /* 1941 * Make sure that we haven't grabbed an interface that's DOWN. 1942 */ 1943 if (ipif != NULL) { 1944 ipif_chosen = ipif_select_source(ipif->ipif_ill, 1945 ipha->ipha_src, zoneid); 1946 if (ipif_chosen != NULL) { 1947 ipif_refrele(ipif); 1948 ipif = ipif_chosen; 1949 } 1950 } 1951 if (ipif == NULL) { 1952 ip0dbg(("icmp_inbound: " 1953 "No source for broadcast/multicast:\n" 1954 "\tsrc 0x%x dst 0x%x ill %p " 1955 "ipif_lcl_addr 0x%x\n", 1956 ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst), 1957 (void *)ill, 1958 ill->ill_ipif->ipif_lcl_addr)); 1959 freemsg(first_mp); 1960 return; 1961 } 1962 ASSERT(ipif != NULL && !ipif->ipif_isv6); 1963 ipha->ipha_dst = ipif->ipif_src_addr; 1964 ipif_refrele(ipif); 1965 } 1966 /* Reset time to live. */ 1967 ipha->ipha_ttl = ipst->ips_ip_def_ttl; 1968 { 1969 /* Swap source and destination addresses */ 1970 ipaddr_t tmp; 1971 1972 tmp = ipha->ipha_src; 1973 ipha->ipha_src = ipha->ipha_dst; 1974 ipha->ipha_dst = tmp; 1975 } 1976 ipha->ipha_ident = 0; 1977 if (!IS_SIMPLE_IPH(ipha)) 1978 icmp_options_update(ipha); 1979 1980 /* 1981 * ICMP echo replies should go out on the same interface 1982 * the request came on as probes used by in.mpathd for detecting 1983 * NIC failures are ECHO packets. We turn-off load spreading 1984 * by setting ipsec_in_attach_if to B_TRUE, which is copied 1985 * to ipsec_out_attach_if by ipsec_in_to_out called later in this 1986 * function. This is in turn handled by ip_wput and ip_newroute 1987 * to make sure that the packet goes out on the interface it came 1988 * in on. If we don't turnoff load spreading, the packets might get 1989 * dropped if there are no non-FAILED/INACTIVE interfaces for it 1990 * to go out and in.mpathd would wrongly detect a failure or 1991 * mis-detect a NIC failure for link failure. As load spreading 1992 * can happen only if ill_group is not NULL, we do only for 1993 * that case and this does not affect the normal case. 1994 * 1995 * We turn off load spreading only on echo packets that came from 1996 * on-link hosts. If the interface route has been deleted, this will 1997 * not be enforced as we can't do much. For off-link hosts, as the 1998 * default routes in IPv4 does not typically have an ire_ipif 1999 * pointer, we can't force MATCH_IRE_ILL in ip_wput/ip_newroute. 2000 * Moreover, expecting a default route through this interface may 2001 * not be correct. We use ipha_dst because of the swap above. 2002 */ 2003 onlink = B_FALSE; 2004 if (icmph->icmph_type == ICMP_ECHO_REPLY && ill->ill_group != NULL) { 2005 /* 2006 * First, we need to make sure that it is not one of our 2007 * local addresses. If we set onlink when it is one of 2008 * our local addresses, we will end up creating IRE_CACHES 2009 * for one of our local addresses. Then, we will never 2010 * accept packets for them afterwards. 2011 */ 2012 src_ire = ire_ctable_lookup(ipha->ipha_dst, 0, IRE_LOCAL, 2013 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 2014 if (src_ire == NULL) { 2015 ipif = ipif_get_next_ipif(NULL, ill); 2016 if (ipif == NULL) { 2017 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2018 freemsg(mp); 2019 return; 2020 } 2021 src_ire = ire_ftable_lookup(ipha->ipha_dst, 0, 0, 2022 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, 2023 NULL, MATCH_IRE_ILL | MATCH_IRE_TYPE, ipst); 2024 ipif_refrele(ipif); 2025 if (src_ire != NULL) { 2026 onlink = B_TRUE; 2027 ire_refrele(src_ire); 2028 } 2029 } else { 2030 ire_refrele(src_ire); 2031 } 2032 } 2033 if (!mctl_present) { 2034 /* 2035 * This packet should go out the same way as it 2036 * came in i.e in clear. To make sure that global 2037 * policy will not be applied to this in ip_wput_ire, 2038 * we attach a IPSEC_IN mp and clear ipsec_in_secure. 2039 */ 2040 ASSERT(first_mp == mp); 2041 first_mp = ipsec_in_alloc(B_TRUE, ipst->ips_netstack); 2042 if (first_mp == NULL) { 2043 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2044 freemsg(mp); 2045 return; 2046 } 2047 ii = (ipsec_in_t *)first_mp->b_rptr; 2048 2049 /* This is not a secure packet */ 2050 ii->ipsec_in_secure = B_FALSE; 2051 if (onlink) { 2052 ii->ipsec_in_attach_if = B_TRUE; 2053 ii->ipsec_in_ill_index = 2054 ill->ill_phyint->phyint_ifindex; 2055 ii->ipsec_in_rill_index = 2056 recv_ill->ill_phyint->phyint_ifindex; 2057 } 2058 first_mp->b_cont = mp; 2059 } else if (onlink) { 2060 ii = (ipsec_in_t *)first_mp->b_rptr; 2061 ii->ipsec_in_attach_if = B_TRUE; 2062 ii->ipsec_in_ill_index = ill->ill_phyint->phyint_ifindex; 2063 ii->ipsec_in_rill_index = recv_ill->ill_phyint->phyint_ifindex; 2064 ii->ipsec_in_ns = ipst->ips_netstack; /* No netstack_hold */ 2065 } else { 2066 ii = (ipsec_in_t *)first_mp->b_rptr; 2067 ii->ipsec_in_ns = ipst->ips_netstack; /* No netstack_hold */ 2068 } 2069 ii->ipsec_in_zoneid = zoneid; 2070 ASSERT(zoneid != ALL_ZONES); 2071 if (!ipsec_in_to_out(first_mp, ipha, NULL)) { 2072 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2073 return; 2074 } 2075 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs); 2076 put(WR(q), first_mp); 2077 } 2078 2079 static ipaddr_t 2080 icmp_get_nexthop_addr(ipha_t *ipha, ill_t *ill, zoneid_t zoneid, mblk_t *mp) 2081 { 2082 conn_t *connp; 2083 connf_t *connfp; 2084 ipaddr_t nexthop_addr = INADDR_ANY; 2085 int hdr_length = IPH_HDR_LENGTH(ipha); 2086 uint16_t *up; 2087 uint32_t ports; 2088 ip_stack_t *ipst = ill->ill_ipst; 2089 2090 up = (uint16_t *)((uchar_t *)ipha + hdr_length); 2091 switch (ipha->ipha_protocol) { 2092 case IPPROTO_TCP: 2093 { 2094 tcph_t *tcph; 2095 2096 /* do a reverse lookup */ 2097 tcph = (tcph_t *)((uchar_t *)ipha + hdr_length); 2098 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcph, 2099 TCPS_LISTEN, ipst); 2100 break; 2101 } 2102 case IPPROTO_UDP: 2103 { 2104 uint32_t dstport, srcport; 2105 2106 ((uint16_t *)&ports)[0] = up[1]; 2107 ((uint16_t *)&ports)[1] = up[0]; 2108 2109 /* Extract ports in net byte order */ 2110 dstport = htons(ntohl(ports) & 0xFFFF); 2111 srcport = htons(ntohl(ports) >> 16); 2112 2113 connfp = &ipst->ips_ipcl_udp_fanout[ 2114 IPCL_UDP_HASH(dstport, ipst)]; 2115 mutex_enter(&connfp->connf_lock); 2116 connp = connfp->connf_head; 2117 2118 /* do a reverse lookup */ 2119 while ((connp != NULL) && 2120 (!IPCL_UDP_MATCH(connp, dstport, 2121 ipha->ipha_src, srcport, ipha->ipha_dst) || 2122 !IPCL_ZONE_MATCH(connp, zoneid))) { 2123 connp = connp->conn_next; 2124 } 2125 if (connp != NULL) 2126 CONN_INC_REF(connp); 2127 mutex_exit(&connfp->connf_lock); 2128 break; 2129 } 2130 case IPPROTO_SCTP: 2131 { 2132 in6_addr_t map_src, map_dst; 2133 2134 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_src); 2135 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_dst); 2136 ((uint16_t *)&ports)[0] = up[1]; 2137 ((uint16_t *)&ports)[1] = up[0]; 2138 2139 connp = sctp_find_conn(&map_src, &map_dst, ports, 2140 0, zoneid, ipst->ips_netstack->netstack_sctp); 2141 if (connp == NULL) { 2142 connp = ipcl_classify_raw(mp, IPPROTO_SCTP, 2143 zoneid, ports, ipha, ipst); 2144 } else { 2145 CONN_INC_REF(connp); 2146 SCTP_REFRELE(CONN2SCTP(connp)); 2147 } 2148 break; 2149 } 2150 default: 2151 { 2152 ipha_t ripha; 2153 2154 ripha.ipha_src = ipha->ipha_dst; 2155 ripha.ipha_dst = ipha->ipha_src; 2156 ripha.ipha_protocol = ipha->ipha_protocol; 2157 2158 connfp = &ipst->ips_ipcl_proto_fanout[ 2159 ipha->ipha_protocol]; 2160 mutex_enter(&connfp->connf_lock); 2161 connp = connfp->connf_head; 2162 for (connp = connfp->connf_head; connp != NULL; 2163 connp = connp->conn_next) { 2164 if (IPCL_PROTO_MATCH(connp, 2165 ipha->ipha_protocol, &ripha, ill, 2166 0, zoneid)) { 2167 CONN_INC_REF(connp); 2168 break; 2169 } 2170 } 2171 mutex_exit(&connfp->connf_lock); 2172 } 2173 } 2174 if (connp != NULL) { 2175 if (connp->conn_nexthop_set) 2176 nexthop_addr = connp->conn_nexthop_v4; 2177 CONN_DEC_REF(connp); 2178 } 2179 return (nexthop_addr); 2180 } 2181 2182 /* Table from RFC 1191 */ 2183 static int icmp_frag_size_table[] = 2184 { 32000, 17914, 8166, 4352, 2002, 1496, 1006, 508, 296, 68 }; 2185 2186 /* 2187 * Process received ICMP Packet too big. 2188 * After updating any IRE it does the fanout to any matching transport streams. 2189 * Assumes the message has been pulled up till the IP header that caused 2190 * the error. 2191 * 2192 * Returns B_FALSE on failure and B_TRUE on success. 2193 */ 2194 static boolean_t 2195 icmp_inbound_too_big(icmph_t *icmph, ipha_t *ipha, ill_t *ill, 2196 zoneid_t zoneid, mblk_t *mp, int iph_hdr_length, 2197 ip_stack_t *ipst) 2198 { 2199 ire_t *ire, *first_ire; 2200 int mtu; 2201 int hdr_length; 2202 ipaddr_t nexthop_addr; 2203 2204 ASSERT(icmph->icmph_type == ICMP_DEST_UNREACHABLE && 2205 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED); 2206 ASSERT(ill != NULL); 2207 2208 hdr_length = IPH_HDR_LENGTH(ipha); 2209 2210 /* Drop if the original packet contained a source route */ 2211 if (ip_source_route_included(ipha)) { 2212 return (B_FALSE); 2213 } 2214 /* 2215 * Verify we have atleast ICMP_MIN_TP_HDR_LENGTH bytes of transport 2216 * header. 2217 */ 2218 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 2219 mp->b_wptr) { 2220 if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 2221 ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) { 2222 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2223 ip1dbg(("icmp_inbound_too_big: insufficient hdr\n")); 2224 return (B_FALSE); 2225 } 2226 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2227 ipha = (ipha_t *)&icmph[1]; 2228 } 2229 nexthop_addr = icmp_get_nexthop_addr(ipha, ill, zoneid, mp); 2230 if (nexthop_addr != INADDR_ANY) { 2231 /* nexthop set */ 2232 first_ire = ire_ctable_lookup(ipha->ipha_dst, 2233 nexthop_addr, 0, NULL, ALL_ZONES, MBLK_GETLABEL(mp), 2234 MATCH_IRE_MARK_PRIVATE_ADDR | MATCH_IRE_GW, ipst); 2235 } else { 2236 /* nexthop not set */ 2237 first_ire = ire_ctable_lookup(ipha->ipha_dst, 0, IRE_CACHE, 2238 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 2239 } 2240 2241 if (!first_ire) { 2242 ip1dbg(("icmp_inbound_too_big: no route for 0x%x\n", 2243 ntohl(ipha->ipha_dst))); 2244 return (B_FALSE); 2245 } 2246 /* Check for MTU discovery advice as described in RFC 1191 */ 2247 mtu = ntohs(icmph->icmph_du_mtu); 2248 rw_enter(&first_ire->ire_bucket->irb_lock, RW_READER); 2249 for (ire = first_ire; ire != NULL && ire->ire_addr == ipha->ipha_dst; 2250 ire = ire->ire_next) { 2251 /* 2252 * Look for the connection to which this ICMP message is 2253 * directed. If it has the IP_NEXTHOP option set, then the 2254 * search is limited to IREs with the MATCH_IRE_PRIVATE 2255 * option. Else the search is limited to regular IREs. 2256 */ 2257 if (((ire->ire_marks & IRE_MARK_PRIVATE_ADDR) && 2258 (nexthop_addr != ire->ire_gateway_addr)) || 2259 (!(ire->ire_marks & IRE_MARK_PRIVATE_ADDR) && 2260 (nexthop_addr != INADDR_ANY))) 2261 continue; 2262 2263 mutex_enter(&ire->ire_lock); 2264 if (icmph->icmph_du_zero == 0 && mtu > 68) { 2265 /* Reduce the IRE max frag value as advised. */ 2266 ip1dbg(("Received mtu from router: %d (was %d)\n", 2267 mtu, ire->ire_max_frag)); 2268 ire->ire_max_frag = MIN(ire->ire_max_frag, mtu); 2269 } else { 2270 uint32_t length; 2271 int i; 2272 2273 /* 2274 * Use the table from RFC 1191 to figure out 2275 * the next "plateau" based on the length in 2276 * the original IP packet. 2277 */ 2278 length = ntohs(ipha->ipha_length); 2279 if (ire->ire_max_frag <= length && 2280 ire->ire_max_frag >= length - hdr_length) { 2281 /* 2282 * Handle broken BSD 4.2 systems that 2283 * return the wrong iph_length in ICMP 2284 * errors. 2285 */ 2286 ip1dbg(("Wrong mtu: sent %d, ire %d\n", 2287 length, ire->ire_max_frag)); 2288 length -= hdr_length; 2289 } 2290 for (i = 0; i < A_CNT(icmp_frag_size_table); i++) { 2291 if (length > icmp_frag_size_table[i]) 2292 break; 2293 } 2294 if (i == A_CNT(icmp_frag_size_table)) { 2295 /* Smaller than 68! */ 2296 ip1dbg(("Too big for packet size %d\n", 2297 length)); 2298 ire->ire_max_frag = MIN(ire->ire_max_frag, 576); 2299 ire->ire_frag_flag = 0; 2300 } else { 2301 mtu = icmp_frag_size_table[i]; 2302 ip1dbg(("Calculated mtu %d, packet size %d, " 2303 "before %d", mtu, length, 2304 ire->ire_max_frag)); 2305 ire->ire_max_frag = MIN(ire->ire_max_frag, mtu); 2306 ip1dbg((", after %d\n", ire->ire_max_frag)); 2307 } 2308 /* Record the new max frag size for the ULP. */ 2309 icmph->icmph_du_zero = 0; 2310 icmph->icmph_du_mtu = 2311 htons((uint16_t)ire->ire_max_frag); 2312 } 2313 mutex_exit(&ire->ire_lock); 2314 } 2315 rw_exit(&first_ire->ire_bucket->irb_lock); 2316 ire_refrele(first_ire); 2317 return (B_TRUE); 2318 } 2319 2320 /* 2321 * If the packet in error is Self-Encapsulated, icmp_inbound_error_fanout 2322 * calls this function. 2323 */ 2324 static mblk_t * 2325 icmp_inbound_self_encap_error(mblk_t *mp, int iph_hdr_length, int hdr_length) 2326 { 2327 ipha_t *ipha; 2328 icmph_t *icmph; 2329 ipha_t *in_ipha; 2330 int length; 2331 2332 ASSERT(mp->b_datap->db_type == M_DATA); 2333 2334 /* 2335 * For Self-encapsulated packets, we added an extra IP header 2336 * without the options. Inner IP header is the one from which 2337 * the outer IP header was formed. Thus, we need to remove the 2338 * outer IP header. To do this, we pullup the whole message 2339 * and overlay whatever follows the outer IP header over the 2340 * outer IP header. 2341 */ 2342 2343 if (!pullupmsg(mp, -1)) 2344 return (NULL); 2345 2346 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2347 ipha = (ipha_t *)&icmph[1]; 2348 in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length); 2349 2350 /* 2351 * The length that we want to overlay is following the inner 2352 * IP header. Subtracting the IP header + icmp header + outer 2353 * IP header's length should give us the length that we want to 2354 * overlay. 2355 */ 2356 length = msgdsize(mp) - iph_hdr_length - sizeof (icmph_t) - 2357 hdr_length; 2358 /* 2359 * Overlay whatever follows the inner header over the 2360 * outer header. 2361 */ 2362 bcopy((uchar_t *)in_ipha, (uchar_t *)ipha, length); 2363 2364 /* Set the wptr to account for the outer header */ 2365 mp->b_wptr -= hdr_length; 2366 return (mp); 2367 } 2368 2369 /* 2370 * Try to pass the ICMP message upstream in case the ULP cares. 2371 * 2372 * If the packet that caused the ICMP error is secure, we send 2373 * it to AH/ESP to make sure that the attached packet has a 2374 * valid association. ipha in the code below points to the 2375 * IP header of the packet that caused the error. 2376 * 2377 * We handle ICMP_FRAGMENTATION_NEEDED(IFN) message differently 2378 * in the context of IPSEC. Normally we tell the upper layer 2379 * whenever we send the ire (including ip_bind), the IPSEC header 2380 * length in ire_ipsec_overhead. TCP can deduce the MSS as it 2381 * has both the MTU (ire_max_frag) and the ire_ipsec_overhead. 2382 * Similarly, we pass the new MTU icmph_du_mtu and TCP does the 2383 * same thing. As TCP has the IPSEC options size that needs to be 2384 * adjusted, we just pass the MTU unchanged. 2385 * 2386 * IFN could have been generated locally or by some router. 2387 * 2388 * LOCAL : *ip_wput_ire -> icmp_frag_needed could have generated this. 2389 * This happens because IP adjusted its value of MTU on an 2390 * earlier IFN message and could not tell the upper layer, 2391 * the new adjusted value of MTU e.g. Packet was encrypted 2392 * or there was not enough information to fanout to upper 2393 * layers. Thus on the next outbound datagram, ip_wput_ire 2394 * generates the IFN, where IPSEC processing has *not* been 2395 * done. 2396 * 2397 * *ip_wput_ire_fragmentit -> ip_wput_frag -> icmp_frag_needed 2398 * could have generated this. This happens because ire_max_frag 2399 * value in IP was set to a new value, while the IPSEC processing 2400 * was being done and after we made the fragmentation check in 2401 * ip_wput_ire. Thus on return from IPSEC processing, 2402 * ip_wput_ipsec_out finds that the new length is > ire_max_frag 2403 * and generates the IFN. As IPSEC processing is over, we fanout 2404 * to AH/ESP to remove the header. 2405 * 2406 * In both these cases, ipsec_in_loopback will be set indicating 2407 * that IFN was generated locally. 2408 * 2409 * ROUTER : IFN could be secure or non-secure. 2410 * 2411 * * SECURE : We use the IPSEC_IN to fanout to AH/ESP if the 2412 * packet in error has AH/ESP headers to validate the AH/ESP 2413 * headers. AH/ESP will verify whether there is a valid SA or 2414 * not and send it back. We will fanout again if we have more 2415 * data in the packet. 2416 * 2417 * If the packet in error does not have AH/ESP, we handle it 2418 * like any other case. 2419 * 2420 * * NON_SECURE : If the packet in error has AH/ESP headers, 2421 * we attach a dummy ipsec_in and send it up to AH/ESP 2422 * for validation. AH/ESP will verify whether there is a 2423 * valid SA or not and send it back. We will fanout again if 2424 * we have more data in the packet. 2425 * 2426 * If the packet in error does not have AH/ESP, we handle it 2427 * like any other case. 2428 */ 2429 static void 2430 icmp_inbound_error_fanout(queue_t *q, ill_t *ill, mblk_t *mp, 2431 icmph_t *icmph, ipha_t *ipha, int iph_hdr_length, int hdr_length, 2432 boolean_t mctl_present, boolean_t ip_policy, ill_t *recv_ill, 2433 zoneid_t zoneid) 2434 { 2435 uint16_t *up; /* Pointer to ports in ULP header */ 2436 uint32_t ports; /* reversed ports for fanout */ 2437 ipha_t ripha; /* With reversed addresses */ 2438 mblk_t *first_mp; 2439 ipsec_in_t *ii; 2440 tcph_t *tcph; 2441 conn_t *connp; 2442 ip_stack_t *ipst; 2443 2444 ASSERT(ill != NULL); 2445 2446 ASSERT(recv_ill != NULL); 2447 ipst = recv_ill->ill_ipst; 2448 2449 first_mp = mp; 2450 if (mctl_present) { 2451 mp = first_mp->b_cont; 2452 ASSERT(mp != NULL); 2453 2454 ii = (ipsec_in_t *)first_mp->b_rptr; 2455 ASSERT(ii->ipsec_in_type == IPSEC_IN); 2456 } else { 2457 ii = NULL; 2458 } 2459 2460 switch (ipha->ipha_protocol) { 2461 case IPPROTO_UDP: 2462 /* 2463 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of 2464 * transport header. 2465 */ 2466 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 2467 mp->b_wptr) { 2468 if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 2469 ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) { 2470 goto discard_pkt; 2471 } 2472 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2473 ipha = (ipha_t *)&icmph[1]; 2474 } 2475 up = (uint16_t *)((uchar_t *)ipha + hdr_length); 2476 2477 /* 2478 * Attempt to find a client stream based on port. 2479 * Note that we do a reverse lookup since the header is 2480 * in the form we sent it out. 2481 * The ripha header is only used for the IP_UDP_MATCH and we 2482 * only set the src and dst addresses and protocol. 2483 */ 2484 ripha.ipha_src = ipha->ipha_dst; 2485 ripha.ipha_dst = ipha->ipha_src; 2486 ripha.ipha_protocol = ipha->ipha_protocol; 2487 ((uint16_t *)&ports)[0] = up[1]; 2488 ((uint16_t *)&ports)[1] = up[0]; 2489 ip2dbg(("icmp_inbound_error: UDP %x:%d to %x:%d: %d/%d\n", 2490 ntohl(ipha->ipha_src), ntohs(up[0]), 2491 ntohl(ipha->ipha_dst), ntohs(up[1]), 2492 icmph->icmph_type, icmph->icmph_code)); 2493 2494 /* Have to change db_type after any pullupmsg */ 2495 DB_TYPE(mp) = M_CTL; 2496 2497 ip_fanout_udp(q, first_mp, ill, &ripha, ports, B_FALSE, 0, 2498 mctl_present, ip_policy, recv_ill, zoneid); 2499 return; 2500 2501 case IPPROTO_TCP: 2502 /* 2503 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of 2504 * transport header. 2505 */ 2506 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 2507 mp->b_wptr) { 2508 if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 2509 ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) { 2510 goto discard_pkt; 2511 } 2512 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2513 ipha = (ipha_t *)&icmph[1]; 2514 } 2515 /* 2516 * Find a TCP client stream for this packet. 2517 * Note that we do a reverse lookup since the header is 2518 * in the form we sent it out. 2519 */ 2520 tcph = (tcph_t *)((uchar_t *)ipha + hdr_length); 2521 connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcph, TCPS_LISTEN, 2522 ipst); 2523 if (connp == NULL) 2524 goto discard_pkt; 2525 2526 /* Have to change db_type after any pullupmsg */ 2527 DB_TYPE(mp) = M_CTL; 2528 squeue_fill(connp->conn_sqp, first_mp, tcp_input, 2529 connp, SQTAG_TCP_INPUT_ICMP_ERR); 2530 return; 2531 2532 case IPPROTO_SCTP: 2533 /* 2534 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of 2535 * transport header. 2536 */ 2537 if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN > 2538 mp->b_wptr) { 2539 if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 2540 ICMP_MIN_TP_HDR_LEN - mp->b_rptr)) { 2541 goto discard_pkt; 2542 } 2543 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2544 ipha = (ipha_t *)&icmph[1]; 2545 } 2546 up = (uint16_t *)((uchar_t *)ipha + hdr_length); 2547 /* 2548 * Find a SCTP client stream for this packet. 2549 * Note that we do a reverse lookup since the header is 2550 * in the form we sent it out. 2551 * The ripha header is only used for the matching and we 2552 * only set the src and dst addresses, protocol, and version. 2553 */ 2554 ripha.ipha_src = ipha->ipha_dst; 2555 ripha.ipha_dst = ipha->ipha_src; 2556 ripha.ipha_protocol = ipha->ipha_protocol; 2557 ripha.ipha_version_and_hdr_length = 2558 ipha->ipha_version_and_hdr_length; 2559 ((uint16_t *)&ports)[0] = up[1]; 2560 ((uint16_t *)&ports)[1] = up[0]; 2561 2562 /* Have to change db_type after any pullupmsg */ 2563 DB_TYPE(mp) = M_CTL; 2564 ip_fanout_sctp(first_mp, recv_ill, &ripha, ports, 0, 2565 mctl_present, ip_policy, 0, zoneid); 2566 return; 2567 2568 case IPPROTO_ESP: 2569 case IPPROTO_AH: { 2570 int ipsec_rc; 2571 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 2572 2573 /* 2574 * We need a IPSEC_IN in the front to fanout to AH/ESP. 2575 * We will re-use the IPSEC_IN if it is already present as 2576 * AH/ESP will not affect any fields in the IPSEC_IN for 2577 * ICMP errors. If there is no IPSEC_IN, allocate a new 2578 * one and attach it in the front. 2579 */ 2580 if (ii != NULL) { 2581 /* 2582 * ip_fanout_proto_again converts the ICMP errors 2583 * that come back from AH/ESP to M_DATA so that 2584 * if it is non-AH/ESP and we do a pullupmsg in 2585 * this function, it would work. Convert it back 2586 * to M_CTL before we send up as this is a ICMP 2587 * error. This could have been generated locally or 2588 * by some router. Validate the inner IPSEC 2589 * headers. 2590 * 2591 * NOTE : ill_index is used by ip_fanout_proto_again 2592 * to locate the ill. 2593 */ 2594 ASSERT(ill != NULL); 2595 ii->ipsec_in_ill_index = 2596 ill->ill_phyint->phyint_ifindex; 2597 ii->ipsec_in_rill_index = 2598 recv_ill->ill_phyint->phyint_ifindex; 2599 DB_TYPE(first_mp->b_cont) = M_CTL; 2600 } else { 2601 /* 2602 * IPSEC_IN is not present. We attach a ipsec_in 2603 * message and send up to IPSEC for validating 2604 * and removing the IPSEC headers. Clear 2605 * ipsec_in_secure so that when we return 2606 * from IPSEC, we don't mistakenly think that this 2607 * is a secure packet came from the network. 2608 * 2609 * NOTE : ill_index is used by ip_fanout_proto_again 2610 * to locate the ill. 2611 */ 2612 ASSERT(first_mp == mp); 2613 first_mp = ipsec_in_alloc(B_TRUE, ipst->ips_netstack); 2614 if (first_mp == NULL) { 2615 freemsg(mp); 2616 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2617 return; 2618 } 2619 ii = (ipsec_in_t *)first_mp->b_rptr; 2620 2621 /* This is not a secure packet */ 2622 ii->ipsec_in_secure = B_FALSE; 2623 first_mp->b_cont = mp; 2624 DB_TYPE(mp) = M_CTL; 2625 ASSERT(ill != NULL); 2626 ii->ipsec_in_ill_index = 2627 ill->ill_phyint->phyint_ifindex; 2628 ii->ipsec_in_rill_index = 2629 recv_ill->ill_phyint->phyint_ifindex; 2630 } 2631 ip2dbg(("icmp_inbound_error: ipsec\n")); 2632 2633 if (!ipsec_loaded(ipss)) { 2634 ip_proto_not_sup(q, first_mp, 0, zoneid, ipst); 2635 return; 2636 } 2637 2638 if (ipha->ipha_protocol == IPPROTO_ESP) 2639 ipsec_rc = ipsecesp_icmp_error(first_mp); 2640 else 2641 ipsec_rc = ipsecah_icmp_error(first_mp); 2642 if (ipsec_rc == IPSEC_STATUS_FAILED) 2643 return; 2644 2645 ip_fanout_proto_again(first_mp, ill, recv_ill, NULL); 2646 return; 2647 } 2648 default: 2649 /* 2650 * The ripha header is only used for the lookup and we 2651 * only set the src and dst addresses and protocol. 2652 */ 2653 ripha.ipha_src = ipha->ipha_dst; 2654 ripha.ipha_dst = ipha->ipha_src; 2655 ripha.ipha_protocol = ipha->ipha_protocol; 2656 ip2dbg(("icmp_inbound_error: proto %d %x to %x: %d/%d\n", 2657 ripha.ipha_protocol, ntohl(ipha->ipha_src), 2658 ntohl(ipha->ipha_dst), 2659 icmph->icmph_type, icmph->icmph_code)); 2660 if (ipha->ipha_protocol == IPPROTO_ENCAP) { 2661 ipha_t *in_ipha; 2662 2663 if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) > 2664 mp->b_wptr) { 2665 if (!pullupmsg(mp, (uchar_t *)ipha + 2666 hdr_length + sizeof (ipha_t) - 2667 mp->b_rptr)) { 2668 goto discard_pkt; 2669 } 2670 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2671 ipha = (ipha_t *)&icmph[1]; 2672 } 2673 /* 2674 * Caller has verified that length has to be 2675 * at least the size of IP header. 2676 */ 2677 ASSERT(hdr_length >= sizeof (ipha_t)); 2678 /* 2679 * Check the sanity of the inner IP header like 2680 * we did for the outer header. 2681 */ 2682 in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length); 2683 if ((IPH_HDR_VERSION(in_ipha) != IPV4_VERSION)) { 2684 goto discard_pkt; 2685 } 2686 if (IPH_HDR_LENGTH(in_ipha) < sizeof (ipha_t)) { 2687 goto discard_pkt; 2688 } 2689 /* Check for Self-encapsulated tunnels */ 2690 if (in_ipha->ipha_src == ipha->ipha_src && 2691 in_ipha->ipha_dst == ipha->ipha_dst) { 2692 2693 mp = icmp_inbound_self_encap_error(mp, 2694 iph_hdr_length, hdr_length); 2695 if (mp == NULL) 2696 goto discard_pkt; 2697 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 2698 ipha = (ipha_t *)&icmph[1]; 2699 hdr_length = IPH_HDR_LENGTH(ipha); 2700 /* 2701 * The packet in error is self-encapsualted. 2702 * And we are finding it further encapsulated 2703 * which we could not have possibly generated. 2704 */ 2705 if (ipha->ipha_protocol == IPPROTO_ENCAP) { 2706 goto discard_pkt; 2707 } 2708 icmp_inbound_error_fanout(q, ill, first_mp, 2709 icmph, ipha, iph_hdr_length, hdr_length, 2710 mctl_present, ip_policy, recv_ill, zoneid); 2711 return; 2712 } 2713 } 2714 if ((ipha->ipha_protocol == IPPROTO_ENCAP || 2715 ipha->ipha_protocol == IPPROTO_IPV6) && 2716 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED && 2717 ii != NULL && 2718 ii->ipsec_in_loopback && 2719 ii->ipsec_in_secure) { 2720 /* 2721 * For IP tunnels that get a looped-back 2722 * ICMP_FRAGMENTATION_NEEDED message, adjust the 2723 * reported new MTU to take into account the IPsec 2724 * headers protecting this configured tunnel. 2725 * 2726 * This allows the tunnel module (tun.c) to blindly 2727 * accept the MTU reported in an ICMP "too big" 2728 * message. 2729 * 2730 * Non-looped back ICMP messages will just be 2731 * handled by the security protocols (if needed), 2732 * and the first subsequent packet will hit this 2733 * path. 2734 */ 2735 icmph->icmph_du_mtu = htons(ntohs(icmph->icmph_du_mtu) - 2736 ipsec_in_extra_length(first_mp)); 2737 } 2738 /* Have to change db_type after any pullupmsg */ 2739 DB_TYPE(mp) = M_CTL; 2740 2741 ip_fanout_proto(q, first_mp, ill, &ripha, 0, mctl_present, 2742 ip_policy, recv_ill, zoneid); 2743 return; 2744 } 2745 /* NOTREACHED */ 2746 discard_pkt: 2747 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 2748 drop_pkt:; 2749 ip1dbg(("icmp_inbound_error_fanout: drop pkt\n")); 2750 freemsg(first_mp); 2751 } 2752 2753 /* 2754 * Common IP options parser. 2755 * 2756 * Setup routine: fill in *optp with options-parsing state, then 2757 * tail-call ipoptp_next to return the first option. 2758 */ 2759 uint8_t 2760 ipoptp_first(ipoptp_t *optp, ipha_t *ipha) 2761 { 2762 uint32_t totallen; /* total length of all options */ 2763 2764 totallen = ipha->ipha_version_and_hdr_length - 2765 (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 2766 totallen <<= 2; 2767 optp->ipoptp_next = (uint8_t *)(&ipha[1]); 2768 optp->ipoptp_end = optp->ipoptp_next + totallen; 2769 optp->ipoptp_flags = 0; 2770 return (ipoptp_next(optp)); 2771 } 2772 2773 /* 2774 * Common IP options parser: extract next option. 2775 */ 2776 uint8_t 2777 ipoptp_next(ipoptp_t *optp) 2778 { 2779 uint8_t *end = optp->ipoptp_end; 2780 uint8_t *cur = optp->ipoptp_next; 2781 uint8_t opt, len, pointer; 2782 2783 /* 2784 * If cur > end already, then the ipoptp_end or ipoptp_next pointer 2785 * has been corrupted. 2786 */ 2787 ASSERT(cur <= end); 2788 2789 if (cur == end) 2790 return (IPOPT_EOL); 2791 2792 opt = cur[IPOPT_OPTVAL]; 2793 2794 /* 2795 * Skip any NOP options. 2796 */ 2797 while (opt == IPOPT_NOP) { 2798 cur++; 2799 if (cur == end) 2800 return (IPOPT_EOL); 2801 opt = cur[IPOPT_OPTVAL]; 2802 } 2803 2804 if (opt == IPOPT_EOL) 2805 return (IPOPT_EOL); 2806 2807 /* 2808 * Option requiring a length. 2809 */ 2810 if ((cur + 1) >= end) { 2811 optp->ipoptp_flags |= IPOPTP_ERROR; 2812 return (IPOPT_EOL); 2813 } 2814 len = cur[IPOPT_OLEN]; 2815 if (len < 2) { 2816 optp->ipoptp_flags |= IPOPTP_ERROR; 2817 return (IPOPT_EOL); 2818 } 2819 optp->ipoptp_cur = cur; 2820 optp->ipoptp_len = len; 2821 optp->ipoptp_next = cur + len; 2822 if (cur + len > end) { 2823 optp->ipoptp_flags |= IPOPTP_ERROR; 2824 return (IPOPT_EOL); 2825 } 2826 2827 /* 2828 * For the options which require a pointer field, make sure 2829 * its there, and make sure it points to either something 2830 * inside this option, or the end of the option. 2831 */ 2832 switch (opt) { 2833 case IPOPT_RR: 2834 case IPOPT_TS: 2835 case IPOPT_LSRR: 2836 case IPOPT_SSRR: 2837 if (len <= IPOPT_OFFSET) { 2838 optp->ipoptp_flags |= IPOPTP_ERROR; 2839 return (opt); 2840 } 2841 pointer = cur[IPOPT_OFFSET]; 2842 if (pointer - 1 > len) { 2843 optp->ipoptp_flags |= IPOPTP_ERROR; 2844 return (opt); 2845 } 2846 break; 2847 } 2848 2849 /* 2850 * Sanity check the pointer field based on the type of the 2851 * option. 2852 */ 2853 switch (opt) { 2854 case IPOPT_RR: 2855 case IPOPT_SSRR: 2856 case IPOPT_LSRR: 2857 if (pointer < IPOPT_MINOFF_SR) 2858 optp->ipoptp_flags |= IPOPTP_ERROR; 2859 break; 2860 case IPOPT_TS: 2861 if (pointer < IPOPT_MINOFF_IT) 2862 optp->ipoptp_flags |= IPOPTP_ERROR; 2863 /* 2864 * Note that the Internet Timestamp option also 2865 * contains two four bit fields (the Overflow field, 2866 * and the Flag field), which follow the pointer 2867 * field. We don't need to check that these fields 2868 * fall within the length of the option because this 2869 * was implicitely done above. We've checked that the 2870 * pointer value is at least IPOPT_MINOFF_IT, and that 2871 * it falls within the option. Since IPOPT_MINOFF_IT > 2872 * IPOPT_POS_OV_FLG, we don't need the explicit check. 2873 */ 2874 ASSERT(len > IPOPT_POS_OV_FLG); 2875 break; 2876 } 2877 2878 return (opt); 2879 } 2880 2881 /* 2882 * Use the outgoing IP header to create an IP_OPTIONS option the way 2883 * it was passed down from the application. 2884 */ 2885 int 2886 ip_opt_get_user(const ipha_t *ipha, uchar_t *buf) 2887 { 2888 ipoptp_t opts; 2889 const uchar_t *opt; 2890 uint8_t optval; 2891 uint8_t optlen; 2892 uint32_t len = 0; 2893 uchar_t *buf1 = buf; 2894 2895 buf += IP_ADDR_LEN; /* Leave room for final destination */ 2896 len += IP_ADDR_LEN; 2897 bzero(buf1, IP_ADDR_LEN); 2898 2899 /* 2900 * OK to cast away const here, as we don't store through the returned 2901 * opts.ipoptp_cur pointer. 2902 */ 2903 for (optval = ipoptp_first(&opts, (ipha_t *)ipha); 2904 optval != IPOPT_EOL; 2905 optval = ipoptp_next(&opts)) { 2906 int off; 2907 2908 opt = opts.ipoptp_cur; 2909 optlen = opts.ipoptp_len; 2910 switch (optval) { 2911 case IPOPT_SSRR: 2912 case IPOPT_LSRR: 2913 2914 /* 2915 * Insert ipha_dst as the first entry in the source 2916 * route and move down the entries on step. 2917 * The last entry gets placed at buf1. 2918 */ 2919 buf[IPOPT_OPTVAL] = optval; 2920 buf[IPOPT_OLEN] = optlen; 2921 buf[IPOPT_OFFSET] = optlen; 2922 2923 off = optlen - IP_ADDR_LEN; 2924 if (off < 0) { 2925 /* No entries in source route */ 2926 break; 2927 } 2928 /* Last entry in source route */ 2929 bcopy(opt + off, buf1, IP_ADDR_LEN); 2930 off -= IP_ADDR_LEN; 2931 2932 while (off > 0) { 2933 bcopy(opt + off, 2934 buf + off + IP_ADDR_LEN, 2935 IP_ADDR_LEN); 2936 off -= IP_ADDR_LEN; 2937 } 2938 /* ipha_dst into first slot */ 2939 bcopy(&ipha->ipha_dst, 2940 buf + off + IP_ADDR_LEN, 2941 IP_ADDR_LEN); 2942 buf += optlen; 2943 len += optlen; 2944 break; 2945 2946 case IPOPT_COMSEC: 2947 case IPOPT_SECURITY: 2948 /* if passing up a label is not ok, then remove */ 2949 if (is_system_labeled()) 2950 break; 2951 /* FALLTHROUGH */ 2952 default: 2953 bcopy(opt, buf, optlen); 2954 buf += optlen; 2955 len += optlen; 2956 break; 2957 } 2958 } 2959 done: 2960 /* Pad the resulting options */ 2961 while (len & 0x3) { 2962 *buf++ = IPOPT_EOL; 2963 len++; 2964 } 2965 return (len); 2966 } 2967 2968 /* 2969 * Update any record route or timestamp options to include this host. 2970 * Reverse any source route option. 2971 * This routine assumes that the options are well formed i.e. that they 2972 * have already been checked. 2973 */ 2974 static void 2975 icmp_options_update(ipha_t *ipha) 2976 { 2977 ipoptp_t opts; 2978 uchar_t *opt; 2979 uint8_t optval; 2980 ipaddr_t src; /* Our local address */ 2981 ipaddr_t dst; 2982 2983 ip2dbg(("icmp_options_update\n")); 2984 src = ipha->ipha_src; 2985 dst = ipha->ipha_dst; 2986 2987 for (optval = ipoptp_first(&opts, ipha); 2988 optval != IPOPT_EOL; 2989 optval = ipoptp_next(&opts)) { 2990 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 2991 opt = opts.ipoptp_cur; 2992 ip2dbg(("icmp_options_update: opt %d, len %d\n", 2993 optval, opts.ipoptp_len)); 2994 switch (optval) { 2995 int off1, off2; 2996 case IPOPT_SSRR: 2997 case IPOPT_LSRR: 2998 /* 2999 * Reverse the source route. The first entry 3000 * should be the next to last one in the current 3001 * source route (the last entry is our address). 3002 * The last entry should be the final destination. 3003 */ 3004 off1 = IPOPT_MINOFF_SR - 1; 3005 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; 3006 if (off2 < 0) { 3007 /* No entries in source route */ 3008 ip1dbg(( 3009 "icmp_options_update: bad src route\n")); 3010 break; 3011 } 3012 bcopy((char *)opt + off2, &dst, IP_ADDR_LEN); 3013 bcopy(&ipha->ipha_dst, (char *)opt + off2, IP_ADDR_LEN); 3014 bcopy(&dst, &ipha->ipha_dst, IP_ADDR_LEN); 3015 off2 -= IP_ADDR_LEN; 3016 3017 while (off1 < off2) { 3018 bcopy((char *)opt + off1, &src, IP_ADDR_LEN); 3019 bcopy((char *)opt + off2, (char *)opt + off1, 3020 IP_ADDR_LEN); 3021 bcopy(&src, (char *)opt + off2, IP_ADDR_LEN); 3022 off1 += IP_ADDR_LEN; 3023 off2 -= IP_ADDR_LEN; 3024 } 3025 opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR; 3026 break; 3027 } 3028 } 3029 } 3030 3031 /* 3032 * Process received ICMP Redirect messages. 3033 */ 3034 static void 3035 icmp_redirect(ill_t *ill, mblk_t *mp) 3036 { 3037 ipha_t *ipha; 3038 int iph_hdr_length; 3039 icmph_t *icmph; 3040 ipha_t *ipha_err; 3041 ire_t *ire; 3042 ire_t *prev_ire; 3043 ire_t *save_ire; 3044 ipaddr_t src, dst, gateway; 3045 iulp_t ulp_info = { 0 }; 3046 int error; 3047 ip_stack_t *ipst; 3048 3049 ASSERT(ill != NULL); 3050 ipst = ill->ill_ipst; 3051 3052 ipha = (ipha_t *)mp->b_rptr; 3053 iph_hdr_length = IPH_HDR_LENGTH(ipha); 3054 if (((mp->b_wptr - mp->b_rptr) - iph_hdr_length) < 3055 sizeof (icmph_t) + IP_SIMPLE_HDR_LENGTH) { 3056 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 3057 freemsg(mp); 3058 return; 3059 } 3060 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 3061 ipha_err = (ipha_t *)&icmph[1]; 3062 src = ipha->ipha_src; 3063 dst = ipha_err->ipha_dst; 3064 gateway = icmph->icmph_rd_gateway; 3065 /* Make sure the new gateway is reachable somehow. */ 3066 ire = ire_route_lookup(gateway, 0, 0, IRE_INTERFACE, NULL, NULL, 3067 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 3068 /* 3069 * Make sure we had a route for the dest in question and that 3070 * that route was pointing to the old gateway (the source of the 3071 * redirect packet.) 3072 */ 3073 prev_ire = ire_route_lookup(dst, 0, src, 0, NULL, NULL, ALL_ZONES, 3074 NULL, MATCH_IRE_GW, ipst); 3075 /* 3076 * Check that 3077 * the redirect was not from ourselves 3078 * the new gateway and the old gateway are directly reachable 3079 */ 3080 if (!prev_ire || 3081 !ire || 3082 ire->ire_type == IRE_LOCAL) { 3083 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects); 3084 freemsg(mp); 3085 if (ire != NULL) 3086 ire_refrele(ire); 3087 if (prev_ire != NULL) 3088 ire_refrele(prev_ire); 3089 return; 3090 } 3091 3092 /* 3093 * Should we use the old ULP info to create the new gateway? From 3094 * a user's perspective, we should inherit the info so that it 3095 * is a "smooth" transition. If we do not do that, then new 3096 * connections going thru the new gateway will have no route metrics, 3097 * which is counter-intuitive to user. From a network point of 3098 * view, this may or may not make sense even though the new gateway 3099 * is still directly connected to us so the route metrics should not 3100 * change much. 3101 * 3102 * But if the old ire_uinfo is not initialized, we do another 3103 * recursive lookup on the dest using the new gateway. There may 3104 * be a route to that. If so, use it to initialize the redirect 3105 * route. 3106 */ 3107 if (prev_ire->ire_uinfo.iulp_set) { 3108 bcopy(&prev_ire->ire_uinfo, &ulp_info, sizeof (iulp_t)); 3109 } else { 3110 ire_t *tmp_ire; 3111 ire_t *sire; 3112 3113 tmp_ire = ire_ftable_lookup(dst, 0, gateway, 0, NULL, &sire, 3114 ALL_ZONES, 0, NULL, 3115 (MATCH_IRE_RECURSIVE | MATCH_IRE_GW | MATCH_IRE_DEFAULT), 3116 ipst); 3117 if (sire != NULL) { 3118 bcopy(&sire->ire_uinfo, &ulp_info, sizeof (iulp_t)); 3119 /* 3120 * If sire != NULL, ire_ftable_lookup() should not 3121 * return a NULL value. 3122 */ 3123 ASSERT(tmp_ire != NULL); 3124 ire_refrele(tmp_ire); 3125 ire_refrele(sire); 3126 } else if (tmp_ire != NULL) { 3127 bcopy(&tmp_ire->ire_uinfo, &ulp_info, 3128 sizeof (iulp_t)); 3129 ire_refrele(tmp_ire); 3130 } 3131 } 3132 if (prev_ire->ire_type == IRE_CACHE) 3133 ire_delete(prev_ire); 3134 ire_refrele(prev_ire); 3135 /* 3136 * TODO: more precise handling for cases 0, 2, 3, the latter two 3137 * require TOS routing 3138 */ 3139 switch (icmph->icmph_code) { 3140 case 0: 3141 case 1: 3142 /* TODO: TOS specificity for cases 2 and 3 */ 3143 case 2: 3144 case 3: 3145 break; 3146 default: 3147 freemsg(mp); 3148 BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects); 3149 ire_refrele(ire); 3150 return; 3151 } 3152 /* 3153 * Create a Route Association. This will allow us to remember that 3154 * someone we believe told us to use the particular gateway. 3155 */ 3156 save_ire = ire; 3157 ire = ire_create( 3158 (uchar_t *)&dst, /* dest addr */ 3159 (uchar_t *)&ip_g_all_ones, /* mask */ 3160 (uchar_t *)&save_ire->ire_src_addr, /* source addr */ 3161 (uchar_t *)&gateway, /* gateway addr */ 3162 NULL, /* no in_srcaddr */ 3163 &save_ire->ire_max_frag, /* max frag */ 3164 NULL, /* Fast Path header */ 3165 NULL, /* no rfq */ 3166 NULL, /* no stq */ 3167 IRE_HOST, 3168 NULL, 3169 NULL, 3170 NULL, 3171 0, 3172 0, 3173 0, 3174 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 3175 &ulp_info, 3176 NULL, 3177 NULL, 3178 ipst); 3179 3180 if (ire == NULL) { 3181 freemsg(mp); 3182 ire_refrele(save_ire); 3183 return; 3184 } 3185 error = ire_add(&ire, NULL, NULL, NULL, B_FALSE); 3186 ire_refrele(save_ire); 3187 atomic_inc_32(&ipst->ips_ip_redirect_cnt); 3188 3189 if (error == 0) { 3190 ire_refrele(ire); /* Held in ire_add_v4 */ 3191 /* tell routing sockets that we received a redirect */ 3192 ip_rts_change(RTM_REDIRECT, dst, gateway, IP_HOST_MASK, 0, src, 3193 (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0, 3194 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR), ipst); 3195 } 3196 3197 /* 3198 * Delete any existing IRE_HOST type redirect ires for this destination. 3199 * This together with the added IRE has the effect of 3200 * modifying an existing redirect. 3201 */ 3202 prev_ire = ire_ftable_lookup(dst, 0, src, IRE_HOST, NULL, NULL, 3203 ALL_ZONES, 0, NULL, (MATCH_IRE_GW | MATCH_IRE_TYPE), ipst); 3204 if (prev_ire != NULL) { 3205 if (prev_ire ->ire_flags & RTF_DYNAMIC) 3206 ire_delete(prev_ire); 3207 ire_refrele(prev_ire); 3208 } 3209 3210 freemsg(mp); 3211 } 3212 3213 /* 3214 * Generate an ICMP parameter problem message. 3215 */ 3216 static void 3217 icmp_param_problem(queue_t *q, mblk_t *mp, uint8_t ptr, zoneid_t zoneid, 3218 ip_stack_t *ipst) 3219 { 3220 icmph_t icmph; 3221 boolean_t mctl_present; 3222 mblk_t *first_mp; 3223 3224 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 3225 3226 if (!(mp = icmp_pkt_err_ok(mp, ipst))) { 3227 if (mctl_present) 3228 freeb(first_mp); 3229 return; 3230 } 3231 3232 bzero(&icmph, sizeof (icmph_t)); 3233 icmph.icmph_type = ICMP_PARAM_PROBLEM; 3234 icmph.icmph_pp_ptr = ptr; 3235 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutParmProbs); 3236 icmp_pkt(q, first_mp, &icmph, sizeof (icmph_t), mctl_present, zoneid, 3237 ipst); 3238 } 3239 3240 /* 3241 * Build and ship an IPv4 ICMP message using the packet data in mp, and 3242 * the ICMP header pointed to by "stuff". (May be called as writer.) 3243 * Note: assumes that icmp_pkt_err_ok has been called to verify that 3244 * an icmp error packet can be sent. 3245 * Assigns an appropriate source address to the packet. If ipha_dst is 3246 * one of our addresses use it for source. Otherwise pick a source based 3247 * on a route lookup back to ipha_src. 3248 * Note that ipha_src must be set here since the 3249 * packet is likely to arrive on an ill queue in ip_wput() which will 3250 * not set a source address. 3251 */ 3252 static void 3253 icmp_pkt(queue_t *q, mblk_t *mp, void *stuff, size_t len, 3254 boolean_t mctl_present, zoneid_t zoneid, ip_stack_t *ipst) 3255 { 3256 ipaddr_t dst; 3257 icmph_t *icmph; 3258 ipha_t *ipha; 3259 uint_t len_needed; 3260 size_t msg_len; 3261 mblk_t *mp1; 3262 ipaddr_t src; 3263 ire_t *ire; 3264 mblk_t *ipsec_mp; 3265 ipsec_out_t *io = NULL; 3266 boolean_t xmit_if_on = B_FALSE; 3267 3268 if (mctl_present) { 3269 /* 3270 * If it is : 3271 * 3272 * 1) a IPSEC_OUT, then this is caused by outbound 3273 * datagram originating on this host. IPSEC processing 3274 * may or may not have been done. Refer to comments above 3275 * icmp_inbound_error_fanout for details. 3276 * 3277 * 2) a IPSEC_IN if we are generating a icmp_message 3278 * for an incoming datagram destined for us i.e called 3279 * from ip_fanout_send_icmp. 3280 */ 3281 ipsec_info_t *in; 3282 ipsec_mp = mp; 3283 mp = ipsec_mp->b_cont; 3284 3285 in = (ipsec_info_t *)ipsec_mp->b_rptr; 3286 ipha = (ipha_t *)mp->b_rptr; 3287 3288 ASSERT(in->ipsec_info_type == IPSEC_OUT || 3289 in->ipsec_info_type == IPSEC_IN); 3290 3291 if (in->ipsec_info_type == IPSEC_IN) { 3292 /* 3293 * Convert the IPSEC_IN to IPSEC_OUT. 3294 */ 3295 if (!ipsec_in_to_out(ipsec_mp, ipha, NULL)) { 3296 BUMP_MIB(&ipst->ips_ip_mib, 3297 ipIfStatsOutDiscards); 3298 return; 3299 } 3300 io = (ipsec_out_t *)ipsec_mp->b_rptr; 3301 } else { 3302 ASSERT(in->ipsec_info_type == IPSEC_OUT); 3303 io = (ipsec_out_t *)in; 3304 if (io->ipsec_out_xmit_if) 3305 xmit_if_on = B_TRUE; 3306 /* 3307 * Clear out ipsec_out_proc_begin, so we do a fresh 3308 * ire lookup. 3309 */ 3310 io->ipsec_out_proc_begin = B_FALSE; 3311 } 3312 ASSERT(zoneid == io->ipsec_out_zoneid); 3313 ASSERT(zoneid != ALL_ZONES); 3314 } else { 3315 /* 3316 * This is in clear. The icmp message we are building 3317 * here should go out in clear. 3318 * 3319 * Pardon the convolution of it all, but it's easier to 3320 * allocate a "use cleartext" IPSEC_IN message and convert 3321 * it than it is to allocate a new one. 3322 */ 3323 ipsec_in_t *ii; 3324 ASSERT(DB_TYPE(mp) == M_DATA); 3325 ipsec_mp = ipsec_in_alloc(B_TRUE, ipst->ips_netstack); 3326 if (ipsec_mp == NULL) { 3327 freemsg(mp); 3328 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 3329 return; 3330 } 3331 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 3332 3333 /* This is not a secure packet */ 3334 ii->ipsec_in_secure = B_FALSE; 3335 /* 3336 * For trusted extensions using a shared IP address we can 3337 * send using any zoneid. 3338 */ 3339 if (zoneid == ALL_ZONES) 3340 ii->ipsec_in_zoneid = GLOBAL_ZONEID; 3341 else 3342 ii->ipsec_in_zoneid = zoneid; 3343 ipsec_mp->b_cont = mp; 3344 ipha = (ipha_t *)mp->b_rptr; 3345 /* 3346 * Convert the IPSEC_IN to IPSEC_OUT. 3347 */ 3348 if (!ipsec_in_to_out(ipsec_mp, ipha, NULL)) { 3349 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 3350 return; 3351 } 3352 io = (ipsec_out_t *)ipsec_mp->b_rptr; 3353 } 3354 3355 /* Remember our eventual destination */ 3356 dst = ipha->ipha_src; 3357 3358 ire = ire_route_lookup(ipha->ipha_dst, 0, 0, (IRE_LOCAL|IRE_LOOPBACK), 3359 NULL, NULL, zoneid, NULL, MATCH_IRE_TYPE, ipst); 3360 if (ire != NULL && 3361 (ire->ire_zoneid == zoneid || ire->ire_zoneid == ALL_ZONES)) { 3362 src = ipha->ipha_dst; 3363 } else if (!xmit_if_on) { 3364 if (ire != NULL) 3365 ire_refrele(ire); 3366 ire = ire_route_lookup(dst, 0, 0, 0, NULL, NULL, zoneid, NULL, 3367 (MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE|MATCH_IRE_ZONEONLY), 3368 ipst); 3369 if (ire == NULL) { 3370 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 3371 freemsg(ipsec_mp); 3372 return; 3373 } 3374 src = ire->ire_src_addr; 3375 } else { 3376 ipif_t *ipif = NULL; 3377 ill_t *ill; 3378 /* 3379 * This must be an ICMP error coming from 3380 * ip_mrtun_forward(). The src addr should 3381 * be equal to the IP-addr of the outgoing 3382 * interface. 3383 */ 3384 if (io == NULL) { 3385 /* This is not a IPSEC_OUT type control msg */ 3386 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 3387 freemsg(ipsec_mp); 3388 return; 3389 } 3390 ill = ill_lookup_on_ifindex(io->ipsec_out_ill_index, B_FALSE, 3391 NULL, NULL, NULL, NULL, ipst); 3392 if (ill != NULL) { 3393 ipif = ipif_get_next_ipif(NULL, ill); 3394 ill_refrele(ill); 3395 } 3396 if (ipif == NULL) { 3397 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 3398 freemsg(ipsec_mp); 3399 return; 3400 } 3401 src = ipif->ipif_src_addr; 3402 ipif_refrele(ipif); 3403 } 3404 3405 if (ire != NULL) 3406 ire_refrele(ire); 3407 3408 /* 3409 * Check if we can send back more then 8 bytes in addition 3410 * to the IP header. We will include as much as 64 bytes. 3411 */ 3412 len_needed = IPH_HDR_LENGTH(ipha); 3413 if (ipha->ipha_protocol == IPPROTO_ENCAP && 3414 (uchar_t *)ipha + len_needed + 1 <= mp->b_wptr) { 3415 len_needed += IPH_HDR_LENGTH(((uchar_t *)ipha + len_needed)); 3416 } 3417 len_needed += ipst->ips_ip_icmp_return; 3418 msg_len = msgdsize(mp); 3419 if (msg_len > len_needed) { 3420 (void) adjmsg(mp, len_needed - msg_len); 3421 msg_len = len_needed; 3422 } 3423 mp1 = allocb(sizeof (icmp_ipha) + len, BPRI_HI); 3424 if (mp1 == NULL) { 3425 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutErrors); 3426 freemsg(ipsec_mp); 3427 return; 3428 } 3429 /* 3430 * On an unlabeled system, dblks don't necessarily have creds. 3431 */ 3432 ASSERT(!is_system_labeled() || DB_CRED(mp) != NULL); 3433 if (DB_CRED(mp) != NULL) 3434 mblk_setcred(mp1, DB_CRED(mp)); 3435 mp1->b_cont = mp; 3436 mp = mp1; 3437 ASSERT(ipsec_mp->b_datap->db_type == M_CTL && 3438 ipsec_mp->b_rptr == (uint8_t *)io && 3439 io->ipsec_out_type == IPSEC_OUT); 3440 ipsec_mp->b_cont = mp; 3441 3442 /* 3443 * Set ipsec_out_icmp_loopback so we can let the ICMP messages this 3444 * node generates be accepted in peace by all on-host destinations. 3445 * If we do NOT assume that all on-host destinations trust 3446 * self-generated ICMP messages, then rework here, ip6.c, and spd.c. 3447 * (Look for ipsec_out_icmp_loopback). 3448 */ 3449 io->ipsec_out_icmp_loopback = B_TRUE; 3450 3451 ipha = (ipha_t *)mp->b_rptr; 3452 mp1->b_wptr = (uchar_t *)ipha + (sizeof (icmp_ipha) + len); 3453 *ipha = icmp_ipha; 3454 ipha->ipha_src = src; 3455 ipha->ipha_dst = dst; 3456 ipha->ipha_ttl = ipst->ips_ip_def_ttl; 3457 msg_len += sizeof (icmp_ipha) + len; 3458 if (msg_len > IP_MAXPACKET) { 3459 (void) adjmsg(mp, IP_MAXPACKET - msg_len); 3460 msg_len = IP_MAXPACKET; 3461 } 3462 ipha->ipha_length = htons((uint16_t)msg_len); 3463 icmph = (icmph_t *)&ipha[1]; 3464 bcopy(stuff, icmph, len); 3465 icmph->icmph_checksum = 0; 3466 icmph->icmph_checksum = IP_CSUM(mp, (int32_t)sizeof (ipha_t), 0); 3467 if (icmph->icmph_checksum == 0) 3468 icmph->icmph_checksum = 0xFFFF; 3469 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs); 3470 put(q, ipsec_mp); 3471 } 3472 3473 /* 3474 * Determine if an ICMP error packet can be sent given the rate limit. 3475 * The limit consists of an average frequency (icmp_pkt_err_interval measured 3476 * in milliseconds) and a burst size. Burst size number of packets can 3477 * be sent arbitrarely closely spaced. 3478 * The state is tracked using two variables to implement an approximate 3479 * token bucket filter: 3480 * icmp_pkt_err_last - lbolt value when the last burst started 3481 * icmp_pkt_err_sent - number of packets sent in current burst 3482 */ 3483 boolean_t 3484 icmp_err_rate_limit(ip_stack_t *ipst) 3485 { 3486 clock_t now = TICK_TO_MSEC(lbolt); 3487 uint_t refilled; /* Number of packets refilled in tbf since last */ 3488 /* Guard against changes by loading into local variable */ 3489 uint_t err_interval = ipst->ips_ip_icmp_err_interval; 3490 3491 if (err_interval == 0) 3492 return (B_FALSE); 3493 3494 if (ipst->ips_icmp_pkt_err_last > now) { 3495 /* 100HZ lbolt in ms for 32bit arch wraps every 49.7 days */ 3496 ipst->ips_icmp_pkt_err_last = 0; 3497 ipst->ips_icmp_pkt_err_sent = 0; 3498 } 3499 /* 3500 * If we are in a burst update the token bucket filter. 3501 * Update the "last" time to be close to "now" but make sure 3502 * we don't loose precision. 3503 */ 3504 if (ipst->ips_icmp_pkt_err_sent != 0) { 3505 refilled = (now - ipst->ips_icmp_pkt_err_last)/err_interval; 3506 if (refilled > ipst->ips_icmp_pkt_err_sent) { 3507 ipst->ips_icmp_pkt_err_sent = 0; 3508 } else { 3509 ipst->ips_icmp_pkt_err_sent -= refilled; 3510 ipst->ips_icmp_pkt_err_last += refilled * err_interval; 3511 } 3512 } 3513 if (ipst->ips_icmp_pkt_err_sent == 0) { 3514 /* Start of new burst */ 3515 ipst->ips_icmp_pkt_err_last = now; 3516 } 3517 if (ipst->ips_icmp_pkt_err_sent < ipst->ips_ip_icmp_err_burst) { 3518 ipst->ips_icmp_pkt_err_sent++; 3519 ip1dbg(("icmp_err_rate_limit: %d sent in burst\n", 3520 ipst->ips_icmp_pkt_err_sent)); 3521 return (B_FALSE); 3522 } 3523 ip1dbg(("icmp_err_rate_limit: dropped\n")); 3524 return (B_TRUE); 3525 } 3526 3527 /* 3528 * Check if it is ok to send an IPv4 ICMP error packet in 3529 * response to the IPv4 packet in mp. 3530 * Free the message and return null if no 3531 * ICMP error packet should be sent. 3532 */ 3533 static mblk_t * 3534 icmp_pkt_err_ok(mblk_t *mp, ip_stack_t *ipst) 3535 { 3536 icmph_t *icmph; 3537 ipha_t *ipha; 3538 uint_t len_needed; 3539 ire_t *src_ire; 3540 ire_t *dst_ire; 3541 3542 if (!mp) 3543 return (NULL); 3544 ipha = (ipha_t *)mp->b_rptr; 3545 if (ip_csum_hdr(ipha)) { 3546 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInCksumErrs); 3547 freemsg(mp); 3548 return (NULL); 3549 } 3550 src_ire = ire_ctable_lookup(ipha->ipha_dst, 0, IRE_BROADCAST, 3551 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 3552 dst_ire = ire_ctable_lookup(ipha->ipha_src, 0, IRE_BROADCAST, 3553 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 3554 if (src_ire != NULL || dst_ire != NULL || 3555 CLASSD(ipha->ipha_dst) || 3556 CLASSD(ipha->ipha_src) || 3557 (ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET)) { 3558 /* Note: only errors to the fragment with offset 0 */ 3559 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 3560 freemsg(mp); 3561 if (src_ire != NULL) 3562 ire_refrele(src_ire); 3563 if (dst_ire != NULL) 3564 ire_refrele(dst_ire); 3565 return (NULL); 3566 } 3567 if (ipha->ipha_protocol == IPPROTO_ICMP) { 3568 /* 3569 * Check the ICMP type. RFC 1122 sez: don't send ICMP 3570 * errors in response to any ICMP errors. 3571 */ 3572 len_needed = IPH_HDR_LENGTH(ipha) + ICMPH_SIZE; 3573 if (mp->b_wptr - mp->b_rptr < len_needed) { 3574 if (!pullupmsg(mp, len_needed)) { 3575 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors); 3576 freemsg(mp); 3577 return (NULL); 3578 } 3579 ipha = (ipha_t *)mp->b_rptr; 3580 } 3581 icmph = (icmph_t *) 3582 (&((char *)ipha)[IPH_HDR_LENGTH(ipha)]); 3583 switch (icmph->icmph_type) { 3584 case ICMP_DEST_UNREACHABLE: 3585 case ICMP_SOURCE_QUENCH: 3586 case ICMP_TIME_EXCEEDED: 3587 case ICMP_PARAM_PROBLEM: 3588 case ICMP_REDIRECT: 3589 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 3590 freemsg(mp); 3591 return (NULL); 3592 default: 3593 break; 3594 } 3595 } 3596 /* 3597 * If this is a labeled system, then check to see if we're allowed to 3598 * send a response to this particular sender. If not, then just drop. 3599 */ 3600 if (is_system_labeled() && !tsol_can_reply_error(mp)) { 3601 ip2dbg(("icmp_pkt_err_ok: can't respond to packet\n")); 3602 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops); 3603 freemsg(mp); 3604 return (NULL); 3605 } 3606 if (icmp_err_rate_limit(ipst)) { 3607 /* 3608 * Only send ICMP error packets every so often. 3609 * This should be done on a per port/source basis, 3610 * but for now this will suffice. 3611 */ 3612 freemsg(mp); 3613 return (NULL); 3614 } 3615 return (mp); 3616 } 3617 3618 /* 3619 * Generate an ICMP redirect message. 3620 */ 3621 static void 3622 icmp_send_redirect(queue_t *q, mblk_t *mp, ipaddr_t gateway, ip_stack_t *ipst) 3623 { 3624 icmph_t icmph; 3625 3626 /* 3627 * We are called from ip_rput where we could 3628 * not have attached an IPSEC_IN. 3629 */ 3630 ASSERT(mp->b_datap->db_type == M_DATA); 3631 3632 if (!(mp = icmp_pkt_err_ok(mp, ipst))) { 3633 return; 3634 } 3635 3636 bzero(&icmph, sizeof (icmph_t)); 3637 icmph.icmph_type = ICMP_REDIRECT; 3638 icmph.icmph_code = 1; 3639 icmph.icmph_rd_gateway = gateway; 3640 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutRedirects); 3641 /* Redirects sent by router, and router is global zone */ 3642 icmp_pkt(q, mp, &icmph, sizeof (icmph_t), B_FALSE, GLOBAL_ZONEID, ipst); 3643 } 3644 3645 /* 3646 * Generate an ICMP time exceeded message. 3647 */ 3648 void 3649 icmp_time_exceeded(queue_t *q, mblk_t *mp, uint8_t code, zoneid_t zoneid, 3650 ip_stack_t *ipst) 3651 { 3652 icmph_t icmph; 3653 boolean_t mctl_present; 3654 mblk_t *first_mp; 3655 3656 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 3657 3658 if (!(mp = icmp_pkt_err_ok(mp, ipst))) { 3659 if (mctl_present) 3660 freeb(first_mp); 3661 return; 3662 } 3663 3664 bzero(&icmph, sizeof (icmph_t)); 3665 icmph.icmph_type = ICMP_TIME_EXCEEDED; 3666 icmph.icmph_code = code; 3667 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimeExcds); 3668 icmp_pkt(q, first_mp, &icmph, sizeof (icmph_t), mctl_present, zoneid, 3669 ipst); 3670 } 3671 3672 /* 3673 * Generate an ICMP unreachable message. 3674 */ 3675 void 3676 icmp_unreachable(queue_t *q, mblk_t *mp, uint8_t code, zoneid_t zoneid, 3677 ip_stack_t *ipst) 3678 { 3679 icmph_t icmph; 3680 mblk_t *first_mp; 3681 boolean_t mctl_present; 3682 3683 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 3684 3685 if (!(mp = icmp_pkt_err_ok(mp, ipst))) { 3686 if (mctl_present) 3687 freeb(first_mp); 3688 return; 3689 } 3690 3691 bzero(&icmph, sizeof (icmph_t)); 3692 icmph.icmph_type = ICMP_DEST_UNREACHABLE; 3693 icmph.icmph_code = code; 3694 BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs); 3695 ip2dbg(("send icmp destination unreachable code %d\n", code)); 3696 icmp_pkt(q, first_mp, (char *)&icmph, sizeof (icmph_t), mctl_present, 3697 zoneid, ipst); 3698 } 3699 3700 /* 3701 * Attempt to start recovery of an IPv4 interface that's been shut down as a 3702 * duplicate. As long as someone else holds the address, the interface will 3703 * stay down. When that conflict goes away, the interface is brought back up. 3704 * This is done so that accidental shutdowns of addresses aren't made 3705 * permanent. Your server will recover from a failure. 3706 * 3707 * For DHCP, recovery is not done in the kernel. Instead, it's handled by a 3708 * user space process (dhcpagent). 3709 * 3710 * Recovery completes if ARP reports that the address is now ours (via 3711 * AR_CN_READY). In that case, we go to ip_arp_excl to finish the operation. 3712 * 3713 * This function is entered on a timer expiry; the ID is in ipif_recovery_id. 3714 */ 3715 static void 3716 ipif_dup_recovery(void *arg) 3717 { 3718 ipif_t *ipif = arg; 3719 ill_t *ill = ipif->ipif_ill; 3720 mblk_t *arp_add_mp; 3721 mblk_t *arp_del_mp; 3722 area_t *area; 3723 ip_stack_t *ipst = ill->ill_ipst; 3724 3725 ipif->ipif_recovery_id = 0; 3726 3727 /* 3728 * No lock needed for moving or condemned check, as this is just an 3729 * optimization. 3730 */ 3731 if (ill->ill_arp_closing || !(ipif->ipif_flags & IPIF_DUPLICATE) || 3732 (ipif->ipif_flags & IPIF_POINTOPOINT) || 3733 (ipif->ipif_state_flags & (IPIF_MOVING | IPIF_CONDEMNED))) { 3734 /* No reason to try to bring this address back. */ 3735 return; 3736 } 3737 3738 if ((arp_add_mp = ipif_area_alloc(ipif)) == NULL) 3739 goto alloc_fail; 3740 3741 if (ipif->ipif_arp_del_mp == NULL) { 3742 if ((arp_del_mp = ipif_ared_alloc(ipif)) == NULL) 3743 goto alloc_fail; 3744 ipif->ipif_arp_del_mp = arp_del_mp; 3745 } 3746 3747 /* Setting the 'unverified' flag restarts DAD */ 3748 area = (area_t *)arp_add_mp->b_rptr; 3749 area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR | 3750 ACE_F_UNVERIFIED; 3751 putnext(ill->ill_rq, arp_add_mp); 3752 return; 3753 3754 alloc_fail: 3755 /* 3756 * On allocation failure, just restart the timer. Note that the ipif 3757 * is down here, so no other thread could be trying to start a recovery 3758 * timer. The ill_lock protects the condemned flag and the recovery 3759 * timer ID. 3760 */ 3761 freemsg(arp_add_mp); 3762 mutex_enter(&ill->ill_lock); 3763 if (ipst->ips_ip_dup_recovery > 0 && ipif->ipif_recovery_id == 0 && 3764 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 3765 ipif->ipif_recovery_id = timeout(ipif_dup_recovery, ipif, 3766 MSEC_TO_TICK(ipst->ips_ip_dup_recovery)); 3767 } 3768 mutex_exit(&ill->ill_lock); 3769 } 3770 3771 /* 3772 * This is for exclusive changes due to ARP. Either tear down an interface due 3773 * to AR_CN_FAILED and AR_CN_BOGON, or bring one up for successful recovery. 3774 */ 3775 /* ARGSUSED */ 3776 static void 3777 ip_arp_excl(ipsq_t *ipsq, queue_t *rq, mblk_t *mp, void *dummy_arg) 3778 { 3779 ill_t *ill = rq->q_ptr; 3780 arh_t *arh; 3781 ipaddr_t src; 3782 ipif_t *ipif; 3783 char ibuf[LIFNAMSIZ + 10]; /* 10 digits for logical i/f number */ 3784 char hbuf[MAC_STR_LEN]; 3785 char sbuf[INET_ADDRSTRLEN]; 3786 const char *failtype; 3787 boolean_t bring_up; 3788 ip_stack_t *ipst = ill->ill_ipst; 3789 3790 switch (((arcn_t *)mp->b_rptr)->arcn_code) { 3791 case AR_CN_READY: 3792 failtype = NULL; 3793 bring_up = B_TRUE; 3794 break; 3795 case AR_CN_FAILED: 3796 failtype = "in use"; 3797 bring_up = B_FALSE; 3798 break; 3799 default: 3800 failtype = "claimed"; 3801 bring_up = B_FALSE; 3802 break; 3803 } 3804 3805 arh = (arh_t *)mp->b_cont->b_rptr; 3806 bcopy((char *)&arh[1] + arh->arh_hlen, &src, IP_ADDR_LEN); 3807 3808 /* Handle failures due to probes */ 3809 if (src == 0) { 3810 bcopy((char *)&arh[1] + 2 * arh->arh_hlen + IP_ADDR_LEN, &src, 3811 IP_ADDR_LEN); 3812 } 3813 3814 (void) strlcpy(ibuf, ill->ill_name, sizeof (ibuf)); 3815 (void) mac_colon_addr((uint8_t *)(arh + 1), arh->arh_hlen, hbuf, 3816 sizeof (hbuf)); 3817 (void) ip_dot_addr(src, sbuf); 3818 for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) { 3819 3820 if ((ipif->ipif_flags & IPIF_POINTOPOINT) || 3821 ipif->ipif_lcl_addr != src) { 3822 continue; 3823 } 3824 3825 /* 3826 * If we failed on a recovery probe, then restart the timer to 3827 * try again later. 3828 */ 3829 if (!bring_up && (ipif->ipif_flags & IPIF_DUPLICATE) && 3830 !(ipif->ipif_flags & (IPIF_DHCPRUNNING|IPIF_TEMPORARY)) && 3831 ill->ill_net_type == IRE_IF_RESOLVER && 3832 !(ipif->ipif_state_flags & IPIF_CONDEMNED) && 3833 ipst->ips_ip_dup_recovery > 0 && 3834 ipif->ipif_recovery_id == 0) { 3835 ipif->ipif_recovery_id = timeout(ipif_dup_recovery, 3836 ipif, MSEC_TO_TICK(ipst->ips_ip_dup_recovery)); 3837 continue; 3838 } 3839 3840 /* 3841 * If what we're trying to do has already been done, then do 3842 * nothing. 3843 */ 3844 if (bring_up == ((ipif->ipif_flags & IPIF_UP) != 0)) 3845 continue; 3846 3847 if (ipif->ipif_id != 0) { 3848 (void) snprintf(ibuf + ill->ill_name_length - 1, 3849 sizeof (ibuf) - ill->ill_name_length + 1, ":%d", 3850 ipif->ipif_id); 3851 } 3852 if (failtype == NULL) { 3853 cmn_err(CE_NOTE, "recovered address %s on %s", sbuf, 3854 ibuf); 3855 } else { 3856 cmn_err(CE_WARN, "%s has duplicate address %s (%s " 3857 "by %s); disabled", ibuf, sbuf, failtype, hbuf); 3858 } 3859 3860 if (bring_up) { 3861 ASSERT(ill->ill_dl_up); 3862 /* 3863 * Free up the ARP delete message so we can allocate 3864 * a fresh one through the normal path. 3865 */ 3866 freemsg(ipif->ipif_arp_del_mp); 3867 ipif->ipif_arp_del_mp = NULL; 3868 if (ipif_resolver_up(ipif, Res_act_initial) != 3869 EINPROGRESS) { 3870 ipif->ipif_addr_ready = 1; 3871 (void) ipif_up_done(ipif); 3872 } 3873 continue; 3874 } 3875 3876 mutex_enter(&ill->ill_lock); 3877 ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE)); 3878 ipif->ipif_flags |= IPIF_DUPLICATE; 3879 ill->ill_ipif_dup_count++; 3880 mutex_exit(&ill->ill_lock); 3881 /* 3882 * Already exclusive on the ill; no need to handle deferred 3883 * processing here. 3884 */ 3885 (void) ipif_down(ipif, NULL, NULL); 3886 ipif_down_tail(ipif); 3887 mutex_enter(&ill->ill_lock); 3888 if (!(ipif->ipif_flags & (IPIF_DHCPRUNNING|IPIF_TEMPORARY)) && 3889 ill->ill_net_type == IRE_IF_RESOLVER && 3890 !(ipif->ipif_state_flags & IPIF_CONDEMNED) && 3891 ipst->ips_ip_dup_recovery > 0) { 3892 ipif->ipif_recovery_id = timeout(ipif_dup_recovery, 3893 ipif, MSEC_TO_TICK(ipst->ips_ip_dup_recovery)); 3894 } 3895 mutex_exit(&ill->ill_lock); 3896 } 3897 freemsg(mp); 3898 } 3899 3900 /* ARGSUSED */ 3901 static void 3902 ip_arp_defend(ipsq_t *ipsq, queue_t *rq, mblk_t *mp, void *dummy_arg) 3903 { 3904 ill_t *ill = rq->q_ptr; 3905 arh_t *arh; 3906 ipaddr_t src; 3907 ipif_t *ipif; 3908 3909 arh = (arh_t *)mp->b_cont->b_rptr; 3910 bcopy((char *)&arh[1] + arh->arh_hlen, &src, IP_ADDR_LEN); 3911 for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) { 3912 if ((ipif->ipif_flags & IPIF_UP) && ipif->ipif_lcl_addr == src) 3913 (void) ipif_resolver_up(ipif, Res_act_defend); 3914 } 3915 freemsg(mp); 3916 } 3917 3918 /* 3919 * News from ARP. ARP sends notification of interesting events down 3920 * to its clients using M_CTL messages with the interesting ARP packet 3921 * attached via b_cont. 3922 * The interesting event from a device comes up the corresponding ARP-IP-DEV 3923 * queue as opposed to ARP sending the message to all the clients, i.e. all 3924 * its ARP-IP-DEV instances. Thus, for AR_CN_ANNOUNCE, we must walk the cache 3925 * table if a cache IRE is found to delete all the entries for the address in 3926 * the packet. 3927 */ 3928 static void 3929 ip_arp_news(queue_t *q, mblk_t *mp) 3930 { 3931 arcn_t *arcn; 3932 arh_t *arh; 3933 ire_t *ire = NULL; 3934 char hbuf[MAC_STR_LEN]; 3935 char sbuf[INET_ADDRSTRLEN]; 3936 ipaddr_t src; 3937 in6_addr_t v6src; 3938 boolean_t isv6 = B_FALSE; 3939 ipif_t *ipif; 3940 ill_t *ill; 3941 ip_stack_t *ipst; 3942 3943 if (CONN_Q(q)) { 3944 conn_t *connp = Q_TO_CONN(q); 3945 3946 ipst = connp->conn_netstack->netstack_ip; 3947 } else { 3948 ill_t *ill = (ill_t *)q->q_ptr; 3949 3950 ipst = ill->ill_ipst; 3951 } 3952 3953 if ((mp->b_wptr - mp->b_rptr) < sizeof (arcn_t) || !mp->b_cont) { 3954 if (q->q_next) { 3955 putnext(q, mp); 3956 } else 3957 freemsg(mp); 3958 return; 3959 } 3960 arh = (arh_t *)mp->b_cont->b_rptr; 3961 /* Is it one we are interested in? */ 3962 if (BE16_TO_U16(arh->arh_proto) == IP6_DL_SAP) { 3963 isv6 = B_TRUE; 3964 bcopy((char *)&arh[1] + (arh->arh_hlen & 0xFF), &v6src, 3965 IPV6_ADDR_LEN); 3966 } else if (BE16_TO_U16(arh->arh_proto) == IP_ARP_PROTO_TYPE) { 3967 bcopy((char *)&arh[1] + (arh->arh_hlen & 0xFF), &src, 3968 IP_ADDR_LEN); 3969 } else { 3970 freemsg(mp); 3971 return; 3972 } 3973 3974 ill = q->q_ptr; 3975 3976 arcn = (arcn_t *)mp->b_rptr; 3977 switch (arcn->arcn_code) { 3978 case AR_CN_BOGON: 3979 /* 3980 * Someone is sending ARP packets with a source protocol 3981 * address that we have published and for which we believe our 3982 * entry is authoritative and (when ill_arp_extend is set) 3983 * verified to be unique on the network. 3984 * 3985 * The ARP module internally handles the cases where the sender 3986 * is just probing (for DAD) and where the hardware address of 3987 * a non-authoritative entry has changed. Thus, these are the 3988 * real conflicts, and we have to do resolution. 3989 * 3990 * We back away quickly from the address if it's from DHCP or 3991 * otherwise temporary and hasn't been used recently (or at 3992 * all). We'd like to include "deprecated" addresses here as 3993 * well (as there's no real reason to defend something we're 3994 * discarding), but IPMP "reuses" this flag to mean something 3995 * other than the standard meaning. 3996 * 3997 * If the ARP module above is not extended (meaning that it 3998 * doesn't know how to defend the address), then we just log 3999 * the problem as we always did and continue on. It's not 4000 * right, but there's little else we can do, and those old ATM 4001 * users are going away anyway. 4002 */ 4003 (void) mac_colon_addr((uint8_t *)(arh + 1), arh->arh_hlen, 4004 hbuf, sizeof (hbuf)); 4005 (void) ip_dot_addr(src, sbuf); 4006 if (isv6) { 4007 ire = ire_cache_lookup_v6(&v6src, ALL_ZONES, NULL, 4008 ipst); 4009 } else { 4010 ire = ire_cache_lookup(src, ALL_ZONES, NULL, ipst); 4011 } 4012 if (ire != NULL && IRE_IS_LOCAL(ire)) { 4013 uint32_t now; 4014 uint32_t maxage; 4015 clock_t lused; 4016 uint_t maxdefense; 4017 uint_t defs; 4018 4019 /* 4020 * First, figure out if this address hasn't been used 4021 * in a while. If it hasn't, then it's a better 4022 * candidate for abandoning. 4023 */ 4024 ipif = ire->ire_ipif; 4025 ASSERT(ipif != NULL); 4026 now = gethrestime_sec(); 4027 maxage = now - ire->ire_create_time; 4028 if (maxage > ipst->ips_ip_max_temp_idle) 4029 maxage = ipst->ips_ip_max_temp_idle; 4030 lused = drv_hztousec(ddi_get_lbolt() - 4031 ire->ire_last_used_time) / MICROSEC + 1; 4032 if (lused >= maxage && (ipif->ipif_flags & 4033 (IPIF_DHCPRUNNING | IPIF_TEMPORARY))) 4034 maxdefense = ipst->ips_ip_max_temp_defend; 4035 else 4036 maxdefense = ipst->ips_ip_max_defend; 4037 4038 /* 4039 * Now figure out how many times we've defended 4040 * ourselves. Ignore defenses that happened long in 4041 * the past. 4042 */ 4043 mutex_enter(&ire->ire_lock); 4044 if ((defs = ire->ire_defense_count) > 0 && 4045 now - ire->ire_defense_time > 4046 ipst->ips_ip_defend_interval) { 4047 ire->ire_defense_count = defs = 0; 4048 } 4049 ire->ire_defense_count++; 4050 ire->ire_defense_time = now; 4051 mutex_exit(&ire->ire_lock); 4052 ill_refhold(ill); 4053 ire_refrele(ire); 4054 4055 /* 4056 * If we've defended ourselves too many times already, 4057 * then give up and tear down the interface(s) using 4058 * this address. Otherwise, defend by sending out a 4059 * gratuitous ARP. 4060 */ 4061 if (defs >= maxdefense && ill->ill_arp_extend) { 4062 (void) qwriter_ip(NULL, ill, q, mp, 4063 ip_arp_excl, CUR_OP, B_FALSE); 4064 } else { 4065 cmn_err(CE_WARN, 4066 "node %s is using our IP address %s on %s", 4067 hbuf, sbuf, ill->ill_name); 4068 /* 4069 * If this is an old (ATM) ARP module, then 4070 * don't try to defend the address. Remain 4071 * compatible with the old behavior. Defend 4072 * only with new ARP. 4073 */ 4074 if (ill->ill_arp_extend) { 4075 (void) qwriter_ip(NULL, ill, q, mp, 4076 ip_arp_defend, CUR_OP, B_FALSE); 4077 } else { 4078 ill_refrele(ill); 4079 } 4080 } 4081 return; 4082 } 4083 cmn_err(CE_WARN, 4084 "proxy ARP problem? Node '%s' is using %s on %s", 4085 hbuf, sbuf, ill->ill_name); 4086 if (ire != NULL) 4087 ire_refrele(ire); 4088 break; 4089 case AR_CN_ANNOUNCE: 4090 if (isv6) { 4091 /* 4092 * For XRESOLV interfaces. 4093 * Delete the IRE cache entry and NCE for this 4094 * v6 address 4095 */ 4096 ip_ire_clookup_and_delete_v6(&v6src, ipst); 4097 /* 4098 * If v6src is a non-zero, it's a router address 4099 * as below. Do the same sort of thing to clean 4100 * out off-net IRE_CACHE entries that go through 4101 * the router. 4102 */ 4103 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 4104 ire_walk_v6(ire_delete_cache_gw_v6, 4105 (char *)&v6src, ALL_ZONES, ipst); 4106 } 4107 } else { 4108 nce_hw_map_t hwm; 4109 4110 /* 4111 * ARP gives us a copy of any packet where it thinks 4112 * the address has changed, so that we can update our 4113 * caches. We're responsible for caching known answers 4114 * in the current design. We check whether the 4115 * hardware address really has changed in all of our 4116 * entries that have cached this mapping, and if so, we 4117 * blow them away. This way we will immediately pick 4118 * up the rare case of a host changing hardware 4119 * address. 4120 */ 4121 if (src == 0) 4122 break; 4123 hwm.hwm_addr = src; 4124 hwm.hwm_hwlen = arh->arh_hlen; 4125 hwm.hwm_hwaddr = (uchar_t *)(arh + 1); 4126 ndp_walk_common(ipst->ips_ndp4, NULL, 4127 (pfi_t)nce_delete_hw_changed, &hwm, ALL_ZONES); 4128 } 4129 break; 4130 case AR_CN_READY: 4131 /* No external v6 resolver has a contract to use this */ 4132 if (isv6) 4133 break; 4134 /* If the link is down, we'll retry this later */ 4135 if (!(ill->ill_phyint->phyint_flags & PHYI_RUNNING)) 4136 break; 4137 ipif = ipif_lookup_addr(src, ill, ALL_ZONES, NULL, NULL, 4138 NULL, NULL, ipst); 4139 if (ipif != NULL) { 4140 /* 4141 * If this is a duplicate recovery, then we now need to 4142 * go exclusive to bring this thing back up. 4143 */ 4144 if ((ipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)) == 4145 IPIF_DUPLICATE) { 4146 ipif_refrele(ipif); 4147 ill_refhold(ill); 4148 (void) qwriter_ip(NULL, ill, q, mp, 4149 ip_arp_excl, CUR_OP, B_FALSE); 4150 return; 4151 } 4152 /* 4153 * If this is the first notice that this address is 4154 * ready, then let the user know now. 4155 */ 4156 if ((ipif->ipif_flags & IPIF_UP) && 4157 !ipif->ipif_addr_ready) { 4158 ipif_mask_reply(ipif); 4159 ip_rts_ifmsg(ipif); 4160 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 4161 sctp_update_ipif(ipif, SCTP_IPIF_UP); 4162 } 4163 ipif->ipif_addr_ready = 1; 4164 ipif_refrele(ipif); 4165 } 4166 ire = ire_cache_lookup(src, ALL_ZONES, MBLK_GETLABEL(mp), ipst); 4167 if (ire != NULL) { 4168 ire->ire_defense_count = 0; 4169 ire_refrele(ire); 4170 } 4171 break; 4172 case AR_CN_FAILED: 4173 /* No external v6 resolver has a contract to use this */ 4174 if (isv6) 4175 break; 4176 ill_refhold(ill); 4177 (void) qwriter_ip(NULL, ill, q, mp, ip_arp_excl, CUR_OP, 4178 B_FALSE); 4179 return; 4180 } 4181 freemsg(mp); 4182 } 4183 4184 /* 4185 * Create a mblk suitable for carrying the interface index and/or source link 4186 * address. This mblk is tagged as an M_CTL and is sent to ULP. This is used 4187 * when the IP_RECVIF and/or IP_RECVSLLA socket option is set by the user 4188 * application. 4189 */ 4190 mblk_t * 4191 ip_add_info(mblk_t *data_mp, ill_t *ill, uint_t flags, zoneid_t zoneid, 4192 ip_stack_t *ipst) 4193 { 4194 mblk_t *mp; 4195 ip_pktinfo_t *pinfo; 4196 ipha_t *ipha; 4197 struct ether_header *pether; 4198 4199 mp = allocb(sizeof (ip_pktinfo_t), BPRI_MED); 4200 if (mp == NULL) { 4201 ip1dbg(("ip_add_info: allocation failure.\n")); 4202 return (data_mp); 4203 } 4204 4205 ipha = (ipha_t *)data_mp->b_rptr; 4206 pinfo = (ip_pktinfo_t *)mp->b_rptr; 4207 bzero(pinfo, sizeof (ip_pktinfo_t)); 4208 pinfo->ip_pkt_flags = (uchar_t)flags; 4209 pinfo->ip_pkt_ulp_type = IN_PKTINFO; /* Tell ULP what type of info */ 4210 4211 if (flags & (IPF_RECVIF | IPF_RECVADDR)) 4212 pinfo->ip_pkt_ifindex = ill->ill_phyint->phyint_ifindex; 4213 if (flags & IPF_RECVADDR) { 4214 ipif_t *ipif; 4215 ire_t *ire; 4216 4217 /* 4218 * Only valid for V4 4219 */ 4220 ASSERT((ipha->ipha_version_and_hdr_length & 0xf0) == 4221 (IPV4_VERSION << 4)); 4222 4223 ipif = ipif_get_next_ipif(NULL, ill); 4224 if (ipif != NULL) { 4225 /* 4226 * Since a decision has already been made to deliver the 4227 * packet, there is no need to test for SECATTR and 4228 * ZONEONLY. 4229 */ 4230 ire = ire_ctable_lookup(ipha->ipha_dst, 0, 0, ipif, 4231 zoneid, NULL, MATCH_IRE_ILL_GROUP, ipst); 4232 if (ire == NULL) { 4233 /* 4234 * packet must have come on a different 4235 * interface. 4236 * Since a decision has already been made to 4237 * deliver the packet, there is no need to test 4238 * for SECATTR and ZONEONLY. 4239 */ 4240 ire = ire_ctable_lookup(ipha->ipha_dst, 0, 0, 4241 ipif, zoneid, NULL, NULL, ipst); 4242 } 4243 4244 if (ire == NULL) { 4245 /* 4246 * This is either a multicast packet or 4247 * the address has been removed since 4248 * the packet was received. 4249 * Return INADDR_ANY so that normal source 4250 * selection occurs for the response. 4251 */ 4252 4253 pinfo->ip_pkt_match_addr.s_addr = INADDR_ANY; 4254 } else { 4255 ASSERT(ire->ire_type != IRE_CACHE); 4256 pinfo->ip_pkt_match_addr.s_addr = 4257 ire->ire_src_addr; 4258 ire_refrele(ire); 4259 } 4260 ipif_refrele(ipif); 4261 } else { 4262 pinfo->ip_pkt_match_addr.s_addr = INADDR_ANY; 4263 } 4264 } 4265 4266 pether = (struct ether_header *)((char *)ipha 4267 - sizeof (struct ether_header)); 4268 /* 4269 * Make sure the interface is an ethernet type, since this option 4270 * is currently supported only on this type of interface. Also make 4271 * sure we are pointing correctly above db_base. 4272 */ 4273 4274 if ((flags & IPF_RECVSLLA) && 4275 ((uchar_t *)pether >= data_mp->b_datap->db_base) && 4276 (ill->ill_type == IFT_ETHER) && 4277 (ill->ill_net_type == IRE_IF_RESOLVER)) { 4278 4279 pinfo->ip_pkt_slla.sdl_type = IFT_ETHER; 4280 bcopy((uchar_t *)pether->ether_shost.ether_addr_octet, 4281 (uchar_t *)pinfo->ip_pkt_slla.sdl_data, ETHERADDRL); 4282 } else { 4283 /* 4284 * Clear the bit. Indicate to upper layer that IP is not 4285 * sending this ancillary info. 4286 */ 4287 pinfo->ip_pkt_flags = pinfo->ip_pkt_flags & ~IPF_RECVSLLA; 4288 } 4289 4290 mp->b_datap->db_type = M_CTL; 4291 mp->b_wptr += sizeof (ip_pktinfo_t); 4292 mp->b_cont = data_mp; 4293 4294 return (mp); 4295 } 4296 4297 /* 4298 * Latch in the IPsec state for a stream based on the ipsec_in_t passed in as 4299 * part of the bind request. 4300 */ 4301 4302 boolean_t 4303 ip_bind_ipsec_policy_set(conn_t *connp, mblk_t *policy_mp) 4304 { 4305 ipsec_in_t *ii; 4306 4307 ASSERT(policy_mp != NULL); 4308 ASSERT(policy_mp->b_datap->db_type == IPSEC_POLICY_SET); 4309 4310 ii = (ipsec_in_t *)policy_mp->b_rptr; 4311 ASSERT(ii->ipsec_in_type == IPSEC_IN); 4312 4313 connp->conn_policy = ii->ipsec_in_policy; 4314 ii->ipsec_in_policy = NULL; 4315 4316 if (ii->ipsec_in_action != NULL) { 4317 if (connp->conn_latch == NULL) { 4318 connp->conn_latch = iplatch_create(); 4319 if (connp->conn_latch == NULL) 4320 return (B_FALSE); 4321 } 4322 ipsec_latch_inbound(connp->conn_latch, ii); 4323 } 4324 return (B_TRUE); 4325 } 4326 4327 /* 4328 * Upper level protocols (ULP) pass through bind requests to IP for inspection 4329 * and to arrange for power-fanout assist. The ULP is identified by 4330 * adding a single byte at the end of the original bind message. 4331 * A ULP other than UDP or TCP that wishes to be recognized passes 4332 * down a bind with a zero length address. 4333 * 4334 * The binding works as follows: 4335 * - A zero byte address means just bind to the protocol. 4336 * - A four byte address is treated as a request to validate 4337 * that the address is a valid local address, appropriate for 4338 * an application to bind to. This does not affect any fanout 4339 * information in IP. 4340 * - A sizeof sin_t byte address is used to bind to only the local address 4341 * and port. 4342 * - A sizeof ipa_conn_t byte address contains complete fanout information 4343 * consisting of local and remote addresses and ports. In 4344 * this case, the addresses are both validated as appropriate 4345 * for this operation, and, if so, the information is retained 4346 * for use in the inbound fanout. 4347 * 4348 * The ULP (except in the zero-length bind) can append an 4349 * additional mblk of db_type IRE_DB_REQ_TYPE or IPSEC_POLICY_SET to the 4350 * T_BIND_REQ/O_T_BIND_REQ. IRE_DB_REQ_TYPE indicates that the ULP wants 4351 * a copy of the source or destination IRE (source for local bind; 4352 * destination for complete bind). IPSEC_POLICY_SET indicates that the 4353 * policy information contained should be copied on to the conn. 4354 * 4355 * NOTE : Only one of IRE_DB_REQ_TYPE or IPSEC_POLICY_SET can be present. 4356 */ 4357 mblk_t * 4358 ip_bind_v4(queue_t *q, mblk_t *mp, conn_t *connp) 4359 { 4360 ssize_t len; 4361 struct T_bind_req *tbr; 4362 sin_t *sin; 4363 ipa_conn_t *ac; 4364 uchar_t *ucp; 4365 mblk_t *mp1; 4366 boolean_t ire_requested; 4367 boolean_t ipsec_policy_set = B_FALSE; 4368 int error = 0; 4369 int protocol; 4370 ipa_conn_x_t *acx; 4371 4372 ASSERT(!connp->conn_af_isv6); 4373 connp->conn_pkt_isv6 = B_FALSE; 4374 4375 len = MBLKL(mp); 4376 if (len < (sizeof (*tbr) + 1)) { 4377 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 4378 "ip_bind: bogus msg, len %ld", len); 4379 /* XXX: Need to return something better */ 4380 goto bad_addr; 4381 } 4382 /* Back up and extract the protocol identifier. */ 4383 mp->b_wptr--; 4384 protocol = *mp->b_wptr & 0xFF; 4385 tbr = (struct T_bind_req *)mp->b_rptr; 4386 /* Reset the message type in preparation for shipping it back. */ 4387 DB_TYPE(mp) = M_PCPROTO; 4388 4389 connp->conn_ulp = (uint8_t)protocol; 4390 4391 /* 4392 * Check for a zero length address. This is from a protocol that 4393 * wants to register to receive all packets of its type. 4394 */ 4395 if (tbr->ADDR_length == 0) { 4396 /* 4397 * These protocols are now intercepted in ip_bind_v6(). 4398 * Reject protocol-level binds here for now. 4399 * 4400 * For SCTP raw socket, ICMP sends down a bind with sin_t 4401 * so that the protocol type cannot be SCTP. 4402 */ 4403 if (protocol == IPPROTO_TCP || protocol == IPPROTO_AH || 4404 protocol == IPPROTO_ESP || protocol == IPPROTO_SCTP) { 4405 goto bad_addr; 4406 } 4407 4408 /* 4409 * 4410 * The udp module never sends down a zero-length address, 4411 * and allowing this on a labeled system will break MLP 4412 * functionality. 4413 */ 4414 if (is_system_labeled() && protocol == IPPROTO_UDP) 4415 goto bad_addr; 4416 4417 if (connp->conn_mac_exempt) 4418 goto bad_addr; 4419 4420 /* No hash here really. The table is big enough. */ 4421 connp->conn_srcv6 = ipv6_all_zeros; 4422 4423 ipcl_proto_insert(connp, protocol); 4424 4425 tbr->PRIM_type = T_BIND_ACK; 4426 return (mp); 4427 } 4428 4429 /* Extract the address pointer from the message. */ 4430 ucp = (uchar_t *)mi_offset_param(mp, tbr->ADDR_offset, 4431 tbr->ADDR_length); 4432 if (ucp == NULL) { 4433 ip1dbg(("ip_bind: no address\n")); 4434 goto bad_addr; 4435 } 4436 if (!OK_32PTR(ucp)) { 4437 ip1dbg(("ip_bind: unaligned address\n")); 4438 goto bad_addr; 4439 } 4440 /* 4441 * Check for trailing mps. 4442 */ 4443 4444 mp1 = mp->b_cont; 4445 ire_requested = (mp1 != NULL && DB_TYPE(mp1) == IRE_DB_REQ_TYPE); 4446 ipsec_policy_set = (mp1 != NULL && DB_TYPE(mp1) == IPSEC_POLICY_SET); 4447 4448 switch (tbr->ADDR_length) { 4449 default: 4450 ip1dbg(("ip_bind: bad address length %d\n", 4451 (int)tbr->ADDR_length)); 4452 goto bad_addr; 4453 4454 case IP_ADDR_LEN: 4455 /* Verification of local address only */ 4456 error = ip_bind_laddr(connp, mp, *(ipaddr_t *)ucp, 0, 4457 ire_requested, ipsec_policy_set, B_FALSE); 4458 break; 4459 4460 case sizeof (sin_t): 4461 sin = (sin_t *)ucp; 4462 error = ip_bind_laddr(connp, mp, sin->sin_addr.s_addr, 4463 sin->sin_port, ire_requested, ipsec_policy_set, B_TRUE); 4464 break; 4465 4466 case sizeof (ipa_conn_t): 4467 ac = (ipa_conn_t *)ucp; 4468 /* For raw socket, the local port is not set. */ 4469 if (ac->ac_lport == 0) 4470 ac->ac_lport = connp->conn_lport; 4471 /* Always verify destination reachability. */ 4472 error = ip_bind_connected(connp, mp, &ac->ac_laddr, 4473 ac->ac_lport, ac->ac_faddr, ac->ac_fport, ire_requested, 4474 ipsec_policy_set, B_TRUE, B_TRUE); 4475 break; 4476 4477 case sizeof (ipa_conn_x_t): 4478 acx = (ipa_conn_x_t *)ucp; 4479 /* 4480 * Whether or not to verify destination reachability depends 4481 * on the setting of the ACX_VERIFY_DST flag in acx->acx_flags. 4482 */ 4483 error = ip_bind_connected(connp, mp, &acx->acx_conn.ac_laddr, 4484 acx->acx_conn.ac_lport, acx->acx_conn.ac_faddr, 4485 acx->acx_conn.ac_fport, ire_requested, ipsec_policy_set, 4486 B_TRUE, (acx->acx_flags & ACX_VERIFY_DST) != 0); 4487 break; 4488 } 4489 if (error == EINPROGRESS) 4490 return (NULL); 4491 else if (error != 0) 4492 goto bad_addr; 4493 /* 4494 * Pass the IPSEC headers size in ire_ipsec_overhead. 4495 * We can't do this in ip_bind_insert_ire because the policy 4496 * may not have been inherited at that point in time and hence 4497 * conn_out_enforce_policy may not be set. 4498 */ 4499 mp1 = mp->b_cont; 4500 if (ire_requested && connp->conn_out_enforce_policy && 4501 mp1 != NULL && DB_TYPE(mp1) == IRE_DB_REQ_TYPE) { 4502 ire_t *ire = (ire_t *)mp1->b_rptr; 4503 ASSERT(MBLKL(mp1) >= sizeof (ire_t)); 4504 ire->ire_ipsec_overhead = conn_ipsec_length(connp); 4505 } 4506 4507 /* Send it home. */ 4508 mp->b_datap->db_type = M_PCPROTO; 4509 tbr->PRIM_type = T_BIND_ACK; 4510 return (mp); 4511 4512 bad_addr: 4513 /* 4514 * If error = -1 then we generate a TBADADDR - otherwise error is 4515 * a unix errno. 4516 */ 4517 if (error > 0) 4518 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, error); 4519 else 4520 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 4521 return (mp); 4522 } 4523 4524 /* 4525 * Here address is verified to be a valid local address. 4526 * If the IRE_DB_REQ_TYPE mp is present, a broadcast/multicast 4527 * address is also considered a valid local address. 4528 * In the case of a broadcast/multicast address, however, the 4529 * upper protocol is expected to reset the src address 4530 * to 0 if it sees a IRE_BROADCAST type returned so that 4531 * no packets are emitted with broadcast/multicast address as 4532 * source address (that violates hosts requirements RFC1122) 4533 * The addresses valid for bind are: 4534 * (1) - INADDR_ANY (0) 4535 * (2) - IP address of an UP interface 4536 * (3) - IP address of a DOWN interface 4537 * (4) - valid local IP broadcast addresses. In this case 4538 * the conn will only receive packets destined to 4539 * the specified broadcast address. 4540 * (5) - a multicast address. In this case 4541 * the conn will only receive packets destined to 4542 * the specified multicast address. Note: the 4543 * application still has to issue an 4544 * IP_ADD_MEMBERSHIP socket option. 4545 * 4546 * On error, return -1 for TBADADDR otherwise pass the 4547 * errno with TSYSERR reply. 4548 * 4549 * In all the above cases, the bound address must be valid in the current zone. 4550 * When the address is loopback, multicast or broadcast, there might be many 4551 * matching IREs so bind has to look up based on the zone. 4552 * 4553 * Note: lport is in network byte order. 4554 */ 4555 int 4556 ip_bind_laddr(conn_t *connp, mblk_t *mp, ipaddr_t src_addr, uint16_t lport, 4557 boolean_t ire_requested, boolean_t ipsec_policy_set, 4558 boolean_t fanout_insert) 4559 { 4560 int error = 0; 4561 ire_t *src_ire; 4562 mblk_t *policy_mp; 4563 ipif_t *ipif; 4564 zoneid_t zoneid; 4565 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 4566 4567 if (ipsec_policy_set) { 4568 policy_mp = mp->b_cont; 4569 } 4570 4571 /* 4572 * If it was previously connected, conn_fully_bound would have 4573 * been set. 4574 */ 4575 connp->conn_fully_bound = B_FALSE; 4576 4577 src_ire = NULL; 4578 ipif = NULL; 4579 4580 zoneid = IPCL_ZONEID(connp); 4581 4582 if (src_addr) { 4583 src_ire = ire_route_lookup(src_addr, 0, 0, 0, 4584 NULL, NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, ipst); 4585 /* 4586 * If an address other than 0.0.0.0 is requested, 4587 * we verify that it is a valid address for bind 4588 * Note: Following code is in if-else-if form for 4589 * readability compared to a condition check. 4590 */ 4591 /* LINTED - statement has no consequent */ 4592 if (IRE_IS_LOCAL(src_ire)) { 4593 /* 4594 * (2) Bind to address of local UP interface 4595 */ 4596 } else if (src_ire && src_ire->ire_type == IRE_BROADCAST) { 4597 /* 4598 * (4) Bind to broadcast address 4599 * Note: permitted only from transports that 4600 * request IRE 4601 */ 4602 if (!ire_requested) 4603 error = EADDRNOTAVAIL; 4604 } else { 4605 /* 4606 * (3) Bind to address of local DOWN interface 4607 * (ipif_lookup_addr() looks up all interfaces 4608 * but we do not get here for UP interfaces 4609 * - case (2) above) 4610 * We put the protocol byte back into the mblk 4611 * since we may come back via ip_wput_nondata() 4612 * later with this mblk if ipif_lookup_addr chooses 4613 * to defer processing. 4614 */ 4615 *mp->b_wptr++ = (char)connp->conn_ulp; 4616 if ((ipif = ipif_lookup_addr(src_addr, NULL, zoneid, 4617 CONNP_TO_WQ(connp), mp, ip_wput_nondata, 4618 &error, ipst)) != NULL) { 4619 ipif_refrele(ipif); 4620 } else if (error == EINPROGRESS) { 4621 if (src_ire != NULL) 4622 ire_refrele(src_ire); 4623 return (EINPROGRESS); 4624 } else if (CLASSD(src_addr)) { 4625 error = 0; 4626 if (src_ire != NULL) 4627 ire_refrele(src_ire); 4628 /* 4629 * (5) bind to multicast address. 4630 * Fake out the IRE returned to upper 4631 * layer to be a broadcast IRE. 4632 */ 4633 src_ire = ire_ctable_lookup( 4634 INADDR_BROADCAST, INADDR_ANY, 4635 IRE_BROADCAST, NULL, zoneid, NULL, 4636 (MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY), 4637 ipst); 4638 if (src_ire == NULL || !ire_requested) 4639 error = EADDRNOTAVAIL; 4640 } else { 4641 /* 4642 * Not a valid address for bind 4643 */ 4644 error = EADDRNOTAVAIL; 4645 } 4646 /* 4647 * Just to keep it consistent with the processing in 4648 * ip_bind_v4() 4649 */ 4650 mp->b_wptr--; 4651 } 4652 if (error) { 4653 /* Red Alert! Attempting to be a bogon! */ 4654 ip1dbg(("ip_bind: bad src address 0x%x\n", 4655 ntohl(src_addr))); 4656 goto bad_addr; 4657 } 4658 } 4659 4660 /* 4661 * Allow setting new policies. For example, disconnects come 4662 * down as ipa_t bind. As we would have set conn_policy_cached 4663 * to B_TRUE before, we should set it to B_FALSE, so that policy 4664 * can change after the disconnect. 4665 */ 4666 connp->conn_policy_cached = B_FALSE; 4667 4668 /* 4669 * If not fanout_insert this was just an address verification 4670 */ 4671 if (fanout_insert) { 4672 /* 4673 * The addresses have been verified. Time to insert in 4674 * the correct fanout list. 4675 */ 4676 IN6_IPADDR_TO_V4MAPPED(src_addr, &connp->conn_srcv6); 4677 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &connp->conn_remv6); 4678 connp->conn_lport = lport; 4679 connp->conn_fport = 0; 4680 /* 4681 * Do we need to add a check to reject Multicast packets 4682 * 4683 * We need to make sure that the conn_recv is set to a non-null 4684 * value before we insert the conn into the classifier table. 4685 * This is to avoid a race with an incoming packet which does an 4686 * ipcl_classify(). 4687 */ 4688 if (*mp->b_wptr == IPPROTO_TCP) 4689 connp->conn_recv = tcp_conn_request; 4690 error = ipcl_bind_insert(connp, *mp->b_wptr, src_addr, lport); 4691 } 4692 4693 if (error == 0) { 4694 if (ire_requested) { 4695 if (!ip_bind_insert_ire(mp, src_ire, NULL, ipst)) { 4696 error = -1; 4697 /* Falls through to bad_addr */ 4698 } 4699 } else if (ipsec_policy_set) { 4700 if (!ip_bind_ipsec_policy_set(connp, policy_mp)) { 4701 error = -1; 4702 /* Falls through to bad_addr */ 4703 } 4704 } 4705 } else if (connp->conn_ulp == IPPROTO_TCP) { 4706 connp->conn_recv = tcp_input; 4707 } 4708 bad_addr: 4709 if (error != 0) { 4710 if (connp->conn_anon_port) { 4711 (void) tsol_mlp_anon(crgetzone(connp->conn_cred), 4712 connp->conn_mlp_type, connp->conn_ulp, ntohs(lport), 4713 B_FALSE); 4714 } 4715 connp->conn_mlp_type = mlptSingle; 4716 } 4717 if (src_ire != NULL) 4718 IRE_REFRELE(src_ire); 4719 if (ipsec_policy_set) { 4720 ASSERT(policy_mp == mp->b_cont); 4721 ASSERT(policy_mp != NULL); 4722 freeb(policy_mp); 4723 /* 4724 * As of now assume that nothing else accompanies 4725 * IPSEC_POLICY_SET. 4726 */ 4727 mp->b_cont = NULL; 4728 } 4729 return (error); 4730 } 4731 4732 /* 4733 * Verify that both the source and destination addresses 4734 * are valid. If verify_dst is false, then the destination address may be 4735 * unreachable, i.e. have no route to it. Protocols like TCP want to verify 4736 * destination reachability, while tunnels do not. 4737 * Note that we allow connect to broadcast and multicast 4738 * addresses when ire_requested is set. Thus the ULP 4739 * has to check for IRE_BROADCAST and multicast. 4740 * 4741 * Returns zero if ok. 4742 * On error: returns -1 to mean TBADADDR otherwise returns an errno 4743 * (for use with TSYSERR reply). 4744 * 4745 * Note: lport and fport are in network byte order. 4746 */ 4747 int 4748 ip_bind_connected(conn_t *connp, mblk_t *mp, ipaddr_t *src_addrp, 4749 uint16_t lport, ipaddr_t dst_addr, uint16_t fport, 4750 boolean_t ire_requested, boolean_t ipsec_policy_set, 4751 boolean_t fanout_insert, boolean_t verify_dst) 4752 { 4753 ire_t *src_ire; 4754 ire_t *dst_ire; 4755 int error = 0; 4756 int protocol; 4757 mblk_t *policy_mp; 4758 ire_t *sire = NULL; 4759 ire_t *md_dst_ire = NULL; 4760 ire_t *lso_dst_ire = NULL; 4761 ill_t *ill = NULL; 4762 zoneid_t zoneid; 4763 ipaddr_t src_addr = *src_addrp; 4764 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 4765 4766 src_ire = dst_ire = NULL; 4767 protocol = *mp->b_wptr & 0xFF; 4768 4769 /* 4770 * If we never got a disconnect before, clear it now. 4771 */ 4772 connp->conn_fully_bound = B_FALSE; 4773 4774 if (ipsec_policy_set) { 4775 policy_mp = mp->b_cont; 4776 } 4777 4778 zoneid = IPCL_ZONEID(connp); 4779 4780 if (CLASSD(dst_addr)) { 4781 /* Pick up an IRE_BROADCAST */ 4782 dst_ire = ire_route_lookup(ip_g_all_ones, 0, 0, 0, NULL, 4783 NULL, zoneid, MBLK_GETLABEL(mp), 4784 (MATCH_IRE_RECURSIVE | 4785 MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE | 4786 MATCH_IRE_SECATTR), ipst); 4787 } else { 4788 /* 4789 * If conn_dontroute is set or if conn_nexthop_set is set, 4790 * and onlink ipif is not found set ENETUNREACH error. 4791 */ 4792 if (connp->conn_dontroute || connp->conn_nexthop_set) { 4793 ipif_t *ipif; 4794 4795 ipif = ipif_lookup_onlink_addr(connp->conn_dontroute ? 4796 dst_addr : connp->conn_nexthop_v4, zoneid, ipst); 4797 if (ipif == NULL) { 4798 error = ENETUNREACH; 4799 goto bad_addr; 4800 } 4801 ipif_refrele(ipif); 4802 } 4803 4804 if (connp->conn_nexthop_set) { 4805 dst_ire = ire_route_lookup(connp->conn_nexthop_v4, 0, 4806 0, 0, NULL, NULL, zoneid, MBLK_GETLABEL(mp), 4807 MATCH_IRE_SECATTR, ipst); 4808 } else { 4809 dst_ire = ire_route_lookup(dst_addr, 0, 0, 0, NULL, 4810 &sire, zoneid, MBLK_GETLABEL(mp), 4811 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 4812 MATCH_IRE_PARENT | MATCH_IRE_RJ_BHOLE | 4813 MATCH_IRE_SECATTR), ipst); 4814 } 4815 } 4816 /* 4817 * dst_ire can't be a broadcast when not ire_requested. 4818 * We also prevent ire's with src address INADDR_ANY to 4819 * be used, which are created temporarily for 4820 * sending out packets from endpoints that have 4821 * conn_unspec_src set. If verify_dst is true, the destination must be 4822 * reachable. If verify_dst is false, the destination needn't be 4823 * reachable. 4824 * 4825 * If we match on a reject or black hole, then we've got a 4826 * local failure. May as well fail out the connect() attempt, 4827 * since it's never going to succeed. 4828 */ 4829 if (dst_ire == NULL || dst_ire->ire_src_addr == INADDR_ANY || 4830 (dst_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || 4831 ((dst_ire->ire_type & IRE_BROADCAST) && !ire_requested)) { 4832 /* 4833 * If we're verifying destination reachability, we always want 4834 * to complain here. 4835 * 4836 * If we're not verifying destination reachability but the 4837 * destination has a route, we still want to fail on the 4838 * temporary address and broadcast address tests. 4839 */ 4840 if (verify_dst || (dst_ire != NULL)) { 4841 if (ip_debug > 2) { 4842 pr_addr_dbg("ip_bind_connected: bad connected " 4843 "dst %s\n", AF_INET, &dst_addr); 4844 } 4845 if (dst_ire == NULL || !(dst_ire->ire_type & IRE_HOST)) 4846 error = ENETUNREACH; 4847 else 4848 error = EHOSTUNREACH; 4849 goto bad_addr; 4850 } 4851 } 4852 4853 /* 4854 * We now know that routing will allow us to reach the destination. 4855 * Check whether Trusted Solaris policy allows communication with this 4856 * host, and pretend that the destination is unreachable if not. 4857 * 4858 * This is never a problem for TCP, since that transport is known to 4859 * compute the label properly as part of the tcp_rput_other T_BIND_ACK 4860 * handling. If the remote is unreachable, it will be detected at that 4861 * point, so there's no reason to check it here. 4862 * 4863 * Note that for sendto (and other datagram-oriented friends), this 4864 * check is done as part of the data path label computation instead. 4865 * The check here is just to make non-TCP connect() report the right 4866 * error. 4867 */ 4868 if (dst_ire != NULL && is_system_labeled() && 4869 !IPCL_IS_TCP(connp) && 4870 tsol_compute_label(DB_CREDDEF(mp, connp->conn_cred), dst_addr, NULL, 4871 connp->conn_mac_exempt, ipst) != 0) { 4872 error = EHOSTUNREACH; 4873 if (ip_debug > 2) { 4874 pr_addr_dbg("ip_bind_connected: no label for dst %s\n", 4875 AF_INET, &dst_addr); 4876 } 4877 goto bad_addr; 4878 } 4879 4880 /* 4881 * If the app does a connect(), it means that it will most likely 4882 * send more than 1 packet to the destination. It makes sense 4883 * to clear the temporary flag. 4884 */ 4885 if (dst_ire != NULL && dst_ire->ire_type == IRE_CACHE && 4886 (dst_ire->ire_marks & IRE_MARK_TEMPORARY)) { 4887 irb_t *irb = dst_ire->ire_bucket; 4888 4889 rw_enter(&irb->irb_lock, RW_WRITER); 4890 dst_ire->ire_marks &= ~IRE_MARK_TEMPORARY; 4891 irb->irb_tmp_ire_cnt--; 4892 rw_exit(&irb->irb_lock); 4893 } 4894 4895 /* 4896 * See if we should notify ULP about LSO/MDT; we do this whether or not 4897 * ire_requested is TRUE, in order to handle active connects; LSO/MDT 4898 * eligibility tests for passive connects are handled separately 4899 * through tcp_adapt_ire(). We do this before the source address 4900 * selection, because dst_ire may change after a call to 4901 * ipif_select_source(). This is a best-effort check, as the 4902 * packet for this connection may not actually go through 4903 * dst_ire->ire_stq, and the exact IRE can only be known after 4904 * calling ip_newroute(). This is why we further check on the 4905 * IRE during LSO/Multidata packet transmission in 4906 * tcp_lsosend()/tcp_multisend(). 4907 */ 4908 if (!ipsec_policy_set && dst_ire != NULL && 4909 !(dst_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST)) && 4910 (ill = ire_to_ill(dst_ire), ill != NULL)) { 4911 if (ipst->ips_ip_lso_outbound && ILL_LSO_CAPABLE(ill)) { 4912 lso_dst_ire = dst_ire; 4913 IRE_REFHOLD(lso_dst_ire); 4914 } else if (ipst->ips_ip_multidata_outbound && 4915 ILL_MDT_CAPABLE(ill)) { 4916 md_dst_ire = dst_ire; 4917 IRE_REFHOLD(md_dst_ire); 4918 } 4919 } 4920 4921 if (dst_ire != NULL && 4922 dst_ire->ire_type == IRE_LOCAL && 4923 dst_ire->ire_zoneid != zoneid && dst_ire->ire_zoneid != ALL_ZONES) { 4924 /* 4925 * If the IRE belongs to a different zone, look for a matching 4926 * route in the forwarding table and use the source address from 4927 * that route. 4928 */ 4929 src_ire = ire_ftable_lookup(dst_addr, 0, 0, 0, NULL, NULL, 4930 zoneid, 0, NULL, 4931 MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 4932 MATCH_IRE_RJ_BHOLE, ipst); 4933 if (src_ire == NULL) { 4934 error = EHOSTUNREACH; 4935 goto bad_addr; 4936 } else if (src_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 4937 if (!(src_ire->ire_type & IRE_HOST)) 4938 error = ENETUNREACH; 4939 else 4940 error = EHOSTUNREACH; 4941 goto bad_addr; 4942 } 4943 if (src_addr == INADDR_ANY) 4944 src_addr = src_ire->ire_src_addr; 4945 ire_refrele(src_ire); 4946 src_ire = NULL; 4947 } else if ((src_addr == INADDR_ANY) && (dst_ire != NULL)) { 4948 if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) { 4949 src_addr = sire->ire_src_addr; 4950 ire_refrele(dst_ire); 4951 dst_ire = sire; 4952 sire = NULL; 4953 } else { 4954 /* 4955 * Pick a source address so that a proper inbound 4956 * load spreading would happen. 4957 */ 4958 ill_t *dst_ill = dst_ire->ire_ipif->ipif_ill; 4959 ipif_t *src_ipif = NULL; 4960 ire_t *ipif_ire; 4961 4962 /* 4963 * Supply a local source address such that inbound 4964 * load spreading happens. 4965 * 4966 * Determine the best source address on this ill for 4967 * the destination. 4968 * 4969 * 1) For broadcast, we should return a broadcast ire 4970 * found above so that upper layers know that the 4971 * destination address is a broadcast address. 4972 * 4973 * 2) If this is part of a group, select a better 4974 * source address so that better inbound load 4975 * balancing happens. Do the same if the ipif 4976 * is DEPRECATED. 4977 * 4978 * 3) If the outgoing interface is part of a usesrc 4979 * group, then try selecting a source address from 4980 * the usesrc ILL. 4981 */ 4982 if ((dst_ire->ire_zoneid != zoneid && 4983 dst_ire->ire_zoneid != ALL_ZONES) || 4984 (!(dst_ire->ire_type & IRE_BROADCAST) && 4985 ((dst_ill->ill_group != NULL) || 4986 (dst_ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) || 4987 (dst_ill->ill_usesrc_ifindex != 0)))) { 4988 /* 4989 * If the destination is reachable via a 4990 * given gateway, the selected source address 4991 * should be in the same subnet as the gateway. 4992 * Otherwise, the destination is not reachable. 4993 * 4994 * If there are no interfaces on the same subnet 4995 * as the destination, ipif_select_source gives 4996 * first non-deprecated interface which might be 4997 * on a different subnet than the gateway. 4998 * This is not desirable. Hence pass the dst_ire 4999 * source address to ipif_select_source. 5000 * It is sure that the destination is reachable 5001 * with the dst_ire source address subnet. 5002 * So passing dst_ire source address to 5003 * ipif_select_source will make sure that the 5004 * selected source will be on the same subnet 5005 * as dst_ire source address. 5006 */ 5007 ipaddr_t saddr = 5008 dst_ire->ire_ipif->ipif_src_addr; 5009 src_ipif = ipif_select_source(dst_ill, 5010 saddr, zoneid); 5011 if (src_ipif != NULL) { 5012 if (IS_VNI(src_ipif->ipif_ill)) { 5013 /* 5014 * For VNI there is no 5015 * interface route 5016 */ 5017 src_addr = 5018 src_ipif->ipif_src_addr; 5019 } else { 5020 ipif_ire = 5021 ipif_to_ire(src_ipif); 5022 if (ipif_ire != NULL) { 5023 IRE_REFRELE(dst_ire); 5024 dst_ire = ipif_ire; 5025 } 5026 src_addr = 5027 dst_ire->ire_src_addr; 5028 } 5029 ipif_refrele(src_ipif); 5030 } else { 5031 src_addr = dst_ire->ire_src_addr; 5032 } 5033 } else { 5034 src_addr = dst_ire->ire_src_addr; 5035 } 5036 } 5037 } 5038 5039 /* 5040 * We do ire_route_lookup() here (and not 5041 * interface lookup as we assert that 5042 * src_addr should only come from an 5043 * UP interface for hard binding. 5044 */ 5045 ASSERT(src_ire == NULL); 5046 src_ire = ire_route_lookup(src_addr, 0, 0, 0, NULL, 5047 NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, ipst); 5048 /* src_ire must be a local|loopback */ 5049 if (!IRE_IS_LOCAL(src_ire)) { 5050 if (ip_debug > 2) { 5051 pr_addr_dbg("ip_bind_connected: bad connected " 5052 "src %s\n", AF_INET, &src_addr); 5053 } 5054 error = EADDRNOTAVAIL; 5055 goto bad_addr; 5056 } 5057 5058 /* 5059 * If the source address is a loopback address, the 5060 * destination had best be local or multicast. 5061 * The transports that can't handle multicast will reject 5062 * those addresses. 5063 */ 5064 if (src_ire->ire_type == IRE_LOOPBACK && 5065 !(IRE_IS_LOCAL(dst_ire) || CLASSD(dst_addr))) { 5066 ip1dbg(("ip_bind_connected: bad connected loopback\n")); 5067 error = -1; 5068 goto bad_addr; 5069 } 5070 5071 /* 5072 * Allow setting new policies. For example, disconnects come 5073 * down as ipa_t bind. As we would have set conn_policy_cached 5074 * to B_TRUE before, we should set it to B_FALSE, so that policy 5075 * can change after the disconnect. 5076 */ 5077 connp->conn_policy_cached = B_FALSE; 5078 5079 /* 5080 * Set the conn addresses/ports immediately, so the IPsec policy calls 5081 * can handle their passed-in conn's. 5082 */ 5083 5084 IN6_IPADDR_TO_V4MAPPED(src_addr, &connp->conn_srcv6); 5085 IN6_IPADDR_TO_V4MAPPED(dst_addr, &connp->conn_remv6); 5086 connp->conn_lport = lport; 5087 connp->conn_fport = fport; 5088 *src_addrp = src_addr; 5089 5090 ASSERT(!(ipsec_policy_set && ire_requested)); 5091 if (ire_requested) { 5092 iulp_t *ulp_info = NULL; 5093 5094 /* 5095 * Note that sire will not be NULL if this is an off-link 5096 * connection and there is not cache for that dest yet. 5097 * 5098 * XXX Because of an existing bug, if there are multiple 5099 * default routes, the IRE returned now may not be the actual 5100 * default route used (default routes are chosen in a 5101 * round robin fashion). So if the metrics for different 5102 * default routes are different, we may return the wrong 5103 * metrics. This will not be a problem if the existing 5104 * bug is fixed. 5105 */ 5106 if (sire != NULL) { 5107 ulp_info = &(sire->ire_uinfo); 5108 } 5109 if (!ip_bind_insert_ire(mp, dst_ire, ulp_info, ipst)) { 5110 error = -1; 5111 goto bad_addr; 5112 } 5113 } else if (ipsec_policy_set) { 5114 if (!ip_bind_ipsec_policy_set(connp, policy_mp)) { 5115 error = -1; 5116 goto bad_addr; 5117 } 5118 } 5119 5120 /* 5121 * Cache IPsec policy in this conn. If we have per-socket policy, 5122 * we'll cache that. If we don't, we'll inherit global policy. 5123 * 5124 * We can't insert until the conn reflects the policy. Note that 5125 * conn_policy_cached is set by ipsec_conn_cache_policy() even for 5126 * connections where we don't have a policy. This is to prevent 5127 * global policy lookups in the inbound path. 5128 * 5129 * If we insert before we set conn_policy_cached, 5130 * CONN_INBOUND_POLICY_PRESENT() check can still evaluate true 5131 * because global policy cound be non-empty. We normally call 5132 * ipsec_check_policy() for conn_policy_cached connections only if 5133 * ipc_in_enforce_policy is set. But in this case, 5134 * conn_policy_cached can get set anytime since we made the 5135 * CONN_INBOUND_POLICY_PRESENT() check and ipsec_check_policy() is 5136 * called, which will make the above assumption false. Thus, we 5137 * need to insert after we set conn_policy_cached. 5138 */ 5139 if ((error = ipsec_conn_cache_policy(connp, B_TRUE)) != 0) 5140 goto bad_addr; 5141 5142 if (fanout_insert) { 5143 /* 5144 * The addresses have been verified. Time to insert in 5145 * the correct fanout list. 5146 * We need to make sure that the conn_recv is set to a non-null 5147 * value before we insert into the classifier table to avoid a 5148 * race with an incoming packet which does an ipcl_classify(). 5149 */ 5150 if (protocol == IPPROTO_TCP) 5151 connp->conn_recv = tcp_input; 5152 error = ipcl_conn_insert(connp, protocol, src_addr, 5153 dst_addr, connp->conn_ports); 5154 } 5155 5156 if (error == 0) { 5157 connp->conn_fully_bound = B_TRUE; 5158 /* 5159 * Our initial checks for LSO/MDT have passed; the IRE is not 5160 * LOCAL/LOOPBACK/BROADCAST, and the link layer seems to 5161 * be supporting LSO/MDT. Pass the IRE, IPC and ILL into 5162 * ip_xxinfo_return(), which performs further checks 5163 * against them and upon success, returns the LSO/MDT info 5164 * mblk which we will attach to the bind acknowledgment. 5165 */ 5166 if (lso_dst_ire != NULL) { 5167 mblk_t *lsoinfo_mp; 5168 5169 ASSERT(ill->ill_lso_capab != NULL); 5170 if ((lsoinfo_mp = ip_lsoinfo_return(lso_dst_ire, connp, 5171 ill->ill_name, ill->ill_lso_capab)) != NULL) 5172 linkb(mp, lsoinfo_mp); 5173 } else if (md_dst_ire != NULL) { 5174 mblk_t *mdinfo_mp; 5175 5176 ASSERT(ill->ill_mdt_capab != NULL); 5177 if ((mdinfo_mp = ip_mdinfo_return(md_dst_ire, connp, 5178 ill->ill_name, ill->ill_mdt_capab)) != NULL) 5179 linkb(mp, mdinfo_mp); 5180 } 5181 } 5182 bad_addr: 5183 if (ipsec_policy_set) { 5184 ASSERT(policy_mp == mp->b_cont); 5185 ASSERT(policy_mp != NULL); 5186 freeb(policy_mp); 5187 /* 5188 * As of now assume that nothing else accompanies 5189 * IPSEC_POLICY_SET. 5190 */ 5191 mp->b_cont = NULL; 5192 } 5193 if (src_ire != NULL) 5194 IRE_REFRELE(src_ire); 5195 if (dst_ire != NULL) 5196 IRE_REFRELE(dst_ire); 5197 if (sire != NULL) 5198 IRE_REFRELE(sire); 5199 if (md_dst_ire != NULL) 5200 IRE_REFRELE(md_dst_ire); 5201 if (lso_dst_ire != NULL) 5202 IRE_REFRELE(lso_dst_ire); 5203 return (error); 5204 } 5205 5206 /* 5207 * Insert the ire in b_cont. Returns false if it fails (due to lack of space). 5208 * Prefers dst_ire over src_ire. 5209 */ 5210 static boolean_t 5211 ip_bind_insert_ire(mblk_t *mp, ire_t *ire, iulp_t *ulp_info, ip_stack_t *ipst) 5212 { 5213 mblk_t *mp1; 5214 ire_t *ret_ire = NULL; 5215 5216 mp1 = mp->b_cont; 5217 ASSERT(mp1 != NULL); 5218 5219 if (ire != NULL) { 5220 /* 5221 * mp1 initialized above to IRE_DB_REQ_TYPE 5222 * appended mblk. Its <upper protocol>'s 5223 * job to make sure there is room. 5224 */ 5225 if ((mp1->b_datap->db_lim - mp1->b_rptr) < sizeof (ire_t)) 5226 return (0); 5227 5228 mp1->b_datap->db_type = IRE_DB_TYPE; 5229 mp1->b_wptr = mp1->b_rptr + sizeof (ire_t); 5230 bcopy(ire, mp1->b_rptr, sizeof (ire_t)); 5231 ret_ire = (ire_t *)mp1->b_rptr; 5232 /* 5233 * Pass the latest setting of the ip_path_mtu_discovery and 5234 * copy the ulp info if any. 5235 */ 5236 ret_ire->ire_frag_flag |= (ipst->ips_ip_path_mtu_discovery) ? 5237 IPH_DF : 0; 5238 if (ulp_info != NULL) { 5239 bcopy(ulp_info, &(ret_ire->ire_uinfo), 5240 sizeof (iulp_t)); 5241 } 5242 ret_ire->ire_mp = mp1; 5243 } else { 5244 /* 5245 * No IRE was found. Remove IRE mblk. 5246 */ 5247 mp->b_cont = mp1->b_cont; 5248 freeb(mp1); 5249 } 5250 5251 return (1); 5252 } 5253 5254 /* 5255 * Carve "len" bytes out of an mblk chain, consuming any we empty, and duping 5256 * the final piece where we don't. Return a pointer to the first mblk in the 5257 * result, and update the pointer to the next mblk to chew on. If anything 5258 * goes wrong (i.e., dupb fails), we waste everything in sight and return a 5259 * NULL pointer. 5260 */ 5261 mblk_t * 5262 ip_carve_mp(mblk_t **mpp, ssize_t len) 5263 { 5264 mblk_t *mp0; 5265 mblk_t *mp1; 5266 mblk_t *mp2; 5267 5268 if (!len || !mpp || !(mp0 = *mpp)) 5269 return (NULL); 5270 /* If we aren't going to consume the first mblk, we need a dup. */ 5271 if (mp0->b_wptr - mp0->b_rptr > len) { 5272 mp1 = dupb(mp0); 5273 if (mp1) { 5274 /* Partition the data between the two mblks. */ 5275 mp1->b_wptr = mp1->b_rptr + len; 5276 mp0->b_rptr = mp1->b_wptr; 5277 /* 5278 * after adjustments if mblk not consumed is now 5279 * unaligned, try to align it. If this fails free 5280 * all messages and let upper layer recover. 5281 */ 5282 if (!OK_32PTR(mp0->b_rptr)) { 5283 if (!pullupmsg(mp0, -1)) { 5284 freemsg(mp0); 5285 freemsg(mp1); 5286 *mpp = NULL; 5287 return (NULL); 5288 } 5289 } 5290 } 5291 return (mp1); 5292 } 5293 /* Eat through as many mblks as we need to get len bytes. */ 5294 len -= mp0->b_wptr - mp0->b_rptr; 5295 for (mp2 = mp1 = mp0; (mp2 = mp2->b_cont) != 0 && len; mp1 = mp2) { 5296 if (mp2->b_wptr - mp2->b_rptr > len) { 5297 /* 5298 * We won't consume the entire last mblk. Like 5299 * above, dup and partition it. 5300 */ 5301 mp1->b_cont = dupb(mp2); 5302 mp1 = mp1->b_cont; 5303 if (!mp1) { 5304 /* 5305 * Trouble. Rather than go to a lot of 5306 * trouble to clean up, we free the messages. 5307 * This won't be any worse than losing it on 5308 * the wire. 5309 */ 5310 freemsg(mp0); 5311 freemsg(mp2); 5312 *mpp = NULL; 5313 return (NULL); 5314 } 5315 mp1->b_wptr = mp1->b_rptr + len; 5316 mp2->b_rptr = mp1->b_wptr; 5317 /* 5318 * after adjustments if mblk not consumed is now 5319 * unaligned, try to align it. If this fails free 5320 * all messages and let upper layer recover. 5321 */ 5322 if (!OK_32PTR(mp2->b_rptr)) { 5323 if (!pullupmsg(mp2, -1)) { 5324 freemsg(mp0); 5325 freemsg(mp2); 5326 *mpp = NULL; 5327 return (NULL); 5328 } 5329 } 5330 *mpp = mp2; 5331 return (mp0); 5332 } 5333 /* Decrement len by the amount we just got. */ 5334 len -= mp2->b_wptr - mp2->b_rptr; 5335 } 5336 /* 5337 * len should be reduced to zero now. If not our caller has 5338 * screwed up. 5339 */ 5340 if (len) { 5341 /* Shouldn't happen! */ 5342 freemsg(mp0); 5343 *mpp = NULL; 5344 return (NULL); 5345 } 5346 /* 5347 * We consumed up to exactly the end of an mblk. Detach the part 5348 * we are returning from the rest of the chain. 5349 */ 5350 mp1->b_cont = NULL; 5351 *mpp = mp2; 5352 return (mp0); 5353 } 5354 5355 /* The ill stream is being unplumbed. Called from ip_close */ 5356 int 5357 ip_modclose(ill_t *ill) 5358 { 5359 5360 boolean_t success; 5361 ipsq_t *ipsq; 5362 ipif_t *ipif; 5363 queue_t *q = ill->ill_rq; 5364 hook_nic_event_t *info; 5365 ip_stack_t *ipst = ill->ill_ipst; 5366 clock_t timeout; 5367 5368 /* 5369 * Wait for the ACKs of all deferred control messages to be processed. 5370 * In particular, we wait for a potential capability reset initiated 5371 * in ip_sioctl_plink() to complete before proceeding. 5372 * 5373 * Note: we wait for at most ip_modclose_ackwait_ms (by default 3000 ms) 5374 * in case the driver never replies. 5375 */ 5376 timeout = lbolt + MSEC_TO_TICK(ip_modclose_ackwait_ms); 5377 mutex_enter(&ill->ill_lock); 5378 while (ill->ill_dlpi_pending != DL_PRIM_INVAL) { 5379 if (cv_timedwait(&ill->ill_cv, &ill->ill_lock, timeout) < 0) { 5380 /* Timeout */ 5381 break; 5382 } 5383 } 5384 mutex_exit(&ill->ill_lock); 5385 5386 /* 5387 * Forcibly enter the ipsq after some delay. This is to take 5388 * care of the case when some ioctl does not complete because 5389 * we sent a control message to the driver and it did not 5390 * send us a reply. We want to be able to at least unplumb 5391 * and replumb rather than force the user to reboot the system. 5392 */ 5393 success = ipsq_enter(ill, B_FALSE); 5394 5395 /* 5396 * Open/close/push/pop is guaranteed to be single threaded 5397 * per stream by STREAMS. FS guarantees that all references 5398 * from top are gone before close is called. So there can't 5399 * be another close thread that has set CONDEMNED on this ill. 5400 * and cause ipsq_enter to return failure. 5401 */ 5402 ASSERT(success); 5403 ipsq = ill->ill_phyint->phyint_ipsq; 5404 5405 /* 5406 * Mark it condemned. No new reference will be made to this ill. 5407 * Lookup functions will return an error. Threads that try to 5408 * increment the refcnt must check for ILL_CAN_LOOKUP. This ensures 5409 * that the refcnt will drop down to zero. 5410 */ 5411 mutex_enter(&ill->ill_lock); 5412 ill->ill_state_flags |= ILL_CONDEMNED; 5413 for (ipif = ill->ill_ipif; ipif != NULL; 5414 ipif = ipif->ipif_next) { 5415 ipif->ipif_state_flags |= IPIF_CONDEMNED; 5416 } 5417 /* 5418 * Wake up anybody waiting to enter the ipsq. ipsq_enter 5419 * returns error if ILL_CONDEMNED is set 5420 */ 5421 cv_broadcast(&ill->ill_cv); 5422 mutex_exit(&ill->ill_lock); 5423 5424 /* 5425 * Send all the deferred control messages downstream which came in 5426 * during the small window right before ipsq_enter(). We do this 5427 * without waiting for the ACKs because all the ACKs for M_PROTO 5428 * messages are ignored in ip_rput() when ILL_CONDEMNED is set. 5429 */ 5430 ill_send_all_deferred_mp(ill); 5431 5432 /* 5433 * Shut down fragmentation reassembly. 5434 * ill_frag_timer won't start a timer again. 5435 * Now cancel any existing timer 5436 */ 5437 (void) untimeout(ill->ill_frag_timer_id); 5438 (void) ill_frag_timeout(ill, 0); 5439 5440 /* 5441 * If MOVE was in progress, clear the 5442 * move_in_progress fields also. 5443 */ 5444 if (ill->ill_move_in_progress) { 5445 ILL_CLEAR_MOVE(ill); 5446 } 5447 5448 /* 5449 * Call ill_delete to bring down the ipifs, ilms and ill on 5450 * this ill. Then wait for the refcnts to drop to zero. 5451 * ill_is_quiescent checks whether the ill is really quiescent. 5452 * Then make sure that threads that are waiting to enter the 5453 * ipsq have seen the error returned by ipsq_enter and have 5454 * gone away. Then we call ill_delete_tail which does the 5455 * DL_UNBIND and DL_DETACH with the driver and then qprocsoff. 5456 */ 5457 ill_delete(ill); 5458 mutex_enter(&ill->ill_lock); 5459 while (!ill_is_quiescent(ill)) 5460 cv_wait(&ill->ill_cv, &ill->ill_lock); 5461 while (ill->ill_waiters) 5462 cv_wait(&ill->ill_cv, &ill->ill_lock); 5463 5464 mutex_exit(&ill->ill_lock); 5465 5466 /* 5467 * ill_delete_tail drops reference on ill_ipst, but we need to keep 5468 * it held until the end of the function since the cleanup 5469 * below needs to be able to use the ip_stack_t. 5470 */ 5471 netstack_hold(ipst->ips_netstack); 5472 5473 /* qprocsoff is called in ill_delete_tail */ 5474 ill_delete_tail(ill); 5475 ASSERT(ill->ill_ipst == NULL); 5476 5477 /* 5478 * Walk through all upper (conn) streams and qenable 5479 * those that have queued data. 5480 * close synchronization needs this to 5481 * be done to ensure that all upper layers blocked 5482 * due to flow control to the closing device 5483 * get unblocked. 5484 */ 5485 ip1dbg(("ip_wsrv: walking\n")); 5486 conn_walk_drain(ipst); 5487 5488 mutex_enter(&ipst->ips_ip_mi_lock); 5489 mi_close_unlink(&ipst->ips_ip_g_head, (IDP)ill); 5490 mutex_exit(&ipst->ips_ip_mi_lock); 5491 5492 /* 5493 * credp could be null if the open didn't succeed and ip_modopen 5494 * itself calls ip_close. 5495 */ 5496 if (ill->ill_credp != NULL) 5497 crfree(ill->ill_credp); 5498 5499 /* 5500 * Unhook the nic event message from the ill and enqueue it into the nic 5501 * event taskq. 5502 */ 5503 if ((info = ill->ill_nic_event_info) != NULL) { 5504 if (ddi_taskq_dispatch(eventq_queue_nic, 5505 ip_ne_queue_func, 5506 (void *)info, DDI_SLEEP) == DDI_FAILURE) { 5507 ip2dbg(("ip_ioctl_finish:ddi_taskq_dispatch failed\n")); 5508 if (info->hne_data != NULL) 5509 kmem_free(info->hne_data, info->hne_datalen); 5510 kmem_free(info, sizeof (hook_nic_event_t)); 5511 } 5512 ill->ill_nic_event_info = NULL; 5513 } 5514 5515 /* 5516 * Now we are done with the module close pieces that 5517 * need the netstack_t. 5518 */ 5519 netstack_rele(ipst->ips_netstack); 5520 5521 mi_close_free((IDP)ill); 5522 q->q_ptr = WR(q)->q_ptr = NULL; 5523 5524 ipsq_exit(ipsq, B_TRUE, B_TRUE); 5525 5526 return (0); 5527 } 5528 5529 /* 5530 * This is called as part of close() for both IP and UDP 5531 * in order to quiesce the conn. 5532 */ 5533 void 5534 ip_quiesce_conn(conn_t *connp) 5535 { 5536 boolean_t drain_cleanup_reqd = B_FALSE; 5537 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 5538 boolean_t ilg_cleanup_reqd = B_FALSE; 5539 ip_stack_t *ipst; 5540 5541 ASSERT(!IPCL_IS_TCP(connp)); 5542 ipst = connp->conn_netstack->netstack_ip; 5543 5544 /* 5545 * Mark the conn as closing, and this conn must not be 5546 * inserted in future into any list. Eg. conn_drain_insert(), 5547 * won't insert this conn into the conn_drain_list. 5548 * Similarly ill_pending_mp_add() will not add any mp to 5549 * the pending mp list, after this conn has started closing. 5550 * 5551 * conn_idl, conn_pending_ill, conn_down_pending_ill, conn_ilg 5552 * cannot get set henceforth. 5553 */ 5554 mutex_enter(&connp->conn_lock); 5555 ASSERT(!(connp->conn_state_flags & CONN_QUIESCED)); 5556 connp->conn_state_flags |= CONN_CLOSING; 5557 if (connp->conn_idl != NULL) 5558 drain_cleanup_reqd = B_TRUE; 5559 if (connp->conn_oper_pending_ill != NULL) 5560 conn_ioctl_cleanup_reqd = B_TRUE; 5561 if (connp->conn_ilg_inuse != 0) 5562 ilg_cleanup_reqd = B_TRUE; 5563 mutex_exit(&connp->conn_lock); 5564 5565 if (IPCL_IS_UDP(connp)) 5566 udp_quiesce_conn(connp); 5567 5568 if (conn_ioctl_cleanup_reqd) 5569 conn_ioctl_cleanup(connp); 5570 5571 if (is_system_labeled() && connp->conn_anon_port) { 5572 (void) tsol_mlp_anon(crgetzone(connp->conn_cred), 5573 connp->conn_mlp_type, connp->conn_ulp, 5574 ntohs(connp->conn_lport), B_FALSE); 5575 connp->conn_anon_port = 0; 5576 } 5577 connp->conn_mlp_type = mlptSingle; 5578 5579 /* 5580 * Remove this conn from any fanout list it is on. 5581 * and then wait for any threads currently operating 5582 * on this endpoint to finish 5583 */ 5584 ipcl_hash_remove(connp); 5585 5586 /* 5587 * Remove this conn from the drain list, and do 5588 * any other cleanup that may be required. 5589 * (Only non-tcp streams may have a non-null conn_idl. 5590 * TCP streams are never flow controlled, and 5591 * conn_idl will be null) 5592 */ 5593 if (drain_cleanup_reqd) 5594 conn_drain_tail(connp, B_TRUE); 5595 5596 if (connp->conn_rq == ipst->ips_ip_g_mrouter || 5597 connp->conn_wq == ipst->ips_ip_g_mrouter) 5598 (void) ip_mrouter_done(NULL, ipst); 5599 5600 if (ilg_cleanup_reqd) 5601 ilg_delete_all(connp); 5602 5603 conn_delete_ire(connp, NULL); 5604 5605 /* 5606 * Now conn refcnt can increase only thru CONN_INC_REF_LOCKED. 5607 * callers from write side can't be there now because close 5608 * is in progress. The only other caller is ipcl_walk 5609 * which checks for the condemned flag. 5610 */ 5611 mutex_enter(&connp->conn_lock); 5612 connp->conn_state_flags |= CONN_CONDEMNED; 5613 while (connp->conn_ref != 1) 5614 cv_wait(&connp->conn_cv, &connp->conn_lock); 5615 connp->conn_state_flags |= CONN_QUIESCED; 5616 mutex_exit(&connp->conn_lock); 5617 } 5618 5619 /* ARGSUSED */ 5620 int 5621 ip_close(queue_t *q, int flags) 5622 { 5623 conn_t *connp; 5624 5625 TRACE_1(TR_FAC_IP, TR_IP_CLOSE, "ip_close: q %p", q); 5626 5627 /* 5628 * Call the appropriate delete routine depending on whether this is 5629 * a module or device. 5630 */ 5631 if (WR(q)->q_next != NULL) { 5632 /* This is a module close */ 5633 return (ip_modclose((ill_t *)q->q_ptr)); 5634 } 5635 5636 connp = q->q_ptr; 5637 ip_quiesce_conn(connp); 5638 5639 qprocsoff(q); 5640 5641 /* 5642 * Now we are truly single threaded on this stream, and can 5643 * delete the things hanging off the connp, and finally the connp. 5644 * We removed this connp from the fanout list, it cannot be 5645 * accessed thru the fanouts, and we already waited for the 5646 * conn_ref to drop to 0. We are already in close, so 5647 * there cannot be any other thread from the top. qprocsoff 5648 * has completed, and service has completed or won't run in 5649 * future. 5650 */ 5651 ASSERT(connp->conn_ref == 1); 5652 5653 /* 5654 * A conn which was previously marked as IPCL_UDP cannot 5655 * retain the flag because it would have been cleared by 5656 * udp_close(). 5657 */ 5658 ASSERT(!IPCL_IS_UDP(connp)); 5659 5660 if (connp->conn_latch != NULL) { 5661 IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack); 5662 connp->conn_latch = NULL; 5663 } 5664 if (connp->conn_policy != NULL) { 5665 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 5666 connp->conn_policy = NULL; 5667 } 5668 if (connp->conn_ipsec_opt_mp != NULL) { 5669 freemsg(connp->conn_ipsec_opt_mp); 5670 connp->conn_ipsec_opt_mp = NULL; 5671 } 5672 5673 inet_minor_free(ip_minor_arena, connp->conn_dev); 5674 5675 connp->conn_ref--; 5676 ipcl_conn_destroy(connp); 5677 5678 q->q_ptr = WR(q)->q_ptr = NULL; 5679 return (0); 5680 } 5681 5682 int 5683 ip_snmpmod_close(queue_t *q) 5684 { 5685 conn_t *connp = Q_TO_CONN(q); 5686 ASSERT(connp->conn_flags & (IPCL_TCPMOD | IPCL_UDPMOD)); 5687 5688 qprocsoff(q); 5689 5690 if (connp->conn_flags & IPCL_UDPMOD) 5691 udp_close_free(connp); 5692 5693 if (connp->conn_cred != NULL) { 5694 crfree(connp->conn_cred); 5695 connp->conn_cred = NULL; 5696 } 5697 CONN_DEC_REF(connp); 5698 q->q_ptr = WR(q)->q_ptr = NULL; 5699 return (0); 5700 } 5701 5702 /* 5703 * Write side put procedure for TCP module or UDP module instance. TCP/UDP 5704 * as a module is only used for MIB browsers that push TCP/UDP over IP or ARP. 5705 * The only supported primitives are T_SVR4_OPTMGMT_REQ and T_OPTMGMT_REQ. 5706 * M_FLUSH messages and ioctls are only passed downstream; we don't flush our 5707 * queues as we never enqueue messages there and we don't handle any ioctls. 5708 * Everything else is freed. 5709 */ 5710 void 5711 ip_snmpmod_wput(queue_t *q, mblk_t *mp) 5712 { 5713 conn_t *connp = q->q_ptr; 5714 pfi_t setfn; 5715 pfi_t getfn; 5716 5717 ASSERT(connp->conn_flags & (IPCL_TCPMOD | IPCL_UDPMOD)); 5718 5719 switch (DB_TYPE(mp)) { 5720 case M_PROTO: 5721 case M_PCPROTO: 5722 if ((MBLKL(mp) >= sizeof (t_scalar_t)) && 5723 ((((union T_primitives *)mp->b_rptr)->type == 5724 T_SVR4_OPTMGMT_REQ) || 5725 (((union T_primitives *)mp->b_rptr)->type == 5726 T_OPTMGMT_REQ))) { 5727 /* 5728 * This is the only TPI primitive supported. Its 5729 * handling does not require tcp_t, but it does require 5730 * conn_t to check permissions. 5731 */ 5732 cred_t *cr = DB_CREDDEF(mp, connp->conn_cred); 5733 5734 if (connp->conn_flags & IPCL_TCPMOD) { 5735 setfn = tcp_snmp_set; 5736 getfn = tcp_snmp_get; 5737 } else { 5738 setfn = udp_snmp_set; 5739 getfn = udp_snmp_get; 5740 } 5741 if (!snmpcom_req(q, mp, setfn, getfn, cr)) { 5742 freemsg(mp); 5743 return; 5744 } 5745 } else if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, ENOTSUP)) 5746 != NULL) 5747 qreply(q, mp); 5748 break; 5749 case M_FLUSH: 5750 case M_IOCTL: 5751 putnext(q, mp); 5752 break; 5753 default: 5754 freemsg(mp); 5755 break; 5756 } 5757 } 5758 5759 /* Return the IP checksum for the IP header at "iph". */ 5760 uint16_t 5761 ip_csum_hdr(ipha_t *ipha) 5762 { 5763 uint16_t *uph; 5764 uint32_t sum; 5765 int opt_len; 5766 5767 opt_len = (ipha->ipha_version_and_hdr_length & 0xF) - 5768 IP_SIMPLE_HDR_LENGTH_IN_WORDS; 5769 uph = (uint16_t *)ipha; 5770 sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + 5771 uph[5] + uph[6] + uph[7] + uph[8] + uph[9]; 5772 if (opt_len > 0) { 5773 do { 5774 sum += uph[10]; 5775 sum += uph[11]; 5776 uph += 2; 5777 } while (--opt_len); 5778 } 5779 sum = (sum & 0xFFFF) + (sum >> 16); 5780 sum = ~(sum + (sum >> 16)) & 0xFFFF; 5781 if (sum == 0xffff) 5782 sum = 0; 5783 return ((uint16_t)sum); 5784 } 5785 5786 /* 5787 * Called when the module is about to be unloaded 5788 */ 5789 void 5790 ip_ddi_destroy(void) 5791 { 5792 tnet_fini(); 5793 5794 sctp_ddi_g_destroy(); 5795 tcp_ddi_g_destroy(); 5796 ipsec_policy_g_destroy(); 5797 ipcl_g_destroy(); 5798 ip_net_g_destroy(); 5799 ip_ire_g_fini(); 5800 inet_minor_destroy(ip_minor_arena); 5801 5802 netstack_unregister(NS_IP); 5803 } 5804 5805 /* 5806 * First step in cleanup. 5807 */ 5808 /* ARGSUSED */ 5809 static void 5810 ip_stack_shutdown(netstackid_t stackid, void *arg) 5811 { 5812 ip_stack_t *ipst = (ip_stack_t *)arg; 5813 5814 #ifdef NS_DEBUG 5815 printf("ip_stack_shutdown(%p, stack %d)\n", (void *)ipst, stackid); 5816 #endif 5817 5818 /* Get rid of loopback interfaces and their IREs */ 5819 ip_loopback_cleanup(ipst); 5820 } 5821 5822 /* 5823 * Free the IP stack instance. 5824 */ 5825 static void 5826 ip_stack_fini(netstackid_t stackid, void *arg) 5827 { 5828 ip_stack_t *ipst = (ip_stack_t *)arg; 5829 int ret; 5830 5831 #ifdef NS_DEBUG 5832 printf("ip_stack_fini(%p, stack %d)\n", (void *)ipst, stackid); 5833 #endif 5834 ipv4_hook_destroy(ipst); 5835 ipv6_hook_destroy(ipst); 5836 ip_net_destroy(ipst); 5837 5838 rw_destroy(&ipst->ips_srcid_lock); 5839 5840 ip_kstat_fini(stackid, ipst->ips_ip_mibkp); 5841 ipst->ips_ip_mibkp = NULL; 5842 icmp_kstat_fini(stackid, ipst->ips_icmp_mibkp); 5843 ipst->ips_icmp_mibkp = NULL; 5844 ip_kstat2_fini(stackid, ipst->ips_ip_kstat); 5845 ipst->ips_ip_kstat = NULL; 5846 bzero(&ipst->ips_ip_statistics, sizeof (ipst->ips_ip_statistics)); 5847 ip6_kstat_fini(stackid, ipst->ips_ip6_kstat); 5848 ipst->ips_ip6_kstat = NULL; 5849 bzero(&ipst->ips_ip6_statistics, sizeof (ipst->ips_ip6_statistics)); 5850 5851 nd_free(&ipst->ips_ip_g_nd); 5852 kmem_free(ipst->ips_param_arr, sizeof (lcl_param_arr)); 5853 ipst->ips_param_arr = NULL; 5854 kmem_free(ipst->ips_ndp_arr, sizeof (lcl_ndp_arr)); 5855 ipst->ips_ndp_arr = NULL; 5856 5857 ip_mrouter_stack_destroy(ipst); 5858 5859 mutex_destroy(&ipst->ips_ip_mi_lock); 5860 rw_destroy(&ipst->ips_ipsec_capab_ills_lock); 5861 rw_destroy(&ipst->ips_ill_g_usesrc_lock); 5862 rw_destroy(&ipst->ips_ip_g_nd_lock); 5863 5864 ret = untimeout(ipst->ips_igmp_timeout_id); 5865 if (ret == -1) { 5866 ASSERT(ipst->ips_igmp_timeout_id == 0); 5867 } else { 5868 ASSERT(ipst->ips_igmp_timeout_id != 0); 5869 ipst->ips_igmp_timeout_id = 0; 5870 } 5871 ret = untimeout(ipst->ips_igmp_slowtimeout_id); 5872 if (ret == -1) { 5873 ASSERT(ipst->ips_igmp_slowtimeout_id == 0); 5874 } else { 5875 ASSERT(ipst->ips_igmp_slowtimeout_id != 0); 5876 ipst->ips_igmp_slowtimeout_id = 0; 5877 } 5878 ret = untimeout(ipst->ips_mld_timeout_id); 5879 if (ret == -1) { 5880 ASSERT(ipst->ips_mld_timeout_id == 0); 5881 } else { 5882 ASSERT(ipst->ips_mld_timeout_id != 0); 5883 ipst->ips_mld_timeout_id = 0; 5884 } 5885 ret = untimeout(ipst->ips_mld_slowtimeout_id); 5886 if (ret == -1) { 5887 ASSERT(ipst->ips_mld_slowtimeout_id == 0); 5888 } else { 5889 ASSERT(ipst->ips_mld_slowtimeout_id != 0); 5890 ipst->ips_mld_slowtimeout_id = 0; 5891 } 5892 ret = untimeout(ipst->ips_ip_ire_expire_id); 5893 if (ret == -1) { 5894 ASSERT(ipst->ips_ip_ire_expire_id == 0); 5895 } else { 5896 ASSERT(ipst->ips_ip_ire_expire_id != 0); 5897 ipst->ips_ip_ire_expire_id = 0; 5898 } 5899 5900 mutex_destroy(&ipst->ips_igmp_timer_lock); 5901 mutex_destroy(&ipst->ips_mld_timer_lock); 5902 mutex_destroy(&ipst->ips_igmp_slowtimeout_lock); 5903 mutex_destroy(&ipst->ips_mld_slowtimeout_lock); 5904 mutex_destroy(&ipst->ips_ip_addr_avail_lock); 5905 rw_destroy(&ipst->ips_ill_g_lock); 5906 5907 ip_ire_fini(ipst); 5908 ip6_asp_free(ipst); 5909 conn_drain_fini(ipst); 5910 ipcl_destroy(ipst); 5911 5912 mutex_destroy(&ipst->ips_ndp4->ndp_g_lock); 5913 mutex_destroy(&ipst->ips_ndp6->ndp_g_lock); 5914 kmem_free(ipst->ips_ndp4, sizeof (ndp_g_t)); 5915 ipst->ips_ndp4 = NULL; 5916 kmem_free(ipst->ips_ndp6, sizeof (ndp_g_t)); 5917 ipst->ips_ndp6 = NULL; 5918 5919 if (ipst->ips_loopback_ksp != NULL) { 5920 kstat_delete_netstack(ipst->ips_loopback_ksp, stackid); 5921 ipst->ips_loopback_ksp = NULL; 5922 } 5923 5924 kmem_free(ipst->ips_phyint_g_list, sizeof (phyint_list_t)); 5925 ipst->ips_phyint_g_list = NULL; 5926 kmem_free(ipst->ips_ill_g_heads, sizeof (ill_g_head_t) * MAX_G_HEADS); 5927 ipst->ips_ill_g_heads = NULL; 5928 5929 kmem_free(ipst, sizeof (*ipst)); 5930 } 5931 5932 /* 5933 * Called when the IP kernel module is loaded into the kernel 5934 */ 5935 void 5936 ip_ddi_init(void) 5937 { 5938 TCP6_MAJ = ddi_name_to_major(TCP6); 5939 TCP_MAJ = ddi_name_to_major(TCP); 5940 SCTP_MAJ = ddi_name_to_major(SCTP); 5941 SCTP6_MAJ = ddi_name_to_major(SCTP6); 5942 5943 ip_input_proc = ip_squeue_switch(ip_squeue_enter); 5944 5945 /* 5946 * For IP and TCP the minor numbers should start from 2 since we have 4 5947 * initial devices: ip, ip6, tcp, tcp6. 5948 */ 5949 if ((ip_minor_arena = inet_minor_create("ip_minor_arena", 5950 INET_MIN_DEV + 2, KM_SLEEP)) == NULL) { 5951 cmn_err(CE_PANIC, 5952 "ip_ddi_init: ip_minor_arena creation failed\n"); 5953 } 5954 5955 ip_poll_normal_ticks = MSEC_TO_TICK_ROUNDUP(ip_poll_normal_ms); 5956 5957 ipcl_g_init(); 5958 ip_ire_g_init(); 5959 ip_net_g_init(); 5960 5961 /* 5962 * We want to be informed each time a stack is created or 5963 * destroyed in the kernel, so we can maintain the 5964 * set of udp_stack_t's. 5965 */ 5966 netstack_register(NS_IP, ip_stack_init, ip_stack_shutdown, 5967 ip_stack_fini); 5968 5969 ipsec_policy_g_init(); 5970 tcp_ddi_g_init(); 5971 sctp_ddi_g_init(); 5972 5973 tnet_init(); 5974 } 5975 5976 /* 5977 * Initialize the IP stack instance. 5978 */ 5979 static void * 5980 ip_stack_init(netstackid_t stackid, netstack_t *ns) 5981 { 5982 ip_stack_t *ipst; 5983 ipparam_t *pa; 5984 ipndp_t *na; 5985 5986 #ifdef NS_DEBUG 5987 printf("ip_stack_init(stack %d)\n", stackid); 5988 #endif 5989 5990 ipst = (ip_stack_t *)kmem_zalloc(sizeof (*ipst), KM_SLEEP); 5991 ipst->ips_netstack = ns; 5992 5993 ipst->ips_ill_g_heads = kmem_zalloc(sizeof (ill_g_head_t) * MAX_G_HEADS, 5994 KM_SLEEP); 5995 ipst->ips_phyint_g_list = kmem_zalloc(sizeof (phyint_list_t), 5996 KM_SLEEP); 5997 ipst->ips_ndp4 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP); 5998 ipst->ips_ndp6 = kmem_zalloc(sizeof (ndp_g_t), KM_SLEEP); 5999 mutex_init(&ipst->ips_ndp4->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL); 6000 mutex_init(&ipst->ips_ndp6->ndp_g_lock, NULL, MUTEX_DEFAULT, NULL); 6001 6002 rw_init(&ipst->ips_ip_g_nd_lock, NULL, RW_DEFAULT, NULL); 6003 mutex_init(&ipst->ips_igmp_timer_lock, NULL, MUTEX_DEFAULT, NULL); 6004 ipst->ips_igmp_deferred_next = INFINITY; 6005 mutex_init(&ipst->ips_mld_timer_lock, NULL, MUTEX_DEFAULT, NULL); 6006 ipst->ips_mld_deferred_next = INFINITY; 6007 mutex_init(&ipst->ips_igmp_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL); 6008 mutex_init(&ipst->ips_mld_slowtimeout_lock, NULL, MUTEX_DEFAULT, NULL); 6009 mutex_init(&ipst->ips_ip_mi_lock, NULL, MUTEX_DEFAULT, NULL); 6010 mutex_init(&ipst->ips_ip_addr_avail_lock, NULL, MUTEX_DEFAULT, NULL); 6011 rw_init(&ipst->ips_ill_g_lock, NULL, RW_DEFAULT, NULL); 6012 rw_init(&ipst->ips_ipsec_capab_ills_lock, NULL, RW_DEFAULT, NULL); 6013 rw_init(&ipst->ips_ill_g_usesrc_lock, NULL, RW_DEFAULT, NULL); 6014 6015 ipcl_init(ipst); 6016 ip_ire_init(ipst); 6017 ip6_asp_init(ipst); 6018 ipif_init(ipst); 6019 conn_drain_init(ipst); 6020 ip_mrouter_stack_init(ipst); 6021 6022 ipst->ips_ip_g_frag_timeout = IP_FRAG_TIMEOUT; 6023 ipst->ips_ip_g_frag_timo_ms = IP_FRAG_TIMEOUT * 1000; 6024 6025 ipst->ips_ip_multirt_log_interval = 1000; 6026 6027 ipst->ips_ip_g_forward = IP_FORWARD_DEFAULT; 6028 ipst->ips_ipv6_forward = IP_FORWARD_DEFAULT; 6029 ipst->ips_ill_index = 1; 6030 6031 ipst->ips_saved_ip_g_forward = -1; 6032 ipst->ips_reg_vif_num = ALL_VIFS; /* Index to Register vif */ 6033 6034 pa = (ipparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP); 6035 ipst->ips_param_arr = pa; 6036 bcopy(lcl_param_arr, ipst->ips_param_arr, sizeof (lcl_param_arr)); 6037 6038 na = (ipndp_t *)kmem_alloc(sizeof (lcl_ndp_arr), KM_SLEEP); 6039 ipst->ips_ndp_arr = na; 6040 bcopy(lcl_ndp_arr, ipst->ips_ndp_arr, sizeof (lcl_ndp_arr)); 6041 ipst->ips_ndp_arr[IPNDP_IP_FORWARDING_OFFSET].ip_ndp_data = 6042 (caddr_t)&ipst->ips_ip_g_forward; 6043 ipst->ips_ndp_arr[IPNDP_IP6_FORWARDING_OFFSET].ip_ndp_data = 6044 (caddr_t)&ipst->ips_ipv6_forward; 6045 ASSERT(strcmp(ipst->ips_ndp_arr[IPNDP_CGTP_FILTER_OFFSET].ip_ndp_name, 6046 "ip_cgtp_filter") == 0); 6047 ipst->ips_ndp_arr[IPNDP_CGTP_FILTER_OFFSET].ip_ndp_data = 6048 (caddr_t)&ip_cgtp_filter; 6049 6050 (void) ip_param_register(&ipst->ips_ip_g_nd, 6051 ipst->ips_param_arr, A_CNT(lcl_param_arr), 6052 ipst->ips_ndp_arr, A_CNT(lcl_ndp_arr)); 6053 6054 ipst->ips_ip_mibkp = ip_kstat_init(stackid, ipst); 6055 ipst->ips_icmp_mibkp = icmp_kstat_init(stackid); 6056 ipst->ips_ip_kstat = ip_kstat2_init(stackid, &ipst->ips_ip_statistics); 6057 ipst->ips_ip6_kstat = 6058 ip6_kstat_init(stackid, &ipst->ips_ip6_statistics); 6059 6060 ipst->ips_ipmp_enable_failback = B_TRUE; 6061 6062 ipst->ips_ip_src_id = 1; 6063 rw_init(&ipst->ips_srcid_lock, NULL, RW_DEFAULT, NULL); 6064 6065 ip_net_init(ipst, ns); 6066 ipv4_hook_init(ipst); 6067 ipv6_hook_init(ipst); 6068 6069 return (ipst); 6070 } 6071 6072 /* 6073 * Allocate and initialize a DLPI template of the specified length. (May be 6074 * called as writer.) 6075 */ 6076 mblk_t * 6077 ip_dlpi_alloc(size_t len, t_uscalar_t prim) 6078 { 6079 mblk_t *mp; 6080 6081 mp = allocb(len, BPRI_MED); 6082 if (!mp) 6083 return (NULL); 6084 6085 /* 6086 * DLPIv2 says that DL_INFO_REQ and DL_TOKEN_REQ (the latter 6087 * of which we don't seem to use) are sent with M_PCPROTO, and 6088 * that other DLPI are M_PROTO. 6089 */ 6090 if (prim == DL_INFO_REQ) { 6091 mp->b_datap->db_type = M_PCPROTO; 6092 } else { 6093 mp->b_datap->db_type = M_PROTO; 6094 } 6095 6096 mp->b_wptr = mp->b_rptr + len; 6097 bzero(mp->b_rptr, len); 6098 ((dl_unitdata_req_t *)mp->b_rptr)->dl_primitive = prim; 6099 return (mp); 6100 } 6101 6102 const char * 6103 dlpi_prim_str(int prim) 6104 { 6105 switch (prim) { 6106 case DL_INFO_REQ: return ("DL_INFO_REQ"); 6107 case DL_INFO_ACK: return ("DL_INFO_ACK"); 6108 case DL_ATTACH_REQ: return ("DL_ATTACH_REQ"); 6109 case DL_DETACH_REQ: return ("DL_DETACH_REQ"); 6110 case DL_BIND_REQ: return ("DL_BIND_REQ"); 6111 case DL_BIND_ACK: return ("DL_BIND_ACK"); 6112 case DL_UNBIND_REQ: return ("DL_UNBIND_REQ"); 6113 case DL_OK_ACK: return ("DL_OK_ACK"); 6114 case DL_ERROR_ACK: return ("DL_ERROR_ACK"); 6115 case DL_ENABMULTI_REQ: return ("DL_ENABMULTI_REQ"); 6116 case DL_DISABMULTI_REQ: return ("DL_DISABMULTI_REQ"); 6117 case DL_PROMISCON_REQ: return ("DL_PROMISCON_REQ"); 6118 case DL_PROMISCOFF_REQ: return ("DL_PROMISCOFF_REQ"); 6119 case DL_UNITDATA_REQ: return ("DL_UNITDATA_REQ"); 6120 case DL_UNITDATA_IND: return ("DL_UNITDATA_IND"); 6121 case DL_UDERROR_IND: return ("DL_UDERROR_IND"); 6122 case DL_PHYS_ADDR_REQ: return ("DL_PHYS_ADDR_REQ"); 6123 case DL_PHYS_ADDR_ACK: return ("DL_PHYS_ADDR_ACK"); 6124 case DL_SET_PHYS_ADDR_REQ: return ("DL_SET_PHYS_ADDR_REQ"); 6125 case DL_NOTIFY_REQ: return ("DL_NOTIFY_REQ"); 6126 case DL_NOTIFY_ACK: return ("DL_NOTIFY_ACK"); 6127 case DL_NOTIFY_IND: return ("DL_NOTIFY_IND"); 6128 case DL_CAPABILITY_REQ: return ("DL_CAPABILITY_REQ"); 6129 case DL_CAPABILITY_ACK: return ("DL_CAPABILITY_ACK"); 6130 case DL_CONTROL_REQ: return ("DL_CONTROL_REQ"); 6131 case DL_CONTROL_ACK: return ("DL_CONTROL_ACK"); 6132 default: return ("<unknown primitive>"); 6133 } 6134 } 6135 6136 const char * 6137 dlpi_err_str(int err) 6138 { 6139 switch (err) { 6140 case DL_ACCESS: return ("DL_ACCESS"); 6141 case DL_BADADDR: return ("DL_BADADDR"); 6142 case DL_BADCORR: return ("DL_BADCORR"); 6143 case DL_BADDATA: return ("DL_BADDATA"); 6144 case DL_BADPPA: return ("DL_BADPPA"); 6145 case DL_BADPRIM: return ("DL_BADPRIM"); 6146 case DL_BADQOSPARAM: return ("DL_BADQOSPARAM"); 6147 case DL_BADQOSTYPE: return ("DL_BADQOSTYPE"); 6148 case DL_BADSAP: return ("DL_BADSAP"); 6149 case DL_BADTOKEN: return ("DL_BADTOKEN"); 6150 case DL_BOUND: return ("DL_BOUND"); 6151 case DL_INITFAILED: return ("DL_INITFAILED"); 6152 case DL_NOADDR: return ("DL_NOADDR"); 6153 case DL_NOTINIT: return ("DL_NOTINIT"); 6154 case DL_OUTSTATE: return ("DL_OUTSTATE"); 6155 case DL_SYSERR: return ("DL_SYSERR"); 6156 case DL_UNSUPPORTED: return ("DL_UNSUPPORTED"); 6157 case DL_UNDELIVERABLE: return ("DL_UNDELIVERABLE"); 6158 case DL_NOTSUPPORTED : return ("DL_NOTSUPPORTED "); 6159 case DL_TOOMANY: return ("DL_TOOMANY"); 6160 case DL_NOTENAB: return ("DL_NOTENAB"); 6161 case DL_BUSY: return ("DL_BUSY"); 6162 case DL_NOAUTO: return ("DL_NOAUTO"); 6163 case DL_NOXIDAUTO: return ("DL_NOXIDAUTO"); 6164 case DL_NOTESTAUTO: return ("DL_NOTESTAUTO"); 6165 case DL_XIDAUTO: return ("DL_XIDAUTO"); 6166 case DL_TESTAUTO: return ("DL_TESTAUTO"); 6167 case DL_PENDING: return ("DL_PENDING"); 6168 default: return ("<unknown error>"); 6169 } 6170 } 6171 6172 /* 6173 * Debug formatting routine. Returns a character string representation of the 6174 * addr in buf, of the form xxx.xxx.xxx.xxx. This routine takes the address 6175 * in the form of a ipaddr_t and calls ip_dot_saddr with a pointer. 6176 * 6177 * Once the ndd table-printing interfaces are removed, this can be changed to 6178 * standard dotted-decimal form. 6179 */ 6180 char * 6181 ip_dot_addr(ipaddr_t addr, char *buf) 6182 { 6183 uint8_t *ap = (uint8_t *)&addr; 6184 6185 (void) mi_sprintf(buf, "%03d.%03d.%03d.%03d", 6186 ap[0] & 0xFF, ap[1] & 0xFF, ap[2] & 0xFF, ap[3] & 0xFF); 6187 return (buf); 6188 } 6189 6190 /* 6191 * Write the given MAC address as a printable string in the usual colon- 6192 * separated format. 6193 */ 6194 const char * 6195 mac_colon_addr(const uint8_t *addr, size_t alen, char *buf, size_t buflen) 6196 { 6197 char *bp; 6198 6199 if (alen == 0 || buflen < 4) 6200 return ("?"); 6201 bp = buf; 6202 for (;;) { 6203 /* 6204 * If there are more MAC address bytes available, but we won't 6205 * have any room to print them, then add "..." to the string 6206 * instead. See below for the 'magic number' explanation. 6207 */ 6208 if ((alen == 2 && buflen < 6) || (alen > 2 && buflen < 7)) { 6209 (void) strcpy(bp, "..."); 6210 break; 6211 } 6212 (void) sprintf(bp, "%02x", *addr++); 6213 bp += 2; 6214 if (--alen == 0) 6215 break; 6216 *bp++ = ':'; 6217 buflen -= 3; 6218 /* 6219 * At this point, based on the first 'if' statement above, 6220 * either alen == 1 and buflen >= 3, or alen > 1 and 6221 * buflen >= 4. The first case leaves room for the final "xx" 6222 * number and trailing NUL byte. The second leaves room for at 6223 * least "...". Thus the apparently 'magic' numbers chosen for 6224 * that statement. 6225 */ 6226 } 6227 return (buf); 6228 } 6229 6230 /* 6231 * Send an ICMP error after patching up the packet appropriately. Returns 6232 * non-zero if the appropriate MIB should be bumped; zero otherwise. 6233 */ 6234 static boolean_t 6235 ip_fanout_send_icmp(queue_t *q, mblk_t *mp, uint_t flags, 6236 uint_t icmp_type, uint_t icmp_code, boolean_t mctl_present, 6237 zoneid_t zoneid, ip_stack_t *ipst) 6238 { 6239 ipha_t *ipha; 6240 mblk_t *first_mp; 6241 boolean_t secure; 6242 unsigned char db_type; 6243 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 6244 6245 first_mp = mp; 6246 if (mctl_present) { 6247 mp = mp->b_cont; 6248 secure = ipsec_in_is_secure(first_mp); 6249 ASSERT(mp != NULL); 6250 } else { 6251 /* 6252 * If this is an ICMP error being reported - which goes 6253 * up as M_CTLs, we need to convert them to M_DATA till 6254 * we finish checking with global policy because 6255 * ipsec_check_global_policy() assumes M_DATA as clear 6256 * and M_CTL as secure. 6257 */ 6258 db_type = DB_TYPE(mp); 6259 DB_TYPE(mp) = M_DATA; 6260 secure = B_FALSE; 6261 } 6262 /* 6263 * We are generating an icmp error for some inbound packet. 6264 * Called from all ip_fanout_(udp, tcp, proto) functions. 6265 * Before we generate an error, check with global policy 6266 * to see whether this is allowed to enter the system. As 6267 * there is no "conn", we are checking with global policy. 6268 */ 6269 ipha = (ipha_t *)mp->b_rptr; 6270 if (secure || ipss->ipsec_inbound_v4_policy_present) { 6271 first_mp = ipsec_check_global_policy(first_mp, NULL, 6272 ipha, NULL, mctl_present, ipst->ips_netstack); 6273 if (first_mp == NULL) 6274 return (B_FALSE); 6275 } 6276 6277 if (!mctl_present) 6278 DB_TYPE(mp) = db_type; 6279 6280 if (flags & IP_FF_SEND_ICMP) { 6281 if (flags & IP_FF_HDR_COMPLETE) { 6282 if (ip_hdr_complete(ipha, zoneid, ipst)) { 6283 freemsg(first_mp); 6284 return (B_TRUE); 6285 } 6286 } 6287 if (flags & IP_FF_CKSUM) { 6288 /* 6289 * Have to correct checksum since 6290 * the packet might have been 6291 * fragmented and the reassembly code in ip_rput 6292 * does not restore the IP checksum. 6293 */ 6294 ipha->ipha_hdr_checksum = 0; 6295 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 6296 } 6297 switch (icmp_type) { 6298 case ICMP_DEST_UNREACHABLE: 6299 icmp_unreachable(WR(q), first_mp, icmp_code, zoneid, 6300 ipst); 6301 break; 6302 default: 6303 freemsg(first_mp); 6304 break; 6305 } 6306 } else { 6307 freemsg(first_mp); 6308 return (B_FALSE); 6309 } 6310 6311 return (B_TRUE); 6312 } 6313 6314 /* 6315 * Used to send an ICMP error message when a packet is received for 6316 * a protocol that is not supported. The mblk passed as argument 6317 * is consumed by this function. 6318 */ 6319 void 6320 ip_proto_not_sup(queue_t *q, mblk_t *ipsec_mp, uint_t flags, zoneid_t zoneid, 6321 ip_stack_t *ipst) 6322 { 6323 mblk_t *mp; 6324 ipha_t *ipha; 6325 ill_t *ill; 6326 ipsec_in_t *ii; 6327 6328 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 6329 ASSERT(ii->ipsec_in_type == IPSEC_IN); 6330 6331 mp = ipsec_mp->b_cont; 6332 ipsec_mp->b_cont = NULL; 6333 ipha = (ipha_t *)mp->b_rptr; 6334 /* Get ill from index in ipsec_in_t. */ 6335 ill = ill_lookup_on_ifindex(ii->ipsec_in_ill_index, 6336 (IPH_HDR_VERSION(ipha) == IPV6_VERSION), NULL, NULL, NULL, NULL, 6337 ipst); 6338 if (ill != NULL) { 6339 if (IPH_HDR_VERSION(ipha) == IP_VERSION) { 6340 if (ip_fanout_send_icmp(q, mp, flags, 6341 ICMP_DEST_UNREACHABLE, 6342 ICMP_PROTOCOL_UNREACHABLE, B_FALSE, zoneid, ipst)) { 6343 BUMP_MIB(ill->ill_ip_mib, 6344 ipIfStatsInUnknownProtos); 6345 } 6346 } else { 6347 if (ip_fanout_send_icmp_v6(q, mp, flags, 6348 ICMP6_PARAM_PROB, ICMP6_PARAMPROB_NEXTHEADER, 6349 0, B_FALSE, zoneid, ipst)) { 6350 BUMP_MIB(ill->ill_ip_mib, 6351 ipIfStatsInUnknownProtos); 6352 } 6353 } 6354 ill_refrele(ill); 6355 } else { /* re-link for the freemsg() below. */ 6356 ipsec_mp->b_cont = mp; 6357 } 6358 6359 /* If ICMP delivered, ipsec_mp will be a singleton (b_cont == NULL). */ 6360 freemsg(ipsec_mp); 6361 } 6362 6363 /* 6364 * See if the inbound datagram has had IPsec processing applied to it. 6365 */ 6366 boolean_t 6367 ipsec_in_is_secure(mblk_t *ipsec_mp) 6368 { 6369 ipsec_in_t *ii; 6370 6371 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 6372 ASSERT(ii->ipsec_in_type == IPSEC_IN); 6373 6374 if (ii->ipsec_in_loopback) { 6375 return (ii->ipsec_in_secure); 6376 } else { 6377 return (ii->ipsec_in_ah_sa != NULL || 6378 ii->ipsec_in_esp_sa != NULL || 6379 ii->ipsec_in_decaps); 6380 } 6381 } 6382 6383 /* 6384 * Handle protocols with which IP is less intimate. There 6385 * can be more than one stream bound to a particular 6386 * protocol. When this is the case, normally each one gets a copy 6387 * of any incoming packets. 6388 * 6389 * IPSEC NOTE : 6390 * 6391 * Don't allow a secure packet going up a non-secure connection. 6392 * We don't allow this because 6393 * 6394 * 1) Reply might go out in clear which will be dropped at 6395 * the sending side. 6396 * 2) If the reply goes out in clear it will give the 6397 * adversary enough information for getting the key in 6398 * most of the cases. 6399 * 6400 * Moreover getting a secure packet when we expect clear 6401 * implies that SA's were added without checking for 6402 * policy on both ends. This should not happen once ISAKMP 6403 * is used to negotiate SAs as SAs will be added only after 6404 * verifying the policy. 6405 * 6406 * NOTE : If the packet was tunneled and not multicast we only send 6407 * to it the first match. Unlike TCP and UDP fanouts this doesn't fall 6408 * back to delivering packets to AF_INET6 raw sockets. 6409 * 6410 * IPQoS Notes: 6411 * Once we have determined the client, invoke IPPF processing. 6412 * Policy processing takes place only if the callout_position, IPP_LOCAL_IN, 6413 * is enabled. If we get here from icmp_inbound_error_fanout or ip_wput_local 6414 * ip_policy will be false. 6415 * 6416 * Zones notes: 6417 * Currently only applications in the global zone can create raw sockets for 6418 * protocols other than ICMP. So unlike the broadcast / multicast case of 6419 * ip_fanout_udp(), we only send a copy of the packet to streams in the 6420 * specified zone. For ICMP, this is handled by the callers of icmp_inbound(). 6421 */ 6422 static void 6423 ip_fanout_proto(queue_t *q, mblk_t *mp, ill_t *ill, ipha_t *ipha, uint_t flags, 6424 boolean_t mctl_present, boolean_t ip_policy, ill_t *recv_ill, 6425 zoneid_t zoneid) 6426 { 6427 queue_t *rq; 6428 mblk_t *mp1, *first_mp1; 6429 uint_t protocol = ipha->ipha_protocol; 6430 ipaddr_t dst; 6431 boolean_t one_only; 6432 mblk_t *first_mp = mp; 6433 boolean_t secure; 6434 uint32_t ill_index; 6435 conn_t *connp, *first_connp, *next_connp; 6436 connf_t *connfp; 6437 boolean_t shared_addr; 6438 mib2_ipIfStatsEntry_t *mibptr; 6439 ip_stack_t *ipst = recv_ill->ill_ipst; 6440 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 6441 6442 mibptr = (ill != NULL) ? ill->ill_ip_mib : &ipst->ips_ip_mib; 6443 if (mctl_present) { 6444 mp = first_mp->b_cont; 6445 secure = ipsec_in_is_secure(first_mp); 6446 ASSERT(mp != NULL); 6447 } else { 6448 secure = B_FALSE; 6449 } 6450 dst = ipha->ipha_dst; 6451 /* 6452 * If the packet was tunneled and not multicast we only send to it 6453 * the first match. 6454 */ 6455 one_only = ((protocol == IPPROTO_ENCAP || protocol == IPPROTO_IPV6) && 6456 !CLASSD(dst)); 6457 6458 shared_addr = (zoneid == ALL_ZONES); 6459 if (shared_addr) { 6460 /* 6461 * We don't allow multilevel ports for raw IP, so no need to 6462 * check for that here. 6463 */ 6464 zoneid = tsol_packet_to_zoneid(mp); 6465 } 6466 6467 connfp = &ipst->ips_ipcl_proto_fanout[protocol]; 6468 mutex_enter(&connfp->connf_lock); 6469 connp = connfp->connf_head; 6470 for (connp = connfp->connf_head; connp != NULL; 6471 connp = connp->conn_next) { 6472 if (IPCL_PROTO_MATCH(connp, protocol, ipha, ill, flags, 6473 zoneid) && 6474 (!is_system_labeled() || 6475 tsol_receive_local(mp, &dst, IPV4_VERSION, shared_addr, 6476 connp))) 6477 break; 6478 } 6479 6480 if (connp == NULL || connp->conn_upq == NULL) { 6481 /* 6482 * No one bound to these addresses. Is 6483 * there a client that wants all 6484 * unclaimed datagrams? 6485 */ 6486 mutex_exit(&connfp->connf_lock); 6487 /* 6488 * Check for IPPROTO_ENCAP... 6489 */ 6490 if (protocol == IPPROTO_ENCAP && ipst->ips_ip_g_mrouter) { 6491 /* 6492 * If an IPsec mblk is here on a multicast 6493 * tunnel (using ip_mroute stuff), check policy here, 6494 * THEN ship off to ip_mroute_decap(). 6495 * 6496 * BTW, If I match a configured IP-in-IP 6497 * tunnel, this path will not be reached, and 6498 * ip_mroute_decap will never be called. 6499 */ 6500 first_mp = ipsec_check_global_policy(first_mp, connp, 6501 ipha, NULL, mctl_present, ipst->ips_netstack); 6502 if (first_mp != NULL) { 6503 if (mctl_present) 6504 freeb(first_mp); 6505 ip_mroute_decap(q, mp, ill); 6506 } /* Else we already freed everything! */ 6507 } else { 6508 /* 6509 * Otherwise send an ICMP protocol unreachable. 6510 */ 6511 if (ip_fanout_send_icmp(q, first_mp, flags, 6512 ICMP_DEST_UNREACHABLE, ICMP_PROTOCOL_UNREACHABLE, 6513 mctl_present, zoneid, ipst)) { 6514 BUMP_MIB(mibptr, ipIfStatsInUnknownProtos); 6515 } 6516 } 6517 return; 6518 } 6519 CONN_INC_REF(connp); 6520 first_connp = connp; 6521 6522 /* 6523 * Only send message to one tunnel driver by immediately 6524 * terminating the loop. 6525 */ 6526 connp = one_only ? NULL : connp->conn_next; 6527 6528 for (;;) { 6529 while (connp != NULL) { 6530 if (IPCL_PROTO_MATCH(connp, protocol, ipha, ill, 6531 flags, zoneid) && 6532 (!is_system_labeled() || 6533 tsol_receive_local(mp, &dst, IPV4_VERSION, 6534 shared_addr, connp))) 6535 break; 6536 connp = connp->conn_next; 6537 } 6538 6539 /* 6540 * Copy the packet. 6541 */ 6542 if (connp == NULL || connp->conn_upq == NULL || 6543 (((first_mp1 = dupmsg(first_mp)) == NULL) && 6544 ((first_mp1 = ip_copymsg(first_mp)) == NULL))) { 6545 /* 6546 * No more interested clients or memory 6547 * allocation failed 6548 */ 6549 connp = first_connp; 6550 break; 6551 } 6552 mp1 = mctl_present ? first_mp1->b_cont : first_mp1; 6553 CONN_INC_REF(connp); 6554 mutex_exit(&connfp->connf_lock); 6555 rq = connp->conn_rq; 6556 if (!canputnext(rq)) { 6557 if (flags & IP_FF_RAWIP) { 6558 BUMP_MIB(mibptr, rawipIfStatsInOverflows); 6559 } else { 6560 BUMP_MIB(&ipst->ips_icmp_mib, icmpInOverflows); 6561 } 6562 6563 freemsg(first_mp1); 6564 } else { 6565 /* 6566 * Don't enforce here if we're an actual tunnel - 6567 * let "tun" do it instead. 6568 */ 6569 if (!IPCL_IS_IPTUN(connp) && 6570 (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || 6571 secure)) { 6572 first_mp1 = ipsec_check_inbound_policy 6573 (first_mp1, connp, ipha, NULL, 6574 mctl_present); 6575 } 6576 if (first_mp1 != NULL) { 6577 int in_flags = 0; 6578 /* 6579 * ip_fanout_proto also gets called from 6580 * icmp_inbound_error_fanout, in which case 6581 * the msg type is M_CTL. Don't add info 6582 * in this case for the time being. In future 6583 * when there is a need for knowing the 6584 * inbound iface index for ICMP error msgs, 6585 * then this can be changed. 6586 */ 6587 if (connp->conn_recvif) 6588 in_flags = IPF_RECVIF; 6589 /* 6590 * The ULP may support IP_RECVPKTINFO for both 6591 * IP v4 and v6 so pass the appropriate argument 6592 * based on conn IP version. 6593 */ 6594 if (connp->conn_ip_recvpktinfo) { 6595 if (connp->conn_af_isv6) { 6596 /* 6597 * V6 only needs index 6598 */ 6599 in_flags |= IPF_RECVIF; 6600 } else { 6601 /* 6602 * V4 needs index + 6603 * matching address. 6604 */ 6605 in_flags |= IPF_RECVADDR; 6606 } 6607 } 6608 if ((in_flags != 0) && 6609 (mp->b_datap->db_type != M_CTL)) { 6610 /* 6611 * the actual data will be 6612 * contained in b_cont upon 6613 * successful return of the 6614 * following call else 6615 * original mblk is returned 6616 */ 6617 ASSERT(recv_ill != NULL); 6618 mp1 = ip_add_info(mp1, recv_ill, 6619 in_flags, IPCL_ZONEID(connp), ipst); 6620 } 6621 BUMP_MIB(mibptr, ipIfStatsHCInDelivers); 6622 if (mctl_present) 6623 freeb(first_mp1); 6624 putnext(rq, mp1); 6625 } 6626 } 6627 mutex_enter(&connfp->connf_lock); 6628 /* Follow the next pointer before releasing the conn. */ 6629 next_connp = connp->conn_next; 6630 CONN_DEC_REF(connp); 6631 connp = next_connp; 6632 } 6633 6634 /* Last one. Send it upstream. */ 6635 mutex_exit(&connfp->connf_lock); 6636 6637 /* 6638 * If this packet is coming from icmp_inbound_error_fanout ip_policy 6639 * will be set to false. 6640 */ 6641 if (IPP_ENABLED(IPP_LOCAL_IN, ipst) && ip_policy) { 6642 ill_index = ill->ill_phyint->phyint_ifindex; 6643 ip_process(IPP_LOCAL_IN, &mp, ill_index); 6644 if (mp == NULL) { 6645 CONN_DEC_REF(connp); 6646 if (mctl_present) { 6647 freeb(first_mp); 6648 } 6649 return; 6650 } 6651 } 6652 6653 rq = connp->conn_rq; 6654 if (!canputnext(rq)) { 6655 if (flags & IP_FF_RAWIP) { 6656 BUMP_MIB(mibptr, rawipIfStatsInOverflows); 6657 } else { 6658 BUMP_MIB(&ipst->ips_icmp_mib, icmpInOverflows); 6659 } 6660 6661 freemsg(first_mp); 6662 } else { 6663 if (IPCL_IS_IPTUN(connp)) { 6664 /* 6665 * Tunneled packet. We enforce policy in the tunnel 6666 * module itself. 6667 * 6668 * Send the WHOLE packet up (incl. IPSEC_IN) without 6669 * a policy check. 6670 */ 6671 putnext(rq, first_mp); 6672 CONN_DEC_REF(connp); 6673 return; 6674 } 6675 6676 if ((CONN_INBOUND_POLICY_PRESENT(connp, ipss) || secure)) { 6677 first_mp = ipsec_check_inbound_policy(first_mp, connp, 6678 ipha, NULL, mctl_present); 6679 } 6680 6681 if (first_mp != NULL) { 6682 int in_flags = 0; 6683 6684 /* 6685 * ip_fanout_proto also gets called 6686 * from icmp_inbound_error_fanout, in 6687 * which case the msg type is M_CTL. 6688 * Don't add info in this case for time 6689 * being. In future when there is a 6690 * need for knowing the inbound iface 6691 * index for ICMP error msgs, then this 6692 * can be changed 6693 */ 6694 if (connp->conn_recvif) 6695 in_flags = IPF_RECVIF; 6696 if (connp->conn_ip_recvpktinfo) { 6697 if (connp->conn_af_isv6) { 6698 /* 6699 * V6 only needs index 6700 */ 6701 in_flags |= IPF_RECVIF; 6702 } else { 6703 /* 6704 * V4 needs index + 6705 * matching address. 6706 */ 6707 in_flags |= IPF_RECVADDR; 6708 } 6709 } 6710 if ((in_flags != 0) && 6711 (mp->b_datap->db_type != M_CTL)) { 6712 6713 /* 6714 * the actual data will be contained in 6715 * b_cont upon successful return 6716 * of the following call else original 6717 * mblk is returned 6718 */ 6719 ASSERT(recv_ill != NULL); 6720 mp = ip_add_info(mp, recv_ill, 6721 in_flags, IPCL_ZONEID(connp), ipst); 6722 } 6723 BUMP_MIB(mibptr, ipIfStatsHCInDelivers); 6724 putnext(rq, mp); 6725 if (mctl_present) 6726 freeb(first_mp); 6727 } 6728 } 6729 CONN_DEC_REF(connp); 6730 } 6731 6732 /* 6733 * Fanout for TCP packets 6734 * The caller puts <fport, lport> in the ports parameter. 6735 * 6736 * IPQoS Notes 6737 * Before sending it to the client, invoke IPPF processing. 6738 * Policy processing takes place only if the callout_position, IPP_LOCAL_IN, 6739 * is enabled. If we get here from icmp_inbound_error_fanout or ip_wput_local 6740 * ip_policy is false. 6741 */ 6742 static void 6743 ip_fanout_tcp(queue_t *q, mblk_t *mp, ill_t *recv_ill, ipha_t *ipha, 6744 uint_t flags, boolean_t mctl_present, boolean_t ip_policy, zoneid_t zoneid) 6745 { 6746 mblk_t *first_mp; 6747 boolean_t secure; 6748 uint32_t ill_index; 6749 int ip_hdr_len; 6750 tcph_t *tcph; 6751 boolean_t syn_present = B_FALSE; 6752 conn_t *connp; 6753 ip_stack_t *ipst = recv_ill->ill_ipst; 6754 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 6755 6756 ASSERT(recv_ill != NULL); 6757 6758 first_mp = mp; 6759 if (mctl_present) { 6760 ASSERT(first_mp->b_datap->db_type == M_CTL); 6761 mp = first_mp->b_cont; 6762 secure = ipsec_in_is_secure(first_mp); 6763 ASSERT(mp != NULL); 6764 } else { 6765 secure = B_FALSE; 6766 } 6767 6768 ip_hdr_len = IPH_HDR_LENGTH(mp->b_rptr); 6769 6770 if ((connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_len, 6771 zoneid, ipst)) == NULL) { 6772 /* 6773 * No connected connection or listener. Send a 6774 * TH_RST via tcp_xmit_listeners_reset. 6775 */ 6776 6777 /* Initiate IPPf processing, if needed. */ 6778 if (IPP_ENABLED(IPP_LOCAL_IN, ipst)) { 6779 uint32_t ill_index; 6780 ill_index = recv_ill->ill_phyint->phyint_ifindex; 6781 ip_process(IPP_LOCAL_IN, &first_mp, ill_index); 6782 if (first_mp == NULL) 6783 return; 6784 } 6785 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsHCInDelivers); 6786 ip2dbg(("ip_fanout_tcp: no listener; send reset to zone %d\n", 6787 zoneid)); 6788 tcp_xmit_listeners_reset(first_mp, ip_hdr_len, zoneid, 6789 ipst->ips_netstack->netstack_tcp); 6790 return; 6791 } 6792 6793 /* 6794 * Allocate the SYN for the TCP connection here itself 6795 */ 6796 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 6797 if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) { 6798 if (IPCL_IS_TCP(connp)) { 6799 squeue_t *sqp; 6800 6801 /* 6802 * For fused tcp loopback, assign the eager's 6803 * squeue to be that of the active connect's. 6804 * Note that we don't check for IP_FF_LOOPBACK 6805 * here since this routine gets called only 6806 * for loopback (unlike the IPv6 counterpart). 6807 */ 6808 ASSERT(Q_TO_CONN(q) != NULL); 6809 if (do_tcp_fusion && 6810 !CONN_INBOUND_POLICY_PRESENT(connp, ipss) && 6811 !secure && 6812 !IPP_ENABLED(IPP_LOCAL_IN, ipst) && !ip_policy && 6813 IPCL_IS_TCP(Q_TO_CONN(q))) { 6814 ASSERT(Q_TO_CONN(q)->conn_sqp != NULL); 6815 sqp = Q_TO_CONN(q)->conn_sqp; 6816 } else { 6817 sqp = IP_SQUEUE_GET(lbolt); 6818 } 6819 6820 mp->b_datap->db_struioflag |= STRUIO_EAGER; 6821 DB_CKSUMSTART(mp) = (intptr_t)sqp; 6822 syn_present = B_TRUE; 6823 } 6824 } 6825 6826 if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) { 6827 uint_t flags = (unsigned int)tcph->th_flags[0] & 0xFF; 6828 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsHCInDelivers); 6829 if ((flags & TH_RST) || (flags & TH_URG)) { 6830 CONN_DEC_REF(connp); 6831 freemsg(first_mp); 6832 return; 6833 } 6834 if (flags & TH_ACK) { 6835 tcp_xmit_listeners_reset(first_mp, ip_hdr_len, zoneid, 6836 ipst->ips_netstack->netstack_tcp); 6837 CONN_DEC_REF(connp); 6838 return; 6839 } 6840 6841 CONN_DEC_REF(connp); 6842 freemsg(first_mp); 6843 return; 6844 } 6845 6846 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || secure) { 6847 first_mp = ipsec_check_inbound_policy(first_mp, connp, ipha, 6848 NULL, mctl_present); 6849 if (first_mp == NULL) { 6850 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards); 6851 CONN_DEC_REF(connp); 6852 return; 6853 } 6854 if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) { 6855 ASSERT(syn_present); 6856 if (mctl_present) { 6857 ASSERT(first_mp != mp); 6858 first_mp->b_datap->db_struioflag |= 6859 STRUIO_POLICY; 6860 } else { 6861 ASSERT(first_mp == mp); 6862 mp->b_datap->db_struioflag &= 6863 ~STRUIO_EAGER; 6864 mp->b_datap->db_struioflag |= 6865 STRUIO_POLICY; 6866 } 6867 } else { 6868 /* 6869 * Discard first_mp early since we're dealing with a 6870 * fully-connected conn_t and tcp doesn't do policy in 6871 * this case. 6872 */ 6873 if (mctl_present) { 6874 freeb(first_mp); 6875 mctl_present = B_FALSE; 6876 } 6877 first_mp = mp; 6878 } 6879 } 6880 6881 /* 6882 * Initiate policy processing here if needed. If we get here from 6883 * icmp_inbound_error_fanout, ip_policy is false. 6884 */ 6885 if (IPP_ENABLED(IPP_LOCAL_IN, ipst) && ip_policy) { 6886 ill_index = recv_ill->ill_phyint->phyint_ifindex; 6887 ip_process(IPP_LOCAL_IN, &mp, ill_index); 6888 if (mp == NULL) { 6889 CONN_DEC_REF(connp); 6890 if (mctl_present) 6891 freeb(first_mp); 6892 return; 6893 } else if (mctl_present) { 6894 ASSERT(first_mp != mp); 6895 first_mp->b_cont = mp; 6896 } else { 6897 first_mp = mp; 6898 } 6899 } 6900 6901 6902 6903 /* Handle socket options. */ 6904 if (!syn_present && 6905 connp->conn_ip_recvpktinfo && (flags & IP_FF_IPINFO)) { 6906 /* Add header */ 6907 ASSERT(recv_ill != NULL); 6908 /* 6909 * Since tcp does not support IP_RECVPKTINFO for V4, only pass 6910 * IPF_RECVIF. 6911 */ 6912 mp = ip_add_info(mp, recv_ill, IPF_RECVIF, IPCL_ZONEID(connp), 6913 ipst); 6914 if (mp == NULL) { 6915 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards); 6916 CONN_DEC_REF(connp); 6917 if (mctl_present) 6918 freeb(first_mp); 6919 return; 6920 } else if (mctl_present) { 6921 /* 6922 * ip_add_info might return a new mp. 6923 */ 6924 ASSERT(first_mp != mp); 6925 first_mp->b_cont = mp; 6926 } else { 6927 first_mp = mp; 6928 } 6929 } 6930 6931 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsHCInDelivers); 6932 if (IPCL_IS_TCP(connp)) { 6933 (*ip_input_proc)(connp->conn_sqp, first_mp, 6934 connp->conn_recv, connp, SQTAG_IP_FANOUT_TCP); 6935 } else { 6936 putnext(connp->conn_rq, first_mp); 6937 CONN_DEC_REF(connp); 6938 } 6939 } 6940 6941 /* 6942 * Deliver a udp packet to the given conn, possibly applying ipsec policy. 6943 * We are responsible for disposing of mp, such as by freemsg() or putnext() 6944 * Caller is responsible for dropping references to the conn, and freeing 6945 * first_mp. 6946 * 6947 * IPQoS Notes 6948 * Before sending it to the client, invoke IPPF processing. Policy processing 6949 * takes place only if the callout_position, IPP_LOCAL_IN, is enabled and 6950 * ip_policy is true. If we get here from icmp_inbound_error_fanout or 6951 * ip_wput_local, ip_policy is false. 6952 */ 6953 static void 6954 ip_fanout_udp_conn(conn_t *connp, mblk_t *first_mp, mblk_t *mp, 6955 boolean_t secure, ill_t *ill, ipha_t *ipha, uint_t flags, ill_t *recv_ill, 6956 boolean_t ip_policy) 6957 { 6958 boolean_t mctl_present = (first_mp != NULL); 6959 uint32_t in_flags = 0; /* set to IP_RECVSLLA and/or IP_RECVIF */ 6960 uint32_t ill_index; 6961 ip_stack_t *ipst = recv_ill->ill_ipst; 6962 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 6963 6964 ASSERT(ill != NULL); 6965 6966 if (mctl_present) 6967 first_mp->b_cont = mp; 6968 else 6969 first_mp = mp; 6970 6971 if (CONN_UDP_FLOWCTLD(connp)) { 6972 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows); 6973 freemsg(first_mp); 6974 return; 6975 } 6976 6977 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || secure) { 6978 first_mp = ipsec_check_inbound_policy(first_mp, connp, ipha, 6979 NULL, mctl_present); 6980 if (first_mp == NULL) { 6981 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 6982 return; /* Freed by ipsec_check_inbound_policy(). */ 6983 } 6984 } 6985 if (mctl_present) 6986 freeb(first_mp); 6987 6988 /* Handle options. */ 6989 if (connp->conn_recvif) 6990 in_flags = IPF_RECVIF; 6991 /* 6992 * UDP supports IP_RECVPKTINFO option for both v4 and v6 so the flag 6993 * passed to ip_add_info is based on IP version of connp. 6994 */ 6995 if (connp->conn_ip_recvpktinfo && (flags & IP_FF_IPINFO)) { 6996 if (connp->conn_af_isv6) { 6997 /* 6998 * V6 only needs index 6999 */ 7000 in_flags |= IPF_RECVIF; 7001 } else { 7002 /* 7003 * V4 needs index + matching address. 7004 */ 7005 in_flags |= IPF_RECVADDR; 7006 } 7007 } 7008 7009 if (connp->conn_recvslla && !(flags & IP_FF_SEND_SLLA)) 7010 in_flags |= IPF_RECVSLLA; 7011 7012 /* 7013 * Initiate IPPF processing here, if needed. Note first_mp won't be 7014 * freed if the packet is dropped. The caller will do so. 7015 */ 7016 if (IPP_ENABLED(IPP_LOCAL_IN, ipst) && ip_policy) { 7017 ill_index = recv_ill->ill_phyint->phyint_ifindex; 7018 ip_process(IPP_LOCAL_IN, &mp, ill_index); 7019 if (mp == NULL) { 7020 return; 7021 } 7022 } 7023 if ((in_flags != 0) && 7024 (mp->b_datap->db_type != M_CTL)) { 7025 /* 7026 * The actual data will be contained in b_cont 7027 * upon successful return of the following call 7028 * else original mblk is returned 7029 */ 7030 ASSERT(recv_ill != NULL); 7031 mp = ip_add_info(mp, recv_ill, in_flags, IPCL_ZONEID(connp), 7032 ipst); 7033 } 7034 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 7035 /* Send it upstream */ 7036 CONN_UDP_RECV(connp, mp); 7037 } 7038 7039 /* 7040 * Fanout for UDP packets. 7041 * The caller puts <fport, lport> in the ports parameter. 7042 * 7043 * If SO_REUSEADDR is set all multicast and broadcast packets 7044 * will be delivered to all streams bound to the same port. 7045 * 7046 * Zones notes: 7047 * Multicast and broadcast packets will be distributed to streams in all zones. 7048 * In the special case where an AF_INET socket binds to 0.0.0.0/<port> and an 7049 * AF_INET6 socket binds to ::/<port>, only the AF_INET socket receives the IPv4 7050 * packets. To maintain this behavior with multiple zones, the conns are grouped 7051 * by zone and the SO_REUSEADDR flag is checked for the first matching conn in 7052 * each zone. If unset, all the following conns in the same zone are skipped. 7053 */ 7054 static void 7055 ip_fanout_udp(queue_t *q, mblk_t *mp, ill_t *ill, ipha_t *ipha, 7056 uint32_t ports, boolean_t broadcast, uint_t flags, boolean_t mctl_present, 7057 boolean_t ip_policy, ill_t *recv_ill, zoneid_t zoneid) 7058 { 7059 uint32_t dstport, srcport; 7060 ipaddr_t dst; 7061 mblk_t *first_mp; 7062 boolean_t secure; 7063 in6_addr_t v6src; 7064 conn_t *connp; 7065 connf_t *connfp; 7066 conn_t *first_connp; 7067 conn_t *next_connp; 7068 mblk_t *mp1, *first_mp1; 7069 ipaddr_t src; 7070 zoneid_t last_zoneid; 7071 boolean_t reuseaddr; 7072 boolean_t shared_addr; 7073 ip_stack_t *ipst; 7074 7075 ASSERT(recv_ill != NULL); 7076 ipst = recv_ill->ill_ipst; 7077 7078 first_mp = mp; 7079 if (mctl_present) { 7080 mp = first_mp->b_cont; 7081 first_mp->b_cont = NULL; 7082 secure = ipsec_in_is_secure(first_mp); 7083 ASSERT(mp != NULL); 7084 } else { 7085 first_mp = NULL; 7086 secure = B_FALSE; 7087 } 7088 7089 /* Extract ports in net byte order */ 7090 dstport = htons(ntohl(ports) & 0xFFFF); 7091 srcport = htons(ntohl(ports) >> 16); 7092 dst = ipha->ipha_dst; 7093 src = ipha->ipha_src; 7094 7095 shared_addr = (zoneid == ALL_ZONES); 7096 if (shared_addr) { 7097 /* 7098 * No need to handle exclusive-stack zones since ALL_ZONES 7099 * only applies to the shared stack. 7100 */ 7101 zoneid = tsol_mlp_findzone(IPPROTO_UDP, dstport); 7102 if (zoneid == ALL_ZONES) 7103 zoneid = tsol_packet_to_zoneid(mp); 7104 } 7105 7106 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(dstport, ipst)]; 7107 mutex_enter(&connfp->connf_lock); 7108 connp = connfp->connf_head; 7109 if (!broadcast && !CLASSD(dst)) { 7110 /* 7111 * Not broadcast or multicast. Send to the one (first) 7112 * client we find. No need to check conn_wantpacket() 7113 * since IP_BOUND_IF/conn_incoming_ill does not apply to 7114 * IPv4 unicast packets. 7115 */ 7116 while ((connp != NULL) && 7117 (!IPCL_UDP_MATCH(connp, dstport, dst, srcport, src) || 7118 !IPCL_ZONE_MATCH(connp, zoneid))) { 7119 connp = connp->conn_next; 7120 } 7121 7122 if (connp == NULL || connp->conn_upq == NULL) 7123 goto notfound; 7124 7125 if (is_system_labeled() && 7126 !tsol_receive_local(mp, &dst, IPV4_VERSION, shared_addr, 7127 connp)) 7128 goto notfound; 7129 7130 CONN_INC_REF(connp); 7131 mutex_exit(&connfp->connf_lock); 7132 ip_fanout_udp_conn(connp, first_mp, mp, secure, ill, ipha, 7133 flags, recv_ill, ip_policy); 7134 IP_STAT(ipst, ip_udp_fannorm); 7135 CONN_DEC_REF(connp); 7136 return; 7137 } 7138 7139 /* 7140 * Broadcast and multicast case 7141 * 7142 * Need to check conn_wantpacket(). 7143 * If SO_REUSEADDR has been set on the first we send the 7144 * packet to all clients that have joined the group and 7145 * match the port. 7146 */ 7147 7148 while (connp != NULL) { 7149 if ((IPCL_UDP_MATCH(connp, dstport, dst, srcport, src)) && 7150 conn_wantpacket(connp, ill, ipha, flags, zoneid) && 7151 (!is_system_labeled() || 7152 tsol_receive_local(mp, &dst, IPV4_VERSION, shared_addr, 7153 connp))) 7154 break; 7155 connp = connp->conn_next; 7156 } 7157 7158 if (connp == NULL || connp->conn_upq == NULL) 7159 goto notfound; 7160 7161 first_connp = connp; 7162 /* 7163 * When SO_REUSEADDR is not set, send the packet only to the first 7164 * matching connection in its zone by keeping track of the zoneid. 7165 */ 7166 reuseaddr = first_connp->conn_reuseaddr; 7167 last_zoneid = first_connp->conn_zoneid; 7168 7169 CONN_INC_REF(connp); 7170 connp = connp->conn_next; 7171 for (;;) { 7172 while (connp != NULL) { 7173 if (IPCL_UDP_MATCH(connp, dstport, dst, srcport, src) && 7174 (reuseaddr || connp->conn_zoneid != last_zoneid) && 7175 conn_wantpacket(connp, ill, ipha, flags, zoneid) && 7176 (!is_system_labeled() || 7177 tsol_receive_local(mp, &dst, IPV4_VERSION, 7178 shared_addr, connp))) 7179 break; 7180 connp = connp->conn_next; 7181 } 7182 /* 7183 * Just copy the data part alone. The mctl part is 7184 * needed just for verifying policy and it is never 7185 * sent up. 7186 */ 7187 if (connp == NULL || (((mp1 = dupmsg(mp)) == NULL) && 7188 ((mp1 = copymsg(mp)) == NULL))) { 7189 /* 7190 * No more interested clients or memory 7191 * allocation failed 7192 */ 7193 connp = first_connp; 7194 break; 7195 } 7196 if (connp->conn_zoneid != last_zoneid) { 7197 /* 7198 * Update the zoneid so that the packet isn't sent to 7199 * any more conns in the same zone unless SO_REUSEADDR 7200 * is set. 7201 */ 7202 reuseaddr = connp->conn_reuseaddr; 7203 last_zoneid = connp->conn_zoneid; 7204 } 7205 if (first_mp != NULL) { 7206 ASSERT(((ipsec_info_t *)first_mp->b_rptr)-> 7207 ipsec_info_type == IPSEC_IN); 7208 first_mp1 = ipsec_in_tag(first_mp, NULL, 7209 ipst->ips_netstack); 7210 if (first_mp1 == NULL) { 7211 freemsg(mp1); 7212 connp = first_connp; 7213 break; 7214 } 7215 } else { 7216 first_mp1 = NULL; 7217 } 7218 CONN_INC_REF(connp); 7219 mutex_exit(&connfp->connf_lock); 7220 /* 7221 * IPQoS notes: We don't send the packet for policy 7222 * processing here, will do it for the last one (below). 7223 * i.e. we do it per-packet now, but if we do policy 7224 * processing per-conn, then we would need to do it 7225 * here too. 7226 */ 7227 ip_fanout_udp_conn(connp, first_mp1, mp1, secure, ill, 7228 ipha, flags, recv_ill, B_FALSE); 7229 mutex_enter(&connfp->connf_lock); 7230 /* Follow the next pointer before releasing the conn. */ 7231 next_connp = connp->conn_next; 7232 IP_STAT(ipst, ip_udp_fanmb); 7233 CONN_DEC_REF(connp); 7234 connp = next_connp; 7235 } 7236 7237 /* Last one. Send it upstream. */ 7238 mutex_exit(&connfp->connf_lock); 7239 ip_fanout_udp_conn(connp, first_mp, mp, secure, ill, ipha, flags, 7240 recv_ill, ip_policy); 7241 IP_STAT(ipst, ip_udp_fanmb); 7242 CONN_DEC_REF(connp); 7243 return; 7244 7245 notfound: 7246 7247 mutex_exit(&connfp->connf_lock); 7248 IP_STAT(ipst, ip_udp_fanothers); 7249 /* 7250 * IPv6 endpoints bound to unicast or multicast IPv4-mapped addresses 7251 * have already been matched above, since they live in the IPv4 7252 * fanout tables. This implies we only need to 7253 * check for IPv6 in6addr_any endpoints here. 7254 * Thus we compare using ipv6_all_zeros instead of the destination 7255 * address, except for the multicast group membership lookup which 7256 * uses the IPv4 destination. 7257 */ 7258 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src); 7259 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(dstport, ipst)]; 7260 mutex_enter(&connfp->connf_lock); 7261 connp = connfp->connf_head; 7262 if (!broadcast && !CLASSD(dst)) { 7263 while (connp != NULL) { 7264 if (IPCL_UDP_MATCH_V6(connp, dstport, ipv6_all_zeros, 7265 srcport, v6src) && IPCL_ZONE_MATCH(connp, zoneid) && 7266 conn_wantpacket(connp, ill, ipha, flags, zoneid) && 7267 !connp->conn_ipv6_v6only) 7268 break; 7269 connp = connp->conn_next; 7270 } 7271 7272 if (connp != NULL && is_system_labeled() && 7273 !tsol_receive_local(mp, &dst, IPV4_VERSION, shared_addr, 7274 connp)) 7275 connp = NULL; 7276 7277 if (connp == NULL || connp->conn_upq == NULL) { 7278 /* 7279 * No one bound to this port. Is 7280 * there a client that wants all 7281 * unclaimed datagrams? 7282 */ 7283 mutex_exit(&connfp->connf_lock); 7284 7285 if (mctl_present) 7286 first_mp->b_cont = mp; 7287 else 7288 first_mp = mp; 7289 if (ipst->ips_ipcl_proto_fanout[IPPROTO_UDP]. 7290 connf_head != NULL) { 7291 ip_fanout_proto(q, first_mp, ill, ipha, 7292 flags | IP_FF_RAWIP, mctl_present, 7293 ip_policy, recv_ill, zoneid); 7294 } else { 7295 if (ip_fanout_send_icmp(q, first_mp, flags, 7296 ICMP_DEST_UNREACHABLE, 7297 ICMP_PORT_UNREACHABLE, 7298 mctl_present, zoneid, ipst)) { 7299 BUMP_MIB(ill->ill_ip_mib, 7300 udpIfStatsNoPorts); 7301 } 7302 } 7303 return; 7304 } 7305 7306 CONN_INC_REF(connp); 7307 mutex_exit(&connfp->connf_lock); 7308 ip_fanout_udp_conn(connp, first_mp, mp, secure, ill, ipha, 7309 flags, recv_ill, ip_policy); 7310 CONN_DEC_REF(connp); 7311 return; 7312 } 7313 /* 7314 * IPv4 multicast packet being delivered to an AF_INET6 7315 * in6addr_any endpoint. 7316 * Need to check conn_wantpacket(). Note that we use conn_wantpacket() 7317 * and not conn_wantpacket_v6() since any multicast membership is 7318 * for an IPv4-mapped multicast address. 7319 * The packet is sent to all clients in all zones that have joined the 7320 * group and match the port. 7321 */ 7322 while (connp != NULL) { 7323 if (IPCL_UDP_MATCH_V6(connp, dstport, ipv6_all_zeros, 7324 srcport, v6src) && 7325 conn_wantpacket(connp, ill, ipha, flags, zoneid) && 7326 (!is_system_labeled() || 7327 tsol_receive_local(mp, &dst, IPV4_VERSION, shared_addr, 7328 connp))) 7329 break; 7330 connp = connp->conn_next; 7331 } 7332 7333 if (connp == NULL || connp->conn_upq == NULL) { 7334 /* 7335 * No one bound to this port. Is 7336 * there a client that wants all 7337 * unclaimed datagrams? 7338 */ 7339 mutex_exit(&connfp->connf_lock); 7340 7341 if (mctl_present) 7342 first_mp->b_cont = mp; 7343 else 7344 first_mp = mp; 7345 if (ipst->ips_ipcl_proto_fanout[IPPROTO_UDP].connf_head != 7346 NULL) { 7347 ip_fanout_proto(q, first_mp, ill, ipha, 7348 flags | IP_FF_RAWIP, mctl_present, ip_policy, 7349 recv_ill, zoneid); 7350 } else { 7351 /* 7352 * We used to attempt to send an icmp error here, but 7353 * since this is known to be a multicast packet 7354 * and we don't send icmp errors in response to 7355 * multicast, just drop the packet and give up sooner. 7356 */ 7357 BUMP_MIB(ill->ill_ip_mib, udpIfStatsNoPorts); 7358 freemsg(first_mp); 7359 } 7360 return; 7361 } 7362 7363 first_connp = connp; 7364 7365 CONN_INC_REF(connp); 7366 connp = connp->conn_next; 7367 for (;;) { 7368 while (connp != NULL) { 7369 if (IPCL_UDP_MATCH_V6(connp, dstport, 7370 ipv6_all_zeros, srcport, v6src) && 7371 conn_wantpacket(connp, ill, ipha, flags, zoneid) && 7372 (!is_system_labeled() || 7373 tsol_receive_local(mp, &dst, IPV4_VERSION, 7374 shared_addr, connp))) 7375 break; 7376 connp = connp->conn_next; 7377 } 7378 /* 7379 * Just copy the data part alone. The mctl part is 7380 * needed just for verifying policy and it is never 7381 * sent up. 7382 */ 7383 if (connp == NULL || (((mp1 = dupmsg(mp)) == NULL) && 7384 ((mp1 = copymsg(mp)) == NULL))) { 7385 /* 7386 * No more intested clients or memory 7387 * allocation failed 7388 */ 7389 connp = first_connp; 7390 break; 7391 } 7392 if (first_mp != NULL) { 7393 ASSERT(((ipsec_info_t *)first_mp->b_rptr)-> 7394 ipsec_info_type == IPSEC_IN); 7395 first_mp1 = ipsec_in_tag(first_mp, NULL, 7396 ipst->ips_netstack); 7397 if (first_mp1 == NULL) { 7398 freemsg(mp1); 7399 connp = first_connp; 7400 break; 7401 } 7402 } else { 7403 first_mp1 = NULL; 7404 } 7405 CONN_INC_REF(connp); 7406 mutex_exit(&connfp->connf_lock); 7407 /* 7408 * IPQoS notes: We don't send the packet for policy 7409 * processing here, will do it for the last one (below). 7410 * i.e. we do it per-packet now, but if we do policy 7411 * processing per-conn, then we would need to do it 7412 * here too. 7413 */ 7414 ip_fanout_udp_conn(connp, first_mp1, mp1, secure, ill, 7415 ipha, flags, recv_ill, B_FALSE); 7416 mutex_enter(&connfp->connf_lock); 7417 /* Follow the next pointer before releasing the conn. */ 7418 next_connp = connp->conn_next; 7419 CONN_DEC_REF(connp); 7420 connp = next_connp; 7421 } 7422 7423 /* Last one. Send it upstream. */ 7424 mutex_exit(&connfp->connf_lock); 7425 ip_fanout_udp_conn(connp, first_mp, mp, secure, ill, ipha, flags, 7426 recv_ill, ip_policy); 7427 CONN_DEC_REF(connp); 7428 } 7429 7430 /* 7431 * Complete the ip_wput header so that it 7432 * is possible to generate ICMP 7433 * errors. 7434 */ 7435 int 7436 ip_hdr_complete(ipha_t *ipha, zoneid_t zoneid, ip_stack_t *ipst) 7437 { 7438 ire_t *ire; 7439 7440 if (ipha->ipha_src == INADDR_ANY) { 7441 ire = ire_lookup_local(zoneid, ipst); 7442 if (ire == NULL) { 7443 ip1dbg(("ip_hdr_complete: no source IRE\n")); 7444 return (1); 7445 } 7446 ipha->ipha_src = ire->ire_addr; 7447 ire_refrele(ire); 7448 } 7449 ipha->ipha_ttl = ipst->ips_ip_def_ttl; 7450 ipha->ipha_hdr_checksum = 0; 7451 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 7452 return (0); 7453 } 7454 7455 /* 7456 * Nobody should be sending 7457 * packets up this stream 7458 */ 7459 static void 7460 ip_lrput(queue_t *q, mblk_t *mp) 7461 { 7462 mblk_t *mp1; 7463 7464 switch (mp->b_datap->db_type) { 7465 case M_FLUSH: 7466 /* Turn around */ 7467 if (*mp->b_rptr & FLUSHW) { 7468 *mp->b_rptr &= ~FLUSHR; 7469 qreply(q, mp); 7470 return; 7471 } 7472 break; 7473 } 7474 /* Could receive messages that passed through ar_rput */ 7475 for (mp1 = mp; mp1; mp1 = mp1->b_cont) 7476 mp1->b_prev = mp1->b_next = NULL; 7477 freemsg(mp); 7478 } 7479 7480 /* Nobody should be sending packets down this stream */ 7481 /* ARGSUSED */ 7482 void 7483 ip_lwput(queue_t *q, mblk_t *mp) 7484 { 7485 freemsg(mp); 7486 } 7487 7488 /* 7489 * Move the first hop in any source route to ipha_dst and remove that part of 7490 * the source route. Called by other protocols. Errors in option formatting 7491 * are ignored - will be handled by ip_wput_options Return the final 7492 * destination (either ipha_dst or the last entry in a source route.) 7493 */ 7494 ipaddr_t 7495 ip_massage_options(ipha_t *ipha, netstack_t *ns) 7496 { 7497 ipoptp_t opts; 7498 uchar_t *opt; 7499 uint8_t optval; 7500 uint8_t optlen; 7501 ipaddr_t dst; 7502 int i; 7503 ire_t *ire; 7504 ip_stack_t *ipst = ns->netstack_ip; 7505 7506 ip2dbg(("ip_massage_options\n")); 7507 dst = ipha->ipha_dst; 7508 for (optval = ipoptp_first(&opts, ipha); 7509 optval != IPOPT_EOL; 7510 optval = ipoptp_next(&opts)) { 7511 opt = opts.ipoptp_cur; 7512 switch (optval) { 7513 uint8_t off; 7514 case IPOPT_SSRR: 7515 case IPOPT_LSRR: 7516 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 7517 ip1dbg(("ip_massage_options: bad src route\n")); 7518 break; 7519 } 7520 optlen = opts.ipoptp_len; 7521 off = opt[IPOPT_OFFSET]; 7522 off--; 7523 redo_srr: 7524 if (optlen < IP_ADDR_LEN || 7525 off > optlen - IP_ADDR_LEN) { 7526 /* End of source route */ 7527 ip1dbg(("ip_massage_options: end of SR\n")); 7528 break; 7529 } 7530 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 7531 ip1dbg(("ip_massage_options: next hop 0x%x\n", 7532 ntohl(dst))); 7533 /* 7534 * Check if our address is present more than 7535 * once as consecutive hops in source route. 7536 * XXX verify per-interface ip_forwarding 7537 * for source route? 7538 */ 7539 ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL, 7540 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 7541 if (ire != NULL) { 7542 ire_refrele(ire); 7543 off += IP_ADDR_LEN; 7544 goto redo_srr; 7545 } 7546 if (dst == htonl(INADDR_LOOPBACK)) { 7547 ip1dbg(("ip_massage_options: loopback addr in " 7548 "source route!\n")); 7549 break; 7550 } 7551 /* 7552 * Update ipha_dst to be the first hop and remove the 7553 * first hop from the source route (by overwriting 7554 * part of the option with NOP options). 7555 */ 7556 ipha->ipha_dst = dst; 7557 /* Put the last entry in dst */ 7558 off = ((optlen - IP_ADDR_LEN - 3) & ~(IP_ADDR_LEN-1)) + 7559 3; 7560 bcopy(&opt[off], &dst, IP_ADDR_LEN); 7561 7562 ip1dbg(("ip_massage_options: last hop 0x%x\n", 7563 ntohl(dst))); 7564 /* Move down and overwrite */ 7565 opt[IP_ADDR_LEN] = opt[0]; 7566 opt[IP_ADDR_LEN+1] = opt[IPOPT_OLEN] - IP_ADDR_LEN; 7567 opt[IP_ADDR_LEN+2] = opt[IPOPT_OFFSET]; 7568 for (i = 0; i < IP_ADDR_LEN; i++) 7569 opt[i] = IPOPT_NOP; 7570 break; 7571 } 7572 } 7573 return (dst); 7574 } 7575 7576 /* 7577 * This function's job is to forward data to the reverse tunnel (FA->HA) 7578 * after doing a few checks. It is assumed that the incoming interface 7579 * of the packet is always different than the outgoing interface and the 7580 * ire_type of the found ire has to be a non-resolver type. 7581 * 7582 * IPQoS notes 7583 * IP policy is invoked twice for a forwarded packet, once on the read side 7584 * and again on the write side if both, IPP_FWD_IN and IPP_FWD_OUT are 7585 * enabled. 7586 */ 7587 static void 7588 ip_mrtun_forward(ire_t *ire, ill_t *in_ill, mblk_t *mp) 7589 { 7590 ipha_t *ipha; 7591 queue_t *q; 7592 uint32_t pkt_len; 7593 #define rptr ((uchar_t *)ipha) 7594 uint32_t sum; 7595 uint32_t max_frag; 7596 mblk_t *first_mp; 7597 uint32_t ill_index; 7598 ipxmit_state_t pktxmit_state; 7599 ill_t *out_ill; 7600 ip_stack_t *ipst = in_ill->ill_ipst; 7601 7602 ASSERT(ire != NULL); 7603 ASSERT(ire->ire_ipif->ipif_net_type == IRE_IF_NORESOLVER); 7604 ASSERT(ire->ire_stq != NULL); 7605 7606 /* Initiate read side IPPF processing */ 7607 if (IPP_ENABLED(IPP_FWD_IN, ipst)) { 7608 ill_index = in_ill->ill_phyint->phyint_ifindex; 7609 ip_process(IPP_FWD_IN, &mp, ill_index); 7610 if (mp == NULL) { 7611 ip2dbg(("ip_mrtun_forward: inbound pkt " 7612 "dropped during IPPF processing\n")); 7613 return; 7614 } 7615 } 7616 7617 if (((in_ill->ill_flags & ((ill_t *)ire->ire_stq->q_ptr)->ill_flags & 7618 ILLF_ROUTER) == 0) || 7619 (in_ill == (ill_t *)ire->ire_stq->q_ptr)) { 7620 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsForwProhibits); 7621 ip0dbg(("ip_mrtun_forward: Can't forward :" 7622 "forwarding is not turned on\n")); 7623 goto drop_pkt; 7624 } 7625 7626 /* 7627 * Don't forward if the interface is down 7628 */ 7629 if (ire->ire_ipif->ipif_ill->ill_ipif_up_count == 0) { 7630 goto discard_pkt; 7631 } 7632 7633 ipha = (ipha_t *)mp->b_rptr; 7634 pkt_len = ntohs(ipha->ipha_length); 7635 /* Adjust the checksum to reflect the ttl decrement. */ 7636 sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST; 7637 ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16)); 7638 if (ipha->ipha_ttl-- <= 1) { 7639 if (ip_csum_hdr(ipha)) { 7640 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsInCksumErrs); 7641 goto drop_pkt; 7642 } 7643 q = ire->ire_stq; 7644 if ((first_mp = allocb(sizeof (ipsec_info_t), 7645 BPRI_HI)) == NULL) { 7646 goto discard_pkt; 7647 } 7648 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsForwProhibits); 7649 ip_ipsec_out_prepend(first_mp, mp, in_ill); 7650 /* Sent by forwarding path, and router is global zone */ 7651 icmp_time_exceeded(q, first_mp, ICMP_TTL_EXCEEDED, 7652 GLOBAL_ZONEID, ipst); 7653 return; 7654 } 7655 7656 /* Get the ill_index of the ILL */ 7657 ill_index = ire->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex; 7658 7659 /* 7660 * This location is chosen for the placement of the forwarding hook 7661 * because at this point we know that we have a path out for the 7662 * packet but haven't yet applied any logic (such as fragmenting) 7663 * that happen as part of transmitting the packet out. 7664 */ 7665 out_ill = ire->ire_ipif->ipif_ill; 7666 7667 DTRACE_PROBE4(ip4__forwarding__start, 7668 ill_t *, in_ill, ill_t *, out_ill, ipha_t *, ipha, mblk_t *, mp); 7669 7670 FW_HOOKS(ipst->ips_ip4_forwarding_event, 7671 ipst->ips_ipv4firewall_forwarding, 7672 in_ill, out_ill, ipha, mp, mp, ipst); 7673 7674 DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp); 7675 7676 if (mp == NULL) 7677 return; 7678 pkt_len = ntohs(ipha->ipha_length); 7679 7680 /* 7681 * ip_mrtun_forward is only used by foreign agent to reverse 7682 * tunnel the incoming packet. So it does not do any option 7683 * processing for source routing. 7684 */ 7685 max_frag = ire->ire_max_frag; 7686 if (pkt_len > max_frag) { 7687 /* 7688 * It needs fragging on its way out. We haven't 7689 * verified the header checksum yet. Since we 7690 * are going to put a surely good checksum in the 7691 * outgoing header, we have to make sure that it 7692 * was good coming in. 7693 */ 7694 if (ip_csum_hdr(ipha)) { 7695 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsInCksumErrs); 7696 goto drop_pkt; 7697 } 7698 7699 /* Initiate write side IPPF processing */ 7700 if (IPP_ENABLED(IPP_FWD_OUT, ipst)) { 7701 ip_process(IPP_FWD_OUT, &mp, ill_index); 7702 if (mp == NULL) { 7703 ip2dbg(("ip_mrtun_forward: outbound pkt "\ 7704 "dropped/deferred during ip policy "\ 7705 "processing\n")); 7706 return; 7707 } 7708 } 7709 if ((first_mp = allocb(sizeof (ipsec_info_t), 7710 BPRI_HI)) == NULL) { 7711 goto discard_pkt; 7712 } 7713 ip_ipsec_out_prepend(first_mp, mp, in_ill); 7714 mp = first_mp; 7715 7716 ip_wput_frag(ire, mp, IB_PKT, max_frag, 0, GLOBAL_ZONEID, ipst); 7717 return; 7718 } 7719 7720 ip2dbg(("ip_mrtun_forward: ire type (%d)\n", ire->ire_type)); 7721 7722 ASSERT(ire->ire_ipif != NULL); 7723 7724 DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL, 7725 ill_t *, out_ill, ipha_t *, ipha, mblk_t *, mp); 7726 FW_HOOKS(ipst->ips_ip4_physical_out_event, 7727 ipst->ips_ipv4firewall_physical_out, 7728 NULL, out_ill, ipha, mp, mp, ipst); 7729 DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp); 7730 if (mp == NULL) 7731 return; 7732 7733 /* Now send the packet to the tunnel interface */ 7734 mp->b_prev = SET_BPREV_FLAG(IPP_FWD_OUT); 7735 q = ire->ire_stq; 7736 pktxmit_state = ip_xmit_v4(mp, ire, NULL, B_FALSE); 7737 if ((pktxmit_state == SEND_FAILED) || 7738 (pktxmit_state == LLHDR_RESLV_FAILED)) { 7739 ip2dbg(("ip_mrtun_forward: failed to send packet to ill %p\n", 7740 q->q_ptr)); 7741 } 7742 7743 return; 7744 discard_pkt: 7745 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsInDiscards); 7746 drop_pkt:; 7747 ip2dbg(("ip_mrtun_forward: dropping pkt\n")); 7748 freemsg(mp); 7749 #undef rptr 7750 } 7751 7752 /* 7753 * Fills the ipsec_out_t data structure with appropriate fields and 7754 * prepends it to mp which contains the IP hdr + data that was meant 7755 * to be forwarded. Please note that ipsec_out_info data structure 7756 * is used here to communicate the outgoing ill path at ip_wput() 7757 * for the ICMP error packet. This has nothing to do with ipsec IP 7758 * security. ipsec_out_t is really used to pass the info to the module 7759 * IP where this information cannot be extracted from conn. 7760 * This functions is called by ip_mrtun_forward(). 7761 */ 7762 void 7763 ip_ipsec_out_prepend(mblk_t *first_mp, mblk_t *mp, ill_t *xmit_ill) 7764 { 7765 ipsec_out_t *io; 7766 7767 ASSERT(xmit_ill != NULL); 7768 first_mp->b_datap->db_type = M_CTL; 7769 first_mp->b_wptr += sizeof (ipsec_info_t); 7770 /* 7771 * This is to pass info to ip_wput in absence of conn. 7772 * ipsec_out_secure will be B_FALSE because of this. 7773 * Thus ipsec_out_secure being B_FALSE indicates that 7774 * this is not IPSEC security related information. 7775 */ 7776 bzero(first_mp->b_rptr, sizeof (ipsec_info_t)); 7777 io = (ipsec_out_t *)first_mp->b_rptr; 7778 io->ipsec_out_type = IPSEC_OUT; 7779 io->ipsec_out_len = sizeof (ipsec_out_t); 7780 first_mp->b_cont = mp; 7781 io->ipsec_out_ill_index = 7782 xmit_ill->ill_phyint->phyint_ifindex; 7783 io->ipsec_out_xmit_if = B_TRUE; 7784 io->ipsec_out_ns = xmit_ill->ill_ipst->ips_netstack; 7785 } 7786 7787 /* 7788 * Return the network mask 7789 * associated with the specified address. 7790 */ 7791 ipaddr_t 7792 ip_net_mask(ipaddr_t addr) 7793 { 7794 uchar_t *up = (uchar_t *)&addr; 7795 ipaddr_t mask = 0; 7796 uchar_t *maskp = (uchar_t *)&mask; 7797 7798 #if defined(__i386) || defined(__amd64) 7799 #define TOTALLY_BRAIN_DAMAGED_C_COMPILER 7800 #endif 7801 #ifdef TOTALLY_BRAIN_DAMAGED_C_COMPILER 7802 maskp[0] = maskp[1] = maskp[2] = maskp[3] = 0; 7803 #endif 7804 if (CLASSD(addr)) { 7805 maskp[0] = 0xF0; 7806 return (mask); 7807 } 7808 if (addr == 0) 7809 return (0); 7810 maskp[0] = 0xFF; 7811 if ((up[0] & 0x80) == 0) 7812 return (mask); 7813 7814 maskp[1] = 0xFF; 7815 if ((up[0] & 0xC0) == 0x80) 7816 return (mask); 7817 7818 maskp[2] = 0xFF; 7819 if ((up[0] & 0xE0) == 0xC0) 7820 return (mask); 7821 7822 /* Must be experimental or multicast, indicate as much */ 7823 return ((ipaddr_t)0); 7824 } 7825 7826 /* 7827 * Select an ill for the packet by considering load spreading across 7828 * a different ill in the group if dst_ill is part of some group. 7829 */ 7830 ill_t * 7831 ip_newroute_get_dst_ill(ill_t *dst_ill) 7832 { 7833 ill_t *ill; 7834 7835 /* 7836 * We schedule irrespective of whether the source address is 7837 * INADDR_ANY or not. illgrp_scheduler returns a held ill. 7838 */ 7839 ill = illgrp_scheduler(dst_ill); 7840 if (ill == NULL) 7841 return (NULL); 7842 7843 /* 7844 * For groups with names ip_sioctl_groupname ensures that all 7845 * ills are of same type. For groups without names, ifgrp_insert 7846 * ensures this. 7847 */ 7848 ASSERT(dst_ill->ill_type == ill->ill_type); 7849 7850 return (ill); 7851 } 7852 7853 /* 7854 * Helper function for the IPIF_NOFAILOVER/ATTACH_IF interface attachment case. 7855 */ 7856 ill_t * 7857 ip_grab_attach_ill(ill_t *ill, mblk_t *first_mp, int ifindex, boolean_t isv6, 7858 ip_stack_t *ipst) 7859 { 7860 ill_t *ret_ill; 7861 7862 ASSERT(ifindex != 0); 7863 ret_ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL, 7864 ipst); 7865 if (ret_ill == NULL || 7866 (ret_ill->ill_phyint->phyint_flags & PHYI_OFFLINE)) { 7867 if (isv6) { 7868 if (ill != NULL) { 7869 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 7870 } else { 7871 BUMP_MIB(&ipst->ips_ip6_mib, 7872 ipIfStatsOutDiscards); 7873 } 7874 ip1dbg(("ip_grab_attach_ill (IPv6): " 7875 "bad ifindex %d.\n", ifindex)); 7876 } else { 7877 if (ill != NULL) { 7878 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 7879 } else { 7880 BUMP_MIB(&ipst->ips_ip_mib, 7881 ipIfStatsOutDiscards); 7882 } 7883 ip1dbg(("ip_grab_attach_ill (IPv4): " 7884 "bad ifindex %d.\n", ifindex)); 7885 } 7886 if (ret_ill != NULL) 7887 ill_refrele(ret_ill); 7888 freemsg(first_mp); 7889 return (NULL); 7890 } 7891 7892 return (ret_ill); 7893 } 7894 7895 /* 7896 * IPv4 - 7897 * ip_newroute is called by ip_rput or ip_wput whenever we need to send 7898 * out a packet to a destination address for which we do not have specific 7899 * (or sufficient) routing information. 7900 * 7901 * NOTE : These are the scopes of some of the variables that point at IRE, 7902 * which needs to be followed while making any future modifications 7903 * to avoid memory leaks. 7904 * 7905 * - ire and sire are the entries looked up initially by 7906 * ire_ftable_lookup. 7907 * - ipif_ire is used to hold the interface ire associated with 7908 * the new cache ire. But it's scope is limited, so we always REFRELE 7909 * it before branching out to error paths. 7910 * - save_ire is initialized before ire_create, so that ire returned 7911 * by ire_create will not over-write the ire. We REFRELE save_ire 7912 * before breaking out of the switch. 7913 * 7914 * Thus on failures, we have to REFRELE only ire and sire, if they 7915 * are not NULL. 7916 */ 7917 void 7918 ip_newroute(queue_t *q, mblk_t *mp, ipaddr_t dst, ill_t *in_ill, conn_t *connp, 7919 zoneid_t zoneid, ip_stack_t *ipst) 7920 { 7921 areq_t *areq; 7922 ipaddr_t gw = 0; 7923 ire_t *ire = NULL; 7924 mblk_t *res_mp; 7925 ipaddr_t *addrp; 7926 ipaddr_t nexthop_addr; 7927 ipif_t *src_ipif = NULL; 7928 ill_t *dst_ill = NULL; 7929 ipha_t *ipha; 7930 ire_t *sire = NULL; 7931 mblk_t *first_mp; 7932 ire_t *save_ire; 7933 ill_t *attach_ill = NULL; /* Bind to IPIF_NOFAILOVER address */ 7934 ushort_t ire_marks = 0; 7935 boolean_t mctl_present; 7936 ipsec_out_t *io; 7937 mblk_t *saved_mp; 7938 ire_t *first_sire = NULL; 7939 mblk_t *copy_mp = NULL; 7940 mblk_t *xmit_mp = NULL; 7941 ipaddr_t save_dst; 7942 uint32_t multirt_flags = 7943 MULTIRT_CACHEGW | MULTIRT_USESTAMP | MULTIRT_SETSTAMP; 7944 boolean_t multirt_is_resolvable; 7945 boolean_t multirt_resolve_next; 7946 boolean_t do_attach_ill = B_FALSE; 7947 boolean_t ip_nexthop = B_FALSE; 7948 tsol_ire_gw_secattr_t *attrp = NULL; 7949 tsol_gcgrp_t *gcgrp = NULL; 7950 tsol_gcgrp_addr_t ga; 7951 7952 if (ip_debug > 2) { 7953 /* ip1dbg */ 7954 pr_addr_dbg("ip_newroute: dst %s\n", AF_INET, &dst); 7955 } 7956 7957 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 7958 if (mctl_present) { 7959 io = (ipsec_out_t *)first_mp->b_rptr; 7960 ASSERT(io->ipsec_out_type == IPSEC_OUT); 7961 ASSERT(zoneid == io->ipsec_out_zoneid); 7962 ASSERT(zoneid != ALL_ZONES); 7963 } 7964 7965 ipha = (ipha_t *)mp->b_rptr; 7966 7967 /* All multicast lookups come through ip_newroute_ipif() */ 7968 if (CLASSD(dst)) { 7969 ip0dbg(("ip_newroute: CLASSD 0x%x (b_prev %p, b_next %p)\n", 7970 ntohl(dst), (void *)mp->b_prev, (void *)mp->b_next)); 7971 freemsg(first_mp); 7972 return; 7973 } 7974 7975 if (mctl_present && io->ipsec_out_attach_if) { 7976 /* ip_grab_attach_ill returns a held ill */ 7977 attach_ill = ip_grab_attach_ill(NULL, first_mp, 7978 io->ipsec_out_ill_index, B_FALSE, ipst); 7979 7980 /* Failure case frees things for us. */ 7981 if (attach_ill == NULL) 7982 return; 7983 7984 /* 7985 * Check if we need an ire that will not be 7986 * looked up by anybody else i.e. HIDDEN. 7987 */ 7988 if (ill_is_probeonly(attach_ill)) 7989 ire_marks = IRE_MARK_HIDDEN; 7990 } 7991 if (mctl_present && io->ipsec_out_ip_nexthop) { 7992 ip_nexthop = B_TRUE; 7993 nexthop_addr = io->ipsec_out_nexthop_addr; 7994 } 7995 /* 7996 * If this IRE is created for forwarding or it is not for 7997 * traffic for congestion controlled protocols, mark it as temporary. 7998 */ 7999 if (mp->b_prev != NULL || !IP_FLOW_CONTROLLED_ULP(ipha->ipha_protocol)) 8000 ire_marks |= IRE_MARK_TEMPORARY; 8001 8002 /* 8003 * Get what we can from ire_ftable_lookup which will follow an IRE 8004 * chain until it gets the most specific information available. 8005 * For example, we know that there is no IRE_CACHE for this dest, 8006 * but there may be an IRE_OFFSUBNET which specifies a gateway. 8007 * ire_ftable_lookup will look up the gateway, etc. 8008 * Check if in_ill != NULL. If it is true, the packet must be 8009 * from an incoming interface where RTA_SRCIFP is set. 8010 * Otherwise, given ire_ftable_lookup algorithm, only one among routes 8011 * to the destination, of equal netmask length in the forward table, 8012 * will be recursively explored. If no information is available 8013 * for the final gateway of that route, we force the returned ire 8014 * to be equal to sire using MATCH_IRE_PARENT. 8015 * At least, in this case we have a starting point (in the buckets) 8016 * to look for other routes to the destination in the forward table. 8017 * This is actually used only for multirouting, where a list 8018 * of routes has to be processed in sequence. 8019 * 8020 * In the process of coming up with the most specific information, 8021 * ire_ftable_lookup may end up with an incomplete IRE_CACHE entry 8022 * for the gateway (i.e., one for which the ire_nce->nce_state is 8023 * not yet ND_REACHABLE, and is in the middle of arp resolution). 8024 * Two caveats when handling incomplete ire's in ip_newroute: 8025 * - we should be careful when accessing its ire_nce (specifically 8026 * the nce_res_mp) ast it might change underneath our feet, and, 8027 * - not all legacy code path callers are prepared to handle 8028 * incomplete ire's, so we should not create/add incomplete 8029 * ire_cache entries here. (See discussion about temporary solution 8030 * further below). 8031 * 8032 * In order to minimize packet dropping, and to preserve existing 8033 * behavior, we treat this case as if there were no IRE_CACHE for the 8034 * gateway, and instead use the IF_RESOLVER ire to send out 8035 * another request to ARP (this is achieved by passing the 8036 * MATCH_IRE_COMPLETE flag to ire_ftable_lookup). When the 8037 * arp response comes back in ip_wput_nondata, we will create 8038 * a per-dst ire_cache that has an ND_COMPLETE ire. 8039 * 8040 * Note that this is a temporary solution; the correct solution is 8041 * to create an incomplete per-dst ire_cache entry, and send the 8042 * packet out when the gw's nce is resolved. In order to achieve this, 8043 * all packet processing must have been completed prior to calling 8044 * ire_add_then_send. Some legacy code paths (e.g. cgtp) would need 8045 * to be modified to accomodate this solution. 8046 */ 8047 if (in_ill != NULL) { 8048 ire = ire_srcif_table_lookup(dst, IRE_IF_RESOLVER, NULL, 8049 in_ill, MATCH_IRE_TYPE); 8050 } else if (ip_nexthop) { 8051 /* 8052 * The first time we come here, we look for an IRE_INTERFACE 8053 * entry for the specified nexthop, set the dst to be the 8054 * nexthop address and create an IRE_CACHE entry for the 8055 * nexthop. The next time around, we are able to find an 8056 * IRE_CACHE entry for the nexthop, set the gateway to be the 8057 * nexthop address and create an IRE_CACHE entry for the 8058 * destination address via the specified nexthop. 8059 */ 8060 ire = ire_cache_lookup(nexthop_addr, zoneid, 8061 MBLK_GETLABEL(mp), ipst); 8062 if (ire != NULL) { 8063 gw = nexthop_addr; 8064 ire_marks |= IRE_MARK_PRIVATE_ADDR; 8065 } else { 8066 ire = ire_ftable_lookup(nexthop_addr, 0, 0, 8067 IRE_INTERFACE, NULL, NULL, zoneid, 0, 8068 MBLK_GETLABEL(mp), 8069 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, 8070 ipst); 8071 if (ire != NULL) { 8072 dst = nexthop_addr; 8073 } 8074 } 8075 } else if (attach_ill == NULL) { 8076 ire = ire_ftable_lookup(dst, 0, 0, 0, 8077 NULL, &sire, zoneid, 0, MBLK_GETLABEL(mp), 8078 MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 8079 MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT | 8080 MATCH_IRE_SECATTR | MATCH_IRE_COMPLETE, 8081 ipst); 8082 } else { 8083 /* 8084 * attach_ill is set only for communicating with 8085 * on-link hosts. So, don't look for DEFAULT. 8086 */ 8087 ipif_t *attach_ipif; 8088 8089 attach_ipif = ipif_get_next_ipif(NULL, attach_ill); 8090 if (attach_ipif == NULL) { 8091 ill_refrele(attach_ill); 8092 goto icmp_err_ret; 8093 } 8094 ire = ire_ftable_lookup(dst, 0, 0, 0, attach_ipif, 8095 &sire, zoneid, 0, MBLK_GETLABEL(mp), 8096 MATCH_IRE_RJ_BHOLE | MATCH_IRE_ILL | 8097 MATCH_IRE_SECATTR, ipst); 8098 ipif_refrele(attach_ipif); 8099 } 8100 ip3dbg(("ip_newroute: ire_ftable_lookup() " 8101 "returned ire %p, sire %p\n", (void *)ire, (void *)sire)); 8102 8103 /* 8104 * This loop is run only once in most cases. 8105 * We loop to resolve further routes only when the destination 8106 * can be reached through multiple RTF_MULTIRT-flagged ires. 8107 */ 8108 do { 8109 /* Clear the previous iteration's values */ 8110 if (src_ipif != NULL) { 8111 ipif_refrele(src_ipif); 8112 src_ipif = NULL; 8113 } 8114 if (dst_ill != NULL) { 8115 ill_refrele(dst_ill); 8116 dst_ill = NULL; 8117 } 8118 8119 multirt_resolve_next = B_FALSE; 8120 /* 8121 * We check if packets have to be multirouted. 8122 * In this case, given the current <ire, sire> couple, 8123 * we look for the next suitable <ire, sire>. 8124 * This check is done in ire_multirt_lookup(), 8125 * which applies various criteria to find the next route 8126 * to resolve. ire_multirt_lookup() leaves <ire, sire> 8127 * unchanged if it detects it has not been tried yet. 8128 */ 8129 if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) { 8130 ip3dbg(("ip_newroute: starting next_resolution " 8131 "with first_mp %p, tag %d\n", 8132 (void *)first_mp, 8133 MULTIRT_DEBUG_TAGGED(first_mp))); 8134 8135 ASSERT(sire != NULL); 8136 multirt_is_resolvable = 8137 ire_multirt_lookup(&ire, &sire, multirt_flags, 8138 MBLK_GETLABEL(mp), ipst); 8139 8140 ip3dbg(("ip_newroute: multirt_is_resolvable %d, " 8141 "ire %p, sire %p\n", 8142 multirt_is_resolvable, 8143 (void *)ire, (void *)sire)); 8144 8145 if (!multirt_is_resolvable) { 8146 /* 8147 * No more multirt route to resolve; give up 8148 * (all routes resolved or no more 8149 * resolvable routes). 8150 */ 8151 if (ire != NULL) { 8152 ire_refrele(ire); 8153 ire = NULL; 8154 } 8155 } else { 8156 ASSERT(sire != NULL); 8157 ASSERT(ire != NULL); 8158 /* 8159 * We simply use first_sire as a flag that 8160 * indicates if a resolvable multirt route 8161 * has already been found. 8162 * If it is not the case, we may have to send 8163 * an ICMP error to report that the 8164 * destination is unreachable. 8165 * We do not IRE_REFHOLD first_sire. 8166 */ 8167 if (first_sire == NULL) { 8168 first_sire = sire; 8169 } 8170 } 8171 } 8172 if (ire == NULL) { 8173 if (ip_debug > 3) { 8174 /* ip2dbg */ 8175 pr_addr_dbg("ip_newroute: " 8176 "can't resolve %s\n", AF_INET, &dst); 8177 } 8178 ip3dbg(("ip_newroute: " 8179 "ire %p, sire %p, first_sire %p\n", 8180 (void *)ire, (void *)sire, (void *)first_sire)); 8181 8182 if (sire != NULL) { 8183 ire_refrele(sire); 8184 sire = NULL; 8185 } 8186 8187 if (first_sire != NULL) { 8188 /* 8189 * At least one multirt route has been found 8190 * in the same call to ip_newroute(); 8191 * there is no need to report an ICMP error. 8192 * first_sire was not IRE_REFHOLDed. 8193 */ 8194 MULTIRT_DEBUG_UNTAG(first_mp); 8195 freemsg(first_mp); 8196 return; 8197 } 8198 ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, 8199 RTA_DST, ipst); 8200 if (attach_ill != NULL) 8201 ill_refrele(attach_ill); 8202 goto icmp_err_ret; 8203 } 8204 8205 /* 8206 * When RTA_SRCIFP is used to add a route, then an interface 8207 * route is added in the source interface's routing table. 8208 * If the outgoing interface of this route is of type 8209 * IRE_IF_RESOLVER, then upon creation of the ire, 8210 * ire_nce->nce_res_mp is set to NULL. 8211 * Later, when this route is first used for forwarding 8212 * a packet, ip_newroute() is called 8213 * to resolve the hardware address of the outgoing ipif. 8214 * We do not come here for IRE_IF_NORESOLVER entries in the 8215 * source interface based table. We only come here if the 8216 * outgoing interface is a resolver interface and we don't 8217 * have the ire_nce->nce_res_mp information yet. 8218 * If in_ill is not null that means it is called from 8219 * ip_rput. 8220 */ 8221 8222 ASSERT(ire->ire_in_ill == NULL || 8223 (ire->ire_type == IRE_IF_RESOLVER && 8224 ire->ire_nce != NULL && ire->ire_nce->nce_res_mp == NULL)); 8225 8226 /* 8227 * Verify that the returned IRE does not have either 8228 * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is 8229 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 8230 */ 8231 if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 8232 (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) { 8233 if (attach_ill != NULL) 8234 ill_refrele(attach_ill); 8235 goto icmp_err_ret; 8236 } 8237 /* 8238 * Increment the ire_ob_pkt_count field for ire if it is an 8239 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and 8240 * increment the same for the parent IRE, sire, if it is some 8241 * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST 8242 * and HOST_REDIRECT). 8243 */ 8244 if ((ire->ire_type & IRE_INTERFACE) != 0) { 8245 UPDATE_OB_PKT_COUNT(ire); 8246 ire->ire_last_used_time = lbolt; 8247 } 8248 8249 if (sire != NULL) { 8250 gw = sire->ire_gateway_addr; 8251 ASSERT((sire->ire_type & (IRE_CACHETABLE | 8252 IRE_INTERFACE)) == 0); 8253 UPDATE_OB_PKT_COUNT(sire); 8254 sire->ire_last_used_time = lbolt; 8255 } 8256 /* 8257 * We have a route to reach the destination. 8258 * 8259 * 1) If the interface is part of ill group, try to get a new 8260 * ill taking load spreading into account. 8261 * 8262 * 2) After selecting the ill, get a source address that 8263 * might create good inbound load spreading. 8264 * ipif_select_source does this for us. 8265 * 8266 * If the application specified the ill (ifindex), we still 8267 * load spread. Only if the packets needs to go out 8268 * specifically on a given ill e.g. binding to 8269 * IPIF_NOFAILOVER address, then we don't try to use a 8270 * different ill for load spreading. 8271 */ 8272 if (attach_ill == NULL) { 8273 /* 8274 * Don't perform outbound load spreading in the 8275 * case of an RTF_MULTIRT route, as we actually 8276 * typically want to replicate outgoing packets 8277 * through particular interfaces. 8278 */ 8279 if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) { 8280 dst_ill = ire->ire_ipif->ipif_ill; 8281 /* for uniformity */ 8282 ill_refhold(dst_ill); 8283 } else { 8284 /* 8285 * If we are here trying to create an IRE_CACHE 8286 * for an offlink destination and have the 8287 * IRE_CACHE for the next hop and the latter is 8288 * using virtual IP source address selection i.e 8289 * it's ire->ire_ipif is pointing to a virtual 8290 * network interface (vni) then 8291 * ip_newroute_get_dst_ll() will return the vni 8292 * interface as the dst_ill. Since the vni is 8293 * virtual i.e not associated with any physical 8294 * interface, it cannot be the dst_ill, hence 8295 * in such a case call ip_newroute_get_dst_ll() 8296 * with the stq_ill instead of the ire_ipif ILL. 8297 * The function returns a refheld ill. 8298 */ 8299 if ((ire->ire_type == IRE_CACHE) && 8300 IS_VNI(ire->ire_ipif->ipif_ill)) 8301 dst_ill = ip_newroute_get_dst_ill( 8302 ire->ire_stq->q_ptr); 8303 else 8304 dst_ill = ip_newroute_get_dst_ill( 8305 ire->ire_ipif->ipif_ill); 8306 } 8307 if (dst_ill == NULL) { 8308 if (ip_debug > 2) { 8309 pr_addr_dbg("ip_newroute: " 8310 "no dst ill for dst" 8311 " %s\n", AF_INET, &dst); 8312 } 8313 goto icmp_err_ret; 8314 } 8315 } else { 8316 dst_ill = ire->ire_ipif->ipif_ill; 8317 /* for uniformity */ 8318 ill_refhold(dst_ill); 8319 /* 8320 * We should have found a route matching ill as we 8321 * called ire_ftable_lookup with MATCH_IRE_ILL. 8322 * Rather than asserting, when there is a mismatch, 8323 * we just drop the packet. 8324 */ 8325 if (dst_ill != attach_ill) { 8326 ip0dbg(("ip_newroute: Packet dropped as " 8327 "IPIF_NOFAILOVER ill is %s, " 8328 "ire->ire_ipif->ipif_ill is %s\n", 8329 attach_ill->ill_name, 8330 dst_ill->ill_name)); 8331 ill_refrele(attach_ill); 8332 goto icmp_err_ret; 8333 } 8334 } 8335 /* attach_ill can't go in loop. IPMP and CGTP are disjoint */ 8336 if (attach_ill != NULL) { 8337 ill_refrele(attach_ill); 8338 attach_ill = NULL; 8339 do_attach_ill = B_TRUE; 8340 } 8341 ASSERT(dst_ill != NULL); 8342 ip2dbg(("ip_newroute: dst_ill %s\n", dst_ill->ill_name)); 8343 8344 /* 8345 * Pick the best source address from dst_ill. 8346 * 8347 * 1) If it is part of a multipathing group, we would 8348 * like to spread the inbound packets across different 8349 * interfaces. ipif_select_source picks a random source 8350 * across the different ills in the group. 8351 * 8352 * 2) If it is not part of a multipathing group, we try 8353 * to pick the source address from the destination 8354 * route. Clustering assumes that when we have multiple 8355 * prefixes hosted on an interface, the prefix of the 8356 * source address matches the prefix of the destination 8357 * route. We do this only if the address is not 8358 * DEPRECATED. 8359 * 8360 * 3) If the conn is in a different zone than the ire, we 8361 * need to pick a source address from the right zone. 8362 * 8363 * NOTE : If we hit case (1) above, the prefix of the source 8364 * address picked may not match the prefix of the 8365 * destination routes prefix as ipif_select_source 8366 * does not look at "dst" while picking a source 8367 * address. 8368 * If we want the same behavior as (2), we will need 8369 * to change the behavior of ipif_select_source. 8370 */ 8371 ASSERT(src_ipif == NULL); 8372 if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) { 8373 /* 8374 * The RTF_SETSRC flag is set in the parent ire (sire). 8375 * Check that the ipif matching the requested source 8376 * address still exists. 8377 */ 8378 src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL, 8379 zoneid, NULL, NULL, NULL, NULL, ipst); 8380 } 8381 if (src_ipif == NULL) { 8382 ire_marks |= IRE_MARK_USESRC_CHECK; 8383 if ((dst_ill->ill_group != NULL) || 8384 (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) || 8385 (connp != NULL && ire->ire_zoneid != zoneid && 8386 ire->ire_zoneid != ALL_ZONES) || 8387 (dst_ill->ill_usesrc_ifindex != 0)) { 8388 /* 8389 * If the destination is reachable via a 8390 * given gateway, the selected source address 8391 * should be in the same subnet as the gateway. 8392 * Otherwise, the destination is not reachable. 8393 * 8394 * If there are no interfaces on the same subnet 8395 * as the destination, ipif_select_source gives 8396 * first non-deprecated interface which might be 8397 * on a different subnet than the gateway. 8398 * This is not desirable. Hence pass the dst_ire 8399 * source address to ipif_select_source. 8400 * It is sure that the destination is reachable 8401 * with the dst_ire source address subnet. 8402 * So passing dst_ire source address to 8403 * ipif_select_source will make sure that the 8404 * selected source will be on the same subnet 8405 * as dst_ire source address. 8406 */ 8407 ipaddr_t saddr = ire->ire_ipif->ipif_src_addr; 8408 src_ipif = ipif_select_source(dst_ill, saddr, 8409 zoneid); 8410 if (src_ipif == NULL) { 8411 if (ip_debug > 2) { 8412 pr_addr_dbg("ip_newroute: " 8413 "no src for dst %s ", 8414 AF_INET, &dst); 8415 printf("through interface %s\n", 8416 dst_ill->ill_name); 8417 } 8418 goto icmp_err_ret; 8419 } 8420 } else { 8421 src_ipif = ire->ire_ipif; 8422 ASSERT(src_ipif != NULL); 8423 /* hold src_ipif for uniformity */ 8424 ipif_refhold(src_ipif); 8425 } 8426 } 8427 8428 /* 8429 * Assign a source address while we have the conn. 8430 * We can't have ip_wput_ire pick a source address when the 8431 * packet returns from arp since we need to look at 8432 * conn_unspec_src and conn_zoneid, and we lose the conn when 8433 * going through arp. 8434 * 8435 * NOTE : ip_newroute_v6 does not have this piece of code as 8436 * it uses ip6i to store this information. 8437 */ 8438 if (ipha->ipha_src == INADDR_ANY && 8439 (connp == NULL || !connp->conn_unspec_src)) { 8440 ipha->ipha_src = src_ipif->ipif_src_addr; 8441 } 8442 if (ip_debug > 3) { 8443 /* ip2dbg */ 8444 pr_addr_dbg("ip_newroute: first hop %s\n", 8445 AF_INET, &gw); 8446 } 8447 ip2dbg(("\tire type %s (%d)\n", 8448 ip_nv_lookup(ire_nv_tbl, ire->ire_type), ire->ire_type)); 8449 8450 /* 8451 * The TTL of multirouted packets is bounded by the 8452 * ip_multirt_ttl ndd variable. 8453 */ 8454 if ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)) { 8455 /* Force TTL of multirouted packets */ 8456 if ((ipst->ips_ip_multirt_ttl > 0) && 8457 (ipha->ipha_ttl > ipst->ips_ip_multirt_ttl)) { 8458 ip2dbg(("ip_newroute: forcing multirt TTL " 8459 "to %d (was %d), dst 0x%08x\n", 8460 ipst->ips_ip_multirt_ttl, ipha->ipha_ttl, 8461 ntohl(sire->ire_addr))); 8462 ipha->ipha_ttl = ipst->ips_ip_multirt_ttl; 8463 } 8464 } 8465 /* 8466 * At this point in ip_newroute(), ire is either the 8467 * IRE_CACHE of the next-hop gateway for an off-subnet 8468 * destination or an IRE_INTERFACE type that should be used 8469 * to resolve an on-subnet destination or an on-subnet 8470 * next-hop gateway. 8471 * 8472 * In the IRE_CACHE case, we have the following : 8473 * 8474 * 1) src_ipif - used for getting a source address. 8475 * 8476 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This 8477 * means packets using this IRE_CACHE will go out on 8478 * dst_ill. 8479 * 8480 * 3) The IRE sire will point to the prefix that is the 8481 * longest matching route for the destination. These 8482 * prefix types include IRE_DEFAULT, IRE_PREFIX, IRE_HOST. 8483 * 8484 * The newly created IRE_CACHE entry for the off-subnet 8485 * destination is tied to both the prefix route and the 8486 * interface route used to resolve the next-hop gateway 8487 * via the ire_phandle and ire_ihandle fields, 8488 * respectively. 8489 * 8490 * In the IRE_INTERFACE case, we have the following : 8491 * 8492 * 1) src_ipif - used for getting a source address. 8493 * 8494 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This 8495 * means packets using the IRE_CACHE that we will build 8496 * here will go out on dst_ill. 8497 * 8498 * 3) sire may or may not be NULL. But, the IRE_CACHE that is 8499 * to be created will only be tied to the IRE_INTERFACE 8500 * that was derived from the ire_ihandle field. 8501 * 8502 * If sire is non-NULL, it means the destination is 8503 * off-link and we will first create the IRE_CACHE for the 8504 * gateway. Next time through ip_newroute, we will create 8505 * the IRE_CACHE for the final destination as described 8506 * above. 8507 * 8508 * In both cases, after the current resolution has been 8509 * completed (or possibly initialised, in the IRE_INTERFACE 8510 * case), the loop may be re-entered to attempt the resolution 8511 * of another RTF_MULTIRT route. 8512 * 8513 * When an IRE_CACHE entry for the off-subnet destination is 8514 * created, RTF_SETSRC and RTF_MULTIRT are inherited from sire, 8515 * for further processing in emission loops. 8516 */ 8517 save_ire = ire; 8518 switch (ire->ire_type) { 8519 case IRE_CACHE: { 8520 ire_t *ipif_ire; 8521 mblk_t *ire_fp_mp; 8522 8523 ASSERT(save_ire->ire_nce->nce_state == ND_REACHABLE); 8524 if (gw == 0) 8525 gw = ire->ire_gateway_addr; 8526 /* 8527 * We need 3 ire's to create a new cache ire for an 8528 * off-link destination from the cache ire of the 8529 * gateway. 8530 * 8531 * 1. The prefix ire 'sire' (Note that this does 8532 * not apply to the conn_nexthop_set case) 8533 * 2. The cache ire of the gateway 'ire' 8534 * 3. The interface ire 'ipif_ire' 8535 * 8536 * We have (1) and (2). We lookup (3) below. 8537 * 8538 * If there is no interface route to the gateway, 8539 * it is a race condition, where we found the cache 8540 * but the interface route has been deleted. 8541 */ 8542 if (ip_nexthop) { 8543 ipif_ire = ire_ihandle_lookup_onlink(ire); 8544 } else { 8545 ipif_ire = 8546 ire_ihandle_lookup_offlink(ire, sire); 8547 } 8548 if (ipif_ire == NULL) { 8549 ip1dbg(("ip_newroute: " 8550 "ire_ihandle_lookup_offlink failed\n")); 8551 goto icmp_err_ret; 8552 } 8553 /* 8554 * XXX We are using the same res_mp 8555 * (DL_UNITDATA_REQ) though the save_ire is not 8556 * pointing at the same ill. 8557 * This is incorrect. We need to send it up to the 8558 * resolver to get the right res_mp. For ethernets 8559 * this may be okay (ill_type == DL_ETHER). 8560 */ 8561 res_mp = save_ire->ire_nce->nce_res_mp; 8562 ire_fp_mp = NULL; 8563 /* 8564 * save_ire's nce_fp_mp can't change since it is 8565 * not an IRE_MIPRTUN or IRE_BROADCAST 8566 * LOCK_IRE_FP_MP does not do any useful work in 8567 * the case of IRE_CACHE. So we don't use it below. 8568 */ 8569 if (save_ire->ire_stq == dst_ill->ill_wq) 8570 ire_fp_mp = save_ire->ire_nce->nce_fp_mp; 8571 8572 /* 8573 * Check cached gateway IRE for any security 8574 * attributes; if found, associate the gateway 8575 * credentials group to the destination IRE. 8576 */ 8577 if ((attrp = save_ire->ire_gw_secattr) != NULL) { 8578 mutex_enter(&attrp->igsa_lock); 8579 if ((gcgrp = attrp->igsa_gcgrp) != NULL) 8580 GCGRP_REFHOLD(gcgrp); 8581 mutex_exit(&attrp->igsa_lock); 8582 } 8583 8584 ire = ire_create( 8585 (uchar_t *)&dst, /* dest address */ 8586 (uchar_t *)&ip_g_all_ones, /* mask */ 8587 (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 8588 (uchar_t *)&gw, /* gateway address */ 8589 NULL, 8590 &save_ire->ire_max_frag, 8591 ire_fp_mp, /* Fast Path header */ 8592 dst_ill->ill_rq, /* recv-from queue */ 8593 dst_ill->ill_wq, /* send-to queue */ 8594 IRE_CACHE, /* IRE type */ 8595 res_mp, 8596 src_ipif, 8597 in_ill, /* incoming ill */ 8598 (sire != NULL) ? 8599 sire->ire_mask : 0, /* Parent mask */ 8600 (sire != NULL) ? 8601 sire->ire_phandle : 0, /* Parent handle */ 8602 ipif_ire->ire_ihandle, /* Interface handle */ 8603 (sire != NULL) ? (sire->ire_flags & 8604 (RTF_SETSRC | RTF_MULTIRT)) : 0, /* flags */ 8605 (sire != NULL) ? 8606 &(sire->ire_uinfo) : &(save_ire->ire_uinfo), 8607 NULL, 8608 gcgrp, 8609 ipst); 8610 8611 if (ire == NULL) { 8612 if (gcgrp != NULL) { 8613 GCGRP_REFRELE(gcgrp); 8614 gcgrp = NULL; 8615 } 8616 ire_refrele(ipif_ire); 8617 ire_refrele(save_ire); 8618 break; 8619 } 8620 8621 /* reference now held by IRE */ 8622 gcgrp = NULL; 8623 8624 ire->ire_marks |= ire_marks; 8625 8626 /* 8627 * Prevent sire and ipif_ire from getting deleted. 8628 * The newly created ire is tied to both of them via 8629 * the phandle and ihandle respectively. 8630 */ 8631 if (sire != NULL) { 8632 IRB_REFHOLD(sire->ire_bucket); 8633 /* Has it been removed already ? */ 8634 if (sire->ire_marks & IRE_MARK_CONDEMNED) { 8635 IRB_REFRELE(sire->ire_bucket); 8636 ire_refrele(ipif_ire); 8637 ire_refrele(save_ire); 8638 break; 8639 } 8640 } 8641 8642 IRB_REFHOLD(ipif_ire->ire_bucket); 8643 /* Has it been removed already ? */ 8644 if (ipif_ire->ire_marks & IRE_MARK_CONDEMNED) { 8645 IRB_REFRELE(ipif_ire->ire_bucket); 8646 if (sire != NULL) 8647 IRB_REFRELE(sire->ire_bucket); 8648 ire_refrele(ipif_ire); 8649 ire_refrele(save_ire); 8650 break; 8651 } 8652 8653 xmit_mp = first_mp; 8654 /* 8655 * In the case of multirouting, a copy 8656 * of the packet is done before its sending. 8657 * The copy is used to attempt another 8658 * route resolution, in a next loop. 8659 */ 8660 if (ire->ire_flags & RTF_MULTIRT) { 8661 copy_mp = copymsg(first_mp); 8662 if (copy_mp != NULL) { 8663 xmit_mp = copy_mp; 8664 MULTIRT_DEBUG_TAG(first_mp); 8665 } 8666 } 8667 ire_add_then_send(q, ire, xmit_mp); 8668 ire_refrele(save_ire); 8669 8670 /* Assert that sire is not deleted yet. */ 8671 if (sire != NULL) { 8672 ASSERT(sire->ire_ptpn != NULL); 8673 IRB_REFRELE(sire->ire_bucket); 8674 } 8675 8676 /* Assert that ipif_ire is not deleted yet. */ 8677 ASSERT(ipif_ire->ire_ptpn != NULL); 8678 IRB_REFRELE(ipif_ire->ire_bucket); 8679 ire_refrele(ipif_ire); 8680 8681 /* 8682 * If copy_mp is not NULL, multirouting was 8683 * requested. We loop to initiate a next 8684 * route resolution attempt, starting from sire. 8685 */ 8686 if (copy_mp != NULL) { 8687 /* 8688 * Search for the next unresolved 8689 * multirt route. 8690 */ 8691 copy_mp = NULL; 8692 ipif_ire = NULL; 8693 ire = NULL; 8694 multirt_resolve_next = B_TRUE; 8695 continue; 8696 } 8697 if (sire != NULL) 8698 ire_refrele(sire); 8699 ipif_refrele(src_ipif); 8700 ill_refrele(dst_ill); 8701 return; 8702 } 8703 case IRE_IF_NORESOLVER: { 8704 /* 8705 * We have what we need to build an IRE_CACHE. 8706 * 8707 * Create a new res_mp with the IP gateway address 8708 * in destination address in the DLPI hdr if the 8709 * physical length is exactly 4 bytes. 8710 */ 8711 if (dst_ill->ill_phys_addr_length == IP_ADDR_LEN) { 8712 uchar_t *addr; 8713 8714 if (gw) 8715 addr = (uchar_t *)&gw; 8716 else 8717 addr = (uchar_t *)&dst; 8718 8719 res_mp = ill_dlur_gen(addr, 8720 dst_ill->ill_phys_addr_length, 8721 dst_ill->ill_sap, 8722 dst_ill->ill_sap_length); 8723 8724 if (res_mp == NULL) { 8725 ip1dbg(("ip_newroute: res_mp NULL\n")); 8726 break; 8727 } 8728 } else if (dst_ill->ill_resolver_mp == NULL) { 8729 ip1dbg(("ip_newroute: dst_ill %p " 8730 "for IF_NORESOLV ire %p has " 8731 "no ill_resolver_mp\n", 8732 (void *)dst_ill, (void *)ire)); 8733 break; 8734 } else { 8735 res_mp = NULL; 8736 } 8737 8738 /* 8739 * TSol note: We are creating the ire cache for the 8740 * destination 'dst'. If 'dst' is offlink, going 8741 * through the first hop 'gw', the security attributes 8742 * of 'dst' must be set to point to the gateway 8743 * credentials of gateway 'gw'. If 'dst' is onlink, it 8744 * is possible that 'dst' is a potential gateway that is 8745 * referenced by some route that has some security 8746 * attributes. Thus in the former case, we need to do a 8747 * gcgrp_lookup of 'gw' while in the latter case we 8748 * need to do gcgrp_lookup of 'dst' itself. 8749 */ 8750 ga.ga_af = AF_INET; 8751 IN6_IPADDR_TO_V4MAPPED(gw != INADDR_ANY ? gw : dst, 8752 &ga.ga_addr); 8753 gcgrp = gcgrp_lookup(&ga, B_FALSE); 8754 8755 ire = ire_create( 8756 (uchar_t *)&dst, /* dest address */ 8757 (uchar_t *)&ip_g_all_ones, /* mask */ 8758 (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 8759 (uchar_t *)&gw, /* gateway address */ 8760 NULL, 8761 &save_ire->ire_max_frag, 8762 NULL, /* Fast Path header */ 8763 dst_ill->ill_rq, /* recv-from queue */ 8764 dst_ill->ill_wq, /* send-to queue */ 8765 IRE_CACHE, 8766 res_mp, 8767 src_ipif, 8768 in_ill, /* Incoming ill */ 8769 save_ire->ire_mask, /* Parent mask */ 8770 (sire != NULL) ? /* Parent handle */ 8771 sire->ire_phandle : 0, 8772 save_ire->ire_ihandle, /* Interface handle */ 8773 (sire != NULL) ? sire->ire_flags & 8774 (RTF_SETSRC | RTF_MULTIRT) : 0, /* flags */ 8775 &(save_ire->ire_uinfo), 8776 NULL, 8777 gcgrp, 8778 ipst); 8779 8780 if (dst_ill->ill_phys_addr_length == IP_ADDR_LEN) 8781 freeb(res_mp); 8782 8783 if (ire == NULL) { 8784 if (gcgrp != NULL) { 8785 GCGRP_REFRELE(gcgrp); 8786 gcgrp = NULL; 8787 } 8788 ire_refrele(save_ire); 8789 break; 8790 } 8791 8792 /* reference now held by IRE */ 8793 gcgrp = NULL; 8794 8795 ire->ire_marks |= ire_marks; 8796 8797 /* Prevent save_ire from getting deleted */ 8798 IRB_REFHOLD(save_ire->ire_bucket); 8799 /* Has it been removed already ? */ 8800 if (save_ire->ire_marks & IRE_MARK_CONDEMNED) { 8801 IRB_REFRELE(save_ire->ire_bucket); 8802 ire_refrele(save_ire); 8803 break; 8804 } 8805 8806 /* 8807 * In the case of multirouting, a copy 8808 * of the packet is made before it is sent. 8809 * The copy is used in the next 8810 * loop to attempt another resolution. 8811 */ 8812 xmit_mp = first_mp; 8813 if ((sire != NULL) && 8814 (sire->ire_flags & RTF_MULTIRT)) { 8815 copy_mp = copymsg(first_mp); 8816 if (copy_mp != NULL) { 8817 xmit_mp = copy_mp; 8818 MULTIRT_DEBUG_TAG(first_mp); 8819 } 8820 } 8821 ire_add_then_send(q, ire, xmit_mp); 8822 8823 /* Assert that it is not deleted yet. */ 8824 ASSERT(save_ire->ire_ptpn != NULL); 8825 IRB_REFRELE(save_ire->ire_bucket); 8826 ire_refrele(save_ire); 8827 8828 if (copy_mp != NULL) { 8829 /* 8830 * If we found a (no)resolver, we ignore any 8831 * trailing top priority IRE_CACHE in further 8832 * loops. This ensures that we do not omit any 8833 * (no)resolver. 8834 * This IRE_CACHE, if any, will be processed 8835 * by another thread entering ip_newroute(). 8836 * IRE_CACHE entries, if any, will be processed 8837 * by another thread entering ip_newroute(), 8838 * (upon resolver response, for instance). 8839 * This aims to force parallel multirt 8840 * resolutions as soon as a packet must be sent. 8841 * In the best case, after the tx of only one 8842 * packet, all reachable routes are resolved. 8843 * Otherwise, the resolution of all RTF_MULTIRT 8844 * routes would require several emissions. 8845 */ 8846 multirt_flags &= ~MULTIRT_CACHEGW; 8847 8848 /* 8849 * Search for the next unresolved multirt 8850 * route. 8851 */ 8852 copy_mp = NULL; 8853 save_ire = NULL; 8854 ire = NULL; 8855 multirt_resolve_next = B_TRUE; 8856 continue; 8857 } 8858 8859 /* 8860 * Don't need sire anymore 8861 */ 8862 if (sire != NULL) 8863 ire_refrele(sire); 8864 8865 ipif_refrele(src_ipif); 8866 ill_refrele(dst_ill); 8867 return; 8868 } 8869 case IRE_IF_RESOLVER: 8870 /* 8871 * We can't build an IRE_CACHE yet, but at least we 8872 * found a resolver that can help. 8873 */ 8874 res_mp = dst_ill->ill_resolver_mp; 8875 if (!OK_RESOLVER_MP(res_mp)) 8876 break; 8877 8878 /* 8879 * To be at this point in the code with a non-zero gw 8880 * means that dst is reachable through a gateway that 8881 * we have never resolved. By changing dst to the gw 8882 * addr we resolve the gateway first. 8883 * When ire_add_then_send() tries to put the IP dg 8884 * to dst, it will reenter ip_newroute() at which 8885 * time we will find the IRE_CACHE for the gw and 8886 * create another IRE_CACHE in case IRE_CACHE above. 8887 */ 8888 if (gw != INADDR_ANY) { 8889 /* 8890 * The source ipif that was determined above was 8891 * relative to the destination address, not the 8892 * gateway's. If src_ipif was not taken out of 8893 * the IRE_IF_RESOLVER entry, we'll need to call 8894 * ipif_select_source() again. 8895 */ 8896 if (src_ipif != ire->ire_ipif) { 8897 ipif_refrele(src_ipif); 8898 src_ipif = ipif_select_source(dst_ill, 8899 gw, zoneid); 8900 if (src_ipif == NULL) { 8901 if (ip_debug > 2) { 8902 pr_addr_dbg( 8903 "ip_newroute: no " 8904 "src for gw %s ", 8905 AF_INET, &gw); 8906 printf("through " 8907 "interface %s\n", 8908 dst_ill->ill_name); 8909 } 8910 goto icmp_err_ret; 8911 } 8912 } 8913 save_dst = dst; 8914 dst = gw; 8915 gw = INADDR_ANY; 8916 } 8917 8918 /* 8919 * We obtain a partial IRE_CACHE which we will pass 8920 * along with the resolver query. When the response 8921 * comes back it will be there ready for us to add. 8922 * The ire_max_frag is atomically set under the 8923 * irebucket lock in ire_add_v[46]. 8924 */ 8925 8926 ire = ire_create_mp( 8927 (uchar_t *)&dst, /* dest address */ 8928 (uchar_t *)&ip_g_all_ones, /* mask */ 8929 (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 8930 (uchar_t *)&gw, /* gateway address */ 8931 NULL, /* no in_src_addr */ 8932 NULL, /* ire_max_frag */ 8933 NULL, /* Fast Path header */ 8934 dst_ill->ill_rq, /* recv-from queue */ 8935 dst_ill->ill_wq, /* send-to queue */ 8936 IRE_CACHE, 8937 NULL, 8938 src_ipif, /* Interface ipif */ 8939 in_ill, /* Incoming ILL */ 8940 save_ire->ire_mask, /* Parent mask */ 8941 0, 8942 save_ire->ire_ihandle, /* Interface handle */ 8943 0, /* flags if any */ 8944 &(save_ire->ire_uinfo), 8945 NULL, 8946 NULL, 8947 ipst); 8948 8949 if (ire == NULL) { 8950 ire_refrele(save_ire); 8951 break; 8952 } 8953 8954 if ((sire != NULL) && 8955 (sire->ire_flags & RTF_MULTIRT)) { 8956 copy_mp = copymsg(first_mp); 8957 if (copy_mp != NULL) 8958 MULTIRT_DEBUG_TAG(copy_mp); 8959 } 8960 8961 ire->ire_marks |= ire_marks; 8962 8963 /* 8964 * Construct message chain for the resolver 8965 * of the form: 8966 * ARP_REQ_MBLK-->IRE_MBLK-->Packet 8967 * Packet could contain a IPSEC_OUT mp. 8968 * 8969 * NOTE : ire will be added later when the response 8970 * comes back from ARP. If the response does not 8971 * come back, ARP frees the packet. For this reason, 8972 * we can't REFHOLD the bucket of save_ire to prevent 8973 * deletions. We may not be able to REFRELE the bucket 8974 * if the response never comes back. Thus, before 8975 * adding the ire, ire_add_v4 will make sure that the 8976 * interface route does not get deleted. This is the 8977 * only case unlike ip_newroute_v6, ip_newroute_ipif_v6 8978 * where we can always prevent deletions because of 8979 * the synchronous nature of adding IRES i.e 8980 * ire_add_then_send is called after creating the IRE. 8981 */ 8982 ASSERT(ire->ire_mp != NULL); 8983 ire->ire_mp->b_cont = first_mp; 8984 /* Have saved_mp handy, for cleanup if canput fails */ 8985 saved_mp = mp; 8986 mp = copyb(res_mp); 8987 if (mp == NULL) { 8988 /* Prepare for cleanup */ 8989 mp = saved_mp; /* pkt */ 8990 ire_delete(ire); /* ire_mp */ 8991 ire = NULL; 8992 ire_refrele(save_ire); 8993 if (copy_mp != NULL) { 8994 MULTIRT_DEBUG_UNTAG(copy_mp); 8995 freemsg(copy_mp); 8996 copy_mp = NULL; 8997 } 8998 break; 8999 } 9000 linkb(mp, ire->ire_mp); 9001 9002 /* 9003 * Fill in the source and dest addrs for the resolver. 9004 * NOTE: this depends on memory layouts imposed by 9005 * ill_init(). 9006 */ 9007 areq = (areq_t *)mp->b_rptr; 9008 addrp = (ipaddr_t *)((char *)areq + 9009 areq->areq_sender_addr_offset); 9010 if (do_attach_ill) { 9011 /* 9012 * This is bind to no failover case. 9013 * arp packet also must go out on attach_ill. 9014 */ 9015 ASSERT(ipha->ipha_src != NULL); 9016 *addrp = ipha->ipha_src; 9017 } else { 9018 *addrp = save_ire->ire_src_addr; 9019 } 9020 9021 ire_refrele(save_ire); 9022 addrp = (ipaddr_t *)((char *)areq + 9023 areq->areq_target_addr_offset); 9024 *addrp = dst; 9025 /* Up to the resolver. */ 9026 if (canputnext(dst_ill->ill_rq) && 9027 !(dst_ill->ill_arp_closing)) { 9028 putnext(dst_ill->ill_rq, mp); 9029 ire = NULL; 9030 if (copy_mp != NULL) { 9031 /* 9032 * If we found a resolver, we ignore 9033 * any trailing top priority IRE_CACHE 9034 * in the further loops. This ensures 9035 * that we do not omit any resolver. 9036 * IRE_CACHE entries, if any, will be 9037 * processed next time we enter 9038 * ip_newroute(). 9039 */ 9040 multirt_flags &= ~MULTIRT_CACHEGW; 9041 /* 9042 * Search for the next unresolved 9043 * multirt route. 9044 */ 9045 first_mp = copy_mp; 9046 copy_mp = NULL; 9047 /* Prepare the next resolution loop. */ 9048 mp = first_mp; 9049 EXTRACT_PKT_MP(mp, first_mp, 9050 mctl_present); 9051 if (mctl_present) 9052 io = (ipsec_out_t *) 9053 first_mp->b_rptr; 9054 ipha = (ipha_t *)mp->b_rptr; 9055 9056 ASSERT(sire != NULL); 9057 9058 dst = save_dst; 9059 multirt_resolve_next = B_TRUE; 9060 continue; 9061 } 9062 9063 if (sire != NULL) 9064 ire_refrele(sire); 9065 9066 /* 9067 * The response will come back in ip_wput 9068 * with db_type IRE_DB_TYPE. 9069 */ 9070 ipif_refrele(src_ipif); 9071 ill_refrele(dst_ill); 9072 return; 9073 } else { 9074 /* Prepare for cleanup */ 9075 DTRACE_PROBE1(ip__newroute__drop, mblk_t *, 9076 mp); 9077 mp->b_cont = NULL; 9078 freeb(mp); /* areq */ 9079 /* 9080 * this is an ire that is not added to the 9081 * cache. ire_freemblk will handle the release 9082 * of any resources associated with the ire. 9083 */ 9084 ire_delete(ire); /* ire_mp */ 9085 mp = saved_mp; /* pkt */ 9086 ire = NULL; 9087 if (copy_mp != NULL) { 9088 MULTIRT_DEBUG_UNTAG(copy_mp); 9089 freemsg(copy_mp); 9090 copy_mp = NULL; 9091 } 9092 break; 9093 } 9094 default: 9095 break; 9096 } 9097 } while (multirt_resolve_next); 9098 9099 ip1dbg(("ip_newroute: dropped\n")); 9100 /* Did this packet originate externally? */ 9101 if (mp->b_prev) { 9102 mp->b_next = NULL; 9103 mp->b_prev = NULL; 9104 if (in_ill != NULL) { 9105 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsInDiscards); 9106 } else { 9107 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards); 9108 } 9109 } else { 9110 if (dst_ill != NULL) { 9111 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutDiscards); 9112 } else { 9113 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 9114 } 9115 } 9116 ASSERT(copy_mp == NULL); 9117 MULTIRT_DEBUG_UNTAG(first_mp); 9118 freemsg(first_mp); 9119 if (ire != NULL) 9120 ire_refrele(ire); 9121 if (sire != NULL) 9122 ire_refrele(sire); 9123 if (src_ipif != NULL) 9124 ipif_refrele(src_ipif); 9125 if (dst_ill != NULL) 9126 ill_refrele(dst_ill); 9127 return; 9128 9129 icmp_err_ret: 9130 ip1dbg(("ip_newroute: no route\n")); 9131 if (src_ipif != NULL) 9132 ipif_refrele(src_ipif); 9133 if (dst_ill != NULL) 9134 ill_refrele(dst_ill); 9135 if (sire != NULL) 9136 ire_refrele(sire); 9137 /* Did this packet originate externally? */ 9138 if (mp->b_prev) { 9139 mp->b_next = NULL; 9140 mp->b_prev = NULL; 9141 if (in_ill != NULL) { 9142 BUMP_MIB(in_ill->ill_ip_mib, ipIfStatsInNoRoutes); 9143 } else { 9144 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInNoRoutes); 9145 } 9146 q = WR(q); 9147 } else { 9148 /* 9149 * There is no outgoing ill, so just increment the 9150 * system MIB. 9151 */ 9152 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 9153 /* 9154 * Since ip_wput() isn't close to finished, we fill 9155 * in enough of the header for credible error reporting. 9156 */ 9157 if (ip_hdr_complete(ipha, zoneid, ipst)) { 9158 /* Failed */ 9159 MULTIRT_DEBUG_UNTAG(first_mp); 9160 freemsg(first_mp); 9161 if (ire != NULL) 9162 ire_refrele(ire); 9163 return; 9164 } 9165 } 9166 9167 /* 9168 * At this point we will have ire only if RTF_BLACKHOLE 9169 * or RTF_REJECT flags are set on the IRE. It will not 9170 * generate ICMP_HOST_UNREACHABLE if RTF_BLACKHOLE is set. 9171 */ 9172 if (ire != NULL) { 9173 if (ire->ire_flags & RTF_BLACKHOLE) { 9174 ire_refrele(ire); 9175 MULTIRT_DEBUG_UNTAG(first_mp); 9176 freemsg(first_mp); 9177 return; 9178 } 9179 ire_refrele(ire); 9180 } 9181 if (ip_source_routed(ipha, ipst)) { 9182 icmp_unreachable(q, first_mp, ICMP_SOURCE_ROUTE_FAILED, 9183 zoneid, ipst); 9184 return; 9185 } 9186 icmp_unreachable(q, first_mp, ICMP_HOST_UNREACHABLE, zoneid, ipst); 9187 } 9188 9189 ip_opt_info_t zero_info; 9190 9191 /* 9192 * IPv4 - 9193 * ip_newroute_ipif is called by ip_wput_multicast and 9194 * ip_rput_forward_multicast whenever we need to send 9195 * out a packet to a destination address for which we do not have specific 9196 * routing information. It is used when the packet will be sent out 9197 * on a specific interface. It is also called by ip_wput() when IP_XMIT_IF 9198 * socket option is set or icmp error message wants to go out on a particular 9199 * interface for a unicast packet. 9200 * 9201 * In most cases, the destination address is resolved thanks to the ipif 9202 * intrinsic resolver. However, there are some cases where the call to 9203 * ip_newroute_ipif must take into account the potential presence of 9204 * RTF_SETSRC and/or RTF_MULITRT flags in an IRE_OFFSUBNET ire 9205 * that uses the interface. This is specified through flags, 9206 * which can be a combination of: 9207 * - RTF_SETSRC: if an IRE_OFFSUBNET ire exists that has the RTF_SETSRC 9208 * flag, the resulting ire will inherit the IRE_OFFSUBNET source address 9209 * and flags. Additionally, the packet source address has to be set to 9210 * the specified address. The caller is thus expected to set this flag 9211 * if the packet has no specific source address yet. 9212 * - RTF_MULTIRT: if an IRE_OFFSUBNET ire exists that has the RTF_MULTIRT 9213 * flag, the resulting ire will inherit the flag. All unresolved routes 9214 * to the destination must be explored in the same call to 9215 * ip_newroute_ipif(). 9216 */ 9217 static void 9218 ip_newroute_ipif(queue_t *q, mblk_t *mp, ipif_t *ipif, ipaddr_t dst, 9219 conn_t *connp, uint32_t flags, zoneid_t zoneid, ip_opt_info_t *infop) 9220 { 9221 areq_t *areq; 9222 ire_t *ire = NULL; 9223 mblk_t *res_mp; 9224 ipaddr_t *addrp; 9225 mblk_t *first_mp; 9226 ire_t *save_ire = NULL; 9227 ill_t *attach_ill = NULL; /* Bind to IPIF_NOFAILOVER */ 9228 ipif_t *src_ipif = NULL; 9229 ushort_t ire_marks = 0; 9230 ill_t *dst_ill = NULL; 9231 boolean_t mctl_present; 9232 ipsec_out_t *io; 9233 ipha_t *ipha; 9234 int ihandle = 0; 9235 mblk_t *saved_mp; 9236 ire_t *fire = NULL; 9237 mblk_t *copy_mp = NULL; 9238 boolean_t multirt_resolve_next; 9239 ipaddr_t ipha_dst; 9240 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 9241 9242 /* 9243 * CGTP goes in a loop which looks up a new ipif, do an ipif_refhold 9244 * here for uniformity 9245 */ 9246 ipif_refhold(ipif); 9247 9248 /* 9249 * This loop is run only once in most cases. 9250 * We loop to resolve further routes only when the destination 9251 * can be reached through multiple RTF_MULTIRT-flagged ires. 9252 */ 9253 do { 9254 if (dst_ill != NULL) { 9255 ill_refrele(dst_ill); 9256 dst_ill = NULL; 9257 } 9258 if (src_ipif != NULL) { 9259 ipif_refrele(src_ipif); 9260 src_ipif = NULL; 9261 } 9262 multirt_resolve_next = B_FALSE; 9263 9264 ip1dbg(("ip_newroute_ipif: dst 0x%x, if %s\n", ntohl(dst), 9265 ipif->ipif_ill->ill_name)); 9266 9267 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 9268 if (mctl_present) 9269 io = (ipsec_out_t *)first_mp->b_rptr; 9270 9271 ipha = (ipha_t *)mp->b_rptr; 9272 9273 /* 9274 * Save the packet destination address, we may need it after 9275 * the packet has been consumed. 9276 */ 9277 ipha_dst = ipha->ipha_dst; 9278 9279 /* 9280 * If the interface is a pt-pt interface we look for an 9281 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER that matches both the 9282 * local_address and the pt-pt destination address. Otherwise 9283 * we just match the local address. 9284 * NOTE: dst could be different than ipha->ipha_dst in case 9285 * of sending igmp multicast packets over a point-to-point 9286 * connection. 9287 * Thus we must be careful enough to check ipha_dst to be a 9288 * multicast address, otherwise it will take xmit_if path for 9289 * multicast packets resulting into kernel stack overflow by 9290 * repeated calls to ip_newroute_ipif from ire_send(). 9291 */ 9292 if (CLASSD(ipha_dst) && 9293 !(ipif->ipif_ill->ill_flags & ILLF_MULTICAST)) { 9294 goto err_ret; 9295 } 9296 9297 /* 9298 * We check if an IRE_OFFSUBNET for the addr that goes through 9299 * ipif exists. We need it to determine if the RTF_SETSRC and/or 9300 * RTF_MULTIRT flags must be honored. This IRE_OFFSUBNET ire may 9301 * propagate its flags to the new ire. 9302 */ 9303 if (CLASSD(ipha_dst) && (flags & (RTF_MULTIRT | RTF_SETSRC))) { 9304 fire = ipif_lookup_multi_ire(ipif, ipha_dst); 9305 ip2dbg(("ip_newroute_ipif: " 9306 "ipif_lookup_multi_ire(" 9307 "ipif %p, dst %08x) = fire %p\n", 9308 (void *)ipif, ntohl(dst), (void *)fire)); 9309 } 9310 9311 if (mctl_present && io->ipsec_out_attach_if) { 9312 attach_ill = ip_grab_attach_ill(NULL, first_mp, 9313 io->ipsec_out_ill_index, B_FALSE, ipst); 9314 9315 /* Failure case frees things for us. */ 9316 if (attach_ill == NULL) { 9317 ipif_refrele(ipif); 9318 if (fire != NULL) 9319 ire_refrele(fire); 9320 return; 9321 } 9322 9323 /* 9324 * Check if we need an ire that will not be 9325 * looked up by anybody else i.e. HIDDEN. 9326 */ 9327 if (ill_is_probeonly(attach_ill)) { 9328 ire_marks = IRE_MARK_HIDDEN; 9329 } 9330 /* 9331 * ip_wput passes the right ipif for IPIF_NOFAILOVER 9332 * case. 9333 */ 9334 dst_ill = ipif->ipif_ill; 9335 /* attach_ill has been refheld by ip_grab_attach_ill */ 9336 ASSERT(dst_ill == attach_ill); 9337 } else { 9338 /* 9339 * If this is set by IP_XMIT_IF, then make sure that 9340 * ipif is pointing to the same ill as the IP_XMIT_IF 9341 * specified ill. 9342 */ 9343 ASSERT((connp == NULL) || 9344 (connp->conn_xmit_if_ill == NULL) || 9345 (connp->conn_xmit_if_ill == ipif->ipif_ill)); 9346 /* 9347 * If the interface belongs to an interface group, 9348 * make sure the next possible interface in the group 9349 * is used. This encourages load spreading among 9350 * peers in an interface group. 9351 * Note: load spreading is disabled for RTF_MULTIRT 9352 * routes. 9353 */ 9354 if ((flags & RTF_MULTIRT) && (fire != NULL) && 9355 (fire->ire_flags & RTF_MULTIRT)) { 9356 /* 9357 * Don't perform outbound load spreading 9358 * in the case of an RTF_MULTIRT issued route, 9359 * we actually typically want to replicate 9360 * outgoing packets through particular 9361 * interfaces. 9362 */ 9363 dst_ill = ipif->ipif_ill; 9364 ill_refhold(dst_ill); 9365 } else { 9366 dst_ill = ip_newroute_get_dst_ill( 9367 ipif->ipif_ill); 9368 } 9369 if (dst_ill == NULL) { 9370 if (ip_debug > 2) { 9371 pr_addr_dbg("ip_newroute_ipif: " 9372 "no dst ill for dst %s\n", 9373 AF_INET, &dst); 9374 } 9375 goto err_ret; 9376 } 9377 } 9378 9379 /* 9380 * Pick a source address preferring non-deprecated ones. 9381 * Unlike ip_newroute, we don't do any source address 9382 * selection here since for multicast it really does not help 9383 * in inbound load spreading as in the unicast case. 9384 */ 9385 if ((flags & RTF_SETSRC) && (fire != NULL) && 9386 (fire->ire_flags & RTF_SETSRC)) { 9387 /* 9388 * As requested by flags, an IRE_OFFSUBNET was looked up 9389 * on that interface. This ire has RTF_SETSRC flag, so 9390 * the source address of the packet must be changed. 9391 * Check that the ipif matching the requested source 9392 * address still exists. 9393 */ 9394 src_ipif = ipif_lookup_addr(fire->ire_src_addr, NULL, 9395 zoneid, NULL, NULL, NULL, NULL, ipst); 9396 } 9397 if (((ipif->ipif_flags & IPIF_DEPRECATED) || 9398 (connp != NULL && ipif->ipif_zoneid != zoneid && 9399 ipif->ipif_zoneid != ALL_ZONES)) && 9400 (src_ipif == NULL)) { 9401 src_ipif = ipif_select_source(dst_ill, dst, zoneid); 9402 if (src_ipif == NULL) { 9403 if (ip_debug > 2) { 9404 /* ip1dbg */ 9405 pr_addr_dbg("ip_newroute_ipif: " 9406 "no src for dst %s", 9407 AF_INET, &dst); 9408 } 9409 ip1dbg((" through interface %s\n", 9410 dst_ill->ill_name)); 9411 goto err_ret; 9412 } 9413 ipif_refrele(ipif); 9414 ipif = src_ipif; 9415 ipif_refhold(ipif); 9416 } 9417 if (src_ipif == NULL) { 9418 src_ipif = ipif; 9419 ipif_refhold(src_ipif); 9420 } 9421 9422 /* 9423 * Assign a source address while we have the conn. 9424 * We can't have ip_wput_ire pick a source address when the 9425 * packet returns from arp since conn_unspec_src might be set 9426 * and we loose the conn when going through arp. 9427 */ 9428 if (ipha->ipha_src == INADDR_ANY && 9429 (connp == NULL || !connp->conn_unspec_src)) { 9430 ipha->ipha_src = src_ipif->ipif_src_addr; 9431 } 9432 9433 /* 9434 * In case of IP_XMIT_IF, it is possible that the outgoing 9435 * interface does not have an interface ire. 9436 * Example: Thousands of mobileip PPP interfaces to mobile 9437 * nodes. We don't want to create interface ires because 9438 * packets from other mobile nodes must not take the route 9439 * via interface ires to the visiting mobile node without 9440 * going through the home agent, in absence of mobileip 9441 * route optimization. 9442 */ 9443 if (CLASSD(ipha_dst) && (connp == NULL || 9444 connp->conn_xmit_if_ill == NULL) && 9445 infop->ip_opt_ill_index == 0) { 9446 /* ipif_to_ire returns an held ire */ 9447 ire = ipif_to_ire(ipif); 9448 if (ire == NULL) 9449 goto err_ret; 9450 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) 9451 goto err_ret; 9452 /* 9453 * ihandle is needed when the ire is added to 9454 * cache table. 9455 */ 9456 save_ire = ire; 9457 ihandle = save_ire->ire_ihandle; 9458 9459 ip2dbg(("ip_newroute_ipif: ire %p, ipif %p, " 9460 "flags %04x\n", 9461 (void *)ire, (void *)ipif, flags)); 9462 if ((flags & RTF_MULTIRT) && (fire != NULL) && 9463 (fire->ire_flags & RTF_MULTIRT)) { 9464 /* 9465 * As requested by flags, an IRE_OFFSUBNET was 9466 * looked up on that interface. This ire has 9467 * RTF_MULTIRT flag, so the resolution loop will 9468 * be re-entered to resolve additional routes on 9469 * other interfaces. For that purpose, a copy of 9470 * the packet is performed at this point. 9471 */ 9472 fire->ire_last_used_time = lbolt; 9473 copy_mp = copymsg(first_mp); 9474 if (copy_mp) { 9475 MULTIRT_DEBUG_TAG(copy_mp); 9476 } 9477 } 9478 if ((flags & RTF_SETSRC) && (fire != NULL) && 9479 (fire->ire_flags & RTF_SETSRC)) { 9480 /* 9481 * As requested by flags, an IRE_OFFSUBET was 9482 * looked up on that interface. This ire has 9483 * RTF_SETSRC flag, so the source address of the 9484 * packet must be changed. 9485 */ 9486 ipha->ipha_src = fire->ire_src_addr; 9487 } 9488 } else { 9489 ASSERT((connp == NULL) || 9490 (connp->conn_xmit_if_ill != NULL) || 9491 (connp->conn_dontroute) || 9492 infop->ip_opt_ill_index != 0); 9493 /* 9494 * The only ways we can come here are: 9495 * 1) IP_XMIT_IF socket option is set 9496 * 2) ICMP error message generated from 9497 * ip_mrtun_forward() routine and it needs 9498 * to go through the specified ill. 9499 * 3) SO_DONTROUTE socket option is set 9500 * 4) IP_PKTINFO option is passed in as ancillary data. 9501 * In all cases, the new ire will not be added 9502 * into cache table. 9503 */ 9504 ire_marks |= IRE_MARK_NOADD; 9505 } 9506 9507 switch (ipif->ipif_net_type) { 9508 case IRE_IF_NORESOLVER: { 9509 /* We have what we need to build an IRE_CACHE. */ 9510 mblk_t *res_mp; 9511 9512 /* 9513 * Create a new res_mp with the 9514 * IP gateway address as destination address in the 9515 * DLPI hdr if the physical length is exactly 4 bytes. 9516 */ 9517 if (dst_ill->ill_phys_addr_length == IP_ADDR_LEN) { 9518 res_mp = ill_dlur_gen((uchar_t *)&dst, 9519 dst_ill->ill_phys_addr_length, 9520 dst_ill->ill_sap, 9521 dst_ill->ill_sap_length); 9522 } else if (dst_ill->ill_resolver_mp == NULL) { 9523 ip1dbg(("ip_newroute: dst_ill %p " 9524 "for IF_NORESOLV ire %p has " 9525 "no ill_resolver_mp\n", 9526 (void *)dst_ill, (void *)ire)); 9527 break; 9528 } else { 9529 /* use the value set in ip_ll_subnet_defaults */ 9530 res_mp = ill_dlur_gen(NULL, 9531 dst_ill->ill_phys_addr_length, 9532 dst_ill->ill_sap, 9533 dst_ill->ill_sap_length); 9534 } 9535 9536 if (res_mp == NULL) 9537 break; 9538 /* 9539 * The new ire inherits the IRE_OFFSUBNET flags 9540 * and source address, if this was requested. 9541 */ 9542 ire = ire_create( 9543 (uchar_t *)&dst, /* dest address */ 9544 (uchar_t *)&ip_g_all_ones, /* mask */ 9545 (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 9546 NULL, /* gateway address */ 9547 NULL, 9548 &ipif->ipif_mtu, 9549 NULL, /* Fast Path header */ 9550 dst_ill->ill_rq, /* recv-from queue */ 9551 dst_ill->ill_wq, /* send-to queue */ 9552 IRE_CACHE, 9553 res_mp, 9554 src_ipif, 9555 NULL, 9556 (save_ire != NULL ? save_ire->ire_mask : 0), 9557 (fire != NULL) ? /* Parent handle */ 9558 fire->ire_phandle : 0, 9559 ihandle, /* Interface handle */ 9560 (fire != NULL) ? 9561 (fire->ire_flags & 9562 (RTF_SETSRC | RTF_MULTIRT)) : 0, 9563 (save_ire == NULL ? &ire_uinfo_null : 9564 &save_ire->ire_uinfo), 9565 NULL, 9566 NULL, 9567 ipst); 9568 9569 freeb(res_mp); 9570 9571 if (ire == NULL) { 9572 if (save_ire != NULL) 9573 ire_refrele(save_ire); 9574 break; 9575 } 9576 9577 ire->ire_marks |= ire_marks; 9578 9579 /* 9580 * If IRE_MARK_NOADD is set then we need to convert 9581 * the max_fragp to a useable value now. This is 9582 * normally done in ire_add_v[46]. We also need to 9583 * associate the ire with an nce (normally would be 9584 * done in ip_wput_nondata()). 9585 * 9586 * Note that IRE_MARK_NOADD packets created here 9587 * do not have a non-null ire_mp pointer. The null 9588 * value of ire_bucket indicates that they were 9589 * never added. 9590 */ 9591 if (ire->ire_marks & IRE_MARK_NOADD) { 9592 uint_t max_frag; 9593 9594 max_frag = *ire->ire_max_fragp; 9595 ire->ire_max_fragp = NULL; 9596 ire->ire_max_frag = max_frag; 9597 9598 if ((ire->ire_nce = ndp_lookup_v4( 9599 ire_to_ill(ire), 9600 (ire->ire_gateway_addr != INADDR_ANY ? 9601 &ire->ire_gateway_addr : &ire->ire_addr), 9602 B_FALSE)) == NULL) { 9603 if (save_ire != NULL) 9604 ire_refrele(save_ire); 9605 break; 9606 } 9607 ASSERT(ire->ire_nce->nce_state == 9608 ND_REACHABLE); 9609 NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce); 9610 } 9611 9612 /* Prevent save_ire from getting deleted */ 9613 if (save_ire != NULL) { 9614 IRB_REFHOLD(save_ire->ire_bucket); 9615 /* Has it been removed already ? */ 9616 if (save_ire->ire_marks & IRE_MARK_CONDEMNED) { 9617 IRB_REFRELE(save_ire->ire_bucket); 9618 ire_refrele(save_ire); 9619 break; 9620 } 9621 } 9622 9623 ire_add_then_send(q, ire, first_mp); 9624 9625 /* Assert that save_ire is not deleted yet. */ 9626 if (save_ire != NULL) { 9627 ASSERT(save_ire->ire_ptpn != NULL); 9628 IRB_REFRELE(save_ire->ire_bucket); 9629 ire_refrele(save_ire); 9630 save_ire = NULL; 9631 } 9632 if (fire != NULL) { 9633 ire_refrele(fire); 9634 fire = NULL; 9635 } 9636 9637 /* 9638 * the resolution loop is re-entered if this 9639 * was requested through flags and if we 9640 * actually are in a multirouting case. 9641 */ 9642 if ((flags & RTF_MULTIRT) && (copy_mp != NULL)) { 9643 boolean_t need_resolve = 9644 ire_multirt_need_resolve(ipha_dst, 9645 MBLK_GETLABEL(copy_mp), ipst); 9646 if (!need_resolve) { 9647 MULTIRT_DEBUG_UNTAG(copy_mp); 9648 freemsg(copy_mp); 9649 copy_mp = NULL; 9650 } else { 9651 /* 9652 * ipif_lookup_group() calls 9653 * ire_lookup_multi() that uses 9654 * ire_ftable_lookup() to find 9655 * an IRE_INTERFACE for the group. 9656 * In the multirt case, 9657 * ire_lookup_multi() then invokes 9658 * ire_multirt_lookup() to find 9659 * the next resolvable ire. 9660 * As a result, we obtain an new 9661 * interface, derived from the 9662 * next ire. 9663 */ 9664 ipif_refrele(ipif); 9665 ipif = ipif_lookup_group(ipha_dst, 9666 zoneid, ipst); 9667 ip2dbg(("ip_newroute_ipif: " 9668 "multirt dst %08x, ipif %p\n", 9669 htonl(dst), (void *)ipif)); 9670 if (ipif != NULL) { 9671 mp = copy_mp; 9672 copy_mp = NULL; 9673 multirt_resolve_next = B_TRUE; 9674 continue; 9675 } else { 9676 freemsg(copy_mp); 9677 } 9678 } 9679 } 9680 if (ipif != NULL) 9681 ipif_refrele(ipif); 9682 ill_refrele(dst_ill); 9683 ipif_refrele(src_ipif); 9684 return; 9685 } 9686 case IRE_IF_RESOLVER: 9687 /* 9688 * We can't build an IRE_CACHE yet, but at least 9689 * we found a resolver that can help. 9690 */ 9691 res_mp = dst_ill->ill_resolver_mp; 9692 if (!OK_RESOLVER_MP(res_mp)) 9693 break; 9694 9695 /* 9696 * We obtain a partial IRE_CACHE which we will pass 9697 * along with the resolver query. When the response 9698 * comes back it will be there ready for us to add. 9699 * The new ire inherits the IRE_OFFSUBNET flags 9700 * and source address, if this was requested. 9701 * The ire_max_frag is atomically set under the 9702 * irebucket lock in ire_add_v[46]. Only in the 9703 * case of IRE_MARK_NOADD, we set it here itself. 9704 */ 9705 ire = ire_create_mp( 9706 (uchar_t *)&dst, /* dest address */ 9707 (uchar_t *)&ip_g_all_ones, /* mask */ 9708 (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 9709 NULL, /* gateway address */ 9710 NULL, /* no in_src_addr */ 9711 (ire_marks & IRE_MARK_NOADD) ? 9712 ipif->ipif_mtu : 0, /* max_frag */ 9713 NULL, /* Fast path header */ 9714 dst_ill->ill_rq, /* recv-from queue */ 9715 dst_ill->ill_wq, /* send-to queue */ 9716 IRE_CACHE, 9717 NULL, /* let ire_nce_init figure res_mp out */ 9718 src_ipif, 9719 NULL, 9720 (save_ire != NULL ? save_ire->ire_mask : 0), 9721 (fire != NULL) ? /* Parent handle */ 9722 fire->ire_phandle : 0, 9723 ihandle, /* Interface handle */ 9724 (fire != NULL) ? /* flags if any */ 9725 (fire->ire_flags & 9726 (RTF_SETSRC | RTF_MULTIRT)) : 0, 9727 (save_ire == NULL ? &ire_uinfo_null : 9728 &save_ire->ire_uinfo), 9729 NULL, 9730 NULL, 9731 ipst); 9732 9733 if (save_ire != NULL) { 9734 ire_refrele(save_ire); 9735 save_ire = NULL; 9736 } 9737 if (ire == NULL) 9738 break; 9739 9740 ire->ire_marks |= ire_marks; 9741 /* 9742 * Construct message chain for the resolver of the 9743 * form: 9744 * ARP_REQ_MBLK-->IRE_MBLK-->Packet 9745 * 9746 * NOTE : ire will be added later when the response 9747 * comes back from ARP. If the response does not 9748 * come back, ARP frees the packet. For this reason, 9749 * we can't REFHOLD the bucket of save_ire to prevent 9750 * deletions. We may not be able to REFRELE the 9751 * bucket if the response never comes back. 9752 * Thus, before adding the ire, ire_add_v4 will make 9753 * sure that the interface route does not get deleted. 9754 * This is the only case unlike ip_newroute_v6, 9755 * ip_newroute_ipif_v6 where we can always prevent 9756 * deletions because ire_add_then_send is called after 9757 * creating the IRE. 9758 * If IRE_MARK_NOADD is set, then ire_add_then_send 9759 * does not add this IRE into the IRE CACHE. 9760 */ 9761 ASSERT(ire->ire_mp != NULL); 9762 ire->ire_mp->b_cont = first_mp; 9763 /* Have saved_mp handy, for cleanup if canput fails */ 9764 saved_mp = mp; 9765 mp = copyb(res_mp); 9766 if (mp == NULL) { 9767 /* Prepare for cleanup */ 9768 mp = saved_mp; /* pkt */ 9769 ire_delete(ire); /* ire_mp */ 9770 ire = NULL; 9771 if (copy_mp != NULL) { 9772 MULTIRT_DEBUG_UNTAG(copy_mp); 9773 freemsg(copy_mp); 9774 copy_mp = NULL; 9775 } 9776 break; 9777 } 9778 linkb(mp, ire->ire_mp); 9779 9780 /* 9781 * Fill in the source and dest addrs for the resolver. 9782 * NOTE: this depends on memory layouts imposed by 9783 * ill_init(). 9784 */ 9785 areq = (areq_t *)mp->b_rptr; 9786 addrp = (ipaddr_t *)((char *)areq + 9787 areq->areq_sender_addr_offset); 9788 *addrp = ire->ire_src_addr; 9789 addrp = (ipaddr_t *)((char *)areq + 9790 areq->areq_target_addr_offset); 9791 *addrp = dst; 9792 /* Up to the resolver. */ 9793 if (canputnext(dst_ill->ill_rq) && 9794 !(dst_ill->ill_arp_closing)) { 9795 putnext(dst_ill->ill_rq, mp); 9796 /* 9797 * The response will come back in ip_wput 9798 * with db_type IRE_DB_TYPE. 9799 */ 9800 } else { 9801 mp->b_cont = NULL; 9802 freeb(mp); /* areq */ 9803 ire_delete(ire); /* ire_mp */ 9804 saved_mp->b_next = NULL; 9805 saved_mp->b_prev = NULL; 9806 freemsg(first_mp); /* pkt */ 9807 ip2dbg(("ip_newroute_ipif: dropped\n")); 9808 } 9809 9810 if (fire != NULL) { 9811 ire_refrele(fire); 9812 fire = NULL; 9813 } 9814 9815 9816 /* 9817 * The resolution loop is re-entered if this was 9818 * requested through flags and we actually are 9819 * in a multirouting case. 9820 */ 9821 if ((flags & RTF_MULTIRT) && (copy_mp != NULL)) { 9822 boolean_t need_resolve = 9823 ire_multirt_need_resolve(ipha_dst, 9824 MBLK_GETLABEL(copy_mp), ipst); 9825 if (!need_resolve) { 9826 MULTIRT_DEBUG_UNTAG(copy_mp); 9827 freemsg(copy_mp); 9828 copy_mp = NULL; 9829 } else { 9830 /* 9831 * ipif_lookup_group() calls 9832 * ire_lookup_multi() that uses 9833 * ire_ftable_lookup() to find 9834 * an IRE_INTERFACE for the group. 9835 * In the multirt case, 9836 * ire_lookup_multi() then invokes 9837 * ire_multirt_lookup() to find 9838 * the next resolvable ire. 9839 * As a result, we obtain an new 9840 * interface, derived from the 9841 * next ire. 9842 */ 9843 ipif_refrele(ipif); 9844 ipif = ipif_lookup_group(ipha_dst, 9845 zoneid, ipst); 9846 if (ipif != NULL) { 9847 mp = copy_mp; 9848 copy_mp = NULL; 9849 multirt_resolve_next = B_TRUE; 9850 continue; 9851 } else { 9852 freemsg(copy_mp); 9853 } 9854 } 9855 } 9856 if (ipif != NULL) 9857 ipif_refrele(ipif); 9858 ill_refrele(dst_ill); 9859 ipif_refrele(src_ipif); 9860 return; 9861 default: 9862 break; 9863 } 9864 } while (multirt_resolve_next); 9865 9866 err_ret: 9867 ip2dbg(("ip_newroute_ipif: dropped\n")); 9868 if (fire != NULL) 9869 ire_refrele(fire); 9870 ipif_refrele(ipif); 9871 /* Did this packet originate externally? */ 9872 if (dst_ill != NULL) 9873 ill_refrele(dst_ill); 9874 if (src_ipif != NULL) 9875 ipif_refrele(src_ipif); 9876 if (mp->b_prev || mp->b_next) { 9877 mp->b_next = NULL; 9878 mp->b_prev = NULL; 9879 } else { 9880 /* 9881 * Since ip_wput() isn't close to finished, we fill 9882 * in enough of the header for credible error reporting. 9883 */ 9884 if (ip_hdr_complete((ipha_t *)mp->b_rptr, zoneid, ipst)) { 9885 /* Failed */ 9886 freemsg(first_mp); 9887 if (ire != NULL) 9888 ire_refrele(ire); 9889 return; 9890 } 9891 } 9892 /* 9893 * At this point we will have ire only if RTF_BLACKHOLE 9894 * or RTF_REJECT flags are set on the IRE. It will not 9895 * generate ICMP_HOST_UNREACHABLE if RTF_BLACKHOLE is set. 9896 */ 9897 if (ire != NULL) { 9898 if (ire->ire_flags & RTF_BLACKHOLE) { 9899 ire_refrele(ire); 9900 freemsg(first_mp); 9901 return; 9902 } 9903 ire_refrele(ire); 9904 } 9905 icmp_unreachable(q, first_mp, ICMP_HOST_UNREACHABLE, zoneid, ipst); 9906 } 9907 9908 /* Name/Value Table Lookup Routine */ 9909 char * 9910 ip_nv_lookup(nv_t *nv, int value) 9911 { 9912 if (!nv) 9913 return (NULL); 9914 for (; nv->nv_name; nv++) { 9915 if (nv->nv_value == value) 9916 return (nv->nv_name); 9917 } 9918 return ("unknown"); 9919 } 9920 9921 /* 9922 * This is a module open, i.e. this is a control stream for access 9923 * to a DLPI device. We allocate an ill_t as the instance data in 9924 * this case. 9925 */ 9926 int 9927 ip_modopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 9928 { 9929 ill_t *ill; 9930 int err; 9931 zoneid_t zoneid; 9932 netstack_t *ns; 9933 ip_stack_t *ipst; 9934 9935 /* 9936 * Prevent unprivileged processes from pushing IP so that 9937 * they can't send raw IP. 9938 */ 9939 if (secpolicy_net_rawaccess(credp) != 0) 9940 return (EPERM); 9941 9942 ns = netstack_find_by_cred(credp); 9943 ASSERT(ns != NULL); 9944 ipst = ns->netstack_ip; 9945 ASSERT(ipst != NULL); 9946 9947 /* 9948 * For exclusive stacks we set the zoneid to zero 9949 * to make IP operate as if in the global zone. 9950 */ 9951 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID) 9952 zoneid = GLOBAL_ZONEID; 9953 else 9954 zoneid = crgetzoneid(credp); 9955 9956 ill = (ill_t *)mi_open_alloc_sleep(sizeof (ill_t)); 9957 q->q_ptr = WR(q)->q_ptr = ill; 9958 ill->ill_ipst = ipst; 9959 ill->ill_zoneid = zoneid; 9960 9961 /* 9962 * ill_init initializes the ill fields and then sends down 9963 * down a DL_INFO_REQ after calling qprocson. 9964 */ 9965 err = ill_init(q, ill); 9966 if (err != 0) { 9967 mi_free(ill); 9968 netstack_rele(ipst->ips_netstack); 9969 q->q_ptr = NULL; 9970 WR(q)->q_ptr = NULL; 9971 return (err); 9972 } 9973 9974 /* ill_init initializes the ipsq marking this thread as writer */ 9975 ipsq_exit(ill->ill_phyint->phyint_ipsq, B_TRUE, B_TRUE); 9976 /* Wait for the DL_INFO_ACK */ 9977 mutex_enter(&ill->ill_lock); 9978 while (ill->ill_state_flags & ILL_LL_SUBNET_PENDING) { 9979 /* 9980 * Return value of 0 indicates a pending signal. 9981 */ 9982 err = cv_wait_sig(&ill->ill_cv, &ill->ill_lock); 9983 if (err == 0) { 9984 mutex_exit(&ill->ill_lock); 9985 (void) ip_close(q, 0); 9986 return (EINTR); 9987 } 9988 } 9989 mutex_exit(&ill->ill_lock); 9990 9991 /* 9992 * ip_rput_other could have set an error in ill_error on 9993 * receipt of M_ERROR. 9994 */ 9995 9996 err = ill->ill_error; 9997 if (err != 0) { 9998 (void) ip_close(q, 0); 9999 return (err); 10000 } 10001 10002 ill->ill_credp = credp; 10003 crhold(credp); 10004 10005 mutex_enter(&ipst->ips_ip_mi_lock); 10006 err = mi_open_link(&ipst->ips_ip_g_head, (IDP)ill, devp, flag, sflag, 10007 credp); 10008 mutex_exit(&ipst->ips_ip_mi_lock); 10009 if (err) { 10010 (void) ip_close(q, 0); 10011 return (err); 10012 } 10013 return (0); 10014 } 10015 10016 /* IP open routine. */ 10017 int 10018 ip_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 10019 { 10020 conn_t *connp; 10021 major_t maj; 10022 zoneid_t zoneid; 10023 netstack_t *ns; 10024 ip_stack_t *ipst; 10025 10026 TRACE_1(TR_FAC_IP, TR_IP_OPEN, "ip_open: q %p", q); 10027 10028 /* Allow reopen. */ 10029 if (q->q_ptr != NULL) 10030 return (0); 10031 10032 if (sflag & MODOPEN) { 10033 /* This is a module open */ 10034 return (ip_modopen(q, devp, flag, sflag, credp)); 10035 } 10036 10037 ns = netstack_find_by_cred(credp); 10038 ASSERT(ns != NULL); 10039 ipst = ns->netstack_ip; 10040 ASSERT(ipst != NULL); 10041 10042 /* 10043 * For exclusive stacks we set the zoneid to zero 10044 * to make IP operate as if in the global zone. 10045 */ 10046 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID) 10047 zoneid = GLOBAL_ZONEID; 10048 else 10049 zoneid = crgetzoneid(credp); 10050 10051 /* 10052 * We are opening as a device. This is an IP client stream, and we 10053 * allocate an conn_t as the instance data. 10054 */ 10055 connp = ipcl_conn_create(IPCL_IPCCONN, KM_SLEEP, ipst->ips_netstack); 10056 10057 /* 10058 * ipcl_conn_create did a netstack_hold. Undo the hold that was 10059 * done by netstack_find_by_cred() 10060 */ 10061 netstack_rele(ipst->ips_netstack); 10062 10063 connp->conn_zoneid = zoneid; 10064 10065 connp->conn_upq = q; 10066 q->q_ptr = WR(q)->q_ptr = connp; 10067 10068 if (flag & SO_SOCKSTR) 10069 connp->conn_flags |= IPCL_SOCKET; 10070 10071 /* Minor tells us which /dev entry was opened */ 10072 if (geteminor(*devp) == IPV6_MINOR) { 10073 connp->conn_flags |= IPCL_ISV6; 10074 connp->conn_af_isv6 = B_TRUE; 10075 ip_setqinfo(q, geteminor(*devp), B_FALSE, ipst); 10076 connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT; 10077 } else { 10078 connp->conn_af_isv6 = B_FALSE; 10079 connp->conn_pkt_isv6 = B_FALSE; 10080 } 10081 10082 if ((connp->conn_dev = inet_minor_alloc(ip_minor_arena)) == 0) { 10083 /* CONN_DEC_REF takes care of netstack_rele() */ 10084 q->q_ptr = WR(q)->q_ptr = NULL; 10085 CONN_DEC_REF(connp); 10086 return (EBUSY); 10087 } 10088 10089 maj = getemajor(*devp); 10090 *devp = makedevice(maj, (minor_t)connp->conn_dev); 10091 10092 /* 10093 * connp->conn_cred is crfree()ed in ipcl_conn_destroy() 10094 */ 10095 connp->conn_cred = credp; 10096 crhold(connp->conn_cred); 10097 10098 /* 10099 * If the caller has the process-wide flag set, then default to MAC 10100 * exempt mode. This allows read-down to unlabeled hosts. 10101 */ 10102 if (getpflags(NET_MAC_AWARE, credp) != 0) 10103 connp->conn_mac_exempt = B_TRUE; 10104 10105 /* 10106 * This should only happen for ndd, netstat, raw socket or other SCTP 10107 * administrative ops. In these cases, we just need a normal conn_t 10108 * with ulp set to IPPROTO_SCTP. All other ops are trapped and 10109 * an error will be returned. 10110 */ 10111 if (maj != SCTP_MAJ && maj != SCTP6_MAJ) { 10112 connp->conn_rq = q; 10113 connp->conn_wq = WR(q); 10114 } else { 10115 connp->conn_ulp = IPPROTO_SCTP; 10116 connp->conn_rq = connp->conn_wq = NULL; 10117 } 10118 /* Non-zero default values */ 10119 connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 10120 10121 /* 10122 * Make the conn globally visible to walkers 10123 */ 10124 mutex_enter(&connp->conn_lock); 10125 connp->conn_state_flags &= ~CONN_INCIPIENT; 10126 mutex_exit(&connp->conn_lock); 10127 ASSERT(connp->conn_ref == 1); 10128 10129 qprocson(q); 10130 10131 return (0); 10132 } 10133 10134 /* 10135 * Change q_qinfo based on the value of isv6. 10136 * This can not called on an ill queue. 10137 * Note that there is no race since either q_qinfo works for conn queues - it 10138 * is just an optimization to enter the best wput routine directly. 10139 */ 10140 void 10141 ip_setqinfo(queue_t *q, minor_t minor, boolean_t bump_mib, ip_stack_t *ipst) 10142 { 10143 ASSERT(q->q_flag & QREADR); 10144 ASSERT(WR(q)->q_next == NULL); 10145 ASSERT(q->q_ptr != NULL); 10146 10147 if (minor == IPV6_MINOR) { 10148 if (bump_mib) { 10149 BUMP_MIB(&ipst->ips_ip6_mib, 10150 ipIfStatsOutSwitchIPVersion); 10151 } 10152 q->q_qinfo = &rinit_ipv6; 10153 WR(q)->q_qinfo = &winit_ipv6; 10154 (Q_TO_CONN(q))->conn_pkt_isv6 = B_TRUE; 10155 } else { 10156 if (bump_mib) { 10157 BUMP_MIB(&ipst->ips_ip_mib, 10158 ipIfStatsOutSwitchIPVersion); 10159 } 10160 q->q_qinfo = &iprinit; 10161 WR(q)->q_qinfo = &ipwinit; 10162 (Q_TO_CONN(q))->conn_pkt_isv6 = B_FALSE; 10163 } 10164 10165 } 10166 10167 /* 10168 * See if IPsec needs loading because of the options in mp. 10169 */ 10170 static boolean_t 10171 ipsec_opt_present(mblk_t *mp) 10172 { 10173 uint8_t *optcp, *next_optcp, *opt_endcp; 10174 struct opthdr *opt; 10175 struct T_opthdr *topt; 10176 int opthdr_len; 10177 t_uscalar_t optname, optlevel; 10178 struct T_optmgmt_req *tor = (struct T_optmgmt_req *)mp->b_rptr; 10179 ipsec_req_t *ipsr; 10180 10181 /* 10182 * Walk through the mess, and find IP_SEC_OPT. If it's there, 10183 * return TRUE. 10184 */ 10185 10186 optcp = mi_offset_param(mp, tor->OPT_offset, tor->OPT_length); 10187 opt_endcp = optcp + tor->OPT_length; 10188 if (tor->PRIM_type == T_OPTMGMT_REQ) { 10189 opthdr_len = sizeof (struct T_opthdr); 10190 } else { /* O_OPTMGMT_REQ */ 10191 ASSERT(tor->PRIM_type == T_SVR4_OPTMGMT_REQ); 10192 opthdr_len = sizeof (struct opthdr); 10193 } 10194 for (; optcp < opt_endcp; optcp = next_optcp) { 10195 if (optcp + opthdr_len > opt_endcp) 10196 return (B_FALSE); /* Not enough option header. */ 10197 if (tor->PRIM_type == T_OPTMGMT_REQ) { 10198 topt = (struct T_opthdr *)optcp; 10199 optlevel = topt->level; 10200 optname = topt->name; 10201 next_optcp = optcp + _TPI_ALIGN_TOPT(topt->len); 10202 } else { 10203 opt = (struct opthdr *)optcp; 10204 optlevel = opt->level; 10205 optname = opt->name; 10206 next_optcp = optcp + opthdr_len + 10207 _TPI_ALIGN_OPT(opt->len); 10208 } 10209 if ((next_optcp < optcp) || /* wraparound pointer space */ 10210 ((next_optcp >= opt_endcp) && /* last option bad len */ 10211 ((next_optcp - opt_endcp) >= __TPI_ALIGN_SIZE))) 10212 return (B_FALSE); /* bad option buffer */ 10213 if ((optlevel == IPPROTO_IP && optname == IP_SEC_OPT) || 10214 (optlevel == IPPROTO_IPV6 && optname == IPV6_SEC_OPT)) { 10215 /* 10216 * Check to see if it's an all-bypass or all-zeroes 10217 * IPsec request. Don't bother loading IPsec if 10218 * the socket doesn't want to use it. (A good example 10219 * is a bypass request.) 10220 * 10221 * Basically, if any of the non-NEVER bits are set, 10222 * load IPsec. 10223 */ 10224 ipsr = (ipsec_req_t *)(optcp + opthdr_len); 10225 if ((ipsr->ipsr_ah_req & ~IPSEC_PREF_NEVER) != 0 || 10226 (ipsr->ipsr_esp_req & ~IPSEC_PREF_NEVER) != 0 || 10227 (ipsr->ipsr_self_encap_req & ~IPSEC_PREF_NEVER) 10228 != 0) 10229 return (B_TRUE); 10230 } 10231 } 10232 return (B_FALSE); 10233 } 10234 10235 /* 10236 * If conn is is waiting for ipsec to finish loading, kick it. 10237 */ 10238 /* ARGSUSED */ 10239 static void 10240 conn_restart_ipsec_waiter(conn_t *connp, void *arg) 10241 { 10242 t_scalar_t optreq_prim; 10243 mblk_t *mp; 10244 cred_t *cr; 10245 int err = 0; 10246 10247 /* 10248 * This function is called, after ipsec loading is complete. 10249 * Since IP checks exclusively and atomically (i.e it prevents 10250 * ipsec load from completing until ip_optcom_req completes) 10251 * whether ipsec load is complete, there cannot be a race with IP 10252 * trying to set the CONN_IPSEC_LOAD_WAIT flag on any conn now. 10253 */ 10254 mutex_enter(&connp->conn_lock); 10255 if (connp->conn_state_flags & CONN_IPSEC_LOAD_WAIT) { 10256 ASSERT(connp->conn_ipsec_opt_mp != NULL); 10257 mp = connp->conn_ipsec_opt_mp; 10258 connp->conn_ipsec_opt_mp = NULL; 10259 connp->conn_state_flags &= ~CONN_IPSEC_LOAD_WAIT; 10260 cr = DB_CREDDEF(mp, GET_QUEUE_CRED(CONNP_TO_WQ(connp))); 10261 mutex_exit(&connp->conn_lock); 10262 10263 ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO); 10264 10265 optreq_prim = ((union T_primitives *)mp->b_rptr)->type; 10266 if (optreq_prim == T_OPTMGMT_REQ) { 10267 err = tpi_optcom_req(CONNP_TO_WQ(connp), mp, cr, 10268 &ip_opt_obj); 10269 } else { 10270 ASSERT(optreq_prim == T_SVR4_OPTMGMT_REQ); 10271 err = svr4_optcom_req(CONNP_TO_WQ(connp), mp, cr, 10272 &ip_opt_obj); 10273 } 10274 if (err != EINPROGRESS) 10275 CONN_OPER_PENDING_DONE(connp); 10276 return; 10277 } 10278 mutex_exit(&connp->conn_lock); 10279 } 10280 10281 /* 10282 * Called from the ipsec_loader thread, outside any perimeter, to tell 10283 * ip qenable any of the queues waiting for the ipsec loader to 10284 * complete. 10285 */ 10286 void 10287 ip_ipsec_load_complete(ipsec_stack_t *ipss) 10288 { 10289 netstack_t *ns = ipss->ipsec_netstack; 10290 10291 ipcl_walk(conn_restart_ipsec_waiter, NULL, ns->netstack_ip); 10292 } 10293 10294 /* 10295 * Can't be used. Need to call svr4* -> optset directly. the leaf routine 10296 * determines the grp on which it has to become exclusive, queues the mp 10297 * and sq draining restarts the optmgmt 10298 */ 10299 static boolean_t 10300 ip_check_for_ipsec_opt(queue_t *q, mblk_t *mp) 10301 { 10302 conn_t *connp = Q_TO_CONN(q); 10303 ipsec_stack_t *ipss = connp->conn_netstack->netstack_ipsec; 10304 10305 /* 10306 * Take IPsec requests and treat them special. 10307 */ 10308 if (ipsec_opt_present(mp)) { 10309 /* First check if IPsec is loaded. */ 10310 mutex_enter(&ipss->ipsec_loader_lock); 10311 if (ipss->ipsec_loader_state != IPSEC_LOADER_WAIT) { 10312 mutex_exit(&ipss->ipsec_loader_lock); 10313 return (B_FALSE); 10314 } 10315 mutex_enter(&connp->conn_lock); 10316 connp->conn_state_flags |= CONN_IPSEC_LOAD_WAIT; 10317 10318 ASSERT(connp->conn_ipsec_opt_mp == NULL); 10319 connp->conn_ipsec_opt_mp = mp; 10320 mutex_exit(&connp->conn_lock); 10321 mutex_exit(&ipss->ipsec_loader_lock); 10322 10323 ipsec_loader_loadnow(ipss); 10324 return (B_TRUE); 10325 } 10326 return (B_FALSE); 10327 } 10328 10329 /* 10330 * Set IPsec policy from an ipsec_req_t. If the req is not "zero" and valid, 10331 * all of them are copied to the conn_t. If the req is "zero", the policy is 10332 * zeroed out. A "zero" policy has zero ipsr_{ah,req,self_encap}_req 10333 * fields. 10334 * We keep only the latest setting of the policy and thus policy setting 10335 * is not incremental/cumulative. 10336 * 10337 * Requests to set policies with multiple alternative actions will 10338 * go through a different API. 10339 */ 10340 int 10341 ipsec_set_req(cred_t *cr, conn_t *connp, ipsec_req_t *req) 10342 { 10343 uint_t ah_req = 0; 10344 uint_t esp_req = 0; 10345 uint_t se_req = 0; 10346 ipsec_selkey_t sel; 10347 ipsec_act_t *actp = NULL; 10348 uint_t nact; 10349 ipsec_policy_t *pin4 = NULL, *pout4 = NULL; 10350 ipsec_policy_t *pin6 = NULL, *pout6 = NULL; 10351 ipsec_policy_root_t *pr; 10352 ipsec_policy_head_t *ph; 10353 int fam; 10354 boolean_t is_pol_reset; 10355 int error = 0; 10356 netstack_t *ns = connp->conn_netstack; 10357 ip_stack_t *ipst = ns->netstack_ip; 10358 ipsec_stack_t *ipss = ns->netstack_ipsec; 10359 10360 #define REQ_MASK (IPSEC_PREF_REQUIRED|IPSEC_PREF_NEVER) 10361 10362 /* 10363 * The IP_SEC_OPT option does not allow variable length parameters, 10364 * hence a request cannot be NULL. 10365 */ 10366 if (req == NULL) 10367 return (EINVAL); 10368 10369 ah_req = req->ipsr_ah_req; 10370 esp_req = req->ipsr_esp_req; 10371 se_req = req->ipsr_self_encap_req; 10372 10373 /* 10374 * Are we dealing with a request to reset the policy (i.e. 10375 * zero requests). 10376 */ 10377 is_pol_reset = ((ah_req & REQ_MASK) == 0 && 10378 (esp_req & REQ_MASK) == 0 && 10379 (se_req & REQ_MASK) == 0); 10380 10381 if (!is_pol_reset) { 10382 /* 10383 * If we couldn't load IPsec, fail with "protocol 10384 * not supported". 10385 * IPsec may not have been loaded for a request with zero 10386 * policies, so we don't fail in this case. 10387 */ 10388 mutex_enter(&ipss->ipsec_loader_lock); 10389 if (ipss->ipsec_loader_state != IPSEC_LOADER_SUCCEEDED) { 10390 mutex_exit(&ipss->ipsec_loader_lock); 10391 return (EPROTONOSUPPORT); 10392 } 10393 mutex_exit(&ipss->ipsec_loader_lock); 10394 10395 /* 10396 * Test for valid requests. Invalid algorithms 10397 * need to be tested by IPSEC code because new 10398 * algorithms can be added dynamically. 10399 */ 10400 if ((ah_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 || 10401 (esp_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0 || 10402 (se_req & ~(REQ_MASK|IPSEC_PREF_UNIQUE)) != 0) { 10403 return (EINVAL); 10404 } 10405 10406 /* 10407 * Only privileged users can issue these 10408 * requests. 10409 */ 10410 if (((ah_req & IPSEC_PREF_NEVER) || 10411 (esp_req & IPSEC_PREF_NEVER) || 10412 (se_req & IPSEC_PREF_NEVER)) && 10413 secpolicy_ip_config(cr, B_FALSE) != 0) { 10414 return (EPERM); 10415 } 10416 10417 /* 10418 * The IPSEC_PREF_REQUIRED and IPSEC_PREF_NEVER 10419 * are mutually exclusive. 10420 */ 10421 if (((ah_req & REQ_MASK) == REQ_MASK) || 10422 ((esp_req & REQ_MASK) == REQ_MASK) || 10423 ((se_req & REQ_MASK) == REQ_MASK)) { 10424 /* Both of them are set */ 10425 return (EINVAL); 10426 } 10427 } 10428 10429 mutex_enter(&connp->conn_lock); 10430 10431 /* 10432 * If we have already cached policies in ip_bind_connected*(), don't 10433 * let them change now. We cache policies for connections 10434 * whose src,dst [addr, port] is known. 10435 */ 10436 if (connp->conn_policy_cached) { 10437 mutex_exit(&connp->conn_lock); 10438 return (EINVAL); 10439 } 10440 10441 /* 10442 * We have a zero policies, reset the connection policy if already 10443 * set. This will cause the connection to inherit the 10444 * global policy, if any. 10445 */ 10446 if (is_pol_reset) { 10447 if (connp->conn_policy != NULL) { 10448 IPPH_REFRELE(connp->conn_policy, ipst->ips_netstack); 10449 connp->conn_policy = NULL; 10450 } 10451 connp->conn_flags &= ~IPCL_CHECK_POLICY; 10452 connp->conn_in_enforce_policy = B_FALSE; 10453 connp->conn_out_enforce_policy = B_FALSE; 10454 mutex_exit(&connp->conn_lock); 10455 return (0); 10456 } 10457 10458 ph = connp->conn_policy = ipsec_polhead_split(connp->conn_policy, 10459 ipst->ips_netstack); 10460 if (ph == NULL) 10461 goto enomem; 10462 10463 ipsec_actvec_from_req(req, &actp, &nact, ipst->ips_netstack); 10464 if (actp == NULL) 10465 goto enomem; 10466 10467 /* 10468 * Always allocate IPv4 policy entries, since they can also 10469 * apply to ipv6 sockets being used in ipv4-compat mode. 10470 */ 10471 bzero(&sel, sizeof (sel)); 10472 sel.ipsl_valid = IPSL_IPV4; 10473 10474 pin4 = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET, NULL, 10475 ipst->ips_netstack); 10476 if (pin4 == NULL) 10477 goto enomem; 10478 10479 pout4 = ipsec_policy_create(&sel, actp, nact, IPSEC_PRIO_SOCKET, NULL, 10480 ipst->ips_netstack); 10481 if (pout4 == NULL) 10482 goto enomem; 10483 10484 if (connp->conn_pkt_isv6) { 10485 /* 10486 * We're looking at a v6 socket, also allocate the 10487 * v6-specific entries... 10488 */ 10489 sel.ipsl_valid = IPSL_IPV6; 10490 pin6 = ipsec_policy_create(&sel, actp, nact, 10491 IPSEC_PRIO_SOCKET, NULL, ipst->ips_netstack); 10492 if (pin6 == NULL) 10493 goto enomem; 10494 10495 pout6 = ipsec_policy_create(&sel, actp, nact, 10496 IPSEC_PRIO_SOCKET, NULL, ipst->ips_netstack); 10497 if (pout6 == NULL) 10498 goto enomem; 10499 10500 /* 10501 * .. and file them away in the right place. 10502 */ 10503 fam = IPSEC_AF_V6; 10504 pr = &ph->iph_root[IPSEC_TYPE_INBOUND]; 10505 HASHLIST_INSERT(pin6, ipsp_hash, pr->ipr_nonhash[fam]); 10506 ipsec_insert_always(&ph->iph_rulebyid, pin6); 10507 pr = &ph->iph_root[IPSEC_TYPE_OUTBOUND]; 10508 HASHLIST_INSERT(pout6, ipsp_hash, pr->ipr_nonhash[fam]); 10509 ipsec_insert_always(&ph->iph_rulebyid, pout6); 10510 } 10511 10512 ipsec_actvec_free(actp, nact); 10513 10514 /* 10515 * File the v4 policies. 10516 */ 10517 fam = IPSEC_AF_V4; 10518 pr = &ph->iph_root[IPSEC_TYPE_INBOUND]; 10519 HASHLIST_INSERT(pin4, ipsp_hash, pr->ipr_nonhash[fam]); 10520 ipsec_insert_always(&ph->iph_rulebyid, pin4); 10521 10522 pr = &ph->iph_root[IPSEC_TYPE_OUTBOUND]; 10523 HASHLIST_INSERT(pout4, ipsp_hash, pr->ipr_nonhash[fam]); 10524 ipsec_insert_always(&ph->iph_rulebyid, pout4); 10525 10526 /* 10527 * If the requests need security, set enforce_policy. 10528 * If the requests are IPSEC_PREF_NEVER, one should 10529 * still set conn_out_enforce_policy so that an ipsec_out 10530 * gets attached in ip_wput. This is needed so that 10531 * for connections that we don't cache policy in ip_bind, 10532 * if global policy matches in ip_wput_attach_policy, we 10533 * don't wrongly inherit global policy. Similarly, we need 10534 * to set conn_in_enforce_policy also so that we don't verify 10535 * policy wrongly. 10536 */ 10537 if ((ah_req & REQ_MASK) != 0 || 10538 (esp_req & REQ_MASK) != 0 || 10539 (se_req & REQ_MASK) != 0) { 10540 connp->conn_in_enforce_policy = B_TRUE; 10541 connp->conn_out_enforce_policy = B_TRUE; 10542 connp->conn_flags |= IPCL_CHECK_POLICY; 10543 } 10544 10545 mutex_exit(&connp->conn_lock); 10546 return (error); 10547 #undef REQ_MASK 10548 10549 /* 10550 * Common memory-allocation-failure exit path. 10551 */ 10552 enomem: 10553 mutex_exit(&connp->conn_lock); 10554 if (actp != NULL) 10555 ipsec_actvec_free(actp, nact); 10556 if (pin4 != NULL) 10557 IPPOL_REFRELE(pin4, ipst->ips_netstack); 10558 if (pout4 != NULL) 10559 IPPOL_REFRELE(pout4, ipst->ips_netstack); 10560 if (pin6 != NULL) 10561 IPPOL_REFRELE(pin6, ipst->ips_netstack); 10562 if (pout6 != NULL) 10563 IPPOL_REFRELE(pout6, ipst->ips_netstack); 10564 return (ENOMEM); 10565 } 10566 10567 /* 10568 * Only for options that pass in an IP addr. Currently only V4 options 10569 * pass in an ipif. V6 options always pass an ifindex specifying the ill. 10570 * So this function assumes level is IPPROTO_IP 10571 */ 10572 int 10573 ip_opt_set_ipif(conn_t *connp, ipaddr_t addr, boolean_t checkonly, int option, 10574 mblk_t *first_mp) 10575 { 10576 ipif_t *ipif = NULL; 10577 int error; 10578 ill_t *ill; 10579 int zoneid; 10580 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 10581 10582 ip2dbg(("ip_opt_set_ipif: ipaddr %X\n", addr)); 10583 10584 if (addr != INADDR_ANY || checkonly) { 10585 ASSERT(connp != NULL); 10586 zoneid = IPCL_ZONEID(connp); 10587 if (option == IP_NEXTHOP) { 10588 ipif = ipif_lookup_onlink_addr(addr, 10589 connp->conn_zoneid, ipst); 10590 } else { 10591 ipif = ipif_lookup_addr(addr, NULL, zoneid, 10592 CONNP_TO_WQ(connp), first_mp, ip_restart_optmgmt, 10593 &error, ipst); 10594 } 10595 if (ipif == NULL) { 10596 if (error == EINPROGRESS) 10597 return (error); 10598 else if ((option == IP_MULTICAST_IF) || 10599 (option == IP_NEXTHOP)) 10600 return (EHOSTUNREACH); 10601 else 10602 return (EINVAL); 10603 } else if (checkonly) { 10604 if (option == IP_MULTICAST_IF) { 10605 ill = ipif->ipif_ill; 10606 /* not supported by the virtual network iface */ 10607 if (IS_VNI(ill)) { 10608 ipif_refrele(ipif); 10609 return (EINVAL); 10610 } 10611 } 10612 ipif_refrele(ipif); 10613 return (0); 10614 } 10615 ill = ipif->ipif_ill; 10616 mutex_enter(&connp->conn_lock); 10617 mutex_enter(&ill->ill_lock); 10618 if ((ill->ill_state_flags & ILL_CONDEMNED) || 10619 (ipif->ipif_state_flags & IPIF_CONDEMNED)) { 10620 mutex_exit(&ill->ill_lock); 10621 mutex_exit(&connp->conn_lock); 10622 ipif_refrele(ipif); 10623 return (option == IP_MULTICAST_IF ? 10624 EHOSTUNREACH : EINVAL); 10625 } 10626 } else { 10627 mutex_enter(&connp->conn_lock); 10628 } 10629 10630 /* None of the options below are supported on the VNI */ 10631 if (ipif != NULL && IS_VNI(ipif->ipif_ill)) { 10632 mutex_exit(&ill->ill_lock); 10633 mutex_exit(&connp->conn_lock); 10634 ipif_refrele(ipif); 10635 return (EINVAL); 10636 } 10637 10638 switch (option) { 10639 case IP_DONTFAILOVER_IF: 10640 /* 10641 * This option is used by in.mpathd to ensure 10642 * that IPMP probe packets only go out on the 10643 * test interfaces. in.mpathd sets this option 10644 * on the non-failover interfaces. 10645 * For backward compatibility, this option 10646 * implicitly sets IP_MULTICAST_IF, as used 10647 * be done in bind(), so that ip_wput gets 10648 * this ipif to send mcast packets. 10649 */ 10650 if (ipif != NULL) { 10651 ASSERT(addr != INADDR_ANY); 10652 connp->conn_nofailover_ill = ipif->ipif_ill; 10653 connp->conn_multicast_ipif = ipif; 10654 } else { 10655 ASSERT(addr == INADDR_ANY); 10656 connp->conn_nofailover_ill = NULL; 10657 connp->conn_multicast_ipif = NULL; 10658 } 10659 break; 10660 10661 case IP_MULTICAST_IF: 10662 connp->conn_multicast_ipif = ipif; 10663 break; 10664 case IP_NEXTHOP: 10665 connp->conn_nexthop_v4 = addr; 10666 connp->conn_nexthop_set = B_TRUE; 10667 break; 10668 } 10669 10670 if (ipif != NULL) { 10671 mutex_exit(&ill->ill_lock); 10672 mutex_exit(&connp->conn_lock); 10673 ipif_refrele(ipif); 10674 return (0); 10675 } 10676 mutex_exit(&connp->conn_lock); 10677 /* We succeded in cleared the option */ 10678 return (0); 10679 } 10680 10681 /* 10682 * For options that pass in an ifindex specifying the ill. V6 options always 10683 * pass in an ill. Some v4 options also pass in ifindex specifying the ill. 10684 */ 10685 int 10686 ip_opt_set_ill(conn_t *connp, int ifindex, boolean_t isv6, boolean_t checkonly, 10687 int level, int option, mblk_t *first_mp) 10688 { 10689 ill_t *ill = NULL; 10690 int error = 0; 10691 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 10692 10693 ip2dbg(("ip_opt_set_ill: ifindex %d\n", ifindex)); 10694 if (ifindex != 0) { 10695 ASSERT(connp != NULL); 10696 ill = ill_lookup_on_ifindex(ifindex, isv6, CONNP_TO_WQ(connp), 10697 first_mp, ip_restart_optmgmt, &error, ipst); 10698 if (ill != NULL) { 10699 if (checkonly) { 10700 /* not supported by the virtual network iface */ 10701 if (IS_VNI(ill)) { 10702 ill_refrele(ill); 10703 return (EINVAL); 10704 } 10705 ill_refrele(ill); 10706 return (0); 10707 } 10708 if (!ipif_lookup_zoneid_group(ill, connp->conn_zoneid, 10709 0, NULL)) { 10710 ill_refrele(ill); 10711 ill = NULL; 10712 mutex_enter(&connp->conn_lock); 10713 goto setit; 10714 } 10715 mutex_enter(&connp->conn_lock); 10716 mutex_enter(&ill->ill_lock); 10717 if (ill->ill_state_flags & ILL_CONDEMNED) { 10718 mutex_exit(&ill->ill_lock); 10719 mutex_exit(&connp->conn_lock); 10720 ill_refrele(ill); 10721 ill = NULL; 10722 mutex_enter(&connp->conn_lock); 10723 } 10724 goto setit; 10725 } else if (error == EINPROGRESS) { 10726 return (error); 10727 } else { 10728 error = 0; 10729 } 10730 } 10731 mutex_enter(&connp->conn_lock); 10732 setit: 10733 ASSERT((level == IPPROTO_IP || level == IPPROTO_IPV6)); 10734 10735 /* 10736 * The options below assume that the ILL (if any) transmits and/or 10737 * receives traffic. Neither of which is true for the virtual network 10738 * interface, so fail setting these on a VNI. 10739 */ 10740 if (IS_VNI(ill)) { 10741 ASSERT(ill != NULL); 10742 mutex_exit(&ill->ill_lock); 10743 mutex_exit(&connp->conn_lock); 10744 ill_refrele(ill); 10745 return (EINVAL); 10746 } 10747 10748 if (level == IPPROTO_IP) { 10749 switch (option) { 10750 case IP_BOUND_IF: 10751 connp->conn_incoming_ill = ill; 10752 connp->conn_outgoing_ill = ill; 10753 connp->conn_orig_bound_ifindex = (ill == NULL) ? 10754 0 : ifindex; 10755 break; 10756 10757 case IP_XMIT_IF: 10758 /* 10759 * Similar to IP_BOUND_IF, but this only 10760 * determines the outgoing interface for 10761 * unicast packets. Also no IRE_CACHE entry 10762 * is added for the destination of the 10763 * outgoing packets. This feature is needed 10764 * for mobile IP. 10765 */ 10766 connp->conn_xmit_if_ill = ill; 10767 connp->conn_orig_xmit_ifindex = (ill == NULL) ? 10768 0 : ifindex; 10769 break; 10770 10771 case IP_MULTICAST_IF: 10772 /* 10773 * This option is an internal special. The socket 10774 * level IP_MULTICAST_IF specifies an 'ipaddr' and 10775 * is handled in ip_opt_set_ipif. IPV6_MULTICAST_IF 10776 * specifies an ifindex and we try first on V6 ill's. 10777 * If we don't find one, we they try using on v4 ill's 10778 * intenally and we come here. 10779 */ 10780 if (!checkonly && ill != NULL) { 10781 ipif_t *ipif; 10782 ipif = ill->ill_ipif; 10783 10784 if (ipif->ipif_state_flags & IPIF_CONDEMNED) { 10785 mutex_exit(&ill->ill_lock); 10786 mutex_exit(&connp->conn_lock); 10787 ill_refrele(ill); 10788 ill = NULL; 10789 mutex_enter(&connp->conn_lock); 10790 } else { 10791 connp->conn_multicast_ipif = ipif; 10792 } 10793 } 10794 break; 10795 } 10796 } else { 10797 switch (option) { 10798 case IPV6_BOUND_IF: 10799 connp->conn_incoming_ill = ill; 10800 connp->conn_outgoing_ill = ill; 10801 connp->conn_orig_bound_ifindex = (ill == NULL) ? 10802 0 : ifindex; 10803 break; 10804 10805 case IPV6_BOUND_PIF: 10806 /* 10807 * Limit all transmit to this ill. 10808 * Unlike IPV6_BOUND_IF, using this option 10809 * prevents load spreading and failover from 10810 * happening when the interface is part of the 10811 * group. That's why we don't need to remember 10812 * the ifindex in orig_bound_ifindex as in 10813 * IPV6_BOUND_IF. 10814 */ 10815 connp->conn_outgoing_pill = ill; 10816 break; 10817 10818 case IPV6_DONTFAILOVER_IF: 10819 /* 10820 * This option is used by in.mpathd to ensure 10821 * that IPMP probe packets only go out on the 10822 * test interfaces. in.mpathd sets this option 10823 * on the non-failover interfaces. 10824 */ 10825 connp->conn_nofailover_ill = ill; 10826 /* 10827 * For backward compatibility, this option 10828 * implicitly sets ip_multicast_ill as used in 10829 * IP_MULTICAST_IF so that ip_wput gets 10830 * this ipif to send mcast packets. 10831 */ 10832 connp->conn_multicast_ill = ill; 10833 connp->conn_orig_multicast_ifindex = (ill == NULL) ? 10834 0 : ifindex; 10835 break; 10836 10837 case IPV6_MULTICAST_IF: 10838 /* 10839 * Set conn_multicast_ill to be the IPv6 ill. 10840 * Set conn_multicast_ipif to be an IPv4 ipif 10841 * for ifindex to make IPv4 mapped addresses 10842 * on PF_INET6 sockets honor IPV6_MULTICAST_IF. 10843 * Even if no IPv6 ill exists for the ifindex 10844 * we need to check for an IPv4 ifindex in order 10845 * for this to work with mapped addresses. In that 10846 * case only set conn_multicast_ipif. 10847 */ 10848 if (!checkonly) { 10849 if (ifindex == 0) { 10850 connp->conn_multicast_ill = NULL; 10851 connp->conn_orig_multicast_ifindex = 0; 10852 connp->conn_multicast_ipif = NULL; 10853 } else if (ill != NULL) { 10854 connp->conn_multicast_ill = ill; 10855 connp->conn_orig_multicast_ifindex = 10856 ifindex; 10857 } 10858 } 10859 break; 10860 } 10861 } 10862 10863 if (ill != NULL) { 10864 mutex_exit(&ill->ill_lock); 10865 mutex_exit(&connp->conn_lock); 10866 ill_refrele(ill); 10867 return (0); 10868 } 10869 mutex_exit(&connp->conn_lock); 10870 /* 10871 * We succeeded in clearing the option (ifindex == 0) or failed to 10872 * locate the ill and could not set the option (ifindex != 0) 10873 */ 10874 return (ifindex == 0 ? 0 : EINVAL); 10875 } 10876 10877 /* This routine sets socket options. */ 10878 /* ARGSUSED */ 10879 int 10880 ip_opt_set(queue_t *q, uint_t optset_context, int level, int name, 10881 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 10882 void *dummy, cred_t *cr, mblk_t *first_mp) 10883 { 10884 int *i1 = (int *)invalp; 10885 conn_t *connp = Q_TO_CONN(q); 10886 int error = 0; 10887 boolean_t checkonly; 10888 ire_t *ire; 10889 boolean_t found; 10890 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 10891 10892 switch (optset_context) { 10893 10894 case SETFN_OPTCOM_CHECKONLY: 10895 checkonly = B_TRUE; 10896 /* 10897 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 10898 * inlen != 0 implies value supplied and 10899 * we have to "pretend" to set it. 10900 * inlen == 0 implies that there is no 10901 * value part in T_CHECK request and just validation 10902 * done elsewhere should be enough, we just return here. 10903 */ 10904 if (inlen == 0) { 10905 *outlenp = 0; 10906 return (0); 10907 } 10908 break; 10909 case SETFN_OPTCOM_NEGOTIATE: 10910 case SETFN_UD_NEGOTIATE: 10911 case SETFN_CONN_NEGOTIATE: 10912 checkonly = B_FALSE; 10913 break; 10914 default: 10915 /* 10916 * We should never get here 10917 */ 10918 *outlenp = 0; 10919 return (EINVAL); 10920 } 10921 10922 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 10923 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 10924 10925 /* 10926 * For fixed length options, no sanity check 10927 * of passed in length is done. It is assumed *_optcom_req() 10928 * routines do the right thing. 10929 */ 10930 10931 switch (level) { 10932 case SOL_SOCKET: 10933 /* 10934 * conn_lock protects the bitfields, and is used to 10935 * set the fields atomically. 10936 */ 10937 switch (name) { 10938 case SO_BROADCAST: 10939 if (!checkonly) { 10940 /* TODO: use value someplace? */ 10941 mutex_enter(&connp->conn_lock); 10942 connp->conn_broadcast = *i1 ? 1 : 0; 10943 mutex_exit(&connp->conn_lock); 10944 } 10945 break; /* goto sizeof (int) option return */ 10946 case SO_USELOOPBACK: 10947 if (!checkonly) { 10948 /* TODO: use value someplace? */ 10949 mutex_enter(&connp->conn_lock); 10950 connp->conn_loopback = *i1 ? 1 : 0; 10951 mutex_exit(&connp->conn_lock); 10952 } 10953 break; /* goto sizeof (int) option return */ 10954 case SO_DONTROUTE: 10955 if (!checkonly) { 10956 mutex_enter(&connp->conn_lock); 10957 connp->conn_dontroute = *i1 ? 1 : 0; 10958 mutex_exit(&connp->conn_lock); 10959 } 10960 break; /* goto sizeof (int) option return */ 10961 case SO_REUSEADDR: 10962 if (!checkonly) { 10963 mutex_enter(&connp->conn_lock); 10964 connp->conn_reuseaddr = *i1 ? 1 : 0; 10965 mutex_exit(&connp->conn_lock); 10966 } 10967 break; /* goto sizeof (int) option return */ 10968 case SO_PROTOTYPE: 10969 if (!checkonly) { 10970 mutex_enter(&connp->conn_lock); 10971 connp->conn_proto = *i1; 10972 mutex_exit(&connp->conn_lock); 10973 } 10974 break; /* goto sizeof (int) option return */ 10975 case SO_ALLZONES: 10976 if (!checkonly) { 10977 mutex_enter(&connp->conn_lock); 10978 if (IPCL_IS_BOUND(connp)) { 10979 mutex_exit(&connp->conn_lock); 10980 return (EINVAL); 10981 } 10982 connp->conn_allzones = *i1 != 0 ? 1 : 0; 10983 mutex_exit(&connp->conn_lock); 10984 } 10985 break; /* goto sizeof (int) option return */ 10986 case SO_ANON_MLP: 10987 if (!checkonly) { 10988 mutex_enter(&connp->conn_lock); 10989 connp->conn_anon_mlp = *i1 != 0 ? 1 : 0; 10990 mutex_exit(&connp->conn_lock); 10991 } 10992 break; /* goto sizeof (int) option return */ 10993 case SO_MAC_EXEMPT: 10994 if (secpolicy_net_mac_aware(cr) != 0 || 10995 IPCL_IS_BOUND(connp)) 10996 return (EACCES); 10997 if (!checkonly) { 10998 mutex_enter(&connp->conn_lock); 10999 connp->conn_mac_exempt = *i1 != 0 ? 1 : 0; 11000 mutex_exit(&connp->conn_lock); 11001 } 11002 break; /* goto sizeof (int) option return */ 11003 default: 11004 /* 11005 * "soft" error (negative) 11006 * option not handled at this level 11007 * Note: Do not modify *outlenp 11008 */ 11009 return (-EINVAL); 11010 } 11011 break; 11012 case IPPROTO_IP: 11013 switch (name) { 11014 case IP_NEXTHOP: 11015 if (secpolicy_ip_config(cr, B_FALSE) != 0) 11016 return (EPERM); 11017 /* FALLTHRU */ 11018 case IP_MULTICAST_IF: 11019 case IP_DONTFAILOVER_IF: { 11020 ipaddr_t addr = *i1; 11021 11022 error = ip_opt_set_ipif(connp, addr, checkonly, name, 11023 first_mp); 11024 if (error != 0) 11025 return (error); 11026 break; /* goto sizeof (int) option return */ 11027 } 11028 11029 case IP_MULTICAST_TTL: 11030 /* Recorded in transport above IP */ 11031 *outvalp = *invalp; 11032 *outlenp = sizeof (uchar_t); 11033 return (0); 11034 case IP_MULTICAST_LOOP: 11035 if (!checkonly) { 11036 mutex_enter(&connp->conn_lock); 11037 connp->conn_multicast_loop = *invalp ? 1 : 0; 11038 mutex_exit(&connp->conn_lock); 11039 } 11040 *outvalp = *invalp; 11041 *outlenp = sizeof (uchar_t); 11042 return (0); 11043 case IP_ADD_MEMBERSHIP: 11044 case MCAST_JOIN_GROUP: 11045 case IP_DROP_MEMBERSHIP: 11046 case MCAST_LEAVE_GROUP: { 11047 struct ip_mreq *mreqp; 11048 struct group_req *greqp; 11049 ire_t *ire; 11050 boolean_t done = B_FALSE; 11051 ipaddr_t group, ifaddr; 11052 struct sockaddr_in *sin; 11053 uint32_t *ifindexp; 11054 boolean_t mcast_opt = B_TRUE; 11055 mcast_record_t fmode; 11056 int (*optfn)(conn_t *, boolean_t, ipaddr_t, ipaddr_t, 11057 uint_t *, mcast_record_t, ipaddr_t, mblk_t *); 11058 11059 switch (name) { 11060 case IP_ADD_MEMBERSHIP: 11061 mcast_opt = B_FALSE; 11062 /* FALLTHRU */ 11063 case MCAST_JOIN_GROUP: 11064 fmode = MODE_IS_EXCLUDE; 11065 optfn = ip_opt_add_group; 11066 break; 11067 11068 case IP_DROP_MEMBERSHIP: 11069 mcast_opt = B_FALSE; 11070 /* FALLTHRU */ 11071 case MCAST_LEAVE_GROUP: 11072 fmode = MODE_IS_INCLUDE; 11073 optfn = ip_opt_delete_group; 11074 break; 11075 } 11076 11077 if (mcast_opt) { 11078 greqp = (struct group_req *)i1; 11079 sin = (struct sockaddr_in *)&greqp->gr_group; 11080 if (sin->sin_family != AF_INET) { 11081 *outlenp = 0; 11082 return (ENOPROTOOPT); 11083 } 11084 group = (ipaddr_t)sin->sin_addr.s_addr; 11085 ifaddr = INADDR_ANY; 11086 ifindexp = &greqp->gr_interface; 11087 } else { 11088 mreqp = (struct ip_mreq *)i1; 11089 group = (ipaddr_t)mreqp->imr_multiaddr.s_addr; 11090 ifaddr = (ipaddr_t)mreqp->imr_interface.s_addr; 11091 ifindexp = NULL; 11092 } 11093 11094 /* 11095 * In the multirouting case, we need to replicate 11096 * the request on all interfaces that will take part 11097 * in replication. We do so because multirouting is 11098 * reflective, thus we will probably receive multi- 11099 * casts on those interfaces. 11100 * The ip_multirt_apply_membership() succeeds if the 11101 * operation succeeds on at least one interface. 11102 */ 11103 ire = ire_ftable_lookup(group, IP_HOST_MASK, 0, 11104 IRE_HOST, NULL, NULL, ALL_ZONES, 0, NULL, 11105 MATCH_IRE_MASK | MATCH_IRE_TYPE, ipst); 11106 if (ire != NULL) { 11107 if (ire->ire_flags & RTF_MULTIRT) { 11108 error = ip_multirt_apply_membership( 11109 optfn, ire, connp, checkonly, group, 11110 fmode, INADDR_ANY, first_mp); 11111 done = B_TRUE; 11112 } 11113 ire_refrele(ire); 11114 } 11115 if (!done) { 11116 error = optfn(connp, checkonly, group, ifaddr, 11117 ifindexp, fmode, INADDR_ANY, first_mp); 11118 } 11119 if (error) { 11120 /* 11121 * EINPROGRESS is a soft error, needs retry 11122 * so don't make *outlenp zero. 11123 */ 11124 if (error != EINPROGRESS) 11125 *outlenp = 0; 11126 return (error); 11127 } 11128 /* OK return - copy input buffer into output buffer */ 11129 if (invalp != outvalp) { 11130 /* don't trust bcopy for identical src/dst */ 11131 bcopy(invalp, outvalp, inlen); 11132 } 11133 *outlenp = inlen; 11134 return (0); 11135 } 11136 case IP_BLOCK_SOURCE: 11137 case IP_UNBLOCK_SOURCE: 11138 case IP_ADD_SOURCE_MEMBERSHIP: 11139 case IP_DROP_SOURCE_MEMBERSHIP: 11140 case MCAST_BLOCK_SOURCE: 11141 case MCAST_UNBLOCK_SOURCE: 11142 case MCAST_JOIN_SOURCE_GROUP: 11143 case MCAST_LEAVE_SOURCE_GROUP: { 11144 struct ip_mreq_source *imreqp; 11145 struct group_source_req *gsreqp; 11146 in_addr_t grp, src, ifaddr = INADDR_ANY; 11147 uint32_t ifindex = 0; 11148 mcast_record_t fmode; 11149 struct sockaddr_in *sin; 11150 ire_t *ire; 11151 boolean_t mcast_opt = B_TRUE, done = B_FALSE; 11152 int (*optfn)(conn_t *, boolean_t, ipaddr_t, ipaddr_t, 11153 uint_t *, mcast_record_t, ipaddr_t, mblk_t *); 11154 11155 switch (name) { 11156 case IP_BLOCK_SOURCE: 11157 mcast_opt = B_FALSE; 11158 /* FALLTHRU */ 11159 case MCAST_BLOCK_SOURCE: 11160 fmode = MODE_IS_EXCLUDE; 11161 optfn = ip_opt_add_group; 11162 break; 11163 11164 case IP_UNBLOCK_SOURCE: 11165 mcast_opt = B_FALSE; 11166 /* FALLTHRU */ 11167 case MCAST_UNBLOCK_SOURCE: 11168 fmode = MODE_IS_EXCLUDE; 11169 optfn = ip_opt_delete_group; 11170 break; 11171 11172 case IP_ADD_SOURCE_MEMBERSHIP: 11173 mcast_opt = B_FALSE; 11174 /* FALLTHRU */ 11175 case MCAST_JOIN_SOURCE_GROUP: 11176 fmode = MODE_IS_INCLUDE; 11177 optfn = ip_opt_add_group; 11178 break; 11179 11180 case IP_DROP_SOURCE_MEMBERSHIP: 11181 mcast_opt = B_FALSE; 11182 /* FALLTHRU */ 11183 case MCAST_LEAVE_SOURCE_GROUP: 11184 fmode = MODE_IS_INCLUDE; 11185 optfn = ip_opt_delete_group; 11186 break; 11187 } 11188 11189 if (mcast_opt) { 11190 gsreqp = (struct group_source_req *)i1; 11191 if (gsreqp->gsr_group.ss_family != AF_INET) { 11192 *outlenp = 0; 11193 return (ENOPROTOOPT); 11194 } 11195 sin = (struct sockaddr_in *)&gsreqp->gsr_group; 11196 grp = (ipaddr_t)sin->sin_addr.s_addr; 11197 sin = (struct sockaddr_in *)&gsreqp->gsr_source; 11198 src = (ipaddr_t)sin->sin_addr.s_addr; 11199 ifindex = gsreqp->gsr_interface; 11200 } else { 11201 imreqp = (struct ip_mreq_source *)i1; 11202 grp = (ipaddr_t)imreqp->imr_multiaddr.s_addr; 11203 src = (ipaddr_t)imreqp->imr_sourceaddr.s_addr; 11204 ifaddr = (ipaddr_t)imreqp->imr_interface.s_addr; 11205 } 11206 11207 /* 11208 * In the multirouting case, we need to replicate 11209 * the request as noted in the mcast cases above. 11210 */ 11211 ire = ire_ftable_lookup(grp, IP_HOST_MASK, 0, 11212 IRE_HOST, NULL, NULL, ALL_ZONES, 0, NULL, 11213 MATCH_IRE_MASK | MATCH_IRE_TYPE, ipst); 11214 if (ire != NULL) { 11215 if (ire->ire_flags & RTF_MULTIRT) { 11216 error = ip_multirt_apply_membership( 11217 optfn, ire, connp, checkonly, grp, 11218 fmode, src, first_mp); 11219 done = B_TRUE; 11220 } 11221 ire_refrele(ire); 11222 } 11223 if (!done) { 11224 error = optfn(connp, checkonly, grp, ifaddr, 11225 &ifindex, fmode, src, first_mp); 11226 } 11227 if (error != 0) { 11228 /* 11229 * EINPROGRESS is a soft error, needs retry 11230 * so don't make *outlenp zero. 11231 */ 11232 if (error != EINPROGRESS) 11233 *outlenp = 0; 11234 return (error); 11235 } 11236 /* OK return - copy input buffer into output buffer */ 11237 if (invalp != outvalp) { 11238 bcopy(invalp, outvalp, inlen); 11239 } 11240 *outlenp = inlen; 11241 return (0); 11242 } 11243 case IP_SEC_OPT: 11244 error = ipsec_set_req(cr, connp, (ipsec_req_t *)invalp); 11245 if (error != 0) { 11246 *outlenp = 0; 11247 return (error); 11248 } 11249 break; 11250 case IP_HDRINCL: 11251 case IP_OPTIONS: 11252 case T_IP_OPTIONS: 11253 case IP_TOS: 11254 case T_IP_TOS: 11255 case IP_TTL: 11256 case IP_RECVDSTADDR: 11257 case IP_RECVOPTS: 11258 /* OK return - copy input buffer into output buffer */ 11259 if (invalp != outvalp) { 11260 /* don't trust bcopy for identical src/dst */ 11261 bcopy(invalp, outvalp, inlen); 11262 } 11263 *outlenp = inlen; 11264 return (0); 11265 case IP_RECVIF: 11266 /* Retrieve the inbound interface index */ 11267 if (!checkonly) { 11268 mutex_enter(&connp->conn_lock); 11269 connp->conn_recvif = *i1 ? 1 : 0; 11270 mutex_exit(&connp->conn_lock); 11271 } 11272 break; /* goto sizeof (int) option return */ 11273 case IP_RECVPKTINFO: 11274 if (!checkonly) { 11275 mutex_enter(&connp->conn_lock); 11276 connp->conn_ip_recvpktinfo = *i1 ? 1 : 0; 11277 mutex_exit(&connp->conn_lock); 11278 } 11279 break; /* goto sizeof (int) option return */ 11280 case IP_RECVSLLA: 11281 /* Retrieve the source link layer address */ 11282 if (!checkonly) { 11283 mutex_enter(&connp->conn_lock); 11284 connp->conn_recvslla = *i1 ? 1 : 0; 11285 mutex_exit(&connp->conn_lock); 11286 } 11287 break; /* goto sizeof (int) option return */ 11288 case MRT_INIT: 11289 case MRT_DONE: 11290 case MRT_ADD_VIF: 11291 case MRT_DEL_VIF: 11292 case MRT_ADD_MFC: 11293 case MRT_DEL_MFC: 11294 case MRT_ASSERT: 11295 if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) { 11296 *outlenp = 0; 11297 return (error); 11298 } 11299 error = ip_mrouter_set((int)name, q, checkonly, 11300 (uchar_t *)invalp, inlen, first_mp); 11301 if (error) { 11302 *outlenp = 0; 11303 return (error); 11304 } 11305 /* OK return - copy input buffer into output buffer */ 11306 if (invalp != outvalp) { 11307 /* don't trust bcopy for identical src/dst */ 11308 bcopy(invalp, outvalp, inlen); 11309 } 11310 *outlenp = inlen; 11311 return (0); 11312 case IP_BOUND_IF: 11313 case IP_XMIT_IF: 11314 error = ip_opt_set_ill(connp, *i1, B_FALSE, checkonly, 11315 level, name, first_mp); 11316 if (error != 0) 11317 return (error); 11318 break; /* goto sizeof (int) option return */ 11319 11320 case IP_UNSPEC_SRC: 11321 /* Allow sending with a zero source address */ 11322 if (!checkonly) { 11323 mutex_enter(&connp->conn_lock); 11324 connp->conn_unspec_src = *i1 ? 1 : 0; 11325 mutex_exit(&connp->conn_lock); 11326 } 11327 break; /* goto sizeof (int) option return */ 11328 default: 11329 /* 11330 * "soft" error (negative) 11331 * option not handled at this level 11332 * Note: Do not modify *outlenp 11333 */ 11334 return (-EINVAL); 11335 } 11336 break; 11337 case IPPROTO_IPV6: 11338 switch (name) { 11339 case IPV6_BOUND_IF: 11340 case IPV6_BOUND_PIF: 11341 case IPV6_DONTFAILOVER_IF: 11342 error = ip_opt_set_ill(connp, *i1, B_TRUE, checkonly, 11343 level, name, first_mp); 11344 if (error != 0) 11345 return (error); 11346 break; /* goto sizeof (int) option return */ 11347 11348 case IPV6_MULTICAST_IF: 11349 /* 11350 * The only possible errors are EINPROGRESS and 11351 * EINVAL. EINPROGRESS will be restarted and is not 11352 * a hard error. We call this option on both V4 and V6 11353 * If both return EINVAL, then this call returns 11354 * EINVAL. If at least one of them succeeds we 11355 * return success. 11356 */ 11357 found = B_FALSE; 11358 error = ip_opt_set_ill(connp, *i1, B_TRUE, checkonly, 11359 level, name, first_mp); 11360 if (error == EINPROGRESS) 11361 return (error); 11362 if (error == 0) 11363 found = B_TRUE; 11364 error = ip_opt_set_ill(connp, *i1, B_FALSE, checkonly, 11365 IPPROTO_IP, IP_MULTICAST_IF, first_mp); 11366 if (error == 0) 11367 found = B_TRUE; 11368 if (!found) 11369 return (error); 11370 break; /* goto sizeof (int) option return */ 11371 11372 case IPV6_MULTICAST_HOPS: 11373 /* Recorded in transport above IP */ 11374 break; /* goto sizeof (int) option return */ 11375 case IPV6_MULTICAST_LOOP: 11376 if (!checkonly) { 11377 mutex_enter(&connp->conn_lock); 11378 connp->conn_multicast_loop = *i1; 11379 mutex_exit(&connp->conn_lock); 11380 } 11381 break; /* goto sizeof (int) option return */ 11382 case IPV6_JOIN_GROUP: 11383 case MCAST_JOIN_GROUP: 11384 case IPV6_LEAVE_GROUP: 11385 case MCAST_LEAVE_GROUP: { 11386 struct ipv6_mreq *ip_mreqp; 11387 struct group_req *greqp; 11388 ire_t *ire; 11389 boolean_t done = B_FALSE; 11390 in6_addr_t groupv6; 11391 uint32_t ifindex; 11392 boolean_t mcast_opt = B_TRUE; 11393 mcast_record_t fmode; 11394 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *, 11395 int, mcast_record_t, const in6_addr_t *, mblk_t *); 11396 11397 switch (name) { 11398 case IPV6_JOIN_GROUP: 11399 mcast_opt = B_FALSE; 11400 /* FALLTHRU */ 11401 case MCAST_JOIN_GROUP: 11402 fmode = MODE_IS_EXCLUDE; 11403 optfn = ip_opt_add_group_v6; 11404 break; 11405 11406 case IPV6_LEAVE_GROUP: 11407 mcast_opt = B_FALSE; 11408 /* FALLTHRU */ 11409 case MCAST_LEAVE_GROUP: 11410 fmode = MODE_IS_INCLUDE; 11411 optfn = ip_opt_delete_group_v6; 11412 break; 11413 } 11414 11415 if (mcast_opt) { 11416 struct sockaddr_in *sin; 11417 struct sockaddr_in6 *sin6; 11418 greqp = (struct group_req *)i1; 11419 if (greqp->gr_group.ss_family == AF_INET) { 11420 sin = (struct sockaddr_in *) 11421 &(greqp->gr_group); 11422 IN6_INADDR_TO_V4MAPPED(&sin->sin_addr, 11423 &groupv6); 11424 } else { 11425 sin6 = (struct sockaddr_in6 *) 11426 &(greqp->gr_group); 11427 groupv6 = sin6->sin6_addr; 11428 } 11429 ifindex = greqp->gr_interface; 11430 } else { 11431 ip_mreqp = (struct ipv6_mreq *)i1; 11432 groupv6 = ip_mreqp->ipv6mr_multiaddr; 11433 ifindex = ip_mreqp->ipv6mr_interface; 11434 } 11435 /* 11436 * In the multirouting case, we need to replicate 11437 * the request on all interfaces that will take part 11438 * in replication. We do so because multirouting is 11439 * reflective, thus we will probably receive multi- 11440 * casts on those interfaces. 11441 * The ip_multirt_apply_membership_v6() succeeds if 11442 * the operation succeeds on at least one interface. 11443 */ 11444 ire = ire_ftable_lookup_v6(&groupv6, &ipv6_all_ones, 0, 11445 IRE_HOST, NULL, NULL, ALL_ZONES, 0, NULL, 11446 MATCH_IRE_MASK | MATCH_IRE_TYPE, ipst); 11447 if (ire != NULL) { 11448 if (ire->ire_flags & RTF_MULTIRT) { 11449 error = ip_multirt_apply_membership_v6( 11450 optfn, ire, connp, checkonly, 11451 &groupv6, fmode, &ipv6_all_zeros, 11452 first_mp); 11453 done = B_TRUE; 11454 } 11455 ire_refrele(ire); 11456 } 11457 if (!done) { 11458 error = optfn(connp, checkonly, &groupv6, 11459 ifindex, fmode, &ipv6_all_zeros, first_mp); 11460 } 11461 if (error) { 11462 /* 11463 * EINPROGRESS is a soft error, needs retry 11464 * so don't make *outlenp zero. 11465 */ 11466 if (error != EINPROGRESS) 11467 *outlenp = 0; 11468 return (error); 11469 } 11470 /* OK return - copy input buffer into output buffer */ 11471 if (invalp != outvalp) { 11472 /* don't trust bcopy for identical src/dst */ 11473 bcopy(invalp, outvalp, inlen); 11474 } 11475 *outlenp = inlen; 11476 return (0); 11477 } 11478 case MCAST_BLOCK_SOURCE: 11479 case MCAST_UNBLOCK_SOURCE: 11480 case MCAST_JOIN_SOURCE_GROUP: 11481 case MCAST_LEAVE_SOURCE_GROUP: { 11482 struct group_source_req *gsreqp; 11483 in6_addr_t v6grp, v6src; 11484 uint32_t ifindex; 11485 mcast_record_t fmode; 11486 ire_t *ire; 11487 boolean_t done = B_FALSE; 11488 int (*optfn)(conn_t *, boolean_t, const in6_addr_t *, 11489 int, mcast_record_t, const in6_addr_t *, mblk_t *); 11490 11491 switch (name) { 11492 case MCAST_BLOCK_SOURCE: 11493 fmode = MODE_IS_EXCLUDE; 11494 optfn = ip_opt_add_group_v6; 11495 break; 11496 case MCAST_UNBLOCK_SOURCE: 11497 fmode = MODE_IS_EXCLUDE; 11498 optfn = ip_opt_delete_group_v6; 11499 break; 11500 case MCAST_JOIN_SOURCE_GROUP: 11501 fmode = MODE_IS_INCLUDE; 11502 optfn = ip_opt_add_group_v6; 11503 break; 11504 case MCAST_LEAVE_SOURCE_GROUP: 11505 fmode = MODE_IS_INCLUDE; 11506 optfn = ip_opt_delete_group_v6; 11507 break; 11508 } 11509 11510 gsreqp = (struct group_source_req *)i1; 11511 ifindex = gsreqp->gsr_interface; 11512 if (gsreqp->gsr_group.ss_family == AF_INET) { 11513 struct sockaddr_in *s; 11514 s = (struct sockaddr_in *)&gsreqp->gsr_group; 11515 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6grp); 11516 s = (struct sockaddr_in *)&gsreqp->gsr_source; 11517 IN6_INADDR_TO_V4MAPPED(&s->sin_addr, &v6src); 11518 } else { 11519 struct sockaddr_in6 *s6; 11520 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_group; 11521 v6grp = s6->sin6_addr; 11522 s6 = (struct sockaddr_in6 *)&gsreqp->gsr_source; 11523 v6src = s6->sin6_addr; 11524 } 11525 11526 /* 11527 * In the multirouting case, we need to replicate 11528 * the request as noted in the mcast cases above. 11529 */ 11530 ire = ire_ftable_lookup_v6(&v6grp, &ipv6_all_ones, 0, 11531 IRE_HOST, NULL, NULL, ALL_ZONES, 0, NULL, 11532 MATCH_IRE_MASK | MATCH_IRE_TYPE, ipst); 11533 if (ire != NULL) { 11534 if (ire->ire_flags & RTF_MULTIRT) { 11535 error = ip_multirt_apply_membership_v6( 11536 optfn, ire, connp, checkonly, 11537 &v6grp, fmode, &v6src, first_mp); 11538 done = B_TRUE; 11539 } 11540 ire_refrele(ire); 11541 } 11542 if (!done) { 11543 error = optfn(connp, checkonly, &v6grp, 11544 ifindex, fmode, &v6src, first_mp); 11545 } 11546 if (error != 0) { 11547 /* 11548 * EINPROGRESS is a soft error, needs retry 11549 * so don't make *outlenp zero. 11550 */ 11551 if (error != EINPROGRESS) 11552 *outlenp = 0; 11553 return (error); 11554 } 11555 /* OK return - copy input buffer into output buffer */ 11556 if (invalp != outvalp) { 11557 bcopy(invalp, outvalp, inlen); 11558 } 11559 *outlenp = inlen; 11560 return (0); 11561 } 11562 case IPV6_UNICAST_HOPS: 11563 /* Recorded in transport above IP */ 11564 break; /* goto sizeof (int) option return */ 11565 case IPV6_UNSPEC_SRC: 11566 /* Allow sending with a zero source address */ 11567 if (!checkonly) { 11568 mutex_enter(&connp->conn_lock); 11569 connp->conn_unspec_src = *i1 ? 1 : 0; 11570 mutex_exit(&connp->conn_lock); 11571 } 11572 break; /* goto sizeof (int) option return */ 11573 case IPV6_RECVPKTINFO: 11574 if (!checkonly) { 11575 mutex_enter(&connp->conn_lock); 11576 connp->conn_ip_recvpktinfo = *i1 ? 1 : 0; 11577 mutex_exit(&connp->conn_lock); 11578 } 11579 break; /* goto sizeof (int) option return */ 11580 case IPV6_RECVTCLASS: 11581 if (!checkonly) { 11582 if (*i1 < 0 || *i1 > 1) { 11583 return (EINVAL); 11584 } 11585 mutex_enter(&connp->conn_lock); 11586 connp->conn_ipv6_recvtclass = *i1; 11587 mutex_exit(&connp->conn_lock); 11588 } 11589 break; 11590 case IPV6_RECVPATHMTU: 11591 if (!checkonly) { 11592 if (*i1 < 0 || *i1 > 1) { 11593 return (EINVAL); 11594 } 11595 mutex_enter(&connp->conn_lock); 11596 connp->conn_ipv6_recvpathmtu = *i1; 11597 mutex_exit(&connp->conn_lock); 11598 } 11599 break; 11600 case IPV6_RECVHOPLIMIT: 11601 if (!checkonly) { 11602 mutex_enter(&connp->conn_lock); 11603 connp->conn_ipv6_recvhoplimit = *i1 ? 1 : 0; 11604 mutex_exit(&connp->conn_lock); 11605 } 11606 break; /* goto sizeof (int) option return */ 11607 case IPV6_RECVHOPOPTS: 11608 if (!checkonly) { 11609 mutex_enter(&connp->conn_lock); 11610 connp->conn_ipv6_recvhopopts = *i1 ? 1 : 0; 11611 mutex_exit(&connp->conn_lock); 11612 } 11613 break; /* goto sizeof (int) option return */ 11614 case IPV6_RECVDSTOPTS: 11615 if (!checkonly) { 11616 mutex_enter(&connp->conn_lock); 11617 connp->conn_ipv6_recvdstopts = *i1 ? 1 : 0; 11618 mutex_exit(&connp->conn_lock); 11619 } 11620 break; /* goto sizeof (int) option return */ 11621 case IPV6_RECVRTHDR: 11622 if (!checkonly) { 11623 mutex_enter(&connp->conn_lock); 11624 connp->conn_ipv6_recvrthdr = *i1 ? 1 : 0; 11625 mutex_exit(&connp->conn_lock); 11626 } 11627 break; /* goto sizeof (int) option return */ 11628 case IPV6_RECVRTHDRDSTOPTS: 11629 if (!checkonly) { 11630 mutex_enter(&connp->conn_lock); 11631 connp->conn_ipv6_recvrtdstopts = *i1 ? 1 : 0; 11632 mutex_exit(&connp->conn_lock); 11633 } 11634 break; /* goto sizeof (int) option return */ 11635 case IPV6_PKTINFO: 11636 if (inlen == 0) 11637 return (-EINVAL); /* clearing option */ 11638 error = ip6_set_pktinfo(cr, connp, 11639 (struct in6_pktinfo *)invalp, first_mp); 11640 if (error != 0) 11641 *outlenp = 0; 11642 else 11643 *outlenp = inlen; 11644 return (error); 11645 case IPV6_NEXTHOP: { 11646 struct sockaddr_in6 *sin6; 11647 11648 /* Verify that the nexthop is reachable */ 11649 if (inlen == 0) 11650 return (-EINVAL); /* clearing option */ 11651 11652 sin6 = (struct sockaddr_in6 *)invalp; 11653 ire = ire_route_lookup_v6(&sin6->sin6_addr, 11654 0, 0, 0, NULL, NULL, connp->conn_zoneid, 11655 NULL, MATCH_IRE_DEFAULT, ipst); 11656 11657 if (ire == NULL) { 11658 *outlenp = 0; 11659 return (EHOSTUNREACH); 11660 } 11661 ire_refrele(ire); 11662 return (-EINVAL); 11663 } 11664 case IPV6_SEC_OPT: 11665 error = ipsec_set_req(cr, connp, (ipsec_req_t *)invalp); 11666 if (error != 0) { 11667 *outlenp = 0; 11668 return (error); 11669 } 11670 break; 11671 case IPV6_SRC_PREFERENCES: { 11672 /* 11673 * This is implemented strictly in the ip module 11674 * (here and in tcp_opt_*() to accomodate tcp 11675 * sockets). Modules above ip pass this option 11676 * down here since ip is the only one that needs to 11677 * be aware of source address preferences. 11678 * 11679 * This socket option only affects connected 11680 * sockets that haven't already bound to a specific 11681 * IPv6 address. In other words, sockets that 11682 * don't call bind() with an address other than the 11683 * unspecified address and that call connect(). 11684 * ip_bind_connected_v6() passes these preferences 11685 * to the ipif_select_source_v6() function. 11686 */ 11687 if (inlen != sizeof (uint32_t)) 11688 return (EINVAL); 11689 error = ip6_set_src_preferences(connp, 11690 *(uint32_t *)invalp); 11691 if (error != 0) { 11692 *outlenp = 0; 11693 return (error); 11694 } else { 11695 *outlenp = sizeof (uint32_t); 11696 } 11697 break; 11698 } 11699 case IPV6_V6ONLY: 11700 if (*i1 < 0 || *i1 > 1) { 11701 return (EINVAL); 11702 } 11703 mutex_enter(&connp->conn_lock); 11704 connp->conn_ipv6_v6only = *i1; 11705 mutex_exit(&connp->conn_lock); 11706 break; 11707 default: 11708 return (-EINVAL); 11709 } 11710 break; 11711 default: 11712 /* 11713 * "soft" error (negative) 11714 * option not handled at this level 11715 * Note: Do not modify *outlenp 11716 */ 11717 return (-EINVAL); 11718 } 11719 /* 11720 * Common case of return from an option that is sizeof (int) 11721 */ 11722 *(int *)outvalp = *i1; 11723 *outlenp = sizeof (int); 11724 return (0); 11725 } 11726 11727 /* 11728 * This routine gets default values of certain options whose default 11729 * values are maintained by protocol specific code 11730 */ 11731 /* ARGSUSED */ 11732 int 11733 ip_opt_default(queue_t *q, int level, int name, uchar_t *ptr) 11734 { 11735 int *i1 = (int *)ptr; 11736 ip_stack_t *ipst = CONNQ_TO_IPST(q); 11737 11738 switch (level) { 11739 case IPPROTO_IP: 11740 switch (name) { 11741 case IP_MULTICAST_TTL: 11742 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL; 11743 return (sizeof (uchar_t)); 11744 case IP_MULTICAST_LOOP: 11745 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP; 11746 return (sizeof (uchar_t)); 11747 default: 11748 return (-1); 11749 } 11750 case IPPROTO_IPV6: 11751 switch (name) { 11752 case IPV6_UNICAST_HOPS: 11753 *i1 = ipst->ips_ipv6_def_hops; 11754 return (sizeof (int)); 11755 case IPV6_MULTICAST_HOPS: 11756 *i1 = IP_DEFAULT_MULTICAST_TTL; 11757 return (sizeof (int)); 11758 case IPV6_MULTICAST_LOOP: 11759 *i1 = IP_DEFAULT_MULTICAST_LOOP; 11760 return (sizeof (int)); 11761 case IPV6_V6ONLY: 11762 *i1 = 1; 11763 return (sizeof (int)); 11764 default: 11765 return (-1); 11766 } 11767 default: 11768 return (-1); 11769 } 11770 /* NOTREACHED */ 11771 } 11772 11773 /* 11774 * Given a destination address and a pointer to where to put the information 11775 * this routine fills in the mtuinfo. 11776 */ 11777 int 11778 ip_fill_mtuinfo(struct in6_addr *in6, in_port_t port, 11779 struct ip6_mtuinfo *mtuinfo, netstack_t *ns) 11780 { 11781 ire_t *ire; 11782 ip_stack_t *ipst = ns->netstack_ip; 11783 11784 if (IN6_IS_ADDR_UNSPECIFIED(in6)) 11785 return (-1); 11786 11787 bzero(mtuinfo, sizeof (*mtuinfo)); 11788 mtuinfo->ip6m_addr.sin6_family = AF_INET6; 11789 mtuinfo->ip6m_addr.sin6_port = port; 11790 mtuinfo->ip6m_addr.sin6_addr = *in6; 11791 11792 ire = ire_cache_lookup_v6(in6, ALL_ZONES, NULL, ipst); 11793 if (ire != NULL) { 11794 mtuinfo->ip6m_mtu = ire->ire_max_frag; 11795 ire_refrele(ire); 11796 } else { 11797 mtuinfo->ip6m_mtu = IPV6_MIN_MTU; 11798 } 11799 return (sizeof (struct ip6_mtuinfo)); 11800 } 11801 11802 /* 11803 * This routine gets socket options. For MRT_VERSION and MRT_ASSERT, error 11804 * checking of GET_QUEUE_CRED(q) and that ip_g_mrouter is set should be done and 11805 * isn't. This doesn't matter as the error checking is done properly for the 11806 * other MRT options coming in through ip_opt_set. 11807 */ 11808 int 11809 ip_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 11810 { 11811 conn_t *connp = Q_TO_CONN(q); 11812 ipsec_req_t *req = (ipsec_req_t *)ptr; 11813 11814 switch (level) { 11815 case IPPROTO_IP: 11816 switch (name) { 11817 case MRT_VERSION: 11818 case MRT_ASSERT: 11819 (void) ip_mrouter_get(name, q, ptr); 11820 return (sizeof (int)); 11821 case IP_SEC_OPT: 11822 return (ipsec_req_from_conn(connp, req, IPSEC_AF_V4)); 11823 case IP_NEXTHOP: 11824 if (connp->conn_nexthop_set) { 11825 *(ipaddr_t *)ptr = connp->conn_nexthop_v4; 11826 return (sizeof (ipaddr_t)); 11827 } else 11828 return (0); 11829 case IP_RECVPKTINFO: 11830 *(int *)ptr = connp->conn_ip_recvpktinfo ? 1: 0; 11831 return (sizeof (int)); 11832 default: 11833 break; 11834 } 11835 break; 11836 case IPPROTO_IPV6: 11837 switch (name) { 11838 case IPV6_SEC_OPT: 11839 return (ipsec_req_from_conn(connp, req, IPSEC_AF_V6)); 11840 case IPV6_SRC_PREFERENCES: { 11841 return (ip6_get_src_preferences(connp, 11842 (uint32_t *)ptr)); 11843 } 11844 case IPV6_V6ONLY: 11845 *(int *)ptr = connp->conn_ipv6_v6only ? 1 : 0; 11846 return (sizeof (int)); 11847 case IPV6_PATHMTU: 11848 return (ip_fill_mtuinfo(&connp->conn_remv6, 0, 11849 (struct ip6_mtuinfo *)ptr, 11850 connp->conn_netstack)); 11851 default: 11852 break; 11853 } 11854 break; 11855 default: 11856 break; 11857 } 11858 return (-1); 11859 } 11860 11861 /* Named Dispatch routine to get a current value out of our parameter table. */ 11862 /* ARGSUSED */ 11863 static int 11864 ip_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr) 11865 { 11866 ipparam_t *ippa = (ipparam_t *)cp; 11867 11868 (void) mi_mpprintf(mp, "%d", ippa->ip_param_value); 11869 return (0); 11870 } 11871 11872 /* ARGSUSED */ 11873 static int 11874 ip_param_generic_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr) 11875 { 11876 11877 (void) mi_mpprintf(mp, "%d", *(int *)cp); 11878 return (0); 11879 } 11880 11881 /* 11882 * Set ip{,6}_forwarding values. This means walking through all of the 11883 * ill's and toggling their forwarding values. 11884 */ 11885 /* ARGSUSED */ 11886 static int 11887 ip_forward_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *ioc_cr) 11888 { 11889 long new_value; 11890 int *forwarding_value = (int *)cp; 11891 ill_t *walker; 11892 boolean_t isv6; 11893 ill_walk_context_t ctx; 11894 ip_stack_t *ipst = CONNQ_TO_IPST(q); 11895 11896 isv6 = (forwarding_value == &ipst->ips_ipv6_forward); 11897 11898 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11899 new_value < 0 || new_value > 1) { 11900 return (EINVAL); 11901 } 11902 11903 *forwarding_value = new_value; 11904 11905 /* 11906 * Regardless of the current value of ip_forwarding, set all per-ill 11907 * values of ip_forwarding to the value being set. 11908 * 11909 * Bring all the ill's up to date with the new global value. 11910 */ 11911 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 11912 11913 if (isv6) 11914 walker = ILL_START_WALK_V6(&ctx, ipst); 11915 else 11916 walker = ILL_START_WALK_V4(&ctx, ipst); 11917 for (; walker != NULL; walker = ill_next(&ctx, walker)) { 11918 (void) ill_forward_set(q, mp, (new_value != 0), 11919 (caddr_t)walker); 11920 } 11921 rw_exit(&ipst->ips_ill_g_lock); 11922 11923 return (0); 11924 } 11925 11926 /* 11927 * Walk through the param array specified registering each element with the 11928 * Named Dispatch handler. This is called only during init. So it is ok 11929 * not to acquire any locks 11930 */ 11931 static boolean_t 11932 ip_param_register(IDP *ndp, ipparam_t *ippa, size_t ippa_cnt, 11933 ipndp_t *ipnd, size_t ipnd_cnt) 11934 { 11935 for (; ippa_cnt-- > 0; ippa++) { 11936 if (ippa->ip_param_name && ippa->ip_param_name[0]) { 11937 if (!nd_load(ndp, ippa->ip_param_name, 11938 ip_param_get, ip_param_set, (caddr_t)ippa)) { 11939 nd_free(ndp); 11940 return (B_FALSE); 11941 } 11942 } 11943 } 11944 11945 for (; ipnd_cnt-- > 0; ipnd++) { 11946 if (ipnd->ip_ndp_name && ipnd->ip_ndp_name[0]) { 11947 if (!nd_load(ndp, ipnd->ip_ndp_name, 11948 ipnd->ip_ndp_getf, ipnd->ip_ndp_setf, 11949 ipnd->ip_ndp_data)) { 11950 nd_free(ndp); 11951 return (B_FALSE); 11952 } 11953 } 11954 } 11955 11956 return (B_TRUE); 11957 } 11958 11959 /* Named Dispatch routine to negotiate a new value for one of our parameters. */ 11960 /* ARGSUSED */ 11961 static int 11962 ip_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *ioc_cr) 11963 { 11964 long new_value; 11965 ipparam_t *ippa = (ipparam_t *)cp; 11966 11967 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11968 new_value < ippa->ip_param_min || new_value > ippa->ip_param_max) { 11969 return (EINVAL); 11970 } 11971 ippa->ip_param_value = new_value; 11972 return (0); 11973 } 11974 11975 /* 11976 * Handles both IPv4 and IPv6 reassembly - doing the out-of-order cases, 11977 * When an ipf is passed here for the first time, if 11978 * we already have in-order fragments on the queue, we convert from the fast- 11979 * path reassembly scheme to the hard-case scheme. From then on, additional 11980 * fragments are reassembled here. We keep track of the start and end offsets 11981 * of each piece, and the number of holes in the chain. When the hole count 11982 * goes to zero, we are done! 11983 * 11984 * The ipf_count will be updated to account for any mblk(s) added (pointed to 11985 * by mp) or subtracted (freeb()ed dups), upon return the caller must update 11986 * ipfb_count and ill_frag_count by the difference of ipf_count before and 11987 * after the call to ip_reassemble(). 11988 */ 11989 int 11990 ip_reassemble(mblk_t *mp, ipf_t *ipf, uint_t start, boolean_t more, ill_t *ill, 11991 size_t msg_len) 11992 { 11993 uint_t end; 11994 mblk_t *next_mp; 11995 mblk_t *mp1; 11996 uint_t offset; 11997 boolean_t incr_dups = B_TRUE; 11998 boolean_t offset_zero_seen = B_FALSE; 11999 boolean_t pkt_boundary_checked = B_FALSE; 12000 12001 /* If start == 0 then ipf_nf_hdr_len has to be set. */ 12002 ASSERT(start != 0 || ipf->ipf_nf_hdr_len != 0); 12003 12004 /* Add in byte count */ 12005 ipf->ipf_count += msg_len; 12006 if (ipf->ipf_end) { 12007 /* 12008 * We were part way through in-order reassembly, but now there 12009 * is a hole. We walk through messages already queued, and 12010 * mark them for hard case reassembly. We know that up till 12011 * now they were in order starting from offset zero. 12012 */ 12013 offset = 0; 12014 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) { 12015 IP_REASS_SET_START(mp1, offset); 12016 if (offset == 0) { 12017 ASSERT(ipf->ipf_nf_hdr_len != 0); 12018 offset = -ipf->ipf_nf_hdr_len; 12019 } 12020 offset += mp1->b_wptr - mp1->b_rptr; 12021 IP_REASS_SET_END(mp1, offset); 12022 } 12023 /* One hole at the end. */ 12024 ipf->ipf_hole_cnt = 1; 12025 /* Brand it as a hard case, forever. */ 12026 ipf->ipf_end = 0; 12027 } 12028 /* Walk through all the new pieces. */ 12029 do { 12030 end = start + (mp->b_wptr - mp->b_rptr); 12031 /* 12032 * If start is 0, decrease 'end' only for the first mblk of 12033 * the fragment. Otherwise 'end' can get wrong value in the 12034 * second pass of the loop if first mblk is exactly the 12035 * size of ipf_nf_hdr_len. 12036 */ 12037 if (start == 0 && !offset_zero_seen) { 12038 /* First segment */ 12039 ASSERT(ipf->ipf_nf_hdr_len != 0); 12040 end -= ipf->ipf_nf_hdr_len; 12041 offset_zero_seen = B_TRUE; 12042 } 12043 next_mp = mp->b_cont; 12044 /* 12045 * We are checking to see if there is any interesing data 12046 * to process. If there isn't and the mblk isn't the 12047 * one which carries the unfragmentable header then we 12048 * drop it. It's possible to have just the unfragmentable 12049 * header come through without any data. That needs to be 12050 * saved. 12051 * 12052 * If the assert at the top of this function holds then the 12053 * term "ipf->ipf_nf_hdr_len != 0" isn't needed. This code 12054 * is infrequently traveled enough that the test is left in 12055 * to protect against future code changes which break that 12056 * invariant. 12057 */ 12058 if (start == end && start != 0 && ipf->ipf_nf_hdr_len != 0) { 12059 /* Empty. Blast it. */ 12060 IP_REASS_SET_START(mp, 0); 12061 IP_REASS_SET_END(mp, 0); 12062 /* 12063 * If the ipf points to the mblk we are about to free, 12064 * update ipf to point to the next mblk (or NULL 12065 * if none). 12066 */ 12067 if (ipf->ipf_mp->b_cont == mp) 12068 ipf->ipf_mp->b_cont = next_mp; 12069 freeb(mp); 12070 continue; 12071 } 12072 mp->b_cont = NULL; 12073 IP_REASS_SET_START(mp, start); 12074 IP_REASS_SET_END(mp, end); 12075 if (!ipf->ipf_tail_mp) { 12076 ipf->ipf_tail_mp = mp; 12077 ipf->ipf_mp->b_cont = mp; 12078 if (start == 0 || !more) { 12079 ipf->ipf_hole_cnt = 1; 12080 /* 12081 * if the first fragment comes in more than one 12082 * mblk, this loop will be executed for each 12083 * mblk. Need to adjust hole count so exiting 12084 * this routine will leave hole count at 1. 12085 */ 12086 if (next_mp) 12087 ipf->ipf_hole_cnt++; 12088 } else 12089 ipf->ipf_hole_cnt = 2; 12090 continue; 12091 } else if (ipf->ipf_last_frag_seen && !more && 12092 !pkt_boundary_checked) { 12093 /* 12094 * We check datagram boundary only if this fragment 12095 * claims to be the last fragment and we have seen a 12096 * last fragment in the past too. We do this only 12097 * once for a given fragment. 12098 * 12099 * start cannot be 0 here as fragments with start=0 12100 * and MF=0 gets handled as a complete packet. These 12101 * fragments should not reach here. 12102 */ 12103 12104 if (start + msgdsize(mp) != 12105 IP_REASS_END(ipf->ipf_tail_mp)) { 12106 /* 12107 * We have two fragments both of which claim 12108 * to be the last fragment but gives conflicting 12109 * information about the whole datagram size. 12110 * Something fishy is going on. Drop the 12111 * fragment and free up the reassembly list. 12112 */ 12113 return (IP_REASS_FAILED); 12114 } 12115 12116 /* 12117 * We shouldn't come to this code block again for this 12118 * particular fragment. 12119 */ 12120 pkt_boundary_checked = B_TRUE; 12121 } 12122 12123 /* New stuff at or beyond tail? */ 12124 offset = IP_REASS_END(ipf->ipf_tail_mp); 12125 if (start >= offset) { 12126 if (ipf->ipf_last_frag_seen) { 12127 /* current fragment is beyond last fragment */ 12128 return (IP_REASS_FAILED); 12129 } 12130 /* Link it on end. */ 12131 ipf->ipf_tail_mp->b_cont = mp; 12132 ipf->ipf_tail_mp = mp; 12133 if (more) { 12134 if (start != offset) 12135 ipf->ipf_hole_cnt++; 12136 } else if (start == offset && next_mp == NULL) 12137 ipf->ipf_hole_cnt--; 12138 continue; 12139 } 12140 mp1 = ipf->ipf_mp->b_cont; 12141 offset = IP_REASS_START(mp1); 12142 /* New stuff at the front? */ 12143 if (start < offset) { 12144 if (start == 0) { 12145 if (end >= offset) { 12146 /* Nailed the hole at the begining. */ 12147 ipf->ipf_hole_cnt--; 12148 } 12149 } else if (end < offset) { 12150 /* 12151 * A hole, stuff, and a hole where there used 12152 * to be just a hole. 12153 */ 12154 ipf->ipf_hole_cnt++; 12155 } 12156 mp->b_cont = mp1; 12157 /* Check for overlap. */ 12158 while (end > offset) { 12159 if (end < IP_REASS_END(mp1)) { 12160 mp->b_wptr -= end - offset; 12161 IP_REASS_SET_END(mp, offset); 12162 BUMP_MIB(ill->ill_ip_mib, 12163 ipIfStatsReasmPartDups); 12164 break; 12165 } 12166 /* Did we cover another hole? */ 12167 if ((mp1->b_cont && 12168 IP_REASS_END(mp1) != 12169 IP_REASS_START(mp1->b_cont) && 12170 end >= IP_REASS_START(mp1->b_cont)) || 12171 (!ipf->ipf_last_frag_seen && !more)) { 12172 ipf->ipf_hole_cnt--; 12173 } 12174 /* Clip out mp1. */ 12175 if ((mp->b_cont = mp1->b_cont) == NULL) { 12176 /* 12177 * After clipping out mp1, this guy 12178 * is now hanging off the end. 12179 */ 12180 ipf->ipf_tail_mp = mp; 12181 } 12182 IP_REASS_SET_START(mp1, 0); 12183 IP_REASS_SET_END(mp1, 0); 12184 /* Subtract byte count */ 12185 ipf->ipf_count -= mp1->b_datap->db_lim - 12186 mp1->b_datap->db_base; 12187 freeb(mp1); 12188 BUMP_MIB(ill->ill_ip_mib, 12189 ipIfStatsReasmPartDups); 12190 mp1 = mp->b_cont; 12191 if (!mp1) 12192 break; 12193 offset = IP_REASS_START(mp1); 12194 } 12195 ipf->ipf_mp->b_cont = mp; 12196 continue; 12197 } 12198 /* 12199 * The new piece starts somewhere between the start of the head 12200 * and before the end of the tail. 12201 */ 12202 for (; mp1; mp1 = mp1->b_cont) { 12203 offset = IP_REASS_END(mp1); 12204 if (start < offset) { 12205 if (end <= offset) { 12206 /* Nothing new. */ 12207 IP_REASS_SET_START(mp, 0); 12208 IP_REASS_SET_END(mp, 0); 12209 /* Subtract byte count */ 12210 ipf->ipf_count -= mp->b_datap->db_lim - 12211 mp->b_datap->db_base; 12212 if (incr_dups) { 12213 ipf->ipf_num_dups++; 12214 incr_dups = B_FALSE; 12215 } 12216 freeb(mp); 12217 BUMP_MIB(ill->ill_ip_mib, 12218 ipIfStatsReasmDuplicates); 12219 break; 12220 } 12221 /* 12222 * Trim redundant stuff off beginning of new 12223 * piece. 12224 */ 12225 IP_REASS_SET_START(mp, offset); 12226 mp->b_rptr += offset - start; 12227 BUMP_MIB(ill->ill_ip_mib, 12228 ipIfStatsReasmPartDups); 12229 start = offset; 12230 if (!mp1->b_cont) { 12231 /* 12232 * After trimming, this guy is now 12233 * hanging off the end. 12234 */ 12235 mp1->b_cont = mp; 12236 ipf->ipf_tail_mp = mp; 12237 if (!more) { 12238 ipf->ipf_hole_cnt--; 12239 } 12240 break; 12241 } 12242 } 12243 if (start >= IP_REASS_START(mp1->b_cont)) 12244 continue; 12245 /* Fill a hole */ 12246 if (start > offset) 12247 ipf->ipf_hole_cnt++; 12248 mp->b_cont = mp1->b_cont; 12249 mp1->b_cont = mp; 12250 mp1 = mp->b_cont; 12251 offset = IP_REASS_START(mp1); 12252 if (end >= offset) { 12253 ipf->ipf_hole_cnt--; 12254 /* Check for overlap. */ 12255 while (end > offset) { 12256 if (end < IP_REASS_END(mp1)) { 12257 mp->b_wptr -= end - offset; 12258 IP_REASS_SET_END(mp, offset); 12259 /* 12260 * TODO we might bump 12261 * this up twice if there is 12262 * overlap at both ends. 12263 */ 12264 BUMP_MIB(ill->ill_ip_mib, 12265 ipIfStatsReasmPartDups); 12266 break; 12267 } 12268 /* Did we cover another hole? */ 12269 if ((mp1->b_cont && 12270 IP_REASS_END(mp1) 12271 != IP_REASS_START(mp1->b_cont) && 12272 end >= 12273 IP_REASS_START(mp1->b_cont)) || 12274 (!ipf->ipf_last_frag_seen && 12275 !more)) { 12276 ipf->ipf_hole_cnt--; 12277 } 12278 /* Clip out mp1. */ 12279 if ((mp->b_cont = mp1->b_cont) == 12280 NULL) { 12281 /* 12282 * After clipping out mp1, 12283 * this guy is now hanging 12284 * off the end. 12285 */ 12286 ipf->ipf_tail_mp = mp; 12287 } 12288 IP_REASS_SET_START(mp1, 0); 12289 IP_REASS_SET_END(mp1, 0); 12290 /* Subtract byte count */ 12291 ipf->ipf_count -= 12292 mp1->b_datap->db_lim - 12293 mp1->b_datap->db_base; 12294 freeb(mp1); 12295 BUMP_MIB(ill->ill_ip_mib, 12296 ipIfStatsReasmPartDups); 12297 mp1 = mp->b_cont; 12298 if (!mp1) 12299 break; 12300 offset = IP_REASS_START(mp1); 12301 } 12302 } 12303 break; 12304 } 12305 } while (start = end, mp = next_mp); 12306 12307 /* Fragment just processed could be the last one. Remember this fact */ 12308 if (!more) 12309 ipf->ipf_last_frag_seen = B_TRUE; 12310 12311 /* Still got holes? */ 12312 if (ipf->ipf_hole_cnt) 12313 return (IP_REASS_PARTIAL); 12314 /* Clean up overloaded fields to avoid upstream disasters. */ 12315 for (mp1 = ipf->ipf_mp->b_cont; mp1; mp1 = mp1->b_cont) { 12316 IP_REASS_SET_START(mp1, 0); 12317 IP_REASS_SET_END(mp1, 0); 12318 } 12319 return (IP_REASS_COMPLETE); 12320 } 12321 12322 /* 12323 * ipsec processing for the fast path, used for input UDP Packets 12324 */ 12325 static boolean_t 12326 ip_udp_check(queue_t *q, conn_t *connp, ill_t *ill, ipha_t *ipha, 12327 mblk_t **mpp, mblk_t **first_mpp, boolean_t mctl_present) 12328 { 12329 uint32_t ill_index; 12330 uint_t in_flags; /* IPF_RECVSLLA and/or IPF_RECVIF */ 12331 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 12332 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 12333 12334 ASSERT(ipha->ipha_protocol == IPPROTO_UDP); 12335 /* The ill_index of the incoming ILL */ 12336 ill_index = ((ill_t *)q->q_ptr)->ill_phyint->phyint_ifindex; 12337 12338 /* pass packet up to the transport */ 12339 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || mctl_present) { 12340 *first_mpp = ipsec_check_inbound_policy(*first_mpp, connp, ipha, 12341 NULL, mctl_present); 12342 if (*first_mpp == NULL) { 12343 return (B_FALSE); 12344 } 12345 } 12346 12347 /* Initiate IPPF processing for fastpath UDP */ 12348 if (IPP_ENABLED(IPP_LOCAL_IN, ipst)) { 12349 ip_process(IPP_LOCAL_IN, mpp, ill_index); 12350 if (*mpp == NULL) { 12351 ip2dbg(("ip_input_ipsec_process: UDP pkt " 12352 "deferred/dropped during IPPF processing\n")); 12353 return (B_FALSE); 12354 } 12355 } 12356 /* 12357 * We make the checks as below since we are in the fast path 12358 * and want to minimize the number of checks if the IP_RECVIF and/or 12359 * IP_RECVSLLA and/or IPV6_RECVPKTINFO options are not set 12360 */ 12361 if (connp->conn_recvif || connp->conn_recvslla || 12362 connp->conn_ip_recvpktinfo) { 12363 if (connp->conn_recvif) { 12364 in_flags = IPF_RECVIF; 12365 } 12366 /* 12367 * UDP supports IP_RECVPKTINFO option for both v4 and v6 12368 * so the flag passed to ip_add_info is based on IP version 12369 * of connp. 12370 */ 12371 if (connp->conn_ip_recvpktinfo) { 12372 if (connp->conn_af_isv6) { 12373 /* 12374 * V6 only needs index 12375 */ 12376 in_flags |= IPF_RECVIF; 12377 } else { 12378 /* 12379 * V4 needs index + matching address. 12380 */ 12381 in_flags |= IPF_RECVADDR; 12382 } 12383 } 12384 if (connp->conn_recvslla) { 12385 in_flags |= IPF_RECVSLLA; 12386 } 12387 /* 12388 * since in_flags are being set ill will be 12389 * referenced in ip_add_info, so it better not 12390 * be NULL. 12391 */ 12392 /* 12393 * the actual data will be contained in b_cont 12394 * upon successful return of the following call. 12395 * If the call fails then the original mblk is 12396 * returned. 12397 */ 12398 *mpp = ip_add_info(*mpp, ill, in_flags, IPCL_ZONEID(connp), 12399 ipst); 12400 } 12401 12402 return (B_TRUE); 12403 } 12404 12405 /* 12406 * Fragmentation reassembly. Each ILL has a hash table for 12407 * queuing packets undergoing reassembly for all IPIFs 12408 * associated with the ILL. The hash is based on the packet 12409 * IP ident field. The ILL frag hash table was allocated 12410 * as a timer block at the time the ILL was created. Whenever 12411 * there is anything on the reassembly queue, the timer will 12412 * be running. Returns B_TRUE if successful else B_FALSE; 12413 * frees mp on failure. 12414 */ 12415 static boolean_t 12416 ip_rput_fragment(queue_t *q, mblk_t **mpp, ipha_t *ipha, 12417 uint32_t *cksum_val, uint16_t *cksum_flags) 12418 { 12419 uint32_t frag_offset_flags; 12420 ill_t *ill = (ill_t *)q->q_ptr; 12421 mblk_t *mp = *mpp; 12422 mblk_t *t_mp; 12423 ipaddr_t dst; 12424 uint8_t proto = ipha->ipha_protocol; 12425 uint32_t sum_val; 12426 uint16_t sum_flags; 12427 ipf_t *ipf; 12428 ipf_t **ipfp; 12429 ipfb_t *ipfb; 12430 uint16_t ident; 12431 uint32_t offset; 12432 ipaddr_t src; 12433 uint_t hdr_length; 12434 uint32_t end; 12435 mblk_t *mp1; 12436 mblk_t *tail_mp; 12437 size_t count; 12438 size_t msg_len; 12439 uint8_t ecn_info = 0; 12440 uint32_t packet_size; 12441 boolean_t pruned = B_FALSE; 12442 ip_stack_t *ipst = ill->ill_ipst; 12443 12444 if (cksum_val != NULL) 12445 *cksum_val = 0; 12446 if (cksum_flags != NULL) 12447 *cksum_flags = 0; 12448 12449 /* 12450 * Drop the fragmented as early as possible, if 12451 * we don't have resource(s) to re-assemble. 12452 */ 12453 if (ipst->ips_ip_reass_queue_bytes == 0) { 12454 freemsg(mp); 12455 return (B_FALSE); 12456 } 12457 12458 /* Check for fragmentation offset; return if there's none */ 12459 if ((frag_offset_flags = ntohs(ipha->ipha_fragment_offset_and_flags) & 12460 (IPH_MF | IPH_OFFSET)) == 0) 12461 return (B_TRUE); 12462 12463 /* 12464 * We utilize hardware computed checksum info only for UDP since 12465 * IP fragmentation is a normal occurence for the protocol. In 12466 * addition, checksum offload support for IP fragments carrying 12467 * UDP payload is commonly implemented across network adapters. 12468 */ 12469 ASSERT(ill != NULL); 12470 if (proto == IPPROTO_UDP && dohwcksum && ILL_HCKSUM_CAPABLE(ill) && 12471 (DB_CKSUMFLAGS(mp) & (HCK_FULLCKSUM | HCK_PARTIALCKSUM))) { 12472 mblk_t *mp1 = mp->b_cont; 12473 int32_t len; 12474 12475 /* Record checksum information from the packet */ 12476 sum_val = (uint32_t)DB_CKSUM16(mp); 12477 sum_flags = DB_CKSUMFLAGS(mp); 12478 12479 /* IP payload offset from beginning of mblk */ 12480 offset = ((uchar_t *)ipha + IPH_HDR_LENGTH(ipha)) - mp->b_rptr; 12481 12482 if ((sum_flags & HCK_PARTIALCKSUM) && 12483 (mp1 == NULL || mp1->b_cont == NULL) && 12484 offset >= DB_CKSUMSTART(mp) && 12485 ((len = offset - DB_CKSUMSTART(mp)) & 1) == 0) { 12486 uint32_t adj; 12487 /* 12488 * Partial checksum has been calculated by hardware 12489 * and attached to the packet; in addition, any 12490 * prepended extraneous data is even byte aligned. 12491 * If any such data exists, we adjust the checksum; 12492 * this would also handle any postpended data. 12493 */ 12494 IP_ADJCKSUM_PARTIAL(mp->b_rptr + DB_CKSUMSTART(mp), 12495 mp, mp1, len, adj); 12496 12497 /* One's complement subtract extraneous checksum */ 12498 if (adj >= sum_val) 12499 sum_val = ~(adj - sum_val) & 0xFFFF; 12500 else 12501 sum_val -= adj; 12502 } 12503 } else { 12504 sum_val = 0; 12505 sum_flags = 0; 12506 } 12507 12508 /* Clear hardware checksumming flag */ 12509 DB_CKSUMFLAGS(mp) = 0; 12510 12511 ident = ipha->ipha_ident; 12512 offset = (frag_offset_flags << 3) & 0xFFFF; 12513 src = ipha->ipha_src; 12514 dst = ipha->ipha_dst; 12515 hdr_length = IPH_HDR_LENGTH(ipha); 12516 end = ntohs(ipha->ipha_length) - hdr_length; 12517 12518 /* If end == 0 then we have a packet with no data, so just free it */ 12519 if (end == 0) { 12520 freemsg(mp); 12521 return (B_FALSE); 12522 } 12523 12524 /* Record the ECN field info. */ 12525 ecn_info = (ipha->ipha_type_of_service & 0x3); 12526 if (offset != 0) { 12527 /* 12528 * If this isn't the first piece, strip the header, and 12529 * add the offset to the end value. 12530 */ 12531 mp->b_rptr += hdr_length; 12532 end += offset; 12533 } 12534 12535 msg_len = MBLKSIZE(mp); 12536 tail_mp = mp; 12537 while (tail_mp->b_cont != NULL) { 12538 tail_mp = tail_mp->b_cont; 12539 msg_len += MBLKSIZE(tail_mp); 12540 } 12541 12542 /* If the reassembly list for this ILL will get too big, prune it */ 12543 if ((msg_len + sizeof (*ipf) + ill->ill_frag_count) >= 12544 ipst->ips_ip_reass_queue_bytes) { 12545 ill_frag_prune(ill, 12546 (ipst->ips_ip_reass_queue_bytes < msg_len) ? 0 : 12547 (ipst->ips_ip_reass_queue_bytes - msg_len)); 12548 pruned = B_TRUE; 12549 } 12550 12551 ipfb = &ill->ill_frag_hash_tbl[ILL_FRAG_HASH(src, ident)]; 12552 mutex_enter(&ipfb->ipfb_lock); 12553 12554 ipfp = &ipfb->ipfb_ipf; 12555 /* Try to find an existing fragment queue for this packet. */ 12556 for (;;) { 12557 ipf = ipfp[0]; 12558 if (ipf != NULL) { 12559 /* 12560 * It has to match on ident and src/dst address. 12561 */ 12562 if (ipf->ipf_ident == ident && 12563 ipf->ipf_src == src && 12564 ipf->ipf_dst == dst && 12565 ipf->ipf_protocol == proto) { 12566 /* 12567 * If we have received too many 12568 * duplicate fragments for this packet 12569 * free it. 12570 */ 12571 if (ipf->ipf_num_dups > ip_max_frag_dups) { 12572 ill_frag_free_pkts(ill, ipfb, ipf, 1); 12573 freemsg(mp); 12574 mutex_exit(&ipfb->ipfb_lock); 12575 return (B_FALSE); 12576 } 12577 /* Found it. */ 12578 break; 12579 } 12580 ipfp = &ipf->ipf_hash_next; 12581 continue; 12582 } 12583 12584 /* 12585 * If we pruned the list, do we want to store this new 12586 * fragment?. We apply an optimization here based on the 12587 * fact that most fragments will be received in order. 12588 * So if the offset of this incoming fragment is zero, 12589 * it is the first fragment of a new packet. We will 12590 * keep it. Otherwise drop the fragment, as we have 12591 * probably pruned the packet already (since the 12592 * packet cannot be found). 12593 */ 12594 if (pruned && offset != 0) { 12595 mutex_exit(&ipfb->ipfb_lock); 12596 freemsg(mp); 12597 return (B_FALSE); 12598 } 12599 12600 if (ipfb->ipfb_frag_pkts >= MAX_FRAG_PKTS(ipst)) { 12601 /* 12602 * Too many fragmented packets in this hash 12603 * bucket. Free the oldest. 12604 */ 12605 ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf, 1); 12606 } 12607 12608 /* New guy. Allocate a frag message. */ 12609 mp1 = allocb(sizeof (*ipf), BPRI_MED); 12610 if (mp1 == NULL) { 12611 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 12612 freemsg(mp); 12613 reass_done: 12614 mutex_exit(&ipfb->ipfb_lock); 12615 return (B_FALSE); 12616 } 12617 12618 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmReqds); 12619 mp1->b_cont = mp; 12620 12621 /* Initialize the fragment header. */ 12622 ipf = (ipf_t *)mp1->b_rptr; 12623 ipf->ipf_mp = mp1; 12624 ipf->ipf_ptphn = ipfp; 12625 ipfp[0] = ipf; 12626 ipf->ipf_hash_next = NULL; 12627 ipf->ipf_ident = ident; 12628 ipf->ipf_protocol = proto; 12629 ipf->ipf_src = src; 12630 ipf->ipf_dst = dst; 12631 ipf->ipf_nf_hdr_len = 0; 12632 /* Record reassembly start time. */ 12633 ipf->ipf_timestamp = gethrestime_sec(); 12634 /* Record ipf generation and account for frag header */ 12635 ipf->ipf_gen = ill->ill_ipf_gen++; 12636 ipf->ipf_count = MBLKSIZE(mp1); 12637 ipf->ipf_last_frag_seen = B_FALSE; 12638 ipf->ipf_ecn = ecn_info; 12639 ipf->ipf_num_dups = 0; 12640 ipfb->ipfb_frag_pkts++; 12641 ipf->ipf_checksum = 0; 12642 ipf->ipf_checksum_flags = 0; 12643 12644 /* Store checksum value in fragment header */ 12645 if (sum_flags != 0) { 12646 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 12647 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 12648 ipf->ipf_checksum = sum_val; 12649 ipf->ipf_checksum_flags = sum_flags; 12650 } 12651 12652 /* 12653 * We handle reassembly two ways. In the easy case, 12654 * where all the fragments show up in order, we do 12655 * minimal bookkeeping, and just clip new pieces on 12656 * the end. If we ever see a hole, then we go off 12657 * to ip_reassemble which has to mark the pieces and 12658 * keep track of the number of holes, etc. Obviously, 12659 * the point of having both mechanisms is so we can 12660 * handle the easy case as efficiently as possible. 12661 */ 12662 if (offset == 0) { 12663 /* Easy case, in-order reassembly so far. */ 12664 ipf->ipf_count += msg_len; 12665 ipf->ipf_tail_mp = tail_mp; 12666 /* 12667 * Keep track of next expected offset in 12668 * ipf_end. 12669 */ 12670 ipf->ipf_end = end; 12671 ipf->ipf_nf_hdr_len = hdr_length; 12672 } else { 12673 /* Hard case, hole at the beginning. */ 12674 ipf->ipf_tail_mp = NULL; 12675 /* 12676 * ipf_end == 0 means that we have given up 12677 * on easy reassembly. 12678 */ 12679 ipf->ipf_end = 0; 12680 12681 /* Forget checksum offload from now on */ 12682 ipf->ipf_checksum_flags = 0; 12683 12684 /* 12685 * ipf_hole_cnt is set by ip_reassemble. 12686 * ipf_count is updated by ip_reassemble. 12687 * No need to check for return value here 12688 * as we don't expect reassembly to complete 12689 * or fail for the first fragment itself. 12690 */ 12691 (void) ip_reassemble(mp, ipf, 12692 (frag_offset_flags & IPH_OFFSET) << 3, 12693 (frag_offset_flags & IPH_MF), ill, msg_len); 12694 } 12695 /* Update per ipfb and ill byte counts */ 12696 ipfb->ipfb_count += ipf->ipf_count; 12697 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */ 12698 ill->ill_frag_count += ipf->ipf_count; 12699 ASSERT(ill->ill_frag_count > 0); /* Wraparound */ 12700 /* If the frag timer wasn't already going, start it. */ 12701 mutex_enter(&ill->ill_lock); 12702 ill_frag_timer_start(ill); 12703 mutex_exit(&ill->ill_lock); 12704 goto reass_done; 12705 } 12706 12707 /* 12708 * If the packet's flag has changed (it could be coming up 12709 * from an interface different than the previous, therefore 12710 * possibly different checksum capability), then forget about 12711 * any stored checksum states. Otherwise add the value to 12712 * the existing one stored in the fragment header. 12713 */ 12714 if (sum_flags != 0 && sum_flags == ipf->ipf_checksum_flags) { 12715 sum_val += ipf->ipf_checksum; 12716 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 12717 sum_val = (sum_val & 0xFFFF) + (sum_val >> 16); 12718 ipf->ipf_checksum = sum_val; 12719 } else if (ipf->ipf_checksum_flags != 0) { 12720 /* Forget checksum offload from now on */ 12721 ipf->ipf_checksum_flags = 0; 12722 } 12723 12724 /* 12725 * We have a new piece of a datagram which is already being 12726 * reassembled. Update the ECN info if all IP fragments 12727 * are ECN capable. If there is one which is not, clear 12728 * all the info. If there is at least one which has CE 12729 * code point, IP needs to report that up to transport. 12730 */ 12731 if (ecn_info != IPH_ECN_NECT && ipf->ipf_ecn != IPH_ECN_NECT) { 12732 if (ecn_info == IPH_ECN_CE) 12733 ipf->ipf_ecn = IPH_ECN_CE; 12734 } else { 12735 ipf->ipf_ecn = IPH_ECN_NECT; 12736 } 12737 if (offset && ipf->ipf_end == offset) { 12738 /* The new fragment fits at the end */ 12739 ipf->ipf_tail_mp->b_cont = mp; 12740 /* Update the byte count */ 12741 ipf->ipf_count += msg_len; 12742 /* Update per ipfb and ill byte counts */ 12743 ipfb->ipfb_count += msg_len; 12744 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */ 12745 ill->ill_frag_count += msg_len; 12746 ASSERT(ill->ill_frag_count > 0); /* Wraparound */ 12747 if (frag_offset_flags & IPH_MF) { 12748 /* More to come. */ 12749 ipf->ipf_end = end; 12750 ipf->ipf_tail_mp = tail_mp; 12751 goto reass_done; 12752 } 12753 } else { 12754 /* Go do the hard cases. */ 12755 int ret; 12756 12757 if (offset == 0) 12758 ipf->ipf_nf_hdr_len = hdr_length; 12759 12760 /* Save current byte count */ 12761 count = ipf->ipf_count; 12762 ret = ip_reassemble(mp, ipf, 12763 (frag_offset_flags & IPH_OFFSET) << 3, 12764 (frag_offset_flags & IPH_MF), ill, msg_len); 12765 /* Count of bytes added and subtracted (freeb()ed) */ 12766 count = ipf->ipf_count - count; 12767 if (count) { 12768 /* Update per ipfb and ill byte counts */ 12769 ipfb->ipfb_count += count; 12770 ASSERT(ipfb->ipfb_count > 0); /* Wraparound */ 12771 ill->ill_frag_count += count; 12772 ASSERT(ill->ill_frag_count > 0); 12773 } 12774 if (ret == IP_REASS_PARTIAL) { 12775 goto reass_done; 12776 } else if (ret == IP_REASS_FAILED) { 12777 /* Reassembly failed. Free up all resources */ 12778 ill_frag_free_pkts(ill, ipfb, ipf, 1); 12779 for (t_mp = mp; t_mp != NULL; t_mp = t_mp->b_cont) { 12780 IP_REASS_SET_START(t_mp, 0); 12781 IP_REASS_SET_END(t_mp, 0); 12782 } 12783 freemsg(mp); 12784 goto reass_done; 12785 } 12786 /* We will reach here iff 'ret' is IP_REASS_COMPLETE */ 12787 } 12788 /* 12789 * We have completed reassembly. Unhook the frag header from 12790 * the reassembly list. 12791 * 12792 * Before we free the frag header, record the ECN info 12793 * to report back to the transport. 12794 */ 12795 ecn_info = ipf->ipf_ecn; 12796 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmOKs); 12797 ipfp = ipf->ipf_ptphn; 12798 12799 /* We need to supply these to caller */ 12800 if ((sum_flags = ipf->ipf_checksum_flags) != 0) 12801 sum_val = ipf->ipf_checksum; 12802 else 12803 sum_val = 0; 12804 12805 mp1 = ipf->ipf_mp; 12806 count = ipf->ipf_count; 12807 ipf = ipf->ipf_hash_next; 12808 if (ipf != NULL) 12809 ipf->ipf_ptphn = ipfp; 12810 ipfp[0] = ipf; 12811 ill->ill_frag_count -= count; 12812 ASSERT(ipfb->ipfb_count >= count); 12813 ipfb->ipfb_count -= count; 12814 ipfb->ipfb_frag_pkts--; 12815 mutex_exit(&ipfb->ipfb_lock); 12816 /* Ditch the frag header. */ 12817 mp = mp1->b_cont; 12818 12819 freeb(mp1); 12820 12821 /* Restore original IP length in header. */ 12822 packet_size = (uint32_t)msgdsize(mp); 12823 if (packet_size > IP_MAXPACKET) { 12824 freemsg(mp); 12825 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 12826 return (B_FALSE); 12827 } 12828 12829 if (DB_REF(mp) > 1) { 12830 mblk_t *mp2 = copymsg(mp); 12831 12832 freemsg(mp); 12833 if (mp2 == NULL) { 12834 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 12835 return (B_FALSE); 12836 } 12837 mp = mp2; 12838 } 12839 ipha = (ipha_t *)mp->b_rptr; 12840 12841 ipha->ipha_length = htons((uint16_t)packet_size); 12842 /* We're now complete, zip the frag state */ 12843 ipha->ipha_fragment_offset_and_flags = 0; 12844 /* Record the ECN info. */ 12845 ipha->ipha_type_of_service &= 0xFC; 12846 ipha->ipha_type_of_service |= ecn_info; 12847 *mpp = mp; 12848 12849 /* Reassembly is successful; return checksum information if needed */ 12850 if (cksum_val != NULL) 12851 *cksum_val = sum_val; 12852 if (cksum_flags != NULL) 12853 *cksum_flags = sum_flags; 12854 12855 return (B_TRUE); 12856 } 12857 12858 /* 12859 * Perform ip header check sum update local options. 12860 * return B_TRUE if all is well, else return B_FALSE and release 12861 * the mp. caller is responsible for decrementing ire ref cnt. 12862 */ 12863 static boolean_t 12864 ip_options_cksum(queue_t *q, ill_t *ill, mblk_t *mp, ipha_t *ipha, ire_t *ire, 12865 ip_stack_t *ipst) 12866 { 12867 mblk_t *first_mp; 12868 boolean_t mctl_present; 12869 uint16_t sum; 12870 12871 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 12872 /* 12873 * Don't do the checksum if it has gone through AH/ESP 12874 * processing. 12875 */ 12876 if (!mctl_present) { 12877 sum = ip_csum_hdr(ipha); 12878 if (sum != 0) { 12879 if (ill != NULL) { 12880 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs); 12881 } else { 12882 BUMP_MIB(&ipst->ips_ip_mib, 12883 ipIfStatsInCksumErrs); 12884 } 12885 freemsg(first_mp); 12886 return (B_FALSE); 12887 } 12888 } 12889 12890 if (!ip_rput_local_options(q, mp, ipha, ire, ipst)) { 12891 if (mctl_present) 12892 freeb(first_mp); 12893 return (B_FALSE); 12894 } 12895 12896 return (B_TRUE); 12897 } 12898 12899 /* 12900 * All udp packet are delivered to the local host via this routine. 12901 */ 12902 void 12903 ip_udp_input(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire, 12904 ill_t *recv_ill) 12905 { 12906 uint32_t sum; 12907 uint32_t u1; 12908 boolean_t mctl_present; 12909 conn_t *connp; 12910 mblk_t *first_mp; 12911 uint16_t *up; 12912 ill_t *ill = (ill_t *)q->q_ptr; 12913 uint16_t reass_hck_flags = 0; 12914 ip_stack_t *ipst; 12915 12916 ASSERT(recv_ill != NULL); 12917 ipst = recv_ill->ill_ipst; 12918 12919 #define rptr ((uchar_t *)ipha) 12920 12921 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 12922 ASSERT(!mctl_present || ipsec_in_is_secure(first_mp)); 12923 ASSERT(ipha->ipha_protocol == IPPROTO_UDP); 12924 ASSERT(ill != NULL); 12925 12926 /* 12927 * FAST PATH for udp packets 12928 */ 12929 12930 /* u1 is # words of IP options */ 12931 u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4) + 12932 IP_SIMPLE_HDR_LENGTH_IN_WORDS); 12933 12934 /* IP options present */ 12935 if (u1 != 0) 12936 goto ipoptions; 12937 12938 /* Check the IP header checksum. */ 12939 if (IS_IP_HDR_HWCKSUM(mctl_present, mp, ill)) { 12940 /* Clear the IP header h/w cksum flag */ 12941 DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM; 12942 } else { 12943 #define uph ((uint16_t *)ipha) 12944 sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + uph[5] + 12945 uph[6] + uph[7] + uph[8] + uph[9]; 12946 #undef uph 12947 /* finish doing IP checksum */ 12948 sum = (sum & 0xFFFF) + (sum >> 16); 12949 sum = ~(sum + (sum >> 16)) & 0xFFFF; 12950 /* 12951 * Don't verify header checksum if this packet is coming 12952 * back from AH/ESP as we already did it. 12953 */ 12954 if (!mctl_present && sum != 0 && sum != 0xFFFF) { 12955 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs); 12956 freemsg(first_mp); 12957 return; 12958 } 12959 } 12960 12961 /* 12962 * Count for SNMP of inbound packets for ire. 12963 * if mctl is present this might be a secure packet and 12964 * has already been counted for in ip_proto_input(). 12965 */ 12966 if (!mctl_present) { 12967 UPDATE_IB_PKT_COUNT(ire); 12968 ire->ire_last_used_time = lbolt; 12969 } 12970 12971 /* packet part of fragmented IP packet? */ 12972 u1 = ntohs(ipha->ipha_fragment_offset_and_flags); 12973 if (u1 & (IPH_MF | IPH_OFFSET)) { 12974 goto fragmented; 12975 } 12976 12977 /* u1 = IP header length (20 bytes) */ 12978 u1 = IP_SIMPLE_HDR_LENGTH; 12979 12980 /* packet does not contain complete IP & UDP headers */ 12981 if ((mp->b_wptr - rptr) < (IP_SIMPLE_HDR_LENGTH + UDPH_SIZE)) 12982 goto udppullup; 12983 12984 /* up points to UDP header */ 12985 up = (uint16_t *)((uchar_t *)ipha + IP_SIMPLE_HDR_LENGTH); 12986 #define iphs ((uint16_t *)ipha) 12987 12988 /* if udp hdr cksum != 0, then need to checksum udp packet */ 12989 if (up[3] != 0) { 12990 mblk_t *mp1 = mp->b_cont; 12991 boolean_t cksum_err; 12992 uint16_t hck_flags = 0; 12993 12994 /* Pseudo-header checksum */ 12995 u1 = IP_UDP_CSUM_COMP + iphs[6] + iphs[7] + iphs[8] + 12996 iphs[9] + up[2]; 12997 12998 /* 12999 * Revert to software checksum calculation if the interface 13000 * isn't capable of checksum offload or if IPsec is present. 13001 */ 13002 if (ILL_HCKSUM_CAPABLE(ill) && !mctl_present && dohwcksum) 13003 hck_flags = DB_CKSUMFLAGS(mp); 13004 13005 if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0) 13006 IP_STAT(ipst, ip_in_sw_cksum); 13007 13008 IP_CKSUM_RECV(hck_flags, u1, 13009 (uchar_t *)(rptr + DB_CKSUMSTART(mp)), 13010 (int32_t)((uchar_t *)up - rptr), 13011 mp, mp1, cksum_err); 13012 13013 if (cksum_err) { 13014 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInCksumErrs); 13015 if (hck_flags & HCK_FULLCKSUM) 13016 IP_STAT(ipst, ip_udp_in_full_hw_cksum_err); 13017 else if (hck_flags & HCK_PARTIALCKSUM) 13018 IP_STAT(ipst, ip_udp_in_part_hw_cksum_err); 13019 else 13020 IP_STAT(ipst, ip_udp_in_sw_cksum_err); 13021 13022 freemsg(first_mp); 13023 return; 13024 } 13025 } 13026 13027 /* Non-fragmented broadcast or multicast packet? */ 13028 if (ire->ire_type == IRE_BROADCAST) 13029 goto udpslowpath; 13030 13031 if ((connp = ipcl_classify_v4(mp, IPPROTO_UDP, IP_SIMPLE_HDR_LENGTH, 13032 ire->ire_zoneid, ipst)) != NULL) { 13033 ASSERT(connp->conn_upq != NULL); 13034 IP_STAT(ipst, ip_udp_fast_path); 13035 13036 if (CONN_UDP_FLOWCTLD(connp)) { 13037 freemsg(mp); 13038 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows); 13039 } else { 13040 if (!mctl_present) { 13041 BUMP_MIB(ill->ill_ip_mib, 13042 ipIfStatsHCInDelivers); 13043 } 13044 /* 13045 * mp and first_mp can change. 13046 */ 13047 if (ip_udp_check(q, connp, recv_ill, 13048 ipha, &mp, &first_mp, mctl_present)) { 13049 /* Send it upstream */ 13050 CONN_UDP_RECV(connp, mp); 13051 } 13052 } 13053 /* 13054 * freeb() cannot deal with null mblk being passed 13055 * in and first_mp can be set to null in the call 13056 * ipsec_input_fast_proc()->ipsec_check_inbound_policy. 13057 */ 13058 if (mctl_present && first_mp != NULL) { 13059 freeb(first_mp); 13060 } 13061 CONN_DEC_REF(connp); 13062 return; 13063 } 13064 13065 /* 13066 * if we got here we know the packet is not fragmented and 13067 * has no options. The classifier could not find a conn_t and 13068 * most likely its an icmp packet so send it through slow path. 13069 */ 13070 13071 goto udpslowpath; 13072 13073 ipoptions: 13074 if (!ip_options_cksum(q, ill, mp, ipha, ire, ipst)) { 13075 goto slow_done; 13076 } 13077 13078 UPDATE_IB_PKT_COUNT(ire); 13079 ire->ire_last_used_time = lbolt; 13080 u1 = ntohs(ipha->ipha_fragment_offset_and_flags); 13081 if (u1 & (IPH_MF | IPH_OFFSET)) { 13082 fragmented: 13083 /* 13084 * "sum" and "reass_hck_flags" are non-zero if the 13085 * reassembled packet has a valid hardware computed 13086 * checksum information associated with it. 13087 */ 13088 if (!ip_rput_fragment(q, &mp, ipha, &sum, &reass_hck_flags)) 13089 goto slow_done; 13090 /* 13091 * Make sure that first_mp points back to mp as 13092 * the mp we came in with could have changed in 13093 * ip_rput_fragment(). 13094 */ 13095 ASSERT(!mctl_present); 13096 ipha = (ipha_t *)mp->b_rptr; 13097 first_mp = mp; 13098 } 13099 13100 /* Now we have a complete datagram, destined for this machine. */ 13101 u1 = IPH_HDR_LENGTH(ipha); 13102 /* Pull up the UDP header, if necessary. */ 13103 if ((MBLKL(mp)) < (u1 + UDPH_SIZE)) { 13104 udppullup: 13105 if (!pullupmsg(mp, u1 + UDPH_SIZE)) { 13106 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13107 freemsg(first_mp); 13108 goto slow_done; 13109 } 13110 ipha = (ipha_t *)mp->b_rptr; 13111 } 13112 13113 /* 13114 * Validate the checksum for the reassembled packet; for the 13115 * pullup case we calculate the payload checksum in software. 13116 */ 13117 up = (uint16_t *)((uchar_t *)ipha + u1 + UDP_PORTS_OFFSET); 13118 if (up[3] != 0) { 13119 boolean_t cksum_err; 13120 13121 if ((reass_hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0) 13122 IP_STAT(ipst, ip_in_sw_cksum); 13123 13124 IP_CKSUM_RECV_REASS(reass_hck_flags, 13125 (int32_t)((uchar_t *)up - (uchar_t *)ipha), 13126 IP_UDP_CSUM_COMP + iphs[6] + iphs[7] + iphs[8] + 13127 iphs[9] + up[2], sum, cksum_err); 13128 13129 if (cksum_err) { 13130 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInCksumErrs); 13131 13132 if (reass_hck_flags & HCK_FULLCKSUM) 13133 IP_STAT(ipst, ip_udp_in_full_hw_cksum_err); 13134 else if (reass_hck_flags & HCK_PARTIALCKSUM) 13135 IP_STAT(ipst, ip_udp_in_part_hw_cksum_err); 13136 else 13137 IP_STAT(ipst, ip_udp_in_sw_cksum_err); 13138 13139 freemsg(first_mp); 13140 goto slow_done; 13141 } 13142 } 13143 udpslowpath: 13144 13145 /* Clear hardware checksum flag to be safe */ 13146 DB_CKSUMFLAGS(mp) = 0; 13147 13148 ip_fanout_udp(q, first_mp, ill, ipha, *(uint32_t *)up, 13149 (ire->ire_type == IRE_BROADCAST), 13150 IP_FF_SEND_ICMP | IP_FF_CKSUM | IP_FF_IPINFO, 13151 mctl_present, B_TRUE, recv_ill, ire->ire_zoneid); 13152 13153 slow_done: 13154 IP_STAT(ipst, ip_udp_slow_path); 13155 return; 13156 13157 #undef iphs 13158 #undef rptr 13159 } 13160 13161 /* ARGSUSED */ 13162 static mblk_t * 13163 ip_tcp_input(mblk_t *mp, ipha_t *ipha, ill_t *recv_ill, boolean_t mctl_present, 13164 ire_t *ire, mblk_t *first_mp, uint_t flags, queue_t *q, 13165 ill_rx_ring_t *ill_ring) 13166 { 13167 conn_t *connp; 13168 uint32_t sum; 13169 uint32_t u1; 13170 uint16_t *up; 13171 int offset; 13172 ssize_t len; 13173 mblk_t *mp1; 13174 boolean_t syn_present = B_FALSE; 13175 tcph_t *tcph; 13176 uint_t ip_hdr_len; 13177 ill_t *ill = (ill_t *)q->q_ptr; 13178 zoneid_t zoneid = ire->ire_zoneid; 13179 boolean_t cksum_err; 13180 uint16_t hck_flags = 0; 13181 ip_stack_t *ipst = recv_ill->ill_ipst; 13182 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 13183 13184 #define rptr ((uchar_t *)ipha) 13185 13186 ASSERT(ipha->ipha_protocol == IPPROTO_TCP); 13187 ASSERT(ill != NULL); 13188 13189 /* 13190 * FAST PATH for tcp packets 13191 */ 13192 13193 /* u1 is # words of IP options */ 13194 u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4) 13195 + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 13196 13197 /* IP options present */ 13198 if (u1) { 13199 goto ipoptions; 13200 } else { 13201 /* Check the IP header checksum. */ 13202 if (IS_IP_HDR_HWCKSUM(mctl_present, mp, ill)) { 13203 /* Clear the IP header h/w cksum flag */ 13204 DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM; 13205 } else { 13206 #define uph ((uint16_t *)ipha) 13207 sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + 13208 uph[5] + uph[6] + uph[7] + uph[8] + uph[9]; 13209 #undef uph 13210 /* finish doing IP checksum */ 13211 sum = (sum & 0xFFFF) + (sum >> 16); 13212 sum = ~(sum + (sum >> 16)) & 0xFFFF; 13213 /* 13214 * Don't verify header checksum if this packet 13215 * is coming back from AH/ESP as we already did it. 13216 */ 13217 if (!mctl_present && (sum != 0) && sum != 0xFFFF) { 13218 BUMP_MIB(ill->ill_ip_mib, 13219 ipIfStatsInCksumErrs); 13220 goto error; 13221 } 13222 } 13223 } 13224 13225 if (!mctl_present) { 13226 UPDATE_IB_PKT_COUNT(ire); 13227 ire->ire_last_used_time = lbolt; 13228 } 13229 13230 /* packet part of fragmented IP packet? */ 13231 u1 = ntohs(ipha->ipha_fragment_offset_and_flags); 13232 if (u1 & (IPH_MF | IPH_OFFSET)) { 13233 goto fragmented; 13234 } 13235 13236 /* u1 = IP header length (20 bytes) */ 13237 u1 = ip_hdr_len = IP_SIMPLE_HDR_LENGTH; 13238 13239 /* does packet contain IP+TCP headers? */ 13240 len = mp->b_wptr - rptr; 13241 if (len < (IP_SIMPLE_HDR_LENGTH + TCP_MIN_HEADER_LENGTH)) { 13242 IP_STAT(ipst, ip_tcppullup); 13243 goto tcppullup; 13244 } 13245 13246 /* TCP options present? */ 13247 offset = ((uchar_t *)ipha)[IP_SIMPLE_HDR_LENGTH + 12] >> 4; 13248 13249 /* 13250 * If options need to be pulled up, then goto tcpoptions. 13251 * otherwise we are still in the fast path 13252 */ 13253 if (len < (offset << 2) + IP_SIMPLE_HDR_LENGTH) { 13254 IP_STAT(ipst, ip_tcpoptions); 13255 goto tcpoptions; 13256 } 13257 13258 /* multiple mblks of tcp data? */ 13259 if ((mp1 = mp->b_cont) != NULL) { 13260 /* more then two? */ 13261 if (mp1->b_cont != NULL) { 13262 IP_STAT(ipst, ip_multipkttcp); 13263 goto multipkttcp; 13264 } 13265 len += mp1->b_wptr - mp1->b_rptr; 13266 } 13267 13268 up = (uint16_t *)(rptr + IP_SIMPLE_HDR_LENGTH + TCP_PORTS_OFFSET); 13269 13270 /* part of pseudo checksum */ 13271 13272 /* TCP datagram length */ 13273 u1 = len - IP_SIMPLE_HDR_LENGTH; 13274 13275 #define iphs ((uint16_t *)ipha) 13276 13277 #ifdef _BIG_ENDIAN 13278 u1 += IPPROTO_TCP; 13279 #else 13280 u1 = ((u1 >> 8) & 0xFF) + (((u1 & 0xFF) + IPPROTO_TCP) << 8); 13281 #endif 13282 u1 += iphs[6] + iphs[7] + iphs[8] + iphs[9]; 13283 13284 /* 13285 * Revert to software checksum calculation if the interface 13286 * isn't capable of checksum offload or if IPsec is present. 13287 */ 13288 if (ILL_HCKSUM_CAPABLE(ill) && !mctl_present && dohwcksum) 13289 hck_flags = DB_CKSUMFLAGS(mp); 13290 13291 if ((hck_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) == 0) 13292 IP_STAT(ipst, ip_in_sw_cksum); 13293 13294 IP_CKSUM_RECV(hck_flags, u1, 13295 (uchar_t *)(rptr + DB_CKSUMSTART(mp)), 13296 (int32_t)((uchar_t *)up - rptr), 13297 mp, mp1, cksum_err); 13298 13299 if (cksum_err) { 13300 BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs); 13301 13302 if (hck_flags & HCK_FULLCKSUM) 13303 IP_STAT(ipst, ip_tcp_in_full_hw_cksum_err); 13304 else if (hck_flags & HCK_PARTIALCKSUM) 13305 IP_STAT(ipst, ip_tcp_in_part_hw_cksum_err); 13306 else 13307 IP_STAT(ipst, ip_tcp_in_sw_cksum_err); 13308 13309 goto error; 13310 } 13311 13312 try_again: 13313 13314 if ((connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_len, 13315 zoneid, ipst)) == NULL) { 13316 /* Send the TH_RST */ 13317 goto no_conn; 13318 } 13319 13320 /* 13321 * TCP FAST PATH for AF_INET socket. 13322 * 13323 * TCP fast path to avoid extra work. An AF_INET socket type 13324 * does not have facility to receive extra information via 13325 * ip_process or ip_add_info. Also, when the connection was 13326 * established, we made a check if this connection is impacted 13327 * by any global IPSec policy or per connection policy (a 13328 * policy that comes in effect later will not apply to this 13329 * connection). Since all this can be determined at the 13330 * connection establishment time, a quick check of flags 13331 * can avoid extra work. 13332 */ 13333 if (IPCL_IS_TCP4_CONNECTED_NO_POLICY(connp) && !mctl_present && 13334 !IPP_ENABLED(IPP_LOCAL_IN, ipst)) { 13335 ASSERT(first_mp == mp); 13336 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 13337 SET_SQUEUE(mp, tcp_rput_data, connp); 13338 return (mp); 13339 } 13340 13341 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 13342 if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) { 13343 if (IPCL_IS_TCP(connp)) { 13344 mp->b_datap->db_struioflag |= STRUIO_EAGER; 13345 DB_CKSUMSTART(mp) = 13346 (intptr_t)ip_squeue_get(ill_ring); 13347 if (IPCL_IS_FULLY_BOUND(connp) && !mctl_present && 13348 !CONN_INBOUND_POLICY_PRESENT(connp, ipss)) { 13349 BUMP_MIB(ill->ill_ip_mib, 13350 ipIfStatsHCInDelivers); 13351 SET_SQUEUE(mp, connp->conn_recv, connp); 13352 return (mp); 13353 } else if (IPCL_IS_BOUND(connp) && !mctl_present && 13354 !CONN_INBOUND_POLICY_PRESENT(connp, ipss)) { 13355 BUMP_MIB(ill->ill_ip_mib, 13356 ipIfStatsHCInDelivers); 13357 ip_squeue_enter_unbound++; 13358 SET_SQUEUE(mp, tcp_conn_request_unbound, 13359 connp); 13360 return (mp); 13361 } 13362 syn_present = B_TRUE; 13363 } 13364 13365 } 13366 13367 if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp) && !syn_present) { 13368 uint_t flags = (unsigned int)tcph->th_flags[0] & 0xFF; 13369 13370 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 13371 /* No need to send this packet to TCP */ 13372 if ((flags & TH_RST) || (flags & TH_URG)) { 13373 CONN_DEC_REF(connp); 13374 freemsg(first_mp); 13375 return (NULL); 13376 } 13377 if (flags & TH_ACK) { 13378 tcp_xmit_listeners_reset(first_mp, ip_hdr_len, zoneid, 13379 ipst->ips_netstack->netstack_tcp); 13380 CONN_DEC_REF(connp); 13381 return (NULL); 13382 } 13383 13384 CONN_DEC_REF(connp); 13385 freemsg(first_mp); 13386 return (NULL); 13387 } 13388 13389 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) || mctl_present) { 13390 first_mp = ipsec_check_inbound_policy(first_mp, connp, 13391 ipha, NULL, mctl_present); 13392 if (first_mp == NULL) { 13393 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13394 CONN_DEC_REF(connp); 13395 return (NULL); 13396 } 13397 if (IPCL_IS_TCP(connp) && IPCL_IS_BOUND(connp)) { 13398 ASSERT(syn_present); 13399 if (mctl_present) { 13400 ASSERT(first_mp != mp); 13401 first_mp->b_datap->db_struioflag |= 13402 STRUIO_POLICY; 13403 } else { 13404 ASSERT(first_mp == mp); 13405 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 13406 mp->b_datap->db_struioflag |= STRUIO_POLICY; 13407 } 13408 } else { 13409 /* 13410 * Discard first_mp early since we're dealing with a 13411 * fully-connected conn_t and tcp doesn't do policy in 13412 * this case. 13413 */ 13414 if (mctl_present) { 13415 freeb(first_mp); 13416 mctl_present = B_FALSE; 13417 } 13418 first_mp = mp; 13419 } 13420 } 13421 13422 /* Initiate IPPF processing for fastpath */ 13423 if (IPP_ENABLED(IPP_LOCAL_IN, ipst)) { 13424 uint32_t ill_index; 13425 13426 ill_index = recv_ill->ill_phyint->phyint_ifindex; 13427 ip_process(IPP_LOCAL_IN, &mp, ill_index); 13428 if (mp == NULL) { 13429 ip2dbg(("ip_input_ipsec_process: TCP pkt " 13430 "deferred/dropped during IPPF processing\n")); 13431 CONN_DEC_REF(connp); 13432 if (mctl_present) 13433 freeb(first_mp); 13434 return (NULL); 13435 } else if (mctl_present) { 13436 /* 13437 * ip_process might return a new mp. 13438 */ 13439 ASSERT(first_mp != mp); 13440 first_mp->b_cont = mp; 13441 } else { 13442 first_mp = mp; 13443 } 13444 13445 } 13446 13447 if (!syn_present && connp->conn_ip_recvpktinfo) { 13448 /* 13449 * TCP does not support IP_RECVPKTINFO for v4 so lets 13450 * make sure IPF_RECVIF is passed to ip_add_info. 13451 */ 13452 mp = ip_add_info(mp, recv_ill, flags|IPF_RECVIF, 13453 IPCL_ZONEID(connp), ipst); 13454 if (mp == NULL) { 13455 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13456 CONN_DEC_REF(connp); 13457 if (mctl_present) 13458 freeb(first_mp); 13459 return (NULL); 13460 } else if (mctl_present) { 13461 /* 13462 * ip_add_info might return a new mp. 13463 */ 13464 ASSERT(first_mp != mp); 13465 first_mp->b_cont = mp; 13466 } else { 13467 first_mp = mp; 13468 } 13469 } 13470 13471 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 13472 if (IPCL_IS_TCP(connp)) { 13473 SET_SQUEUE(first_mp, connp->conn_recv, connp); 13474 return (first_mp); 13475 } else { 13476 putnext(connp->conn_rq, first_mp); 13477 CONN_DEC_REF(connp); 13478 return (NULL); 13479 } 13480 13481 no_conn: 13482 /* Initiate IPPf processing, if needed. */ 13483 if (IPP_ENABLED(IPP_LOCAL_IN, ipst)) { 13484 uint32_t ill_index; 13485 ill_index = recv_ill->ill_phyint->phyint_ifindex; 13486 ip_process(IPP_LOCAL_IN, &first_mp, ill_index); 13487 if (first_mp == NULL) { 13488 return (NULL); 13489 } 13490 } 13491 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 13492 13493 tcp_xmit_listeners_reset(first_mp, IPH_HDR_LENGTH(mp->b_rptr), zoneid, 13494 ipst->ips_netstack->netstack_tcp); 13495 return (NULL); 13496 ipoptions: 13497 if (!ip_options_cksum(q, ill, first_mp, ipha, ire, ipst)) { 13498 goto slow_done; 13499 } 13500 13501 UPDATE_IB_PKT_COUNT(ire); 13502 ire->ire_last_used_time = lbolt; 13503 13504 u1 = ntohs(ipha->ipha_fragment_offset_and_flags); 13505 if (u1 & (IPH_MF | IPH_OFFSET)) { 13506 fragmented: 13507 if (!ip_rput_fragment(q, &mp, ipha, NULL, NULL)) { 13508 if (mctl_present) 13509 freeb(first_mp); 13510 goto slow_done; 13511 } 13512 /* 13513 * Make sure that first_mp points back to mp as 13514 * the mp we came in with could have changed in 13515 * ip_rput_fragment(). 13516 */ 13517 ASSERT(!mctl_present); 13518 ipha = (ipha_t *)mp->b_rptr; 13519 first_mp = mp; 13520 } 13521 13522 /* Now we have a complete datagram, destined for this machine. */ 13523 u1 = ip_hdr_len = IPH_HDR_LENGTH(ipha); 13524 13525 len = mp->b_wptr - mp->b_rptr; 13526 /* Pull up a minimal TCP header, if necessary. */ 13527 if (len < (u1 + 20)) { 13528 tcppullup: 13529 if (!pullupmsg(mp, u1 + 20)) { 13530 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13531 goto error; 13532 } 13533 ipha = (ipha_t *)mp->b_rptr; 13534 len = mp->b_wptr - mp->b_rptr; 13535 } 13536 13537 /* 13538 * Extract the offset field from the TCP header. As usual, we 13539 * try to help the compiler more than the reader. 13540 */ 13541 offset = ((uchar_t *)ipha)[u1 + 12] >> 4; 13542 if (offset != 5) { 13543 tcpoptions: 13544 if (offset < 5) { 13545 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13546 goto error; 13547 } 13548 /* 13549 * There must be TCP options. 13550 * Make sure we can grab them. 13551 */ 13552 offset <<= 2; 13553 offset += u1; 13554 if (len < offset) { 13555 if (!pullupmsg(mp, offset)) { 13556 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13557 goto error; 13558 } 13559 ipha = (ipha_t *)mp->b_rptr; 13560 len = mp->b_wptr - rptr; 13561 } 13562 } 13563 13564 /* Get the total packet length in len, including headers. */ 13565 if (mp->b_cont) { 13566 multipkttcp: 13567 len = msgdsize(mp); 13568 } 13569 13570 /* 13571 * Check the TCP checksum by pulling together the pseudo- 13572 * header checksum, and passing it to ip_csum to be added in 13573 * with the TCP datagram. 13574 * 13575 * Since we are not using the hwcksum if available we must 13576 * clear the flag. We may come here via tcppullup or tcpoptions. 13577 * If either of these fails along the way the mblk is freed. 13578 * If this logic ever changes and mblk is reused to say send 13579 * ICMP's back, then this flag may need to be cleared in 13580 * other places as well. 13581 */ 13582 DB_CKSUMFLAGS(mp) = 0; 13583 13584 up = (uint16_t *)(rptr + u1 + TCP_PORTS_OFFSET); 13585 13586 u1 = (uint32_t)(len - u1); /* TCP datagram length. */ 13587 #ifdef _BIG_ENDIAN 13588 u1 += IPPROTO_TCP; 13589 #else 13590 u1 = ((u1 >> 8) & 0xFF) + (((u1 & 0xFF) + IPPROTO_TCP) << 8); 13591 #endif 13592 u1 += iphs[6] + iphs[7] + iphs[8] + iphs[9]; 13593 /* 13594 * Not M_DATA mblk or its a dup, so do the checksum now. 13595 */ 13596 IP_STAT(ipst, ip_in_sw_cksum); 13597 if (IP_CSUM(mp, (int32_t)((uchar_t *)up - rptr), u1) != 0) { 13598 BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs); 13599 goto error; 13600 } 13601 13602 IP_STAT(ipst, ip_tcp_slow_path); 13603 goto try_again; 13604 #undef iphs 13605 #undef rptr 13606 13607 error: 13608 freemsg(first_mp); 13609 slow_done: 13610 return (NULL); 13611 } 13612 13613 /* ARGSUSED */ 13614 static void 13615 ip_sctp_input(mblk_t *mp, ipha_t *ipha, ill_t *recv_ill, boolean_t mctl_present, 13616 ire_t *ire, mblk_t *first_mp, uint_t flags, queue_t *q, ipaddr_t dst) 13617 { 13618 conn_t *connp; 13619 uint32_t sum; 13620 uint32_t u1; 13621 ssize_t len; 13622 sctp_hdr_t *sctph; 13623 zoneid_t zoneid = ire->ire_zoneid; 13624 uint32_t pktsum; 13625 uint32_t calcsum; 13626 uint32_t ports; 13627 uint_t ipif_seqid; 13628 in6_addr_t map_src, map_dst; 13629 ill_t *ill = (ill_t *)q->q_ptr; 13630 ip_stack_t *ipst; 13631 sctp_stack_t *sctps; 13632 13633 ASSERT(recv_ill != NULL); 13634 ipst = recv_ill->ill_ipst; 13635 sctps = ipst->ips_netstack->netstack_sctp; 13636 13637 #define rptr ((uchar_t *)ipha) 13638 13639 ASSERT(ipha->ipha_protocol == IPPROTO_SCTP); 13640 ASSERT(ill != NULL); 13641 13642 /* u1 is # words of IP options */ 13643 u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4) 13644 + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 13645 13646 /* IP options present */ 13647 if (u1 > 0) { 13648 goto ipoptions; 13649 } else { 13650 /* Check the IP header checksum. */ 13651 if (!IS_IP_HDR_HWCKSUM(mctl_present, mp, ill)) { 13652 #define uph ((uint16_t *)ipha) 13653 sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + 13654 uph[5] + uph[6] + uph[7] + uph[8] + uph[9]; 13655 #undef uph 13656 /* finish doing IP checksum */ 13657 sum = (sum & 0xFFFF) + (sum >> 16); 13658 sum = ~(sum + (sum >> 16)) & 0xFFFF; 13659 /* 13660 * Don't verify header checksum if this packet 13661 * is coming back from AH/ESP as we already did it. 13662 */ 13663 if (!mctl_present && (sum != 0) && sum != 0xFFFF) { 13664 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs); 13665 goto error; 13666 } 13667 } 13668 /* 13669 * Since there is no SCTP h/w cksum support yet, just 13670 * clear the flag. 13671 */ 13672 DB_CKSUMFLAGS(mp) = 0; 13673 } 13674 13675 /* 13676 * Don't verify header checksum if this packet is coming 13677 * back from AH/ESP as we already did it. 13678 */ 13679 if (!mctl_present) { 13680 UPDATE_IB_PKT_COUNT(ire); 13681 ire->ire_last_used_time = lbolt; 13682 } 13683 13684 /* packet part of fragmented IP packet? */ 13685 u1 = ntohs(ipha->ipha_fragment_offset_and_flags); 13686 if (u1 & (IPH_MF | IPH_OFFSET)) 13687 goto fragmented; 13688 13689 /* u1 = IP header length (20 bytes) */ 13690 u1 = IP_SIMPLE_HDR_LENGTH; 13691 13692 find_sctp_client: 13693 /* Pullup if we don't have the sctp common header. */ 13694 len = MBLKL(mp); 13695 if (len < (u1 + SCTP_COMMON_HDR_LENGTH)) { 13696 if (mp->b_cont == NULL || 13697 !pullupmsg(mp, u1 + SCTP_COMMON_HDR_LENGTH)) { 13698 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13699 goto error; 13700 } 13701 ipha = (ipha_t *)mp->b_rptr; 13702 len = MBLKL(mp); 13703 } 13704 13705 sctph = (sctp_hdr_t *)(rptr + u1); 13706 #ifdef DEBUG 13707 if (!skip_sctp_cksum) { 13708 #endif 13709 pktsum = sctph->sh_chksum; 13710 sctph->sh_chksum = 0; 13711 calcsum = sctp_cksum(mp, u1); 13712 if (calcsum != pktsum) { 13713 BUMP_MIB(&sctps->sctps_mib, sctpChecksumError); 13714 goto error; 13715 } 13716 sctph->sh_chksum = pktsum; 13717 #ifdef DEBUG /* skip_sctp_cksum */ 13718 } 13719 #endif 13720 /* get the ports */ 13721 ports = *(uint32_t *)&sctph->sh_sport; 13722 13723 ipif_seqid = ire->ire_ipif->ipif_seqid; 13724 IRE_REFRELE(ire); 13725 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_dst); 13726 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_src); 13727 if ((connp = sctp_fanout(&map_src, &map_dst, ports, ipif_seqid, zoneid, 13728 mp, sctps)) == NULL) { 13729 /* Check for raw socket or OOTB handling */ 13730 goto no_conn; 13731 } 13732 13733 /* Found a client; up it goes */ 13734 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers); 13735 sctp_input(connp, ipha, mp, first_mp, recv_ill, B_TRUE, mctl_present); 13736 return; 13737 13738 no_conn: 13739 ip_fanout_sctp_raw(first_mp, recv_ill, ipha, B_TRUE, 13740 ports, mctl_present, flags, B_TRUE, ipif_seqid, zoneid); 13741 return; 13742 13743 ipoptions: 13744 DB_CKSUMFLAGS(mp) = 0; 13745 if (!ip_options_cksum(q, ill, first_mp, ipha, ire, ipst)) 13746 goto slow_done; 13747 13748 UPDATE_IB_PKT_COUNT(ire); 13749 ire->ire_last_used_time = lbolt; 13750 13751 u1 = ntohs(ipha->ipha_fragment_offset_and_flags); 13752 if (u1 & (IPH_MF | IPH_OFFSET)) { 13753 fragmented: 13754 if (!ip_rput_fragment(q, &mp, ipha, NULL, NULL)) 13755 goto slow_done; 13756 /* 13757 * Make sure that first_mp points back to mp as 13758 * the mp we came in with could have changed in 13759 * ip_rput_fragment(). 13760 */ 13761 ASSERT(!mctl_present); 13762 ipha = (ipha_t *)mp->b_rptr; 13763 first_mp = mp; 13764 } 13765 13766 /* Now we have a complete datagram, destined for this machine. */ 13767 u1 = IPH_HDR_LENGTH(ipha); 13768 goto find_sctp_client; 13769 #undef iphs 13770 #undef rptr 13771 13772 error: 13773 freemsg(first_mp); 13774 slow_done: 13775 IRE_REFRELE(ire); 13776 } 13777 13778 #define VER_BITS 0xF0 13779 #define VERSION_6 0x60 13780 13781 static boolean_t 13782 ip_rput_multimblk_ipoptions(queue_t *q, ill_t *ill, mblk_t *mp, ipha_t **iphapp, 13783 ipaddr_t *dstp, ip_stack_t *ipst) 13784 { 13785 uint_t opt_len; 13786 ipha_t *ipha; 13787 ssize_t len; 13788 uint_t pkt_len; 13789 13790 ASSERT(ill != NULL); 13791 IP_STAT(ipst, ip_ipoptions); 13792 ipha = *iphapp; 13793 13794 #define rptr ((uchar_t *)ipha) 13795 /* Assume no IPv6 packets arrive over the IPv4 queue */ 13796 if (IPH_HDR_VERSION(ipha) == IPV6_VERSION) { 13797 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInWrongIPVersion); 13798 freemsg(mp); 13799 return (B_FALSE); 13800 } 13801 13802 /* multiple mblk or too short */ 13803 pkt_len = ntohs(ipha->ipha_length); 13804 13805 /* Get the number of words of IP options in the IP header. */ 13806 opt_len = ipha->ipha_version_and_hdr_length - IP_SIMPLE_HDR_VERSION; 13807 if (opt_len) { 13808 /* IP Options present! Validate and process. */ 13809 if (opt_len > (15 - IP_SIMPLE_HDR_LENGTH_IN_WORDS)) { 13810 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 13811 goto done; 13812 } 13813 /* 13814 * Recompute complete header length and make sure we 13815 * have access to all of it. 13816 */ 13817 len = ((size_t)opt_len + IP_SIMPLE_HDR_LENGTH_IN_WORDS) << 2; 13818 if (len > (mp->b_wptr - rptr)) { 13819 if (len > pkt_len) { 13820 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 13821 goto done; 13822 } 13823 if (!pullupmsg(mp, len)) { 13824 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13825 goto done; 13826 } 13827 ipha = (ipha_t *)mp->b_rptr; 13828 } 13829 /* 13830 * Go off to ip_rput_options which returns the next hop 13831 * destination address, which may have been affected 13832 * by source routing. 13833 */ 13834 IP_STAT(ipst, ip_opt); 13835 if (ip_rput_options(q, mp, ipha, dstp, ipst) == -1) { 13836 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13837 return (B_FALSE); 13838 } 13839 } 13840 *iphapp = ipha; 13841 return (B_TRUE); 13842 done: 13843 /* clear b_prev - used by ip_mroute_decap */ 13844 mp->b_prev = NULL; 13845 freemsg(mp); 13846 return (B_FALSE); 13847 #undef rptr 13848 } 13849 13850 /* 13851 * Deal with the fact that there is no ire for the destination. 13852 * The incoming ill (in_ill) is passed in to ip_newroute only 13853 * in the case of packets coming from mobile ip forward tunnel. 13854 * It must be null otherwise. 13855 */ 13856 static ire_t * 13857 ip_rput_noire(queue_t *q, ill_t *in_ill, mblk_t *mp, int ll_multicast, 13858 ipaddr_t dst) 13859 { 13860 ipha_t *ipha; 13861 ill_t *ill; 13862 ire_t *ire; 13863 boolean_t check_multirt = B_FALSE; 13864 ip_stack_t *ipst; 13865 13866 ipha = (ipha_t *)mp->b_rptr; 13867 ill = (ill_t *)q->q_ptr; 13868 13869 ASSERT(ill != NULL); 13870 ipst = ill->ill_ipst; 13871 13872 /* 13873 * No IRE for this destination, so it can't be for us. 13874 * Unless we are forwarding, drop the packet. 13875 * We have to let source routed packets through 13876 * since we don't yet know if they are 'ping -l' 13877 * packets i.e. if they will go out over the 13878 * same interface as they came in on. 13879 */ 13880 if (ll_multicast) { 13881 freemsg(mp); 13882 return (NULL); 13883 } 13884 if (!(ill->ill_flags & ILLF_ROUTER) && !ip_source_routed(ipha, ipst)) { 13885 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits); 13886 freemsg(mp); 13887 return (NULL); 13888 } 13889 13890 /* 13891 * Mark this packet as having originated externally. 13892 * 13893 * For non-forwarding code path, ire_send later double 13894 * checks this interface to see if it is still exists 13895 * post-ARP resolution. 13896 * 13897 * Also, IPQOS uses this to differentiate between 13898 * IPP_FWD_OUT and IPP_LOCAL_OUT for post-ARP 13899 * QOS packet processing in ip_wput_attach_llhdr(). 13900 * The QoS module can mark the b_band for a fastpath message 13901 * or the dl_priority field in a unitdata_req header for 13902 * CoS marking. This info can only be found in 13903 * ip_wput_attach_llhdr(). 13904 */ 13905 mp->b_prev = (mblk_t *)(uintptr_t)ill->ill_phyint->phyint_ifindex; 13906 /* 13907 * Clear the indication that this may have a hardware checksum 13908 * as we are not using it 13909 */ 13910 DB_CKSUMFLAGS(mp) = 0; 13911 13912 if (in_ill != NULL) { 13913 /* 13914 * Now hand the packet to ip_newroute. 13915 */ 13916 ip_newroute(q, mp, dst, in_ill, NULL, GLOBAL_ZONEID, ipst); 13917 return (NULL); 13918 } 13919 ire = ire_forward(dst, &check_multirt, NULL, NULL, 13920 MBLK_GETLABEL(mp), ipst); 13921 13922 if (ire == NULL && check_multirt) { 13923 /* Let ip_newroute handle CGTP */ 13924 ip_newroute(q, mp, dst, in_ill, NULL, GLOBAL_ZONEID, ipst); 13925 return (NULL); 13926 } 13927 13928 if (ire != NULL) 13929 return (ire); 13930 13931 mp->b_prev = mp->b_next = 0; 13932 /* send icmp unreachable */ 13933 q = WR(q); 13934 /* Sent by forwarding path, and router is global zone */ 13935 if (ip_source_routed(ipha, ipst)) { 13936 icmp_unreachable(q, mp, ICMP_SOURCE_ROUTE_FAILED, 13937 GLOBAL_ZONEID, ipst); 13938 } else { 13939 icmp_unreachable(q, mp, ICMP_HOST_UNREACHABLE, GLOBAL_ZONEID, 13940 ipst); 13941 } 13942 13943 return (NULL); 13944 13945 } 13946 13947 /* 13948 * check ip header length and align it. 13949 */ 13950 static boolean_t 13951 ip_check_and_align_header(queue_t *q, mblk_t *mp, ip_stack_t *ipst) 13952 { 13953 ssize_t len; 13954 ill_t *ill; 13955 ipha_t *ipha; 13956 13957 len = MBLKL(mp); 13958 13959 if (!OK_32PTR(mp->b_rptr) || len < IP_SIMPLE_HDR_LENGTH) { 13960 ill = (ill_t *)q->q_ptr; 13961 13962 if (!OK_32PTR(mp->b_rptr)) 13963 IP_STAT(ipst, ip_notaligned1); 13964 else 13965 IP_STAT(ipst, ip_notaligned2); 13966 /* Guard against bogus device drivers */ 13967 if (len < 0) { 13968 /* clear b_prev - used by ip_mroute_decap */ 13969 mp->b_prev = NULL; 13970 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors); 13971 freemsg(mp); 13972 return (B_FALSE); 13973 } 13974 13975 if (ip_rput_pullups++ == 0) { 13976 ipha = (ipha_t *)mp->b_rptr; 13977 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 13978 "ip_check_and_align_header: %s forced us to " 13979 " pullup pkt, hdr len %ld, hdr addr %p", 13980 ill->ill_name, len, ipha); 13981 } 13982 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 13983 /* clear b_prev - used by ip_mroute_decap */ 13984 mp->b_prev = NULL; 13985 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 13986 freemsg(mp); 13987 return (B_FALSE); 13988 } 13989 } 13990 return (B_TRUE); 13991 } 13992 13993 static boolean_t 13994 ip_rput_notforus(queue_t **qp, mblk_t *mp, ire_t *ire, ill_t *ill) 13995 { 13996 ill_group_t *ill_group; 13997 ill_group_t *ire_group; 13998 queue_t *q; 13999 ill_t *ire_ill; 14000 uint_t ill_ifindex; 14001 ip_stack_t *ipst = ill->ill_ipst; 14002 14003 q = *qp; 14004 /* 14005 * We need to check to make sure the packet came in 14006 * on the queue associated with the destination IRE. 14007 * Note that for multicast packets and broadcast packets sent to 14008 * a broadcast address which is shared between multiple interfaces 14009 * we should not do this since we just got a random broadcast ire. 14010 */ 14011 if (ire->ire_rfq && ire->ire_type != IRE_BROADCAST) { 14012 boolean_t check_multi = B_TRUE; 14013 14014 /* 14015 * This packet came in on an interface other than the 14016 * one associated with the destination address. 14017 * "Gateway" it to the appropriate interface here. 14018 * As long as the ills belong to the same group, 14019 * we don't consider them to arriving on the wrong 14020 * interface. Thus, when the switch is doing inbound 14021 * load spreading, we won't drop packets when we 14022 * are doing strict multihoming checks. Note, the 14023 * same holds true for 'usesrc groups' where the 14024 * destination address may belong to another interface 14025 * to allow multipathing to happen 14026 */ 14027 ill_group = ill->ill_group; 14028 ire_ill = (ill_t *)(ire->ire_rfq)->q_ptr; 14029 ill_ifindex = ill->ill_usesrc_ifindex; 14030 ire_group = ire_ill->ill_group; 14031 14032 /* 14033 * If it's part of the same IPMP group, or if it's a legal 14034 * address on the 'usesrc' interface, then bypass strict 14035 * checks. 14036 */ 14037 if (ill_group != NULL && ill_group == ire_group) { 14038 check_multi = B_FALSE; 14039 } else if (ill_ifindex != 0 && 14040 ill_ifindex == ire_ill->ill_phyint->phyint_ifindex) { 14041 check_multi = B_FALSE; 14042 } 14043 14044 if (check_multi && 14045 ipst->ips_ip_strict_dst_multihoming && 14046 ((ill->ill_flags & 14047 ire->ire_ipif->ipif_ill->ill_flags & 14048 ILLF_ROUTER) == 0)) { 14049 /* Drop packet */ 14050 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits); 14051 freemsg(mp); 14052 return (B_TRUE); 14053 } 14054 14055 /* 14056 * Change the queue (for non-virtual destination network 14057 * interfaces) and ip_rput_local will be called with the right 14058 * queue 14059 */ 14060 q = ire->ire_rfq; 14061 } 14062 /* Must be broadcast. We'll take it. */ 14063 *qp = q; 14064 return (B_FALSE); 14065 } 14066 14067 ire_t * 14068 ip_fast_forward(ire_t *ire, ipaddr_t dst, ill_t *ill, mblk_t *mp) 14069 { 14070 ipha_t *ipha; 14071 ipaddr_t ip_dst, ip_src; 14072 ire_t *src_ire = NULL; 14073 ill_t *stq_ill; 14074 uint_t hlen; 14075 uint_t pkt_len; 14076 uint32_t sum; 14077 queue_t *dev_q; 14078 boolean_t check_multirt = B_FALSE; 14079 ip_stack_t *ipst = ill->ill_ipst; 14080 14081 ipha = (ipha_t *)mp->b_rptr; 14082 14083 /* 14084 * Martian Address Filtering [RFC 1812, Section 5.3.7] 14085 * The loopback address check for both src and dst has already 14086 * been checked in ip_input 14087 */ 14088 ip_dst = ntohl(dst); 14089 ip_src = ntohl(ipha->ipha_src); 14090 14091 if (ip_dst == INADDR_ANY || IN_BADCLASS(ip_dst) || 14092 IN_CLASSD(ip_src)) { 14093 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits); 14094 goto drop; 14095 } 14096 src_ire = ire_ctable_lookup(ipha->ipha_src, 0, IRE_BROADCAST, NULL, 14097 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 14098 14099 if (src_ire != NULL) { 14100 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits); 14101 goto drop; 14102 } 14103 14104 14105 /* No ire cache of nexthop. So first create one */ 14106 if (ire == NULL) { 14107 ire = ire_forward(dst, &check_multirt, NULL, NULL, NULL, ipst); 14108 /* 14109 * We only come to ip_fast_forward if ip_cgtp_filter is 14110 * is not set. So upon return from ire_forward 14111 * check_multirt should remain as false. 14112 */ 14113 ASSERT(!check_multirt); 14114 if (ire == NULL) { 14115 /* An attempt was made to forward the packet */ 14116 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams); 14117 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14118 mp->b_prev = mp->b_next = 0; 14119 /* send icmp unreachable */ 14120 /* Sent by forwarding path, and router is global zone */ 14121 if (ip_source_routed(ipha, ipst)) { 14122 icmp_unreachable(ill->ill_wq, mp, 14123 ICMP_SOURCE_ROUTE_FAILED, GLOBAL_ZONEID, 14124 ipst); 14125 } else { 14126 icmp_unreachable(ill->ill_wq, mp, 14127 ICMP_HOST_UNREACHABLE, GLOBAL_ZONEID, 14128 ipst); 14129 } 14130 return (ire); 14131 } 14132 } 14133 14134 /* 14135 * Forwarding fastpath exception case: 14136 * If either of the follwoing case is true, we take 14137 * the slowpath 14138 * o forwarding is not enabled 14139 * o incoming and outgoing interface are the same, or the same 14140 * IPMP group 14141 * o corresponding ire is in incomplete state 14142 * o packet needs fragmentation 14143 * 14144 * The codeflow from here on is thus: 14145 * ip_rput_process_forward->ip_rput_forward->ip_xmit_v4 14146 */ 14147 pkt_len = ntohs(ipha->ipha_length); 14148 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 14149 if (!(stq_ill->ill_flags & ILLF_ROUTER) || 14150 !(ill->ill_flags & ILLF_ROUTER) || 14151 (ill == stq_ill) || 14152 (ill->ill_group != NULL && ill->ill_group == stq_ill->ill_group) || 14153 (ire->ire_nce == NULL) || 14154 (ire->ire_nce->nce_state != ND_REACHABLE) || 14155 (pkt_len > ire->ire_max_frag) || 14156 ipha->ipha_ttl <= 1) { 14157 ip_rput_process_forward(ill->ill_rq, mp, ire, 14158 ipha, ill, B_FALSE); 14159 return (ire); 14160 } 14161 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams); 14162 14163 DTRACE_PROBE4(ip4__forwarding__start, 14164 ill_t *, ill, ill_t *, stq_ill, ipha_t *, ipha, mblk_t *, mp); 14165 14166 FW_HOOKS(ipst->ips_ip4_forwarding_event, 14167 ipst->ips_ipv4firewall_forwarding, 14168 ill, stq_ill, ipha, mp, mp, ipst); 14169 14170 DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp); 14171 14172 if (mp == NULL) 14173 goto drop; 14174 14175 mp->b_datap->db_struioun.cksum.flags = 0; 14176 /* Adjust the checksum to reflect the ttl decrement. */ 14177 sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST; 14178 ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16)); 14179 ipha->ipha_ttl--; 14180 14181 dev_q = ire->ire_stq->q_next; 14182 if ((dev_q->q_next != NULL || 14183 dev_q->q_first != NULL) && !canput(dev_q)) { 14184 goto indiscard; 14185 } 14186 14187 hlen = ire->ire_nce->nce_fp_mp != NULL ? 14188 MBLKL(ire->ire_nce->nce_fp_mp) : 0; 14189 14190 if (hlen != 0 || ire->ire_nce->nce_res_mp != NULL) { 14191 mblk_t *mpip = mp; 14192 14193 mp = ip_wput_attach_llhdr(mpip, ire, 0, 0); 14194 if (mp != NULL) { 14195 DTRACE_PROBE4(ip4__physical__out__start, 14196 ill_t *, NULL, ill_t *, stq_ill, 14197 ipha_t *, ipha, mblk_t *, mp); 14198 FW_HOOKS(ipst->ips_ip4_physical_out_event, 14199 ipst->ips_ipv4firewall_physical_out, 14200 NULL, stq_ill, ipha, mp, mpip, ipst); 14201 DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, 14202 mp); 14203 if (mp == NULL) 14204 goto drop; 14205 14206 UPDATE_IB_PKT_COUNT(ire); 14207 ire->ire_last_used_time = lbolt; 14208 BUMP_MIB(stq_ill->ill_ip_mib, 14209 ipIfStatsHCOutForwDatagrams); 14210 BUMP_MIB(stq_ill->ill_ip_mib, ipIfStatsHCOutTransmits); 14211 UPDATE_MIB(stq_ill->ill_ip_mib, ipIfStatsHCOutOctets, 14212 pkt_len); 14213 putnext(ire->ire_stq, mp); 14214 return (ire); 14215 } 14216 } 14217 14218 indiscard: 14219 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14220 drop: 14221 if (mp != NULL) 14222 freemsg(mp); 14223 if (src_ire != NULL) 14224 ire_refrele(src_ire); 14225 return (ire); 14226 14227 } 14228 14229 /* 14230 * This function is called in the forwarding slowpath, when 14231 * either the ire lacks the link-layer address, or the packet needs 14232 * further processing(eg. fragmentation), before transmission. 14233 */ 14234 14235 static void 14236 ip_rput_process_forward(queue_t *q, mblk_t *mp, ire_t *ire, ipha_t *ipha, 14237 ill_t *ill, boolean_t ll_multicast) 14238 { 14239 ill_group_t *ill_group; 14240 ill_group_t *ire_group; 14241 queue_t *dev_q; 14242 ire_t *src_ire; 14243 ip_stack_t *ipst = ill->ill_ipst; 14244 14245 ASSERT(ire->ire_stq != NULL); 14246 14247 mp->b_prev = NULL; /* ip_rput_noire sets incoming interface here */ 14248 mp->b_next = NULL; /* ip_rput_noire sets dst here */ 14249 14250 if (ll_multicast != 0) { 14251 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14252 goto drop_pkt; 14253 } 14254 14255 /* 14256 * check if ipha_src is a broadcast address. Note that this 14257 * check is redundant when we get here from ip_fast_forward() 14258 * which has already done this check. However, since we can 14259 * also get here from ip_rput_process_broadcast() or, for 14260 * for the slow path through ip_fast_forward(), we perform 14261 * the check again for code-reusability 14262 */ 14263 src_ire = ire_ctable_lookup(ipha->ipha_src, 0, IRE_BROADCAST, NULL, 14264 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 14265 if (src_ire != NULL || ntohl(ipha->ipha_dst) == INADDR_ANY || 14266 IN_BADCLASS(ntohl(ipha->ipha_dst))) { 14267 if (src_ire != NULL) 14268 ire_refrele(src_ire); 14269 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits); 14270 ip2dbg(("ip_rput_process_forward: Received packet with" 14271 " bad src/dst address on %s\n", ill->ill_name)); 14272 goto drop_pkt; 14273 } 14274 14275 ill_group = ill->ill_group; 14276 ire_group = ((ill_t *)(ire->ire_rfq)->q_ptr)->ill_group; 14277 /* 14278 * Check if we want to forward this one at this time. 14279 * We allow source routed packets on a host provided that 14280 * they go out the same interface or same interface group 14281 * as they came in on. 14282 * 14283 * XXX To be quicker, we may wish to not chase pointers to 14284 * get the ILLF_ROUTER flag and instead store the 14285 * forwarding policy in the ire. An unfortunate 14286 * side-effect of that would be requiring an ire flush 14287 * whenever the ILLF_ROUTER flag changes. 14288 */ 14289 if (((ill->ill_flags & 14290 ((ill_t *)ire->ire_stq->q_ptr)->ill_flags & 14291 ILLF_ROUTER) == 0) && 14292 !(ip_source_routed(ipha, ipst) && (ire->ire_rfq == q || 14293 (ill_group != NULL && ill_group == ire_group)))) { 14294 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits); 14295 if (ip_source_routed(ipha, ipst)) { 14296 q = WR(q); 14297 /* 14298 * Clear the indication that this may have 14299 * hardware checksum as we are not using it. 14300 */ 14301 DB_CKSUMFLAGS(mp) = 0; 14302 /* Sent by forwarding path, and router is global zone */ 14303 icmp_unreachable(q, mp, 14304 ICMP_SOURCE_ROUTE_FAILED, GLOBAL_ZONEID, ipst); 14305 return; 14306 } 14307 goto drop_pkt; 14308 } 14309 14310 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams); 14311 14312 /* Packet is being forwarded. Turning off hwcksum flag. */ 14313 DB_CKSUMFLAGS(mp) = 0; 14314 if (ipst->ips_ip_g_send_redirects) { 14315 /* 14316 * Check whether the incoming interface and outgoing 14317 * interface is part of the same group. If so, 14318 * send redirects. 14319 * 14320 * Check the source address to see if it originated 14321 * on the same logical subnet it is going back out on. 14322 * If so, we should be able to send it a redirect. 14323 * Avoid sending a redirect if the destination 14324 * is directly connected (i.e., ipha_dst is the same 14325 * as ire_gateway_addr or the ire_addr of the 14326 * nexthop IRE_CACHE ), or if the packet was source 14327 * routed out this interface. 14328 */ 14329 ipaddr_t src, nhop; 14330 mblk_t *mp1; 14331 ire_t *nhop_ire = NULL; 14332 14333 /* 14334 * Check whether ire_rfq and q are from the same ill 14335 * or if they are not same, they at least belong 14336 * to the same group. If so, send redirects. 14337 */ 14338 if ((ire->ire_rfq == q || 14339 (ill_group != NULL && ill_group == ire_group)) && 14340 !ip_source_routed(ipha, ipst)) { 14341 14342 nhop = (ire->ire_gateway_addr != 0 ? 14343 ire->ire_gateway_addr : ire->ire_addr); 14344 14345 if (ipha->ipha_dst == nhop) { 14346 /* 14347 * We avoid sending a redirect if the 14348 * destination is directly connected 14349 * because it is possible that multiple 14350 * IP subnets may have been configured on 14351 * the link, and the source may not 14352 * be on the same subnet as ip destination, 14353 * even though they are on the same 14354 * physical link. 14355 */ 14356 goto sendit; 14357 } 14358 14359 src = ipha->ipha_src; 14360 14361 /* 14362 * We look up the interface ire for the nexthop, 14363 * to see if ipha_src is in the same subnet 14364 * as the nexthop. 14365 * 14366 * Note that, if, in the future, IRE_CACHE entries 14367 * are obsoleted, this lookup will not be needed, 14368 * as the ire passed to this function will be the 14369 * same as the nhop_ire computed below. 14370 */ 14371 nhop_ire = ire_ftable_lookup(nhop, 0, 0, 14372 IRE_INTERFACE, NULL, NULL, ALL_ZONES, 14373 0, NULL, MATCH_IRE_TYPE, ipst); 14374 14375 if (nhop_ire != NULL) { 14376 if ((src & nhop_ire->ire_mask) == 14377 (nhop & nhop_ire->ire_mask)) { 14378 /* 14379 * The source is directly connected. 14380 * Just copy the ip header (which is 14381 * in the first mblk) 14382 */ 14383 mp1 = copyb(mp); 14384 if (mp1 != NULL) { 14385 icmp_send_redirect(WR(q), mp1, 14386 nhop, ipst); 14387 } 14388 } 14389 ire_refrele(nhop_ire); 14390 } 14391 } 14392 } 14393 sendit: 14394 dev_q = ire->ire_stq->q_next; 14395 if ((dev_q->q_next || dev_q->q_first) && !canput(dev_q)) { 14396 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14397 freemsg(mp); 14398 return; 14399 } 14400 14401 ip_rput_forward(ire, ipha, mp, ill); 14402 return; 14403 14404 drop_pkt: 14405 ip2dbg(("ip_rput_process_forward: drop pkt\n")); 14406 freemsg(mp); 14407 } 14408 14409 ire_t * 14410 ip_rput_process_broadcast(queue_t **qp, mblk_t *mp, ire_t *ire, ipha_t *ipha, 14411 ill_t *ill, ipaddr_t dst, int cgtp_flt_pkt, int ll_multicast) 14412 { 14413 queue_t *q; 14414 uint16_t hcksumflags; 14415 ip_stack_t *ipst = ill->ill_ipst; 14416 14417 q = *qp; 14418 14419 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInBcastPkts); 14420 14421 /* 14422 * Clear the indication that this may have hardware 14423 * checksum as we are not using it for forwarding. 14424 */ 14425 hcksumflags = DB_CKSUMFLAGS(mp); 14426 DB_CKSUMFLAGS(mp) = 0; 14427 14428 /* 14429 * Directed broadcast forwarding: if the packet came in over a 14430 * different interface then it is routed out over we can forward it. 14431 */ 14432 if (ipha->ipha_protocol == IPPROTO_TCP) { 14433 ire_refrele(ire); 14434 freemsg(mp); 14435 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14436 return (NULL); 14437 } 14438 /* 14439 * For multicast we have set dst to be INADDR_BROADCAST 14440 * for delivering to all STREAMS. IRE_MARK_NORECV is really 14441 * only for broadcast packets. 14442 */ 14443 if (!CLASSD(ipha->ipha_dst)) { 14444 ire_t *new_ire; 14445 ipif_t *ipif; 14446 /* 14447 * For ill groups, as the switch duplicates broadcasts 14448 * across all the ports, we need to filter out and 14449 * send up only one copy. There is one copy for every 14450 * broadcast address on each ill. Thus, we look for a 14451 * specific IRE on this ill and look at IRE_MARK_NORECV 14452 * later to see whether this ill is eligible to receive 14453 * them or not. ill_nominate_bcast_rcv() nominates only 14454 * one set of IREs for receiving. 14455 */ 14456 14457 ipif = ipif_get_next_ipif(NULL, ill); 14458 if (ipif == NULL) { 14459 ire_refrele(ire); 14460 freemsg(mp); 14461 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14462 return (NULL); 14463 } 14464 new_ire = ire_ctable_lookup(dst, 0, 0, 14465 ipif, ALL_ZONES, NULL, MATCH_IRE_ILL, ipst); 14466 ipif_refrele(ipif); 14467 14468 if (new_ire != NULL) { 14469 if (new_ire->ire_marks & IRE_MARK_NORECV) { 14470 ire_refrele(ire); 14471 ire_refrele(new_ire); 14472 freemsg(mp); 14473 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14474 return (NULL); 14475 } 14476 /* 14477 * In the special case of multirouted broadcast 14478 * packets, we unconditionally need to "gateway" 14479 * them to the appropriate interface here. 14480 * In the normal case, this cannot happen, because 14481 * there is no broadcast IRE tagged with the 14482 * RTF_MULTIRT flag. 14483 */ 14484 if (new_ire->ire_flags & RTF_MULTIRT) { 14485 ire_refrele(new_ire); 14486 if (ire->ire_rfq != NULL) { 14487 q = ire->ire_rfq; 14488 *qp = q; 14489 } 14490 } else { 14491 ire_refrele(ire); 14492 ire = new_ire; 14493 } 14494 } else if (cgtp_flt_pkt == CGTP_IP_PKT_NOT_CGTP) { 14495 if (!ipst->ips_ip_g_forward_directed_bcast) { 14496 /* 14497 * Free the message if 14498 * ip_g_forward_directed_bcast is turned 14499 * off for non-local broadcast. 14500 */ 14501 ire_refrele(ire); 14502 freemsg(mp); 14503 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14504 return (NULL); 14505 } 14506 } else { 14507 /* 14508 * This CGTP packet successfully passed the 14509 * CGTP filter, but the related CGTP 14510 * broadcast IRE has not been found, 14511 * meaning that the redundant ipif is 14512 * probably down. However, if we discarded 14513 * this packet, its duplicate would be 14514 * filtered out by the CGTP filter so none 14515 * of them would get through. So we keep 14516 * going with this one. 14517 */ 14518 ASSERT(cgtp_flt_pkt == CGTP_IP_PKT_PREMIUM); 14519 if (ire->ire_rfq != NULL) { 14520 q = ire->ire_rfq; 14521 *qp = q; 14522 } 14523 } 14524 } 14525 if (ipst->ips_ip_g_forward_directed_bcast && ll_multicast == 0) { 14526 /* 14527 * Verify that there are not more then one 14528 * IRE_BROADCAST with this broadcast address which 14529 * has ire_stq set. 14530 * TODO: simplify, loop over all IRE's 14531 */ 14532 ire_t *ire1; 14533 int num_stq = 0; 14534 mblk_t *mp1; 14535 14536 /* Find the first one with ire_stq set */ 14537 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 14538 for (ire1 = ire; ire1 && 14539 !ire1->ire_stq && ire1->ire_addr == ire->ire_addr; 14540 ire1 = ire1->ire_next) 14541 ; 14542 if (ire1) { 14543 ire_refrele(ire); 14544 ire = ire1; 14545 IRE_REFHOLD(ire); 14546 } 14547 14548 /* Check if there are additional ones with stq set */ 14549 for (ire1 = ire; ire1; ire1 = ire1->ire_next) { 14550 if (ire->ire_addr != ire1->ire_addr) 14551 break; 14552 if (ire1->ire_stq) { 14553 num_stq++; 14554 break; 14555 } 14556 } 14557 rw_exit(&ire->ire_bucket->irb_lock); 14558 if (num_stq == 1 && ire->ire_stq != NULL) { 14559 ip1dbg(("ip_rput_process_broadcast: directed " 14560 "broadcast to 0x%x\n", 14561 ntohl(ire->ire_addr))); 14562 mp1 = copymsg(mp); 14563 if (mp1) { 14564 switch (ipha->ipha_protocol) { 14565 case IPPROTO_UDP: 14566 ip_udp_input(q, mp1, ipha, ire, ill); 14567 break; 14568 default: 14569 ip_proto_input(q, mp1, ipha, ire, ill); 14570 break; 14571 } 14572 } 14573 /* 14574 * Adjust ttl to 2 (1+1 - the forward engine 14575 * will decrement it by one. 14576 */ 14577 if (ip_csum_hdr(ipha)) { 14578 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs); 14579 ip2dbg(("ip_rput_broadcast:drop pkt\n")); 14580 freemsg(mp); 14581 ire_refrele(ire); 14582 return (NULL); 14583 } 14584 ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl + 1; 14585 ipha->ipha_hdr_checksum = 0; 14586 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 14587 ip_rput_process_forward(q, mp, ire, ipha, 14588 ill, ll_multicast); 14589 ire_refrele(ire); 14590 return (NULL); 14591 } 14592 ip1dbg(("ip_rput: NO directed broadcast to 0x%x\n", 14593 ntohl(ire->ire_addr))); 14594 } 14595 14596 14597 /* Restore any hardware checksum flags */ 14598 DB_CKSUMFLAGS(mp) = hcksumflags; 14599 return (ire); 14600 } 14601 14602 /* ARGSUSED */ 14603 static boolean_t 14604 ip_rput_process_multicast(queue_t *q, mblk_t *mp, ill_t *ill, ipha_t *ipha, 14605 int *ll_multicast, ipaddr_t *dstp) 14606 { 14607 ip_stack_t *ipst = ill->ill_ipst; 14608 14609 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts); 14610 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets, 14611 ntohs(ipha->ipha_length)); 14612 14613 /* 14614 * Forward packets only if we have joined the allmulti 14615 * group on this interface. 14616 */ 14617 if (ipst->ips_ip_g_mrouter && ill->ill_join_allmulti) { 14618 int retval; 14619 14620 /* 14621 * Clear the indication that this may have hardware 14622 * checksum as we are not using it. 14623 */ 14624 DB_CKSUMFLAGS(mp) = 0; 14625 retval = ip_mforward(ill, ipha, mp); 14626 /* ip_mforward updates mib variables if needed */ 14627 /* clear b_prev - used by ip_mroute_decap */ 14628 mp->b_prev = NULL; 14629 14630 switch (retval) { 14631 case 0: 14632 /* 14633 * pkt is okay and arrived on phyint. 14634 * 14635 * If we are running as a multicast router 14636 * we need to see all IGMP and/or PIM packets. 14637 */ 14638 if ((ipha->ipha_protocol == IPPROTO_IGMP) || 14639 (ipha->ipha_protocol == IPPROTO_PIM)) { 14640 goto done; 14641 } 14642 break; 14643 case -1: 14644 /* pkt is mal-formed, toss it */ 14645 goto drop_pkt; 14646 case 1: 14647 /* pkt is okay and arrived on a tunnel */ 14648 /* 14649 * If we are running a multicast router 14650 * we need to see all igmp packets. 14651 */ 14652 if (ipha->ipha_protocol == IPPROTO_IGMP) { 14653 *dstp = INADDR_BROADCAST; 14654 *ll_multicast = 1; 14655 return (B_FALSE); 14656 } 14657 14658 goto drop_pkt; 14659 } 14660 } 14661 14662 ILM_WALKER_HOLD(ill); 14663 if (ilm_lookup_ill(ill, *dstp, ALL_ZONES) == NULL) { 14664 /* 14665 * This might just be caused by the fact that 14666 * multiple IP Multicast addresses map to the same 14667 * link layer multicast - no need to increment counter! 14668 */ 14669 ILM_WALKER_RELE(ill); 14670 freemsg(mp); 14671 return (B_TRUE); 14672 } 14673 ILM_WALKER_RELE(ill); 14674 done: 14675 ip2dbg(("ip_rput: multicast for us: 0x%x\n", ntohl(*dstp))); 14676 /* 14677 * This assumes the we deliver to all streams for multicast 14678 * and broadcast packets. 14679 */ 14680 *dstp = INADDR_BROADCAST; 14681 *ll_multicast = 1; 14682 return (B_FALSE); 14683 drop_pkt: 14684 ip2dbg(("ip_rput: drop pkt\n")); 14685 freemsg(mp); 14686 return (B_TRUE); 14687 } 14688 14689 static boolean_t 14690 ip_rput_process_notdata(queue_t *q, mblk_t **first_mpp, ill_t *ill, 14691 int *ll_multicast, mblk_t **mpp) 14692 { 14693 mblk_t *mp1, *from_mp, *to_mp, *mp, *first_mp; 14694 boolean_t must_copy = B_FALSE; 14695 struct iocblk *iocp; 14696 ipha_t *ipha; 14697 ip_stack_t *ipst = ill->ill_ipst; 14698 14699 #define rptr ((uchar_t *)ipha) 14700 14701 first_mp = *first_mpp; 14702 mp = *mpp; 14703 14704 ASSERT(first_mp == mp); 14705 14706 /* 14707 * if db_ref > 1 then copymsg and free original. Packet may be 14708 * changed and do not want other entity who has a reference to this 14709 * message to trip over the changes. This is a blind change because 14710 * trying to catch all places that might change packet is too 14711 * difficult (since it may be a module above this one) 14712 * 14713 * This corresponds to the non-fast path case. We walk down the full 14714 * chain in this case, and check the db_ref count of all the dblks, 14715 * and do a copymsg if required. It is possible that the db_ref counts 14716 * of the data blocks in the mblk chain can be different. 14717 * For Example, we can get a DL_UNITDATA_IND(M_PROTO) with a db_ref 14718 * count of 1, followed by a M_DATA block with a ref count of 2, if 14719 * 'snoop' is running. 14720 */ 14721 for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) { 14722 if (mp1->b_datap->db_ref > 1) { 14723 must_copy = B_TRUE; 14724 break; 14725 } 14726 } 14727 14728 if (must_copy) { 14729 mp1 = copymsg(mp); 14730 if (mp1 == NULL) { 14731 for (mp1 = mp; mp1 != NULL; 14732 mp1 = mp1->b_cont) { 14733 mp1->b_next = NULL; 14734 mp1->b_prev = NULL; 14735 } 14736 freemsg(mp); 14737 if (ill != NULL) { 14738 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14739 } else { 14740 BUMP_MIB(&ipst->ips_ip_mib, 14741 ipIfStatsInDiscards); 14742 } 14743 return (B_TRUE); 14744 } 14745 for (from_mp = mp, to_mp = mp1; from_mp != NULL; 14746 from_mp = from_mp->b_cont, to_mp = to_mp->b_cont) { 14747 /* Copy b_prev - used by ip_mroute_decap */ 14748 to_mp->b_prev = from_mp->b_prev; 14749 from_mp->b_prev = NULL; 14750 } 14751 *first_mpp = first_mp = mp1; 14752 freemsg(mp); 14753 mp = mp1; 14754 *mpp = mp1; 14755 } 14756 14757 ipha = (ipha_t *)mp->b_rptr; 14758 14759 /* 14760 * previous code has a case for M_DATA. 14761 * We want to check how that happens. 14762 */ 14763 ASSERT(first_mp->b_datap->db_type != M_DATA); 14764 switch (first_mp->b_datap->db_type) { 14765 case M_PROTO: 14766 case M_PCPROTO: 14767 if (((dl_unitdata_ind_t *)rptr)->dl_primitive != 14768 DL_UNITDATA_IND) { 14769 /* Go handle anything other than data elsewhere. */ 14770 ip_rput_dlpi(q, mp); 14771 return (B_TRUE); 14772 } 14773 *ll_multicast = ((dl_unitdata_ind_t *)rptr)->dl_group_address; 14774 /* Ditch the DLPI header. */ 14775 mp1 = mp->b_cont; 14776 ASSERT(first_mp == mp); 14777 *first_mpp = mp1; 14778 freeb(mp); 14779 *mpp = mp1; 14780 return (B_FALSE); 14781 case M_IOCACK: 14782 ip1dbg(("got iocack ")); 14783 iocp = (struct iocblk *)mp->b_rptr; 14784 switch (iocp->ioc_cmd) { 14785 case DL_IOC_HDR_INFO: 14786 ill = (ill_t *)q->q_ptr; 14787 ill_fastpath_ack(ill, mp); 14788 return (B_TRUE); 14789 case SIOCSTUNPARAM: 14790 case OSIOCSTUNPARAM: 14791 /* Go through qwriter_ip */ 14792 break; 14793 case SIOCGTUNPARAM: 14794 case OSIOCGTUNPARAM: 14795 ip_rput_other(NULL, q, mp, NULL); 14796 return (B_TRUE); 14797 default: 14798 putnext(q, mp); 14799 return (B_TRUE); 14800 } 14801 /* FALLTHRU */ 14802 case M_ERROR: 14803 case M_HANGUP: 14804 /* 14805 * Since this is on the ill stream we unconditionally 14806 * bump up the refcount 14807 */ 14808 ill_refhold(ill); 14809 (void) qwriter_ip(NULL, ill, q, mp, ip_rput_other, CUR_OP, 14810 B_FALSE); 14811 return (B_TRUE); 14812 case M_CTL: 14813 if ((MBLKL(first_mp) >= sizeof (da_ipsec_t)) && 14814 (((da_ipsec_t *)first_mp->b_rptr)->da_type == 14815 IPHADA_M_CTL)) { 14816 /* 14817 * It's an IPsec accelerated packet. 14818 * Make sure that the ill from which we received the 14819 * packet has enabled IPsec hardware acceleration. 14820 */ 14821 if (!(ill->ill_capabilities & 14822 (ILL_CAPAB_AH|ILL_CAPAB_ESP))) { 14823 /* IPsec kstats: bean counter */ 14824 freemsg(mp); 14825 return (B_TRUE); 14826 } 14827 14828 /* 14829 * Make mp point to the mblk following the M_CTL, 14830 * then process according to type of mp. 14831 * After this processing, first_mp will point to 14832 * the data-attributes and mp to the pkt following 14833 * the M_CTL. 14834 */ 14835 mp = first_mp->b_cont; 14836 if (mp == NULL) { 14837 freemsg(first_mp); 14838 return (B_TRUE); 14839 } 14840 /* 14841 * A Hardware Accelerated packet can only be M_DATA 14842 * ESP or AH packet. 14843 */ 14844 if (mp->b_datap->db_type != M_DATA) { 14845 /* non-M_DATA IPsec accelerated packet */ 14846 IPSECHW_DEBUG(IPSECHW_PKT, 14847 ("non-M_DATA IPsec accelerated pkt\n")); 14848 freemsg(first_mp); 14849 return (B_TRUE); 14850 } 14851 ipha = (ipha_t *)mp->b_rptr; 14852 if (ipha->ipha_protocol != IPPROTO_AH && 14853 ipha->ipha_protocol != IPPROTO_ESP) { 14854 IPSECHW_DEBUG(IPSECHW_PKT, 14855 ("non-M_DATA IPsec accelerated pkt\n")); 14856 freemsg(first_mp); 14857 return (B_TRUE); 14858 } 14859 *mpp = mp; 14860 return (B_FALSE); 14861 } 14862 putnext(q, mp); 14863 return (B_TRUE); 14864 case M_FLUSH: 14865 if (*mp->b_rptr & FLUSHW) { 14866 *mp->b_rptr &= ~FLUSHR; 14867 qreply(q, mp); 14868 return (B_TRUE); 14869 } 14870 freemsg(mp); 14871 return (B_TRUE); 14872 case M_IOCNAK: 14873 ip1dbg(("got iocnak ")); 14874 iocp = (struct iocblk *)mp->b_rptr; 14875 switch (iocp->ioc_cmd) { 14876 case DL_IOC_HDR_INFO: 14877 case SIOCSTUNPARAM: 14878 case OSIOCSTUNPARAM: 14879 /* 14880 * Since this is on the ill stream we unconditionally 14881 * bump up the refcount 14882 */ 14883 ill_refhold(ill); 14884 (void) qwriter_ip(NULL, ill, q, mp, ip_rput_other, 14885 CUR_OP, B_FALSE); 14886 return (B_TRUE); 14887 case SIOCGTUNPARAM: 14888 case OSIOCGTUNPARAM: 14889 ip_rput_other(NULL, q, mp, NULL); 14890 return (B_TRUE); 14891 default: 14892 break; 14893 } 14894 /* FALLTHRU */ 14895 default: 14896 putnext(q, mp); 14897 return (B_TRUE); 14898 } 14899 } 14900 14901 /* Read side put procedure. Packets coming from the wire arrive here. */ 14902 void 14903 ip_rput(queue_t *q, mblk_t *mp) 14904 { 14905 ill_t *ill; 14906 ip_stack_t *ipst; 14907 14908 TRACE_1(TR_FAC_IP, TR_IP_RPUT_START, "ip_rput_start: q %p", q); 14909 14910 ill = (ill_t *)q->q_ptr; 14911 ipst = ill->ill_ipst; 14912 14913 if (ill->ill_state_flags & (ILL_CONDEMNED | ILL_LL_SUBNET_PENDING)) { 14914 union DL_primitives *dl; 14915 14916 /* 14917 * Things are opening or closing. Only accept DLPI control 14918 * messages. In the open case, the ill->ill_ipif has not yet 14919 * been created. In the close case, things hanging off the 14920 * ill could have been freed already. In either case it 14921 * may not be safe to proceed further. 14922 */ 14923 14924 dl = (union DL_primitives *)mp->b_rptr; 14925 if ((mp->b_datap->db_type != M_PCPROTO) || 14926 (dl->dl_primitive == DL_UNITDATA_IND)) { 14927 /* 14928 * Also SIOC[GS]TUN* ioctls can come here. 14929 */ 14930 inet_freemsg(mp); 14931 TRACE_2(TR_FAC_IP, TR_IP_RPUT_END, 14932 "ip_input_end: q %p (%S)", q, "uninit"); 14933 return; 14934 } 14935 } 14936 14937 /* 14938 * if db_ref > 1 then copymsg and free original. Packet may be 14939 * changed and we do not want the other entity who has a reference to 14940 * this message to trip over the changes. This is a blind change because 14941 * trying to catch all places that might change the packet is too 14942 * difficult. 14943 * 14944 * This corresponds to the fast path case, where we have a chain of 14945 * M_DATA mblks. We check the db_ref count of only the 1st data block 14946 * in the mblk chain. There doesn't seem to be a reason why a device 14947 * driver would send up data with varying db_ref counts in the mblk 14948 * chain. In any case the Fast path is a private interface, and our 14949 * drivers don't do such a thing. Given the above assumption, there is 14950 * no need to walk down the entire mblk chain (which could have a 14951 * potential performance problem) 14952 */ 14953 if (mp->b_datap->db_ref > 1) { 14954 mblk_t *mp1; 14955 boolean_t adjusted = B_FALSE; 14956 IP_STAT(ipst, ip_db_ref); 14957 14958 /* 14959 * The IP_RECVSLLA option depends on having the link layer 14960 * header. First check that: 14961 * a> the underlying device is of type ether, since this 14962 * option is currently supported only over ethernet. 14963 * b> there is enough room to copy over the link layer header. 14964 * 14965 * Once the checks are done, adjust rptr so that the link layer 14966 * header will be copied via copymsg. Note that, IFT_ETHER may 14967 * be returned by some non-ethernet drivers but in this case the 14968 * second check will fail. 14969 */ 14970 if (ill->ill_type == IFT_ETHER && 14971 (mp->b_rptr - mp->b_datap->db_base) >= 14972 sizeof (struct ether_header)) { 14973 mp->b_rptr -= sizeof (struct ether_header); 14974 adjusted = B_TRUE; 14975 } 14976 mp1 = copymsg(mp); 14977 if (mp1 == NULL) { 14978 mp->b_next = NULL; 14979 /* clear b_prev - used by ip_mroute_decap */ 14980 mp->b_prev = NULL; 14981 freemsg(mp); 14982 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 14983 TRACE_2(TR_FAC_IP, TR_IP_RPUT_END, 14984 "ip_rput_end: q %p (%S)", q, "copymsg"); 14985 return; 14986 } 14987 if (adjusted) { 14988 /* 14989 * Copy is done. Restore the pointer in the _new_ mblk 14990 */ 14991 mp1->b_rptr += sizeof (struct ether_header); 14992 } 14993 /* Copy b_prev - used by ip_mroute_decap */ 14994 mp1->b_prev = mp->b_prev; 14995 mp->b_prev = NULL; 14996 freemsg(mp); 14997 mp = mp1; 14998 } 14999 15000 TRACE_2(TR_FAC_IP, TR_IP_RPUT_END, 15001 "ip_rput_end: q %p (%S)", q, "end"); 15002 15003 ip_input(ill, NULL, mp, NULL); 15004 } 15005 15006 /* 15007 * Direct read side procedure capable of dealing with chains. GLDv3 based 15008 * drivers call this function directly with mblk chains while STREAMS 15009 * read side procedure ip_rput() calls this for single packet with ip_ring 15010 * set to NULL to process one packet at a time. 15011 * 15012 * The ill will always be valid if this function is called directly from 15013 * the driver. 15014 * 15015 * If ip_input() is called from GLDv3: 15016 * 15017 * - This must be a non-VLAN IP stream. 15018 * - 'mp' is either an untagged or a special priority-tagged packet. 15019 * - Any VLAN tag that was in the MAC header has been stripped. 15020 * 15021 * If the IP header in packet is not 32-bit aligned, every message in the 15022 * chain will be aligned before further operations. This is required on SPARC 15023 * platform. 15024 */ 15025 /* ARGSUSED */ 15026 void 15027 ip_input(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain, 15028 struct mac_header_info_s *mhip) 15029 { 15030 ipaddr_t dst = NULL; 15031 ipaddr_t prev_dst; 15032 ire_t *ire = NULL; 15033 ipha_t *ipha; 15034 uint_t pkt_len; 15035 ssize_t len; 15036 uint_t opt_len; 15037 int ll_multicast; 15038 int cgtp_flt_pkt; 15039 queue_t *q = ill->ill_rq; 15040 squeue_t *curr_sqp = NULL; 15041 mblk_t *head = NULL; 15042 mblk_t *tail = NULL; 15043 mblk_t *first_mp; 15044 mblk_t *mp; 15045 mblk_t *dmp; 15046 int cnt = 0; 15047 ip_stack_t *ipst = ill->ill_ipst; 15048 15049 ASSERT(mp_chain != NULL); 15050 ASSERT(ill != NULL); 15051 15052 TRACE_1(TR_FAC_IP, TR_IP_RPUT_START, "ip_input_start: q %p", q); 15053 15054 #define rptr ((uchar_t *)ipha) 15055 15056 while (mp_chain != NULL) { 15057 first_mp = mp = mp_chain; 15058 mp_chain = mp_chain->b_next; 15059 mp->b_next = NULL; 15060 ll_multicast = 0; 15061 15062 /* 15063 * We do ire caching from one iteration to 15064 * another. In the event the packet chain contains 15065 * all packets from the same dst, this caching saves 15066 * an ire_cache_lookup for each of the succeeding 15067 * packets in a packet chain. 15068 */ 15069 prev_dst = dst; 15070 15071 /* 15072 * Check and align the IP header. 15073 */ 15074 if (DB_TYPE(mp) == M_DATA) { 15075 dmp = mp; 15076 } else if (DB_TYPE(mp) == M_PROTO && 15077 *(t_uscalar_t *)mp->b_rptr == DL_UNITDATA_IND) { 15078 dmp = mp->b_cont; 15079 } else { 15080 dmp = NULL; 15081 } 15082 if (dmp != NULL) { 15083 /* 15084 * IP header ptr not aligned? 15085 * OR IP header not complete in first mblk 15086 */ 15087 if (!OK_32PTR(dmp->b_rptr) || 15088 MBLKL(dmp) < IP_SIMPLE_HDR_LENGTH) { 15089 if (!ip_check_and_align_header(q, dmp, ipst)) 15090 continue; 15091 } 15092 } 15093 15094 /* 15095 * ip_input fast path 15096 */ 15097 15098 /* mblk type is not M_DATA */ 15099 if (DB_TYPE(mp) != M_DATA) { 15100 if (ip_rput_process_notdata(q, &first_mp, ill, 15101 &ll_multicast, &mp)) 15102 continue; 15103 } 15104 15105 /* Make sure its an M_DATA and that its aligned */ 15106 ASSERT(DB_TYPE(mp) == M_DATA); 15107 ASSERT(DB_REF(mp) == 1 && OK_32PTR(mp->b_rptr)); 15108 15109 ipha = (ipha_t *)mp->b_rptr; 15110 len = mp->b_wptr - rptr; 15111 pkt_len = ntohs(ipha->ipha_length); 15112 15113 /* 15114 * We must count all incoming packets, even if they end 15115 * up being dropped later on. 15116 */ 15117 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives); 15118 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets, pkt_len); 15119 15120 /* multiple mblk or too short */ 15121 len -= pkt_len; 15122 if (len != 0) { 15123 /* 15124 * Make sure we have data length consistent 15125 * with the IP header. 15126 */ 15127 if (mp->b_cont == NULL) { 15128 if (len < 0 || pkt_len < IP_SIMPLE_HDR_LENGTH) { 15129 BUMP_MIB(ill->ill_ip_mib, 15130 ipIfStatsInHdrErrors); 15131 ip2dbg(("ip_input: drop pkt\n")); 15132 freemsg(mp); 15133 continue; 15134 } 15135 mp->b_wptr = rptr + pkt_len; 15136 } else if ((len += msgdsize(mp->b_cont)) != 0) { 15137 if (len < 0 || pkt_len < IP_SIMPLE_HDR_LENGTH) { 15138 BUMP_MIB(ill->ill_ip_mib, 15139 ipIfStatsInHdrErrors); 15140 ip2dbg(("ip_input: drop pkt\n")); 15141 freemsg(mp); 15142 continue; 15143 } 15144 (void) adjmsg(mp, -len); 15145 IP_STAT(ipst, ip_multimblk3); 15146 } 15147 } 15148 15149 /* Obtain the dst of the current packet */ 15150 dst = ipha->ipha_dst; 15151 15152 if (IP_LOOPBACK_ADDR(dst) || 15153 IP_LOOPBACK_ADDR(ipha->ipha_src)) { 15154 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors); 15155 cmn_err(CE_CONT, "dst %X src %X\n", 15156 dst, ipha->ipha_src); 15157 freemsg(mp); 15158 continue; 15159 } 15160 15161 /* 15162 * The event for packets being received from a 'physical' 15163 * interface is placed after validation of the source and/or 15164 * destination address as being local so that packets can be 15165 * redirected to loopback addresses using ipnat. 15166 */ 15167 DTRACE_PROBE4(ip4__physical__in__start, 15168 ill_t *, ill, ill_t *, NULL, 15169 ipha_t *, ipha, mblk_t *, first_mp); 15170 15171 FW_HOOKS(ipst->ips_ip4_physical_in_event, 15172 ipst->ips_ipv4firewall_physical_in, 15173 ill, NULL, ipha, first_mp, mp, ipst); 15174 15175 DTRACE_PROBE1(ip4__physical__in__end, mblk_t *, first_mp); 15176 15177 if (first_mp == NULL) { 15178 continue; 15179 } 15180 dst = ipha->ipha_dst; 15181 15182 /* 15183 * Attach any necessary label information to 15184 * this packet 15185 */ 15186 if (is_system_labeled() && 15187 !tsol_get_pkt_label(mp, IPV4_VERSION)) { 15188 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 15189 freemsg(mp); 15190 continue; 15191 } 15192 15193 /* 15194 * Reuse the cached ire only if the ipha_dst of the previous 15195 * packet is the same as the current packet AND it is not 15196 * INADDR_ANY. 15197 */ 15198 if (!(dst == prev_dst && dst != INADDR_ANY) && 15199 (ire != NULL)) { 15200 ire_refrele(ire); 15201 ire = NULL; 15202 } 15203 opt_len = ipha->ipha_version_and_hdr_length - 15204 IP_SIMPLE_HDR_VERSION; 15205 15206 /* 15207 * Check to see if we can take the fastpath. 15208 * That is possible if the following conditions are met 15209 * o Tsol disabled 15210 * o CGTP disabled 15211 * o ipp_action_count is 0 15212 * o Mobile IP not running 15213 * o no options in the packet 15214 * o not a RSVP packet 15215 * o not a multicast packet 15216 */ 15217 if (!is_system_labeled() && 15218 !ip_cgtp_filter && ipp_action_count == 0 && 15219 ill->ill_mrtun_refcnt == 0 && ill->ill_srcif_refcnt == 0 && 15220 opt_len == 0 && ipha->ipha_protocol != IPPROTO_RSVP && 15221 !ll_multicast && !CLASSD(dst)) { 15222 if (ire == NULL) 15223 ire = ire_cache_lookup(dst, ALL_ZONES, NULL, 15224 ipst); 15225 15226 /* incoming packet is for forwarding */ 15227 if (ire == NULL || (ire->ire_type & IRE_CACHE)) { 15228 ire = ip_fast_forward(ire, dst, ill, mp); 15229 continue; 15230 } 15231 /* incoming packet is for local consumption */ 15232 if (ire->ire_type & IRE_LOCAL) 15233 goto local; 15234 } 15235 15236 /* 15237 * Disable ire caching for anything more complex 15238 * than the simple fast path case we checked for above. 15239 */ 15240 if (ire != NULL) { 15241 ire_refrele(ire); 15242 ire = NULL; 15243 } 15244 15245 /* Full-blown slow path */ 15246 if (opt_len != 0) { 15247 if (len != 0) 15248 IP_STAT(ipst, ip_multimblk4); 15249 else 15250 IP_STAT(ipst, ip_ipoptions); 15251 if (!ip_rput_multimblk_ipoptions(q, ill, mp, &ipha, 15252 &dst, ipst)) 15253 continue; 15254 } 15255 15256 /* 15257 * Invoke the CGTP (multirouting) filtering module to process 15258 * the incoming packet. Packets identified as duplicates 15259 * must be discarded. Filtering is active only if the 15260 * the ip_cgtp_filter ndd variable is non-zero. 15261 * 15262 * Only applies to the shared stack since the filter_ops 15263 * do not carry an ip_stack_t or zoneid. 15264 */ 15265 cgtp_flt_pkt = CGTP_IP_PKT_NOT_CGTP; 15266 if (ip_cgtp_filter && (ip_cgtp_filter_ops != NULL) && 15267 ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID) { 15268 cgtp_flt_pkt = 15269 ip_cgtp_filter_ops->cfo_filter(q, mp); 15270 if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) { 15271 freemsg(first_mp); 15272 continue; 15273 } 15274 } 15275 15276 /* 15277 * If rsvpd is running, let RSVP daemon handle its processing 15278 * and forwarding of RSVP multicast/unicast packets. 15279 * If rsvpd is not running but mrouted is running, RSVP 15280 * multicast packets are forwarded as multicast traffic 15281 * and RSVP unicast packets are forwarded by unicast router. 15282 * If neither rsvpd nor mrouted is running, RSVP multicast 15283 * packets are not forwarded, but the unicast packets are 15284 * forwarded like unicast traffic. 15285 */ 15286 if (ipha->ipha_protocol == IPPROTO_RSVP && 15287 ipst->ips_ipcl_proto_fanout[IPPROTO_RSVP].connf_head != 15288 NULL) { 15289 /* RSVP packet and rsvpd running. Treat as ours */ 15290 ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(dst))); 15291 /* 15292 * This assumes that we deliver to all streams for 15293 * multicast and broadcast packets. 15294 * We have to force ll_multicast to 1 to handle the 15295 * M_DATA messages passed in from ip_mroute_decap. 15296 */ 15297 dst = INADDR_BROADCAST; 15298 ll_multicast = 1; 15299 } else if (CLASSD(dst)) { 15300 /* packet is multicast */ 15301 mp->b_next = NULL; 15302 if (ip_rput_process_multicast(q, mp, ill, ipha, 15303 &ll_multicast, &dst)) 15304 continue; 15305 } 15306 15307 15308 /* 15309 * Check if the packet is coming from the Mobile IP 15310 * forward tunnel interface 15311 */ 15312 if (ill->ill_srcif_refcnt > 0) { 15313 ire = ire_srcif_table_lookup(dst, IRE_INTERFACE, 15314 NULL, ill, MATCH_IRE_TYPE); 15315 if (ire != NULL && ire->ire_nce->nce_res_mp == NULL && 15316 ire->ire_ipif->ipif_net_type == IRE_IF_RESOLVER) { 15317 15318 /* We need to resolve the link layer info */ 15319 ire_refrele(ire); 15320 ire = NULL; 15321 (void) ip_rput_noire(q, (ill_t *)q->q_ptr, mp, 15322 ll_multicast, dst); 15323 continue; 15324 } 15325 } 15326 15327 if (ire == NULL) { 15328 ire = ire_cache_lookup(dst, ALL_ZONES, 15329 MBLK_GETLABEL(mp), ipst); 15330 } 15331 15332 /* 15333 * If mipagent is running and reverse tunnel is created as per 15334 * mobile node request, then any packet coming through the 15335 * incoming interface from the mobile-node, should be reverse 15336 * tunneled to it's home agent except those that are destined 15337 * to foreign agent only. 15338 * This needs source address based ire lookup. The routing 15339 * entries for source address based lookup are only created by 15340 * mipagent program only when a reverse tunnel is created. 15341 * Reference : RFC2002, RFC2344 15342 */ 15343 if (ill->ill_mrtun_refcnt > 0) { 15344 ipaddr_t srcaddr; 15345 ire_t *tmp_ire; 15346 15347 tmp_ire = ire; /* Save, we might need it later */ 15348 if (ire == NULL || (ire->ire_type != IRE_LOCAL && 15349 ire->ire_type != IRE_BROADCAST)) { 15350 srcaddr = ipha->ipha_src; 15351 ire = ire_mrtun_lookup(srcaddr, ill); 15352 if (ire != NULL) { 15353 /* 15354 * Should not be getting iphada packet 15355 * here. we should only get those for 15356 * IRE_LOCAL traffic, excluded above. 15357 * Fail-safe (drop packet) in the event 15358 * hardware is misbehaving. 15359 */ 15360 if (first_mp != mp) { 15361 /* IPsec KSTATS: beancount me */ 15362 freemsg(first_mp); 15363 } else { 15364 /* 15365 * This packet must be forwarded 15366 * to Reverse Tunnel 15367 */ 15368 ip_mrtun_forward(ire, ill, mp); 15369 } 15370 ire_refrele(ire); 15371 ire = NULL; 15372 if (tmp_ire != NULL) { 15373 ire_refrele(tmp_ire); 15374 tmp_ire = NULL; 15375 } 15376 TRACE_2(TR_FAC_IP, TR_IP_RPUT_END, 15377 "ip_input_end: q %p (%S)", 15378 q, "uninit"); 15379 continue; 15380 } 15381 } 15382 /* 15383 * If this packet is from a non-mobilenode or a 15384 * mobile-node which does not request reverse 15385 * tunnel service 15386 */ 15387 ire = tmp_ire; 15388 } 15389 15390 15391 /* 15392 * If we reach here that means the incoming packet satisfies 15393 * one of the following conditions: 15394 * - packet is from a mobile node which does not request 15395 * reverse tunnel 15396 * - packet is from a non-mobile node, which is the most 15397 * common case 15398 * - packet is from a reverse tunnel enabled mobile node 15399 * and destined to foreign agent only 15400 */ 15401 15402 if (ire == NULL) { 15403 /* 15404 * No IRE for this destination, so it can't be for us. 15405 * Unless we are forwarding, drop the packet. 15406 * We have to let source routed packets through 15407 * since we don't yet know if they are 'ping -l' 15408 * packets i.e. if they will go out over the 15409 * same interface as they came in on. 15410 */ 15411 ire = ip_rput_noire(q, NULL, mp, ll_multicast, dst); 15412 if (ire == NULL) 15413 continue; 15414 } 15415 15416 /* 15417 * Broadcast IRE may indicate either broadcast or 15418 * multicast packet 15419 */ 15420 if (ire->ire_type == IRE_BROADCAST) { 15421 /* 15422 * Skip broadcast checks if packet is UDP multicast; 15423 * we'd rather not enter ip_rput_process_broadcast() 15424 * unless the packet is broadcast for real, since 15425 * that routine is a no-op for multicast. 15426 */ 15427 if (ipha->ipha_protocol != IPPROTO_UDP || 15428 !CLASSD(ipha->ipha_dst)) { 15429 ire = ip_rput_process_broadcast(&q, mp, 15430 ire, ipha, ill, dst, cgtp_flt_pkt, 15431 ll_multicast); 15432 if (ire == NULL) 15433 continue; 15434 } 15435 } else if (ire->ire_stq != NULL) { 15436 /* fowarding? */ 15437 ip_rput_process_forward(q, mp, ire, ipha, ill, 15438 ll_multicast); 15439 /* ip_rput_process_forward consumed the packet */ 15440 continue; 15441 } 15442 15443 local: 15444 /* packet not for us */ 15445 if (ire->ire_rfq != q) { 15446 if (ip_rput_notforus(&q, mp, ire, ill)) 15447 continue; 15448 } 15449 15450 switch (ipha->ipha_protocol) { 15451 case IPPROTO_TCP: 15452 ASSERT(first_mp == mp); 15453 if ((mp = ip_tcp_input(mp, ipha, ill, B_FALSE, ire, 15454 mp, 0, q, ip_ring)) != NULL) { 15455 if (curr_sqp == NULL) { 15456 curr_sqp = GET_SQUEUE(mp); 15457 ASSERT(cnt == 0); 15458 cnt++; 15459 head = tail = mp; 15460 } else if (curr_sqp == GET_SQUEUE(mp)) { 15461 ASSERT(tail != NULL); 15462 cnt++; 15463 tail->b_next = mp; 15464 tail = mp; 15465 } else { 15466 /* 15467 * A different squeue. Send the 15468 * chain for the previous squeue on 15469 * its way. This shouldn't happen 15470 * often unless interrupt binding 15471 * changes. 15472 */ 15473 IP_STAT(ipst, ip_input_multi_squeue); 15474 squeue_enter_chain(curr_sqp, head, 15475 tail, cnt, SQTAG_IP_INPUT); 15476 curr_sqp = GET_SQUEUE(mp); 15477 head = mp; 15478 tail = mp; 15479 cnt = 1; 15480 } 15481 } 15482 continue; 15483 case IPPROTO_UDP: 15484 ASSERT(first_mp == mp); 15485 ip_udp_input(q, mp, ipha, ire, ill); 15486 continue; 15487 case IPPROTO_SCTP: 15488 ASSERT(first_mp == mp); 15489 ip_sctp_input(mp, ipha, ill, B_FALSE, ire, mp, 0, 15490 q, dst); 15491 /* ire has been released by ip_sctp_input */ 15492 ire = NULL; 15493 continue; 15494 default: 15495 ip_proto_input(q, first_mp, ipha, ire, ill); 15496 continue; 15497 } 15498 } 15499 15500 if (ire != NULL) 15501 ire_refrele(ire); 15502 15503 if (head != NULL) 15504 squeue_enter_chain(curr_sqp, head, tail, cnt, SQTAG_IP_INPUT); 15505 15506 /* 15507 * This code is there just to make netperf/ttcp look good. 15508 * 15509 * Its possible that after being in polling mode (and having cleared 15510 * the backlog), squeues have turned the interrupt frequency higher 15511 * to improve latency at the expense of more CPU utilization (less 15512 * packets per interrupts or more number of interrupts). Workloads 15513 * like ttcp/netperf do manage to tickle polling once in a while 15514 * but for the remaining time, stay in higher interrupt mode since 15515 * their packet arrival rate is pretty uniform and this shows up 15516 * as higher CPU utilization. Since people care about CPU utilization 15517 * while running netperf/ttcp, turn the interrupt frequency back to 15518 * normal/default if polling has not been used in ip_poll_normal_ticks. 15519 */ 15520 if (ip_ring != NULL && (ip_ring->rr_poll_state & ILL_POLLING)) { 15521 if (lbolt >= (ip_ring->rr_poll_time + ip_poll_normal_ticks)) { 15522 ip_ring->rr_poll_state &= ~ILL_POLLING; 15523 ip_ring->rr_blank(ip_ring->rr_handle, 15524 ip_ring->rr_normal_blank_time, 15525 ip_ring->rr_normal_pkt_cnt); 15526 } 15527 } 15528 15529 TRACE_2(TR_FAC_IP, TR_IP_RPUT_END, 15530 "ip_input_end: q %p (%S)", q, "end"); 15531 #undef rptr 15532 } 15533 15534 static void 15535 ip_dlpi_error(ill_t *ill, t_uscalar_t prim, t_uscalar_t dl_err, 15536 t_uscalar_t err) 15537 { 15538 if (dl_err == DL_SYSERR) { 15539 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE, 15540 "%s: %s failed: DL_SYSERR (errno %u)\n", 15541 ill->ill_name, dlpi_prim_str(prim), err); 15542 return; 15543 } 15544 15545 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE, 15546 "%s: %s failed: %s\n", ill->ill_name, dlpi_prim_str(prim), 15547 dlpi_err_str(dl_err)); 15548 } 15549 15550 /* 15551 * ip_rput_dlpi is called by ip_rput to handle all DLPI messages other 15552 * than DL_UNITDATA_IND messages. If we need to process this message 15553 * exclusively, we call qwriter_ip, in which case we also need to call 15554 * ill_refhold before that, since qwriter_ip does an ill_refrele. 15555 */ 15556 void 15557 ip_rput_dlpi(queue_t *q, mblk_t *mp) 15558 { 15559 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr; 15560 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa; 15561 ill_t *ill; 15562 15563 ip1dbg(("ip_rput_dlpi")); 15564 ill = (ill_t *)q->q_ptr; 15565 switch (dloa->dl_primitive) { 15566 case DL_ERROR_ACK: 15567 ip2dbg(("ip_rput_dlpi(%s): DL_ERROR_ACK %s (0x%x): " 15568 "%s (0x%x), unix %u\n", ill->ill_name, 15569 dlpi_prim_str(dlea->dl_error_primitive), 15570 dlea->dl_error_primitive, 15571 dlpi_err_str(dlea->dl_errno), 15572 dlea->dl_errno, 15573 dlea->dl_unix_errno)); 15574 switch (dlea->dl_error_primitive) { 15575 case DL_UNBIND_REQ: 15576 mutex_enter(&ill->ill_lock); 15577 ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS; 15578 cv_signal(&ill->ill_cv); 15579 mutex_exit(&ill->ill_lock); 15580 /* FALLTHRU */ 15581 case DL_NOTIFY_REQ: 15582 case DL_ATTACH_REQ: 15583 case DL_DETACH_REQ: 15584 case DL_INFO_REQ: 15585 case DL_BIND_REQ: 15586 case DL_ENABMULTI_REQ: 15587 case DL_PHYS_ADDR_REQ: 15588 case DL_CAPABILITY_REQ: 15589 case DL_CONTROL_REQ: 15590 /* 15591 * Refhold the ill to match qwriter_ip which does a 15592 * refrele. Since this is on the ill stream we 15593 * unconditionally bump up the refcount without 15594 * checking for ILL_CAN_LOOKUP 15595 */ 15596 ill_refhold(ill); 15597 (void) qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer, 15598 CUR_OP, B_FALSE); 15599 return; 15600 case DL_DISABMULTI_REQ: 15601 freemsg(mp); /* Don't want to pass this up */ 15602 return; 15603 default: 15604 break; 15605 } 15606 ip_dlpi_error(ill, dlea->dl_error_primitive, 15607 dlea->dl_errno, dlea->dl_unix_errno); 15608 freemsg(mp); 15609 return; 15610 case DL_INFO_ACK: 15611 case DL_BIND_ACK: 15612 case DL_PHYS_ADDR_ACK: 15613 case DL_NOTIFY_ACK: 15614 case DL_CAPABILITY_ACK: 15615 case DL_CONTROL_ACK: 15616 /* 15617 * Refhold the ill to match qwriter_ip which does a refrele 15618 * Since this is on the ill stream we unconditionally 15619 * bump up the refcount without doing ILL_CAN_LOOKUP. 15620 */ 15621 ill_refhold(ill); 15622 (void) qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer, 15623 CUR_OP, B_FALSE); 15624 return; 15625 case DL_NOTIFY_IND: 15626 ill_refhold(ill); 15627 /* 15628 * The DL_NOTIFY_IND is an asynchronous message that has no 15629 * relation to the current ioctl in progress (if any). Hence we 15630 * pass in NEW_OP in this case. 15631 */ 15632 (void) qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer, 15633 NEW_OP, B_FALSE); 15634 return; 15635 case DL_OK_ACK: 15636 ip1dbg(("ip_rput: DL_OK_ACK for %s\n", 15637 dlpi_prim_str((int)dloa->dl_correct_primitive))); 15638 switch (dloa->dl_correct_primitive) { 15639 case DL_UNBIND_REQ: 15640 mutex_enter(&ill->ill_lock); 15641 ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS; 15642 cv_signal(&ill->ill_cv); 15643 mutex_exit(&ill->ill_lock); 15644 /* FALLTHRU */ 15645 case DL_ATTACH_REQ: 15646 case DL_DETACH_REQ: 15647 /* 15648 * Refhold the ill to match qwriter_ip which does a 15649 * refrele. Since this is on the ill stream we 15650 * unconditionally bump up the refcount 15651 */ 15652 ill_refhold(ill); 15653 qwriter_ip(NULL, ill, q, mp, ip_rput_dlpi_writer, 15654 CUR_OP, B_FALSE); 15655 return; 15656 case DL_ENABMULTI_REQ: 15657 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS) 15658 ill->ill_dlpi_multicast_state = IDS_OK; 15659 break; 15660 15661 } 15662 break; 15663 default: 15664 break; 15665 } 15666 freemsg(mp); 15667 } 15668 15669 /* 15670 * Handling of DLPI messages that require exclusive access to the ipsq. 15671 * 15672 * Need to do ill_pending_mp_release on ioctl completion, which could 15673 * happen here. (along with mi_copy_done) 15674 */ 15675 /* ARGSUSED */ 15676 static void 15677 ip_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 15678 { 15679 dl_ok_ack_t *dloa = (dl_ok_ack_t *)mp->b_rptr; 15680 dl_error_ack_t *dlea = (dl_error_ack_t *)dloa; 15681 int err = 0; 15682 ill_t *ill; 15683 ipif_t *ipif = NULL; 15684 mblk_t *mp1 = NULL; 15685 conn_t *connp = NULL; 15686 t_uscalar_t paddrreq; 15687 mblk_t *mp_hw; 15688 boolean_t success; 15689 boolean_t ioctl_aborted = B_FALSE; 15690 boolean_t log = B_TRUE; 15691 hook_nic_event_t *info; 15692 ip_stack_t *ipst; 15693 15694 ip1dbg(("ip_rput_dlpi_writer ..")); 15695 ill = (ill_t *)q->q_ptr; 15696 ASSERT(ipsq == ill->ill_phyint->phyint_ipsq); 15697 15698 ASSERT(IAM_WRITER_ILL(ill)); 15699 15700 ipst = ill->ill_ipst; 15701 15702 /* 15703 * ipsq_pending_mp and ipsq_pending_ipif track each other. i.e. 15704 * both are null or non-null. However we can assert that only 15705 * after grabbing the ipsq_lock. So we don't make any assertion 15706 * here and in other places in the code. 15707 */ 15708 ipif = ipsq->ipsq_pending_ipif; 15709 /* 15710 * The current ioctl could have been aborted by the user and a new 15711 * ioctl to bring up another ill could have started. We could still 15712 * get a response from the driver later. 15713 */ 15714 if (ipif != NULL && ipif->ipif_ill != ill) 15715 ioctl_aborted = B_TRUE; 15716 15717 switch (dloa->dl_primitive) { 15718 case DL_ERROR_ACK: 15719 switch (dlea->dl_error_primitive) { 15720 case DL_UNBIND_REQ: 15721 case DL_ATTACH_REQ: 15722 case DL_DETACH_REQ: 15723 case DL_INFO_REQ: 15724 ill_dlpi_done(ill, dlea->dl_error_primitive); 15725 break; 15726 case DL_NOTIFY_REQ: 15727 ill_dlpi_done(ill, DL_NOTIFY_REQ); 15728 log = B_FALSE; 15729 break; 15730 case DL_PHYS_ADDR_REQ: 15731 /* 15732 * For IPv6 only, there are two additional 15733 * phys_addr_req's sent to the driver to get the 15734 * IPv6 token and lla. This allows IP to acquire 15735 * the hardware address format for a given interface 15736 * without having built in knowledge of the hardware 15737 * address. ill_phys_addr_pend keeps track of the last 15738 * DL_PAR sent so we know which response we are 15739 * dealing with. ill_dlpi_done will update 15740 * ill_phys_addr_pend when it sends the next req. 15741 * We don't complete the IOCTL until all three DL_PARs 15742 * have been attempted, so set *_len to 0 and break. 15743 */ 15744 paddrreq = ill->ill_phys_addr_pend; 15745 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ); 15746 if (paddrreq == DL_IPV6_TOKEN) { 15747 ill->ill_token_length = 0; 15748 log = B_FALSE; 15749 break; 15750 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) { 15751 ill->ill_nd_lla_len = 0; 15752 log = B_FALSE; 15753 break; 15754 } 15755 /* 15756 * Something went wrong with the DL_PHYS_ADDR_REQ. 15757 * We presumably have an IOCTL hanging out waiting 15758 * for completion. Find it and complete the IOCTL 15759 * with the error noted. 15760 * However, ill_dl_phys was called on an ill queue 15761 * (from SIOCSLIFNAME), thus conn_pending_ill is not 15762 * set. But the ioctl is known to be pending on ill_wq. 15763 */ 15764 if (!ill->ill_ifname_pending) 15765 break; 15766 ill->ill_ifname_pending = 0; 15767 if (!ioctl_aborted) 15768 mp1 = ipsq_pending_mp_get(ipsq, &connp); 15769 if (mp1 != NULL) { 15770 /* 15771 * This operation (SIOCSLIFNAME) must have 15772 * happened on the ill. Assert there is no conn 15773 */ 15774 ASSERT(connp == NULL); 15775 q = ill->ill_wq; 15776 } 15777 break; 15778 case DL_BIND_REQ: 15779 ill_dlpi_done(ill, DL_BIND_REQ); 15780 if (ill->ill_ifname_pending) 15781 break; 15782 /* 15783 * Something went wrong with the bind. We presumably 15784 * have an IOCTL hanging out waiting for completion. 15785 * Find it, take down the interface that was coming 15786 * up, and complete the IOCTL with the error noted. 15787 */ 15788 if (!ioctl_aborted) 15789 mp1 = ipsq_pending_mp_get(ipsq, &connp); 15790 if (mp1 != NULL) { 15791 /* 15792 * This operation (SIOCSLIFFLAGS) must have 15793 * happened from a conn. 15794 */ 15795 ASSERT(connp != NULL); 15796 q = CONNP_TO_WQ(connp); 15797 if (ill->ill_move_in_progress) { 15798 ILL_CLEAR_MOVE(ill); 15799 } 15800 (void) ipif_down(ipif, NULL, NULL); 15801 /* error is set below the switch */ 15802 } 15803 break; 15804 case DL_ENABMULTI_REQ: 15805 ip1dbg(("DL_ERROR_ACK to enabmulti\n")); 15806 15807 if (ill->ill_dlpi_multicast_state == IDS_INPROGRESS) 15808 ill->ill_dlpi_multicast_state = IDS_FAILED; 15809 if (ill->ill_dlpi_multicast_state == IDS_FAILED) { 15810 ipif_t *ipif; 15811 15812 log = B_FALSE; 15813 printf("ip: joining multicasts failed (%d)" 15814 " on %s - will use link layer " 15815 "broadcasts for multicast\n", 15816 dlea->dl_errno, ill->ill_name); 15817 15818 /* 15819 * Set up the multicast mapping alone. 15820 * writer, so ok to access ill->ill_ipif 15821 * without any lock. 15822 */ 15823 ipif = ill->ill_ipif; 15824 mutex_enter(&ill->ill_phyint->phyint_lock); 15825 ill->ill_phyint->phyint_flags |= 15826 PHYI_MULTI_BCAST; 15827 mutex_exit(&ill->ill_phyint->phyint_lock); 15828 15829 if (!ill->ill_isv6) { 15830 (void) ipif_arp_setup_multicast(ipif, 15831 NULL); 15832 } else { 15833 (void) ipif_ndp_setup_multicast(ipif, 15834 NULL); 15835 } 15836 } 15837 freemsg(mp); /* Don't want to pass this up */ 15838 return; 15839 case DL_CAPABILITY_REQ: 15840 case DL_CONTROL_REQ: 15841 ip1dbg(("ip_rput_dlpi_writer: got DL_ERROR_ACK for " 15842 "DL_CAPABILITY/CONTROL REQ\n")); 15843 ill_dlpi_done(ill, dlea->dl_error_primitive); 15844 ill->ill_dlpi_capab_state = IDS_FAILED; 15845 freemsg(mp); 15846 return; 15847 } 15848 /* 15849 * Note the error for IOCTL completion (mp1 is set when 15850 * ready to complete ioctl). If ill_ifname_pending_err is 15851 * set, an error occured during plumbing (ill_ifname_pending), 15852 * so we want to report that error. 15853 * 15854 * NOTE: there are two addtional DL_PHYS_ADDR_REQ's 15855 * (DL_IPV6_TOKEN and DL_IPV6_LINK_LAYER_ADDR) that are 15856 * expected to get errack'd if the driver doesn't support 15857 * these flags (e.g. ethernet). log will be set to B_FALSE 15858 * if these error conditions are encountered. 15859 */ 15860 if (mp1 != NULL) { 15861 if (ill->ill_ifname_pending_err != 0) { 15862 err = ill->ill_ifname_pending_err; 15863 ill->ill_ifname_pending_err = 0; 15864 } else { 15865 err = dlea->dl_unix_errno ? 15866 dlea->dl_unix_errno : ENXIO; 15867 } 15868 /* 15869 * If we're plumbing an interface and an error hasn't already 15870 * been saved, set ill_ifname_pending_err to the error passed 15871 * up. Ignore the error if log is B_FALSE (see comment above). 15872 */ 15873 } else if (log && ill->ill_ifname_pending && 15874 ill->ill_ifname_pending_err == 0) { 15875 ill->ill_ifname_pending_err = dlea->dl_unix_errno ? 15876 dlea->dl_unix_errno : ENXIO; 15877 } 15878 15879 if (log) 15880 ip_dlpi_error(ill, dlea->dl_error_primitive, 15881 dlea->dl_errno, dlea->dl_unix_errno); 15882 break; 15883 case DL_CAPABILITY_ACK: { 15884 boolean_t reneg_flag = B_FALSE; 15885 /* Call a routine to handle this one. */ 15886 ill_dlpi_done(ill, DL_CAPABILITY_REQ); 15887 /* 15888 * Check if the ACK is due to renegotiation case since we 15889 * will need to send a new CAPABILITY_REQ later. 15890 */ 15891 if (ill->ill_dlpi_capab_state == IDS_RENEG) { 15892 /* This is the ack for a renogiation case */ 15893 reneg_flag = B_TRUE; 15894 ill->ill_dlpi_capab_state = IDS_UNKNOWN; 15895 } 15896 ill_capability_ack(ill, mp); 15897 if (reneg_flag) 15898 ill_capability_probe(ill); 15899 break; 15900 } 15901 case DL_CONTROL_ACK: 15902 /* We treat all of these as "fire and forget" */ 15903 ill_dlpi_done(ill, DL_CONTROL_REQ); 15904 break; 15905 case DL_INFO_ACK: 15906 /* Call a routine to handle this one. */ 15907 ill_dlpi_done(ill, DL_INFO_REQ); 15908 ip_ll_subnet_defaults(ill, mp); 15909 ASSERT(!MUTEX_HELD(&ill->ill_phyint->phyint_ipsq->ipsq_lock)); 15910 return; 15911 case DL_BIND_ACK: 15912 /* 15913 * We should have an IOCTL waiting on this unless 15914 * sent by ill_dl_phys, in which case just return 15915 */ 15916 ill_dlpi_done(ill, DL_BIND_REQ); 15917 if (ill->ill_ifname_pending) 15918 break; 15919 15920 if (!ioctl_aborted) 15921 mp1 = ipsq_pending_mp_get(ipsq, &connp); 15922 if (mp1 == NULL) 15923 break; 15924 /* 15925 * Because mp1 was added by ill_dl_up(), and it always 15926 * passes a valid connp, connp must be valid here. 15927 */ 15928 ASSERT(connp != NULL); 15929 q = CONNP_TO_WQ(connp); 15930 15931 /* 15932 * We are exclusive. So nothing can change even after 15933 * we get the pending mp. If need be we can put it back 15934 * and restart, as in calling ipif_arp_up() below. 15935 */ 15936 ip1dbg(("ip_rput_dlpi: bind_ack %s\n", ill->ill_name)); 15937 15938 mutex_enter(&ill->ill_lock); 15939 15940 ill->ill_dl_up = 1; 15941 15942 if ((info = ill->ill_nic_event_info) != NULL) { 15943 ip2dbg(("ip_rput_dlpi_writer: unexpected nic event %d " 15944 "attached for %s\n", info->hne_event, 15945 ill->ill_name)); 15946 if (info->hne_data != NULL) 15947 kmem_free(info->hne_data, info->hne_datalen); 15948 kmem_free(info, sizeof (hook_nic_event_t)); 15949 } 15950 15951 info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP); 15952 if (info != NULL) { 15953 info->hne_nic = ill->ill_phyint->phyint_ifindex; 15954 info->hne_lif = 0; 15955 info->hne_event = NE_UP; 15956 info->hne_data = NULL; 15957 info->hne_datalen = 0; 15958 info->hne_family = ill->ill_isv6 ? 15959 ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data; 15960 } else 15961 ip2dbg(("ip_rput_dlpi_writer: could not attach UP nic " 15962 "event information for %s (ENOMEM)\n", 15963 ill->ill_name)); 15964 15965 ill->ill_nic_event_info = info; 15966 15967 mutex_exit(&ill->ill_lock); 15968 15969 /* 15970 * Now bring up the resolver; when that is complete, we'll 15971 * create IREs. Note that we intentionally mirror what 15972 * ipif_up() would have done, because we got here by way of 15973 * ill_dl_up(), which stopped ipif_up()'s processing. 15974 */ 15975 if (ill->ill_isv6) { 15976 /* 15977 * v6 interfaces. 15978 * Unlike ARP which has to do another bind 15979 * and attach, once we get here we are 15980 * done with NDP. Except in the case of 15981 * ILLF_XRESOLV, in which case we send an 15982 * AR_INTERFACE_UP to the external resolver. 15983 * If all goes well, the ioctl will complete 15984 * in ip_rput(). If there's an error, we 15985 * complete it here. 15986 */ 15987 err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr); 15988 if (err == 0) { 15989 if (ill->ill_flags & ILLF_XRESOLV) { 15990 mutex_enter(&connp->conn_lock); 15991 mutex_enter(&ill->ill_lock); 15992 success = ipsq_pending_mp_add( 15993 connp, ipif, q, mp1, 0); 15994 mutex_exit(&ill->ill_lock); 15995 mutex_exit(&connp->conn_lock); 15996 if (success) { 15997 err = ipif_resolver_up(ipif, 15998 Res_act_initial); 15999 if (err == EINPROGRESS) { 16000 freemsg(mp); 16001 return; 16002 } 16003 ASSERT(err != 0); 16004 mp1 = ipsq_pending_mp_get(ipsq, 16005 &connp); 16006 ASSERT(mp1 != NULL); 16007 } else { 16008 /* conn has started closing */ 16009 err = EINTR; 16010 } 16011 } else { /* Non XRESOLV interface */ 16012 (void) ipif_resolver_up(ipif, 16013 Res_act_initial); 16014 err = ipif_up_done_v6(ipif); 16015 } 16016 } 16017 } else if (ill->ill_net_type == IRE_IF_RESOLVER) { 16018 /* 16019 * ARP and other v4 external resolvers. 16020 * Leave the pending mblk intact so that 16021 * the ioctl completes in ip_rput(). 16022 */ 16023 mutex_enter(&connp->conn_lock); 16024 mutex_enter(&ill->ill_lock); 16025 success = ipsq_pending_mp_add(connp, ipif, q, mp1, 0); 16026 mutex_exit(&ill->ill_lock); 16027 mutex_exit(&connp->conn_lock); 16028 if (success) { 16029 err = ipif_resolver_up(ipif, Res_act_initial); 16030 if (err == EINPROGRESS) { 16031 freemsg(mp); 16032 return; 16033 } 16034 ASSERT(err != 0); 16035 mp1 = ipsq_pending_mp_get(ipsq, &connp); 16036 } else { 16037 /* The conn has started closing */ 16038 err = EINTR; 16039 } 16040 } else { 16041 /* 16042 * This one is complete. Reply to pending ioctl. 16043 */ 16044 (void) ipif_resolver_up(ipif, Res_act_initial); 16045 err = ipif_up_done(ipif); 16046 } 16047 16048 if ((err == 0) && (ill->ill_up_ipifs)) { 16049 err = ill_up_ipifs(ill, q, mp1); 16050 if (err == EINPROGRESS) { 16051 freemsg(mp); 16052 return; 16053 } 16054 } 16055 16056 if (ill->ill_up_ipifs) { 16057 ill_group_cleanup(ill); 16058 } 16059 16060 break; 16061 case DL_NOTIFY_IND: { 16062 dl_notify_ind_t *notify = (dl_notify_ind_t *)mp->b_rptr; 16063 ire_t *ire; 16064 boolean_t need_ire_walk_v4 = B_FALSE; 16065 boolean_t need_ire_walk_v6 = B_FALSE; 16066 16067 switch (notify->dl_notification) { 16068 case DL_NOTE_PHYS_ADDR: 16069 err = ill_set_phys_addr(ill, mp); 16070 break; 16071 16072 case DL_NOTE_FASTPATH_FLUSH: 16073 ill_fastpath_flush(ill); 16074 break; 16075 16076 case DL_NOTE_SDU_SIZE: 16077 /* 16078 * Change the MTU size of the interface, of all 16079 * attached ipif's, and of all relevant ire's. The 16080 * new value's a uint32_t at notify->dl_data. 16081 * Mtu change Vs. new ire creation - protocol below. 16082 * 16083 * a Mark the ipif as IPIF_CHANGING. 16084 * b Set the new mtu in the ipif. 16085 * c Change the ire_max_frag on all affected ires 16086 * d Unmark the IPIF_CHANGING 16087 * 16088 * To see how the protocol works, assume an interface 16089 * route is also being added simultaneously by 16090 * ip_rt_add and let 'ipif' be the ipif referenced by 16091 * the ire. If the ire is created before step a, 16092 * it will be cleaned up by step c. If the ire is 16093 * created after step d, it will see the new value of 16094 * ipif_mtu. Any attempt to create the ire between 16095 * steps a to d will fail because of the IPIF_CHANGING 16096 * flag. Note that ire_create() is passed a pointer to 16097 * the ipif_mtu, and not the value. During ire_add 16098 * under the bucket lock, the ire_max_frag of the 16099 * new ire being created is set from the ipif/ire from 16100 * which it is being derived. 16101 */ 16102 mutex_enter(&ill->ill_lock); 16103 ill->ill_max_frag = (uint_t)notify->dl_data; 16104 16105 /* 16106 * If an SIOCSLIFLNKINFO has changed the ill_max_mtu 16107 * leave it alone 16108 */ 16109 if (ill->ill_mtu_userspecified) { 16110 mutex_exit(&ill->ill_lock); 16111 break; 16112 } 16113 ill->ill_max_mtu = ill->ill_max_frag; 16114 if (ill->ill_isv6) { 16115 if (ill->ill_max_mtu < IPV6_MIN_MTU) 16116 ill->ill_max_mtu = IPV6_MIN_MTU; 16117 } else { 16118 if (ill->ill_max_mtu < IP_MIN_MTU) 16119 ill->ill_max_mtu = IP_MIN_MTU; 16120 } 16121 for (ipif = ill->ill_ipif; ipif != NULL; 16122 ipif = ipif->ipif_next) { 16123 /* 16124 * Don't override the mtu if the user 16125 * has explicitly set it. 16126 */ 16127 if (ipif->ipif_flags & IPIF_FIXEDMTU) 16128 continue; 16129 ipif->ipif_mtu = (uint_t)notify->dl_data; 16130 if (ipif->ipif_isv6) 16131 ire = ipif_to_ire_v6(ipif); 16132 else 16133 ire = ipif_to_ire(ipif); 16134 if (ire != NULL) { 16135 ire->ire_max_frag = ipif->ipif_mtu; 16136 ire_refrele(ire); 16137 } 16138 if (ipif->ipif_flags & IPIF_UP) { 16139 if (ill->ill_isv6) 16140 need_ire_walk_v6 = B_TRUE; 16141 else 16142 need_ire_walk_v4 = B_TRUE; 16143 } 16144 } 16145 mutex_exit(&ill->ill_lock); 16146 if (need_ire_walk_v4) 16147 ire_walk_v4(ill_mtu_change, (char *)ill, 16148 ALL_ZONES, ipst); 16149 if (need_ire_walk_v6) 16150 ire_walk_v6(ill_mtu_change, (char *)ill, 16151 ALL_ZONES, ipst); 16152 break; 16153 case DL_NOTE_LINK_UP: 16154 case DL_NOTE_LINK_DOWN: { 16155 /* 16156 * We are writer. ill / phyint / ipsq assocs stable. 16157 * The RUNNING flag reflects the state of the link. 16158 */ 16159 phyint_t *phyint = ill->ill_phyint; 16160 uint64_t new_phyint_flags; 16161 boolean_t changed = B_FALSE; 16162 boolean_t went_up; 16163 16164 went_up = notify->dl_notification == DL_NOTE_LINK_UP; 16165 mutex_enter(&phyint->phyint_lock); 16166 new_phyint_flags = went_up ? 16167 phyint->phyint_flags | PHYI_RUNNING : 16168 phyint->phyint_flags & ~PHYI_RUNNING; 16169 if (new_phyint_flags != phyint->phyint_flags) { 16170 phyint->phyint_flags = new_phyint_flags; 16171 changed = B_TRUE; 16172 } 16173 mutex_exit(&phyint->phyint_lock); 16174 /* 16175 * ill_restart_dad handles the DAD restart and routing 16176 * socket notification logic. 16177 */ 16178 if (changed) { 16179 ill_restart_dad(phyint->phyint_illv4, went_up); 16180 ill_restart_dad(phyint->phyint_illv6, went_up); 16181 } 16182 break; 16183 } 16184 case DL_NOTE_PROMISC_ON_PHYS: 16185 IPSECHW_DEBUG(IPSECHW_PKT, ("ip_rput_dlpi_writer: " 16186 "got a DL_NOTE_PROMISC_ON_PHYS\n")); 16187 mutex_enter(&ill->ill_lock); 16188 ill->ill_promisc_on_phys = B_TRUE; 16189 mutex_exit(&ill->ill_lock); 16190 break; 16191 case DL_NOTE_PROMISC_OFF_PHYS: 16192 IPSECHW_DEBUG(IPSECHW_PKT, ("ip_rput_dlpi_writer: " 16193 "got a DL_NOTE_PROMISC_OFF_PHYS\n")); 16194 mutex_enter(&ill->ill_lock); 16195 ill->ill_promisc_on_phys = B_FALSE; 16196 mutex_exit(&ill->ill_lock); 16197 break; 16198 case DL_NOTE_CAPAB_RENEG: 16199 /* 16200 * Something changed on the driver side. 16201 * It wants us to renegotiate the capabilities 16202 * on this ill. The most likely cause is the 16203 * aggregation interface under us where a 16204 * port got added or went away. 16205 * 16206 * We reset the capabilities and set the 16207 * state to IDS_RENG so that when the ack 16208 * comes back, we can start the 16209 * renegotiation process. 16210 */ 16211 ill_capability_reset(ill); 16212 ill->ill_dlpi_capab_state = IDS_RENEG; 16213 break; 16214 default: 16215 ip0dbg(("ip_rput_dlpi_writer: unknown notification " 16216 "type 0x%x for DL_NOTIFY_IND\n", 16217 notify->dl_notification)); 16218 break; 16219 } 16220 16221 /* 16222 * As this is an asynchronous operation, we 16223 * should not call ill_dlpi_done 16224 */ 16225 break; 16226 } 16227 case DL_NOTIFY_ACK: { 16228 dl_notify_ack_t *noteack = (dl_notify_ack_t *)mp->b_rptr; 16229 16230 if (noteack->dl_notifications & DL_NOTE_LINK_UP) 16231 ill->ill_note_link = 1; 16232 ill_dlpi_done(ill, DL_NOTIFY_REQ); 16233 break; 16234 } 16235 case DL_PHYS_ADDR_ACK: { 16236 /* 16237 * As part of plumbing the interface via SIOCSLIFNAME, 16238 * ill_dl_phys() will queue a series of DL_PHYS_ADDR_REQs, 16239 * whose answers we receive here. As each answer is received, 16240 * we call ill_dlpi_done() to dispatch the next request as 16241 * we're processing the current one. Once all answers have 16242 * been received, we use ipsq_pending_mp_get() to dequeue the 16243 * outstanding IOCTL and reply to it. (Because ill_dl_phys() 16244 * is invoked from an ill queue, conn_oper_pending_ill is not 16245 * available, but we know the ioctl is pending on ill_wq.) 16246 */ 16247 uint_t paddrlen, paddroff; 16248 16249 paddrreq = ill->ill_phys_addr_pend; 16250 paddrlen = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_length; 16251 paddroff = ((dl_phys_addr_ack_t *)mp->b_rptr)->dl_addr_offset; 16252 16253 ill_dlpi_done(ill, DL_PHYS_ADDR_REQ); 16254 if (paddrreq == DL_IPV6_TOKEN) { 16255 /* 16256 * bcopy to low-order bits of ill_token 16257 * 16258 * XXX Temporary hack - currently, all known tokens 16259 * are 64 bits, so I'll cheat for the moment. 16260 */ 16261 bcopy(mp->b_rptr + paddroff, 16262 &ill->ill_token.s6_addr32[2], paddrlen); 16263 ill->ill_token_length = paddrlen; 16264 break; 16265 } else if (paddrreq == DL_IPV6_LINK_LAYER_ADDR) { 16266 ASSERT(ill->ill_nd_lla_mp == NULL); 16267 ill_set_ndmp(ill, mp, paddroff, paddrlen); 16268 mp = NULL; 16269 break; 16270 } 16271 16272 ASSERT(paddrreq == DL_CURR_PHYS_ADDR); 16273 ASSERT(ill->ill_phys_addr_mp == NULL); 16274 if (!ill->ill_ifname_pending) 16275 break; 16276 ill->ill_ifname_pending = 0; 16277 if (!ioctl_aborted) 16278 mp1 = ipsq_pending_mp_get(ipsq, &connp); 16279 if (mp1 != NULL) { 16280 ASSERT(connp == NULL); 16281 q = ill->ill_wq; 16282 } 16283 /* 16284 * If any error acks received during the plumbing sequence, 16285 * ill_ifname_pending_err will be set. Break out and send up 16286 * the error to the pending ioctl. 16287 */ 16288 if (ill->ill_ifname_pending_err != 0) { 16289 err = ill->ill_ifname_pending_err; 16290 ill->ill_ifname_pending_err = 0; 16291 break; 16292 } 16293 16294 ill->ill_phys_addr_mp = mp; 16295 ill->ill_phys_addr = mp->b_rptr + paddroff; 16296 mp = NULL; 16297 16298 /* 16299 * If paddrlen is zero, the DLPI provider doesn't support 16300 * physical addresses. The other two tests were historical 16301 * workarounds for bugs in our former PPP implementation, but 16302 * now other things have grown dependencies on them -- e.g., 16303 * the tun module specifies a dl_addr_length of zero in its 16304 * DL_BIND_ACK, but then specifies an incorrect value in its 16305 * DL_PHYS_ADDR_ACK. These bogus checks need to be removed, 16306 * but only after careful testing ensures that all dependent 16307 * broken DLPI providers have been fixed. 16308 */ 16309 if (paddrlen == 0 || ill->ill_phys_addr_length == 0 || 16310 ill->ill_phys_addr_length == IP_ADDR_LEN) { 16311 ill->ill_phys_addr = NULL; 16312 } else if (paddrlen != ill->ill_phys_addr_length) { 16313 ip0dbg(("DL_PHYS_ADDR_ACK: got addrlen %d, expected %d", 16314 paddrlen, ill->ill_phys_addr_length)); 16315 err = EINVAL; 16316 break; 16317 } 16318 16319 if (ill->ill_nd_lla_mp == NULL) { 16320 if ((mp_hw = copyb(ill->ill_phys_addr_mp)) == NULL) { 16321 err = ENOMEM; 16322 break; 16323 } 16324 ill_set_ndmp(ill, mp_hw, paddroff, paddrlen); 16325 } 16326 16327 /* 16328 * Set the interface token. If the zeroth interface address 16329 * is unspecified, then set it to the link local address. 16330 */ 16331 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) 16332 (void) ill_setdefaulttoken(ill); 16333 16334 ASSERT(ill->ill_ipif->ipif_id == 0); 16335 if (ipif != NULL && 16336 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 16337 (void) ipif_setlinklocal(ipif); 16338 break; 16339 } 16340 case DL_OK_ACK: 16341 ip2dbg(("DL_OK_ACK %s (0x%x)\n", 16342 dlpi_prim_str((int)dloa->dl_correct_primitive), 16343 dloa->dl_correct_primitive)); 16344 switch (dloa->dl_correct_primitive) { 16345 case DL_UNBIND_REQ: 16346 case DL_ATTACH_REQ: 16347 case DL_DETACH_REQ: 16348 ill_dlpi_done(ill, dloa->dl_correct_primitive); 16349 break; 16350 } 16351 break; 16352 default: 16353 break; 16354 } 16355 16356 freemsg(mp); 16357 if (mp1 != NULL) { 16358 /* 16359 * The operation must complete without EINPROGRESS 16360 * since ipsq_pending_mp_get() has removed the mblk 16361 * from ipsq_pending_mp. Otherwise, the operation 16362 * will be stuck forever in the ipsq. 16363 */ 16364 ASSERT(err != EINPROGRESS); 16365 16366 switch (ipsq->ipsq_current_ioctl) { 16367 case 0: 16368 ipsq_current_finish(ipsq); 16369 break; 16370 16371 case SIOCLIFADDIF: 16372 case SIOCSLIFNAME: 16373 ip_ioctl_finish(q, mp1, err, COPYOUT, ipsq); 16374 break; 16375 16376 default: 16377 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq); 16378 break; 16379 } 16380 } 16381 } 16382 16383 /* 16384 * ip_rput_other is called by ip_rput to handle messages modifying the global 16385 * state in IP. Normally called as writer. Exception SIOCGTUNPARAM (shared) 16386 */ 16387 /* ARGSUSED */ 16388 void 16389 ip_rput_other(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 16390 { 16391 ill_t *ill; 16392 struct iocblk *iocp; 16393 mblk_t *mp1; 16394 conn_t *connp = NULL; 16395 16396 ip1dbg(("ip_rput_other ")); 16397 ill = (ill_t *)q->q_ptr; 16398 /* 16399 * This routine is not a writer in the case of SIOCGTUNPARAM 16400 * in which case ipsq is NULL. 16401 */ 16402 if (ipsq != NULL) { 16403 ASSERT(IAM_WRITER_IPSQ(ipsq)); 16404 ASSERT(ipsq == ill->ill_phyint->phyint_ipsq); 16405 } 16406 16407 switch (mp->b_datap->db_type) { 16408 case M_ERROR: 16409 case M_HANGUP: 16410 /* 16411 * The device has a problem. We force the ILL down. It can 16412 * be brought up again manually using SIOCSIFFLAGS (via 16413 * ifconfig or equivalent). 16414 */ 16415 ASSERT(ipsq != NULL); 16416 if (mp->b_rptr < mp->b_wptr) 16417 ill->ill_error = (int)(*mp->b_rptr & 0xFF); 16418 if (ill->ill_error == 0) 16419 ill->ill_error = ENXIO; 16420 if (!ill_down_start(q, mp)) 16421 return; 16422 ipif_all_down_tail(ipsq, q, mp, NULL); 16423 break; 16424 case M_IOCACK: 16425 iocp = (struct iocblk *)mp->b_rptr; 16426 ASSERT(iocp->ioc_cmd != DL_IOC_HDR_INFO); 16427 switch (iocp->ioc_cmd) { 16428 case SIOCSTUNPARAM: 16429 case OSIOCSTUNPARAM: 16430 ASSERT(ipsq != NULL); 16431 /* 16432 * Finish socket ioctl passed through to tun. 16433 * We should have an IOCTL waiting on this. 16434 */ 16435 mp1 = ipsq_pending_mp_get(ipsq, &connp); 16436 if (ill->ill_isv6) { 16437 struct iftun_req *ta; 16438 16439 /* 16440 * if a source or destination is 16441 * being set, try and set the link 16442 * local address for the tunnel 16443 */ 16444 ta = (struct iftun_req *)mp->b_cont-> 16445 b_cont->b_rptr; 16446 if (ta->ifta_flags & (IFTUN_SRC | IFTUN_DST)) { 16447 ipif_set_tun_llink(ill, ta); 16448 } 16449 16450 } 16451 if (mp1 != NULL) { 16452 /* 16453 * Now copy back the b_next/b_prev used by 16454 * mi code for the mi_copy* functions. 16455 * See ip_sioctl_tunparam() for the reason. 16456 * Also protect against missing b_cont. 16457 */ 16458 if (mp->b_cont != NULL) { 16459 mp->b_cont->b_next = 16460 mp1->b_cont->b_next; 16461 mp->b_cont->b_prev = 16462 mp1->b_cont->b_prev; 16463 } 16464 inet_freemsg(mp1); 16465 ASSERT(connp != NULL); 16466 ip_ioctl_finish(CONNP_TO_WQ(connp), mp, 16467 iocp->ioc_error, NO_COPYOUT, ipsq); 16468 } else { 16469 ASSERT(connp == NULL); 16470 putnext(q, mp); 16471 } 16472 break; 16473 case SIOCGTUNPARAM: 16474 case OSIOCGTUNPARAM: 16475 /* 16476 * This is really M_IOCDATA from the tunnel driver. 16477 * convert back and complete the ioctl. 16478 * We should have an IOCTL waiting on this. 16479 */ 16480 mp1 = ill_pending_mp_get(ill, &connp, iocp->ioc_id); 16481 if (mp1) { 16482 /* 16483 * Now copy back the b_next/b_prev used by 16484 * mi code for the mi_copy* functions. 16485 * See ip_sioctl_tunparam() for the reason. 16486 * Also protect against missing b_cont. 16487 */ 16488 if (mp->b_cont != NULL) { 16489 mp->b_cont->b_next = 16490 mp1->b_cont->b_next; 16491 mp->b_cont->b_prev = 16492 mp1->b_cont->b_prev; 16493 } 16494 inet_freemsg(mp1); 16495 if (iocp->ioc_error == 0) 16496 mp->b_datap->db_type = M_IOCDATA; 16497 ASSERT(connp != NULL); 16498 ip_ioctl_finish(CONNP_TO_WQ(connp), mp, 16499 iocp->ioc_error, COPYOUT, NULL); 16500 } else { 16501 ASSERT(connp == NULL); 16502 putnext(q, mp); 16503 } 16504 break; 16505 default: 16506 break; 16507 } 16508 break; 16509 case M_IOCNAK: 16510 iocp = (struct iocblk *)mp->b_rptr; 16511 16512 switch (iocp->ioc_cmd) { 16513 int mode; 16514 16515 case DL_IOC_HDR_INFO: 16516 /* 16517 * If this was the first attempt turn of the 16518 * fastpath probing. 16519 */ 16520 mutex_enter(&ill->ill_lock); 16521 if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS) { 16522 ill->ill_dlpi_fastpath_state = IDS_FAILED; 16523 mutex_exit(&ill->ill_lock); 16524 ill_fastpath_nack(ill); 16525 ip1dbg(("ip_rput: DLPI fastpath off on " 16526 "interface %s\n", 16527 ill->ill_name)); 16528 } else { 16529 mutex_exit(&ill->ill_lock); 16530 } 16531 freemsg(mp); 16532 break; 16533 case SIOCSTUNPARAM: 16534 case OSIOCSTUNPARAM: 16535 ASSERT(ipsq != NULL); 16536 /* 16537 * Finish socket ioctl passed through to tun 16538 * We should have an IOCTL waiting on this. 16539 */ 16540 /* FALLTHRU */ 16541 case SIOCGTUNPARAM: 16542 case OSIOCGTUNPARAM: 16543 /* 16544 * This is really M_IOCDATA from the tunnel driver. 16545 * convert back and complete the ioctl. 16546 * We should have an IOCTL waiting on this. 16547 */ 16548 if (iocp->ioc_cmd == SIOCGTUNPARAM || 16549 iocp->ioc_cmd == OSIOCGTUNPARAM) { 16550 mp1 = ill_pending_mp_get(ill, &connp, 16551 iocp->ioc_id); 16552 mode = COPYOUT; 16553 ipsq = NULL; 16554 } else { 16555 mp1 = ipsq_pending_mp_get(ipsq, &connp); 16556 mode = NO_COPYOUT; 16557 } 16558 if (mp1 != NULL) { 16559 /* 16560 * Now copy back the b_next/b_prev used by 16561 * mi code for the mi_copy* functions. 16562 * See ip_sioctl_tunparam() for the reason. 16563 * Also protect against missing b_cont. 16564 */ 16565 if (mp->b_cont != NULL) { 16566 mp->b_cont->b_next = 16567 mp1->b_cont->b_next; 16568 mp->b_cont->b_prev = 16569 mp1->b_cont->b_prev; 16570 } 16571 inet_freemsg(mp1); 16572 if (iocp->ioc_error == 0) 16573 iocp->ioc_error = EINVAL; 16574 ASSERT(connp != NULL); 16575 ip_ioctl_finish(CONNP_TO_WQ(connp), mp, 16576 iocp->ioc_error, mode, ipsq); 16577 } else { 16578 ASSERT(connp == NULL); 16579 putnext(q, mp); 16580 } 16581 break; 16582 default: 16583 break; 16584 } 16585 default: 16586 break; 16587 } 16588 } 16589 16590 /* 16591 * NOTE : This function does not ire_refrele the ire argument passed in. 16592 * 16593 * IPQoS notes 16594 * IP policy is invoked twice for a forwarded packet, once on the read side 16595 * and again on the write side if both, IPP_FWD_IN and IPP_FWD_OUT are 16596 * enabled. An additional parameter, in_ill, has been added for this purpose. 16597 * Note that in_ill could be NULL when called from ip_rput_forward_multicast 16598 * because ip_mroute drops this information. 16599 * 16600 */ 16601 void 16602 ip_rput_forward(ire_t *ire, ipha_t *ipha, mblk_t *mp, ill_t *in_ill) 16603 { 16604 uint32_t pkt_len; 16605 queue_t *q; 16606 uint32_t sum; 16607 #define rptr ((uchar_t *)ipha) 16608 uint32_t max_frag; 16609 uint32_t ill_index; 16610 ill_t *out_ill; 16611 mib2_ipIfStatsEntry_t *mibptr; 16612 ip_stack_t *ipst = in_ill->ill_ipst; 16613 16614 /* Get the ill_index of the incoming ILL */ 16615 ill_index = (in_ill != NULL) ? in_ill->ill_phyint->phyint_ifindex : 0; 16616 mibptr = (in_ill != NULL) ? in_ill->ill_ip_mib : &ipst->ips_ip_mib; 16617 16618 /* Initiate Read side IPPF processing */ 16619 if (IPP_ENABLED(IPP_FWD_IN, ipst)) { 16620 ip_process(IPP_FWD_IN, &mp, ill_index); 16621 if (mp == NULL) { 16622 ip2dbg(("ip_rput_forward: pkt dropped/deferred "\ 16623 "during IPPF processing\n")); 16624 return; 16625 } 16626 } 16627 16628 pkt_len = ntohs(ipha->ipha_length); 16629 16630 /* Adjust the checksum to reflect the ttl decrement. */ 16631 sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST; 16632 ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16)); 16633 16634 if (ipha->ipha_ttl-- <= 1) { 16635 if (ip_csum_hdr(ipha)) { 16636 BUMP_MIB(mibptr, ipIfStatsInCksumErrs); 16637 goto drop_pkt; 16638 } 16639 /* 16640 * Note: ire_stq this will be NULL for multicast 16641 * datagrams using the long path through arp (the IRE 16642 * is not an IRE_CACHE). This should not cause 16643 * problems since we don't generate ICMP errors for 16644 * multicast packets. 16645 */ 16646 BUMP_MIB(mibptr, ipIfStatsForwProhibits); 16647 q = ire->ire_stq; 16648 if (q != NULL) { 16649 /* Sent by forwarding path, and router is global zone */ 16650 icmp_time_exceeded(q, mp, ICMP_TTL_EXCEEDED, 16651 GLOBAL_ZONEID, ipst); 16652 } else 16653 freemsg(mp); 16654 return; 16655 } 16656 16657 /* 16658 * Don't forward if the interface is down 16659 */ 16660 if (ire->ire_ipif->ipif_ill->ill_ipif_up_count == 0) { 16661 BUMP_MIB(mibptr, ipIfStatsInDiscards); 16662 ip2dbg(("ip_rput_forward:interface is down\n")); 16663 goto drop_pkt; 16664 } 16665 16666 /* Get the ill_index of the outgoing ILL */ 16667 ill_index = ire->ire_ipif->ipif_ill->ill_phyint->phyint_ifindex; 16668 16669 out_ill = ire->ire_ipif->ipif_ill; 16670 16671 DTRACE_PROBE4(ip4__forwarding__start, 16672 ill_t *, in_ill, ill_t *, out_ill, ipha_t *, ipha, mblk_t *, mp); 16673 16674 FW_HOOKS(ipst->ips_ip4_forwarding_event, 16675 ipst->ips_ipv4firewall_forwarding, 16676 in_ill, out_ill, ipha, mp, mp, ipst); 16677 16678 DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp); 16679 16680 if (mp == NULL) 16681 return; 16682 pkt_len = ntohs(ipha->ipha_length); 16683 16684 if (is_system_labeled()) { 16685 mblk_t *mp1; 16686 16687 if ((mp1 = tsol_ip_forward(ire, mp)) == NULL) { 16688 BUMP_MIB(mibptr, ipIfStatsForwProhibits); 16689 goto drop_pkt; 16690 } 16691 /* Size may have changed */ 16692 mp = mp1; 16693 ipha = (ipha_t *)mp->b_rptr; 16694 pkt_len = ntohs(ipha->ipha_length); 16695 } 16696 16697 /* Check if there are options to update */ 16698 if (!IS_SIMPLE_IPH(ipha)) { 16699 if (ip_csum_hdr(ipha)) { 16700 BUMP_MIB(mibptr, ipIfStatsInCksumErrs); 16701 goto drop_pkt; 16702 } 16703 if (ip_rput_forward_options(mp, ipha, ire, ipst)) { 16704 BUMP_MIB(mibptr, ipIfStatsForwProhibits); 16705 return; 16706 } 16707 16708 ipha->ipha_hdr_checksum = 0; 16709 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 16710 } 16711 max_frag = ire->ire_max_frag; 16712 if (pkt_len > max_frag) { 16713 /* 16714 * It needs fragging on its way out. We haven't 16715 * verified the header checksum yet. Since we 16716 * are going to put a surely good checksum in the 16717 * outgoing header, we have to make sure that it 16718 * was good coming in. 16719 */ 16720 if (ip_csum_hdr(ipha)) { 16721 BUMP_MIB(mibptr, ipIfStatsInCksumErrs); 16722 goto drop_pkt; 16723 } 16724 /* Initiate Write side IPPF processing */ 16725 if (IPP_ENABLED(IPP_FWD_OUT, ipst)) { 16726 ip_process(IPP_FWD_OUT, &mp, ill_index); 16727 if (mp == NULL) { 16728 ip2dbg(("ip_rput_forward: pkt dropped/deferred"\ 16729 " during IPPF processing\n")); 16730 return; 16731 } 16732 } 16733 ip_wput_frag(ire, mp, IB_PKT, max_frag, 0, GLOBAL_ZONEID, ipst); 16734 ip2dbg(("ip_rput_forward:sent to ip_wput_frag\n")); 16735 return; 16736 } 16737 16738 DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL, 16739 ill_t *, out_ill, ipha_t *, ipha, mblk_t *, mp); 16740 FW_HOOKS(ipst->ips_ip4_physical_out_event, 16741 ipst->ips_ipv4firewall_physical_out, 16742 NULL, out_ill, ipha, mp, mp, ipst); 16743 DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp); 16744 if (mp == NULL) 16745 return; 16746 16747 mp->b_prev = (mblk_t *)IPP_FWD_OUT; 16748 ip1dbg(("ip_rput_forward: Calling ip_xmit_v4\n")); 16749 (void) ip_xmit_v4(mp, ire, NULL, B_FALSE); 16750 /* ip_xmit_v4 always consumes the packet */ 16751 return; 16752 16753 drop_pkt:; 16754 ip1dbg(("ip_rput_forward: drop pkt\n")); 16755 freemsg(mp); 16756 #undef rptr 16757 } 16758 16759 void 16760 ip_rput_forward_multicast(ipaddr_t dst, mblk_t *mp, ipif_t *ipif) 16761 { 16762 ire_t *ire; 16763 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 16764 16765 ASSERT(!ipif->ipif_isv6); 16766 /* 16767 * Find an IRE which matches the destination and the outgoing 16768 * queue in the cache table. All we need is an IRE_CACHE which 16769 * is pointing at ipif->ipif_ill. If it is part of some ill group, 16770 * then it is enough to have some IRE_CACHE in the group. 16771 */ 16772 if (ipif->ipif_flags & IPIF_POINTOPOINT) 16773 dst = ipif->ipif_pp_dst_addr; 16774 16775 ire = ire_ctable_lookup(dst, 0, 0, ipif, ALL_ZONES, MBLK_GETLABEL(mp), 16776 MATCH_IRE_ILL_GROUP | MATCH_IRE_SECATTR, ipst); 16777 if (ire == NULL) { 16778 /* 16779 * Mark this packet to make it be delivered to 16780 * ip_rput_forward after the new ire has been 16781 * created. 16782 */ 16783 mp->b_prev = NULL; 16784 mp->b_next = mp; 16785 ip_newroute_ipif(ipif->ipif_ill->ill_wq, mp, ipif, dst, 16786 NULL, 0, GLOBAL_ZONEID, &zero_info); 16787 } else { 16788 ip_rput_forward(ire, (ipha_t *)mp->b_rptr, mp, NULL); 16789 IRE_REFRELE(ire); 16790 } 16791 } 16792 16793 /* Update any source route, record route or timestamp options */ 16794 static int 16795 ip_rput_forward_options(mblk_t *mp, ipha_t *ipha, ire_t *ire, ip_stack_t *ipst) 16796 { 16797 ipoptp_t opts; 16798 uchar_t *opt; 16799 uint8_t optval; 16800 uint8_t optlen; 16801 ipaddr_t dst; 16802 uint32_t ts; 16803 ire_t *dst_ire = NULL; 16804 ire_t *tmp_ire = NULL; 16805 timestruc_t now; 16806 16807 ip2dbg(("ip_rput_forward_options\n")); 16808 dst = ipha->ipha_dst; 16809 for (optval = ipoptp_first(&opts, ipha); 16810 optval != IPOPT_EOL; 16811 optval = ipoptp_next(&opts)) { 16812 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 16813 opt = opts.ipoptp_cur; 16814 optlen = opts.ipoptp_len; 16815 ip2dbg(("ip_rput_forward_options: opt %d, len %d\n", 16816 optval, opts.ipoptp_len)); 16817 switch (optval) { 16818 uint32_t off; 16819 case IPOPT_SSRR: 16820 case IPOPT_LSRR: 16821 /* Check if adminstratively disabled */ 16822 if (!ipst->ips_ip_forward_src_routed) { 16823 if (ire->ire_stq != NULL) { 16824 /* 16825 * Sent by forwarding path, and router 16826 * is global zone 16827 */ 16828 icmp_unreachable(ire->ire_stq, mp, 16829 ICMP_SOURCE_ROUTE_FAILED, 16830 GLOBAL_ZONEID, ipst); 16831 } else { 16832 ip0dbg(("ip_rput_forward_options: " 16833 "unable to send unreach\n")); 16834 freemsg(mp); 16835 } 16836 return (-1); 16837 } 16838 16839 dst_ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, 16840 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 16841 if (dst_ire == NULL) { 16842 /* 16843 * Must be partial since ip_rput_options 16844 * checked for strict. 16845 */ 16846 break; 16847 } 16848 off = opt[IPOPT_OFFSET]; 16849 off--; 16850 redo_srr: 16851 if (optlen < IP_ADDR_LEN || 16852 off > optlen - IP_ADDR_LEN) { 16853 /* End of source route */ 16854 ip1dbg(( 16855 "ip_rput_forward_options: end of SR\n")); 16856 ire_refrele(dst_ire); 16857 break; 16858 } 16859 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 16860 bcopy(&ire->ire_src_addr, (char *)opt + off, 16861 IP_ADDR_LEN); 16862 ip1dbg(("ip_rput_forward_options: next hop 0x%x\n", 16863 ntohl(dst))); 16864 16865 /* 16866 * Check if our address is present more than 16867 * once as consecutive hops in source route. 16868 */ 16869 tmp_ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, 16870 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 16871 if (tmp_ire != NULL) { 16872 ire_refrele(tmp_ire); 16873 off += IP_ADDR_LEN; 16874 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 16875 goto redo_srr; 16876 } 16877 ipha->ipha_dst = dst; 16878 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 16879 ire_refrele(dst_ire); 16880 break; 16881 case IPOPT_RR: 16882 off = opt[IPOPT_OFFSET]; 16883 off--; 16884 if (optlen < IP_ADDR_LEN || 16885 off > optlen - IP_ADDR_LEN) { 16886 /* No more room - ignore */ 16887 ip1dbg(( 16888 "ip_rput_forward_options: end of RR\n")); 16889 break; 16890 } 16891 bcopy(&ire->ire_src_addr, (char *)opt + off, 16892 IP_ADDR_LEN); 16893 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 16894 break; 16895 case IPOPT_TS: 16896 /* Insert timestamp if there is room */ 16897 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 16898 case IPOPT_TS_TSONLY: 16899 off = IPOPT_TS_TIMELEN; 16900 break; 16901 case IPOPT_TS_PRESPEC: 16902 case IPOPT_TS_PRESPEC_RFC791: 16903 /* Verify that the address matched */ 16904 off = opt[IPOPT_OFFSET] - 1; 16905 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 16906 dst_ire = ire_ctable_lookup(dst, 0, 16907 IRE_LOCAL, NULL, ALL_ZONES, NULL, 16908 MATCH_IRE_TYPE, ipst); 16909 if (dst_ire == NULL) { 16910 /* Not for us */ 16911 break; 16912 } 16913 ire_refrele(dst_ire); 16914 /* FALLTHRU */ 16915 case IPOPT_TS_TSANDADDR: 16916 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 16917 break; 16918 default: 16919 /* 16920 * ip_*put_options should have already 16921 * dropped this packet. 16922 */ 16923 cmn_err(CE_PANIC, "ip_rput_forward_options: " 16924 "unknown IT - bug in ip_rput_options?\n"); 16925 return (0); /* Keep "lint" happy */ 16926 } 16927 if (opt[IPOPT_OFFSET] - 1 + off > optlen) { 16928 /* Increase overflow counter */ 16929 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1; 16930 opt[IPOPT_POS_OV_FLG] = 16931 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) | 16932 (off << 4)); 16933 break; 16934 } 16935 off = opt[IPOPT_OFFSET] - 1; 16936 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 16937 case IPOPT_TS_PRESPEC: 16938 case IPOPT_TS_PRESPEC_RFC791: 16939 case IPOPT_TS_TSANDADDR: 16940 bcopy(&ire->ire_src_addr, 16941 (char *)opt + off, IP_ADDR_LEN); 16942 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 16943 /* FALLTHRU */ 16944 case IPOPT_TS_TSONLY: 16945 off = opt[IPOPT_OFFSET] - 1; 16946 /* Compute # of milliseconds since midnight */ 16947 gethrestime(&now); 16948 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 16949 now.tv_nsec / (NANOSEC / MILLISEC); 16950 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN); 16951 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN; 16952 break; 16953 } 16954 break; 16955 } 16956 } 16957 return (0); 16958 } 16959 16960 /* 16961 * This is called after processing at least one of AH/ESP headers. 16962 * 16963 * NOTE: the ill corresponding to ipsec_in_ill_index may not be 16964 * the actual, physical interface on which the packet was received, 16965 * but, when ip_strict_dst_multihoming is set to 1, could be the 16966 * interface which had the ipha_dst configured when the packet went 16967 * through ip_rput. The ill_index corresponding to the recv_ill 16968 * is saved in ipsec_in_rill_index 16969 */ 16970 void 16971 ip_fanout_proto_again(mblk_t *ipsec_mp, ill_t *ill, ill_t *recv_ill, ire_t *ire) 16972 { 16973 mblk_t *mp; 16974 ipaddr_t dst; 16975 in6_addr_t *v6dstp; 16976 ipha_t *ipha; 16977 ip6_t *ip6h; 16978 ipsec_in_t *ii; 16979 boolean_t ill_need_rele = B_FALSE; 16980 boolean_t rill_need_rele = B_FALSE; 16981 boolean_t ire_need_rele = B_FALSE; 16982 netstack_t *ns; 16983 ip_stack_t *ipst; 16984 16985 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 16986 ASSERT(ii->ipsec_in_ill_index != 0); 16987 ns = ii->ipsec_in_ns; 16988 ASSERT(ii->ipsec_in_ns != NULL); 16989 ipst = ns->netstack_ip; 16990 16991 mp = ipsec_mp->b_cont; 16992 ASSERT(mp != NULL); 16993 16994 16995 if (ill == NULL) { 16996 ASSERT(recv_ill == NULL); 16997 /* 16998 * We need to get the original queue on which ip_rput_local 16999 * or ip_rput_data_v6 was called. 17000 */ 17001 ill = ill_lookup_on_ifindex(ii->ipsec_in_ill_index, 17002 !ii->ipsec_in_v4, NULL, NULL, NULL, NULL, ipst); 17003 ill_need_rele = B_TRUE; 17004 17005 if (ii->ipsec_in_ill_index != ii->ipsec_in_rill_index) { 17006 recv_ill = ill_lookup_on_ifindex( 17007 ii->ipsec_in_rill_index, !ii->ipsec_in_v4, 17008 NULL, NULL, NULL, NULL, ipst); 17009 rill_need_rele = B_TRUE; 17010 } else { 17011 recv_ill = ill; 17012 } 17013 17014 if ((ill == NULL) || (recv_ill == NULL)) { 17015 ip0dbg(("ip_fanout_proto_again: interface " 17016 "disappeared\n")); 17017 if (ill != NULL) 17018 ill_refrele(ill); 17019 if (recv_ill != NULL) 17020 ill_refrele(recv_ill); 17021 freemsg(ipsec_mp); 17022 return; 17023 } 17024 } 17025 17026 ASSERT(ill != NULL && recv_ill != NULL); 17027 17028 if (mp->b_datap->db_type == M_CTL) { 17029 /* 17030 * AH/ESP is returning the ICMP message after 17031 * removing their headers. Fanout again till 17032 * it gets to the right protocol. 17033 */ 17034 if (ii->ipsec_in_v4) { 17035 icmph_t *icmph; 17036 int iph_hdr_length; 17037 int hdr_length; 17038 17039 ipha = (ipha_t *)mp->b_rptr; 17040 iph_hdr_length = IPH_HDR_LENGTH(ipha); 17041 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 17042 ipha = (ipha_t *)&icmph[1]; 17043 hdr_length = IPH_HDR_LENGTH(ipha); 17044 /* 17045 * icmp_inbound_error_fanout may need to do pullupmsg. 17046 * Reset the type to M_DATA. 17047 */ 17048 mp->b_datap->db_type = M_DATA; 17049 icmp_inbound_error_fanout(ill->ill_rq, ill, ipsec_mp, 17050 icmph, ipha, iph_hdr_length, hdr_length, B_TRUE, 17051 B_FALSE, ill, ii->ipsec_in_zoneid); 17052 } else { 17053 icmp6_t *icmp6; 17054 int hdr_length; 17055 17056 ip6h = (ip6_t *)mp->b_rptr; 17057 /* Don't call hdr_length_v6() unless you have to. */ 17058 if (ip6h->ip6_nxt != IPPROTO_ICMPV6) 17059 hdr_length = ip_hdr_length_v6(mp, ip6h); 17060 else 17061 hdr_length = IPV6_HDR_LEN; 17062 17063 icmp6 = (icmp6_t *)(&mp->b_rptr[hdr_length]); 17064 /* 17065 * icmp_inbound_error_fanout_v6 may need to do 17066 * pullupmsg. Reset the type to M_DATA. 17067 */ 17068 mp->b_datap->db_type = M_DATA; 17069 icmp_inbound_error_fanout_v6(ill->ill_rq, ipsec_mp, 17070 ip6h, icmp6, ill, B_TRUE, ii->ipsec_in_zoneid); 17071 } 17072 if (ill_need_rele) 17073 ill_refrele(ill); 17074 if (rill_need_rele) 17075 ill_refrele(recv_ill); 17076 return; 17077 } 17078 17079 if (ii->ipsec_in_v4) { 17080 ipha = (ipha_t *)mp->b_rptr; 17081 dst = ipha->ipha_dst; 17082 if (CLASSD(dst)) { 17083 /* 17084 * Multicast has to be delivered to all streams. 17085 */ 17086 dst = INADDR_BROADCAST; 17087 } 17088 17089 if (ire == NULL) { 17090 ire = ire_cache_lookup(dst, ii->ipsec_in_zoneid, 17091 MBLK_GETLABEL(mp), ipst); 17092 if (ire == NULL) { 17093 if (ill_need_rele) 17094 ill_refrele(ill); 17095 if (rill_need_rele) 17096 ill_refrele(recv_ill); 17097 ip1dbg(("ip_fanout_proto_again: " 17098 "IRE not found")); 17099 freemsg(ipsec_mp); 17100 return; 17101 } 17102 ire_need_rele = B_TRUE; 17103 } 17104 17105 switch (ipha->ipha_protocol) { 17106 case IPPROTO_UDP: 17107 ip_udp_input(ill->ill_rq, ipsec_mp, ipha, ire, 17108 recv_ill); 17109 if (ire_need_rele) 17110 ire_refrele(ire); 17111 break; 17112 case IPPROTO_TCP: 17113 if (!ire_need_rele) 17114 IRE_REFHOLD(ire); 17115 mp = ip_tcp_input(mp, ipha, ill, B_TRUE, 17116 ire, ipsec_mp, 0, ill->ill_rq, NULL); 17117 IRE_REFRELE(ire); 17118 if (mp != NULL) 17119 squeue_enter_chain(GET_SQUEUE(mp), mp, 17120 mp, 1, SQTAG_IP_PROTO_AGAIN); 17121 break; 17122 case IPPROTO_SCTP: 17123 if (!ire_need_rele) 17124 IRE_REFHOLD(ire); 17125 ip_sctp_input(mp, ipha, ill, B_TRUE, ire, 17126 ipsec_mp, 0, ill->ill_rq, dst); 17127 break; 17128 default: 17129 ip_proto_input(ill->ill_rq, ipsec_mp, ipha, ire, 17130 recv_ill); 17131 if (ire_need_rele) 17132 ire_refrele(ire); 17133 break; 17134 } 17135 } else { 17136 uint32_t rput_flags = 0; 17137 17138 ip6h = (ip6_t *)mp->b_rptr; 17139 v6dstp = &ip6h->ip6_dst; 17140 /* 17141 * XXX Assumes ip_rput_v6 sets ll_multicast only for multicast 17142 * address. 17143 * 17144 * Currently, we don't store that state in the IPSEC_IN 17145 * message, and we may need to. 17146 */ 17147 rput_flags |= (IN6_IS_ADDR_MULTICAST(v6dstp) ? 17148 IP6_IN_LLMCAST : 0); 17149 ip_rput_data_v6(ill->ill_rq, ill, ipsec_mp, ip6h, rput_flags, 17150 NULL, NULL); 17151 } 17152 if (ill_need_rele) 17153 ill_refrele(ill); 17154 if (rill_need_rele) 17155 ill_refrele(recv_ill); 17156 } 17157 17158 /* 17159 * Call ill_frag_timeout to do garbage collection. ill_frag_timeout 17160 * returns 'true' if there are still fragments left on the queue, in 17161 * which case we restart the timer. 17162 */ 17163 void 17164 ill_frag_timer(void *arg) 17165 { 17166 ill_t *ill = (ill_t *)arg; 17167 boolean_t frag_pending; 17168 ip_stack_t *ipst = ill->ill_ipst; 17169 17170 mutex_enter(&ill->ill_lock); 17171 ASSERT(!ill->ill_fragtimer_executing); 17172 if (ill->ill_state_flags & ILL_CONDEMNED) { 17173 ill->ill_frag_timer_id = 0; 17174 mutex_exit(&ill->ill_lock); 17175 return; 17176 } 17177 ill->ill_fragtimer_executing = 1; 17178 mutex_exit(&ill->ill_lock); 17179 17180 frag_pending = ill_frag_timeout(ill, ipst->ips_ip_g_frag_timeout); 17181 17182 /* 17183 * Restart the timer, if we have fragments pending or if someone 17184 * wanted us to be scheduled again. 17185 */ 17186 mutex_enter(&ill->ill_lock); 17187 ill->ill_fragtimer_executing = 0; 17188 ill->ill_frag_timer_id = 0; 17189 if (frag_pending || ill->ill_fragtimer_needrestart) 17190 ill_frag_timer_start(ill); 17191 mutex_exit(&ill->ill_lock); 17192 } 17193 17194 void 17195 ill_frag_timer_start(ill_t *ill) 17196 { 17197 ip_stack_t *ipst = ill->ill_ipst; 17198 17199 ASSERT(MUTEX_HELD(&ill->ill_lock)); 17200 17201 /* If the ill is closing or opening don't proceed */ 17202 if (ill->ill_state_flags & ILL_CONDEMNED) 17203 return; 17204 17205 if (ill->ill_fragtimer_executing) { 17206 /* 17207 * ill_frag_timer is currently executing. Just record the 17208 * the fact that we want the timer to be restarted. 17209 * ill_frag_timer will post a timeout before it returns, 17210 * ensuring it will be called again. 17211 */ 17212 ill->ill_fragtimer_needrestart = 1; 17213 return; 17214 } 17215 17216 if (ill->ill_frag_timer_id == 0) { 17217 /* 17218 * The timer is neither running nor is the timeout handler 17219 * executing. Post a timeout so that ill_frag_timer will be 17220 * called 17221 */ 17222 ill->ill_frag_timer_id = timeout(ill_frag_timer, ill, 17223 MSEC_TO_TICK(ipst->ips_ip_g_frag_timo_ms >> 1)); 17224 ill->ill_fragtimer_needrestart = 0; 17225 } 17226 } 17227 17228 /* 17229 * This routine is needed for loopback when forwarding multicasts. 17230 * 17231 * IPQoS Notes: 17232 * IPPF processing is done in fanout routines. 17233 * Policy processing is done only if IPP_lOCAL_IN is enabled. Further, 17234 * processing for IPSec packets is done when it comes back in clear. 17235 * NOTE : The callers of this function need to do the ire_refrele for the 17236 * ire that is being passed in. 17237 */ 17238 void 17239 ip_proto_input(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire, 17240 ill_t *recv_ill) 17241 { 17242 ill_t *ill = (ill_t *)q->q_ptr; 17243 uint32_t sum; 17244 uint32_t u1; 17245 uint32_t u2; 17246 int hdr_length; 17247 boolean_t mctl_present; 17248 mblk_t *first_mp = mp; 17249 mblk_t *hada_mp = NULL; 17250 ipha_t *inner_ipha; 17251 ip_stack_t *ipst; 17252 17253 ASSERT(recv_ill != NULL); 17254 ipst = recv_ill->ill_ipst; 17255 17256 TRACE_1(TR_FAC_IP, TR_IP_RPUT_LOCL_START, 17257 "ip_rput_locl_start: q %p", q); 17258 17259 ASSERT(ire->ire_ipversion == IPV4_VERSION); 17260 ASSERT(ill != NULL); 17261 17262 17263 #define rptr ((uchar_t *)ipha) 17264 #define iphs ((uint16_t *)ipha) 17265 17266 /* 17267 * no UDP or TCP packet should come here anymore. 17268 */ 17269 ASSERT((ipha->ipha_protocol != IPPROTO_TCP) && 17270 (ipha->ipha_protocol != IPPROTO_UDP)); 17271 17272 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 17273 if (mctl_present && 17274 ((da_ipsec_t *)first_mp->b_rptr)->da_type == IPHADA_M_CTL) { 17275 ASSERT(MBLKL(first_mp) >= sizeof (da_ipsec_t)); 17276 17277 /* 17278 * It's an IPsec accelerated packet. 17279 * Keep a pointer to the data attributes around until 17280 * we allocate the ipsec_info_t. 17281 */ 17282 IPSECHW_DEBUG(IPSECHW_PKT, 17283 ("ip_rput_local: inbound HW accelerated IPsec pkt\n")); 17284 hada_mp = first_mp; 17285 hada_mp->b_cont = NULL; 17286 /* 17287 * Since it is accelerated, it comes directly from 17288 * the ill and the data attributes is followed by 17289 * the packet data. 17290 */ 17291 ASSERT(mp->b_datap->db_type != M_CTL); 17292 first_mp = mp; 17293 mctl_present = B_FALSE; 17294 } 17295 17296 /* 17297 * IF M_CTL is not present, then ipsec_in_is_secure 17298 * should return B_TRUE. There is a case where loopback 17299 * packets has an M_CTL in the front with all the 17300 * IPSEC options set to IPSEC_PREF_NEVER - which means 17301 * ipsec_in_is_secure will return B_FALSE. As loopback 17302 * packets never comes here, it is safe to ASSERT the 17303 * following. 17304 */ 17305 ASSERT(!mctl_present || ipsec_in_is_secure(first_mp)); 17306 17307 17308 /* u1 is # words of IP options */ 17309 u1 = ipha->ipha_version_and_hdr_length - (uchar_t)((IP_VERSION << 4) 17310 + IP_SIMPLE_HDR_LENGTH_IN_WORDS); 17311 17312 if (u1) { 17313 if (!ip_options_cksum(q, ill, mp, ipha, ire, ipst)) { 17314 if (hada_mp != NULL) 17315 freemsg(hada_mp); 17316 return; 17317 } 17318 } else { 17319 /* Check the IP header checksum. */ 17320 #define uph ((uint16_t *)ipha) 17321 sum = uph[0] + uph[1] + uph[2] + uph[3] + uph[4] + uph[5] + 17322 uph[6] + uph[7] + uph[8] + uph[9]; 17323 #undef uph 17324 /* finish doing IP checksum */ 17325 sum = (sum & 0xFFFF) + (sum >> 16); 17326 sum = ~(sum + (sum >> 16)) & 0xFFFF; 17327 /* 17328 * Don't verify header checksum if this packet is coming 17329 * back from AH/ESP as we already did it. 17330 */ 17331 if (!mctl_present && (sum && sum != 0xFFFF)) { 17332 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs); 17333 goto drop_pkt; 17334 } 17335 } 17336 17337 /* 17338 * Count for SNMP of inbound packets for ire. As ip_proto_input 17339 * might be called more than once for secure packets, count only 17340 * the first time. 17341 */ 17342 if (!mctl_present) { 17343 UPDATE_IB_PKT_COUNT(ire); 17344 ire->ire_last_used_time = lbolt; 17345 } 17346 17347 /* Check for fragmentation offset. */ 17348 u2 = ntohs(ipha->ipha_fragment_offset_and_flags); 17349 u1 = u2 & (IPH_MF | IPH_OFFSET); 17350 if (u1) { 17351 /* 17352 * We re-assemble fragments before we do the AH/ESP 17353 * processing. Thus, M_CTL should not be present 17354 * while we are re-assembling. 17355 */ 17356 ASSERT(!mctl_present); 17357 ASSERT(first_mp == mp); 17358 if (!ip_rput_fragment(q, &mp, ipha, NULL, NULL)) { 17359 return; 17360 } 17361 /* 17362 * Make sure that first_mp points back to mp as 17363 * the mp we came in with could have changed in 17364 * ip_rput_fragment(). 17365 */ 17366 ipha = (ipha_t *)mp->b_rptr; 17367 first_mp = mp; 17368 } 17369 17370 /* 17371 * Clear hardware checksumming flag as it is currently only 17372 * used by TCP and UDP. 17373 */ 17374 DB_CKSUMFLAGS(mp) = 0; 17375 17376 /* Now we have a complete datagram, destined for this machine. */ 17377 u1 = IPH_HDR_LENGTH(ipha); 17378 switch (ipha->ipha_protocol) { 17379 case IPPROTO_ICMP: { 17380 ire_t *ire_zone; 17381 ilm_t *ilm; 17382 mblk_t *mp1; 17383 zoneid_t last_zoneid; 17384 17385 if (CLASSD(ipha->ipha_dst) && 17386 !(recv_ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) { 17387 ASSERT(ire->ire_type == IRE_BROADCAST); 17388 /* 17389 * In the multicast case, applications may have joined 17390 * the group from different zones, so we need to deliver 17391 * the packet to each of them. Loop through the 17392 * multicast memberships structures (ilm) on the receive 17393 * ill and send a copy of the packet up each matching 17394 * one. However, we don't do this for multicasts sent on 17395 * the loopback interface (PHYI_LOOPBACK flag set) as 17396 * they must stay in the sender's zone. 17397 * 17398 * ilm_add_v6() ensures that ilms in the same zone are 17399 * contiguous in the ill_ilm list. We use this property 17400 * to avoid sending duplicates needed when two 17401 * applications in the same zone join the same group on 17402 * different logical interfaces: we ignore the ilm if 17403 * its zoneid is the same as the last matching one. 17404 * In addition, the sending of the packet for 17405 * ire_zoneid is delayed until all of the other ilms 17406 * have been exhausted. 17407 */ 17408 last_zoneid = -1; 17409 ILM_WALKER_HOLD(recv_ill); 17410 for (ilm = recv_ill->ill_ilm; ilm != NULL; 17411 ilm = ilm->ilm_next) { 17412 if ((ilm->ilm_flags & ILM_DELETED) || 17413 ipha->ipha_dst != ilm->ilm_addr || 17414 ilm->ilm_zoneid == last_zoneid || 17415 ilm->ilm_zoneid == ire->ire_zoneid || 17416 ilm->ilm_zoneid == ALL_ZONES || 17417 !(ilm->ilm_ipif->ipif_flags & IPIF_UP)) 17418 continue; 17419 mp1 = ip_copymsg(first_mp); 17420 if (mp1 == NULL) 17421 continue; 17422 icmp_inbound(q, mp1, B_TRUE, ill, 17423 0, sum, mctl_present, B_TRUE, 17424 recv_ill, ilm->ilm_zoneid); 17425 last_zoneid = ilm->ilm_zoneid; 17426 } 17427 ILM_WALKER_RELE(recv_ill); 17428 } else if (ire->ire_type == IRE_BROADCAST) { 17429 /* 17430 * In the broadcast case, there may be many zones 17431 * which need a copy of the packet delivered to them. 17432 * There is one IRE_BROADCAST per broadcast address 17433 * and per zone; we walk those using a helper function. 17434 * In addition, the sending of the packet for ire is 17435 * delayed until all of the other ires have been 17436 * processed. 17437 */ 17438 IRB_REFHOLD(ire->ire_bucket); 17439 ire_zone = NULL; 17440 while ((ire_zone = ire_get_next_bcast_ire(ire_zone, 17441 ire)) != NULL) { 17442 mp1 = ip_copymsg(first_mp); 17443 if (mp1 == NULL) 17444 continue; 17445 17446 UPDATE_IB_PKT_COUNT(ire_zone); 17447 ire_zone->ire_last_used_time = lbolt; 17448 icmp_inbound(q, mp1, B_TRUE, ill, 17449 0, sum, mctl_present, B_TRUE, 17450 recv_ill, ire_zone->ire_zoneid); 17451 } 17452 IRB_REFRELE(ire->ire_bucket); 17453 } 17454 icmp_inbound(q, first_mp, (ire->ire_type == IRE_BROADCAST), 17455 ill, 0, sum, mctl_present, B_TRUE, recv_ill, 17456 ire->ire_zoneid); 17457 TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END, 17458 "ip_rput_locl_end: q %p (%S)", q, "icmp"); 17459 return; 17460 } 17461 case IPPROTO_IGMP: 17462 /* 17463 * If we are not willing to accept IGMP packets in clear, 17464 * then check with global policy. 17465 */ 17466 if (ipst->ips_igmp_accept_clear_messages == 0) { 17467 first_mp = ipsec_check_global_policy(first_mp, NULL, 17468 ipha, NULL, mctl_present, ipst->ips_netstack); 17469 if (first_mp == NULL) 17470 return; 17471 } 17472 if (is_system_labeled() && !tsol_can_accept_raw(mp, B_TRUE)) { 17473 freemsg(first_mp); 17474 ip1dbg(("ip_proto_input: zone all cannot accept raw")); 17475 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17476 return; 17477 } 17478 if ((mp = igmp_input(q, mp, ill)) == NULL) { 17479 /* Bad packet - discarded by igmp_input */ 17480 TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END, 17481 "ip_rput_locl_end: q %p (%S)", q, "igmp"); 17482 if (mctl_present) 17483 freeb(first_mp); 17484 return; 17485 } 17486 /* 17487 * igmp_input() may have returned the pulled up message. 17488 * So first_mp and ipha need to be reinitialized. 17489 */ 17490 ipha = (ipha_t *)mp->b_rptr; 17491 if (mctl_present) 17492 first_mp->b_cont = mp; 17493 else 17494 first_mp = mp; 17495 if (ipst->ips_ipcl_proto_fanout[ipha->ipha_protocol]. 17496 connf_head != NULL) { 17497 /* No user-level listener for IGMP packets */ 17498 goto drop_pkt; 17499 } 17500 /* deliver to local raw users */ 17501 break; 17502 case IPPROTO_PIM: 17503 /* 17504 * If we are not willing to accept PIM packets in clear, 17505 * then check with global policy. 17506 */ 17507 if (ipst->ips_pim_accept_clear_messages == 0) { 17508 first_mp = ipsec_check_global_policy(first_mp, NULL, 17509 ipha, NULL, mctl_present, ipst->ips_netstack); 17510 if (first_mp == NULL) 17511 return; 17512 } 17513 if (is_system_labeled() && !tsol_can_accept_raw(mp, B_TRUE)) { 17514 freemsg(first_mp); 17515 ip1dbg(("ip_proto_input: zone all cannot accept PIM")); 17516 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17517 return; 17518 } 17519 if (pim_input(q, mp, ill) != 0) { 17520 /* Bad packet - discarded by pim_input */ 17521 TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END, 17522 "ip_rput_locl_end: q %p (%S)", q, "pim"); 17523 if (mctl_present) 17524 freeb(first_mp); 17525 return; 17526 } 17527 17528 /* 17529 * pim_input() may have pulled up the message so ipha needs to 17530 * be reinitialized. 17531 */ 17532 ipha = (ipha_t *)mp->b_rptr; 17533 if (ipst->ips_ipcl_proto_fanout[ipha->ipha_protocol]. 17534 connf_head != NULL) { 17535 /* No user-level listener for PIM packets */ 17536 goto drop_pkt; 17537 } 17538 /* deliver to local raw users */ 17539 break; 17540 case IPPROTO_ENCAP: 17541 /* 17542 * Handle self-encapsulated packets (IP-in-IP where 17543 * the inner addresses == the outer addresses). 17544 */ 17545 hdr_length = IPH_HDR_LENGTH(ipha); 17546 if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) > 17547 mp->b_wptr) { 17548 if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 17549 sizeof (ipha_t) - mp->b_rptr)) { 17550 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17551 freemsg(first_mp); 17552 return; 17553 } 17554 ipha = (ipha_t *)mp->b_rptr; 17555 } 17556 inner_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length); 17557 /* 17558 * Check the sanity of the inner IP header. 17559 */ 17560 if ((IPH_HDR_VERSION(inner_ipha) != IPV4_VERSION)) { 17561 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17562 freemsg(first_mp); 17563 return; 17564 } 17565 if (IPH_HDR_LENGTH(inner_ipha) < sizeof (ipha_t)) { 17566 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17567 freemsg(first_mp); 17568 return; 17569 } 17570 if (inner_ipha->ipha_src == ipha->ipha_src && 17571 inner_ipha->ipha_dst == ipha->ipha_dst) { 17572 ipsec_in_t *ii; 17573 17574 /* 17575 * Self-encapsulated tunnel packet. Remove 17576 * the outer IP header and fanout again. 17577 * We also need to make sure that the inner 17578 * header is pulled up until options. 17579 */ 17580 mp->b_rptr = (uchar_t *)inner_ipha; 17581 ipha = inner_ipha; 17582 hdr_length = IPH_HDR_LENGTH(ipha); 17583 if ((uchar_t *)ipha + hdr_length > mp->b_wptr) { 17584 if (!pullupmsg(mp, (uchar_t *)ipha + 17585 + hdr_length - mp->b_rptr)) { 17586 freemsg(first_mp); 17587 return; 17588 } 17589 ipha = (ipha_t *)mp->b_rptr; 17590 } 17591 if (!mctl_present) { 17592 ASSERT(first_mp == mp); 17593 /* 17594 * This means that somebody is sending 17595 * Self-encapsualted packets without AH/ESP. 17596 * If AH/ESP was present, we would have already 17597 * allocated the first_mp. 17598 */ 17599 first_mp = ipsec_in_alloc(B_TRUE, 17600 ipst->ips_netstack); 17601 if (first_mp == NULL) { 17602 ip1dbg(("ip_proto_input: IPSEC_IN " 17603 "allocation failure.\n")); 17604 BUMP_MIB(ill->ill_ip_mib, 17605 ipIfStatsInDiscards); 17606 freemsg(mp); 17607 return; 17608 } 17609 first_mp->b_cont = mp; 17610 } 17611 /* 17612 * We generally store the ill_index if we need to 17613 * do IPSEC processing as we lose the ill queue when 17614 * we come back. But in this case, we never should 17615 * have to store the ill_index here as it should have 17616 * been stored previously when we processed the 17617 * AH/ESP header in this routine or for non-ipsec 17618 * cases, we still have the queue. But for some bad 17619 * packets from the wire, we can get to IPSEC after 17620 * this and we better store the index for that case. 17621 */ 17622 ill = (ill_t *)q->q_ptr; 17623 ii = (ipsec_in_t *)first_mp->b_rptr; 17624 ii->ipsec_in_ill_index = 17625 ill->ill_phyint->phyint_ifindex; 17626 ii->ipsec_in_rill_index = 17627 recv_ill->ill_phyint->phyint_ifindex; 17628 if (ii->ipsec_in_decaps) { 17629 /* 17630 * This packet is self-encapsulated multiple 17631 * times. We don't want to recurse infinitely. 17632 * To keep it simple, drop the packet. 17633 */ 17634 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17635 freemsg(first_mp); 17636 return; 17637 } 17638 ii->ipsec_in_decaps = B_TRUE; 17639 ip_fanout_proto_again(first_mp, recv_ill, recv_ill, 17640 ire); 17641 return; 17642 } 17643 break; 17644 case IPPROTO_AH: 17645 case IPPROTO_ESP: { 17646 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 17647 17648 /* 17649 * Fast path for AH/ESP. If this is the first time 17650 * we are sending a datagram to AH/ESP, allocate 17651 * a IPSEC_IN message and prepend it. Otherwise, 17652 * just fanout. 17653 */ 17654 17655 int ipsec_rc; 17656 ipsec_in_t *ii; 17657 netstack_t *ns = ipst->ips_netstack; 17658 17659 IP_STAT(ipst, ipsec_proto_ahesp); 17660 if (!mctl_present) { 17661 ASSERT(first_mp == mp); 17662 first_mp = ipsec_in_alloc(B_TRUE, ns); 17663 if (first_mp == NULL) { 17664 ip1dbg(("ip_proto_input: IPSEC_IN " 17665 "allocation failure.\n")); 17666 freemsg(hada_mp); /* okay ifnull */ 17667 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17668 freemsg(mp); 17669 return; 17670 } 17671 /* 17672 * Store the ill_index so that when we come back 17673 * from IPSEC we ride on the same queue. 17674 */ 17675 ill = (ill_t *)q->q_ptr; 17676 ii = (ipsec_in_t *)first_mp->b_rptr; 17677 ii->ipsec_in_ill_index = 17678 ill->ill_phyint->phyint_ifindex; 17679 ii->ipsec_in_rill_index = 17680 recv_ill->ill_phyint->phyint_ifindex; 17681 first_mp->b_cont = mp; 17682 /* 17683 * Cache hardware acceleration info. 17684 */ 17685 if (hada_mp != NULL) { 17686 IPSECHW_DEBUG(IPSECHW_PKT, 17687 ("ip_rput_local: caching data attr.\n")); 17688 ii->ipsec_in_accelerated = B_TRUE; 17689 ii->ipsec_in_da = hada_mp; 17690 hada_mp = NULL; 17691 } 17692 } else { 17693 ii = (ipsec_in_t *)first_mp->b_rptr; 17694 } 17695 17696 if (!ipsec_loaded(ipss)) { 17697 ip_proto_not_sup(q, first_mp, IP_FF_SEND_ICMP, 17698 ire->ire_zoneid, ipst); 17699 return; 17700 } 17701 17702 ns = ipst->ips_netstack; 17703 /* select inbound SA and have IPsec process the pkt */ 17704 if (ipha->ipha_protocol == IPPROTO_ESP) { 17705 esph_t *esph = ipsec_inbound_esp_sa(first_mp, ns); 17706 if (esph == NULL) 17707 return; 17708 ASSERT(ii->ipsec_in_esp_sa != NULL); 17709 ASSERT(ii->ipsec_in_esp_sa->ipsa_input_func != NULL); 17710 ipsec_rc = ii->ipsec_in_esp_sa->ipsa_input_func( 17711 first_mp, esph); 17712 } else { 17713 ah_t *ah = ipsec_inbound_ah_sa(first_mp, ns); 17714 if (ah == NULL) 17715 return; 17716 ASSERT(ii->ipsec_in_ah_sa != NULL); 17717 ASSERT(ii->ipsec_in_ah_sa->ipsa_input_func != NULL); 17718 ipsec_rc = ii->ipsec_in_ah_sa->ipsa_input_func( 17719 first_mp, ah); 17720 } 17721 17722 switch (ipsec_rc) { 17723 case IPSEC_STATUS_SUCCESS: 17724 break; 17725 case IPSEC_STATUS_FAILED: 17726 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 17727 /* FALLTHRU */ 17728 case IPSEC_STATUS_PENDING: 17729 return; 17730 } 17731 /* we're done with IPsec processing, send it up */ 17732 ip_fanout_proto_again(first_mp, ill, recv_ill, ire); 17733 return; 17734 } 17735 default: 17736 break; 17737 } 17738 if (is_system_labeled() && !tsol_can_accept_raw(mp, B_FALSE)) { 17739 ip1dbg(("ip_proto_input: zone %d cannot accept raw IP", 17740 ire->ire_zoneid)); 17741 goto drop_pkt; 17742 } 17743 /* 17744 * Handle protocols with which IP is less intimate. There 17745 * can be more than one stream bound to a particular 17746 * protocol. When this is the case, each one gets a copy 17747 * of any incoming packets. 17748 */ 17749 ip_fanout_proto(q, first_mp, ill, ipha, 17750 IP_FF_SEND_ICMP | IP_FF_CKSUM | IP_FF_RAWIP, mctl_present, 17751 B_TRUE, recv_ill, ire->ire_zoneid); 17752 TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END, 17753 "ip_rput_locl_end: q %p (%S)", q, "ip_fanout_proto"); 17754 return; 17755 17756 drop_pkt: 17757 freemsg(first_mp); 17758 if (hada_mp != NULL) 17759 freeb(hada_mp); 17760 TRACE_2(TR_FAC_IP, TR_IP_RPUT_LOCL_END, 17761 "ip_rput_locl_end: q %p (%S)", q, "droppkt"); 17762 #undef rptr 17763 #undef iphs 17764 17765 } 17766 17767 /* 17768 * Update any source route, record route or timestamp options. 17769 * Check that we are at end of strict source route. 17770 * The options have already been checked for sanity in ip_rput_options(). 17771 */ 17772 static boolean_t 17773 ip_rput_local_options(queue_t *q, mblk_t *mp, ipha_t *ipha, ire_t *ire, 17774 ip_stack_t *ipst) 17775 { 17776 ipoptp_t opts; 17777 uchar_t *opt; 17778 uint8_t optval; 17779 uint8_t optlen; 17780 ipaddr_t dst; 17781 uint32_t ts; 17782 ire_t *dst_ire; 17783 timestruc_t now; 17784 zoneid_t zoneid; 17785 ill_t *ill; 17786 17787 ASSERT(ire->ire_ipversion == IPV4_VERSION); 17788 17789 ip2dbg(("ip_rput_local_options\n")); 17790 17791 for (optval = ipoptp_first(&opts, ipha); 17792 optval != IPOPT_EOL; 17793 optval = ipoptp_next(&opts)) { 17794 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 17795 opt = opts.ipoptp_cur; 17796 optlen = opts.ipoptp_len; 17797 ip2dbg(("ip_rput_local_options: opt %d, len %d\n", 17798 optval, optlen)); 17799 switch (optval) { 17800 uint32_t off; 17801 case IPOPT_SSRR: 17802 case IPOPT_LSRR: 17803 off = opt[IPOPT_OFFSET]; 17804 off--; 17805 if (optlen < IP_ADDR_LEN || 17806 off > optlen - IP_ADDR_LEN) { 17807 /* End of source route */ 17808 ip1dbg(("ip_rput_local_options: end of SR\n")); 17809 break; 17810 } 17811 /* 17812 * This will only happen if two consecutive entries 17813 * in the source route contains our address or if 17814 * it is a packet with a loose source route which 17815 * reaches us before consuming the whole source route 17816 */ 17817 ip1dbg(("ip_rput_local_options: not end of SR\n")); 17818 if (optval == IPOPT_SSRR) { 17819 goto bad_src_route; 17820 } 17821 /* 17822 * Hack: instead of dropping the packet truncate the 17823 * source route to what has been used by filling the 17824 * rest with IPOPT_NOP. 17825 */ 17826 opt[IPOPT_OLEN] = (uint8_t)off; 17827 while (off < optlen) { 17828 opt[off++] = IPOPT_NOP; 17829 } 17830 break; 17831 case IPOPT_RR: 17832 off = opt[IPOPT_OFFSET]; 17833 off--; 17834 if (optlen < IP_ADDR_LEN || 17835 off > optlen - IP_ADDR_LEN) { 17836 /* No more room - ignore */ 17837 ip1dbg(( 17838 "ip_rput_local_options: end of RR\n")); 17839 break; 17840 } 17841 bcopy(&ire->ire_src_addr, (char *)opt + off, 17842 IP_ADDR_LEN); 17843 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 17844 break; 17845 case IPOPT_TS: 17846 /* Insert timestamp if there is romm */ 17847 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 17848 case IPOPT_TS_TSONLY: 17849 off = IPOPT_TS_TIMELEN; 17850 break; 17851 case IPOPT_TS_PRESPEC: 17852 case IPOPT_TS_PRESPEC_RFC791: 17853 /* Verify that the address matched */ 17854 off = opt[IPOPT_OFFSET] - 1; 17855 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 17856 dst_ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, 17857 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 17858 ipst); 17859 if (dst_ire == NULL) { 17860 /* Not for us */ 17861 break; 17862 } 17863 ire_refrele(dst_ire); 17864 /* FALLTHRU */ 17865 case IPOPT_TS_TSANDADDR: 17866 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 17867 break; 17868 default: 17869 /* 17870 * ip_*put_options should have already 17871 * dropped this packet. 17872 */ 17873 cmn_err(CE_PANIC, "ip_rput_local_options: " 17874 "unknown IT - bug in ip_rput_options?\n"); 17875 return (B_TRUE); /* Keep "lint" happy */ 17876 } 17877 if (opt[IPOPT_OFFSET] - 1 + off > optlen) { 17878 /* Increase overflow counter */ 17879 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1; 17880 opt[IPOPT_POS_OV_FLG] = 17881 (uint8_t)((opt[IPOPT_POS_OV_FLG] & 0x0F) | 17882 (off << 4)); 17883 break; 17884 } 17885 off = opt[IPOPT_OFFSET] - 1; 17886 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 17887 case IPOPT_TS_PRESPEC: 17888 case IPOPT_TS_PRESPEC_RFC791: 17889 case IPOPT_TS_TSANDADDR: 17890 bcopy(&ire->ire_src_addr, (char *)opt + off, 17891 IP_ADDR_LEN); 17892 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 17893 /* FALLTHRU */ 17894 case IPOPT_TS_TSONLY: 17895 off = opt[IPOPT_OFFSET] - 1; 17896 /* Compute # of milliseconds since midnight */ 17897 gethrestime(&now); 17898 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 17899 now.tv_nsec / (NANOSEC / MILLISEC); 17900 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN); 17901 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN; 17902 break; 17903 } 17904 break; 17905 } 17906 } 17907 return (B_TRUE); 17908 17909 bad_src_route: 17910 q = WR(q); 17911 if (q->q_next != NULL) 17912 ill = q->q_ptr; 17913 else 17914 ill = NULL; 17915 17916 /* make sure we clear any indication of a hardware checksum */ 17917 DB_CKSUMFLAGS(mp) = 0; 17918 zoneid = ipif_lookup_addr_zoneid(ipha->ipha_dst, ill, ipst); 17919 if (zoneid == ALL_ZONES) 17920 freemsg(mp); 17921 else 17922 icmp_unreachable(q, mp, ICMP_SOURCE_ROUTE_FAILED, zoneid, ipst); 17923 return (B_FALSE); 17924 17925 } 17926 17927 /* 17928 * Process IP options in an inbound packet. If an option affects the 17929 * effective destination address, return the next hop address via dstp. 17930 * Returns -1 if something fails in which case an ICMP error has been sent 17931 * and mp freed. 17932 */ 17933 static int 17934 ip_rput_options(queue_t *q, mblk_t *mp, ipha_t *ipha, ipaddr_t *dstp, 17935 ip_stack_t *ipst) 17936 { 17937 ipoptp_t opts; 17938 uchar_t *opt; 17939 uint8_t optval; 17940 uint8_t optlen; 17941 ipaddr_t dst; 17942 intptr_t code = 0; 17943 ire_t *ire = NULL; 17944 zoneid_t zoneid; 17945 ill_t *ill; 17946 17947 ip2dbg(("ip_rput_options\n")); 17948 dst = ipha->ipha_dst; 17949 for (optval = ipoptp_first(&opts, ipha); 17950 optval != IPOPT_EOL; 17951 optval = ipoptp_next(&opts)) { 17952 opt = opts.ipoptp_cur; 17953 optlen = opts.ipoptp_len; 17954 ip2dbg(("ip_rput_options: opt %d, len %d\n", 17955 optval, optlen)); 17956 /* 17957 * Note: we need to verify the checksum before we 17958 * modify anything thus this routine only extracts the next 17959 * hop dst from any source route. 17960 */ 17961 switch (optval) { 17962 uint32_t off; 17963 case IPOPT_SSRR: 17964 case IPOPT_LSRR: 17965 ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL, 17966 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 17967 if (ire == NULL) { 17968 if (optval == IPOPT_SSRR) { 17969 ip1dbg(("ip_rput_options: not next" 17970 " strict source route 0x%x\n", 17971 ntohl(dst))); 17972 code = (char *)&ipha->ipha_dst - 17973 (char *)ipha; 17974 goto param_prob; /* RouterReq's */ 17975 } 17976 ip2dbg(("ip_rput_options: " 17977 "not next source route 0x%x\n", 17978 ntohl(dst))); 17979 break; 17980 } 17981 ire_refrele(ire); 17982 17983 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 17984 ip1dbg(( 17985 "ip_rput_options: bad option offset\n")); 17986 code = (char *)&opt[IPOPT_OLEN] - 17987 (char *)ipha; 17988 goto param_prob; 17989 } 17990 off = opt[IPOPT_OFFSET]; 17991 off--; 17992 redo_srr: 17993 if (optlen < IP_ADDR_LEN || 17994 off > optlen - IP_ADDR_LEN) { 17995 /* End of source route */ 17996 ip1dbg(("ip_rput_options: end of SR\n")); 17997 break; 17998 } 17999 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 18000 ip1dbg(("ip_rput_options: next hop 0x%x\n", 18001 ntohl(dst))); 18002 18003 /* 18004 * Check if our address is present more than 18005 * once as consecutive hops in source route. 18006 * XXX verify per-interface ip_forwarding 18007 * for source route? 18008 */ 18009 ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL, 18010 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 18011 18012 if (ire != NULL) { 18013 ire_refrele(ire); 18014 off += IP_ADDR_LEN; 18015 goto redo_srr; 18016 } 18017 18018 if (dst == htonl(INADDR_LOOPBACK)) { 18019 ip1dbg(("ip_rput_options: loopback addr in " 18020 "source route!\n")); 18021 goto bad_src_route; 18022 } 18023 /* 18024 * For strict: verify that dst is directly 18025 * reachable. 18026 */ 18027 if (optval == IPOPT_SSRR) { 18028 ire = ire_ftable_lookup(dst, 0, 0, 18029 IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, 18030 MBLK_GETLABEL(mp), 18031 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, ipst); 18032 if (ire == NULL) { 18033 ip1dbg(("ip_rput_options: SSRR not " 18034 "directly reachable: 0x%x\n", 18035 ntohl(dst))); 18036 goto bad_src_route; 18037 } 18038 ire_refrele(ire); 18039 } 18040 /* 18041 * Defer update of the offset and the record route 18042 * until the packet is forwarded. 18043 */ 18044 break; 18045 case IPOPT_RR: 18046 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 18047 ip1dbg(( 18048 "ip_rput_options: bad option offset\n")); 18049 code = (char *)&opt[IPOPT_OLEN] - 18050 (char *)ipha; 18051 goto param_prob; 18052 } 18053 break; 18054 case IPOPT_TS: 18055 /* 18056 * Verify that length >= 5 and that there is either 18057 * room for another timestamp or that the overflow 18058 * counter is not maxed out. 18059 */ 18060 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha; 18061 if (optlen < IPOPT_MINLEN_IT) { 18062 goto param_prob; 18063 } 18064 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 18065 ip1dbg(( 18066 "ip_rput_options: bad option offset\n")); 18067 code = (char *)&opt[IPOPT_OFFSET] - 18068 (char *)ipha; 18069 goto param_prob; 18070 } 18071 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 18072 case IPOPT_TS_TSONLY: 18073 off = IPOPT_TS_TIMELEN; 18074 break; 18075 case IPOPT_TS_TSANDADDR: 18076 case IPOPT_TS_PRESPEC: 18077 case IPOPT_TS_PRESPEC_RFC791: 18078 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 18079 break; 18080 default: 18081 code = (char *)&opt[IPOPT_POS_OV_FLG] - 18082 (char *)ipha; 18083 goto param_prob; 18084 } 18085 if (opt[IPOPT_OFFSET] - 1 + off > optlen && 18086 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) { 18087 /* 18088 * No room and the overflow counter is 15 18089 * already. 18090 */ 18091 goto param_prob; 18092 } 18093 break; 18094 } 18095 } 18096 18097 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) { 18098 *dstp = dst; 18099 return (0); 18100 } 18101 18102 ip1dbg(("ip_rput_options: error processing IP options.")); 18103 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha; 18104 18105 param_prob: 18106 q = WR(q); 18107 if (q->q_next != NULL) 18108 ill = q->q_ptr; 18109 else 18110 ill = NULL; 18111 18112 /* make sure we clear any indication of a hardware checksum */ 18113 DB_CKSUMFLAGS(mp) = 0; 18114 /* Don't know whether this is for non-global or global/forwarding */ 18115 zoneid = ipif_lookup_addr_zoneid(dst, ill, ipst); 18116 if (zoneid == ALL_ZONES) 18117 freemsg(mp); 18118 else 18119 icmp_param_problem(q, mp, (uint8_t)code, zoneid, ipst); 18120 return (-1); 18121 18122 bad_src_route: 18123 q = WR(q); 18124 if (q->q_next != NULL) 18125 ill = q->q_ptr; 18126 else 18127 ill = NULL; 18128 18129 /* make sure we clear any indication of a hardware checksum */ 18130 DB_CKSUMFLAGS(mp) = 0; 18131 zoneid = ipif_lookup_addr_zoneid(dst, ill, ipst); 18132 if (zoneid == ALL_ZONES) 18133 freemsg(mp); 18134 else 18135 icmp_unreachable(q, mp, ICMP_SOURCE_ROUTE_FAILED, zoneid, ipst); 18136 return (-1); 18137 } 18138 18139 /* 18140 * IP & ICMP info in >=14 msg's ... 18141 * - ip fixed part (mib2_ip_t) 18142 * - icmp fixed part (mib2_icmp_t) 18143 * - ipAddrEntryTable (ip 20) all IPv4 ipifs 18144 * - ipRouteEntryTable (ip 21) all IPv4 IREs 18145 * - ipNetToMediaEntryTable (ip 22) [filled in by the arp module] 18146 * - ipRouteAttributeTable (ip 102) labeled routes 18147 * - ip multicast membership (ip_member_t) 18148 * - ip multicast source filtering (ip_grpsrc_t) 18149 * - igmp fixed part (struct igmpstat) 18150 * - multicast routing stats (struct mrtstat) 18151 * - multicast routing vifs (array of struct vifctl) 18152 * - multicast routing routes (array of struct mfcctl) 18153 * - ip6 fixed part (mib2_ipv6IfStatsEntry_t) 18154 * One per ill plus one generic 18155 * - icmp6 fixed part (mib2_ipv6IfIcmpEntry_t) 18156 * One per ill plus one generic 18157 * - ipv6RouteEntry all IPv6 IREs 18158 * - ipv6RouteAttributeTable (ip6 102) labeled routes 18159 * - ipv6NetToMediaEntry all Neighbor Cache entries 18160 * - ipv6AddrEntry all IPv6 ipifs 18161 * - ipv6 multicast membership (ipv6_member_t) 18162 * - ipv6 multicast source filtering (ipv6_grpsrc_t) 18163 * 18164 * MIB2_IP_MEDIA is filled in by the arp module with ARP cache entries. 18165 * 18166 * NOTE: original mpctl is copied for msg's 2..N, since its ctl part is 18167 * already filled in by the caller. 18168 * Return value of 0 indicates that no messages were sent and caller 18169 * should free mpctl. 18170 */ 18171 int 18172 ip_snmp_get(queue_t *q, mblk_t *mpctl) 18173 { 18174 ip_stack_t *ipst; 18175 sctp_stack_t *sctps; 18176 18177 18178 if (q->q_next != NULL) { 18179 ipst = ILLQ_TO_IPST(q); 18180 } else { 18181 ipst = CONNQ_TO_IPST(q); 18182 } 18183 ASSERT(ipst != NULL); 18184 sctps = ipst->ips_netstack->netstack_sctp; 18185 18186 if (mpctl == NULL || mpctl->b_cont == NULL) { 18187 return (0); 18188 } 18189 18190 if ((mpctl = ip_snmp_get_mib2_ip_traffic_stats(q, mpctl, 18191 ipst)) == NULL) { 18192 return (1); 18193 } 18194 18195 if ((mpctl = ip_snmp_get_mib2_ip6(q, mpctl, ipst)) == NULL) { 18196 return (1); 18197 } 18198 18199 if ((mpctl = ip_snmp_get_mib2_icmp(q, mpctl, ipst)) == NULL) { 18200 return (1); 18201 } 18202 18203 if ((mpctl = ip_snmp_get_mib2_icmp6(q, mpctl, ipst)) == NULL) { 18204 return (1); 18205 } 18206 18207 if ((mpctl = ip_snmp_get_mib2_igmp(q, mpctl, ipst)) == NULL) { 18208 return (1); 18209 } 18210 18211 if ((mpctl = ip_snmp_get_mib2_multi(q, mpctl, ipst)) == NULL) { 18212 return (1); 18213 } 18214 18215 if ((mpctl = ip_snmp_get_mib2_ip_addr(q, mpctl, ipst)) == NULL) { 18216 return (1); 18217 } 18218 18219 if ((mpctl = ip_snmp_get_mib2_ip6_addr(q, mpctl, ipst)) == NULL) { 18220 return (1); 18221 } 18222 18223 if ((mpctl = ip_snmp_get_mib2_ip_group_mem(q, mpctl, ipst)) == NULL) { 18224 return (1); 18225 } 18226 18227 if ((mpctl = ip_snmp_get_mib2_ip6_group_mem(q, mpctl, ipst)) == NULL) { 18228 return (1); 18229 } 18230 18231 if ((mpctl = ip_snmp_get_mib2_ip_group_src(q, mpctl, ipst)) == NULL) { 18232 return (1); 18233 } 18234 18235 if ((mpctl = ip_snmp_get_mib2_ip6_group_src(q, mpctl, ipst)) == NULL) { 18236 return (1); 18237 } 18238 18239 if ((mpctl = ip_snmp_get_mib2_virt_multi(q, mpctl, ipst)) == NULL) { 18240 return (1); 18241 } 18242 18243 if ((mpctl = ip_snmp_get_mib2_multi_rtable(q, mpctl, ipst)) == NULL) { 18244 return (1); 18245 } 18246 18247 if ((mpctl = ip_snmp_get_mib2_ip_route_media(q, mpctl, ipst)) == NULL) { 18248 return (1); 18249 } 18250 18251 mpctl = ip_snmp_get_mib2_ip6_route_media(q, mpctl, ipst); 18252 if (mpctl == NULL) { 18253 return (1); 18254 } 18255 18256 if ((mpctl = sctp_snmp_get_mib2(q, mpctl, sctps)) == NULL) { 18257 return (1); 18258 } 18259 freemsg(mpctl); 18260 return (1); 18261 } 18262 18263 18264 /* Get global (legacy) IPv4 statistics */ 18265 static mblk_t * 18266 ip_snmp_get_mib2_ip(queue_t *q, mblk_t *mpctl, mib2_ipIfStatsEntry_t *ipmib, 18267 ip_stack_t *ipst) 18268 { 18269 mib2_ip_t old_ip_mib; 18270 struct opthdr *optp; 18271 mblk_t *mp2ctl; 18272 18273 /* 18274 * make a copy of the original message 18275 */ 18276 mp2ctl = copymsg(mpctl); 18277 18278 /* fixed length IP structure... */ 18279 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18280 optp->level = MIB2_IP; 18281 optp->name = 0; 18282 SET_MIB(old_ip_mib.ipForwarding, 18283 (WE_ARE_FORWARDING(ipst) ? 1 : 2)); 18284 SET_MIB(old_ip_mib.ipDefaultTTL, 18285 (uint32_t)ipst->ips_ip_def_ttl); 18286 SET_MIB(old_ip_mib.ipReasmTimeout, 18287 ipst->ips_ip_g_frag_timeout); 18288 SET_MIB(old_ip_mib.ipAddrEntrySize, 18289 sizeof (mib2_ipAddrEntry_t)); 18290 SET_MIB(old_ip_mib.ipRouteEntrySize, 18291 sizeof (mib2_ipRouteEntry_t)); 18292 SET_MIB(old_ip_mib.ipNetToMediaEntrySize, 18293 sizeof (mib2_ipNetToMediaEntry_t)); 18294 SET_MIB(old_ip_mib.ipMemberEntrySize, sizeof (ip_member_t)); 18295 SET_MIB(old_ip_mib.ipGroupSourceEntrySize, sizeof (ip_grpsrc_t)); 18296 SET_MIB(old_ip_mib.ipRouteAttributeSize, 18297 sizeof (mib2_ipAttributeEntry_t)); 18298 SET_MIB(old_ip_mib.transportMLPSize, sizeof (mib2_transportMLPEntry_t)); 18299 18300 /* 18301 * Grab the statistics from the new IP MIB 18302 */ 18303 SET_MIB(old_ip_mib.ipInReceives, 18304 (uint32_t)ipmib->ipIfStatsHCInReceives); 18305 SET_MIB(old_ip_mib.ipInHdrErrors, ipmib->ipIfStatsInHdrErrors); 18306 SET_MIB(old_ip_mib.ipInAddrErrors, ipmib->ipIfStatsInAddrErrors); 18307 SET_MIB(old_ip_mib.ipForwDatagrams, 18308 (uint32_t)ipmib->ipIfStatsHCOutForwDatagrams); 18309 SET_MIB(old_ip_mib.ipInUnknownProtos, 18310 ipmib->ipIfStatsInUnknownProtos); 18311 SET_MIB(old_ip_mib.ipInDiscards, ipmib->ipIfStatsInDiscards); 18312 SET_MIB(old_ip_mib.ipInDelivers, 18313 (uint32_t)ipmib->ipIfStatsHCInDelivers); 18314 SET_MIB(old_ip_mib.ipOutRequests, 18315 (uint32_t)ipmib->ipIfStatsHCOutRequests); 18316 SET_MIB(old_ip_mib.ipOutDiscards, ipmib->ipIfStatsOutDiscards); 18317 SET_MIB(old_ip_mib.ipOutNoRoutes, ipmib->ipIfStatsOutNoRoutes); 18318 SET_MIB(old_ip_mib.ipReasmReqds, ipmib->ipIfStatsReasmReqds); 18319 SET_MIB(old_ip_mib.ipReasmOKs, ipmib->ipIfStatsReasmOKs); 18320 SET_MIB(old_ip_mib.ipReasmFails, ipmib->ipIfStatsReasmFails); 18321 SET_MIB(old_ip_mib.ipFragOKs, ipmib->ipIfStatsOutFragOKs); 18322 SET_MIB(old_ip_mib.ipFragFails, ipmib->ipIfStatsOutFragFails); 18323 SET_MIB(old_ip_mib.ipFragCreates, ipmib->ipIfStatsOutFragCreates); 18324 18325 /* ipRoutingDiscards is not being used */ 18326 SET_MIB(old_ip_mib.ipRoutingDiscards, 0); 18327 SET_MIB(old_ip_mib.tcpInErrs, ipmib->tcpIfStatsInErrs); 18328 SET_MIB(old_ip_mib.udpNoPorts, ipmib->udpIfStatsNoPorts); 18329 SET_MIB(old_ip_mib.ipInCksumErrs, ipmib->ipIfStatsInCksumErrs); 18330 SET_MIB(old_ip_mib.ipReasmDuplicates, 18331 ipmib->ipIfStatsReasmDuplicates); 18332 SET_MIB(old_ip_mib.ipReasmPartDups, ipmib->ipIfStatsReasmPartDups); 18333 SET_MIB(old_ip_mib.ipForwProhibits, ipmib->ipIfStatsForwProhibits); 18334 SET_MIB(old_ip_mib.udpInCksumErrs, ipmib->udpIfStatsInCksumErrs); 18335 SET_MIB(old_ip_mib.udpInOverflows, ipmib->udpIfStatsInOverflows); 18336 SET_MIB(old_ip_mib.rawipInOverflows, 18337 ipmib->rawipIfStatsInOverflows); 18338 18339 SET_MIB(old_ip_mib.ipsecInSucceeded, ipmib->ipsecIfStatsInSucceeded); 18340 SET_MIB(old_ip_mib.ipsecInFailed, ipmib->ipsecIfStatsInFailed); 18341 SET_MIB(old_ip_mib.ipInIPv6, ipmib->ipIfStatsInWrongIPVersion); 18342 SET_MIB(old_ip_mib.ipOutIPv6, ipmib->ipIfStatsOutWrongIPVersion); 18343 SET_MIB(old_ip_mib.ipOutSwitchIPv6, 18344 ipmib->ipIfStatsOutSwitchIPVersion); 18345 18346 if (!snmp_append_data(mpctl->b_cont, (char *)&old_ip_mib, 18347 (int)sizeof (old_ip_mib))) { 18348 ip1dbg(("ip_snmp_get_mib2_ip: failed to allocate %u bytes\n", 18349 (uint_t)sizeof (old_ip_mib))); 18350 } 18351 18352 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18353 ip3dbg(("ip_snmp_get_mib2_ip: level %d, name %d, len %d\n", 18354 (int)optp->level, (int)optp->name, (int)optp->len)); 18355 qreply(q, mpctl); 18356 return (mp2ctl); 18357 } 18358 18359 /* Per interface IPv4 statistics */ 18360 static mblk_t * 18361 ip_snmp_get_mib2_ip_traffic_stats(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18362 { 18363 struct opthdr *optp; 18364 mblk_t *mp2ctl; 18365 ill_t *ill; 18366 ill_walk_context_t ctx; 18367 mblk_t *mp_tail = NULL; 18368 mib2_ipIfStatsEntry_t global_ip_mib; 18369 18370 /* 18371 * Make a copy of the original message 18372 */ 18373 mp2ctl = copymsg(mpctl); 18374 18375 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18376 optp->level = MIB2_IP; 18377 optp->name = MIB2_IP_TRAFFIC_STATS; 18378 /* Include "unknown interface" ip_mib */ 18379 ipst->ips_ip_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4; 18380 ipst->ips_ip_mib.ipIfStatsIfIndex = 18381 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */ 18382 SET_MIB(ipst->ips_ip_mib.ipIfStatsForwarding, 18383 (ipst->ips_ip_g_forward ? 1 : 2)); 18384 SET_MIB(ipst->ips_ip_mib.ipIfStatsDefaultTTL, 18385 (uint32_t)ipst->ips_ip_def_ttl); 18386 SET_MIB(ipst->ips_ip_mib.ipIfStatsEntrySize, 18387 sizeof (mib2_ipIfStatsEntry_t)); 18388 SET_MIB(ipst->ips_ip_mib.ipIfStatsAddrEntrySize, 18389 sizeof (mib2_ipAddrEntry_t)); 18390 SET_MIB(ipst->ips_ip_mib.ipIfStatsRouteEntrySize, 18391 sizeof (mib2_ipRouteEntry_t)); 18392 SET_MIB(ipst->ips_ip_mib.ipIfStatsNetToMediaEntrySize, 18393 sizeof (mib2_ipNetToMediaEntry_t)); 18394 SET_MIB(ipst->ips_ip_mib.ipIfStatsMemberEntrySize, 18395 sizeof (ip_member_t)); 18396 SET_MIB(ipst->ips_ip_mib.ipIfStatsGroupSourceEntrySize, 18397 sizeof (ip_grpsrc_t)); 18398 18399 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 18400 (char *)&ipst->ips_ip_mib, (int)sizeof (ipst->ips_ip_mib))) { 18401 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: " 18402 "failed to allocate %u bytes\n", 18403 (uint_t)sizeof (ipst->ips_ip_mib))); 18404 } 18405 18406 bcopy(&ipst->ips_ip_mib, &global_ip_mib, sizeof (global_ip_mib)); 18407 18408 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18409 ill = ILL_START_WALK_V4(&ctx, ipst); 18410 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18411 ill->ill_ip_mib->ipIfStatsIfIndex = 18412 ill->ill_phyint->phyint_ifindex; 18413 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding, 18414 (ipst->ips_ip_g_forward ? 1 : 2)); 18415 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultTTL, 18416 (uint32_t)ipst->ips_ip_def_ttl); 18417 18418 ip_mib2_add_ip_stats(&global_ip_mib, ill->ill_ip_mib); 18419 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 18420 (char *)ill->ill_ip_mib, 18421 (int)sizeof (*ill->ill_ip_mib))) { 18422 ip1dbg(("ip_snmp_get_mib2_ip_traffic_stats: " 18423 "failed to allocate %u bytes\n", 18424 (uint_t)sizeof (*ill->ill_ip_mib))); 18425 } 18426 } 18427 rw_exit(&ipst->ips_ill_g_lock); 18428 18429 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18430 ip3dbg(("ip_snmp_get_mib2_ip_traffic_stats: " 18431 "level %d, name %d, len %d\n", 18432 (int)optp->level, (int)optp->name, (int)optp->len)); 18433 qreply(q, mpctl); 18434 18435 return (ip_snmp_get_mib2_ip(q, mp2ctl, &global_ip_mib, ipst)); 18436 } 18437 18438 /* Global IPv4 ICMP statistics */ 18439 static mblk_t * 18440 ip_snmp_get_mib2_icmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18441 { 18442 struct opthdr *optp; 18443 mblk_t *mp2ctl; 18444 18445 /* 18446 * Make a copy of the original message 18447 */ 18448 mp2ctl = copymsg(mpctl); 18449 18450 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18451 optp->level = MIB2_ICMP; 18452 optp->name = 0; 18453 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_icmp_mib, 18454 (int)sizeof (ipst->ips_icmp_mib))) { 18455 ip1dbg(("ip_snmp_get_mib2_icmp: failed to allocate %u bytes\n", 18456 (uint_t)sizeof (ipst->ips_icmp_mib))); 18457 } 18458 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18459 ip3dbg(("ip_snmp_get_mib2_icmp: level %d, name %d, len %d\n", 18460 (int)optp->level, (int)optp->name, (int)optp->len)); 18461 qreply(q, mpctl); 18462 return (mp2ctl); 18463 } 18464 18465 /* Global IPv4 IGMP statistics */ 18466 static mblk_t * 18467 ip_snmp_get_mib2_igmp(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18468 { 18469 struct opthdr *optp; 18470 mblk_t *mp2ctl; 18471 18472 /* 18473 * make a copy of the original message 18474 */ 18475 mp2ctl = copymsg(mpctl); 18476 18477 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18478 optp->level = EXPER_IGMP; 18479 optp->name = 0; 18480 if (!snmp_append_data(mpctl->b_cont, (char *)&ipst->ips_igmpstat, 18481 (int)sizeof (ipst->ips_igmpstat))) { 18482 ip1dbg(("ip_snmp_get_mib2_igmp: failed to allocate %u bytes\n", 18483 (uint_t)sizeof (ipst->ips_igmpstat))); 18484 } 18485 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18486 ip3dbg(("ip_snmp_get_mib2_igmp: level %d, name %d, len %d\n", 18487 (int)optp->level, (int)optp->name, (int)optp->len)); 18488 qreply(q, mpctl); 18489 return (mp2ctl); 18490 } 18491 18492 /* Global IPv4 Multicast Routing statistics */ 18493 static mblk_t * 18494 ip_snmp_get_mib2_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18495 { 18496 struct opthdr *optp; 18497 mblk_t *mp2ctl; 18498 18499 /* 18500 * make a copy of the original message 18501 */ 18502 mp2ctl = copymsg(mpctl); 18503 18504 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18505 optp->level = EXPER_DVMRP; 18506 optp->name = 0; 18507 if (!ip_mroute_stats(mpctl->b_cont, ipst)) { 18508 ip0dbg(("ip_mroute_stats: failed\n")); 18509 } 18510 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18511 ip3dbg(("ip_snmp_get_mib2_multi: level %d, name %d, len %d\n", 18512 (int)optp->level, (int)optp->name, (int)optp->len)); 18513 qreply(q, mpctl); 18514 return (mp2ctl); 18515 } 18516 18517 /* IPv4 address information */ 18518 static mblk_t * 18519 ip_snmp_get_mib2_ip_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18520 { 18521 struct opthdr *optp; 18522 mblk_t *mp2ctl; 18523 mblk_t *mp_tail = NULL; 18524 ill_t *ill; 18525 ipif_t *ipif; 18526 uint_t bitval; 18527 mib2_ipAddrEntry_t mae; 18528 zoneid_t zoneid; 18529 ill_walk_context_t ctx; 18530 18531 /* 18532 * make a copy of the original message 18533 */ 18534 mp2ctl = copymsg(mpctl); 18535 18536 /* ipAddrEntryTable */ 18537 18538 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18539 optp->level = MIB2_IP; 18540 optp->name = MIB2_IP_ADDR; 18541 zoneid = Q_TO_CONN(q)->conn_zoneid; 18542 18543 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18544 ill = ILL_START_WALK_V4(&ctx, ipst); 18545 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18546 for (ipif = ill->ill_ipif; ipif != NULL; 18547 ipif = ipif->ipif_next) { 18548 if (ipif->ipif_zoneid != zoneid && 18549 ipif->ipif_zoneid != ALL_ZONES) 18550 continue; 18551 mae.ipAdEntInfo.ae_ibcnt = ipif->ipif_ib_pkt_count; 18552 mae.ipAdEntInfo.ae_obcnt = ipif->ipif_ob_pkt_count; 18553 mae.ipAdEntInfo.ae_focnt = ipif->ipif_fo_pkt_count; 18554 18555 (void) ipif_get_name(ipif, 18556 mae.ipAdEntIfIndex.o_bytes, 18557 OCTET_LENGTH); 18558 mae.ipAdEntIfIndex.o_length = 18559 mi_strlen(mae.ipAdEntIfIndex.o_bytes); 18560 mae.ipAdEntAddr = ipif->ipif_lcl_addr; 18561 mae.ipAdEntNetMask = ipif->ipif_net_mask; 18562 mae.ipAdEntInfo.ae_subnet = ipif->ipif_subnet; 18563 mae.ipAdEntInfo.ae_subnet_len = 18564 ip_mask_to_plen(ipif->ipif_net_mask); 18565 mae.ipAdEntInfo.ae_src_addr = ipif->ipif_src_addr; 18566 for (bitval = 1; 18567 bitval && 18568 !(bitval & ipif->ipif_brd_addr); 18569 bitval <<= 1) 18570 noop; 18571 mae.ipAdEntBcastAddr = bitval; 18572 mae.ipAdEntReasmMaxSize = IP_MAXPACKET; 18573 mae.ipAdEntInfo.ae_mtu = ipif->ipif_mtu; 18574 mae.ipAdEntInfo.ae_metric = ipif->ipif_metric; 18575 mae.ipAdEntInfo.ae_broadcast_addr = 18576 ipif->ipif_brd_addr; 18577 mae.ipAdEntInfo.ae_pp_dst_addr = 18578 ipif->ipif_pp_dst_addr; 18579 mae.ipAdEntInfo.ae_flags = ipif->ipif_flags | 18580 ill->ill_flags | ill->ill_phyint->phyint_flags; 18581 mae.ipAdEntRetransmitTime = AR_EQ_DEFAULT_XMIT_INTERVAL; 18582 18583 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 18584 (char *)&mae, (int)sizeof (mib2_ipAddrEntry_t))) { 18585 ip1dbg(("ip_snmp_get_mib2_ip_addr: failed to " 18586 "allocate %u bytes\n", 18587 (uint_t)sizeof (mib2_ipAddrEntry_t))); 18588 } 18589 } 18590 } 18591 rw_exit(&ipst->ips_ill_g_lock); 18592 18593 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18594 ip3dbg(("ip_snmp_get_mib2_ip_addr: level %d, name %d, len %d\n", 18595 (int)optp->level, (int)optp->name, (int)optp->len)); 18596 qreply(q, mpctl); 18597 return (mp2ctl); 18598 } 18599 18600 /* IPv6 address information */ 18601 static mblk_t * 18602 ip_snmp_get_mib2_ip6_addr(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18603 { 18604 struct opthdr *optp; 18605 mblk_t *mp2ctl; 18606 mblk_t *mp_tail = NULL; 18607 ill_t *ill; 18608 ipif_t *ipif; 18609 mib2_ipv6AddrEntry_t mae6; 18610 zoneid_t zoneid; 18611 ill_walk_context_t ctx; 18612 18613 /* 18614 * make a copy of the original message 18615 */ 18616 mp2ctl = copymsg(mpctl); 18617 18618 /* ipv6AddrEntryTable */ 18619 18620 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18621 optp->level = MIB2_IP6; 18622 optp->name = MIB2_IP6_ADDR; 18623 zoneid = Q_TO_CONN(q)->conn_zoneid; 18624 18625 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18626 ill = ILL_START_WALK_V6(&ctx, ipst); 18627 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18628 for (ipif = ill->ill_ipif; ipif != NULL; 18629 ipif = ipif->ipif_next) { 18630 if (ipif->ipif_zoneid != zoneid && 18631 ipif->ipif_zoneid != ALL_ZONES) 18632 continue; 18633 mae6.ipv6AddrInfo.ae_ibcnt = ipif->ipif_ib_pkt_count; 18634 mae6.ipv6AddrInfo.ae_obcnt = ipif->ipif_ob_pkt_count; 18635 mae6.ipv6AddrInfo.ae_focnt = ipif->ipif_fo_pkt_count; 18636 18637 (void) ipif_get_name(ipif, 18638 mae6.ipv6AddrIfIndex.o_bytes, 18639 OCTET_LENGTH); 18640 mae6.ipv6AddrIfIndex.o_length = 18641 mi_strlen(mae6.ipv6AddrIfIndex.o_bytes); 18642 mae6.ipv6AddrAddress = ipif->ipif_v6lcl_addr; 18643 mae6.ipv6AddrPfxLength = 18644 ip_mask_to_plen_v6(&ipif->ipif_v6net_mask); 18645 mae6.ipv6AddrInfo.ae_subnet = ipif->ipif_v6subnet; 18646 mae6.ipv6AddrInfo.ae_subnet_len = 18647 mae6.ipv6AddrPfxLength; 18648 mae6.ipv6AddrInfo.ae_src_addr = ipif->ipif_v6src_addr; 18649 18650 /* Type: stateless(1), stateful(2), unknown(3) */ 18651 if (ipif->ipif_flags & IPIF_ADDRCONF) 18652 mae6.ipv6AddrType = 1; 18653 else 18654 mae6.ipv6AddrType = 2; 18655 /* Anycast: true(1), false(2) */ 18656 if (ipif->ipif_flags & IPIF_ANYCAST) 18657 mae6.ipv6AddrAnycastFlag = 1; 18658 else 18659 mae6.ipv6AddrAnycastFlag = 2; 18660 18661 /* 18662 * Address status: preferred(1), deprecated(2), 18663 * invalid(3), inaccessible(4), unknown(5) 18664 */ 18665 if (ipif->ipif_flags & IPIF_NOLOCAL) 18666 mae6.ipv6AddrStatus = 3; 18667 else if (ipif->ipif_flags & IPIF_DEPRECATED) 18668 mae6.ipv6AddrStatus = 2; 18669 else 18670 mae6.ipv6AddrStatus = 1; 18671 mae6.ipv6AddrInfo.ae_mtu = ipif->ipif_mtu; 18672 mae6.ipv6AddrInfo.ae_metric = ipif->ipif_metric; 18673 mae6.ipv6AddrInfo.ae_pp_dst_addr = 18674 ipif->ipif_v6pp_dst_addr; 18675 mae6.ipv6AddrInfo.ae_flags = ipif->ipif_flags | 18676 ill->ill_flags | ill->ill_phyint->phyint_flags; 18677 mae6.ipv6AddrReasmMaxSize = IP_MAXPACKET; 18678 mae6.ipv6AddrIdentifier = ill->ill_token; 18679 mae6.ipv6AddrIdentifierLen = ill->ill_token_length; 18680 mae6.ipv6AddrReachableTime = ill->ill_reachable_time; 18681 mae6.ipv6AddrRetransmitTime = 18682 ill->ill_reachable_retrans_time; 18683 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 18684 (char *)&mae6, 18685 (int)sizeof (mib2_ipv6AddrEntry_t))) { 18686 ip1dbg(("ip_snmp_get_mib2_ip6_addr: failed to " 18687 "allocate %u bytes\n", 18688 (uint_t)sizeof (mib2_ipv6AddrEntry_t))); 18689 } 18690 } 18691 } 18692 rw_exit(&ipst->ips_ill_g_lock); 18693 18694 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18695 ip3dbg(("ip_snmp_get_mib2_ip6_addr: level %d, name %d, len %d\n", 18696 (int)optp->level, (int)optp->name, (int)optp->len)); 18697 qreply(q, mpctl); 18698 return (mp2ctl); 18699 } 18700 18701 /* IPv4 multicast group membership. */ 18702 static mblk_t * 18703 ip_snmp_get_mib2_ip_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18704 { 18705 struct opthdr *optp; 18706 mblk_t *mp2ctl; 18707 ill_t *ill; 18708 ipif_t *ipif; 18709 ilm_t *ilm; 18710 ip_member_t ipm; 18711 mblk_t *mp_tail = NULL; 18712 ill_walk_context_t ctx; 18713 zoneid_t zoneid; 18714 18715 /* 18716 * make a copy of the original message 18717 */ 18718 mp2ctl = copymsg(mpctl); 18719 zoneid = Q_TO_CONN(q)->conn_zoneid; 18720 18721 /* ipGroupMember table */ 18722 optp = (struct opthdr *)&mpctl->b_rptr[ 18723 sizeof (struct T_optmgmt_ack)]; 18724 optp->level = MIB2_IP; 18725 optp->name = EXPER_IP_GROUP_MEMBERSHIP; 18726 18727 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18728 ill = ILL_START_WALK_V4(&ctx, ipst); 18729 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18730 ILM_WALKER_HOLD(ill); 18731 for (ipif = ill->ill_ipif; ipif != NULL; 18732 ipif = ipif->ipif_next) { 18733 if (ipif->ipif_zoneid != zoneid && 18734 ipif->ipif_zoneid != ALL_ZONES) 18735 continue; /* not this zone */ 18736 (void) ipif_get_name(ipif, 18737 ipm.ipGroupMemberIfIndex.o_bytes, 18738 OCTET_LENGTH); 18739 ipm.ipGroupMemberIfIndex.o_length = 18740 mi_strlen(ipm.ipGroupMemberIfIndex.o_bytes); 18741 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 18742 ASSERT(ilm->ilm_ipif != NULL); 18743 ASSERT(ilm->ilm_ill == NULL); 18744 if (ilm->ilm_ipif != ipif) 18745 continue; 18746 ipm.ipGroupMemberAddress = ilm->ilm_addr; 18747 ipm.ipGroupMemberRefCnt = ilm->ilm_refcnt; 18748 ipm.ipGroupMemberFilterMode = ilm->ilm_fmode; 18749 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 18750 (char *)&ipm, (int)sizeof (ipm))) { 18751 ip1dbg(("ip_snmp_get_mib2_ip_group: " 18752 "failed to allocate %u bytes\n", 18753 (uint_t)sizeof (ipm))); 18754 } 18755 } 18756 } 18757 ILM_WALKER_RELE(ill); 18758 } 18759 rw_exit(&ipst->ips_ill_g_lock); 18760 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18761 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 18762 (int)optp->level, (int)optp->name, (int)optp->len)); 18763 qreply(q, mpctl); 18764 return (mp2ctl); 18765 } 18766 18767 /* IPv6 multicast group membership. */ 18768 static mblk_t * 18769 ip_snmp_get_mib2_ip6_group_mem(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18770 { 18771 struct opthdr *optp; 18772 mblk_t *mp2ctl; 18773 ill_t *ill; 18774 ilm_t *ilm; 18775 ipv6_member_t ipm6; 18776 mblk_t *mp_tail = NULL; 18777 ill_walk_context_t ctx; 18778 zoneid_t zoneid; 18779 18780 /* 18781 * make a copy of the original message 18782 */ 18783 mp2ctl = copymsg(mpctl); 18784 zoneid = Q_TO_CONN(q)->conn_zoneid; 18785 18786 /* ip6GroupMember table */ 18787 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18788 optp->level = MIB2_IP6; 18789 optp->name = EXPER_IP6_GROUP_MEMBERSHIP; 18790 18791 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18792 ill = ILL_START_WALK_V6(&ctx, ipst); 18793 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18794 ILM_WALKER_HOLD(ill); 18795 ipm6.ipv6GroupMemberIfIndex = ill->ill_phyint->phyint_ifindex; 18796 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 18797 ASSERT(ilm->ilm_ipif == NULL); 18798 ASSERT(ilm->ilm_ill != NULL); 18799 if (ilm->ilm_zoneid != zoneid) 18800 continue; /* not this zone */ 18801 ipm6.ipv6GroupMemberAddress = ilm->ilm_v6addr; 18802 ipm6.ipv6GroupMemberRefCnt = ilm->ilm_refcnt; 18803 ipm6.ipv6GroupMemberFilterMode = ilm->ilm_fmode; 18804 if (!snmp_append_data2(mpctl->b_cont, 18805 &mp_tail, 18806 (char *)&ipm6, (int)sizeof (ipm6))) { 18807 ip1dbg(("ip_snmp_get_mib2_ip6_group: " 18808 "failed to allocate %u bytes\n", 18809 (uint_t)sizeof (ipm6))); 18810 } 18811 } 18812 ILM_WALKER_RELE(ill); 18813 } 18814 rw_exit(&ipst->ips_ill_g_lock); 18815 18816 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18817 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 18818 (int)optp->level, (int)optp->name, (int)optp->len)); 18819 qreply(q, mpctl); 18820 return (mp2ctl); 18821 } 18822 18823 /* IP multicast filtered sources */ 18824 static mblk_t * 18825 ip_snmp_get_mib2_ip_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18826 { 18827 struct opthdr *optp; 18828 mblk_t *mp2ctl; 18829 ill_t *ill; 18830 ipif_t *ipif; 18831 ilm_t *ilm; 18832 ip_grpsrc_t ips; 18833 mblk_t *mp_tail = NULL; 18834 ill_walk_context_t ctx; 18835 zoneid_t zoneid; 18836 int i; 18837 slist_t *sl; 18838 18839 /* 18840 * make a copy of the original message 18841 */ 18842 mp2ctl = copymsg(mpctl); 18843 zoneid = Q_TO_CONN(q)->conn_zoneid; 18844 18845 /* ipGroupSource table */ 18846 optp = (struct opthdr *)&mpctl->b_rptr[ 18847 sizeof (struct T_optmgmt_ack)]; 18848 optp->level = MIB2_IP; 18849 optp->name = EXPER_IP_GROUP_SOURCES; 18850 18851 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18852 ill = ILL_START_WALK_V4(&ctx, ipst); 18853 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18854 ILM_WALKER_HOLD(ill); 18855 for (ipif = ill->ill_ipif; ipif != NULL; 18856 ipif = ipif->ipif_next) { 18857 if (ipif->ipif_zoneid != zoneid) 18858 continue; /* not this zone */ 18859 (void) ipif_get_name(ipif, 18860 ips.ipGroupSourceIfIndex.o_bytes, 18861 OCTET_LENGTH); 18862 ips.ipGroupSourceIfIndex.o_length = 18863 mi_strlen(ips.ipGroupSourceIfIndex.o_bytes); 18864 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 18865 ASSERT(ilm->ilm_ipif != NULL); 18866 ASSERT(ilm->ilm_ill == NULL); 18867 sl = ilm->ilm_filter; 18868 if (ilm->ilm_ipif != ipif || SLIST_IS_EMPTY(sl)) 18869 continue; 18870 ips.ipGroupSourceGroup = ilm->ilm_addr; 18871 for (i = 0; i < sl->sl_numsrc; i++) { 18872 if (!IN6_IS_ADDR_V4MAPPED( 18873 &sl->sl_addr[i])) 18874 continue; 18875 IN6_V4MAPPED_TO_IPADDR(&sl->sl_addr[i], 18876 ips.ipGroupSourceAddress); 18877 if (snmp_append_data2(mpctl->b_cont, 18878 &mp_tail, (char *)&ips, 18879 (int)sizeof (ips)) == 0) { 18880 ip1dbg(("ip_snmp_get_mib2_" 18881 "ip_group_src: failed to " 18882 "allocate %u bytes\n", 18883 (uint_t)sizeof (ips))); 18884 } 18885 } 18886 } 18887 } 18888 ILM_WALKER_RELE(ill); 18889 } 18890 rw_exit(&ipst->ips_ill_g_lock); 18891 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18892 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 18893 (int)optp->level, (int)optp->name, (int)optp->len)); 18894 qreply(q, mpctl); 18895 return (mp2ctl); 18896 } 18897 18898 /* IPv6 multicast filtered sources. */ 18899 static mblk_t * 18900 ip_snmp_get_mib2_ip6_group_src(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18901 { 18902 struct opthdr *optp; 18903 mblk_t *mp2ctl; 18904 ill_t *ill; 18905 ilm_t *ilm; 18906 ipv6_grpsrc_t ips6; 18907 mblk_t *mp_tail = NULL; 18908 ill_walk_context_t ctx; 18909 zoneid_t zoneid; 18910 int i; 18911 slist_t *sl; 18912 18913 /* 18914 * make a copy of the original message 18915 */ 18916 mp2ctl = copymsg(mpctl); 18917 zoneid = Q_TO_CONN(q)->conn_zoneid; 18918 18919 /* ip6GroupMember table */ 18920 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18921 optp->level = MIB2_IP6; 18922 optp->name = EXPER_IP6_GROUP_SOURCES; 18923 18924 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 18925 ill = ILL_START_WALK_V6(&ctx, ipst); 18926 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 18927 ILM_WALKER_HOLD(ill); 18928 ips6.ipv6GroupSourceIfIndex = ill->ill_phyint->phyint_ifindex; 18929 for (ilm = ill->ill_ilm; ilm; ilm = ilm->ilm_next) { 18930 ASSERT(ilm->ilm_ipif == NULL); 18931 ASSERT(ilm->ilm_ill != NULL); 18932 sl = ilm->ilm_filter; 18933 if (ilm->ilm_zoneid != zoneid || SLIST_IS_EMPTY(sl)) 18934 continue; 18935 ips6.ipv6GroupSourceGroup = ilm->ilm_v6addr; 18936 for (i = 0; i < sl->sl_numsrc; i++) { 18937 ips6.ipv6GroupSourceAddress = sl->sl_addr[i]; 18938 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 18939 (char *)&ips6, (int)sizeof (ips6))) { 18940 ip1dbg(("ip_snmp_get_mib2_ip6_" 18941 "group_src: failed to allocate " 18942 "%u bytes\n", 18943 (uint_t)sizeof (ips6))); 18944 } 18945 } 18946 } 18947 ILM_WALKER_RELE(ill); 18948 } 18949 rw_exit(&ipst->ips_ill_g_lock); 18950 18951 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18952 ip3dbg(("ip_snmp_get: level %d, name %d, len %d\n", 18953 (int)optp->level, (int)optp->name, (int)optp->len)); 18954 qreply(q, mpctl); 18955 return (mp2ctl); 18956 } 18957 18958 /* Multicast routing virtual interface table. */ 18959 static mblk_t * 18960 ip_snmp_get_mib2_virt_multi(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18961 { 18962 struct opthdr *optp; 18963 mblk_t *mp2ctl; 18964 18965 /* 18966 * make a copy of the original message 18967 */ 18968 mp2ctl = copymsg(mpctl); 18969 18970 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18971 optp->level = EXPER_DVMRP; 18972 optp->name = EXPER_DVMRP_VIF; 18973 if (!ip_mroute_vif(mpctl->b_cont, ipst)) { 18974 ip0dbg(("ip_mroute_vif: failed\n")); 18975 } 18976 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 18977 ip3dbg(("ip_snmp_get_mib2_virt_multi: level %d, name %d, len %d\n", 18978 (int)optp->level, (int)optp->name, (int)optp->len)); 18979 qreply(q, mpctl); 18980 return (mp2ctl); 18981 } 18982 18983 /* Multicast routing table. */ 18984 static mblk_t * 18985 ip_snmp_get_mib2_multi_rtable(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 18986 { 18987 struct opthdr *optp; 18988 mblk_t *mp2ctl; 18989 18990 /* 18991 * make a copy of the original message 18992 */ 18993 mp2ctl = copymsg(mpctl); 18994 18995 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 18996 optp->level = EXPER_DVMRP; 18997 optp->name = EXPER_DVMRP_MRT; 18998 if (!ip_mroute_mrt(mpctl->b_cont, ipst)) { 18999 ip0dbg(("ip_mroute_mrt: failed\n")); 19000 } 19001 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 19002 ip3dbg(("ip_snmp_get_mib2_multi_rtable: level %d, name %d, len %d\n", 19003 (int)optp->level, (int)optp->name, (int)optp->len)); 19004 qreply(q, mpctl); 19005 return (mp2ctl); 19006 } 19007 19008 /* 19009 * Return ipRouteEntryTable, ipNetToMediaEntryTable, and ipRouteAttributeTable 19010 * in one IRE walk. 19011 */ 19012 static mblk_t * 19013 ip_snmp_get_mib2_ip_route_media(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 19014 { 19015 struct opthdr *optp; 19016 mblk_t *mp2ctl; /* Returned */ 19017 mblk_t *mp3ctl; /* nettomedia */ 19018 mblk_t *mp4ctl; /* routeattrs */ 19019 iproutedata_t ird; 19020 zoneid_t zoneid; 19021 19022 /* 19023 * make copies of the original message 19024 * - mp2ctl is returned unchanged to the caller for his use 19025 * - mpctl is sent upstream as ipRouteEntryTable 19026 * - mp3ctl is sent upstream as ipNetToMediaEntryTable 19027 * - mp4ctl is sent upstream as ipRouteAttributeTable 19028 */ 19029 mp2ctl = copymsg(mpctl); 19030 mp3ctl = copymsg(mpctl); 19031 mp4ctl = copymsg(mpctl); 19032 if (mp3ctl == NULL || mp4ctl == NULL) { 19033 freemsg(mp4ctl); 19034 freemsg(mp3ctl); 19035 freemsg(mp2ctl); 19036 freemsg(mpctl); 19037 return (NULL); 19038 } 19039 19040 bzero(&ird, sizeof (ird)); 19041 19042 ird.ird_route.lp_head = mpctl->b_cont; 19043 ird.ird_netmedia.lp_head = mp3ctl->b_cont; 19044 ird.ird_attrs.lp_head = mp4ctl->b_cont; 19045 19046 zoneid = Q_TO_CONN(q)->conn_zoneid; 19047 ire_walk_v4(ip_snmp_get2_v4, &ird, zoneid, ipst); 19048 if (zoneid == GLOBAL_ZONEID) { 19049 /* 19050 * Those IREs are used by Mobile-IP; since mipagent(1M) 19051 * requires the sys_net_config or sys_ip_config privilege, 19052 * it can only run in the global zone or an exclusive-IP zone, 19053 * and both those have a conn_zoneid == GLOBAL_ZONEID. 19054 */ 19055 ire_walk_srcif_table_v4(ip_snmp_get2_v4, &ird, ipst); 19056 ire_walk_ill_mrtun(0, 0, ip_snmp_get2_v4, &ird, NULL, ipst); 19057 } 19058 19059 /* ipRouteEntryTable in mpctl */ 19060 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19061 optp->level = MIB2_IP; 19062 optp->name = MIB2_IP_ROUTE; 19063 optp->len = msgdsize(ird.ird_route.lp_head); 19064 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n", 19065 (int)optp->level, (int)optp->name, (int)optp->len)); 19066 qreply(q, mpctl); 19067 19068 /* ipNetToMediaEntryTable in mp3ctl */ 19069 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19070 optp->level = MIB2_IP; 19071 optp->name = MIB2_IP_MEDIA; 19072 optp->len = msgdsize(ird.ird_netmedia.lp_head); 19073 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n", 19074 (int)optp->level, (int)optp->name, (int)optp->len)); 19075 qreply(q, mp3ctl); 19076 19077 /* ipRouteAttributeTable in mp4ctl */ 19078 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19079 optp->level = MIB2_IP; 19080 optp->name = EXPER_IP_RTATTR; 19081 optp->len = msgdsize(ird.ird_attrs.lp_head); 19082 ip3dbg(("ip_snmp_get_mib2_ip_route_media: level %d, name %d, len %d\n", 19083 (int)optp->level, (int)optp->name, (int)optp->len)); 19084 if (optp->len == 0) 19085 freemsg(mp4ctl); 19086 else 19087 qreply(q, mp4ctl); 19088 19089 return (mp2ctl); 19090 } 19091 19092 /* 19093 * Return ipv6RouteEntryTable and ipv6RouteAttributeTable in one IRE walk, and 19094 * ipv6NetToMediaEntryTable in an NDP walk. 19095 */ 19096 static mblk_t * 19097 ip_snmp_get_mib2_ip6_route_media(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 19098 { 19099 struct opthdr *optp; 19100 mblk_t *mp2ctl; /* Returned */ 19101 mblk_t *mp3ctl; /* nettomedia */ 19102 mblk_t *mp4ctl; /* routeattrs */ 19103 iproutedata_t ird; 19104 zoneid_t zoneid; 19105 19106 /* 19107 * make copies of the original message 19108 * - mp2ctl is returned unchanged to the caller for his use 19109 * - mpctl is sent upstream as ipv6RouteEntryTable 19110 * - mp3ctl is sent upstream as ipv6NetToMediaEntryTable 19111 * - mp4ctl is sent upstream as ipv6RouteAttributeTable 19112 */ 19113 mp2ctl = copymsg(mpctl); 19114 mp3ctl = copymsg(mpctl); 19115 mp4ctl = copymsg(mpctl); 19116 if (mp3ctl == NULL || mp4ctl == NULL) { 19117 freemsg(mp4ctl); 19118 freemsg(mp3ctl); 19119 freemsg(mp2ctl); 19120 freemsg(mpctl); 19121 return (NULL); 19122 } 19123 19124 bzero(&ird, sizeof (ird)); 19125 19126 ird.ird_route.lp_head = mpctl->b_cont; 19127 ird.ird_netmedia.lp_head = mp3ctl->b_cont; 19128 ird.ird_attrs.lp_head = mp4ctl->b_cont; 19129 19130 zoneid = Q_TO_CONN(q)->conn_zoneid; 19131 ire_walk_v6(ip_snmp_get2_v6_route, &ird, zoneid, ipst); 19132 19133 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19134 optp->level = MIB2_IP6; 19135 optp->name = MIB2_IP6_ROUTE; 19136 optp->len = msgdsize(ird.ird_route.lp_head); 19137 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n", 19138 (int)optp->level, (int)optp->name, (int)optp->len)); 19139 qreply(q, mpctl); 19140 19141 /* ipv6NetToMediaEntryTable in mp3ctl */ 19142 ndp_walk(NULL, ip_snmp_get2_v6_media, &ird, ipst); 19143 19144 optp = (struct opthdr *)&mp3ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19145 optp->level = MIB2_IP6; 19146 optp->name = MIB2_IP6_MEDIA; 19147 optp->len = msgdsize(ird.ird_netmedia.lp_head); 19148 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n", 19149 (int)optp->level, (int)optp->name, (int)optp->len)); 19150 qreply(q, mp3ctl); 19151 19152 /* ipv6RouteAttributeTable in mp4ctl */ 19153 optp = (struct opthdr *)&mp4ctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19154 optp->level = MIB2_IP6; 19155 optp->name = EXPER_IP_RTATTR; 19156 optp->len = msgdsize(ird.ird_attrs.lp_head); 19157 ip3dbg(("ip_snmp_get_mib2_ip6_route_media: level %d, name %d, len %d\n", 19158 (int)optp->level, (int)optp->name, (int)optp->len)); 19159 if (optp->len == 0) 19160 freemsg(mp4ctl); 19161 else 19162 qreply(q, mp4ctl); 19163 19164 return (mp2ctl); 19165 } 19166 19167 /* 19168 * IPv6 mib: One per ill 19169 */ 19170 static mblk_t * 19171 ip_snmp_get_mib2_ip6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 19172 { 19173 struct opthdr *optp; 19174 mblk_t *mp2ctl; 19175 ill_t *ill; 19176 ill_walk_context_t ctx; 19177 mblk_t *mp_tail = NULL; 19178 19179 /* 19180 * Make a copy of the original message 19181 */ 19182 mp2ctl = copymsg(mpctl); 19183 19184 /* fixed length IPv6 structure ... */ 19185 19186 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19187 optp->level = MIB2_IP6; 19188 optp->name = 0; 19189 /* Include "unknown interface" ip6_mib */ 19190 ipst->ips_ip6_mib.ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6; 19191 ipst->ips_ip6_mib.ipIfStatsIfIndex = 19192 MIB2_UNKNOWN_INTERFACE; /* Flag to netstat */ 19193 SET_MIB(ipst->ips_ip6_mib.ipIfStatsForwarding, 19194 ipst->ips_ipv6_forward ? 1 : 2); 19195 SET_MIB(ipst->ips_ip6_mib.ipIfStatsDefaultHopLimit, 19196 ipst->ips_ipv6_def_hops); 19197 SET_MIB(ipst->ips_ip6_mib.ipIfStatsEntrySize, 19198 sizeof (mib2_ipIfStatsEntry_t)); 19199 SET_MIB(ipst->ips_ip6_mib.ipIfStatsAddrEntrySize, 19200 sizeof (mib2_ipv6AddrEntry_t)); 19201 SET_MIB(ipst->ips_ip6_mib.ipIfStatsRouteEntrySize, 19202 sizeof (mib2_ipv6RouteEntry_t)); 19203 SET_MIB(ipst->ips_ip6_mib.ipIfStatsNetToMediaEntrySize, 19204 sizeof (mib2_ipv6NetToMediaEntry_t)); 19205 SET_MIB(ipst->ips_ip6_mib.ipIfStatsMemberEntrySize, 19206 sizeof (ipv6_member_t)); 19207 SET_MIB(ipst->ips_ip6_mib.ipIfStatsGroupSourceEntrySize, 19208 sizeof (ipv6_grpsrc_t)); 19209 19210 /* 19211 * Synchronize 64- and 32-bit counters 19212 */ 19213 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInReceives, 19214 ipIfStatsHCInReceives); 19215 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInDelivers, 19216 ipIfStatsHCInDelivers); 19217 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutRequests, 19218 ipIfStatsHCOutRequests); 19219 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutForwDatagrams, 19220 ipIfStatsHCOutForwDatagrams); 19221 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsOutMcastPkts, 19222 ipIfStatsHCOutMcastPkts); 19223 SYNC32_MIB(&ipst->ips_ip6_mib, ipIfStatsInMcastPkts, 19224 ipIfStatsHCInMcastPkts); 19225 19226 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 19227 (char *)&ipst->ips_ip6_mib, (int)sizeof (ipst->ips_ip6_mib))) { 19228 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate %u bytes\n", 19229 (uint_t)sizeof (ipst->ips_ip6_mib))); 19230 } 19231 19232 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 19233 ill = ILL_START_WALK_V6(&ctx, ipst); 19234 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 19235 ill->ill_ip_mib->ipIfStatsIfIndex = 19236 ill->ill_phyint->phyint_ifindex; 19237 SET_MIB(ill->ill_ip_mib->ipIfStatsForwarding, 19238 ipst->ips_ipv6_forward ? 1 : 2); 19239 SET_MIB(ill->ill_ip_mib->ipIfStatsDefaultHopLimit, 19240 ill->ill_max_hops); 19241 19242 /* 19243 * Synchronize 64- and 32-bit counters 19244 */ 19245 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInReceives, 19246 ipIfStatsHCInReceives); 19247 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInDelivers, 19248 ipIfStatsHCInDelivers); 19249 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutRequests, 19250 ipIfStatsHCOutRequests); 19251 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutForwDatagrams, 19252 ipIfStatsHCOutForwDatagrams); 19253 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsOutMcastPkts, 19254 ipIfStatsHCOutMcastPkts); 19255 SYNC32_MIB(ill->ill_ip_mib, ipIfStatsInMcastPkts, 19256 ipIfStatsHCInMcastPkts); 19257 19258 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 19259 (char *)ill->ill_ip_mib, 19260 (int)sizeof (*ill->ill_ip_mib))) { 19261 ip1dbg(("ip_snmp_get_mib2_ip6: failed to allocate " 19262 "%u bytes\n", 19263 (uint_t)sizeof (*ill->ill_ip_mib))); 19264 } 19265 } 19266 rw_exit(&ipst->ips_ill_g_lock); 19267 19268 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 19269 ip3dbg(("ip_snmp_get_mib2_ip6: level %d, name %d, len %d\n", 19270 (int)optp->level, (int)optp->name, (int)optp->len)); 19271 qreply(q, mpctl); 19272 return (mp2ctl); 19273 } 19274 19275 /* 19276 * ICMPv6 mib: One per ill 19277 */ 19278 static mblk_t * 19279 ip_snmp_get_mib2_icmp6(queue_t *q, mblk_t *mpctl, ip_stack_t *ipst) 19280 { 19281 struct opthdr *optp; 19282 mblk_t *mp2ctl; 19283 ill_t *ill; 19284 ill_walk_context_t ctx; 19285 mblk_t *mp_tail = NULL; 19286 /* 19287 * Make a copy of the original message 19288 */ 19289 mp2ctl = copymsg(mpctl); 19290 19291 /* fixed length ICMPv6 structure ... */ 19292 19293 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 19294 optp->level = MIB2_ICMP6; 19295 optp->name = 0; 19296 /* Include "unknown interface" icmp6_mib */ 19297 ipst->ips_icmp6_mib.ipv6IfIcmpIfIndex = 19298 MIB2_UNKNOWN_INTERFACE; /* netstat flag */ 19299 ipst->ips_icmp6_mib.ipv6IfIcmpEntrySize = 19300 sizeof (mib2_ipv6IfIcmpEntry_t); 19301 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 19302 (char *)&ipst->ips_icmp6_mib, 19303 (int)sizeof (ipst->ips_icmp6_mib))) { 19304 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate %u bytes\n", 19305 (uint_t)sizeof (ipst->ips_icmp6_mib))); 19306 } 19307 19308 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 19309 ill = ILL_START_WALK_V6(&ctx, ipst); 19310 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 19311 ill->ill_icmp6_mib->ipv6IfIcmpIfIndex = 19312 ill->ill_phyint->phyint_ifindex; 19313 if (!snmp_append_data2(mpctl->b_cont, &mp_tail, 19314 (char *)ill->ill_icmp6_mib, 19315 (int)sizeof (*ill->ill_icmp6_mib))) { 19316 ip1dbg(("ip_snmp_get_mib2_icmp6: failed to allocate " 19317 "%u bytes\n", 19318 (uint_t)sizeof (*ill->ill_icmp6_mib))); 19319 } 19320 } 19321 rw_exit(&ipst->ips_ill_g_lock); 19322 19323 optp->len = (t_uscalar_t)msgdsize(mpctl->b_cont); 19324 ip3dbg(("ip_snmp_get_mib2_icmp6: level %d, name %d, len %d\n", 19325 (int)optp->level, (int)optp->name, (int)optp->len)); 19326 qreply(q, mpctl); 19327 return (mp2ctl); 19328 } 19329 19330 /* 19331 * ire_walk routine to create both ipRouteEntryTable and 19332 * ipRouteAttributeTable in one IRE walk 19333 */ 19334 static void 19335 ip_snmp_get2_v4(ire_t *ire, iproutedata_t *ird) 19336 { 19337 ill_t *ill; 19338 ipif_t *ipif; 19339 mib2_ipRouteEntry_t *re; 19340 mib2_ipAttributeEntry_t *iae, *iaeptr; 19341 ipaddr_t gw_addr; 19342 tsol_ire_gw_secattr_t *attrp; 19343 tsol_gc_t *gc = NULL; 19344 tsol_gcgrp_t *gcgrp = NULL; 19345 uint_t sacnt = 0; 19346 int i; 19347 19348 ASSERT(ire->ire_ipversion == IPV4_VERSION); 19349 19350 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL) 19351 return; 19352 19353 if ((attrp = ire->ire_gw_secattr) != NULL) { 19354 mutex_enter(&attrp->igsa_lock); 19355 if ((gc = attrp->igsa_gc) != NULL) { 19356 gcgrp = gc->gc_grp; 19357 ASSERT(gcgrp != NULL); 19358 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER); 19359 sacnt = 1; 19360 } else if ((gcgrp = attrp->igsa_gcgrp) != NULL) { 19361 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER); 19362 gc = gcgrp->gcgrp_head; 19363 sacnt = gcgrp->gcgrp_count; 19364 } 19365 mutex_exit(&attrp->igsa_lock); 19366 19367 /* do nothing if there's no gc to report */ 19368 if (gc == NULL) { 19369 ASSERT(sacnt == 0); 19370 if (gcgrp != NULL) { 19371 /* we might as well drop the lock now */ 19372 rw_exit(&gcgrp->gcgrp_rwlock); 19373 gcgrp = NULL; 19374 } 19375 attrp = NULL; 19376 } 19377 19378 ASSERT(gc == NULL || (gcgrp != NULL && 19379 RW_LOCK_HELD(&gcgrp->gcgrp_rwlock))); 19380 } 19381 ASSERT(sacnt == 0 || gc != NULL); 19382 19383 if (sacnt != 0 && 19384 (iae = kmem_alloc(sacnt * sizeof (*iae), KM_NOSLEEP)) == NULL) { 19385 kmem_free(re, sizeof (*re)); 19386 rw_exit(&gcgrp->gcgrp_rwlock); 19387 return; 19388 } 19389 19390 /* 19391 * Return all IRE types for route table... let caller pick and choose 19392 */ 19393 re->ipRouteDest = ire->ire_addr; 19394 ipif = ire->ire_ipif; 19395 re->ipRouteIfIndex.o_length = 0; 19396 if (ire->ire_type == IRE_CACHE) { 19397 ill = (ill_t *)ire->ire_stq->q_ptr; 19398 re->ipRouteIfIndex.o_length = 19399 ill->ill_name_length == 0 ? 0 : 19400 MIN(OCTET_LENGTH, ill->ill_name_length - 1); 19401 bcopy(ill->ill_name, re->ipRouteIfIndex.o_bytes, 19402 re->ipRouteIfIndex.o_length); 19403 } else if (ipif != NULL) { 19404 (void) ipif_get_name(ipif, re->ipRouteIfIndex.o_bytes, 19405 OCTET_LENGTH); 19406 re->ipRouteIfIndex.o_length = 19407 mi_strlen(re->ipRouteIfIndex.o_bytes); 19408 } 19409 re->ipRouteMetric1 = -1; 19410 re->ipRouteMetric2 = -1; 19411 re->ipRouteMetric3 = -1; 19412 re->ipRouteMetric4 = -1; 19413 19414 gw_addr = ire->ire_gateway_addr; 19415 19416 if (ire->ire_type & (IRE_INTERFACE|IRE_LOOPBACK|IRE_BROADCAST)) 19417 re->ipRouteNextHop = ire->ire_src_addr; 19418 else 19419 re->ipRouteNextHop = gw_addr; 19420 /* indirect(4), direct(3), or invalid(2) */ 19421 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) 19422 re->ipRouteType = 2; 19423 else 19424 re->ipRouteType = (gw_addr != 0) ? 4 : 3; 19425 re->ipRouteProto = -1; 19426 re->ipRouteAge = gethrestime_sec() - ire->ire_create_time; 19427 re->ipRouteMask = ire->ire_mask; 19428 re->ipRouteMetric5 = -1; 19429 re->ipRouteInfo.re_max_frag = ire->ire_max_frag; 19430 re->ipRouteInfo.re_frag_flag = ire->ire_frag_flag; 19431 re->ipRouteInfo.re_rtt = ire->ire_uinfo.iulp_rtt; 19432 re->ipRouteInfo.re_ref = ire->ire_refcnt; 19433 re->ipRouteInfo.re_src_addr = ire->ire_src_addr; 19434 re->ipRouteInfo.re_obpkt = ire->ire_ob_pkt_count; 19435 re->ipRouteInfo.re_ibpkt = ire->ire_ib_pkt_count; 19436 re->ipRouteInfo.re_flags = ire->ire_flags; 19437 re->ipRouteInfo.re_in_ill.o_length = 0; 19438 19439 if (ire->ire_flags & RTF_DYNAMIC) { 19440 re->ipRouteInfo.re_ire_type = IRE_HOST_REDIRECT; 19441 } else { 19442 re->ipRouteInfo.re_ire_type = ire->ire_type; 19443 } 19444 19445 if (ire->ire_in_ill != NULL) { 19446 re->ipRouteInfo.re_in_ill.o_length = 19447 ire->ire_in_ill->ill_name_length == 0 ? 0 : 19448 MIN(OCTET_LENGTH, ire->ire_in_ill->ill_name_length - 1); 19449 bcopy(ire->ire_in_ill->ill_name, 19450 re->ipRouteInfo.re_in_ill.o_bytes, 19451 re->ipRouteInfo.re_in_ill.o_length); 19452 } 19453 re->ipRouteInfo.re_in_src_addr = ire->ire_in_src_addr; 19454 19455 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail, 19456 (char *)re, (int)sizeof (*re))) { 19457 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n", 19458 (uint_t)sizeof (*re))); 19459 } 19460 19461 for (iaeptr = iae, i = 0; i < sacnt; i++, iaeptr++, gc = gc->gc_next) { 19462 iaeptr->iae_routeidx = ird->ird_idx; 19463 iaeptr->iae_doi = gc->gc_db->gcdb_doi; 19464 iaeptr->iae_slrange = gc->gc_db->gcdb_slrange; 19465 } 19466 19467 if (!snmp_append_data2(ird->ird_attrs.lp_head, &ird->ird_attrs.lp_tail, 19468 (char *)iae, sacnt * sizeof (*iae))) { 19469 ip1dbg(("ip_snmp_get2_v4: failed to allocate %u bytes\n", 19470 (unsigned)(sacnt * sizeof (*iae)))); 19471 } 19472 19473 /* bump route index for next pass */ 19474 ird->ird_idx++; 19475 19476 kmem_free(re, sizeof (*re)); 19477 if (sacnt != 0) 19478 kmem_free(iae, sacnt * sizeof (*iae)); 19479 19480 if (gcgrp != NULL) 19481 rw_exit(&gcgrp->gcgrp_rwlock); 19482 } 19483 19484 /* 19485 * ire_walk routine to create ipv6RouteEntryTable and ipRouteEntryTable. 19486 */ 19487 static void 19488 ip_snmp_get2_v6_route(ire_t *ire, iproutedata_t *ird) 19489 { 19490 ill_t *ill; 19491 ipif_t *ipif; 19492 mib2_ipv6RouteEntry_t *re; 19493 mib2_ipAttributeEntry_t *iae, *iaeptr; 19494 in6_addr_t gw_addr_v6; 19495 tsol_ire_gw_secattr_t *attrp; 19496 tsol_gc_t *gc = NULL; 19497 tsol_gcgrp_t *gcgrp = NULL; 19498 uint_t sacnt = 0; 19499 int i; 19500 19501 ASSERT(ire->ire_ipversion == IPV6_VERSION); 19502 19503 if ((re = kmem_zalloc(sizeof (*re), KM_NOSLEEP)) == NULL) 19504 return; 19505 19506 if ((attrp = ire->ire_gw_secattr) != NULL) { 19507 mutex_enter(&attrp->igsa_lock); 19508 if ((gc = attrp->igsa_gc) != NULL) { 19509 gcgrp = gc->gc_grp; 19510 ASSERT(gcgrp != NULL); 19511 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER); 19512 sacnt = 1; 19513 } else if ((gcgrp = attrp->igsa_gcgrp) != NULL) { 19514 rw_enter(&gcgrp->gcgrp_rwlock, RW_READER); 19515 gc = gcgrp->gcgrp_head; 19516 sacnt = gcgrp->gcgrp_count; 19517 } 19518 mutex_exit(&attrp->igsa_lock); 19519 19520 /* do nothing if there's no gc to report */ 19521 if (gc == NULL) { 19522 ASSERT(sacnt == 0); 19523 if (gcgrp != NULL) { 19524 /* we might as well drop the lock now */ 19525 rw_exit(&gcgrp->gcgrp_rwlock); 19526 gcgrp = NULL; 19527 } 19528 attrp = NULL; 19529 } 19530 19531 ASSERT(gc == NULL || (gcgrp != NULL && 19532 RW_LOCK_HELD(&gcgrp->gcgrp_rwlock))); 19533 } 19534 ASSERT(sacnt == 0 || gc != NULL); 19535 19536 if (sacnt != 0 && 19537 (iae = kmem_alloc(sacnt * sizeof (*iae), KM_NOSLEEP)) == NULL) { 19538 kmem_free(re, sizeof (*re)); 19539 rw_exit(&gcgrp->gcgrp_rwlock); 19540 return; 19541 } 19542 19543 /* 19544 * Return all IRE types for route table... let caller pick and choose 19545 */ 19546 re->ipv6RouteDest = ire->ire_addr_v6; 19547 re->ipv6RoutePfxLength = ip_mask_to_plen_v6(&ire->ire_mask_v6); 19548 re->ipv6RouteIndex = 0; /* Unique when multiple with same dest/plen */ 19549 re->ipv6RouteIfIndex.o_length = 0; 19550 ipif = ire->ire_ipif; 19551 if (ire->ire_type == IRE_CACHE) { 19552 ill = (ill_t *)ire->ire_stq->q_ptr; 19553 re->ipv6RouteIfIndex.o_length = 19554 ill->ill_name_length == 0 ? 0 : 19555 MIN(OCTET_LENGTH, ill->ill_name_length - 1); 19556 bcopy(ill->ill_name, re->ipv6RouteIfIndex.o_bytes, 19557 re->ipv6RouteIfIndex.o_length); 19558 } else if (ipif != NULL) { 19559 (void) ipif_get_name(ipif, re->ipv6RouteIfIndex.o_bytes, 19560 OCTET_LENGTH); 19561 re->ipv6RouteIfIndex.o_length = 19562 mi_strlen(re->ipv6RouteIfIndex.o_bytes); 19563 } 19564 19565 ASSERT(!(ire->ire_type & IRE_BROADCAST)); 19566 19567 mutex_enter(&ire->ire_lock); 19568 gw_addr_v6 = ire->ire_gateway_addr_v6; 19569 mutex_exit(&ire->ire_lock); 19570 19571 if (ire->ire_type & (IRE_INTERFACE|IRE_LOOPBACK)) 19572 re->ipv6RouteNextHop = ire->ire_src_addr_v6; 19573 else 19574 re->ipv6RouteNextHop = gw_addr_v6; 19575 19576 /* remote(4), local(3), or discard(2) */ 19577 if (ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) 19578 re->ipv6RouteType = 2; 19579 else if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) 19580 re->ipv6RouteType = 3; 19581 else 19582 re->ipv6RouteType = 4; 19583 19584 re->ipv6RouteProtocol = -1; 19585 re->ipv6RoutePolicy = 0; 19586 re->ipv6RouteAge = gethrestime_sec() - ire->ire_create_time; 19587 re->ipv6RouteNextHopRDI = 0; 19588 re->ipv6RouteWeight = 0; 19589 re->ipv6RouteMetric = 0; 19590 re->ipv6RouteInfo.re_max_frag = ire->ire_max_frag; 19591 re->ipv6RouteInfo.re_frag_flag = ire->ire_frag_flag; 19592 re->ipv6RouteInfo.re_rtt = ire->ire_uinfo.iulp_rtt; 19593 re->ipv6RouteInfo.re_src_addr = ire->ire_src_addr_v6; 19594 re->ipv6RouteInfo.re_obpkt = ire->ire_ob_pkt_count; 19595 re->ipv6RouteInfo.re_ibpkt = ire->ire_ib_pkt_count; 19596 re->ipv6RouteInfo.re_ref = ire->ire_refcnt; 19597 re->ipv6RouteInfo.re_flags = ire->ire_flags; 19598 19599 if (ire->ire_flags & RTF_DYNAMIC) { 19600 re->ipv6RouteInfo.re_ire_type = IRE_HOST_REDIRECT; 19601 } else { 19602 re->ipv6RouteInfo.re_ire_type = ire->ire_type; 19603 } 19604 19605 if (!snmp_append_data2(ird->ird_route.lp_head, &ird->ird_route.lp_tail, 19606 (char *)re, (int)sizeof (*re))) { 19607 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u bytes\n", 19608 (uint_t)sizeof (*re))); 19609 } 19610 19611 for (iaeptr = iae, i = 0; i < sacnt; i++, iaeptr++, gc = gc->gc_next) { 19612 iaeptr->iae_routeidx = ird->ird_idx; 19613 iaeptr->iae_doi = gc->gc_db->gcdb_doi; 19614 iaeptr->iae_slrange = gc->gc_db->gcdb_slrange; 19615 } 19616 19617 if (!snmp_append_data2(ird->ird_attrs.lp_head, &ird->ird_attrs.lp_tail, 19618 (char *)iae, sacnt * sizeof (*iae))) { 19619 ip1dbg(("ip_snmp_get2_v6: failed to allocate %u bytes\n", 19620 (unsigned)(sacnt * sizeof (*iae)))); 19621 } 19622 19623 /* bump route index for next pass */ 19624 ird->ird_idx++; 19625 19626 kmem_free(re, sizeof (*re)); 19627 if (sacnt != 0) 19628 kmem_free(iae, sacnt * sizeof (*iae)); 19629 19630 if (gcgrp != NULL) 19631 rw_exit(&gcgrp->gcgrp_rwlock); 19632 } 19633 19634 /* 19635 * ndp_walk routine to create ipv6NetToMediaEntryTable 19636 */ 19637 static int 19638 ip_snmp_get2_v6_media(nce_t *nce, iproutedata_t *ird) 19639 { 19640 ill_t *ill; 19641 mib2_ipv6NetToMediaEntry_t ntme; 19642 dl_unitdata_req_t *dl; 19643 19644 ill = nce->nce_ill; 19645 if (ill->ill_isv6 == B_FALSE) /* skip arpce entry */ 19646 return (0); 19647 19648 /* 19649 * Neighbor cache entry attached to IRE with on-link 19650 * destination. 19651 */ 19652 ntme.ipv6NetToMediaIfIndex = ill->ill_phyint->phyint_ifindex; 19653 ntme.ipv6NetToMediaNetAddress = nce->nce_addr; 19654 if ((ill->ill_flags & ILLF_XRESOLV) && 19655 (nce->nce_res_mp != NULL)) { 19656 dl = (dl_unitdata_req_t *)(nce->nce_res_mp->b_rptr); 19657 ntme.ipv6NetToMediaPhysAddress.o_length = 19658 dl->dl_dest_addr_length; 19659 } else { 19660 ntme.ipv6NetToMediaPhysAddress.o_length = 19661 ill->ill_phys_addr_length; 19662 } 19663 if (nce->nce_res_mp != NULL) { 19664 bcopy((char *)nce->nce_res_mp->b_rptr + 19665 NCE_LL_ADDR_OFFSET(ill), 19666 ntme.ipv6NetToMediaPhysAddress.o_bytes, 19667 ntme.ipv6NetToMediaPhysAddress.o_length); 19668 } else { 19669 bzero(ntme.ipv6NetToMediaPhysAddress.o_bytes, 19670 ill->ill_phys_addr_length); 19671 } 19672 /* 19673 * Note: Returns ND_* states. Should be: 19674 * reachable(1), stale(2), delay(3), probe(4), 19675 * invalid(5), unknown(6) 19676 */ 19677 ntme.ipv6NetToMediaState = nce->nce_state; 19678 ntme.ipv6NetToMediaLastUpdated = 0; 19679 19680 /* other(1), dynamic(2), static(3), local(4) */ 19681 if (IN6_IS_ADDR_LOOPBACK(&nce->nce_addr)) { 19682 ntme.ipv6NetToMediaType = 4; 19683 } else if (IN6_IS_ADDR_MULTICAST(&nce->nce_addr)) { 19684 ntme.ipv6NetToMediaType = 1; 19685 } else { 19686 ntme.ipv6NetToMediaType = 2; 19687 } 19688 19689 if (!snmp_append_data2(ird->ird_netmedia.lp_head, 19690 &ird->ird_netmedia.lp_tail, (char *)&ntme, sizeof (ntme))) { 19691 ip1dbg(("ip_snmp_get2_v6_media: failed to allocate %u bytes\n", 19692 (uint_t)sizeof (ntme))); 19693 } 19694 return (0); 19695 } 19696 19697 /* 19698 * return (0) if invalid set request, 1 otherwise, including non-tcp requests 19699 */ 19700 /* ARGSUSED */ 19701 int 19702 ip_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) 19703 { 19704 switch (level) { 19705 case MIB2_IP: 19706 case MIB2_ICMP: 19707 switch (name) { 19708 default: 19709 break; 19710 } 19711 return (1); 19712 default: 19713 return (1); 19714 } 19715 } 19716 19717 /* 19718 * When there exists both a 64- and 32-bit counter of a particular type 19719 * (i.e., InReceives), only the 64-bit counters are added. 19720 */ 19721 void 19722 ip_mib2_add_ip_stats(mib2_ipIfStatsEntry_t *o1, mib2_ipIfStatsEntry_t *o2) 19723 { 19724 UPDATE_MIB(o1, ipIfStatsInHdrErrors, o2->ipIfStatsInHdrErrors); 19725 UPDATE_MIB(o1, ipIfStatsInTooBigErrors, o2->ipIfStatsInTooBigErrors); 19726 UPDATE_MIB(o1, ipIfStatsInNoRoutes, o2->ipIfStatsInNoRoutes); 19727 UPDATE_MIB(o1, ipIfStatsInAddrErrors, o2->ipIfStatsInAddrErrors); 19728 UPDATE_MIB(o1, ipIfStatsInUnknownProtos, o2->ipIfStatsInUnknownProtos); 19729 UPDATE_MIB(o1, ipIfStatsInTruncatedPkts, o2->ipIfStatsInTruncatedPkts); 19730 UPDATE_MIB(o1, ipIfStatsInDiscards, o2->ipIfStatsInDiscards); 19731 UPDATE_MIB(o1, ipIfStatsOutDiscards, o2->ipIfStatsOutDiscards); 19732 UPDATE_MIB(o1, ipIfStatsOutFragOKs, o2->ipIfStatsOutFragOKs); 19733 UPDATE_MIB(o1, ipIfStatsOutFragFails, o2->ipIfStatsOutFragFails); 19734 UPDATE_MIB(o1, ipIfStatsOutFragCreates, o2->ipIfStatsOutFragCreates); 19735 UPDATE_MIB(o1, ipIfStatsReasmReqds, o2->ipIfStatsReasmReqds); 19736 UPDATE_MIB(o1, ipIfStatsReasmOKs, o2->ipIfStatsReasmOKs); 19737 UPDATE_MIB(o1, ipIfStatsReasmFails, o2->ipIfStatsReasmFails); 19738 UPDATE_MIB(o1, ipIfStatsOutNoRoutes, o2->ipIfStatsOutNoRoutes); 19739 UPDATE_MIB(o1, ipIfStatsReasmDuplicates, o2->ipIfStatsReasmDuplicates); 19740 UPDATE_MIB(o1, ipIfStatsReasmPartDups, o2->ipIfStatsReasmPartDups); 19741 UPDATE_MIB(o1, ipIfStatsForwProhibits, o2->ipIfStatsForwProhibits); 19742 UPDATE_MIB(o1, udpInCksumErrs, o2->udpInCksumErrs); 19743 UPDATE_MIB(o1, udpInOverflows, o2->udpInOverflows); 19744 UPDATE_MIB(o1, rawipInOverflows, o2->rawipInOverflows); 19745 UPDATE_MIB(o1, ipIfStatsInWrongIPVersion, 19746 o2->ipIfStatsInWrongIPVersion); 19747 UPDATE_MIB(o1, ipIfStatsOutWrongIPVersion, 19748 o2->ipIfStatsInWrongIPVersion); 19749 UPDATE_MIB(o1, ipIfStatsOutSwitchIPVersion, 19750 o2->ipIfStatsOutSwitchIPVersion); 19751 UPDATE_MIB(o1, ipIfStatsHCInReceives, o2->ipIfStatsHCInReceives); 19752 UPDATE_MIB(o1, ipIfStatsHCInOctets, o2->ipIfStatsHCInOctets); 19753 UPDATE_MIB(o1, ipIfStatsHCInForwDatagrams, 19754 o2->ipIfStatsHCInForwDatagrams); 19755 UPDATE_MIB(o1, ipIfStatsHCInDelivers, o2->ipIfStatsHCInDelivers); 19756 UPDATE_MIB(o1, ipIfStatsHCOutRequests, o2->ipIfStatsHCOutRequests); 19757 UPDATE_MIB(o1, ipIfStatsHCOutForwDatagrams, 19758 o2->ipIfStatsHCOutForwDatagrams); 19759 UPDATE_MIB(o1, ipIfStatsOutFragReqds, o2->ipIfStatsOutFragReqds); 19760 UPDATE_MIB(o1, ipIfStatsHCOutTransmits, o2->ipIfStatsHCOutTransmits); 19761 UPDATE_MIB(o1, ipIfStatsHCOutOctets, o2->ipIfStatsHCOutOctets); 19762 UPDATE_MIB(o1, ipIfStatsHCInMcastPkts, o2->ipIfStatsHCInMcastPkts); 19763 UPDATE_MIB(o1, ipIfStatsHCInMcastOctets, o2->ipIfStatsHCInMcastOctets); 19764 UPDATE_MIB(o1, ipIfStatsHCOutMcastPkts, o2->ipIfStatsHCOutMcastPkts); 19765 UPDATE_MIB(o1, ipIfStatsHCOutMcastOctets, 19766 o2->ipIfStatsHCOutMcastOctets); 19767 UPDATE_MIB(o1, ipIfStatsHCInBcastPkts, o2->ipIfStatsHCInBcastPkts); 19768 UPDATE_MIB(o1, ipIfStatsHCOutBcastPkts, o2->ipIfStatsHCOutBcastPkts); 19769 UPDATE_MIB(o1, ipsecInSucceeded, o2->ipsecInSucceeded); 19770 UPDATE_MIB(o1, ipsecInFailed, o2->ipsecInFailed); 19771 UPDATE_MIB(o1, ipInCksumErrs, o2->ipInCksumErrs); 19772 UPDATE_MIB(o1, tcpInErrs, o2->tcpInErrs); 19773 UPDATE_MIB(o1, udpNoPorts, o2->udpNoPorts); 19774 } 19775 19776 void 19777 ip_mib2_add_icmp6_stats(mib2_ipv6IfIcmpEntry_t *o1, mib2_ipv6IfIcmpEntry_t *o2) 19778 { 19779 UPDATE_MIB(o1, ipv6IfIcmpInMsgs, o2->ipv6IfIcmpInMsgs); 19780 UPDATE_MIB(o1, ipv6IfIcmpInErrors, o2->ipv6IfIcmpInErrors); 19781 UPDATE_MIB(o1, ipv6IfIcmpInDestUnreachs, o2->ipv6IfIcmpInDestUnreachs); 19782 UPDATE_MIB(o1, ipv6IfIcmpInAdminProhibs, o2->ipv6IfIcmpInAdminProhibs); 19783 UPDATE_MIB(o1, ipv6IfIcmpInTimeExcds, o2->ipv6IfIcmpInTimeExcds); 19784 UPDATE_MIB(o1, ipv6IfIcmpInParmProblems, o2->ipv6IfIcmpInParmProblems); 19785 UPDATE_MIB(o1, ipv6IfIcmpInPktTooBigs, o2->ipv6IfIcmpInPktTooBigs); 19786 UPDATE_MIB(o1, ipv6IfIcmpInEchos, o2->ipv6IfIcmpInEchos); 19787 UPDATE_MIB(o1, ipv6IfIcmpInEchoReplies, o2->ipv6IfIcmpInEchoReplies); 19788 UPDATE_MIB(o1, ipv6IfIcmpInRouterSolicits, 19789 o2->ipv6IfIcmpInRouterSolicits); 19790 UPDATE_MIB(o1, ipv6IfIcmpInRouterAdvertisements, 19791 o2->ipv6IfIcmpInRouterAdvertisements); 19792 UPDATE_MIB(o1, ipv6IfIcmpInNeighborSolicits, 19793 o2->ipv6IfIcmpInNeighborSolicits); 19794 UPDATE_MIB(o1, ipv6IfIcmpInNeighborAdvertisements, 19795 o2->ipv6IfIcmpInNeighborAdvertisements); 19796 UPDATE_MIB(o1, ipv6IfIcmpInRedirects, o2->ipv6IfIcmpInRedirects); 19797 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembQueries, 19798 o2->ipv6IfIcmpInGroupMembQueries); 19799 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembResponses, 19800 o2->ipv6IfIcmpInGroupMembResponses); 19801 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembReductions, 19802 o2->ipv6IfIcmpInGroupMembReductions); 19803 UPDATE_MIB(o1, ipv6IfIcmpOutMsgs, o2->ipv6IfIcmpOutMsgs); 19804 UPDATE_MIB(o1, ipv6IfIcmpOutErrors, o2->ipv6IfIcmpOutErrors); 19805 UPDATE_MIB(o1, ipv6IfIcmpOutDestUnreachs, 19806 o2->ipv6IfIcmpOutDestUnreachs); 19807 UPDATE_MIB(o1, ipv6IfIcmpOutAdminProhibs, 19808 o2->ipv6IfIcmpOutAdminProhibs); 19809 UPDATE_MIB(o1, ipv6IfIcmpOutTimeExcds, o2->ipv6IfIcmpOutTimeExcds); 19810 UPDATE_MIB(o1, ipv6IfIcmpOutParmProblems, 19811 o2->ipv6IfIcmpOutParmProblems); 19812 UPDATE_MIB(o1, ipv6IfIcmpOutPktTooBigs, o2->ipv6IfIcmpOutPktTooBigs); 19813 UPDATE_MIB(o1, ipv6IfIcmpOutEchos, o2->ipv6IfIcmpOutEchos); 19814 UPDATE_MIB(o1, ipv6IfIcmpOutEchoReplies, o2->ipv6IfIcmpOutEchoReplies); 19815 UPDATE_MIB(o1, ipv6IfIcmpOutRouterSolicits, 19816 o2->ipv6IfIcmpOutRouterSolicits); 19817 UPDATE_MIB(o1, ipv6IfIcmpOutRouterAdvertisements, 19818 o2->ipv6IfIcmpOutRouterAdvertisements); 19819 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborSolicits, 19820 o2->ipv6IfIcmpOutNeighborSolicits); 19821 UPDATE_MIB(o1, ipv6IfIcmpOutNeighborAdvertisements, 19822 o2->ipv6IfIcmpOutNeighborAdvertisements); 19823 UPDATE_MIB(o1, ipv6IfIcmpOutRedirects, o2->ipv6IfIcmpOutRedirects); 19824 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembQueries, 19825 o2->ipv6IfIcmpOutGroupMembQueries); 19826 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembResponses, 19827 o2->ipv6IfIcmpOutGroupMembResponses); 19828 UPDATE_MIB(o1, ipv6IfIcmpOutGroupMembReductions, 19829 o2->ipv6IfIcmpOutGroupMembReductions); 19830 UPDATE_MIB(o1, ipv6IfIcmpInOverflows, o2->ipv6IfIcmpInOverflows); 19831 UPDATE_MIB(o1, ipv6IfIcmpBadHoplimit, o2->ipv6IfIcmpBadHoplimit); 19832 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborAdvertisements, 19833 o2->ipv6IfIcmpInBadNeighborAdvertisements); 19834 UPDATE_MIB(o1, ipv6IfIcmpInBadNeighborSolicitations, 19835 o2->ipv6IfIcmpInBadNeighborSolicitations); 19836 UPDATE_MIB(o1, ipv6IfIcmpInBadRedirects, o2->ipv6IfIcmpInBadRedirects); 19837 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembTotal, 19838 o2->ipv6IfIcmpInGroupMembTotal); 19839 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadQueries, 19840 o2->ipv6IfIcmpInGroupMembBadQueries); 19841 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembBadReports, 19842 o2->ipv6IfIcmpInGroupMembBadReports); 19843 UPDATE_MIB(o1, ipv6IfIcmpInGroupMembOurReports, 19844 o2->ipv6IfIcmpInGroupMembOurReports); 19845 } 19846 19847 /* 19848 * Called before the options are updated to check if this packet will 19849 * be source routed from here. 19850 * This routine assumes that the options are well formed i.e. that they 19851 * have already been checked. 19852 */ 19853 static boolean_t 19854 ip_source_routed(ipha_t *ipha, ip_stack_t *ipst) 19855 { 19856 ipoptp_t opts; 19857 uchar_t *opt; 19858 uint8_t optval; 19859 uint8_t optlen; 19860 ipaddr_t dst; 19861 ire_t *ire; 19862 19863 if (IS_SIMPLE_IPH(ipha)) { 19864 ip2dbg(("not source routed\n")); 19865 return (B_FALSE); 19866 } 19867 dst = ipha->ipha_dst; 19868 for (optval = ipoptp_first(&opts, ipha); 19869 optval != IPOPT_EOL; 19870 optval = ipoptp_next(&opts)) { 19871 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 19872 opt = opts.ipoptp_cur; 19873 optlen = opts.ipoptp_len; 19874 ip2dbg(("ip_source_routed: opt %d, len %d\n", 19875 optval, optlen)); 19876 switch (optval) { 19877 uint32_t off; 19878 case IPOPT_SSRR: 19879 case IPOPT_LSRR: 19880 /* 19881 * If dst is one of our addresses and there are some 19882 * entries left in the source route return (true). 19883 */ 19884 ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, NULL, 19885 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 19886 if (ire == NULL) { 19887 ip2dbg(("ip_source_routed: not next" 19888 " source route 0x%x\n", 19889 ntohl(dst))); 19890 return (B_FALSE); 19891 } 19892 ire_refrele(ire); 19893 off = opt[IPOPT_OFFSET]; 19894 off--; 19895 if (optlen < IP_ADDR_LEN || 19896 off > optlen - IP_ADDR_LEN) { 19897 /* End of source route */ 19898 ip1dbg(("ip_source_routed: end of SR\n")); 19899 return (B_FALSE); 19900 } 19901 return (B_TRUE); 19902 } 19903 } 19904 ip2dbg(("not source routed\n")); 19905 return (B_FALSE); 19906 } 19907 19908 /* 19909 * Check if the packet contains any source route. 19910 */ 19911 static boolean_t 19912 ip_source_route_included(ipha_t *ipha) 19913 { 19914 ipoptp_t opts; 19915 uint8_t optval; 19916 19917 if (IS_SIMPLE_IPH(ipha)) 19918 return (B_FALSE); 19919 for (optval = ipoptp_first(&opts, ipha); 19920 optval != IPOPT_EOL; 19921 optval = ipoptp_next(&opts)) { 19922 switch (optval) { 19923 case IPOPT_SSRR: 19924 case IPOPT_LSRR: 19925 return (B_TRUE); 19926 } 19927 } 19928 return (B_FALSE); 19929 } 19930 19931 /* 19932 * Called when the IRE expiration timer fires. 19933 */ 19934 void 19935 ip_trash_timer_expire(void *args) 19936 { 19937 int flush_flag = 0; 19938 ire_expire_arg_t iea; 19939 ip_stack_t *ipst = (ip_stack_t *)args; 19940 19941 iea.iea_ipst = ipst; /* No netstack_hold */ 19942 19943 /* 19944 * ip_ire_expire_id is protected by ip_trash_timer_lock. 19945 * This lock makes sure that a new invocation of this function 19946 * that occurs due to an almost immediate timer firing will not 19947 * progress beyond this point until the current invocation is done 19948 */ 19949 mutex_enter(&ipst->ips_ip_trash_timer_lock); 19950 ipst->ips_ip_ire_expire_id = 0; 19951 mutex_exit(&ipst->ips_ip_trash_timer_lock); 19952 19953 /* Periodic timer */ 19954 if (ipst->ips_ip_ire_arp_time_elapsed >= 19955 ipst->ips_ip_ire_arp_interval) { 19956 /* 19957 * Remove all IRE_CACHE entries since they might 19958 * contain arp information. 19959 */ 19960 flush_flag |= FLUSH_ARP_TIME; 19961 ipst->ips_ip_ire_arp_time_elapsed = 0; 19962 IP_STAT(ipst, ip_ire_arp_timer_expired); 19963 } 19964 if (ipst->ips_ip_ire_rd_time_elapsed >= 19965 ipst->ips_ip_ire_redir_interval) { 19966 /* Remove all redirects */ 19967 flush_flag |= FLUSH_REDIRECT_TIME; 19968 ipst->ips_ip_ire_rd_time_elapsed = 0; 19969 IP_STAT(ipst, ip_ire_redirect_timer_expired); 19970 } 19971 if (ipst->ips_ip_ire_pmtu_time_elapsed >= 19972 ipst->ips_ip_ire_pathmtu_interval) { 19973 /* Increase path mtu */ 19974 flush_flag |= FLUSH_MTU_TIME; 19975 ipst->ips_ip_ire_pmtu_time_elapsed = 0; 19976 IP_STAT(ipst, ip_ire_pmtu_timer_expired); 19977 } 19978 19979 /* 19980 * Optimize for the case when there are no redirects in the 19981 * ftable, that is, no need to walk the ftable in that case. 19982 */ 19983 if (flush_flag & (FLUSH_MTU_TIME|FLUSH_ARP_TIME)) { 19984 iea.iea_flush_flag = flush_flag; 19985 ire_walk_ill_tables(MATCH_IRE_TYPE, IRE_CACHETABLE, ire_expire, 19986 (char *)(uintptr_t)&iea, IP_MASK_TABLE_SIZE, 0, NULL, 19987 ipst->ips_ip_cache_table_size, ipst->ips_ip_cache_table, 19988 NULL, ALL_ZONES, ipst); 19989 } 19990 if ((flush_flag & FLUSH_REDIRECT_TIME) && 19991 ipst->ips_ip_redirect_cnt > 0) { 19992 iea.iea_flush_flag = flush_flag; 19993 ire_walk_ill_tables(MATCH_IRE_TYPE, IRE_FORWARDTABLE, 19994 ire_expire, (char *)(uintptr_t)&iea, IP_MASK_TABLE_SIZE, 19995 0, NULL, 0, NULL, NULL, ALL_ZONES, ipst); 19996 } 19997 if (flush_flag & FLUSH_MTU_TIME) { 19998 /* 19999 * Walk all IPv6 IRE's and update them 20000 * Note that ARP and redirect timers are not 20001 * needed since NUD handles stale entries. 20002 */ 20003 flush_flag = FLUSH_MTU_TIME; 20004 iea.iea_flush_flag = flush_flag; 20005 ire_walk_v6(ire_expire, (char *)(uintptr_t)&iea, 20006 ALL_ZONES, ipst); 20007 } 20008 20009 ipst->ips_ip_ire_arp_time_elapsed += ipst->ips_ip_timer_interval; 20010 ipst->ips_ip_ire_rd_time_elapsed += ipst->ips_ip_timer_interval; 20011 ipst->ips_ip_ire_pmtu_time_elapsed += ipst->ips_ip_timer_interval; 20012 20013 /* 20014 * Hold the lock to serialize timeout calls and prevent 20015 * stale values in ip_ire_expire_id. Otherwise it is possible 20016 * for the timer to fire and a new invocation of this function 20017 * to start before the return value of timeout has been stored 20018 * in ip_ire_expire_id by the current invocation. 20019 */ 20020 mutex_enter(&ipst->ips_ip_trash_timer_lock); 20021 ipst->ips_ip_ire_expire_id = timeout(ip_trash_timer_expire, 20022 (void *)ipst, MSEC_TO_TICK(ipst->ips_ip_timer_interval)); 20023 mutex_exit(&ipst->ips_ip_trash_timer_lock); 20024 } 20025 20026 /* 20027 * Called by the memory allocator subsystem directly, when the system 20028 * is running low on memory. 20029 */ 20030 /* ARGSUSED */ 20031 void 20032 ip_trash_ire_reclaim(void *args) 20033 { 20034 netstack_handle_t nh; 20035 netstack_t *ns; 20036 20037 netstack_next_init(&nh); 20038 while ((ns = netstack_next(&nh)) != NULL) { 20039 ip_trash_ire_reclaim_stack(ns->netstack_ip); 20040 netstack_rele(ns); 20041 } 20042 netstack_next_fini(&nh); 20043 } 20044 20045 static void 20046 ip_trash_ire_reclaim_stack(ip_stack_t *ipst) 20047 { 20048 ire_cache_count_t icc; 20049 ire_cache_reclaim_t icr; 20050 ncc_cache_count_t ncc; 20051 nce_cache_reclaim_t ncr; 20052 uint_t delete_cnt; 20053 /* 20054 * Memory reclaim call back. 20055 * Count unused, offlink, pmtu, and onlink IRE_CACHE entries. 20056 * Then, with a target of freeing 1/Nth of IRE_CACHE 20057 * entries, determine what fraction to free for 20058 * each category of IRE_CACHE entries giving absolute priority 20059 * in the order of onlink, pmtu, offlink, unused (e.g. no pmtu 20060 * entry will be freed unless all offlink entries are freed). 20061 */ 20062 icc.icc_total = 0; 20063 icc.icc_unused = 0; 20064 icc.icc_offlink = 0; 20065 icc.icc_pmtu = 0; 20066 icc.icc_onlink = 0; 20067 ire_walk(ire_cache_count, (char *)&icc, ipst); 20068 20069 /* 20070 * Free NCEs for IPv6 like the onlink ires. 20071 */ 20072 ncc.ncc_total = 0; 20073 ncc.ncc_host = 0; 20074 ndp_walk(NULL, (pfi_t)ndp_cache_count, (uchar_t *)&ncc, ipst); 20075 20076 ASSERT(icc.icc_total == icc.icc_unused + icc.icc_offlink + 20077 icc.icc_pmtu + icc.icc_onlink); 20078 delete_cnt = icc.icc_total/ipst->ips_ip_ire_reclaim_fraction; 20079 IP_STAT(ipst, ip_trash_ire_reclaim_calls); 20080 if (delete_cnt == 0) 20081 return; 20082 IP_STAT(ipst, ip_trash_ire_reclaim_success); 20083 /* Always delete all unused offlink entries */ 20084 icr.icr_ipst = ipst; 20085 icr.icr_unused = 1; 20086 if (delete_cnt <= icc.icc_unused) { 20087 /* 20088 * Only need to free unused entries. In other words, 20089 * there are enough unused entries to free to meet our 20090 * target number of freed ire cache entries. 20091 */ 20092 icr.icr_offlink = icr.icr_pmtu = icr.icr_onlink = 0; 20093 ncr.ncr_host = 0; 20094 } else if (delete_cnt <= icc.icc_unused + icc.icc_offlink) { 20095 /* 20096 * Only need to free unused entries, plus a fraction of offlink 20097 * entries. It follows from the first if statement that 20098 * icc_offlink is non-zero, and that delete_cnt != icc_unused. 20099 */ 20100 delete_cnt -= icc.icc_unused; 20101 /* Round up # deleted by truncating fraction */ 20102 icr.icr_offlink = icc.icc_offlink / delete_cnt; 20103 icr.icr_pmtu = icr.icr_onlink = 0; 20104 ncr.ncr_host = 0; 20105 } else if (delete_cnt <= 20106 icc.icc_unused + icc.icc_offlink + icc.icc_pmtu) { 20107 /* 20108 * Free all unused and offlink entries, plus a fraction of 20109 * pmtu entries. It follows from the previous if statement 20110 * that icc_pmtu is non-zero, and that 20111 * delete_cnt != icc_unused + icc_offlink. 20112 */ 20113 icr.icr_offlink = 1; 20114 delete_cnt -= icc.icc_unused + icc.icc_offlink; 20115 /* Round up # deleted by truncating fraction */ 20116 icr.icr_pmtu = icc.icc_pmtu / delete_cnt; 20117 icr.icr_onlink = 0; 20118 ncr.ncr_host = 0; 20119 } else { 20120 /* 20121 * Free all unused, offlink, and pmtu entries, plus a fraction 20122 * of onlink entries. If we're here, then we know that 20123 * icc_onlink is non-zero, and that 20124 * delete_cnt != icc_unused + icc_offlink + icc_pmtu. 20125 */ 20126 icr.icr_offlink = icr.icr_pmtu = 1; 20127 delete_cnt -= icc.icc_unused + icc.icc_offlink + 20128 icc.icc_pmtu; 20129 /* Round up # deleted by truncating fraction */ 20130 icr.icr_onlink = icc.icc_onlink / delete_cnt; 20131 /* Using the same delete fraction as for onlink IREs */ 20132 ncr.ncr_host = ncc.ncc_host / delete_cnt; 20133 } 20134 #ifdef DEBUG 20135 ip1dbg(("IP reclaim: target %d out of %d current %d/%d/%d/%d " 20136 "fractions %d/%d/%d/%d\n", 20137 icc.icc_total/ipst->ips_ip_ire_reclaim_fraction, icc.icc_total, 20138 icc.icc_unused, icc.icc_offlink, 20139 icc.icc_pmtu, icc.icc_onlink, 20140 icr.icr_unused, icr.icr_offlink, 20141 icr.icr_pmtu, icr.icr_onlink)); 20142 #endif 20143 ire_walk(ire_cache_reclaim, (char *)&icr, ipst); 20144 if (ncr.ncr_host != 0) 20145 ndp_walk(NULL, (pfi_t)ndp_cache_reclaim, 20146 (uchar_t *)&ncr, ipst); 20147 #ifdef DEBUG 20148 icc.icc_total = 0; icc.icc_unused = 0; icc.icc_offlink = 0; 20149 icc.icc_pmtu = 0; icc.icc_onlink = 0; 20150 ire_walk(ire_cache_count, (char *)&icc, ipst); 20151 ip1dbg(("IP reclaim: result total %d %d/%d/%d/%d\n", 20152 icc.icc_total, icc.icc_unused, icc.icc_offlink, 20153 icc.icc_pmtu, icc.icc_onlink)); 20154 #endif 20155 } 20156 20157 /* 20158 * ip_unbind is called when a copy of an unbind request is received from the 20159 * upper level protocol. We remove this conn from any fanout hash list it is 20160 * on, and zero out the bind information. No reply is expected up above. 20161 */ 20162 mblk_t * 20163 ip_unbind(queue_t *q, mblk_t *mp) 20164 { 20165 conn_t *connp = Q_TO_CONN(q); 20166 20167 ASSERT(!MUTEX_HELD(&connp->conn_lock)); 20168 20169 if (is_system_labeled() && connp->conn_anon_port) { 20170 (void) tsol_mlp_anon(crgetzone(connp->conn_cred), 20171 connp->conn_mlp_type, connp->conn_ulp, 20172 ntohs(connp->conn_lport), B_FALSE); 20173 connp->conn_anon_port = 0; 20174 } 20175 connp->conn_mlp_type = mlptSingle; 20176 20177 ipcl_hash_remove(connp); 20178 20179 ASSERT(mp->b_cont == NULL); 20180 /* 20181 * Convert mp into a T_OK_ACK 20182 */ 20183 mp = mi_tpi_ok_ack_alloc(mp); 20184 20185 /* 20186 * should not happen in practice... T_OK_ACK is smaller than the 20187 * original message. 20188 */ 20189 if (mp == NULL) 20190 return (NULL); 20191 20192 /* 20193 * Don't bzero the ports if its TCP since TCP still needs the 20194 * lport to remove it from its own bind hash. TCP will do the 20195 * cleanup. 20196 */ 20197 if (!IPCL_IS_TCP(connp)) 20198 bzero(&connp->u_port, sizeof (connp->u_port)); 20199 20200 return (mp); 20201 } 20202 20203 /* 20204 * Write side put procedure. Outbound data, IOCTLs, responses from 20205 * resolvers, etc, come down through here. 20206 * 20207 * arg2 is always a queue_t *. 20208 * When that queue is an ill_t (i.e. q_next != NULL), then arg must be 20209 * the zoneid. 20210 * When that queue is not an ill_t, then arg must be a conn_t pointer. 20211 */ 20212 void 20213 ip_output(void *arg, mblk_t *mp, void *arg2, int caller) 20214 { 20215 ip_output_options(arg, mp, arg2, caller, &zero_info); 20216 } 20217 20218 void 20219 ip_output_options(void *arg, mblk_t *mp, void *arg2, int caller, 20220 ip_opt_info_t *infop) 20221 { 20222 conn_t *connp = NULL; 20223 queue_t *q = (queue_t *)arg2; 20224 ipha_t *ipha; 20225 #define rptr ((uchar_t *)ipha) 20226 ire_t *ire = NULL; 20227 ire_t *sctp_ire = NULL; 20228 uint32_t v_hlen_tos_len; 20229 ipaddr_t dst; 20230 mblk_t *first_mp = NULL; 20231 boolean_t mctl_present; 20232 ipsec_out_t *io; 20233 int match_flags; 20234 ill_t *attach_ill = NULL; 20235 /* Bind to IPIF_NOFAILOVER ill etc. */ 20236 ill_t *xmit_ill = NULL; /* IP_XMIT_IF etc. */ 20237 ipif_t *dst_ipif; 20238 boolean_t multirt_need_resolve = B_FALSE; 20239 mblk_t *copy_mp = NULL; 20240 int err; 20241 zoneid_t zoneid; 20242 int adjust; 20243 uint16_t iplen; 20244 boolean_t need_decref = B_FALSE; 20245 boolean_t ignore_dontroute = B_FALSE; 20246 boolean_t ignore_nexthop = B_FALSE; 20247 boolean_t ip_nexthop = B_FALSE; 20248 ipaddr_t nexthop_addr; 20249 ip_stack_t *ipst; 20250 20251 #ifdef _BIG_ENDIAN 20252 #define V_HLEN (v_hlen_tos_len >> 24) 20253 #else 20254 #define V_HLEN (v_hlen_tos_len & 0xFF) 20255 #endif 20256 20257 TRACE_1(TR_FAC_IP, TR_IP_WPUT_START, 20258 "ip_wput_start: q %p", q); 20259 20260 /* 20261 * ip_wput fast path 20262 */ 20263 20264 /* is packet from ARP ? */ 20265 if (q->q_next != NULL) { 20266 zoneid = (zoneid_t)(uintptr_t)arg; 20267 goto qnext; 20268 } 20269 20270 connp = (conn_t *)arg; 20271 ASSERT(connp != NULL); 20272 zoneid = connp->conn_zoneid; 20273 ipst = connp->conn_netstack->netstack_ip; 20274 20275 /* is queue flow controlled? */ 20276 if ((q->q_first != NULL || connp->conn_draining) && 20277 (caller == IP_WPUT)) { 20278 ASSERT(!need_decref); 20279 (void) putq(q, mp); 20280 return; 20281 } 20282 20283 /* Multidata transmit? */ 20284 if (DB_TYPE(mp) == M_MULTIDATA) { 20285 /* 20286 * We should never get here, since all Multidata messages 20287 * originating from tcp should have been directed over to 20288 * tcp_multisend() in the first place. 20289 */ 20290 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 20291 freemsg(mp); 20292 return; 20293 } else if (DB_TYPE(mp) != M_DATA) 20294 goto notdata; 20295 20296 if (mp->b_flag & MSGHASREF) { 20297 ASSERT(connp->conn_ulp == IPPROTO_SCTP); 20298 mp->b_flag &= ~MSGHASREF; 20299 SCTP_EXTRACT_IPINFO(mp, sctp_ire); 20300 need_decref = B_TRUE; 20301 } 20302 ipha = (ipha_t *)mp->b_rptr; 20303 20304 /* is IP header non-aligned or mblk smaller than basic IP header */ 20305 #ifndef SAFETY_BEFORE_SPEED 20306 if (!OK_32PTR(rptr) || 20307 (mp->b_wptr - rptr) < IP_SIMPLE_HDR_LENGTH) 20308 goto hdrtoosmall; 20309 #endif 20310 20311 ASSERT(OK_32PTR(ipha)); 20312 20313 /* 20314 * This function assumes that mp points to an IPv4 packet. If it's the 20315 * wrong version, we'll catch it again in ip_output_v6. 20316 * 20317 * Note that this is *only* locally-generated output here, and never 20318 * forwarded data, and that we need to deal only with transports that 20319 * don't know how to label. (TCP, UDP, and ICMP/raw-IP all know how to 20320 * label.) 20321 */ 20322 if (is_system_labeled() && 20323 (ipha->ipha_version_and_hdr_length & 0xf0) == (IPV4_VERSION << 4) && 20324 !connp->conn_ulp_labeled) { 20325 err = tsol_check_label(BEST_CRED(mp, connp), &mp, &adjust, 20326 connp->conn_mac_exempt, ipst); 20327 ipha = (ipha_t *)mp->b_rptr; 20328 if (err != 0) { 20329 first_mp = mp; 20330 if (err == EINVAL) 20331 goto icmp_parameter_problem; 20332 ip2dbg(("ip_wput: label check failed (%d)\n", err)); 20333 goto discard_pkt; 20334 } 20335 iplen = ntohs(ipha->ipha_length) + adjust; 20336 ipha->ipha_length = htons(iplen); 20337 } 20338 20339 ASSERT(infop != NULL); 20340 20341 if (infop->ip_opt_flags & IP_VERIFY_SRC) { 20342 /* 20343 * IP_PKTINFO ancillary option is present. 20344 * IPCL_ZONEID is used to honor IP_ALLZONES option which 20345 * allows using address of any zone as the source address. 20346 */ 20347 ire = ire_ctable_lookup(ipha->ipha_src, 0, 20348 (IRE_LOCAL|IRE_LOOPBACK), NULL, IPCL_ZONEID(connp), 20349 NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, ipst); 20350 if (ire == NULL) 20351 goto drop_pkt; 20352 ire_refrele(ire); 20353 ire = NULL; 20354 } 20355 20356 /* 20357 * IP_DONTFAILOVER_IF and IP_XMIT_IF have precedence over 20358 * ill index passed in IP_PKTINFO. 20359 */ 20360 if (infop->ip_opt_ill_index != 0 && 20361 connp->conn_xmit_if_ill == NULL && 20362 connp->conn_nofailover_ill == NULL) { 20363 20364 xmit_ill = ill_lookup_on_ifindex( 20365 infop->ip_opt_ill_index, B_FALSE, NULL, NULL, NULL, NULL, 20366 ipst); 20367 20368 if (xmit_ill == NULL || IS_VNI(xmit_ill)) 20369 goto drop_pkt; 20370 /* 20371 * check that there is an ipif belonging 20372 * to our zone. IPCL_ZONEID is not used because 20373 * IP_ALLZONES option is valid only when the ill is 20374 * accessible from all zones i.e has a valid ipif in 20375 * all zones. 20376 */ 20377 if (!ipif_lookup_zoneid_group(xmit_ill, zoneid, 0, NULL)) { 20378 goto drop_pkt; 20379 } 20380 } 20381 20382 /* 20383 * If there is a policy, try to attach an ipsec_out in 20384 * the front. At the end, first_mp either points to a 20385 * M_DATA message or IPSEC_OUT message linked to a 20386 * M_DATA message. We have to do it now as we might 20387 * lose the "conn" if we go through ip_newroute. 20388 */ 20389 if (connp->conn_out_enforce_policy || (connp->conn_latch != NULL)) { 20390 if (((mp = ipsec_attach_ipsec_out(mp, connp, NULL, 20391 ipha->ipha_protocol, ipst->ips_netstack)) == NULL)) { 20392 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 20393 if (need_decref) 20394 CONN_DEC_REF(connp); 20395 return; 20396 } else { 20397 ASSERT(mp->b_datap->db_type == M_CTL); 20398 first_mp = mp; 20399 mp = mp->b_cont; 20400 mctl_present = B_TRUE; 20401 } 20402 } else { 20403 first_mp = mp; 20404 mctl_present = B_FALSE; 20405 } 20406 20407 v_hlen_tos_len = ((uint32_t *)ipha)[0]; 20408 20409 /* is wrong version or IP options present */ 20410 if (V_HLEN != IP_SIMPLE_HDR_VERSION) 20411 goto version_hdrlen_check; 20412 dst = ipha->ipha_dst; 20413 20414 if (connp->conn_nofailover_ill != NULL) { 20415 attach_ill = conn_get_held_ill(connp, 20416 &connp->conn_nofailover_ill, &err); 20417 if (err == ILL_LOOKUP_FAILED) { 20418 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 20419 if (need_decref) 20420 CONN_DEC_REF(connp); 20421 freemsg(first_mp); 20422 return; 20423 } 20424 } 20425 20426 20427 /* is packet multicast? */ 20428 if (CLASSD(dst)) 20429 goto multicast; 20430 20431 /* 20432 * If xmit_ill is set above due to index passed in ip_pkt_info. It 20433 * takes precedence over conn_dontroute and conn_nexthop_set 20434 */ 20435 if (xmit_ill != NULL) { 20436 goto send_from_ill; 20437 } 20438 20439 if ((connp->conn_dontroute) || (connp->conn_xmit_if_ill != NULL) || 20440 (connp->conn_nexthop_set)) { 20441 /* 20442 * If the destination is a broadcast or a loopback 20443 * address, SO_DONTROUTE, IP_XMIT_IF and IP_NEXTHOP go 20444 * through the standard path. But in the case of local 20445 * destination only SO_DONTROUTE and IP_NEXTHOP go through 20446 * the standard path not IP_XMIT_IF. 20447 */ 20448 ire = ire_cache_lookup(dst, zoneid, MBLK_GETLABEL(mp), ipst); 20449 if ((ire == NULL) || ((ire->ire_type != IRE_BROADCAST) && 20450 (ire->ire_type != IRE_LOOPBACK))) { 20451 if ((connp->conn_dontroute || 20452 connp->conn_nexthop_set) && (ire != NULL) && 20453 (ire->ire_type == IRE_LOCAL)) 20454 goto standard_path; 20455 20456 if (ire != NULL) { 20457 ire_refrele(ire); 20458 /* No more access to ire */ 20459 ire = NULL; 20460 } 20461 /* 20462 * bypass routing checks and go directly to 20463 * interface. 20464 */ 20465 if (connp->conn_dontroute) { 20466 goto dontroute; 20467 } else if (connp->conn_nexthop_set) { 20468 ip_nexthop = B_TRUE; 20469 nexthop_addr = connp->conn_nexthop_v4; 20470 goto send_from_ill; 20471 } 20472 20473 /* 20474 * If IP_XMIT_IF socket option is set, 20475 * then we allow unicast and multicast 20476 * packets to go through the ill. It is 20477 * quite possible that the destination 20478 * is not in the ire cache table and we 20479 * do not want to go to ip_newroute() 20480 * instead we call ip_newroute_ipif. 20481 */ 20482 xmit_ill = conn_get_held_ill(connp, 20483 &connp->conn_xmit_if_ill, &err); 20484 if (err == ILL_LOOKUP_FAILED) { 20485 BUMP_MIB(&ipst->ips_ip_mib, 20486 ipIfStatsOutDiscards); 20487 if (attach_ill != NULL) 20488 ill_refrele(attach_ill); 20489 if (need_decref) 20490 CONN_DEC_REF(connp); 20491 freemsg(first_mp); 20492 return; 20493 } 20494 goto send_from_ill; 20495 } 20496 standard_path: 20497 /* Must be a broadcast, a loopback or a local ire */ 20498 if (ire != NULL) { 20499 ire_refrele(ire); 20500 /* No more access to ire */ 20501 ire = NULL; 20502 } 20503 } 20504 20505 if (attach_ill != NULL) 20506 goto send_from_ill; 20507 20508 /* 20509 * We cache IRE_CACHEs to avoid lookups. We don't do 20510 * this for the tcp global queue and listen end point 20511 * as it does not really have a real destination to 20512 * talk to. This is also true for SCTP. 20513 */ 20514 if (IP_FLOW_CONTROLLED_ULP(connp->conn_ulp) && 20515 !connp->conn_fully_bound) { 20516 ire = ire_cache_lookup(dst, zoneid, MBLK_GETLABEL(mp), ipst); 20517 if (ire == NULL) 20518 goto noirefound; 20519 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 20520 "ip_wput_end: q %p (%S)", q, "end"); 20521 20522 /* 20523 * Check if the ire has the RTF_MULTIRT flag, inherited 20524 * from an IRE_OFFSUBNET ire entry in ip_newroute(). 20525 */ 20526 if (ire->ire_flags & RTF_MULTIRT) { 20527 20528 /* 20529 * Force the TTL of multirouted packets if required. 20530 * The TTL of such packets is bounded by the 20531 * ip_multirt_ttl ndd variable. 20532 */ 20533 if ((ipst->ips_ip_multirt_ttl > 0) && 20534 (ipha->ipha_ttl > ipst->ips_ip_multirt_ttl)) { 20535 ip2dbg(("ip_wput: forcing multirt TTL to %d " 20536 "(was %d), dst 0x%08x\n", 20537 ipst->ips_ip_multirt_ttl, ipha->ipha_ttl, 20538 ntohl(ire->ire_addr))); 20539 ipha->ipha_ttl = ipst->ips_ip_multirt_ttl; 20540 } 20541 /* 20542 * We look at this point if there are pending 20543 * unresolved routes. ire_multirt_resolvable() 20544 * checks in O(n) that all IRE_OFFSUBNET ire 20545 * entries for the packet's destination and 20546 * flagged RTF_MULTIRT are currently resolved. 20547 * If some remain unresolved, we make a copy 20548 * of the current message. It will be used 20549 * to initiate additional route resolutions. 20550 */ 20551 multirt_need_resolve = 20552 ire_multirt_need_resolve(ire->ire_addr, 20553 MBLK_GETLABEL(first_mp), ipst); 20554 ip2dbg(("ip_wput[TCP]: ire %p, " 20555 "multirt_need_resolve %d, first_mp %p\n", 20556 (void *)ire, multirt_need_resolve, 20557 (void *)first_mp)); 20558 if (multirt_need_resolve) { 20559 copy_mp = copymsg(first_mp); 20560 if (copy_mp != NULL) { 20561 MULTIRT_DEBUG_TAG(copy_mp); 20562 } 20563 } 20564 } 20565 20566 ip_wput_ire(q, first_mp, ire, connp, caller, zoneid); 20567 20568 /* 20569 * Try to resolve another multiroute if 20570 * ire_multirt_need_resolve() deemed it necessary. 20571 */ 20572 if (copy_mp != NULL) { 20573 ip_newroute(q, copy_mp, dst, NULL, connp, zoneid, ipst); 20574 } 20575 if (need_decref) 20576 CONN_DEC_REF(connp); 20577 return; 20578 } 20579 20580 /* 20581 * Access to conn_ire_cache. (protected by conn_lock) 20582 * 20583 * IRE_MARK_CONDEMNED is marked in ire_delete. We don't grab 20584 * the ire bucket lock here to check for CONDEMNED as it is okay to 20585 * send a packet or two with the IRE_CACHE that is going away. 20586 * Access to the ire requires an ire refhold on the ire prior to 20587 * its use since an interface unplumb thread may delete the cached 20588 * ire and release the refhold at any time. 20589 * 20590 * Caching an ire in the conn_ire_cache 20591 * 20592 * o Caching an ire pointer in the conn requires a strict check for 20593 * IRE_MARK_CONDEMNED. An interface unplumb thread deletes all relevant 20594 * ires before cleaning up the conns. So the caching of an ire pointer 20595 * in the conn is done after making sure under the bucket lock that the 20596 * ire has not yet been marked CONDEMNED. Otherwise we will end up 20597 * caching an ire after the unplumb thread has cleaned up the conn. 20598 * If the conn does not send a packet subsequently the unplumb thread 20599 * will be hanging waiting for the ire count to drop to zero. 20600 * 20601 * o We also need to atomically test for a null conn_ire_cache and 20602 * set the conn_ire_cache under the the protection of the conn_lock 20603 * to avoid races among concurrent threads trying to simultaneously 20604 * cache an ire in the conn_ire_cache. 20605 */ 20606 mutex_enter(&connp->conn_lock); 20607 ire = sctp_ire != NULL ? sctp_ire : connp->conn_ire_cache; 20608 20609 if (ire != NULL && ire->ire_addr == dst && 20610 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 20611 20612 IRE_REFHOLD(ire); 20613 mutex_exit(&connp->conn_lock); 20614 20615 } else { 20616 boolean_t cached = B_FALSE; 20617 connp->conn_ire_cache = NULL; 20618 mutex_exit(&connp->conn_lock); 20619 /* Release the old ire */ 20620 if (ire != NULL && sctp_ire == NULL) 20621 IRE_REFRELE_NOTR(ire); 20622 20623 ire = ire_cache_lookup(dst, zoneid, MBLK_GETLABEL(mp), ipst); 20624 if (ire == NULL) 20625 goto noirefound; 20626 IRE_REFHOLD_NOTR(ire); 20627 20628 mutex_enter(&connp->conn_lock); 20629 if (!(connp->conn_state_flags & CONN_CLOSING) && 20630 connp->conn_ire_cache == NULL) { 20631 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 20632 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 20633 connp->conn_ire_cache = ire; 20634 cached = B_TRUE; 20635 } 20636 rw_exit(&ire->ire_bucket->irb_lock); 20637 } 20638 mutex_exit(&connp->conn_lock); 20639 20640 /* 20641 * We can continue to use the ire but since it was 20642 * not cached, we should drop the extra reference. 20643 */ 20644 if (!cached) 20645 IRE_REFRELE_NOTR(ire); 20646 } 20647 20648 20649 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 20650 "ip_wput_end: q %p (%S)", q, "end"); 20651 20652 /* 20653 * Check if the ire has the RTF_MULTIRT flag, inherited 20654 * from an IRE_OFFSUBNET ire entry in ip_newroute(). 20655 */ 20656 if (ire->ire_flags & RTF_MULTIRT) { 20657 20658 /* 20659 * Force the TTL of multirouted packets if required. 20660 * The TTL of such packets is bounded by the 20661 * ip_multirt_ttl ndd variable. 20662 */ 20663 if ((ipst->ips_ip_multirt_ttl > 0) && 20664 (ipha->ipha_ttl > ipst->ips_ip_multirt_ttl)) { 20665 ip2dbg(("ip_wput: forcing multirt TTL to %d " 20666 "(was %d), dst 0x%08x\n", 20667 ipst->ips_ip_multirt_ttl, ipha->ipha_ttl, 20668 ntohl(ire->ire_addr))); 20669 ipha->ipha_ttl = ipst->ips_ip_multirt_ttl; 20670 } 20671 20672 /* 20673 * At this point, we check to see if there are any pending 20674 * unresolved routes. ire_multirt_resolvable() 20675 * checks in O(n) that all IRE_OFFSUBNET ire 20676 * entries for the packet's destination and 20677 * flagged RTF_MULTIRT are currently resolved. 20678 * If some remain unresolved, we make a copy 20679 * of the current message. It will be used 20680 * to initiate additional route resolutions. 20681 */ 20682 multirt_need_resolve = ire_multirt_need_resolve(ire->ire_addr, 20683 MBLK_GETLABEL(first_mp), ipst); 20684 ip2dbg(("ip_wput[not TCP]: ire %p, " 20685 "multirt_need_resolve %d, first_mp %p\n", 20686 (void *)ire, multirt_need_resolve, (void *)first_mp)); 20687 if (multirt_need_resolve) { 20688 copy_mp = copymsg(first_mp); 20689 if (copy_mp != NULL) { 20690 MULTIRT_DEBUG_TAG(copy_mp); 20691 } 20692 } 20693 } 20694 20695 ip_wput_ire(q, first_mp, ire, connp, caller, zoneid); 20696 20697 /* 20698 * Try to resolve another multiroute if 20699 * ire_multirt_resolvable() deemed it necessary 20700 */ 20701 if (copy_mp != NULL) { 20702 ip_newroute(q, copy_mp, dst, NULL, connp, zoneid, ipst); 20703 } 20704 if (need_decref) 20705 CONN_DEC_REF(connp); 20706 return; 20707 20708 qnext: 20709 /* 20710 * Upper Level Protocols pass down complete IP datagrams 20711 * as M_DATA messages. Everything else is a sideshow. 20712 * 20713 * 1) We could be re-entering ip_wput because of ip_neworute 20714 * in which case we could have a IPSEC_OUT message. We 20715 * need to pass through ip_wput like other datagrams and 20716 * hence cannot branch to ip_wput_nondata. 20717 * 20718 * 2) ARP, AH, ESP, and other clients who are on the module 20719 * instance of IP stream, give us something to deal with. 20720 * We will handle AH and ESP here and rest in ip_wput_nondata. 20721 * 20722 * 3) ICMP replies also could come here. 20723 */ 20724 ipst = ILLQ_TO_IPST(q); 20725 20726 if (DB_TYPE(mp) != M_DATA) { 20727 notdata: 20728 if (DB_TYPE(mp) == M_CTL) { 20729 /* 20730 * M_CTL messages are used by ARP, AH and ESP to 20731 * communicate with IP. We deal with IPSEC_IN and 20732 * IPSEC_OUT here. ip_wput_nondata handles other 20733 * cases. 20734 */ 20735 ipsec_info_t *ii = (ipsec_info_t *)mp->b_rptr; 20736 if (mp->b_cont && (mp->b_cont->b_flag & MSGHASREF)) { 20737 first_mp = mp->b_cont; 20738 first_mp->b_flag &= ~MSGHASREF; 20739 ASSERT(connp->conn_ulp == IPPROTO_SCTP); 20740 SCTP_EXTRACT_IPINFO(first_mp, sctp_ire); 20741 CONN_DEC_REF(connp); 20742 connp = NULL; 20743 } 20744 if (ii->ipsec_info_type == IPSEC_IN) { 20745 /* 20746 * Either this message goes back to 20747 * IPSEC for further processing or to 20748 * ULP after policy checks. 20749 */ 20750 ip_fanout_proto_again(mp, NULL, NULL, NULL); 20751 return; 20752 } else if (ii->ipsec_info_type == IPSEC_OUT) { 20753 io = (ipsec_out_t *)ii; 20754 if (io->ipsec_out_proc_begin) { 20755 /* 20756 * IPSEC processing has already started. 20757 * Complete it. 20758 * IPQoS notes: We don't care what is 20759 * in ipsec_out_ill_index since this 20760 * won't be processed for IPQoS policies 20761 * in ipsec_out_process. 20762 */ 20763 ipsec_out_process(q, mp, NULL, 20764 io->ipsec_out_ill_index); 20765 return; 20766 } else { 20767 connp = (q->q_next != NULL) ? 20768 NULL : Q_TO_CONN(q); 20769 first_mp = mp; 20770 mp = mp->b_cont; 20771 mctl_present = B_TRUE; 20772 } 20773 zoneid = io->ipsec_out_zoneid; 20774 ASSERT(zoneid != ALL_ZONES); 20775 } else if (ii->ipsec_info_type == IPSEC_CTL) { 20776 /* 20777 * It's an IPsec control message requesting 20778 * an SADB update to be sent to the IPsec 20779 * hardware acceleration capable ills. 20780 */ 20781 ipsec_ctl_t *ipsec_ctl = 20782 (ipsec_ctl_t *)mp->b_rptr; 20783 ipsa_t *sa = (ipsa_t *)ipsec_ctl->ipsec_ctl_sa; 20784 uint_t satype = ipsec_ctl->ipsec_ctl_sa_type; 20785 mblk_t *cmp = mp->b_cont; 20786 20787 ASSERT(MBLKL(mp) >= sizeof (ipsec_ctl_t)); 20788 ASSERT(cmp != NULL); 20789 20790 freeb(mp); 20791 ill_ipsec_capab_send_all(satype, cmp, sa, 20792 ipst->ips_netstack); 20793 return; 20794 } else { 20795 /* 20796 * This must be ARP or special TSOL signaling. 20797 */ 20798 ip_wput_nondata(NULL, q, mp, NULL); 20799 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 20800 "ip_wput_end: q %p (%S)", q, "nondata"); 20801 return; 20802 } 20803 } else { 20804 /* 20805 * This must be non-(ARP/AH/ESP) messages. 20806 */ 20807 ASSERT(!need_decref); 20808 ip_wput_nondata(NULL, q, mp, NULL); 20809 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 20810 "ip_wput_end: q %p (%S)", q, "nondata"); 20811 return; 20812 } 20813 } else { 20814 first_mp = mp; 20815 mctl_present = B_FALSE; 20816 } 20817 20818 ASSERT(first_mp != NULL); 20819 /* 20820 * ICMP echo replies attach an ipsec_out and set ipsec_out_attach_if 20821 * to make sure that this packet goes out on the same interface it 20822 * came in. We handle that here. 20823 */ 20824 if (mctl_present) { 20825 uint_t ifindex; 20826 20827 io = (ipsec_out_t *)first_mp->b_rptr; 20828 if (io->ipsec_out_attach_if || 20829 io->ipsec_out_xmit_if || 20830 io->ipsec_out_ip_nexthop) { 20831 ill_t *ill; 20832 20833 /* 20834 * We may have lost the conn context if we are 20835 * coming here from ip_newroute(). Copy the 20836 * nexthop information. 20837 */ 20838 if (io->ipsec_out_ip_nexthop) { 20839 ip_nexthop = B_TRUE; 20840 nexthop_addr = io->ipsec_out_nexthop_addr; 20841 20842 ipha = (ipha_t *)mp->b_rptr; 20843 dst = ipha->ipha_dst; 20844 goto send_from_ill; 20845 } else { 20846 ASSERT(io->ipsec_out_ill_index != 0); 20847 ifindex = io->ipsec_out_ill_index; 20848 ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 20849 NULL, NULL, NULL, NULL, ipst); 20850 /* 20851 * ipsec_out_xmit_if bit is used to tell 20852 * ip_wput to use the ill to send outgoing data 20853 * as we have no conn when data comes from ICMP 20854 * error msg routines. Currently this feature is 20855 * only used by ip_mrtun_forward routine. 20856 */ 20857 if (io->ipsec_out_xmit_if) { 20858 xmit_ill = ill; 20859 if (xmit_ill == NULL) { 20860 ip1dbg(("ip_output:bad ifindex " 20861 "for xmit_ill %d\n", 20862 ifindex)); 20863 freemsg(first_mp); 20864 BUMP_MIB(&ipst->ips_ip_mib, 20865 ipIfStatsOutDiscards); 20866 ASSERT(!need_decref); 20867 return; 20868 } 20869 /* Free up the ipsec_out_t mblk */ 20870 ASSERT(first_mp->b_cont == mp); 20871 first_mp->b_cont = NULL; 20872 freeb(first_mp); 20873 /* Just send the IP header+ICMP+data */ 20874 first_mp = mp; 20875 ipha = (ipha_t *)mp->b_rptr; 20876 dst = ipha->ipha_dst; 20877 goto send_from_ill; 20878 } else { 20879 attach_ill = ill; 20880 } 20881 20882 if (attach_ill == NULL) { 20883 ASSERT(xmit_ill == NULL); 20884 ip1dbg(("ip_output: bad ifindex for " 20885 "(BIND TO IPIF_NOFAILOVER) %d\n", 20886 ifindex)); 20887 freemsg(first_mp); 20888 BUMP_MIB(&ipst->ips_ip_mib, 20889 ipIfStatsOutDiscards); 20890 ASSERT(!need_decref); 20891 return; 20892 } 20893 } 20894 } 20895 } 20896 20897 ASSERT(xmit_ill == NULL); 20898 20899 /* We have a complete IP datagram heading outbound. */ 20900 ipha = (ipha_t *)mp->b_rptr; 20901 20902 #ifndef SPEED_BEFORE_SAFETY 20903 /* 20904 * Make sure we have a full-word aligned message and that at least 20905 * a simple IP header is accessible in the first message. If not, 20906 * try a pullup. 20907 */ 20908 if (!OK_32PTR(rptr) || 20909 (mp->b_wptr - rptr) < IP_SIMPLE_HDR_LENGTH) { 20910 hdrtoosmall: 20911 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 20912 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 20913 "ip_wput_end: q %p (%S)", q, "pullupfailed"); 20914 if (first_mp == NULL) 20915 first_mp = mp; 20916 goto discard_pkt; 20917 } 20918 20919 /* This function assumes that mp points to an IPv4 packet. */ 20920 if (is_system_labeled() && q->q_next == NULL && 20921 (*mp->b_rptr & 0xf0) == (IPV4_VERSION << 4) && 20922 !connp->conn_ulp_labeled) { 20923 err = tsol_check_label(BEST_CRED(mp, connp), &mp, 20924 &adjust, connp->conn_mac_exempt, ipst); 20925 ipha = (ipha_t *)mp->b_rptr; 20926 if (first_mp != NULL) 20927 first_mp->b_cont = mp; 20928 if (err != 0) { 20929 if (first_mp == NULL) 20930 first_mp = mp; 20931 if (err == EINVAL) 20932 goto icmp_parameter_problem; 20933 ip2dbg(("ip_wput: label check failed (%d)\n", 20934 err)); 20935 goto discard_pkt; 20936 } 20937 iplen = ntohs(ipha->ipha_length) + adjust; 20938 ipha->ipha_length = htons(iplen); 20939 } 20940 20941 ipha = (ipha_t *)mp->b_rptr; 20942 if (first_mp == NULL) { 20943 ASSERT(attach_ill == NULL && xmit_ill == NULL); 20944 /* 20945 * If we got here because of "goto hdrtoosmall" 20946 * We need to attach a IPSEC_OUT. 20947 */ 20948 if (connp->conn_out_enforce_policy) { 20949 if (((mp = ipsec_attach_ipsec_out(mp, connp, 20950 NULL, ipha->ipha_protocol, 20951 ipst->ips_netstack)) == NULL)) { 20952 BUMP_MIB(&ipst->ips_ip_mib, 20953 ipIfStatsOutDiscards); 20954 if (need_decref) 20955 CONN_DEC_REF(connp); 20956 return; 20957 } else { 20958 ASSERT(mp->b_datap->db_type == M_CTL); 20959 first_mp = mp; 20960 mp = mp->b_cont; 20961 mctl_present = B_TRUE; 20962 } 20963 } else { 20964 first_mp = mp; 20965 mctl_present = B_FALSE; 20966 } 20967 } 20968 } 20969 #endif 20970 20971 /* Most of the code below is written for speed, not readability */ 20972 v_hlen_tos_len = ((uint32_t *)ipha)[0]; 20973 20974 /* 20975 * If ip_newroute() fails, we're going to need a full 20976 * header for the icmp wraparound. 20977 */ 20978 if (V_HLEN != IP_SIMPLE_HDR_VERSION) { 20979 uint_t v_hlen; 20980 version_hdrlen_check: 20981 ASSERT(first_mp != NULL); 20982 v_hlen = V_HLEN; 20983 /* 20984 * siphon off IPv6 packets coming down from transport 20985 * layer modules here. 20986 * Note: high-order bit carries NUD reachability confirmation 20987 */ 20988 if (((v_hlen >> 4) & 0x7) == IPV6_VERSION) { 20989 /* 20990 * XXX implement a IPv4 and IPv6 packet counter per 20991 * conn and switch when ratio exceeds e.g. 10:1 20992 */ 20993 #ifdef notyet 20994 if (q->q_next == NULL) /* Avoid ill queue */ 20995 ip_setqinfo(RD(q), B_TRUE, B_TRUE, ipst); 20996 #endif 20997 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutWrongIPVersion); 20998 ASSERT(xmit_ill == NULL); 20999 if (attach_ill != NULL) 21000 ill_refrele(attach_ill); 21001 if (need_decref) 21002 mp->b_flag |= MSGHASREF; 21003 (void) ip_output_v6(arg, first_mp, arg2, caller); 21004 return; 21005 } 21006 21007 if ((v_hlen >> 4) != IP_VERSION) { 21008 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21009 "ip_wput_end: q %p (%S)", q, "badvers"); 21010 goto discard_pkt; 21011 } 21012 /* 21013 * Is the header length at least 20 bytes? 21014 * 21015 * Are there enough bytes accessible in the header? If 21016 * not, try a pullup. 21017 */ 21018 v_hlen &= 0xF; 21019 v_hlen <<= 2; 21020 if (v_hlen < IP_SIMPLE_HDR_LENGTH) { 21021 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21022 "ip_wput_end: q %p (%S)", q, "badlen"); 21023 goto discard_pkt; 21024 } 21025 if (v_hlen > (mp->b_wptr - rptr)) { 21026 if (!pullupmsg(mp, v_hlen)) { 21027 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21028 "ip_wput_end: q %p (%S)", q, "badpullup2"); 21029 goto discard_pkt; 21030 } 21031 ipha = (ipha_t *)mp->b_rptr; 21032 } 21033 /* 21034 * Move first entry from any source route into ipha_dst and 21035 * verify the options 21036 */ 21037 if (ip_wput_options(q, first_mp, ipha, mctl_present, 21038 zoneid, ipst)) { 21039 ASSERT(xmit_ill == NULL); 21040 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 21041 if (attach_ill != NULL) 21042 ill_refrele(attach_ill); 21043 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21044 "ip_wput_end: q %p (%S)", q, "badopts"); 21045 if (need_decref) 21046 CONN_DEC_REF(connp); 21047 return; 21048 } 21049 } 21050 dst = ipha->ipha_dst; 21051 21052 /* 21053 * Try to get an IRE_CACHE for the destination address. If we can't, 21054 * we have to run the packet through ip_newroute which will take 21055 * the appropriate action to arrange for an IRE_CACHE, such as querying 21056 * a resolver, or assigning a default gateway, etc. 21057 */ 21058 if (CLASSD(dst)) { 21059 ipif_t *ipif; 21060 uint32_t setsrc = 0; 21061 21062 multicast: 21063 ASSERT(first_mp != NULL); 21064 ip2dbg(("ip_wput: CLASSD\n")); 21065 if (connp == NULL) { 21066 /* 21067 * Use the first good ipif on the ill. 21068 * XXX Should this ever happen? (Appears 21069 * to show up with just ppp and no ethernet due 21070 * to in.rdisc.) 21071 * However, ire_send should be able to 21072 * call ip_wput_ire directly. 21073 * 21074 * XXX Also, this can happen for ICMP and other packets 21075 * with multicast source addresses. Perhaps we should 21076 * fix things so that we drop the packet in question, 21077 * but for now, just run with it. 21078 */ 21079 ill_t *ill = (ill_t *)q->q_ptr; 21080 21081 /* 21082 * Don't honor attach_if for this case. If ill 21083 * is part of the group, ipif could belong to 21084 * any ill and we cannot maintain attach_ill 21085 * and ipif_ill same anymore and the assert 21086 * below would fail. 21087 */ 21088 if (mctl_present && io->ipsec_out_attach_if) { 21089 io->ipsec_out_ill_index = 0; 21090 io->ipsec_out_attach_if = B_FALSE; 21091 ASSERT(attach_ill != NULL); 21092 ill_refrele(attach_ill); 21093 attach_ill = NULL; 21094 } 21095 21096 ASSERT(attach_ill == NULL); 21097 ipif = ipif_select_source(ill, dst, GLOBAL_ZONEID); 21098 if (ipif == NULL) { 21099 if (need_decref) 21100 CONN_DEC_REF(connp); 21101 freemsg(first_mp); 21102 return; 21103 } 21104 ip1dbg(("ip_wput: CLASSD no CONN: dst 0x%x on %s\n", 21105 ntohl(dst), ill->ill_name)); 21106 } else { 21107 /* 21108 * The order of precedence is IP_XMIT_IF, IP_PKTINFO 21109 * and IP_MULTICAST_IF. 21110 * Block comment above this function explains the 21111 * locking mechanism used here 21112 */ 21113 if (xmit_ill == NULL) { 21114 xmit_ill = conn_get_held_ill(connp, 21115 &connp->conn_xmit_if_ill, &err); 21116 if (err == ILL_LOOKUP_FAILED) { 21117 ip1dbg(("ip_wput: No ill for " 21118 "IP_XMIT_IF\n")); 21119 BUMP_MIB(&ipst->ips_ip_mib, 21120 ipIfStatsOutNoRoutes); 21121 goto drop_pkt; 21122 } 21123 } 21124 21125 if (xmit_ill == NULL) { 21126 ipif = conn_get_held_ipif(connp, 21127 &connp->conn_multicast_ipif, &err); 21128 if (err == IPIF_LOOKUP_FAILED) { 21129 ip1dbg(("ip_wput: No ipif for " 21130 "multicast\n")); 21131 BUMP_MIB(&ipst->ips_ip_mib, 21132 ipIfStatsOutNoRoutes); 21133 goto drop_pkt; 21134 } 21135 } 21136 if (xmit_ill != NULL) { 21137 ipif = ipif_get_next_ipif(NULL, xmit_ill); 21138 if (ipif == NULL) { 21139 ip1dbg(("ip_wput: No ipif for " 21140 "IP_XMIT_IF\n")); 21141 BUMP_MIB(&ipst->ips_ip_mib, 21142 ipIfStatsOutNoRoutes); 21143 goto drop_pkt; 21144 } 21145 } else if (ipif == NULL || ipif->ipif_isv6) { 21146 /* 21147 * We must do this ipif determination here 21148 * else we could pass through ip_newroute 21149 * and come back here without the conn context. 21150 * 21151 * Note: we do late binding i.e. we bind to 21152 * the interface when the first packet is sent. 21153 * For performance reasons we do not rebind on 21154 * each packet but keep the binding until the 21155 * next IP_MULTICAST_IF option. 21156 * 21157 * conn_multicast_{ipif,ill} are shared between 21158 * IPv4 and IPv6 and AF_INET6 sockets can 21159 * send both IPv4 and IPv6 packets. Hence 21160 * we have to check that "isv6" matches above. 21161 */ 21162 if (ipif != NULL) 21163 ipif_refrele(ipif); 21164 ipif = ipif_lookup_group(dst, zoneid, ipst); 21165 if (ipif == NULL) { 21166 ip1dbg(("ip_wput: No ipif for " 21167 "multicast\n")); 21168 BUMP_MIB(&ipst->ips_ip_mib, 21169 ipIfStatsOutNoRoutes); 21170 goto drop_pkt; 21171 } 21172 err = conn_set_held_ipif(connp, 21173 &connp->conn_multicast_ipif, ipif); 21174 if (err == IPIF_LOOKUP_FAILED) { 21175 ipif_refrele(ipif); 21176 ip1dbg(("ip_wput: No ipif for " 21177 "multicast\n")); 21178 BUMP_MIB(&ipst->ips_ip_mib, 21179 ipIfStatsOutNoRoutes); 21180 goto drop_pkt; 21181 } 21182 } 21183 } 21184 ASSERT(!ipif->ipif_isv6); 21185 /* 21186 * As we may lose the conn by the time we reach ip_wput_ire, 21187 * we copy conn_multicast_loop and conn_dontroute on to an 21188 * ipsec_out. In case if this datagram goes out secure, 21189 * we need the ill_index also. Copy that also into the 21190 * ipsec_out. 21191 */ 21192 if (mctl_present) { 21193 io = (ipsec_out_t *)first_mp->b_rptr; 21194 ASSERT(first_mp->b_datap->db_type == M_CTL); 21195 ASSERT(io->ipsec_out_type == IPSEC_OUT); 21196 } else { 21197 ASSERT(mp == first_mp); 21198 if ((first_mp = allocb(sizeof (ipsec_info_t), 21199 BPRI_HI)) == NULL) { 21200 ipif_refrele(ipif); 21201 first_mp = mp; 21202 goto discard_pkt; 21203 } 21204 first_mp->b_datap->db_type = M_CTL; 21205 first_mp->b_wptr += sizeof (ipsec_info_t); 21206 /* ipsec_out_secure is B_FALSE now */ 21207 bzero(first_mp->b_rptr, sizeof (ipsec_info_t)); 21208 io = (ipsec_out_t *)first_mp->b_rptr; 21209 io->ipsec_out_type = IPSEC_OUT; 21210 io->ipsec_out_len = sizeof (ipsec_out_t); 21211 io->ipsec_out_use_global_policy = B_TRUE; 21212 io->ipsec_out_ns = ipst->ips_netstack; 21213 first_mp->b_cont = mp; 21214 mctl_present = B_TRUE; 21215 } 21216 if (attach_ill != NULL) { 21217 ASSERT(attach_ill == ipif->ipif_ill); 21218 match_flags = MATCH_IRE_ILL | MATCH_IRE_SECATTR; 21219 21220 /* 21221 * Check if we need an ire that will not be 21222 * looked up by anybody else i.e. HIDDEN. 21223 */ 21224 if (ill_is_probeonly(attach_ill)) { 21225 match_flags |= MATCH_IRE_MARK_HIDDEN; 21226 } 21227 io->ipsec_out_ill_index = 21228 attach_ill->ill_phyint->phyint_ifindex; 21229 io->ipsec_out_attach_if = B_TRUE; 21230 } else { 21231 match_flags = MATCH_IRE_ILL_GROUP | MATCH_IRE_SECATTR; 21232 io->ipsec_out_ill_index = 21233 ipif->ipif_ill->ill_phyint->phyint_ifindex; 21234 } 21235 if (connp != NULL) { 21236 io->ipsec_out_multicast_loop = 21237 connp->conn_multicast_loop; 21238 io->ipsec_out_dontroute = connp->conn_dontroute; 21239 io->ipsec_out_zoneid = connp->conn_zoneid; 21240 } 21241 /* 21242 * If the application uses IP_MULTICAST_IF with 21243 * different logical addresses of the same ILL, we 21244 * need to make sure that the soruce address of 21245 * the packet matches the logical IP address used 21246 * in the option. We do it by initializing ipha_src 21247 * here. This should keep IPSEC also happy as 21248 * when we return from IPSEC processing, we don't 21249 * have to worry about getting the right address on 21250 * the packet. Thus it is sufficient to look for 21251 * IRE_CACHE using MATCH_IRE_ILL rathen than 21252 * MATCH_IRE_IPIF. 21253 * 21254 * NOTE : We need to do it for non-secure case also as 21255 * this might go out secure if there is a global policy 21256 * match in ip_wput_ire. For bind to IPIF_NOFAILOVER 21257 * address, the source should be initialized already and 21258 * hence we won't be initializing here. 21259 * 21260 * As we do not have the ire yet, it is possible that 21261 * we set the source address here and then later discover 21262 * that the ire implies the source address to be assigned 21263 * through the RTF_SETSRC flag. 21264 * In that case, the setsrc variable will remind us 21265 * that overwritting the source address by the one 21266 * of the RTF_SETSRC-flagged ire is allowed. 21267 */ 21268 if (ipha->ipha_src == INADDR_ANY && 21269 (connp == NULL || !connp->conn_unspec_src)) { 21270 ipha->ipha_src = ipif->ipif_src_addr; 21271 setsrc = RTF_SETSRC; 21272 } 21273 /* 21274 * Find an IRE which matches the destination and the outgoing 21275 * queue (i.e. the outgoing interface.) 21276 * For loopback use a unicast IP address for 21277 * the ire lookup. 21278 */ 21279 if (ipif->ipif_ill->ill_phyint->phyint_flags & 21280 PHYI_LOOPBACK) { 21281 dst = ipif->ipif_lcl_addr; 21282 } 21283 /* 21284 * If IP_XMIT_IF is set, we branch out to ip_newroute_ipif. 21285 * We don't need to lookup ire in ctable as the packet 21286 * needs to be sent to the destination through the specified 21287 * ill irrespective of ires in the cache table. 21288 */ 21289 ire = NULL; 21290 if (xmit_ill == NULL) { 21291 ire = ire_ctable_lookup(dst, 0, 0, ipif, 21292 zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 21293 } 21294 21295 /* 21296 * refrele attach_ill as its not needed anymore. 21297 */ 21298 if (attach_ill != NULL) { 21299 ill_refrele(attach_ill); 21300 attach_ill = NULL; 21301 } 21302 21303 if (ire == NULL) { 21304 /* 21305 * Multicast loopback and multicast forwarding is 21306 * done in ip_wput_ire. 21307 * 21308 * Mark this packet to make it be delivered to 21309 * ip_wput_ire after the new ire has been 21310 * created. 21311 * 21312 * The call to ip_newroute_ipif takes into account 21313 * the setsrc reminder. In any case, we take care 21314 * of the RTF_MULTIRT flag. 21315 */ 21316 mp->b_prev = mp->b_next = NULL; 21317 if (xmit_ill == NULL || 21318 xmit_ill->ill_ipif_up_count > 0) { 21319 ip_newroute_ipif(q, first_mp, ipif, dst, connp, 21320 setsrc | RTF_MULTIRT, zoneid, infop); 21321 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21322 "ip_wput_end: q %p (%S)", q, "noire"); 21323 } else { 21324 freemsg(first_mp); 21325 } 21326 ipif_refrele(ipif); 21327 if (xmit_ill != NULL) 21328 ill_refrele(xmit_ill); 21329 if (need_decref) 21330 CONN_DEC_REF(connp); 21331 return; 21332 } 21333 21334 ipif_refrele(ipif); 21335 ipif = NULL; 21336 ASSERT(xmit_ill == NULL); 21337 21338 /* 21339 * Honor the RTF_SETSRC flag for multicast packets, 21340 * if allowed by the setsrc reminder. 21341 */ 21342 if ((ire->ire_flags & RTF_SETSRC) && setsrc) { 21343 ipha->ipha_src = ire->ire_src_addr; 21344 } 21345 21346 /* 21347 * Unconditionally force the TTL to 1 for 21348 * multirouted multicast packets: 21349 * multirouted multicast should not cross 21350 * multicast routers. 21351 */ 21352 if (ire->ire_flags & RTF_MULTIRT) { 21353 if (ipha->ipha_ttl > 1) { 21354 ip2dbg(("ip_wput: forcing multicast " 21355 "multirt TTL to 1 (was %d), dst 0x%08x\n", 21356 ipha->ipha_ttl, ntohl(ire->ire_addr))); 21357 ipha->ipha_ttl = 1; 21358 } 21359 } 21360 } else { 21361 ire = ire_cache_lookup(dst, zoneid, MBLK_GETLABEL(mp), ipst); 21362 if ((ire != NULL) && (ire->ire_type & 21363 (IRE_BROADCAST | IRE_LOCAL | IRE_LOOPBACK))) { 21364 ignore_dontroute = B_TRUE; 21365 ignore_nexthop = B_TRUE; 21366 } 21367 if (ire != NULL) { 21368 ire_refrele(ire); 21369 ire = NULL; 21370 } 21371 /* 21372 * Guard against coming in from arp in which case conn is NULL. 21373 * Also guard against non M_DATA with dontroute set but 21374 * destined to local, loopback or broadcast addresses. 21375 */ 21376 if (connp != NULL && connp->conn_dontroute && 21377 !ignore_dontroute) { 21378 dontroute: 21379 /* 21380 * Set TTL to 1 if SO_DONTROUTE is set to prevent 21381 * routing protocols from seeing false direct 21382 * connectivity. 21383 */ 21384 ipha->ipha_ttl = 1; 21385 /* 21386 * If IP_XMIT_IF is also set (conn_xmit_if_ill != NULL) 21387 * along with SO_DONTROUTE, higher precedence is 21388 * given to IP_XMIT_IF and the IP_XMIT_IF ipif is used. 21389 */ 21390 if (connp->conn_xmit_if_ill == NULL) { 21391 /* If suitable ipif not found, drop packet */ 21392 dst_ipif = ipif_lookup_onlink_addr(dst, zoneid, 21393 ipst); 21394 if (dst_ipif == NULL) { 21395 ip1dbg(("ip_wput: no route for " 21396 "dst using SO_DONTROUTE\n")); 21397 BUMP_MIB(&ipst->ips_ip_mib, 21398 ipIfStatsOutNoRoutes); 21399 mp->b_prev = mp->b_next = NULL; 21400 if (first_mp == NULL) 21401 first_mp = mp; 21402 goto drop_pkt; 21403 } else { 21404 /* 21405 * If suitable ipif has been found, set 21406 * xmit_ill to the corresponding 21407 * ipif_ill because we'll be following 21408 * the IP_XMIT_IF logic. 21409 */ 21410 ASSERT(xmit_ill == NULL); 21411 xmit_ill = dst_ipif->ipif_ill; 21412 mutex_enter(&xmit_ill->ill_lock); 21413 if (!ILL_CAN_LOOKUP(xmit_ill)) { 21414 mutex_exit(&xmit_ill->ill_lock); 21415 xmit_ill = NULL; 21416 ipif_refrele(dst_ipif); 21417 ip1dbg(("ip_wput: no route for" 21418 " dst using" 21419 " SO_DONTROUTE\n")); 21420 BUMP_MIB(&ipst->ips_ip_mib, 21421 ipIfStatsOutNoRoutes); 21422 mp->b_prev = mp->b_next = NULL; 21423 if (first_mp == NULL) 21424 first_mp = mp; 21425 goto drop_pkt; 21426 } 21427 ill_refhold_locked(xmit_ill); 21428 mutex_exit(&xmit_ill->ill_lock); 21429 ipif_refrele(dst_ipif); 21430 } 21431 } 21432 21433 } 21434 /* 21435 * If we are bound to IPIF_NOFAILOVER address, look for 21436 * an IRE_CACHE matching the ill. 21437 */ 21438 send_from_ill: 21439 if (attach_ill != NULL) { 21440 ipif_t *attach_ipif; 21441 21442 match_flags = MATCH_IRE_ILL | MATCH_IRE_SECATTR; 21443 21444 /* 21445 * Check if we need an ire that will not be 21446 * looked up by anybody else i.e. HIDDEN. 21447 */ 21448 if (ill_is_probeonly(attach_ill)) { 21449 match_flags |= MATCH_IRE_MARK_HIDDEN; 21450 } 21451 21452 attach_ipif = ipif_get_next_ipif(NULL, attach_ill); 21453 if (attach_ipif == NULL) { 21454 ip1dbg(("ip_wput: No ipif for attach_ill\n")); 21455 goto discard_pkt; 21456 } 21457 ire = ire_ctable_lookup(dst, 0, 0, attach_ipif, 21458 zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 21459 ipif_refrele(attach_ipif); 21460 } else if (xmit_ill != NULL || (connp != NULL && 21461 connp->conn_xmit_if_ill != NULL)) { 21462 /* 21463 * Mark this packet as originated locally 21464 */ 21465 mp->b_prev = mp->b_next = NULL; 21466 /* 21467 * xmit_ill could be NULL if SO_DONTROUTE 21468 * is also set. 21469 */ 21470 if (xmit_ill == NULL) { 21471 xmit_ill = conn_get_held_ill(connp, 21472 &connp->conn_xmit_if_ill, &err); 21473 if (err == ILL_LOOKUP_FAILED) { 21474 BUMP_MIB(&ipst->ips_ip_mib, 21475 ipIfStatsOutDiscards); 21476 if (need_decref) 21477 CONN_DEC_REF(connp); 21478 freemsg(first_mp); 21479 return; 21480 } 21481 if (xmit_ill == NULL) { 21482 if (connp->conn_dontroute) 21483 goto dontroute; 21484 goto send_from_ill; 21485 } 21486 } 21487 /* 21488 * Could be SO_DONTROUTE case also. 21489 * check at least one interface is UP as 21490 * specified by this ILL 21491 */ 21492 if (xmit_ill->ill_ipif_up_count > 0) { 21493 ipif_t *ipif; 21494 21495 ipif = ipif_get_next_ipif(NULL, xmit_ill); 21496 if (ipif == NULL) { 21497 ip1dbg(("ip_output: " 21498 "xmit_ill NULL ipif\n")); 21499 goto drop_pkt; 21500 } 21501 /* 21502 * Look for a ire that is part of the group, 21503 * if found use it else call ip_newroute_ipif. 21504 * IPCL_ZONEID is not used for matching because 21505 * IP_ALLZONES option is valid only when the 21506 * ill is accessible from all zones i.e has a 21507 * valid ipif in all zones. 21508 */ 21509 match_flags = MATCH_IRE_ILL_GROUP | 21510 MATCH_IRE_SECATTR; 21511 ire = ire_ctable_lookup(dst, 0, 0, ipif, zoneid, 21512 MBLK_GETLABEL(mp), match_flags, ipst); 21513 /* 21514 * If an ire exists use it or else create 21515 * an ire but don't add it to the cache. 21516 * Adding an ire may cause issues with 21517 * asymmetric routing. 21518 * In case of multiroute always act as if 21519 * ire does not exist. 21520 */ 21521 if (ire == NULL || 21522 ire->ire_flags & RTF_MULTIRT) { 21523 if (ire != NULL) 21524 ire_refrele(ire); 21525 ip_newroute_ipif(q, first_mp, ipif, 21526 dst, connp, 0, zoneid, infop); 21527 ipif_refrele(ipif); 21528 ip1dbg(("ip_wput: ip_unicast_if\n")); 21529 ill_refrele(xmit_ill); 21530 if (need_decref) 21531 CONN_DEC_REF(connp); 21532 return; 21533 } 21534 ipif_refrele(ipif); 21535 } else { 21536 goto drop_pkt; 21537 } 21538 } else if (ip_nexthop || (connp != NULL && 21539 (connp->conn_nexthop_set)) && !ignore_nexthop) { 21540 if (!ip_nexthop) { 21541 ip_nexthop = B_TRUE; 21542 nexthop_addr = connp->conn_nexthop_v4; 21543 } 21544 match_flags = MATCH_IRE_MARK_PRIVATE_ADDR | 21545 MATCH_IRE_GW; 21546 ire = ire_ctable_lookup(dst, nexthop_addr, 0, 21547 NULL, zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 21548 } else { 21549 ire = ire_cache_lookup(dst, zoneid, MBLK_GETLABEL(mp), 21550 ipst); 21551 } 21552 if (!ire) { 21553 /* 21554 * Make sure we don't load spread if this 21555 * is IPIF_NOFAILOVER case. 21556 */ 21557 if ((attach_ill != NULL) || 21558 (ip_nexthop && !ignore_nexthop)) { 21559 if (mctl_present) { 21560 io = (ipsec_out_t *)first_mp->b_rptr; 21561 ASSERT(first_mp->b_datap->db_type == 21562 M_CTL); 21563 ASSERT(io->ipsec_out_type == IPSEC_OUT); 21564 } else { 21565 ASSERT(mp == first_mp); 21566 first_mp = allocb( 21567 sizeof (ipsec_info_t), BPRI_HI); 21568 if (first_mp == NULL) { 21569 first_mp = mp; 21570 goto discard_pkt; 21571 } 21572 first_mp->b_datap->db_type = M_CTL; 21573 first_mp->b_wptr += 21574 sizeof (ipsec_info_t); 21575 /* ipsec_out_secure is B_FALSE now */ 21576 bzero(first_mp->b_rptr, 21577 sizeof (ipsec_info_t)); 21578 io = (ipsec_out_t *)first_mp->b_rptr; 21579 io->ipsec_out_type = IPSEC_OUT; 21580 io->ipsec_out_len = 21581 sizeof (ipsec_out_t); 21582 io->ipsec_out_use_global_policy = 21583 B_TRUE; 21584 io->ipsec_out_ns = ipst->ips_netstack; 21585 first_mp->b_cont = mp; 21586 mctl_present = B_TRUE; 21587 } 21588 if (attach_ill != NULL) { 21589 io->ipsec_out_ill_index = attach_ill-> 21590 ill_phyint->phyint_ifindex; 21591 io->ipsec_out_attach_if = B_TRUE; 21592 } else { 21593 io->ipsec_out_ip_nexthop = ip_nexthop; 21594 io->ipsec_out_nexthop_addr = 21595 nexthop_addr; 21596 } 21597 } 21598 noirefound: 21599 /* 21600 * Mark this packet as having originated on 21601 * this machine. This will be noted in 21602 * ire_add_then_send, which needs to know 21603 * whether to run it back through ip_wput or 21604 * ip_rput following successful resolution. 21605 */ 21606 mp->b_prev = NULL; 21607 mp->b_next = NULL; 21608 ip_newroute(q, first_mp, dst, NULL, connp, zoneid, 21609 ipst); 21610 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21611 "ip_wput_end: q %p (%S)", q, "newroute"); 21612 if (attach_ill != NULL) 21613 ill_refrele(attach_ill); 21614 if (xmit_ill != NULL) 21615 ill_refrele(xmit_ill); 21616 if (need_decref) 21617 CONN_DEC_REF(connp); 21618 return; 21619 } 21620 } 21621 21622 /* We now know where we are going with it. */ 21623 21624 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21625 "ip_wput_end: q %p (%S)", q, "end"); 21626 21627 /* 21628 * Check if the ire has the RTF_MULTIRT flag, inherited 21629 * from an IRE_OFFSUBNET ire entry in ip_newroute. 21630 */ 21631 if (ire->ire_flags & RTF_MULTIRT) { 21632 /* 21633 * Force the TTL of multirouted packets if required. 21634 * The TTL of such packets is bounded by the 21635 * ip_multirt_ttl ndd variable. 21636 */ 21637 if ((ipst->ips_ip_multirt_ttl > 0) && 21638 (ipha->ipha_ttl > ipst->ips_ip_multirt_ttl)) { 21639 ip2dbg(("ip_wput: forcing multirt TTL to %d " 21640 "(was %d), dst 0x%08x\n", 21641 ipst->ips_ip_multirt_ttl, ipha->ipha_ttl, 21642 ntohl(ire->ire_addr))); 21643 ipha->ipha_ttl = ipst->ips_ip_multirt_ttl; 21644 } 21645 /* 21646 * At this point, we check to see if there are any pending 21647 * unresolved routes. ire_multirt_resolvable() 21648 * checks in O(n) that all IRE_OFFSUBNET ire 21649 * entries for the packet's destination and 21650 * flagged RTF_MULTIRT are currently resolved. 21651 * If some remain unresolved, we make a copy 21652 * of the current message. It will be used 21653 * to initiate additional route resolutions. 21654 */ 21655 multirt_need_resolve = ire_multirt_need_resolve(ire->ire_addr, 21656 MBLK_GETLABEL(first_mp), ipst); 21657 ip2dbg(("ip_wput[noirefound]: ire %p, " 21658 "multirt_need_resolve %d, first_mp %p\n", 21659 (void *)ire, multirt_need_resolve, (void *)first_mp)); 21660 if (multirt_need_resolve) { 21661 copy_mp = copymsg(first_mp); 21662 if (copy_mp != NULL) { 21663 MULTIRT_DEBUG_TAG(copy_mp); 21664 } 21665 } 21666 } 21667 21668 ip_wput_ire(q, first_mp, ire, connp, caller, zoneid); 21669 /* 21670 * Try to resolve another multiroute if 21671 * ire_multirt_resolvable() deemed it necessary. 21672 * At this point, we need to distinguish 21673 * multicasts from other packets. For multicasts, 21674 * we call ip_newroute_ipif() and request that both 21675 * multirouting and setsrc flags are checked. 21676 */ 21677 if (copy_mp != NULL) { 21678 if (CLASSD(dst)) { 21679 ipif_t *ipif = ipif_lookup_group(dst, zoneid, ipst); 21680 if (ipif) { 21681 ASSERT(infop->ip_opt_ill_index == 0); 21682 ip_newroute_ipif(q, copy_mp, ipif, dst, connp, 21683 RTF_SETSRC | RTF_MULTIRT, zoneid, infop); 21684 ipif_refrele(ipif); 21685 } else { 21686 MULTIRT_DEBUG_UNTAG(copy_mp); 21687 freemsg(copy_mp); 21688 copy_mp = NULL; 21689 } 21690 } else { 21691 ip_newroute(q, copy_mp, dst, NULL, connp, zoneid, ipst); 21692 } 21693 } 21694 if (attach_ill != NULL) 21695 ill_refrele(attach_ill); 21696 if (xmit_ill != NULL) 21697 ill_refrele(xmit_ill); 21698 if (need_decref) 21699 CONN_DEC_REF(connp); 21700 return; 21701 21702 icmp_parameter_problem: 21703 /* could not have originated externally */ 21704 ASSERT(mp->b_prev == NULL); 21705 if (ip_hdr_complete(ipha, zoneid, ipst) == 0) { 21706 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 21707 /* it's the IP header length that's in trouble */ 21708 icmp_param_problem(q, first_mp, 0, zoneid, ipst); 21709 first_mp = NULL; 21710 } 21711 21712 discard_pkt: 21713 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 21714 drop_pkt: 21715 ip1dbg(("ip_wput: dropped packet\n")); 21716 if (ire != NULL) 21717 ire_refrele(ire); 21718 if (need_decref) 21719 CONN_DEC_REF(connp); 21720 freemsg(first_mp); 21721 if (attach_ill != NULL) 21722 ill_refrele(attach_ill); 21723 if (xmit_ill != NULL) 21724 ill_refrele(xmit_ill); 21725 TRACE_2(TR_FAC_IP, TR_IP_WPUT_END, 21726 "ip_wput_end: q %p (%S)", q, "droppkt"); 21727 } 21728 21729 /* 21730 * If this is a conn_t queue, then we pass in the conn. This includes the 21731 * zoneid. 21732 * Otherwise, this is a message coming back from ARP or for an ill_t queue, 21733 * in which case we use the global zoneid since those are all part of 21734 * the global zone. 21735 */ 21736 void 21737 ip_wput(queue_t *q, mblk_t *mp) 21738 { 21739 if (CONN_Q(q)) 21740 ip_output(Q_TO_CONN(q), mp, q, IP_WPUT); 21741 else 21742 ip_output(GLOBAL_ZONEID, mp, q, IP_WPUT); 21743 } 21744 21745 /* 21746 * 21747 * The following rules must be observed when accessing any ipif or ill 21748 * that has been cached in the conn. Typically conn_nofailover_ill, 21749 * conn_xmit_if_ill, conn_multicast_ipif and conn_multicast_ill. 21750 * 21751 * Access: The ipif or ill pointed to from the conn can be accessed under 21752 * the protection of the conn_lock or after it has been refheld under the 21753 * protection of the conn lock. In addition the IPIF_CAN_LOOKUP or 21754 * ILL_CAN_LOOKUP macros must be used before actually doing the refhold. 21755 * The reason for this is that a concurrent unplumb could actually be 21756 * cleaning up these cached pointers by walking the conns and might have 21757 * finished cleaning up the conn in question. The macros check that an 21758 * unplumb has not yet started on the ipif or ill. 21759 * 21760 * Caching: An ipif or ill pointer may be cached in the conn only after 21761 * making sure that an unplumb has not started. So the caching is done 21762 * while holding both the conn_lock and the ill_lock and after using the 21763 * ILL_CAN_LOOKUP/IPIF_CAN_LOOKUP macro. An unplumb will set the ILL_CONDEMNED 21764 * flag before starting the cleanup of conns. 21765 * 21766 * The list of ipifs hanging off the ill is protected by ill_g_lock and ill_lock 21767 * On the other hand to access ipif->ipif_ill, we need one of either ill_g_lock 21768 * or a reference to the ipif or a reference to an ire that references the 21769 * ipif. An ipif does not change its ill except for failover/failback. Since 21770 * failover/failback happens only after bringing down the ipif and making sure 21771 * the ipif refcnt has gone to zero and holding the ill_g_lock and ill_lock 21772 * the above holds. 21773 */ 21774 ipif_t * 21775 conn_get_held_ipif(conn_t *connp, ipif_t **ipifp, int *err) 21776 { 21777 ipif_t *ipif; 21778 ill_t *ill; 21779 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 21780 21781 *err = 0; 21782 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 21783 mutex_enter(&connp->conn_lock); 21784 ipif = *ipifp; 21785 if (ipif != NULL) { 21786 ill = ipif->ipif_ill; 21787 mutex_enter(&ill->ill_lock); 21788 if (IPIF_CAN_LOOKUP(ipif)) { 21789 ipif_refhold_locked(ipif); 21790 mutex_exit(&ill->ill_lock); 21791 mutex_exit(&connp->conn_lock); 21792 rw_exit(&ipst->ips_ill_g_lock); 21793 return (ipif); 21794 } else { 21795 *err = IPIF_LOOKUP_FAILED; 21796 } 21797 mutex_exit(&ill->ill_lock); 21798 } 21799 mutex_exit(&connp->conn_lock); 21800 rw_exit(&ipst->ips_ill_g_lock); 21801 return (NULL); 21802 } 21803 21804 ill_t * 21805 conn_get_held_ill(conn_t *connp, ill_t **illp, int *err) 21806 { 21807 ill_t *ill; 21808 21809 *err = 0; 21810 mutex_enter(&connp->conn_lock); 21811 ill = *illp; 21812 if (ill != NULL) { 21813 mutex_enter(&ill->ill_lock); 21814 if (ILL_CAN_LOOKUP(ill)) { 21815 ill_refhold_locked(ill); 21816 mutex_exit(&ill->ill_lock); 21817 mutex_exit(&connp->conn_lock); 21818 return (ill); 21819 } else { 21820 *err = ILL_LOOKUP_FAILED; 21821 } 21822 mutex_exit(&ill->ill_lock); 21823 } 21824 mutex_exit(&connp->conn_lock); 21825 return (NULL); 21826 } 21827 21828 static int 21829 conn_set_held_ipif(conn_t *connp, ipif_t **ipifp, ipif_t *ipif) 21830 { 21831 ill_t *ill; 21832 21833 ill = ipif->ipif_ill; 21834 mutex_enter(&connp->conn_lock); 21835 mutex_enter(&ill->ill_lock); 21836 if (IPIF_CAN_LOOKUP(ipif)) { 21837 *ipifp = ipif; 21838 mutex_exit(&ill->ill_lock); 21839 mutex_exit(&connp->conn_lock); 21840 return (0); 21841 } 21842 mutex_exit(&ill->ill_lock); 21843 mutex_exit(&connp->conn_lock); 21844 return (IPIF_LOOKUP_FAILED); 21845 } 21846 21847 /* 21848 * This is called if the outbound datagram needs fragmentation. 21849 * 21850 * NOTE : This function does not ire_refrele the ire argument passed in. 21851 */ 21852 static void 21853 ip_wput_ire_fragmentit(mblk_t *ipsec_mp, ire_t *ire, zoneid_t zoneid, 21854 ip_stack_t *ipst) 21855 { 21856 ipha_t *ipha; 21857 mblk_t *mp; 21858 uint32_t v_hlen_tos_len; 21859 uint32_t max_frag; 21860 uint32_t frag_flag; 21861 boolean_t dont_use; 21862 21863 if (ipsec_mp->b_datap->db_type == M_CTL) { 21864 mp = ipsec_mp->b_cont; 21865 } else { 21866 mp = ipsec_mp; 21867 } 21868 21869 ipha = (ipha_t *)mp->b_rptr; 21870 v_hlen_tos_len = ((uint32_t *)ipha)[0]; 21871 21872 #ifdef _BIG_ENDIAN 21873 #define V_HLEN (v_hlen_tos_len >> 24) 21874 #define LENGTH (v_hlen_tos_len & 0xFFFF) 21875 #else 21876 #define V_HLEN (v_hlen_tos_len & 0xFF) 21877 #define LENGTH ((v_hlen_tos_len >> 24) | ((v_hlen_tos_len >> 8) & 0xFF00)) 21878 #endif 21879 21880 #ifndef SPEED_BEFORE_SAFETY 21881 /* 21882 * Check that ipha_length is consistent with 21883 * the mblk length 21884 */ 21885 if (LENGTH != (mp->b_cont ? msgdsize(mp) : mp->b_wptr - rptr)) { 21886 ip0dbg(("Packet length mismatch: %d, %ld\n", 21887 LENGTH, msgdsize(mp))); 21888 freemsg(ipsec_mp); 21889 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 21890 "ip_wput_ire_fragmentit: mp %p (%S)", mp, 21891 "packet length mismatch"); 21892 return; 21893 } 21894 #endif 21895 /* 21896 * Don't use frag_flag if pre-built packet or source 21897 * routed or if multicast (since multicast packets do not solicit 21898 * ICMP "packet too big" messages). Get the values of 21899 * max_frag and frag_flag atomically by acquiring the 21900 * ire_lock. 21901 */ 21902 mutex_enter(&ire->ire_lock); 21903 max_frag = ire->ire_max_frag; 21904 frag_flag = ire->ire_frag_flag; 21905 mutex_exit(&ire->ire_lock); 21906 21907 dont_use = ((ipha->ipha_ident == IP_HDR_INCLUDED) || 21908 (V_HLEN != IP_SIMPLE_HDR_VERSION && 21909 ip_source_route_included(ipha)) || CLASSD(ipha->ipha_dst)); 21910 21911 ip_wput_frag(ire, ipsec_mp, OB_PKT, max_frag, 21912 (dont_use ? 0 : frag_flag), zoneid, ipst); 21913 } 21914 21915 /* 21916 * Used for deciding the MSS size for the upper layer. Thus 21917 * we need to check the outbound policy values in the conn. 21918 */ 21919 int 21920 conn_ipsec_length(conn_t *connp) 21921 { 21922 ipsec_latch_t *ipl; 21923 21924 ipl = connp->conn_latch; 21925 if (ipl == NULL) 21926 return (0); 21927 21928 if (ipl->ipl_out_policy == NULL) 21929 return (0); 21930 21931 return (ipl->ipl_out_policy->ipsp_act->ipa_ovhd); 21932 } 21933 21934 /* 21935 * Returns an estimate of the IPSEC headers size. This is used if 21936 * we don't want to call into IPSEC to get the exact size. 21937 */ 21938 int 21939 ipsec_out_extra_length(mblk_t *ipsec_mp) 21940 { 21941 ipsec_out_t *io = (ipsec_out_t *)ipsec_mp->b_rptr; 21942 ipsec_action_t *a; 21943 21944 ASSERT(io->ipsec_out_type == IPSEC_OUT); 21945 if (!io->ipsec_out_secure) 21946 return (0); 21947 21948 a = io->ipsec_out_act; 21949 21950 if (a == NULL) { 21951 ASSERT(io->ipsec_out_policy != NULL); 21952 a = io->ipsec_out_policy->ipsp_act; 21953 } 21954 ASSERT(a != NULL); 21955 21956 return (a->ipa_ovhd); 21957 } 21958 21959 /* 21960 * Returns an estimate of the IPSEC headers size. This is used if 21961 * we don't want to call into IPSEC to get the exact size. 21962 */ 21963 int 21964 ipsec_in_extra_length(mblk_t *ipsec_mp) 21965 { 21966 ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr; 21967 ipsec_action_t *a; 21968 21969 ASSERT(ii->ipsec_in_type == IPSEC_IN); 21970 21971 a = ii->ipsec_in_action; 21972 return (a == NULL ? 0 : a->ipa_ovhd); 21973 } 21974 21975 /* 21976 * If there are any source route options, return the true final 21977 * destination. Otherwise, return the destination. 21978 */ 21979 ipaddr_t 21980 ip_get_dst(ipha_t *ipha) 21981 { 21982 ipoptp_t opts; 21983 uchar_t *opt; 21984 uint8_t optval; 21985 uint8_t optlen; 21986 ipaddr_t dst; 21987 uint32_t off; 21988 21989 dst = ipha->ipha_dst; 21990 21991 if (IS_SIMPLE_IPH(ipha)) 21992 return (dst); 21993 21994 for (optval = ipoptp_first(&opts, ipha); 21995 optval != IPOPT_EOL; 21996 optval = ipoptp_next(&opts)) { 21997 opt = opts.ipoptp_cur; 21998 optlen = opts.ipoptp_len; 21999 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 22000 switch (optval) { 22001 case IPOPT_SSRR: 22002 case IPOPT_LSRR: 22003 off = opt[IPOPT_OFFSET]; 22004 /* 22005 * If one of the conditions is true, it means 22006 * end of options and dst already has the right 22007 * value. 22008 */ 22009 if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) { 22010 off = optlen - IP_ADDR_LEN; 22011 bcopy(&opt[off], &dst, IP_ADDR_LEN); 22012 } 22013 return (dst); 22014 default: 22015 break; 22016 } 22017 } 22018 22019 return (dst); 22020 } 22021 22022 mblk_t * 22023 ip_wput_ire_parse_ipsec_out(mblk_t *mp, ipha_t *ipha, ip6_t *ip6h, ire_t *ire, 22024 conn_t *connp, boolean_t unspec_src, zoneid_t zoneid) 22025 { 22026 ipsec_out_t *io; 22027 mblk_t *first_mp; 22028 boolean_t policy_present; 22029 ip_stack_t *ipst; 22030 ipsec_stack_t *ipss; 22031 22032 ASSERT(ire != NULL); 22033 ipst = ire->ire_ipst; 22034 ipss = ipst->ips_netstack->netstack_ipsec; 22035 22036 first_mp = mp; 22037 if (mp->b_datap->db_type == M_CTL) { 22038 io = (ipsec_out_t *)first_mp->b_rptr; 22039 /* 22040 * ip_wput[_v6] attaches an IPSEC_OUT in two cases. 22041 * 22042 * 1) There is per-socket policy (including cached global 22043 * policy) or a policy on the IP-in-IP tunnel. 22044 * 2) There is no per-socket policy, but it is 22045 * a multicast packet that needs to go out 22046 * on a specific interface. This is the case 22047 * where (ip_wput and ip_wput_multicast) attaches 22048 * an IPSEC_OUT and sets ipsec_out_secure B_FALSE. 22049 * 22050 * In case (2) we check with global policy to 22051 * see if there is a match and set the ill_index 22052 * appropriately so that we can lookup the ire 22053 * properly in ip_wput_ipsec_out. 22054 */ 22055 22056 /* 22057 * ipsec_out_use_global_policy is set to B_FALSE 22058 * in ipsec_in_to_out(). Refer to that function for 22059 * details. 22060 */ 22061 if ((io->ipsec_out_latch == NULL) && 22062 (io->ipsec_out_use_global_policy)) { 22063 return (ip_wput_attach_policy(first_mp, ipha, ip6h, 22064 ire, connp, unspec_src, zoneid)); 22065 } 22066 if (!io->ipsec_out_secure) { 22067 /* 22068 * If this is not a secure packet, drop 22069 * the IPSEC_OUT mp and treat it as a clear 22070 * packet. This happens when we are sending 22071 * a ICMP reply back to a clear packet. See 22072 * ipsec_in_to_out() for details. 22073 */ 22074 mp = first_mp->b_cont; 22075 freeb(first_mp); 22076 } 22077 return (mp); 22078 } 22079 /* 22080 * See whether we need to attach a global policy here. We 22081 * don't depend on the conn (as it could be null) for deciding 22082 * what policy this datagram should go through because it 22083 * should have happened in ip_wput if there was some 22084 * policy. This normally happens for connections which are not 22085 * fully bound preventing us from caching policies in 22086 * ip_bind. Packets coming from the TCP listener/global queue 22087 * - which are non-hard_bound - could also be affected by 22088 * applying policy here. 22089 * 22090 * If this packet is coming from tcp global queue or listener, 22091 * we will be applying policy here. This may not be *right* 22092 * if these packets are coming from the detached connection as 22093 * it could have gone in clear before. This happens only if a 22094 * TCP connection started when there is no policy and somebody 22095 * added policy before it became detached. Thus packets of the 22096 * detached connection could go out secure and the other end 22097 * would drop it because it will be expecting in clear. The 22098 * converse is not true i.e if somebody starts a TCP 22099 * connection and deletes the policy, all the packets will 22100 * still go out with the policy that existed before deleting 22101 * because ip_unbind sends up policy information which is used 22102 * by TCP on subsequent ip_wputs. The right solution is to fix 22103 * TCP to attach a dummy IPSEC_OUT and set 22104 * ipsec_out_use_global_policy to B_FALSE. As this might 22105 * affect performance for normal cases, we are not doing it. 22106 * Thus, set policy before starting any TCP connections. 22107 * 22108 * NOTE - We might apply policy even for a hard bound connection 22109 * - for which we cached policy in ip_bind - if somebody added 22110 * global policy after we inherited the policy in ip_bind. 22111 * This means that the packets that were going out in clear 22112 * previously would start going secure and hence get dropped 22113 * on the other side. To fix this, TCP attaches a dummy 22114 * ipsec_out and make sure that we don't apply global policy. 22115 */ 22116 if (ipha != NULL) 22117 policy_present = ipss->ipsec_outbound_v4_policy_present; 22118 else 22119 policy_present = ipss->ipsec_outbound_v6_policy_present; 22120 if (!policy_present) 22121 return (mp); 22122 22123 return (ip_wput_attach_policy(mp, ipha, ip6h, ire, connp, unspec_src, 22124 zoneid)); 22125 } 22126 22127 ire_t * 22128 conn_set_outgoing_ill(conn_t *connp, ire_t *ire, ill_t **conn_outgoing_ill) 22129 { 22130 ipaddr_t addr; 22131 ire_t *save_ire; 22132 irb_t *irb; 22133 ill_group_t *illgrp; 22134 int err; 22135 22136 save_ire = ire; 22137 addr = ire->ire_addr; 22138 22139 ASSERT(ire->ire_type == IRE_BROADCAST); 22140 22141 illgrp = connp->conn_outgoing_ill->ill_group; 22142 if (illgrp == NULL) { 22143 *conn_outgoing_ill = conn_get_held_ill(connp, 22144 &connp->conn_outgoing_ill, &err); 22145 if (err == ILL_LOOKUP_FAILED) { 22146 ire_refrele(save_ire); 22147 return (NULL); 22148 } 22149 return (save_ire); 22150 } 22151 /* 22152 * If IP_BOUND_IF has been done, conn_outgoing_ill will be set. 22153 * If it is part of the group, we need to send on the ire 22154 * that has been cleared of IRE_MARK_NORECV and that belongs 22155 * to this group. This is okay as IP_BOUND_IF really means 22156 * any ill in the group. We depend on the fact that the 22157 * first ire in the group is always cleared of IRE_MARK_NORECV 22158 * if such an ire exists. This is possible only if you have 22159 * at least one ill in the group that has not failed. 22160 * 22161 * First get to the ire that matches the address and group. 22162 * 22163 * We don't look for an ire with a matching zoneid because a given zone 22164 * won't always have broadcast ires on all ills in the group. 22165 */ 22166 irb = ire->ire_bucket; 22167 rw_enter(&irb->irb_lock, RW_READER); 22168 if (ire->ire_marks & IRE_MARK_NORECV) { 22169 /* 22170 * If the current zone only has an ire broadcast for this 22171 * address marked NORECV, the ire we want is ahead in the 22172 * bucket, so we look it up deliberately ignoring the zoneid. 22173 */ 22174 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 22175 if (ire->ire_addr != addr) 22176 continue; 22177 /* skip over deleted ires */ 22178 if (ire->ire_marks & IRE_MARK_CONDEMNED) 22179 continue; 22180 } 22181 } 22182 while (ire != NULL) { 22183 /* 22184 * If a new interface is coming up, we could end up 22185 * seeing the loopback ire and the non-loopback ire 22186 * may not have been added yet. So check for ire_stq 22187 */ 22188 if (ire->ire_stq != NULL && (ire->ire_addr != addr || 22189 ire->ire_ipif->ipif_ill->ill_group == illgrp)) { 22190 break; 22191 } 22192 ire = ire->ire_next; 22193 } 22194 if (ire != NULL && ire->ire_addr == addr && 22195 ire->ire_ipif->ipif_ill->ill_group == illgrp) { 22196 IRE_REFHOLD(ire); 22197 rw_exit(&irb->irb_lock); 22198 ire_refrele(save_ire); 22199 *conn_outgoing_ill = ire_to_ill(ire); 22200 /* 22201 * Refhold the ill to make the conn_outgoing_ill 22202 * independent of the ire. ip_wput_ire goes in a loop 22203 * and may refrele the ire. Since we have an ire at this 22204 * point we don't need to use ILL_CAN_LOOKUP on the ill. 22205 */ 22206 ill_refhold(*conn_outgoing_ill); 22207 return (ire); 22208 } 22209 rw_exit(&irb->irb_lock); 22210 ip1dbg(("conn_set_outgoing_ill: No matching ire\n")); 22211 /* 22212 * If we can't find a suitable ire, return the original ire. 22213 */ 22214 return (save_ire); 22215 } 22216 22217 /* 22218 * This function does the ire_refrele of the ire passed in as the 22219 * argument. As this function looks up more ires i.e broadcast ires, 22220 * it needs to REFRELE them. Currently, for simplicity we don't 22221 * differentiate the one passed in and looked up here. We always 22222 * REFRELE. 22223 * IPQoS Notes: 22224 * IP policy is invoked if IPP_LOCAL_OUT is enabled. Processing for 22225 * IPSec packets are done in ipsec_out_process. 22226 * 22227 */ 22228 void 22229 ip_wput_ire(queue_t *q, mblk_t *mp, ire_t *ire, conn_t *connp, int caller, 22230 zoneid_t zoneid) 22231 { 22232 ipha_t *ipha; 22233 #define rptr ((uchar_t *)ipha) 22234 queue_t *stq; 22235 #define Q_TO_INDEX(stq) (((ill_t *)stq->q_ptr)->ill_phyint->phyint_ifindex) 22236 uint32_t v_hlen_tos_len; 22237 uint32_t ttl_protocol; 22238 ipaddr_t src; 22239 ipaddr_t dst; 22240 uint32_t cksum; 22241 ipaddr_t orig_src; 22242 ire_t *ire1; 22243 mblk_t *next_mp; 22244 uint_t hlen; 22245 uint16_t *up; 22246 uint32_t max_frag = ire->ire_max_frag; 22247 ill_t *ill = ire_to_ill(ire); 22248 int clusterwide; 22249 uint16_t ip_hdr_included; /* IP header included by ULP? */ 22250 int ipsec_len; 22251 mblk_t *first_mp; 22252 ipsec_out_t *io; 22253 boolean_t conn_dontroute; /* conn value for multicast */ 22254 boolean_t conn_multicast_loop; /* conn value for multicast */ 22255 boolean_t multicast_forward; /* Should we forward ? */ 22256 boolean_t unspec_src; 22257 ill_t *conn_outgoing_ill = NULL; 22258 ill_t *ire_ill; 22259 ill_t *ire1_ill; 22260 ill_t *out_ill; 22261 uint32_t ill_index = 0; 22262 boolean_t multirt_send = B_FALSE; 22263 int err; 22264 ipxmit_state_t pktxmit_state; 22265 ip_stack_t *ipst = ire->ire_ipst; 22266 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 22267 22268 TRACE_1(TR_FAC_IP, TR_IP_WPUT_IRE_START, 22269 "ip_wput_ire_start: q %p", q); 22270 22271 multicast_forward = B_FALSE; 22272 unspec_src = (connp != NULL && connp->conn_unspec_src); 22273 22274 if (ire->ire_flags & RTF_MULTIRT) { 22275 /* 22276 * Multirouting case. The bucket where ire is stored 22277 * probably holds other RTF_MULTIRT flagged ire 22278 * to the destination. In this call to ip_wput_ire, 22279 * we attempt to send the packet through all 22280 * those ires. Thus, we first ensure that ire is the 22281 * first RTF_MULTIRT ire in the bucket, 22282 * before walking the ire list. 22283 */ 22284 ire_t *first_ire; 22285 irb_t *irb = ire->ire_bucket; 22286 ASSERT(irb != NULL); 22287 22288 /* Make sure we do not omit any multiroute ire. */ 22289 IRB_REFHOLD(irb); 22290 for (first_ire = irb->irb_ire; 22291 first_ire != NULL; 22292 first_ire = first_ire->ire_next) { 22293 if ((first_ire->ire_flags & RTF_MULTIRT) && 22294 (first_ire->ire_addr == ire->ire_addr) && 22295 !(first_ire->ire_marks & 22296 (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))) 22297 break; 22298 } 22299 22300 if ((first_ire != NULL) && (first_ire != ire)) { 22301 IRE_REFHOLD(first_ire); 22302 ire_refrele(ire); 22303 ire = first_ire; 22304 ill = ire_to_ill(ire); 22305 } 22306 IRB_REFRELE(irb); 22307 } 22308 22309 /* 22310 * conn_outgoing_ill is used only in the broadcast loop. 22311 * for performance we don't grab the mutexs in the fastpath 22312 */ 22313 if ((connp != NULL) && 22314 (connp->conn_xmit_if_ill == NULL) && 22315 (ire->ire_type == IRE_BROADCAST) && 22316 ((connp->conn_nofailover_ill != NULL) || 22317 (connp->conn_outgoing_ill != NULL))) { 22318 /* 22319 * Bind to IPIF_NOFAILOVER address overrides IP_BOUND_IF 22320 * option. So, see if this endpoint is bound to a 22321 * IPIF_NOFAILOVER address. If so, honor it. This implies 22322 * that if the interface is failed, we will still send 22323 * the packet on the same ill which is what we want. 22324 */ 22325 conn_outgoing_ill = conn_get_held_ill(connp, 22326 &connp->conn_nofailover_ill, &err); 22327 if (err == ILL_LOOKUP_FAILED) { 22328 ire_refrele(ire); 22329 freemsg(mp); 22330 return; 22331 } 22332 if (conn_outgoing_ill == NULL) { 22333 /* 22334 * Choose a good ill in the group to send the 22335 * packets on. 22336 */ 22337 ire = conn_set_outgoing_ill(connp, ire, 22338 &conn_outgoing_ill); 22339 if (ire == NULL) { 22340 freemsg(mp); 22341 return; 22342 } 22343 } 22344 } 22345 22346 if (mp->b_datap->db_type != M_CTL) { 22347 ipha = (ipha_t *)mp->b_rptr; 22348 } else { 22349 io = (ipsec_out_t *)mp->b_rptr; 22350 ASSERT(io->ipsec_out_type == IPSEC_OUT); 22351 ASSERT(zoneid == io->ipsec_out_zoneid); 22352 ASSERT(zoneid != ALL_ZONES); 22353 ipha = (ipha_t *)mp->b_cont->b_rptr; 22354 dst = ipha->ipha_dst; 22355 /* 22356 * For the multicast case, ipsec_out carries conn_dontroute and 22357 * conn_multicast_loop as conn may not be available here. We 22358 * need this for multicast loopback and forwarding which is done 22359 * later in the code. 22360 */ 22361 if (CLASSD(dst)) { 22362 conn_dontroute = io->ipsec_out_dontroute; 22363 conn_multicast_loop = io->ipsec_out_multicast_loop; 22364 /* 22365 * If conn_dontroute is not set or conn_multicast_loop 22366 * is set, we need to do forwarding/loopback. For 22367 * datagrams from ip_wput_multicast, conn_dontroute is 22368 * set to B_TRUE and conn_multicast_loop is set to 22369 * B_FALSE so that we neither do forwarding nor 22370 * loopback. 22371 */ 22372 if (!conn_dontroute || conn_multicast_loop) 22373 multicast_forward = B_TRUE; 22374 } 22375 } 22376 22377 if (ire->ire_type == IRE_LOCAL && ire->ire_zoneid != zoneid && 22378 ire->ire_zoneid != ALL_ZONES) { 22379 /* 22380 * When a zone sends a packet to another zone, we try to deliver 22381 * the packet under the same conditions as if the destination 22382 * was a real node on the network. To do so, we look for a 22383 * matching route in the forwarding table. 22384 * RTF_REJECT and RTF_BLACKHOLE are handled just like 22385 * ip_newroute() does. 22386 * Note that IRE_LOCAL are special, since they are used 22387 * when the zoneid doesn't match in some cases. This means that 22388 * we need to handle ipha_src differently since ire_src_addr 22389 * belongs to the receiving zone instead of the sending zone. 22390 * When ip_restrict_interzone_loopback is set, then 22391 * ire_cache_lookup() ensures that IRE_LOCAL are only used 22392 * for loopback between zones when the logical "Ethernet" would 22393 * have looped them back. 22394 */ 22395 ire_t *src_ire; 22396 22397 src_ire = ire_ftable_lookup(ipha->ipha_dst, 0, 0, 0, 22398 NULL, NULL, zoneid, 0, NULL, (MATCH_IRE_RECURSIVE | 22399 MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE), ipst); 22400 if (src_ire != NULL && 22401 !(src_ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) && 22402 (!ipst->ips_ip_restrict_interzone_loopback || 22403 ire_local_same_ill_group(ire, src_ire))) { 22404 if (ipha->ipha_src == INADDR_ANY && !unspec_src) 22405 ipha->ipha_src = src_ire->ire_src_addr; 22406 ire_refrele(src_ire); 22407 } else { 22408 ire_refrele(ire); 22409 if (conn_outgoing_ill != NULL) 22410 ill_refrele(conn_outgoing_ill); 22411 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 22412 if (src_ire != NULL) { 22413 if (src_ire->ire_flags & RTF_BLACKHOLE) { 22414 ire_refrele(src_ire); 22415 freemsg(mp); 22416 return; 22417 } 22418 ire_refrele(src_ire); 22419 } 22420 if (ip_hdr_complete(ipha, zoneid, ipst)) { 22421 /* Failed */ 22422 freemsg(mp); 22423 return; 22424 } 22425 icmp_unreachable(q, mp, ICMP_HOST_UNREACHABLE, zoneid, 22426 ipst); 22427 return; 22428 } 22429 } 22430 22431 if (mp->b_datap->db_type == M_CTL || 22432 ipss->ipsec_outbound_v4_policy_present) { 22433 mp = ip_wput_ire_parse_ipsec_out(mp, ipha, NULL, ire, connp, 22434 unspec_src, zoneid); 22435 if (mp == NULL) { 22436 ire_refrele(ire); 22437 if (conn_outgoing_ill != NULL) 22438 ill_refrele(conn_outgoing_ill); 22439 return; 22440 } 22441 } 22442 22443 first_mp = mp; 22444 ipsec_len = 0; 22445 22446 if (first_mp->b_datap->db_type == M_CTL) { 22447 io = (ipsec_out_t *)first_mp->b_rptr; 22448 ASSERT(io->ipsec_out_type == IPSEC_OUT); 22449 mp = first_mp->b_cont; 22450 ipsec_len = ipsec_out_extra_length(first_mp); 22451 ASSERT(ipsec_len >= 0); 22452 /* We already picked up the zoneid from the M_CTL above */ 22453 ASSERT(zoneid == io->ipsec_out_zoneid); 22454 ASSERT(zoneid != ALL_ZONES); 22455 22456 /* 22457 * Drop M_CTL here if IPsec processing is not needed. 22458 * (Non-IPsec use of M_CTL extracted any information it 22459 * needed above). 22460 */ 22461 if (ipsec_len == 0) { 22462 freeb(first_mp); 22463 first_mp = mp; 22464 } 22465 } 22466 22467 /* 22468 * Fast path for ip_wput_ire 22469 */ 22470 22471 ipha = (ipha_t *)mp->b_rptr; 22472 v_hlen_tos_len = ((uint32_t *)ipha)[0]; 22473 dst = ipha->ipha_dst; 22474 22475 /* 22476 * ICMP(RAWIP) module should set the ipha_ident to IP_HDR_INCLUDED 22477 * if the socket is a SOCK_RAW type. The transport checksum should 22478 * be provided in the pre-built packet, so we don't need to compute it. 22479 * Also, other application set flags, like DF, should not be altered. 22480 * Other transport MUST pass down zero. 22481 */ 22482 ip_hdr_included = ipha->ipha_ident; 22483 ASSERT(ipha->ipha_ident == 0 || ipha->ipha_ident == IP_HDR_INCLUDED); 22484 22485 if (CLASSD(dst)) { 22486 ip1dbg(("ip_wput_ire: to 0x%x ire %s addr 0x%x\n", 22487 ntohl(dst), 22488 ip_nv_lookup(ire_nv_tbl, ire->ire_type), 22489 ntohl(ire->ire_addr))); 22490 } 22491 22492 /* Macros to extract header fields from data already in registers */ 22493 #ifdef _BIG_ENDIAN 22494 #define V_HLEN (v_hlen_tos_len >> 24) 22495 #define LENGTH (v_hlen_tos_len & 0xFFFF) 22496 #define PROTO (ttl_protocol & 0xFF) 22497 #else 22498 #define V_HLEN (v_hlen_tos_len & 0xFF) 22499 #define LENGTH ((v_hlen_tos_len >> 24) | ((v_hlen_tos_len >> 8) & 0xFF00)) 22500 #define PROTO (ttl_protocol >> 8) 22501 #endif 22502 22503 22504 orig_src = src = ipha->ipha_src; 22505 /* (The loop back to "another" is explained down below.) */ 22506 another:; 22507 /* 22508 * Assign an ident value for this packet. We assign idents on 22509 * a per destination basis out of the IRE. There could be 22510 * other threads targeting the same destination, so we have to 22511 * arrange for a atomic increment. Note that we use a 32-bit 22512 * atomic add because it has better performance than its 22513 * 16-bit sibling. 22514 * 22515 * If running in cluster mode and if the source address 22516 * belongs to a replicated service then vector through 22517 * cl_inet_ipident vector to allocate ip identifier 22518 * NOTE: This is a contract private interface with the 22519 * clustering group. 22520 */ 22521 clusterwide = 0; 22522 if (cl_inet_ipident) { 22523 ASSERT(cl_inet_isclusterwide); 22524 if ((*cl_inet_isclusterwide)(IPPROTO_IP, 22525 AF_INET, (uint8_t *)(uintptr_t)src)) { 22526 ipha->ipha_ident = (*cl_inet_ipident)(IPPROTO_IP, 22527 AF_INET, (uint8_t *)(uintptr_t)src, 22528 (uint8_t *)(uintptr_t)dst); 22529 clusterwide = 1; 22530 } 22531 } 22532 if (!clusterwide) { 22533 ipha->ipha_ident = 22534 (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1); 22535 } 22536 22537 #ifndef _BIG_ENDIAN 22538 ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8); 22539 #endif 22540 22541 /* 22542 * Set source address unless sent on an ill or conn_unspec_src is set. 22543 * This is needed to obey conn_unspec_src when packets go through 22544 * ip_newroute + arp. 22545 * Assumes ip_newroute{,_multi} sets the source address as well. 22546 */ 22547 if (src == INADDR_ANY && !unspec_src) { 22548 /* 22549 * Assign the appropriate source address from the IRE if none 22550 * was specified. 22551 */ 22552 ASSERT(ire->ire_ipversion == IPV4_VERSION); 22553 22554 /* 22555 * With IP multipathing, broadcast packets are sent on the ire 22556 * that has been cleared of IRE_MARK_NORECV and that belongs to 22557 * the group. However, this ire might not be in the same zone so 22558 * we can't always use its source address. We look for a 22559 * broadcast ire in the same group and in the right zone. 22560 */ 22561 if (ire->ire_type == IRE_BROADCAST && 22562 ire->ire_zoneid != zoneid) { 22563 ire_t *src_ire = ire_ctable_lookup(dst, 0, 22564 IRE_BROADCAST, ire->ire_ipif, zoneid, NULL, 22565 (MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP), ipst); 22566 if (src_ire != NULL) { 22567 src = src_ire->ire_src_addr; 22568 ire_refrele(src_ire); 22569 } else { 22570 ire_refrele(ire); 22571 if (conn_outgoing_ill != NULL) 22572 ill_refrele(conn_outgoing_ill); 22573 freemsg(first_mp); 22574 if (ill != NULL) { 22575 BUMP_MIB(ill->ill_ip_mib, 22576 ipIfStatsOutDiscards); 22577 } else { 22578 BUMP_MIB(&ipst->ips_ip_mib, 22579 ipIfStatsOutDiscards); 22580 } 22581 return; 22582 } 22583 } else { 22584 src = ire->ire_src_addr; 22585 } 22586 22587 if (connp == NULL) { 22588 ip1dbg(("ip_wput_ire: no connp and no src " 22589 "address for dst 0x%x, using src 0x%x\n", 22590 ntohl(dst), 22591 ntohl(src))); 22592 } 22593 ipha->ipha_src = src; 22594 } 22595 stq = ire->ire_stq; 22596 22597 /* 22598 * We only allow ire chains for broadcasts since there will 22599 * be multiple IRE_CACHE entries for the same multicast 22600 * address (one per ipif). 22601 */ 22602 next_mp = NULL; 22603 22604 /* broadcast packet */ 22605 if (ire->ire_type == IRE_BROADCAST) 22606 goto broadcast; 22607 22608 /* loopback ? */ 22609 if (stq == NULL) 22610 goto nullstq; 22611 22612 /* The ill_index for outbound ILL */ 22613 ill_index = Q_TO_INDEX(stq); 22614 22615 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutRequests); 22616 ttl_protocol = ((uint16_t *)ipha)[4]; 22617 22618 /* pseudo checksum (do it in parts for IP header checksum) */ 22619 cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF); 22620 22621 if (!IP_FLOW_CONTROLLED_ULP(PROTO)) { 22622 queue_t *dev_q = stq->q_next; 22623 22624 /* flow controlled */ 22625 if ((dev_q->q_next || dev_q->q_first) && 22626 !canput(dev_q)) 22627 goto blocked; 22628 if ((PROTO == IPPROTO_UDP) && 22629 (ip_hdr_included != IP_HDR_INCLUDED)) { 22630 hlen = (V_HLEN & 0xF) << 2; 22631 up = IPH_UDPH_CHECKSUMP(ipha, hlen); 22632 if (*up != 0) { 22633 IP_CKSUM_XMIT(ill, ire, mp, ipha, up, PROTO, 22634 hlen, LENGTH, max_frag, ipsec_len, cksum); 22635 /* Software checksum? */ 22636 if (DB_CKSUMFLAGS(mp) == 0) { 22637 IP_STAT(ipst, ip_out_sw_cksum); 22638 IP_STAT_UPDATE(ipst, 22639 ip_udp_out_sw_cksum_bytes, 22640 LENGTH - hlen); 22641 } 22642 } 22643 } 22644 } else if (ip_hdr_included != IP_HDR_INCLUDED) { 22645 hlen = (V_HLEN & 0xF) << 2; 22646 if (PROTO == IPPROTO_TCP) { 22647 up = IPH_TCPH_CHECKSUMP(ipha, hlen); 22648 /* 22649 * The packet header is processed once and for all, even 22650 * in the multirouting case. We disable hardware 22651 * checksum if the packet is multirouted, as it will be 22652 * replicated via several interfaces, and not all of 22653 * them may have this capability. 22654 */ 22655 IP_CKSUM_XMIT(ill, ire, mp, ipha, up, PROTO, hlen, 22656 LENGTH, max_frag, ipsec_len, cksum); 22657 /* Software checksum? */ 22658 if (DB_CKSUMFLAGS(mp) == 0) { 22659 IP_STAT(ipst, ip_out_sw_cksum); 22660 IP_STAT_UPDATE(ipst, ip_tcp_out_sw_cksum_bytes, 22661 LENGTH - hlen); 22662 } 22663 } else { 22664 sctp_hdr_t *sctph; 22665 22666 ASSERT(PROTO == IPPROTO_SCTP); 22667 ASSERT(MBLKL(mp) >= (hlen + sizeof (*sctph))); 22668 sctph = (sctp_hdr_t *)(mp->b_rptr + hlen); 22669 /* 22670 * Zero out the checksum field to ensure proper 22671 * checksum calculation. 22672 */ 22673 sctph->sh_chksum = 0; 22674 #ifdef DEBUG 22675 if (!skip_sctp_cksum) 22676 #endif 22677 sctph->sh_chksum = sctp_cksum(mp, hlen); 22678 } 22679 } 22680 22681 /* 22682 * If this is a multicast packet and originated from ip_wput 22683 * we need to do loopback and forwarding checks. If it comes 22684 * from ip_wput_multicast, we SHOULD not do this. 22685 */ 22686 if (CLASSD(ipha->ipha_dst) && multicast_forward) goto multi_loopback; 22687 22688 /* checksum */ 22689 cksum += ttl_protocol; 22690 22691 /* fragment the packet */ 22692 if (max_frag < (uint_t)(LENGTH + ipsec_len)) 22693 goto fragmentit; 22694 /* 22695 * Don't use frag_flag if packet is pre-built or source 22696 * routed or if multicast (since multicast packets do 22697 * not solicit ICMP "packet too big" messages). 22698 */ 22699 if ((ip_hdr_included != IP_HDR_INCLUDED) && 22700 (V_HLEN == IP_SIMPLE_HDR_VERSION || 22701 !ip_source_route_included(ipha)) && 22702 !CLASSD(ipha->ipha_dst)) 22703 ipha->ipha_fragment_offset_and_flags |= 22704 htons(ire->ire_frag_flag); 22705 22706 if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) { 22707 /* calculate IP header checksum */ 22708 cksum += ipha->ipha_ident; 22709 cksum += (v_hlen_tos_len >> 16)+(v_hlen_tos_len & 0xFFFF); 22710 cksum += ipha->ipha_fragment_offset_and_flags; 22711 22712 /* IP options present */ 22713 hlen = (V_HLEN & 0xF) - IP_SIMPLE_HDR_LENGTH_IN_WORDS; 22714 if (hlen) 22715 goto checksumoptions; 22716 22717 /* calculate hdr checksum */ 22718 cksum = ((cksum & 0xFFFF) + (cksum >> 16)); 22719 cksum = ~(cksum + (cksum >> 16)); 22720 ipha->ipha_hdr_checksum = (uint16_t)cksum; 22721 } 22722 if (ipsec_len != 0) { 22723 /* 22724 * We will do the rest of the processing after 22725 * we come back from IPSEC in ip_wput_ipsec_out(). 22726 */ 22727 ASSERT(MBLKL(first_mp) >= sizeof (ipsec_out_t)); 22728 22729 io = (ipsec_out_t *)first_mp->b_rptr; 22730 io->ipsec_out_ill_index = ((ill_t *)stq->q_ptr)-> 22731 ill_phyint->phyint_ifindex; 22732 22733 ipsec_out_process(q, first_mp, ire, ill_index); 22734 ire_refrele(ire); 22735 if (conn_outgoing_ill != NULL) 22736 ill_refrele(conn_outgoing_ill); 22737 return; 22738 } 22739 22740 /* 22741 * In most cases, the emission loop below is entered only 22742 * once. Only in the case where the ire holds the 22743 * RTF_MULTIRT flag, do we loop to process all RTF_MULTIRT 22744 * flagged ires in the bucket, and send the packet 22745 * through all crossed RTF_MULTIRT routes. 22746 */ 22747 if (ire->ire_flags & RTF_MULTIRT) { 22748 multirt_send = B_TRUE; 22749 } 22750 do { 22751 if (multirt_send) { 22752 irb_t *irb; 22753 /* 22754 * We are in a multiple send case, need to get 22755 * the next ire and make a duplicate of the packet. 22756 * ire1 holds here the next ire to process in the 22757 * bucket. If multirouting is expected, 22758 * any non-RTF_MULTIRT ire that has the 22759 * right destination address is ignored. 22760 */ 22761 irb = ire->ire_bucket; 22762 ASSERT(irb != NULL); 22763 22764 IRB_REFHOLD(irb); 22765 for (ire1 = ire->ire_next; 22766 ire1 != NULL; 22767 ire1 = ire1->ire_next) { 22768 if ((ire1->ire_flags & RTF_MULTIRT) == 0) 22769 continue; 22770 if (ire1->ire_addr != ire->ire_addr) 22771 continue; 22772 if (ire1->ire_marks & 22773 (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)) 22774 continue; 22775 22776 /* Got one */ 22777 IRE_REFHOLD(ire1); 22778 break; 22779 } 22780 IRB_REFRELE(irb); 22781 22782 if (ire1 != NULL) { 22783 next_mp = copyb(mp); 22784 if ((next_mp == NULL) || 22785 ((mp->b_cont != NULL) && 22786 ((next_mp->b_cont = 22787 dupmsg(mp->b_cont)) == NULL))) { 22788 freemsg(next_mp); 22789 next_mp = NULL; 22790 ire_refrele(ire1); 22791 ire1 = NULL; 22792 } 22793 } 22794 22795 /* Last multiroute ire; don't loop anymore. */ 22796 if (ire1 == NULL) { 22797 multirt_send = B_FALSE; 22798 } 22799 } 22800 22801 DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL, 22802 ill_t *, ire->ire_ipif->ipif_ill, ipha_t *, ipha, 22803 mblk_t *, mp); 22804 FW_HOOKS(ipst->ips_ip4_physical_out_event, 22805 ipst->ips_ipv4firewall_physical_out, 22806 NULL, ire->ire_ipif->ipif_ill, ipha, mp, mp, ipst); 22807 DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp); 22808 if (mp == NULL) 22809 goto release_ire_and_ill; 22810 22811 mp->b_prev = SET_BPREV_FLAG(IPP_LOCAL_OUT); 22812 DTRACE_PROBE2(ip__xmit__1, mblk_t *, mp, ire_t *, ire); 22813 pktxmit_state = ip_xmit_v4(mp, ire, NULL, B_TRUE); 22814 if ((pktxmit_state == SEND_FAILED) || 22815 (pktxmit_state == LLHDR_RESLV_FAILED)) { 22816 ip2dbg(("ip_wput_ire: ip_xmit_v4 failed" 22817 "- packet dropped\n")); 22818 release_ire_and_ill: 22819 ire_refrele(ire); 22820 if (next_mp != NULL) { 22821 freemsg(next_mp); 22822 ire_refrele(ire1); 22823 } 22824 if (conn_outgoing_ill != NULL) 22825 ill_refrele(conn_outgoing_ill); 22826 return; 22827 } 22828 22829 if (CLASSD(dst)) { 22830 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutMcastPkts); 22831 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutMcastOctets, 22832 ntohs(ipha->ipha_length)); 22833 } 22834 22835 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 22836 "ip_wput_ire_end: q %p (%S)", 22837 q, "last copy out"); 22838 IRE_REFRELE(ire); 22839 22840 if (multirt_send) { 22841 ASSERT(ire1); 22842 /* 22843 * Proceed with the next RTF_MULTIRT ire, 22844 * Also set up the send-to queue accordingly. 22845 */ 22846 ire = ire1; 22847 ire1 = NULL; 22848 stq = ire->ire_stq; 22849 mp = next_mp; 22850 next_mp = NULL; 22851 ipha = (ipha_t *)mp->b_rptr; 22852 ill_index = Q_TO_INDEX(stq); 22853 ill = (ill_t *)stq->q_ptr; 22854 } 22855 } while (multirt_send); 22856 if (conn_outgoing_ill != NULL) 22857 ill_refrele(conn_outgoing_ill); 22858 return; 22859 22860 /* 22861 * ire->ire_type == IRE_BROADCAST (minimize diffs) 22862 */ 22863 broadcast: 22864 { 22865 /* 22866 * Avoid broadcast storms by setting the ttl to 1 22867 * for broadcasts. This parameter can be set 22868 * via ndd, so make sure that for the SO_DONTROUTE 22869 * case that ipha_ttl is always set to 1. 22870 * In the event that we are replying to incoming 22871 * ICMP packets, conn could be NULL. 22872 */ 22873 if ((connp != NULL) && connp->conn_dontroute) 22874 ipha->ipha_ttl = 1; 22875 else 22876 ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl; 22877 22878 /* 22879 * Note that we are not doing a IRB_REFHOLD here. 22880 * Actually we don't care if the list changes i.e 22881 * if somebody deletes an IRE from the list while 22882 * we drop the lock, the next time we come around 22883 * ire_next will be NULL and hence we won't send 22884 * out multiple copies which is fine. 22885 */ 22886 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 22887 ire1 = ire->ire_next; 22888 if (conn_outgoing_ill != NULL) { 22889 while (ire->ire_ipif->ipif_ill != conn_outgoing_ill) { 22890 ASSERT(ire1 == ire->ire_next); 22891 if (ire1 != NULL && ire1->ire_addr == dst) { 22892 ire_refrele(ire); 22893 ire = ire1; 22894 IRE_REFHOLD(ire); 22895 ire1 = ire->ire_next; 22896 continue; 22897 } 22898 rw_exit(&ire->ire_bucket->irb_lock); 22899 /* Did not find a matching ill */ 22900 ip1dbg(("ip_wput_ire: broadcast with no " 22901 "matching IP_BOUND_IF ill %s\n", 22902 conn_outgoing_ill->ill_name)); 22903 freemsg(first_mp); 22904 if (ire != NULL) 22905 ire_refrele(ire); 22906 ill_refrele(conn_outgoing_ill); 22907 return; 22908 } 22909 } else if (ire1 != NULL && ire1->ire_addr == dst) { 22910 /* 22911 * If the next IRE has the same address and is not one 22912 * of the two copies that we need to send, try to see 22913 * whether this copy should be sent at all. This 22914 * assumes that we insert loopbacks first and then 22915 * non-loopbacks. This is acheived by inserting the 22916 * loopback always before non-loopback. 22917 * This is used to send a single copy of a broadcast 22918 * packet out all physical interfaces that have an 22919 * matching IRE_BROADCAST while also looping 22920 * back one copy (to ip_wput_local) for each 22921 * matching physical interface. However, we avoid 22922 * sending packets out different logical that match by 22923 * having ipif_up/ipif_down supress duplicate 22924 * IRE_BROADCASTS. 22925 * 22926 * This feature is currently used to get broadcasts 22927 * sent to multiple interfaces, when the broadcast 22928 * address being used applies to multiple interfaces. 22929 * For example, a whole net broadcast will be 22930 * replicated on every connected subnet of 22931 * the target net. 22932 * 22933 * Each zone has its own set of IRE_BROADCASTs, so that 22934 * we're able to distribute inbound packets to multiple 22935 * zones who share a broadcast address. We avoid looping 22936 * back outbound packets in different zones but on the 22937 * same ill, as the application would see duplicates. 22938 * 22939 * If the interfaces are part of the same group, 22940 * we would want to send only one copy out for 22941 * whole group. 22942 * 22943 * This logic assumes that ire_add_v4() groups the 22944 * IRE_BROADCAST entries so that those with the same 22945 * ire_addr and ill_group are kept together. 22946 */ 22947 ire_ill = ire->ire_ipif->ipif_ill; 22948 if (ire->ire_stq == NULL && ire1->ire_stq != NULL) { 22949 if (ire_ill->ill_group != NULL && 22950 (ire->ire_marks & IRE_MARK_NORECV)) { 22951 /* 22952 * If the current zone only has an ire 22953 * broadcast for this address marked 22954 * NORECV, the ire we want is ahead in 22955 * the bucket, so we look it up 22956 * deliberately ignoring the zoneid. 22957 */ 22958 for (ire1 = ire->ire_bucket->irb_ire; 22959 ire1 != NULL; 22960 ire1 = ire1->ire_next) { 22961 ire1_ill = 22962 ire1->ire_ipif->ipif_ill; 22963 if (ire1->ire_addr != dst) 22964 continue; 22965 /* skip over the current ire */ 22966 if (ire1 == ire) 22967 continue; 22968 /* skip over deleted ires */ 22969 if (ire1->ire_marks & 22970 IRE_MARK_CONDEMNED) 22971 continue; 22972 /* 22973 * non-loopback ire in our 22974 * group: use it for the next 22975 * pass in the loop 22976 */ 22977 if (ire1->ire_stq != NULL && 22978 ire1_ill->ill_group == 22979 ire_ill->ill_group) 22980 break; 22981 } 22982 } 22983 } else { 22984 while (ire1 != NULL && ire1->ire_addr == dst) { 22985 ire1_ill = ire1->ire_ipif->ipif_ill; 22986 /* 22987 * We can have two broadcast ires on the 22988 * same ill in different zones; here 22989 * we'll send a copy of the packet on 22990 * each ill and the fanout code will 22991 * call conn_wantpacket() to check that 22992 * the zone has the broadcast address 22993 * configured on the ill. If the two 22994 * ires are in the same group we only 22995 * send one copy up. 22996 */ 22997 if (ire1_ill != ire_ill && 22998 (ire1_ill->ill_group == NULL || 22999 ire_ill->ill_group == NULL || 23000 ire1_ill->ill_group != 23001 ire_ill->ill_group)) { 23002 break; 23003 } 23004 ire1 = ire1->ire_next; 23005 } 23006 } 23007 } 23008 ASSERT(multirt_send == B_FALSE); 23009 if (ire1 != NULL && ire1->ire_addr == dst) { 23010 if ((ire->ire_flags & RTF_MULTIRT) && 23011 (ire1->ire_flags & RTF_MULTIRT)) { 23012 /* 23013 * We are in the multirouting case. 23014 * The message must be sent at least 23015 * on both ires. These ires have been 23016 * inserted AFTER the standard ones 23017 * in ip_rt_add(). There are thus no 23018 * other ire entries for the destination 23019 * address in the rest of the bucket 23020 * that do not have the RTF_MULTIRT 23021 * flag. We don't process a copy 23022 * of the message here. This will be 23023 * done in the final sending loop. 23024 */ 23025 multirt_send = B_TRUE; 23026 } else { 23027 next_mp = ip_copymsg(first_mp); 23028 if (next_mp != NULL) 23029 IRE_REFHOLD(ire1); 23030 } 23031 } 23032 rw_exit(&ire->ire_bucket->irb_lock); 23033 } 23034 23035 if (stq) { 23036 /* 23037 * A non-NULL send-to queue means this packet is going 23038 * out of this machine. 23039 */ 23040 out_ill = (ill_t *)stq->q_ptr; 23041 23042 BUMP_MIB(out_ill->ill_ip_mib, ipIfStatsHCOutRequests); 23043 ttl_protocol = ((uint16_t *)ipha)[4]; 23044 /* 23045 * We accumulate the pseudo header checksum in cksum. 23046 * This is pretty hairy code, so watch close. One 23047 * thing to keep in mind is that UDP and TCP have 23048 * stored their respective datagram lengths in their 23049 * checksum fields. This lines things up real nice. 23050 */ 23051 cksum = (dst >> 16) + (dst & 0xFFFF) + 23052 (src >> 16) + (src & 0xFFFF); 23053 /* 23054 * We assume the udp checksum field contains the 23055 * length, so to compute the pseudo header checksum, 23056 * all we need is the protocol number and src/dst. 23057 */ 23058 /* Provide the checksums for UDP and TCP. */ 23059 if ((PROTO == IPPROTO_TCP) && 23060 (ip_hdr_included != IP_HDR_INCLUDED)) { 23061 /* hlen gets the number of uchar_ts in the IP header */ 23062 hlen = (V_HLEN & 0xF) << 2; 23063 up = IPH_TCPH_CHECKSUMP(ipha, hlen); 23064 IP_STAT(ipst, ip_out_sw_cksum); 23065 IP_STAT_UPDATE(ipst, ip_tcp_out_sw_cksum_bytes, 23066 LENGTH - hlen); 23067 *up = IP_CSUM(mp, hlen, cksum + IP_TCP_CSUM_COMP); 23068 if (*up == 0) 23069 *up = 0xFFFF; 23070 } else if (PROTO == IPPROTO_SCTP && 23071 (ip_hdr_included != IP_HDR_INCLUDED)) { 23072 sctp_hdr_t *sctph; 23073 23074 hlen = (V_HLEN & 0xF) << 2; 23075 ASSERT(MBLKL(mp) >= (hlen + sizeof (*sctph))); 23076 sctph = (sctp_hdr_t *)(mp->b_rptr + hlen); 23077 sctph->sh_chksum = 0; 23078 #ifdef DEBUG 23079 if (!skip_sctp_cksum) 23080 #endif 23081 sctph->sh_chksum = sctp_cksum(mp, hlen); 23082 } else { 23083 queue_t *dev_q = stq->q_next; 23084 23085 if ((dev_q->q_next || dev_q->q_first) && 23086 !canput(dev_q)) { 23087 blocked: 23088 ipha->ipha_ident = ip_hdr_included; 23089 /* 23090 * If we don't have a conn to apply 23091 * backpressure, free the message. 23092 * In the ire_send path, we don't know 23093 * the position to requeue the packet. Rather 23094 * than reorder packets, we just drop this 23095 * packet. 23096 */ 23097 if (ipst->ips_ip_output_queue && 23098 connp != NULL && 23099 caller != IRE_SEND) { 23100 if (caller == IP_WSRV) { 23101 connp->conn_did_putbq = 1; 23102 (void) putbq(connp->conn_wq, 23103 first_mp); 23104 conn_drain_insert(connp); 23105 /* 23106 * This is the service thread, 23107 * and the queue is already 23108 * noenabled. The check for 23109 * canput and the putbq is not 23110 * atomic. So we need to check 23111 * again. 23112 */ 23113 if (canput(stq->q_next)) 23114 connp->conn_did_putbq 23115 = 0; 23116 IP_STAT(ipst, ip_conn_flputbq); 23117 } else { 23118 /* 23119 * We are not the service proc. 23120 * ip_wsrv will be scheduled or 23121 * is already running. 23122 */ 23123 (void) putq(connp->conn_wq, 23124 first_mp); 23125 } 23126 } else { 23127 out_ill = (ill_t *)stq->q_ptr; 23128 BUMP_MIB(out_ill->ill_ip_mib, 23129 ipIfStatsOutDiscards); 23130 freemsg(first_mp); 23131 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23132 "ip_wput_ire_end: q %p (%S)", 23133 q, "discard"); 23134 } 23135 ire_refrele(ire); 23136 if (next_mp) { 23137 ire_refrele(ire1); 23138 freemsg(next_mp); 23139 } 23140 if (conn_outgoing_ill != NULL) 23141 ill_refrele(conn_outgoing_ill); 23142 return; 23143 } 23144 if ((PROTO == IPPROTO_UDP) && 23145 (ip_hdr_included != IP_HDR_INCLUDED)) { 23146 /* 23147 * hlen gets the number of uchar_ts in the 23148 * IP header 23149 */ 23150 hlen = (V_HLEN & 0xF) << 2; 23151 up = IPH_UDPH_CHECKSUMP(ipha, hlen); 23152 max_frag = ire->ire_max_frag; 23153 if (*up != 0) { 23154 IP_CKSUM_XMIT(ire_ill, ire, mp, ipha, 23155 up, PROTO, hlen, LENGTH, max_frag, 23156 ipsec_len, cksum); 23157 /* Software checksum? */ 23158 if (DB_CKSUMFLAGS(mp) == 0) { 23159 IP_STAT(ipst, ip_out_sw_cksum); 23160 IP_STAT_UPDATE(ipst, 23161 ip_udp_out_sw_cksum_bytes, 23162 LENGTH - hlen); 23163 } 23164 } 23165 } 23166 } 23167 /* 23168 * Need to do this even when fragmenting. The local 23169 * loopback can be done without computing checksums 23170 * but forwarding out other interface must be done 23171 * after the IP checksum (and ULP checksums) have been 23172 * computed. 23173 * 23174 * NOTE : multicast_forward is set only if this packet 23175 * originated from ip_wput. For packets originating from 23176 * ip_wput_multicast, it is not set. 23177 */ 23178 if (CLASSD(ipha->ipha_dst) && multicast_forward) { 23179 multi_loopback: 23180 ip2dbg(("ip_wput: multicast, loop %d\n", 23181 conn_multicast_loop)); 23182 23183 /* Forget header checksum offload */ 23184 DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM; 23185 23186 /* 23187 * Local loopback of multicasts? Check the 23188 * ill. 23189 * 23190 * Note that the loopback function will not come 23191 * in through ip_rput - it will only do the 23192 * client fanout thus we need to do an mforward 23193 * as well. The is different from the BSD 23194 * logic. 23195 */ 23196 if (ill != NULL) { 23197 ilm_t *ilm; 23198 23199 ILM_WALKER_HOLD(ill); 23200 ilm = ilm_lookup_ill(ill, ipha->ipha_dst, 23201 ALL_ZONES); 23202 ILM_WALKER_RELE(ill); 23203 if (ilm != NULL) { 23204 /* 23205 * Pass along the virtual output q. 23206 * ip_wput_local() will distribute the 23207 * packet to all the matching zones, 23208 * except the sending zone when 23209 * IP_MULTICAST_LOOP is false. 23210 */ 23211 ip_multicast_loopback(q, ill, first_mp, 23212 conn_multicast_loop ? 0 : 23213 IP_FF_NO_MCAST_LOOP, zoneid); 23214 } 23215 } 23216 if (ipha->ipha_ttl == 0) { 23217 /* 23218 * 0 => only to this host i.e. we are 23219 * done. We are also done if this was the 23220 * loopback interface since it is sufficient 23221 * to loopback one copy of a multicast packet. 23222 */ 23223 freemsg(first_mp); 23224 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23225 "ip_wput_ire_end: q %p (%S)", 23226 q, "loopback"); 23227 ire_refrele(ire); 23228 if (conn_outgoing_ill != NULL) 23229 ill_refrele(conn_outgoing_ill); 23230 return; 23231 } 23232 /* 23233 * ILLF_MULTICAST is checked in ip_newroute 23234 * i.e. we don't need to check it here since 23235 * all IRE_CACHEs come from ip_newroute. 23236 * For multicast traffic, SO_DONTROUTE is interpreted 23237 * to mean only send the packet out the interface 23238 * (optionally specified with IP_MULTICAST_IF) 23239 * and do not forward it out additional interfaces. 23240 * RSVP and the rsvp daemon is an example of a 23241 * protocol and user level process that 23242 * handles it's own routing. Hence, it uses the 23243 * SO_DONTROUTE option to accomplish this. 23244 */ 23245 23246 if (ipst->ips_ip_g_mrouter && !conn_dontroute && 23247 ill != NULL) { 23248 /* Unconditionally redo the checksum */ 23249 ipha->ipha_hdr_checksum = 0; 23250 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 23251 23252 /* 23253 * If this needs to go out secure, we need 23254 * to wait till we finish the IPSEC 23255 * processing. 23256 */ 23257 if (ipsec_len == 0 && 23258 ip_mforward(ill, ipha, mp)) { 23259 freemsg(first_mp); 23260 ip1dbg(("ip_wput: mforward failed\n")); 23261 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23262 "ip_wput_ire_end: q %p (%S)", 23263 q, "mforward failed"); 23264 ire_refrele(ire); 23265 if (conn_outgoing_ill != NULL) 23266 ill_refrele(conn_outgoing_ill); 23267 return; 23268 } 23269 } 23270 } 23271 max_frag = ire->ire_max_frag; 23272 cksum += ttl_protocol; 23273 if (max_frag >= (uint_t)(LENGTH + ipsec_len)) { 23274 /* No fragmentation required for this one. */ 23275 /* 23276 * Don't use frag_flag if packet is pre-built or source 23277 * routed or if multicast (since multicast packets do 23278 * not solicit ICMP "packet too big" messages). 23279 */ 23280 if ((ip_hdr_included != IP_HDR_INCLUDED) && 23281 (V_HLEN == IP_SIMPLE_HDR_VERSION || 23282 !ip_source_route_included(ipha)) && 23283 !CLASSD(ipha->ipha_dst)) 23284 ipha->ipha_fragment_offset_and_flags |= 23285 htons(ire->ire_frag_flag); 23286 23287 if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) { 23288 /* Complete the IP header checksum. */ 23289 cksum += ipha->ipha_ident; 23290 cksum += (v_hlen_tos_len >> 16)+ 23291 (v_hlen_tos_len & 0xFFFF); 23292 cksum += ipha->ipha_fragment_offset_and_flags; 23293 hlen = (V_HLEN & 0xF) - 23294 IP_SIMPLE_HDR_LENGTH_IN_WORDS; 23295 if (hlen) { 23296 checksumoptions: 23297 /* 23298 * Account for the IP Options in the IP 23299 * header checksum. 23300 */ 23301 up = (uint16_t *)(rptr+ 23302 IP_SIMPLE_HDR_LENGTH); 23303 do { 23304 cksum += up[0]; 23305 cksum += up[1]; 23306 up += 2; 23307 } while (--hlen); 23308 } 23309 cksum = ((cksum & 0xFFFF) + (cksum >> 16)); 23310 cksum = ~(cksum + (cksum >> 16)); 23311 ipha->ipha_hdr_checksum = (uint16_t)cksum; 23312 } 23313 if (ipsec_len != 0) { 23314 ipsec_out_process(q, first_mp, ire, ill_index); 23315 if (!next_mp) { 23316 ire_refrele(ire); 23317 if (conn_outgoing_ill != NULL) 23318 ill_refrele(conn_outgoing_ill); 23319 return; 23320 } 23321 goto next; 23322 } 23323 23324 /* 23325 * multirt_send has already been handled 23326 * for broadcast, but not yet for multicast 23327 * or IP options. 23328 */ 23329 if (next_mp == NULL) { 23330 if (ire->ire_flags & RTF_MULTIRT) { 23331 multirt_send = B_TRUE; 23332 } 23333 } 23334 23335 /* 23336 * In most cases, the emission loop below is 23337 * entered only once. Only in the case where 23338 * the ire holds the RTF_MULTIRT flag, do we loop 23339 * to process all RTF_MULTIRT ires in the bucket, 23340 * and send the packet through all crossed 23341 * RTF_MULTIRT routes. 23342 */ 23343 do { 23344 if (multirt_send) { 23345 irb_t *irb; 23346 23347 irb = ire->ire_bucket; 23348 ASSERT(irb != NULL); 23349 /* 23350 * We are in a multiple send case, 23351 * need to get the next IRE and make 23352 * a duplicate of the packet. 23353 */ 23354 IRB_REFHOLD(irb); 23355 for (ire1 = ire->ire_next; 23356 ire1 != NULL; 23357 ire1 = ire1->ire_next) { 23358 if (!(ire1->ire_flags & 23359 RTF_MULTIRT)) 23360 continue; 23361 if (ire1->ire_addr != 23362 ire->ire_addr) 23363 continue; 23364 if (ire1->ire_marks & 23365 (IRE_MARK_CONDEMNED| 23366 IRE_MARK_HIDDEN)) 23367 continue; 23368 23369 /* Got one */ 23370 IRE_REFHOLD(ire1); 23371 break; 23372 } 23373 IRB_REFRELE(irb); 23374 23375 if (ire1 != NULL) { 23376 next_mp = copyb(mp); 23377 if ((next_mp == NULL) || 23378 ((mp->b_cont != NULL) && 23379 ((next_mp->b_cont = 23380 dupmsg(mp->b_cont)) 23381 == NULL))) { 23382 freemsg(next_mp); 23383 next_mp = NULL; 23384 ire_refrele(ire1); 23385 ire1 = NULL; 23386 } 23387 } 23388 23389 /* 23390 * Last multiroute ire; don't loop 23391 * anymore. The emission is over 23392 * and next_mp is NULL. 23393 */ 23394 if (ire1 == NULL) { 23395 multirt_send = B_FALSE; 23396 } 23397 } 23398 23399 out_ill = ire->ire_ipif->ipif_ill; 23400 DTRACE_PROBE4(ip4__physical__out__start, 23401 ill_t *, NULL, 23402 ill_t *, out_ill, 23403 ipha_t *, ipha, mblk_t *, mp); 23404 FW_HOOKS(ipst->ips_ip4_physical_out_event, 23405 ipst->ips_ipv4firewall_physical_out, 23406 NULL, out_ill, ipha, mp, mp, ipst); 23407 DTRACE_PROBE1(ip4__physical__out__end, 23408 mblk_t *, mp); 23409 if (mp == NULL) 23410 goto release_ire_and_ill_2; 23411 23412 ASSERT(ipsec_len == 0); 23413 mp->b_prev = 23414 SET_BPREV_FLAG(IPP_LOCAL_OUT); 23415 DTRACE_PROBE2(ip__xmit__2, 23416 mblk_t *, mp, ire_t *, ire); 23417 pktxmit_state = ip_xmit_v4(mp, ire, 23418 NULL, B_TRUE); 23419 if ((pktxmit_state == SEND_FAILED) || 23420 (pktxmit_state == LLHDR_RESLV_FAILED)) { 23421 release_ire_and_ill_2: 23422 if (next_mp) { 23423 freemsg(next_mp); 23424 ire_refrele(ire1); 23425 } 23426 ire_refrele(ire); 23427 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23428 "ip_wput_ire_end: q %p (%S)", 23429 q, "discard MDATA"); 23430 if (conn_outgoing_ill != NULL) 23431 ill_refrele(conn_outgoing_ill); 23432 return; 23433 } 23434 23435 if (CLASSD(dst)) { 23436 BUMP_MIB(out_ill->ill_ip_mib, 23437 ipIfStatsHCOutMcastPkts); 23438 UPDATE_MIB(out_ill->ill_ip_mib, 23439 ipIfStatsHCOutMcastOctets, 23440 ntohs(ipha->ipha_length)); 23441 } else if (ire->ire_type == IRE_BROADCAST) { 23442 BUMP_MIB(out_ill->ill_ip_mib, 23443 ipIfStatsHCOutBcastPkts); 23444 } 23445 23446 if (multirt_send) { 23447 /* 23448 * We are in a multiple send case, 23449 * need to re-enter the sending loop 23450 * using the next ire. 23451 */ 23452 ire_refrele(ire); 23453 ire = ire1; 23454 stq = ire->ire_stq; 23455 mp = next_mp; 23456 next_mp = NULL; 23457 ipha = (ipha_t *)mp->b_rptr; 23458 ill_index = Q_TO_INDEX(stq); 23459 } 23460 } while (multirt_send); 23461 23462 if (!next_mp) { 23463 /* 23464 * Last copy going out (the ultra-common 23465 * case). Note that we intentionally replicate 23466 * the putnext rather than calling it before 23467 * the next_mp check in hopes of a little 23468 * tail-call action out of the compiler. 23469 */ 23470 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23471 "ip_wput_ire_end: q %p (%S)", 23472 q, "last copy out(1)"); 23473 ire_refrele(ire); 23474 if (conn_outgoing_ill != NULL) 23475 ill_refrele(conn_outgoing_ill); 23476 return; 23477 } 23478 /* More copies going out below. */ 23479 } else { 23480 int offset; 23481 fragmentit: 23482 offset = ntohs(ipha->ipha_fragment_offset_and_flags); 23483 /* 23484 * If this would generate a icmp_frag_needed message, 23485 * we need to handle it before we do the IPSEC 23486 * processing. Otherwise, we need to strip the IPSEC 23487 * headers before we send up the message to the ULPs 23488 * which becomes messy and difficult. 23489 */ 23490 if (ipsec_len != 0) { 23491 if ((max_frag < (unsigned int)(LENGTH + 23492 ipsec_len)) && (offset & IPH_DF)) { 23493 out_ill = (ill_t *)stq->q_ptr; 23494 BUMP_MIB(out_ill->ill_ip_mib, 23495 ipIfStatsOutFragFails); 23496 BUMP_MIB(out_ill->ill_ip_mib, 23497 ipIfStatsOutFragReqds); 23498 ipha->ipha_hdr_checksum = 0; 23499 ipha->ipha_hdr_checksum = 23500 (uint16_t)ip_csum_hdr(ipha); 23501 icmp_frag_needed(ire->ire_stq, first_mp, 23502 max_frag, zoneid, ipst); 23503 if (!next_mp) { 23504 ire_refrele(ire); 23505 if (conn_outgoing_ill != NULL) { 23506 ill_refrele( 23507 conn_outgoing_ill); 23508 } 23509 return; 23510 } 23511 } else { 23512 /* 23513 * This won't cause a icmp_frag_needed 23514 * message. to be generated. Send it on 23515 * the wire. Note that this could still 23516 * cause fragmentation and all we 23517 * do is the generation of the message 23518 * to the ULP if needed before IPSEC. 23519 */ 23520 if (!next_mp) { 23521 ipsec_out_process(q, first_mp, 23522 ire, ill_index); 23523 TRACE_2(TR_FAC_IP, 23524 TR_IP_WPUT_IRE_END, 23525 "ip_wput_ire_end: q %p " 23526 "(%S)", q, 23527 "last ipsec_out_process"); 23528 ire_refrele(ire); 23529 if (conn_outgoing_ill != NULL) { 23530 ill_refrele( 23531 conn_outgoing_ill); 23532 } 23533 return; 23534 } 23535 ipsec_out_process(q, first_mp, 23536 ire, ill_index); 23537 } 23538 } else { 23539 /* 23540 * Initiate IPPF processing. For 23541 * fragmentable packets we finish 23542 * all QOS packet processing before 23543 * calling: 23544 * ip_wput_ire_fragmentit->ip_wput_frag 23545 */ 23546 23547 if (IPP_ENABLED(IPP_LOCAL_OUT, ipst)) { 23548 ip_process(IPP_LOCAL_OUT, &mp, 23549 ill_index); 23550 if (mp == NULL) { 23551 out_ill = (ill_t *)stq->q_ptr; 23552 BUMP_MIB(out_ill->ill_ip_mib, 23553 ipIfStatsOutDiscards); 23554 if (next_mp != NULL) { 23555 freemsg(next_mp); 23556 ire_refrele(ire1); 23557 } 23558 ire_refrele(ire); 23559 TRACE_2(TR_FAC_IP, 23560 TR_IP_WPUT_IRE_END, 23561 "ip_wput_ire: q %p (%S)", 23562 q, "discard MDATA"); 23563 if (conn_outgoing_ill != NULL) { 23564 ill_refrele( 23565 conn_outgoing_ill); 23566 } 23567 return; 23568 } 23569 } 23570 if (!next_mp) { 23571 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23572 "ip_wput_ire_end: q %p (%S)", 23573 q, "last fragmentation"); 23574 ip_wput_ire_fragmentit(mp, ire, 23575 zoneid, ipst); 23576 ire_refrele(ire); 23577 if (conn_outgoing_ill != NULL) 23578 ill_refrele(conn_outgoing_ill); 23579 return; 23580 } 23581 ip_wput_ire_fragmentit(mp, ire, zoneid, ipst); 23582 } 23583 } 23584 } else { 23585 nullstq: 23586 /* A NULL stq means the destination address is local. */ 23587 UPDATE_OB_PKT_COUNT(ire); 23588 ire->ire_last_used_time = lbolt; 23589 ASSERT(ire->ire_ipif != NULL); 23590 if (!next_mp) { 23591 /* 23592 * Is there an "in" and "out" for traffic local 23593 * to a host (loopback)? The code in Solaris doesn't 23594 * explicitly draw a line in its code for in vs out, 23595 * so we've had to draw a line in the sand: ip_wput_ire 23596 * is considered to be the "output" side and 23597 * ip_wput_local to be the "input" side. 23598 */ 23599 out_ill = ire->ire_ipif->ipif_ill; 23600 23601 DTRACE_PROBE4(ip4__loopback__out__start, 23602 ill_t *, NULL, ill_t *, out_ill, 23603 ipha_t *, ipha, mblk_t *, first_mp); 23604 23605 FW_HOOKS(ipst->ips_ip4_loopback_out_event, 23606 ipst->ips_ipv4firewall_loopback_out, 23607 NULL, out_ill, ipha, first_mp, mp, ipst); 23608 23609 DTRACE_PROBE1(ip4__loopback__out_end, 23610 mblk_t *, first_mp); 23611 23612 TRACE_2(TR_FAC_IP, TR_IP_WPUT_IRE_END, 23613 "ip_wput_ire_end: q %p (%S)", 23614 q, "local address"); 23615 23616 if (first_mp != NULL) 23617 ip_wput_local(q, out_ill, ipha, 23618 first_mp, ire, 0, ire->ire_zoneid); 23619 ire_refrele(ire); 23620 if (conn_outgoing_ill != NULL) 23621 ill_refrele(conn_outgoing_ill); 23622 return; 23623 } 23624 23625 out_ill = ire->ire_ipif->ipif_ill; 23626 23627 DTRACE_PROBE4(ip4__loopback__out__start, 23628 ill_t *, NULL, ill_t *, out_ill, 23629 ipha_t *, ipha, mblk_t *, first_mp); 23630 23631 FW_HOOKS(ipst->ips_ip4_loopback_out_event, 23632 ipst->ips_ipv4firewall_loopback_out, 23633 NULL, out_ill, ipha, first_mp, mp, ipst); 23634 23635 DTRACE_PROBE1(ip4__loopback__out__end, mblk_t *, first_mp); 23636 23637 if (first_mp != NULL) 23638 ip_wput_local(q, out_ill, ipha, 23639 first_mp, ire, 0, ire->ire_zoneid); 23640 } 23641 next: 23642 /* 23643 * More copies going out to additional interfaces. 23644 * ire1 has already been held. We don't need the 23645 * "ire" anymore. 23646 */ 23647 ire_refrele(ire); 23648 ire = ire1; 23649 ASSERT(ire != NULL && ire->ire_refcnt >= 1 && next_mp != NULL); 23650 mp = next_mp; 23651 ASSERT(ire->ire_ipversion == IPV4_VERSION); 23652 ill = ire_to_ill(ire); 23653 first_mp = mp; 23654 if (ipsec_len != 0) { 23655 ASSERT(first_mp->b_datap->db_type == M_CTL); 23656 mp = mp->b_cont; 23657 } 23658 dst = ire->ire_addr; 23659 ipha = (ipha_t *)mp->b_rptr; 23660 /* 23661 * Restore src so that we will pick up ire->ire_src_addr if src was 0. 23662 * Restore ipha_ident "no checksum" flag. 23663 */ 23664 src = orig_src; 23665 ipha->ipha_ident = ip_hdr_included; 23666 goto another; 23667 23668 #undef rptr 23669 #undef Q_TO_INDEX 23670 } 23671 23672 /* 23673 * Routine to allocate a message that is used to notify the ULP about MDT. 23674 * The caller may provide a pointer to the link-layer MDT capabilities, 23675 * or NULL if MDT is to be disabled on the stream. 23676 */ 23677 mblk_t * 23678 ip_mdinfo_alloc(ill_mdt_capab_t *isrc) 23679 { 23680 mblk_t *mp; 23681 ip_mdt_info_t *mdti; 23682 ill_mdt_capab_t *idst; 23683 23684 if ((mp = allocb(sizeof (*mdti), BPRI_HI)) != NULL) { 23685 DB_TYPE(mp) = M_CTL; 23686 mp->b_wptr = mp->b_rptr + sizeof (*mdti); 23687 mdti = (ip_mdt_info_t *)mp->b_rptr; 23688 mdti->mdt_info_id = MDT_IOC_INFO_UPDATE; 23689 idst = &(mdti->mdt_capab); 23690 23691 /* 23692 * If the caller provides us with the capability, copy 23693 * it over into our notification message; otherwise 23694 * we zero out the capability portion. 23695 */ 23696 if (isrc != NULL) 23697 bcopy((caddr_t)isrc, (caddr_t)idst, sizeof (*idst)); 23698 else 23699 bzero((caddr_t)idst, sizeof (*idst)); 23700 } 23701 return (mp); 23702 } 23703 23704 /* 23705 * Routine which determines whether MDT can be enabled on the destination 23706 * IRE and IPC combination, and if so, allocates and returns the MDT 23707 * notification mblk that may be used by ULP. We also check if we need to 23708 * turn MDT back to 'on' when certain restrictions prohibiting us to allow 23709 * MDT usage in the past have been lifted. This gets called during IP 23710 * and ULP binding. 23711 */ 23712 mblk_t * 23713 ip_mdinfo_return(ire_t *dst_ire, conn_t *connp, char *ill_name, 23714 ill_mdt_capab_t *mdt_cap) 23715 { 23716 mblk_t *mp; 23717 boolean_t rc = B_FALSE; 23718 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 23719 23720 ASSERT(dst_ire != NULL); 23721 ASSERT(connp != NULL); 23722 ASSERT(mdt_cap != NULL); 23723 23724 /* 23725 * Currently, we only support simple TCP/{IPv4,IPv6} with 23726 * Multidata, which is handled in tcp_multisend(). This 23727 * is the reason why we do all these checks here, to ensure 23728 * that we don't enable Multidata for the cases which we 23729 * can't handle at the moment. 23730 */ 23731 do { 23732 /* Only do TCP at the moment */ 23733 if (connp->conn_ulp != IPPROTO_TCP) 23734 break; 23735 23736 /* 23737 * IPSEC outbound policy present? Note that we get here 23738 * after calling ipsec_conn_cache_policy() where the global 23739 * policy checking is performed. conn_latch will be 23740 * non-NULL as long as there's a policy defined, 23741 * i.e. conn_out_enforce_policy may be NULL in such case 23742 * when the connection is non-secure, and hence we check 23743 * further if the latch refers to an outbound policy. 23744 */ 23745 if (CONN_IPSEC_OUT_ENCAPSULATED(connp)) 23746 break; 23747 23748 /* CGTP (multiroute) is enabled? */ 23749 if (dst_ire->ire_flags & RTF_MULTIRT) 23750 break; 23751 23752 /* Outbound IPQoS enabled? */ 23753 if (IPP_ENABLED(IPP_LOCAL_OUT, ipst)) { 23754 /* 23755 * In this case, we disable MDT for this and all 23756 * future connections going over the interface. 23757 */ 23758 mdt_cap->ill_mdt_on = 0; 23759 break; 23760 } 23761 23762 /* socket option(s) present? */ 23763 if (!CONN_IS_LSO_MD_FASTPATH(connp)) 23764 break; 23765 23766 rc = B_TRUE; 23767 /* CONSTCOND */ 23768 } while (0); 23769 23770 /* Remember the result */ 23771 connp->conn_mdt_ok = rc; 23772 23773 if (!rc) 23774 return (NULL); 23775 else if (!mdt_cap->ill_mdt_on) { 23776 /* 23777 * If MDT has been previously turned off in the past, and we 23778 * currently can do MDT (due to IPQoS policy removal, etc.) 23779 * then enable it for this interface. 23780 */ 23781 mdt_cap->ill_mdt_on = 1; 23782 ip1dbg(("ip_mdinfo_return: reenabling MDT for " 23783 "interface %s\n", ill_name)); 23784 } 23785 23786 /* Allocate the MDT info mblk */ 23787 if ((mp = ip_mdinfo_alloc(mdt_cap)) == NULL) { 23788 ip0dbg(("ip_mdinfo_return: can't enable Multidata for " 23789 "conn %p on %s (ENOMEM)\n", (void *)connp, ill_name)); 23790 return (NULL); 23791 } 23792 return (mp); 23793 } 23794 23795 /* 23796 * Routine to allocate a message that is used to notify the ULP about LSO. 23797 * The caller may provide a pointer to the link-layer LSO capabilities, 23798 * or NULL if LSO is to be disabled on the stream. 23799 */ 23800 mblk_t * 23801 ip_lsoinfo_alloc(ill_lso_capab_t *isrc) 23802 { 23803 mblk_t *mp; 23804 ip_lso_info_t *lsoi; 23805 ill_lso_capab_t *idst; 23806 23807 if ((mp = allocb(sizeof (*lsoi), BPRI_HI)) != NULL) { 23808 DB_TYPE(mp) = M_CTL; 23809 mp->b_wptr = mp->b_rptr + sizeof (*lsoi); 23810 lsoi = (ip_lso_info_t *)mp->b_rptr; 23811 lsoi->lso_info_id = LSO_IOC_INFO_UPDATE; 23812 idst = &(lsoi->lso_capab); 23813 23814 /* 23815 * If the caller provides us with the capability, copy 23816 * it over into our notification message; otherwise 23817 * we zero out the capability portion. 23818 */ 23819 if (isrc != NULL) 23820 bcopy((caddr_t)isrc, (caddr_t)idst, sizeof (*idst)); 23821 else 23822 bzero((caddr_t)idst, sizeof (*idst)); 23823 } 23824 return (mp); 23825 } 23826 23827 /* 23828 * Routine which determines whether LSO can be enabled on the destination 23829 * IRE and IPC combination, and if so, allocates and returns the LSO 23830 * notification mblk that may be used by ULP. We also check if we need to 23831 * turn LSO back to 'on' when certain restrictions prohibiting us to allow 23832 * LSO usage in the past have been lifted. This gets called during IP 23833 * and ULP binding. 23834 */ 23835 mblk_t * 23836 ip_lsoinfo_return(ire_t *dst_ire, conn_t *connp, char *ill_name, 23837 ill_lso_capab_t *lso_cap) 23838 { 23839 mblk_t *mp; 23840 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 23841 23842 ASSERT(dst_ire != NULL); 23843 ASSERT(connp != NULL); 23844 ASSERT(lso_cap != NULL); 23845 23846 connp->conn_lso_ok = B_TRUE; 23847 23848 if ((connp->conn_ulp != IPPROTO_TCP) || 23849 CONN_IPSEC_OUT_ENCAPSULATED(connp) || 23850 (dst_ire->ire_flags & RTF_MULTIRT) || 23851 !CONN_IS_LSO_MD_FASTPATH(connp) || 23852 (IPP_ENABLED(IPP_LOCAL_OUT, ipst))) { 23853 connp->conn_lso_ok = B_FALSE; 23854 if (IPP_ENABLED(IPP_LOCAL_OUT, ipst)) { 23855 /* 23856 * Disable LSO for this and all future connections going 23857 * over the interface. 23858 */ 23859 lso_cap->ill_lso_on = 0; 23860 } 23861 } 23862 23863 if (!connp->conn_lso_ok) 23864 return (NULL); 23865 else if (!lso_cap->ill_lso_on) { 23866 /* 23867 * If LSO has been previously turned off in the past, and we 23868 * currently can do LSO (due to IPQoS policy removal, etc.) 23869 * then enable it for this interface. 23870 */ 23871 lso_cap->ill_lso_on = 1; 23872 ip1dbg(("ip_mdinfo_return: reenabling LSO for interface %s\n", 23873 ill_name)); 23874 } 23875 23876 /* Allocate the LSO info mblk */ 23877 if ((mp = ip_lsoinfo_alloc(lso_cap)) == NULL) 23878 ip0dbg(("ip_lsoinfo_return: can't enable LSO for " 23879 "conn %p on %s (ENOMEM)\n", (void *)connp, ill_name)); 23880 23881 return (mp); 23882 } 23883 23884 /* 23885 * Create destination address attribute, and fill it with the physical 23886 * destination address and SAP taken from the template DL_UNITDATA_REQ 23887 * message block. 23888 */ 23889 boolean_t 23890 ip_md_addr_attr(multidata_t *mmd, pdesc_t *pd, const mblk_t *dlmp) 23891 { 23892 dl_unitdata_req_t *dlurp; 23893 pattr_t *pa; 23894 pattrinfo_t pa_info; 23895 pattr_addr_t **das = (pattr_addr_t **)&pa_info.buf; 23896 uint_t das_len, das_off; 23897 23898 ASSERT(dlmp != NULL); 23899 23900 dlurp = (dl_unitdata_req_t *)dlmp->b_rptr; 23901 das_len = dlurp->dl_dest_addr_length; 23902 das_off = dlurp->dl_dest_addr_offset; 23903 23904 pa_info.type = PATTR_DSTADDRSAP; 23905 pa_info.len = sizeof (**das) + das_len - 1; 23906 23907 /* create and associate the attribute */ 23908 pa = mmd_addpattr(mmd, pd, &pa_info, B_TRUE, KM_NOSLEEP); 23909 if (pa != NULL) { 23910 ASSERT(*das != NULL); 23911 (*das)->addr_is_group = 0; 23912 (*das)->addr_len = (uint8_t)das_len; 23913 bcopy((caddr_t)dlurp + das_off, (*das)->addr, das_len); 23914 } 23915 23916 return (pa != NULL); 23917 } 23918 23919 /* 23920 * Create hardware checksum attribute and fill it with the values passed. 23921 */ 23922 boolean_t 23923 ip_md_hcksum_attr(multidata_t *mmd, pdesc_t *pd, uint32_t start_offset, 23924 uint32_t stuff_offset, uint32_t end_offset, uint32_t flags) 23925 { 23926 pattr_t *pa; 23927 pattrinfo_t pa_info; 23928 23929 ASSERT(mmd != NULL); 23930 23931 pa_info.type = PATTR_HCKSUM; 23932 pa_info.len = sizeof (pattr_hcksum_t); 23933 23934 /* create and associate the attribute */ 23935 pa = mmd_addpattr(mmd, pd, &pa_info, B_TRUE, KM_NOSLEEP); 23936 if (pa != NULL) { 23937 pattr_hcksum_t *hck = (pattr_hcksum_t *)pa_info.buf; 23938 23939 hck->hcksum_start_offset = start_offset; 23940 hck->hcksum_stuff_offset = stuff_offset; 23941 hck->hcksum_end_offset = end_offset; 23942 hck->hcksum_flags = flags; 23943 } 23944 return (pa != NULL); 23945 } 23946 23947 /* 23948 * Create zerocopy attribute and fill it with the specified flags 23949 */ 23950 boolean_t 23951 ip_md_zcopy_attr(multidata_t *mmd, pdesc_t *pd, uint_t flags) 23952 { 23953 pattr_t *pa; 23954 pattrinfo_t pa_info; 23955 23956 ASSERT(mmd != NULL); 23957 pa_info.type = PATTR_ZCOPY; 23958 pa_info.len = sizeof (pattr_zcopy_t); 23959 23960 /* create and associate the attribute */ 23961 pa = mmd_addpattr(mmd, pd, &pa_info, B_TRUE, KM_NOSLEEP); 23962 if (pa != NULL) { 23963 pattr_zcopy_t *zcopy = (pattr_zcopy_t *)pa_info.buf; 23964 23965 zcopy->zcopy_flags = flags; 23966 } 23967 return (pa != NULL); 23968 } 23969 23970 /* 23971 * Check if ip_wput_frag_mdt() and ip_wput_frag_mdt_v6() can handle a message 23972 * block chain. We could rewrite to handle arbitrary message block chains but 23973 * that would make the code complicated and slow. Right now there three 23974 * restrictions: 23975 * 23976 * 1. The first message block must contain the complete IP header and 23977 * at least 1 byte of payload data. 23978 * 2. At most MULTIDATA_MAX_PBUFS non-empty message blocks are allowed 23979 * so that we can use a single Multidata message. 23980 * 3. No frag must be distributed over two or more message blocks so 23981 * that we don't need more than two packet descriptors per frag. 23982 * 23983 * The above restrictions allow us to support userland applications (which 23984 * will send down a single message block) and NFS over UDP (which will 23985 * send down a chain of at most three message blocks). 23986 * 23987 * We also don't use MDT for payloads with less than or equal to 23988 * ip_wput_frag_mdt_min bytes because it would cause too much overhead. 23989 */ 23990 boolean_t 23991 ip_can_frag_mdt(mblk_t *mp, ssize_t hdr_len, ssize_t len) 23992 { 23993 int blocks; 23994 ssize_t total, missing, size; 23995 23996 ASSERT(mp != NULL); 23997 ASSERT(hdr_len > 0); 23998 23999 size = MBLKL(mp) - hdr_len; 24000 if (size <= 0) 24001 return (B_FALSE); 24002 24003 /* The first mblk contains the header and some payload. */ 24004 blocks = 1; 24005 total = size; 24006 size %= len; 24007 missing = (size == 0) ? 0 : (len - size); 24008 mp = mp->b_cont; 24009 24010 while (mp != NULL) { 24011 /* 24012 * Give up if we encounter a zero length message block. 24013 * In practice, this should rarely happen and therefore 24014 * not worth the trouble of freeing and re-linking the 24015 * mblk from the chain to handle such case. 24016 */ 24017 if ((size = MBLKL(mp)) == 0) 24018 return (B_FALSE); 24019 24020 /* Too many payload buffers for a single Multidata message? */ 24021 if (++blocks > MULTIDATA_MAX_PBUFS) 24022 return (B_FALSE); 24023 24024 total += size; 24025 /* Is a frag distributed over two or more message blocks? */ 24026 if (missing > size) 24027 return (B_FALSE); 24028 size -= missing; 24029 24030 size %= len; 24031 missing = (size == 0) ? 0 : (len - size); 24032 24033 mp = mp->b_cont; 24034 } 24035 24036 return (total > ip_wput_frag_mdt_min); 24037 } 24038 24039 /* 24040 * Outbound IPv4 fragmentation routine using MDT. 24041 */ 24042 static void 24043 ip_wput_frag_mdt(ire_t *ire, mblk_t *mp, ip_pkt_t pkt_type, int len, 24044 uint32_t frag_flag, int offset) 24045 { 24046 ipha_t *ipha_orig; 24047 int i1, ip_data_end; 24048 uint_t pkts, wroff, hdr_chunk_len, pbuf_idx; 24049 mblk_t *hdr_mp, *md_mp = NULL; 24050 unsigned char *hdr_ptr, *pld_ptr; 24051 multidata_t *mmd; 24052 ip_pdescinfo_t pdi; 24053 ill_t *ill; 24054 ip_stack_t *ipst = ire->ire_ipst; 24055 24056 ASSERT(DB_TYPE(mp) == M_DATA); 24057 ASSERT(MBLKL(mp) > sizeof (ipha_t)); 24058 24059 ill = ire_to_ill(ire); 24060 ASSERT(ill != NULL); 24061 24062 ipha_orig = (ipha_t *)mp->b_rptr; 24063 mp->b_rptr += sizeof (ipha_t); 24064 24065 /* Calculate how many packets we will send out */ 24066 i1 = (mp->b_cont == NULL) ? MBLKL(mp) : msgsize(mp); 24067 pkts = (i1 + len - 1) / len; 24068 ASSERT(pkts > 1); 24069 24070 /* Allocate a message block which will hold all the IP Headers. */ 24071 wroff = ipst->ips_ip_wroff_extra; 24072 hdr_chunk_len = wroff + IP_SIMPLE_HDR_LENGTH; 24073 24074 i1 = pkts * hdr_chunk_len; 24075 /* 24076 * Create the header buffer, Multidata and destination address 24077 * and SAP attribute that should be associated with it. 24078 */ 24079 if ((hdr_mp = allocb(i1, BPRI_HI)) == NULL || 24080 ((hdr_mp->b_wptr += i1), 24081 (mmd = mmd_alloc(hdr_mp, &md_mp, KM_NOSLEEP)) == NULL) || 24082 !ip_md_addr_attr(mmd, NULL, ire->ire_nce->nce_res_mp)) { 24083 freemsg(mp); 24084 if (md_mp == NULL) { 24085 freemsg(hdr_mp); 24086 } else { 24087 free_mmd: IP_STAT(ipst, ip_frag_mdt_discarded); 24088 freemsg(md_mp); 24089 } 24090 IP_STAT(ipst, ip_frag_mdt_allocfail); 24091 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragFails); 24092 return; 24093 } 24094 IP_STAT(ipst, ip_frag_mdt_allocd); 24095 24096 /* 24097 * Add a payload buffer to the Multidata; this operation must not 24098 * fail, or otherwise our logic in this routine is broken. There 24099 * is no memory allocation done by the routine, so any returned 24100 * failure simply tells us that we've done something wrong. 24101 * 24102 * A failure tells us that either we're adding the same payload 24103 * buffer more than once, or we're trying to add more buffers than 24104 * allowed. None of the above cases should happen, and we panic 24105 * because either there's horrible heap corruption, and/or 24106 * programming mistake. 24107 */ 24108 if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0) 24109 goto pbuf_panic; 24110 24111 hdr_ptr = hdr_mp->b_rptr; 24112 pld_ptr = mp->b_rptr; 24113 24114 /* Establish the ending byte offset, based on the starting offset. */ 24115 offset <<= 3; 24116 ip_data_end = offset + ntohs(ipha_orig->ipha_length) - 24117 IP_SIMPLE_HDR_LENGTH; 24118 24119 pdi.flags = PDESC_HBUF_REF | PDESC_PBUF_REF; 24120 24121 while (pld_ptr < mp->b_wptr) { 24122 ipha_t *ipha; 24123 uint16_t offset_and_flags; 24124 uint16_t ip_len; 24125 int error; 24126 24127 ASSERT((hdr_ptr + hdr_chunk_len) <= hdr_mp->b_wptr); 24128 ipha = (ipha_t *)(hdr_ptr + wroff); 24129 ASSERT(OK_32PTR(ipha)); 24130 *ipha = *ipha_orig; 24131 24132 if (ip_data_end - offset > len) { 24133 offset_and_flags = IPH_MF; 24134 } else { 24135 /* 24136 * Last frag. Set len to the length of this last piece. 24137 */ 24138 len = ip_data_end - offset; 24139 /* A frag of a frag might have IPH_MF non-zero */ 24140 offset_and_flags = 24141 ntohs(ipha->ipha_fragment_offset_and_flags) & 24142 IPH_MF; 24143 } 24144 offset_and_flags |= (uint16_t)(offset >> 3); 24145 offset_and_flags |= (uint16_t)frag_flag; 24146 /* Store the offset and flags in the IP header. */ 24147 ipha->ipha_fragment_offset_and_flags = htons(offset_and_flags); 24148 24149 /* Store the length in the IP header. */ 24150 ip_len = (uint16_t)(len + IP_SIMPLE_HDR_LENGTH); 24151 ipha->ipha_length = htons(ip_len); 24152 24153 /* 24154 * Set the IP header checksum. Note that mp is just 24155 * the header, so this is easy to pass to ip_csum. 24156 */ 24157 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 24158 24159 /* 24160 * Record offset and size of header and data of the next packet 24161 * in the multidata message. 24162 */ 24163 PDESC_HDR_ADD(&pdi, hdr_ptr, wroff, IP_SIMPLE_HDR_LENGTH, 0); 24164 PDESC_PLD_INIT(&pdi); 24165 i1 = MIN(mp->b_wptr - pld_ptr, len); 24166 ASSERT(i1 > 0); 24167 PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, pld_ptr, i1); 24168 if (i1 == len) { 24169 pld_ptr += len; 24170 } else { 24171 i1 = len - i1; 24172 mp = mp->b_cont; 24173 ASSERT(mp != NULL); 24174 ASSERT(MBLKL(mp) >= i1); 24175 /* 24176 * Attach the next payload message block to the 24177 * multidata message. 24178 */ 24179 if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0) 24180 goto pbuf_panic; 24181 PDESC_PLD_SPAN_ADD(&pdi, pbuf_idx, mp->b_rptr, i1); 24182 pld_ptr = mp->b_rptr + i1; 24183 } 24184 24185 if ((mmd_addpdesc(mmd, (pdescinfo_t *)&pdi, &error, 24186 KM_NOSLEEP)) == NULL) { 24187 /* 24188 * Any failure other than ENOMEM indicates that we 24189 * have passed in invalid pdesc info or parameters 24190 * to mmd_addpdesc, which must not happen. 24191 * 24192 * EINVAL is a result of failure on boundary checks 24193 * against the pdesc info contents. It should not 24194 * happen, and we panic because either there's 24195 * horrible heap corruption, and/or programming 24196 * mistake. 24197 */ 24198 if (error != ENOMEM) { 24199 cmn_err(CE_PANIC, "ip_wput_frag_mdt: " 24200 "pdesc logic error detected for " 24201 "mmd %p pinfo %p (%d)\n", 24202 (void *)mmd, (void *)&pdi, error); 24203 /* NOTREACHED */ 24204 } 24205 IP_STAT(ipst, ip_frag_mdt_addpdescfail); 24206 /* Free unattached payload message blocks as well */ 24207 md_mp->b_cont = mp->b_cont; 24208 goto free_mmd; 24209 } 24210 24211 /* Advance fragment offset. */ 24212 offset += len; 24213 24214 /* Advance to location for next header in the buffer. */ 24215 hdr_ptr += hdr_chunk_len; 24216 24217 /* Did we reach the next payload message block? */ 24218 if (pld_ptr == mp->b_wptr && mp->b_cont != NULL) { 24219 mp = mp->b_cont; 24220 /* 24221 * Attach the next message block with payload 24222 * data to the multidata message. 24223 */ 24224 if ((pbuf_idx = mmd_addpldbuf(mmd, mp)) < 0) 24225 goto pbuf_panic; 24226 pld_ptr = mp->b_rptr; 24227 } 24228 } 24229 24230 ASSERT(hdr_mp->b_wptr == hdr_ptr); 24231 ASSERT(mp->b_wptr == pld_ptr); 24232 24233 /* Update IP statistics */ 24234 IP_STAT_UPDATE(ipst, ip_frag_mdt_pkt_out, pkts); 24235 24236 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsOutFragCreates, pkts); 24237 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutFragOKs); 24238 24239 len = ntohs(ipha_orig->ipha_length) + (pkts - 1) * IP_SIMPLE_HDR_LENGTH; 24240 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutTransmits, pkts); 24241 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCOutOctets, len); 24242 24243 if (pkt_type == OB_PKT) { 24244 ire->ire_ob_pkt_count += pkts; 24245 if (ire->ire_ipif != NULL) 24246 atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, pkts); 24247 } else { 24248 /* 24249 * The type is IB_PKT in the forwarding path and in 24250 * the mobile IP case when the packet is being reverse- 24251 * tunneled to the home agent. 24252 */ 24253 ire->ire_ib_pkt_count += pkts; 24254 ASSERT(!IRE_IS_LOCAL(ire)); 24255 if (ire->ire_type & IRE_BROADCAST) { 24256 atomic_add_32(&ire->ire_ipif->ipif_ib_pkt_count, pkts); 24257 } else { 24258 UPDATE_MIB(ill->ill_ip_mib, 24259 ipIfStatsHCOutForwDatagrams, pkts); 24260 atomic_add_32(&ire->ire_ipif->ipif_fo_pkt_count, pkts); 24261 } 24262 } 24263 ire->ire_last_used_time = lbolt; 24264 /* Send it down */ 24265 putnext(ire->ire_stq, md_mp); 24266 return; 24267 24268 pbuf_panic: 24269 cmn_err(CE_PANIC, "ip_wput_frag_mdt: payload buffer logic " 24270 "error for mmd %p pbuf %p (%d)", (void *)mmd, (void *)mp, 24271 pbuf_idx); 24272 /* NOTREACHED */ 24273 } 24274 24275 /* 24276 * Outbound IP fragmentation routine. 24277 * 24278 * NOTE : This routine does not ire_refrele the ire that is passed in 24279 * as the argument. 24280 */ 24281 static void 24282 ip_wput_frag(ire_t *ire, mblk_t *mp_orig, ip_pkt_t pkt_type, uint32_t max_frag, 24283 uint32_t frag_flag, zoneid_t zoneid, ip_stack_t *ipst) 24284 { 24285 int i1; 24286 mblk_t *ll_hdr_mp; 24287 int ll_hdr_len; 24288 int hdr_len; 24289 mblk_t *hdr_mp; 24290 ipha_t *ipha; 24291 int ip_data_end; 24292 int len; 24293 mblk_t *mp = mp_orig, *mp1; 24294 int offset; 24295 queue_t *q; 24296 uint32_t v_hlen_tos_len; 24297 mblk_t *first_mp; 24298 boolean_t mctl_present; 24299 ill_t *ill; 24300 ill_t *out_ill; 24301 mblk_t *xmit_mp; 24302 mblk_t *carve_mp; 24303 ire_t *ire1 = NULL; 24304 ire_t *save_ire = NULL; 24305 mblk_t *next_mp = NULL; 24306 boolean_t last_frag = B_FALSE; 24307 boolean_t multirt_send = B_FALSE; 24308 ire_t *first_ire = NULL; 24309 irb_t *irb = NULL; 24310 mib2_ipIfStatsEntry_t *mibptr = NULL; 24311 24312 ill = ire_to_ill(ire); 24313 mibptr = (ill != NULL) ? ill->ill_ip_mib : &ipst->ips_ip_mib; 24314 24315 BUMP_MIB(mibptr, ipIfStatsOutFragReqds); 24316 24317 /* 24318 * IPSEC does not allow hw accelerated packets to be fragmented 24319 * This check is made in ip_wput_ipsec_out prior to coming here 24320 * via ip_wput_ire_fragmentit. 24321 * 24322 * If at this point we have an ire whose ARP request has not 24323 * been sent out, we call ip_xmit_v4->ire_arpresolve to trigger 24324 * sending of ARP query and change ire's state to ND_INCOMPLETE. 24325 * This packet and all fragmentable packets for this ire will 24326 * continue to get dropped while ire_nce->nce_state remains in 24327 * ND_INCOMPLETE. Post-ARP resolution, after ire's nce_state changes to 24328 * ND_REACHABLE, all subsquent large packets for this ire will 24329 * get fragemented and sent out by this function. 24330 */ 24331 if (ire->ire_nce && ire->ire_nce->nce_state != ND_REACHABLE) { 24332 /* If nce_state is ND_INITIAL, trigger ARP query */ 24333 (void) ip_xmit_v4(NULL, ire, NULL, B_FALSE); 24334 ip1dbg(("ip_wput_frag: mac address for ire is unresolved" 24335 " - dropping packet\n")); 24336 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 24337 freemsg(mp); 24338 return; 24339 } 24340 24341 TRACE_0(TR_FAC_IP, TR_IP_WPUT_FRAG_START, 24342 "ip_wput_frag_start:"); 24343 24344 if (mp->b_datap->db_type == M_CTL) { 24345 first_mp = mp; 24346 mp_orig = mp = mp->b_cont; 24347 mctl_present = B_TRUE; 24348 } else { 24349 first_mp = mp; 24350 mctl_present = B_FALSE; 24351 } 24352 24353 ASSERT(MBLKL(mp) >= sizeof (ipha_t)); 24354 ipha = (ipha_t *)mp->b_rptr; 24355 24356 /* 24357 * If the Don't Fragment flag is on, generate an ICMP destination 24358 * unreachable, fragmentation needed. 24359 */ 24360 offset = ntohs(ipha->ipha_fragment_offset_and_flags); 24361 if (offset & IPH_DF) { 24362 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 24363 /* 24364 * Need to compute hdr checksum if called from ip_wput_ire. 24365 * Note that ip_rput_forward verifies the checksum before 24366 * calling this routine so in that case this is a noop. 24367 */ 24368 ipha->ipha_hdr_checksum = 0; 24369 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 24370 icmp_frag_needed(ire->ire_stq, first_mp, max_frag, zoneid, 24371 ipst); 24372 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 24373 "ip_wput_frag_end:(%S)", 24374 "don't fragment"); 24375 return; 24376 } 24377 if (mctl_present) 24378 freeb(first_mp); 24379 /* 24380 * Establish the starting offset. May not be zero if we are fragging 24381 * a fragment that is being forwarded. 24382 */ 24383 offset = offset & IPH_OFFSET; 24384 24385 /* TODO why is this test needed? */ 24386 v_hlen_tos_len = ((uint32_t *)ipha)[0]; 24387 if (((max_frag - LENGTH) & ~7) < 8) { 24388 /* TODO: notify ulp somehow */ 24389 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 24390 freemsg(mp); 24391 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 24392 "ip_wput_frag_end:(%S)", 24393 "len < 8"); 24394 return; 24395 } 24396 24397 hdr_len = (V_HLEN & 0xF) << 2; 24398 24399 ipha->ipha_hdr_checksum = 0; 24400 24401 /* 24402 * Establish the number of bytes maximum per frag, after putting 24403 * in the header. 24404 */ 24405 len = (max_frag - hdr_len) & ~7; 24406 24407 /* Check if we can use MDT to send out the frags. */ 24408 ASSERT(!IRE_IS_LOCAL(ire)); 24409 if (hdr_len == IP_SIMPLE_HDR_LENGTH && 24410 ipst->ips_ip_multidata_outbound && 24411 !(ire->ire_flags & RTF_MULTIRT) && 24412 !IPP_ENABLED(IPP_LOCAL_OUT, ipst) && 24413 ill != NULL && ILL_MDT_CAPABLE(ill) && 24414 IP_CAN_FRAG_MDT(mp, IP_SIMPLE_HDR_LENGTH, len)) { 24415 ASSERT(ill->ill_mdt_capab != NULL); 24416 if (!ill->ill_mdt_capab->ill_mdt_on) { 24417 /* 24418 * If MDT has been previously turned off in the past, 24419 * and we currently can do MDT (due to IPQoS policy 24420 * removal, etc.) then enable it for this interface. 24421 */ 24422 ill->ill_mdt_capab->ill_mdt_on = 1; 24423 ip1dbg(("ip_wput_frag: enabled MDT for interface %s\n", 24424 ill->ill_name)); 24425 } 24426 ip_wput_frag_mdt(ire, mp, pkt_type, len, frag_flag, 24427 offset); 24428 return; 24429 } 24430 24431 /* Get a copy of the header for the trailing frags */ 24432 hdr_mp = ip_wput_frag_copyhdr((uchar_t *)ipha, hdr_len, offset, ipst); 24433 if (!hdr_mp) { 24434 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 24435 freemsg(mp); 24436 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 24437 "ip_wput_frag_end:(%S)", 24438 "couldn't copy hdr"); 24439 return; 24440 } 24441 if (DB_CRED(mp) != NULL) 24442 mblk_setcred(hdr_mp, DB_CRED(mp)); 24443 24444 /* Store the starting offset, with the MoreFrags flag. */ 24445 i1 = offset | IPH_MF | frag_flag; 24446 ipha->ipha_fragment_offset_and_flags = htons((uint16_t)i1); 24447 24448 /* Establish the ending byte offset, based on the starting offset. */ 24449 offset <<= 3; 24450 ip_data_end = offset + ntohs(ipha->ipha_length) - hdr_len; 24451 24452 /* Store the length of the first fragment in the IP header. */ 24453 i1 = len + hdr_len; 24454 ASSERT(i1 <= IP_MAXPACKET); 24455 ipha->ipha_length = htons((uint16_t)i1); 24456 24457 /* 24458 * Compute the IP header checksum for the first frag. We have to 24459 * watch out that we stop at the end of the header. 24460 */ 24461 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 24462 24463 /* 24464 * Now carve off the first frag. Note that this will include the 24465 * original IP header. 24466 */ 24467 if (!(mp = ip_carve_mp(&mp_orig, i1))) { 24468 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 24469 freeb(hdr_mp); 24470 freemsg(mp_orig); 24471 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 24472 "ip_wput_frag_end:(%S)", 24473 "couldn't carve first"); 24474 return; 24475 } 24476 24477 /* 24478 * Multirouting case. Each fragment is replicated 24479 * via all non-condemned RTF_MULTIRT routes 24480 * currently resolved. 24481 * We ensure that first_ire is the first RTF_MULTIRT 24482 * ire in the bucket. 24483 */ 24484 if (ire->ire_flags & RTF_MULTIRT) { 24485 irb = ire->ire_bucket; 24486 ASSERT(irb != NULL); 24487 24488 multirt_send = B_TRUE; 24489 24490 /* Make sure we do not omit any multiroute ire. */ 24491 IRB_REFHOLD(irb); 24492 for (first_ire = irb->irb_ire; 24493 first_ire != NULL; 24494 first_ire = first_ire->ire_next) { 24495 if ((first_ire->ire_flags & RTF_MULTIRT) && 24496 (first_ire->ire_addr == ire->ire_addr) && 24497 !(first_ire->ire_marks & 24498 (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))) 24499 break; 24500 } 24501 24502 if (first_ire != NULL) { 24503 if (first_ire != ire) { 24504 IRE_REFHOLD(first_ire); 24505 /* 24506 * Do not release the ire passed in 24507 * as the argument. 24508 */ 24509 ire = first_ire; 24510 } else { 24511 first_ire = NULL; 24512 } 24513 } 24514 IRB_REFRELE(irb); 24515 24516 /* 24517 * Save the first ire; we will need to restore it 24518 * for the trailing frags. 24519 * We REFHOLD save_ire, as each iterated ire will be 24520 * REFRELEd. 24521 */ 24522 save_ire = ire; 24523 IRE_REFHOLD(save_ire); 24524 } 24525 24526 /* 24527 * First fragment emission loop. 24528 * In most cases, the emission loop below is entered only 24529 * once. Only in the case where the ire holds the RTF_MULTIRT 24530 * flag, do we loop to process all RTF_MULTIRT ires in the 24531 * bucket, and send the fragment through all crossed 24532 * RTF_MULTIRT routes. 24533 */ 24534 do { 24535 if (ire->ire_flags & RTF_MULTIRT) { 24536 /* 24537 * We are in a multiple send case, need to get 24538 * the next ire and make a copy of the packet. 24539 * ire1 holds here the next ire to process in the 24540 * bucket. If multirouting is expected, 24541 * any non-RTF_MULTIRT ire that has the 24542 * right destination address is ignored. 24543 * 24544 * We have to take into account the MTU of 24545 * each walked ire. max_frag is set by the 24546 * the caller and generally refers to 24547 * the primary ire entry. Here we ensure that 24548 * no route with a lower MTU will be used, as 24549 * fragments are carved once for all ires, 24550 * then replicated. 24551 */ 24552 ASSERT(irb != NULL); 24553 IRB_REFHOLD(irb); 24554 for (ire1 = ire->ire_next; 24555 ire1 != NULL; 24556 ire1 = ire1->ire_next) { 24557 if ((ire1->ire_flags & RTF_MULTIRT) == 0) 24558 continue; 24559 if (ire1->ire_addr != ire->ire_addr) 24560 continue; 24561 if (ire1->ire_marks & 24562 (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)) 24563 continue; 24564 /* 24565 * Ensure we do not exceed the MTU 24566 * of the next route. 24567 */ 24568 if (ire1->ire_max_frag < max_frag) { 24569 ip_multirt_bad_mtu(ire1, max_frag); 24570 continue; 24571 } 24572 24573 /* Got one. */ 24574 IRE_REFHOLD(ire1); 24575 break; 24576 } 24577 IRB_REFRELE(irb); 24578 24579 if (ire1 != NULL) { 24580 next_mp = copyb(mp); 24581 if ((next_mp == NULL) || 24582 ((mp->b_cont != NULL) && 24583 ((next_mp->b_cont = 24584 dupmsg(mp->b_cont)) == NULL))) { 24585 freemsg(next_mp); 24586 next_mp = NULL; 24587 ire_refrele(ire1); 24588 ire1 = NULL; 24589 } 24590 } 24591 24592 /* Last multiroute ire; don't loop anymore. */ 24593 if (ire1 == NULL) { 24594 multirt_send = B_FALSE; 24595 } 24596 } 24597 24598 ll_hdr_len = 0; 24599 LOCK_IRE_FP_MP(ire); 24600 ll_hdr_mp = ire->ire_nce->nce_fp_mp; 24601 if (ll_hdr_mp != NULL) { 24602 ASSERT(ll_hdr_mp->b_datap->db_type == M_DATA); 24603 ll_hdr_len = ll_hdr_mp->b_wptr - ll_hdr_mp->b_rptr; 24604 } else { 24605 ll_hdr_mp = ire->ire_nce->nce_res_mp; 24606 } 24607 24608 /* If there is a transmit header, get a copy for this frag. */ 24609 /* 24610 * TODO: should check db_ref before calling ip_carve_mp since 24611 * it might give us a dup. 24612 */ 24613 if (!ll_hdr_mp) { 24614 /* No xmit header. */ 24615 xmit_mp = mp; 24616 24617 /* We have a link-layer header that can fit in our mblk. */ 24618 } else if (mp->b_datap->db_ref == 1 && 24619 ll_hdr_len != 0 && 24620 ll_hdr_len <= mp->b_rptr - mp->b_datap->db_base) { 24621 /* M_DATA fastpath */ 24622 mp->b_rptr -= ll_hdr_len; 24623 bcopy(ll_hdr_mp->b_rptr, mp->b_rptr, ll_hdr_len); 24624 xmit_mp = mp; 24625 24626 /* Corner case if copyb has failed */ 24627 } else if (!(xmit_mp = copyb(ll_hdr_mp))) { 24628 UNLOCK_IRE_FP_MP(ire); 24629 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 24630 freeb(hdr_mp); 24631 freemsg(mp); 24632 freemsg(mp_orig); 24633 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 24634 "ip_wput_frag_end:(%S)", 24635 "discard"); 24636 24637 if (multirt_send) { 24638 ASSERT(ire1); 24639 ASSERT(next_mp); 24640 24641 freemsg(next_mp); 24642 ire_refrele(ire1); 24643 } 24644 if (save_ire != NULL) 24645 IRE_REFRELE(save_ire); 24646 24647 if (first_ire != NULL) 24648 ire_refrele(first_ire); 24649 return; 24650 24651 /* 24652 * Case of res_mp OR the fastpath mp can't fit 24653 * in the mblk 24654 */ 24655 } else { 24656 xmit_mp->b_cont = mp; 24657 if (DB_CRED(mp) != NULL) 24658 mblk_setcred(xmit_mp, DB_CRED(mp)); 24659 /* 24660 * Get priority marking, if any. 24661 * We propagate the CoS marking from the 24662 * original packet that went to QoS processing 24663 * in ip_wput_ire to the newly carved mp. 24664 */ 24665 if (DB_TYPE(xmit_mp) == M_DATA) 24666 xmit_mp->b_band = mp->b_band; 24667 } 24668 UNLOCK_IRE_FP_MP(ire); 24669 24670 q = ire->ire_stq; 24671 out_ill = (ill_t *)q->q_ptr; 24672 24673 BUMP_MIB(out_ill->ill_ip_mib, ipIfStatsOutFragCreates); 24674 24675 DTRACE_PROBE4(ip4__physical__out__start, 24676 ill_t *, NULL, ill_t *, out_ill, 24677 ipha_t *, ipha, mblk_t *, xmit_mp); 24678 24679 FW_HOOKS(ipst->ips_ip4_physical_out_event, 24680 ipst->ips_ipv4firewall_physical_out, 24681 NULL, out_ill, ipha, xmit_mp, mp, ipst); 24682 24683 DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, xmit_mp); 24684 24685 if (xmit_mp != NULL) { 24686 putnext(q, xmit_mp); 24687 24688 BUMP_MIB(out_ill->ill_ip_mib, ipIfStatsHCOutTransmits); 24689 UPDATE_MIB(out_ill->ill_ip_mib, 24690 ipIfStatsHCOutOctets, i1); 24691 24692 if (pkt_type != OB_PKT) { 24693 /* 24694 * Update the packet count and MIB stats 24695 * of trailing RTF_MULTIRT ires. 24696 */ 24697 UPDATE_OB_PKT_COUNT(ire); 24698 BUMP_MIB(out_ill->ill_ip_mib, 24699 ipIfStatsOutFragReqds); 24700 } 24701 } 24702 24703 if (multirt_send) { 24704 /* 24705 * We are in a multiple send case; look for 24706 * the next ire and re-enter the loop. 24707 */ 24708 ASSERT(ire1); 24709 ASSERT(next_mp); 24710 /* REFRELE the current ire before looping */ 24711 ire_refrele(ire); 24712 ire = ire1; 24713 ire1 = NULL; 24714 mp = next_mp; 24715 next_mp = NULL; 24716 } 24717 } while (multirt_send); 24718 24719 ASSERT(ire1 == NULL); 24720 24721 /* Restore the original ire; we need it for the trailing frags */ 24722 if (save_ire != NULL) { 24723 /* REFRELE the last iterated ire */ 24724 ire_refrele(ire); 24725 /* save_ire has been REFHOLDed */ 24726 ire = save_ire; 24727 save_ire = NULL; 24728 q = ire->ire_stq; 24729 } 24730 24731 if (pkt_type == OB_PKT) { 24732 UPDATE_OB_PKT_COUNT(ire); 24733 } else { 24734 out_ill = (ill_t *)q->q_ptr; 24735 BUMP_MIB(out_ill->ill_ip_mib, ipIfStatsHCOutForwDatagrams); 24736 UPDATE_IB_PKT_COUNT(ire); 24737 } 24738 24739 /* Advance the offset to the second frag starting point. */ 24740 offset += len; 24741 /* 24742 * Update hdr_len from the copied header - there might be less options 24743 * in the later fragments. 24744 */ 24745 hdr_len = IPH_HDR_LENGTH(hdr_mp->b_rptr); 24746 /* Loop until done. */ 24747 for (;;) { 24748 uint16_t offset_and_flags; 24749 uint16_t ip_len; 24750 24751 if (ip_data_end - offset > len) { 24752 /* 24753 * Carve off the appropriate amount from the original 24754 * datagram. 24755 */ 24756 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) { 24757 mp = NULL; 24758 break; 24759 } 24760 /* 24761 * More frags after this one. Get another copy 24762 * of the header. 24763 */ 24764 if (carve_mp->b_datap->db_ref == 1 && 24765 hdr_mp->b_wptr - hdr_mp->b_rptr < 24766 carve_mp->b_rptr - carve_mp->b_datap->db_base) { 24767 /* Inline IP header */ 24768 carve_mp->b_rptr -= hdr_mp->b_wptr - 24769 hdr_mp->b_rptr; 24770 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr, 24771 hdr_mp->b_wptr - hdr_mp->b_rptr); 24772 mp = carve_mp; 24773 } else { 24774 if (!(mp = copyb(hdr_mp))) { 24775 freemsg(carve_mp); 24776 break; 24777 } 24778 /* Get priority marking, if any. */ 24779 mp->b_band = carve_mp->b_band; 24780 mp->b_cont = carve_mp; 24781 } 24782 ipha = (ipha_t *)mp->b_rptr; 24783 offset_and_flags = IPH_MF; 24784 } else { 24785 /* 24786 * Last frag. Consume the header. Set len to 24787 * the length of this last piece. 24788 */ 24789 len = ip_data_end - offset; 24790 24791 /* 24792 * Carve off the appropriate amount from the original 24793 * datagram. 24794 */ 24795 if (!(carve_mp = ip_carve_mp(&mp_orig, len))) { 24796 mp = NULL; 24797 break; 24798 } 24799 if (carve_mp->b_datap->db_ref == 1 && 24800 hdr_mp->b_wptr - hdr_mp->b_rptr < 24801 carve_mp->b_rptr - carve_mp->b_datap->db_base) { 24802 /* Inline IP header */ 24803 carve_mp->b_rptr -= hdr_mp->b_wptr - 24804 hdr_mp->b_rptr; 24805 bcopy(hdr_mp->b_rptr, carve_mp->b_rptr, 24806 hdr_mp->b_wptr - hdr_mp->b_rptr); 24807 mp = carve_mp; 24808 freeb(hdr_mp); 24809 hdr_mp = mp; 24810 } else { 24811 mp = hdr_mp; 24812 /* Get priority marking, if any. */ 24813 mp->b_band = carve_mp->b_band; 24814 mp->b_cont = carve_mp; 24815 } 24816 ipha = (ipha_t *)mp->b_rptr; 24817 /* A frag of a frag might have IPH_MF non-zero */ 24818 offset_and_flags = 24819 ntohs(ipha->ipha_fragment_offset_and_flags) & 24820 IPH_MF; 24821 } 24822 offset_and_flags |= (uint16_t)(offset >> 3); 24823 offset_and_flags |= (uint16_t)frag_flag; 24824 /* Store the offset and flags in the IP header. */ 24825 ipha->ipha_fragment_offset_and_flags = htons(offset_and_flags); 24826 24827 /* Store the length in the IP header. */ 24828 ip_len = (uint16_t)(len + hdr_len); 24829 ipha->ipha_length = htons(ip_len); 24830 24831 /* 24832 * Set the IP header checksum. Note that mp is just 24833 * the header, so this is easy to pass to ip_csum. 24834 */ 24835 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha); 24836 24837 /* Attach a transmit header, if any, and ship it. */ 24838 if (pkt_type == OB_PKT) { 24839 UPDATE_OB_PKT_COUNT(ire); 24840 } else { 24841 out_ill = (ill_t *)q->q_ptr; 24842 BUMP_MIB(out_ill->ill_ip_mib, 24843 ipIfStatsHCOutForwDatagrams); 24844 UPDATE_IB_PKT_COUNT(ire); 24845 } 24846 24847 if (ire->ire_flags & RTF_MULTIRT) { 24848 irb = ire->ire_bucket; 24849 ASSERT(irb != NULL); 24850 24851 multirt_send = B_TRUE; 24852 24853 /* 24854 * Save the original ire; we will need to restore it 24855 * for the tailing frags. 24856 */ 24857 save_ire = ire; 24858 IRE_REFHOLD(save_ire); 24859 } 24860 /* 24861 * Emission loop for this fragment, similar 24862 * to what is done for the first fragment. 24863 */ 24864 do { 24865 if (multirt_send) { 24866 /* 24867 * We are in a multiple send case, need to get 24868 * the next ire and make a copy of the packet. 24869 */ 24870 ASSERT(irb != NULL); 24871 IRB_REFHOLD(irb); 24872 for (ire1 = ire->ire_next; 24873 ire1 != NULL; 24874 ire1 = ire1->ire_next) { 24875 if (!(ire1->ire_flags & RTF_MULTIRT)) 24876 continue; 24877 if (ire1->ire_addr != ire->ire_addr) 24878 continue; 24879 if (ire1->ire_marks & 24880 (IRE_MARK_CONDEMNED| 24881 IRE_MARK_HIDDEN)) 24882 continue; 24883 /* 24884 * Ensure we do not exceed the MTU 24885 * of the next route. 24886 */ 24887 if (ire1->ire_max_frag < max_frag) { 24888 ip_multirt_bad_mtu(ire1, 24889 max_frag); 24890 continue; 24891 } 24892 24893 /* Got one. */ 24894 IRE_REFHOLD(ire1); 24895 break; 24896 } 24897 IRB_REFRELE(irb); 24898 24899 if (ire1 != NULL) { 24900 next_mp = copyb(mp); 24901 if ((next_mp == NULL) || 24902 ((mp->b_cont != NULL) && 24903 ((next_mp->b_cont = 24904 dupmsg(mp->b_cont)) == NULL))) { 24905 freemsg(next_mp); 24906 next_mp = NULL; 24907 ire_refrele(ire1); 24908 ire1 = NULL; 24909 } 24910 } 24911 24912 /* Last multiroute ire; don't loop anymore. */ 24913 if (ire1 == NULL) { 24914 multirt_send = B_FALSE; 24915 } 24916 } 24917 24918 /* Update transmit header */ 24919 ll_hdr_len = 0; 24920 LOCK_IRE_FP_MP(ire); 24921 ll_hdr_mp = ire->ire_nce->nce_fp_mp; 24922 if (ll_hdr_mp != NULL) { 24923 ASSERT(ll_hdr_mp->b_datap->db_type == M_DATA); 24924 ll_hdr_len = MBLKL(ll_hdr_mp); 24925 } else { 24926 ll_hdr_mp = ire->ire_nce->nce_res_mp; 24927 } 24928 24929 if (!ll_hdr_mp) { 24930 xmit_mp = mp; 24931 24932 /* 24933 * We have link-layer header that can fit in 24934 * our mblk. 24935 */ 24936 } else if (mp->b_datap->db_ref == 1 && 24937 ll_hdr_len != 0 && 24938 ll_hdr_len <= mp->b_rptr - mp->b_datap->db_base) { 24939 /* M_DATA fastpath */ 24940 mp->b_rptr -= ll_hdr_len; 24941 bcopy(ll_hdr_mp->b_rptr, mp->b_rptr, 24942 ll_hdr_len); 24943 xmit_mp = mp; 24944 24945 /* 24946 * Case of res_mp OR the fastpath mp can't fit 24947 * in the mblk 24948 */ 24949 } else if ((xmit_mp = copyb(ll_hdr_mp)) != NULL) { 24950 xmit_mp->b_cont = mp; 24951 if (DB_CRED(mp) != NULL) 24952 mblk_setcred(xmit_mp, DB_CRED(mp)); 24953 /* Get priority marking, if any. */ 24954 if (DB_TYPE(xmit_mp) == M_DATA) 24955 xmit_mp->b_band = mp->b_band; 24956 24957 /* Corner case if copyb failed */ 24958 } else { 24959 /* 24960 * Exit both the replication and 24961 * fragmentation loops. 24962 */ 24963 UNLOCK_IRE_FP_MP(ire); 24964 goto drop_pkt; 24965 } 24966 UNLOCK_IRE_FP_MP(ire); 24967 24968 mp1 = mp; 24969 out_ill = (ill_t *)q->q_ptr; 24970 24971 BUMP_MIB(out_ill->ill_ip_mib, ipIfStatsOutFragCreates); 24972 24973 DTRACE_PROBE4(ip4__physical__out__start, 24974 ill_t *, NULL, ill_t *, out_ill, 24975 ipha_t *, ipha, mblk_t *, xmit_mp); 24976 24977 FW_HOOKS(ipst->ips_ip4_physical_out_event, 24978 ipst->ips_ipv4firewall_physical_out, 24979 NULL, out_ill, ipha, xmit_mp, mp, ipst); 24980 24981 DTRACE_PROBE1(ip4__physical__out__end, 24982 mblk_t *, xmit_mp); 24983 24984 if (mp != mp1 && hdr_mp == mp1) 24985 hdr_mp = mp; 24986 if (mp != mp1 && mp_orig == mp1) 24987 mp_orig = mp; 24988 24989 if (xmit_mp != NULL) { 24990 putnext(q, xmit_mp); 24991 24992 BUMP_MIB(out_ill->ill_ip_mib, 24993 ipIfStatsHCOutTransmits); 24994 UPDATE_MIB(out_ill->ill_ip_mib, 24995 ipIfStatsHCOutOctets, ip_len); 24996 24997 if (pkt_type != OB_PKT) { 24998 /* 24999 * Update the packet count of trailing 25000 * RTF_MULTIRT ires. 25001 */ 25002 UPDATE_OB_PKT_COUNT(ire); 25003 } 25004 } 25005 25006 /* All done if we just consumed the hdr_mp. */ 25007 if (mp == hdr_mp) { 25008 last_frag = B_TRUE; 25009 BUMP_MIB(out_ill->ill_ip_mib, 25010 ipIfStatsOutFragOKs); 25011 } 25012 25013 if (multirt_send) { 25014 /* 25015 * We are in a multiple send case; look for 25016 * the next ire and re-enter the loop. 25017 */ 25018 ASSERT(ire1); 25019 ASSERT(next_mp); 25020 /* REFRELE the current ire before looping */ 25021 ire_refrele(ire); 25022 ire = ire1; 25023 ire1 = NULL; 25024 q = ire->ire_stq; 25025 mp = next_mp; 25026 next_mp = NULL; 25027 } 25028 } while (multirt_send); 25029 /* 25030 * Restore the original ire; we need it for the 25031 * trailing frags 25032 */ 25033 if (save_ire != NULL) { 25034 ASSERT(ire1 == NULL); 25035 /* REFRELE the last iterated ire */ 25036 ire_refrele(ire); 25037 /* save_ire has been REFHOLDed */ 25038 ire = save_ire; 25039 q = ire->ire_stq; 25040 save_ire = NULL; 25041 } 25042 25043 if (last_frag) { 25044 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 25045 "ip_wput_frag_end:(%S)", 25046 "consumed hdr_mp"); 25047 25048 if (first_ire != NULL) 25049 ire_refrele(first_ire); 25050 return; 25051 } 25052 /* Otherwise, advance and loop. */ 25053 offset += len; 25054 } 25055 25056 drop_pkt: 25057 /* Clean up following allocation failure. */ 25058 BUMP_MIB(mibptr, ipIfStatsOutFragFails); 25059 freemsg(mp); 25060 if (mp != hdr_mp) 25061 freeb(hdr_mp); 25062 if (mp != mp_orig) 25063 freemsg(mp_orig); 25064 25065 if (save_ire != NULL) 25066 IRE_REFRELE(save_ire); 25067 if (first_ire != NULL) 25068 ire_refrele(first_ire); 25069 25070 TRACE_1(TR_FAC_IP, TR_IP_WPUT_FRAG_END, 25071 "ip_wput_frag_end:(%S)", 25072 "end--alloc failure"); 25073 } 25074 25075 /* 25076 * Copy the header plus those options which have the copy bit set 25077 */ 25078 static mblk_t * 25079 ip_wput_frag_copyhdr(uchar_t *rptr, int hdr_len, int offset, ip_stack_t *ipst) 25080 { 25081 mblk_t *mp; 25082 uchar_t *up; 25083 25084 /* 25085 * Quick check if we need to look for options without the copy bit 25086 * set 25087 */ 25088 mp = allocb(ipst->ips_ip_wroff_extra + hdr_len, BPRI_HI); 25089 if (!mp) 25090 return (mp); 25091 mp->b_rptr += ipst->ips_ip_wroff_extra; 25092 if (hdr_len == IP_SIMPLE_HDR_LENGTH || offset != 0) { 25093 bcopy(rptr, mp->b_rptr, hdr_len); 25094 mp->b_wptr += hdr_len + ipst->ips_ip_wroff_extra; 25095 return (mp); 25096 } 25097 up = mp->b_rptr; 25098 bcopy(rptr, up, IP_SIMPLE_HDR_LENGTH); 25099 up += IP_SIMPLE_HDR_LENGTH; 25100 rptr += IP_SIMPLE_HDR_LENGTH; 25101 hdr_len -= IP_SIMPLE_HDR_LENGTH; 25102 while (hdr_len > 0) { 25103 uint32_t optval; 25104 uint32_t optlen; 25105 25106 optval = *rptr; 25107 if (optval == IPOPT_EOL) 25108 break; 25109 if (optval == IPOPT_NOP) 25110 optlen = 1; 25111 else 25112 optlen = rptr[1]; 25113 if (optval & IPOPT_COPY) { 25114 bcopy(rptr, up, optlen); 25115 up += optlen; 25116 } 25117 rptr += optlen; 25118 hdr_len -= optlen; 25119 } 25120 /* 25121 * Make sure that we drop an even number of words by filling 25122 * with EOL to the next word boundary. 25123 */ 25124 for (hdr_len = up - (mp->b_rptr + IP_SIMPLE_HDR_LENGTH); 25125 hdr_len & 0x3; hdr_len++) 25126 *up++ = IPOPT_EOL; 25127 mp->b_wptr = up; 25128 /* Update header length */ 25129 mp->b_rptr[0] = (uint8_t)((IP_VERSION << 4) | ((up - mp->b_rptr) >> 2)); 25130 return (mp); 25131 } 25132 25133 /* 25134 * Delivery to local recipients including fanout to multiple recipients. 25135 * Does not do checksumming of UDP/TCP. 25136 * Note: q should be the read side queue for either the ill or conn. 25137 * Note: rq should be the read side q for the lower (ill) stream. 25138 * We don't send packets to IPPF processing, thus the last argument 25139 * to all the fanout calls are B_FALSE. 25140 */ 25141 void 25142 ip_wput_local(queue_t *q, ill_t *ill, ipha_t *ipha, mblk_t *mp, ire_t *ire, 25143 int fanout_flags, zoneid_t zoneid) 25144 { 25145 uint32_t protocol; 25146 mblk_t *first_mp; 25147 boolean_t mctl_present; 25148 int ire_type; 25149 #define rptr ((uchar_t *)ipha) 25150 ip_stack_t *ipst = ill->ill_ipst; 25151 25152 TRACE_1(TR_FAC_IP, TR_IP_WPUT_LOCAL_START, 25153 "ip_wput_local_start: q %p", q); 25154 25155 if (ire != NULL) { 25156 ire_type = ire->ire_type; 25157 } else { 25158 /* 25159 * Only ip_multicast_loopback() calls us with a NULL ire. If the 25160 * packet is not multicast, we can't tell the ire type. 25161 */ 25162 ASSERT(CLASSD(ipha->ipha_dst)); 25163 ire_type = IRE_BROADCAST; 25164 } 25165 25166 first_mp = mp; 25167 if (first_mp->b_datap->db_type == M_CTL) { 25168 ipsec_out_t *io = (ipsec_out_t *)first_mp->b_rptr; 25169 if (!io->ipsec_out_secure) { 25170 /* 25171 * This ipsec_out_t was allocated in ip_wput 25172 * for multicast packets to store the ill_index. 25173 * As this is being delivered locally, we don't 25174 * need this anymore. 25175 */ 25176 mp = first_mp->b_cont; 25177 freeb(first_mp); 25178 first_mp = mp; 25179 mctl_present = B_FALSE; 25180 } else { 25181 /* 25182 * Convert IPSEC_OUT to IPSEC_IN, preserving all 25183 * security properties for the looped-back packet. 25184 */ 25185 mctl_present = B_TRUE; 25186 mp = first_mp->b_cont; 25187 ASSERT(mp != NULL); 25188 ipsec_out_to_in(first_mp); 25189 } 25190 } else { 25191 mctl_present = B_FALSE; 25192 } 25193 25194 DTRACE_PROBE4(ip4__loopback__in__start, 25195 ill_t *, ill, ill_t *, NULL, 25196 ipha_t *, ipha, mblk_t *, first_mp); 25197 25198 FW_HOOKS(ipst->ips_ip4_loopback_in_event, 25199 ipst->ips_ipv4firewall_loopback_in, 25200 ill, NULL, ipha, first_mp, mp, ipst); 25201 25202 DTRACE_PROBE1(ip4__loopback__in__end, mblk_t *, first_mp); 25203 25204 if (first_mp == NULL) 25205 return; 25206 25207 ipst->ips_loopback_packets++; 25208 25209 ip2dbg(("ip_wput_local: from 0x%x to 0x%x in zone %d\n", 25210 ntohl(ipha->ipha_src), ntohl(ipha->ipha_dst), zoneid)); 25211 if (!IS_SIMPLE_IPH(ipha)) { 25212 ip_wput_local_options(ipha, ipst); 25213 } 25214 25215 protocol = ipha->ipha_protocol; 25216 switch (protocol) { 25217 case IPPROTO_ICMP: { 25218 ire_t *ire_zone; 25219 ilm_t *ilm; 25220 mblk_t *mp1; 25221 zoneid_t last_zoneid; 25222 25223 if (CLASSD(ipha->ipha_dst) && 25224 !(ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)) { 25225 ASSERT(ire_type == IRE_BROADCAST); 25226 /* 25227 * In the multicast case, applications may have joined 25228 * the group from different zones, so we need to deliver 25229 * the packet to each of them. Loop through the 25230 * multicast memberships structures (ilm) on the receive 25231 * ill and send a copy of the packet up each matching 25232 * one. However, we don't do this for multicasts sent on 25233 * the loopback interface (PHYI_LOOPBACK flag set) as 25234 * they must stay in the sender's zone. 25235 * 25236 * ilm_add_v6() ensures that ilms in the same zone are 25237 * contiguous in the ill_ilm list. We use this property 25238 * to avoid sending duplicates needed when two 25239 * applications in the same zone join the same group on 25240 * different logical interfaces: we ignore the ilm if 25241 * it's zoneid is the same as the last matching one. 25242 * In addition, the sending of the packet for 25243 * ire_zoneid is delayed until all of the other ilms 25244 * have been exhausted. 25245 */ 25246 last_zoneid = -1; 25247 ILM_WALKER_HOLD(ill); 25248 for (ilm = ill->ill_ilm; ilm != NULL; 25249 ilm = ilm->ilm_next) { 25250 if ((ilm->ilm_flags & ILM_DELETED) || 25251 ipha->ipha_dst != ilm->ilm_addr || 25252 ilm->ilm_zoneid == last_zoneid || 25253 ilm->ilm_zoneid == zoneid || 25254 !(ilm->ilm_ipif->ipif_flags & IPIF_UP)) 25255 continue; 25256 mp1 = ip_copymsg(first_mp); 25257 if (mp1 == NULL) 25258 continue; 25259 icmp_inbound(q, mp1, B_TRUE, ill, 0, 0, 25260 mctl_present, B_FALSE, ill, 25261 ilm->ilm_zoneid); 25262 last_zoneid = ilm->ilm_zoneid; 25263 } 25264 ILM_WALKER_RELE(ill); 25265 /* 25266 * Loopback case: the sending endpoint has 25267 * IP_MULTICAST_LOOP disabled, therefore we don't 25268 * dispatch the multicast packet to the sending zone. 25269 */ 25270 if (fanout_flags & IP_FF_NO_MCAST_LOOP) { 25271 freemsg(first_mp); 25272 return; 25273 } 25274 } else if (ire_type == IRE_BROADCAST) { 25275 /* 25276 * In the broadcast case, there may be many zones 25277 * which need a copy of the packet delivered to them. 25278 * There is one IRE_BROADCAST per broadcast address 25279 * and per zone; we walk those using a helper function. 25280 * In addition, the sending of the packet for zoneid is 25281 * delayed until all of the other ires have been 25282 * processed. 25283 */ 25284 IRB_REFHOLD(ire->ire_bucket); 25285 ire_zone = NULL; 25286 while ((ire_zone = ire_get_next_bcast_ire(ire_zone, 25287 ire)) != NULL) { 25288 mp1 = ip_copymsg(first_mp); 25289 if (mp1 == NULL) 25290 continue; 25291 25292 UPDATE_IB_PKT_COUNT(ire_zone); 25293 ire_zone->ire_last_used_time = lbolt; 25294 icmp_inbound(q, mp1, B_TRUE, ill, 0, 0, 25295 mctl_present, B_FALSE, ill, 25296 ire_zone->ire_zoneid); 25297 } 25298 IRB_REFRELE(ire->ire_bucket); 25299 } 25300 icmp_inbound(q, first_mp, (ire_type == IRE_BROADCAST), ill, 0, 25301 0, mctl_present, B_FALSE, ill, zoneid); 25302 TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END, 25303 "ip_wput_local_end: q %p (%S)", 25304 q, "icmp"); 25305 return; 25306 } 25307 case IPPROTO_IGMP: 25308 if ((mp = igmp_input(q, mp, ill)) == NULL) { 25309 /* Bad packet - discarded by igmp_input */ 25310 TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END, 25311 "ip_wput_local_end: q %p (%S)", 25312 q, "igmp_input--bad packet"); 25313 if (mctl_present) 25314 freeb(first_mp); 25315 return; 25316 } 25317 /* 25318 * igmp_input() may have returned the pulled up message. 25319 * So first_mp and ipha need to be reinitialized. 25320 */ 25321 ipha = (ipha_t *)mp->b_rptr; 25322 if (mctl_present) 25323 first_mp->b_cont = mp; 25324 else 25325 first_mp = mp; 25326 /* deliver to local raw users */ 25327 break; 25328 case IPPROTO_ENCAP: 25329 /* 25330 * This case is covered by either ip_fanout_proto, or by 25331 * the above security processing for self-tunneled packets. 25332 */ 25333 break; 25334 case IPPROTO_UDP: { 25335 uint16_t *up; 25336 uint32_t ports; 25337 25338 up = (uint16_t *)(rptr + IPH_HDR_LENGTH(ipha) + 25339 UDP_PORTS_OFFSET); 25340 /* Force a 'valid' checksum. */ 25341 up[3] = 0; 25342 25343 ports = *(uint32_t *)up; 25344 ip_fanout_udp(q, first_mp, ill, ipha, ports, 25345 (ire_type == IRE_BROADCAST), 25346 fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE | 25347 IP_FF_SEND_SLLA | IP_FF_IPINFO, mctl_present, B_FALSE, 25348 ill, zoneid); 25349 TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END, 25350 "ip_wput_local_end: q %p (%S)", q, "ip_fanout_udp"); 25351 return; 25352 } 25353 case IPPROTO_TCP: { 25354 25355 /* 25356 * For TCP, discard broadcast packets. 25357 */ 25358 if ((ushort_t)ire_type == IRE_BROADCAST) { 25359 freemsg(first_mp); 25360 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards); 25361 ip2dbg(("ip_wput_local: discard broadcast\n")); 25362 return; 25363 } 25364 25365 if (mp->b_datap->db_type == M_DATA) { 25366 /* 25367 * M_DATA mblk, so init mblk (chain) for no struio(). 25368 */ 25369 mblk_t *mp1 = mp; 25370 25371 do 25372 mp1->b_datap->db_struioflag = 0; 25373 while ((mp1 = mp1->b_cont) != NULL); 25374 } 25375 ASSERT((rptr + IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET + 4) 25376 <= mp->b_wptr); 25377 ip_fanout_tcp(q, first_mp, ill, ipha, 25378 fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE | 25379 IP_FF_SYN_ADDIRE | IP_FF_IPINFO, 25380 mctl_present, B_FALSE, zoneid); 25381 TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END, 25382 "ip_wput_local_end: q %p (%S)", q, "ip_fanout_tcp"); 25383 return; 25384 } 25385 case IPPROTO_SCTP: 25386 { 25387 uint32_t ports; 25388 25389 bcopy(rptr + IPH_HDR_LENGTH(ipha), &ports, sizeof (ports)); 25390 ip_fanout_sctp(first_mp, ill, ipha, ports, 25391 fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE | 25392 IP_FF_IPINFO, 25393 mctl_present, B_FALSE, 0, zoneid); 25394 return; 25395 } 25396 25397 default: 25398 break; 25399 } 25400 /* 25401 * Find a client for some other protocol. We give 25402 * copies to multiple clients, if more than one is 25403 * bound. 25404 */ 25405 ip_fanout_proto(q, first_mp, ill, ipha, 25406 fanout_flags | IP_FF_SEND_ICMP | IP_FF_HDR_COMPLETE | IP_FF_RAWIP, 25407 mctl_present, B_FALSE, ill, zoneid); 25408 TRACE_2(TR_FAC_IP, TR_IP_WPUT_LOCAL_END, 25409 "ip_wput_local_end: q %p (%S)", q, "ip_fanout_proto"); 25410 #undef rptr 25411 } 25412 25413 /* 25414 * Update any source route, record route, or timestamp options. 25415 * Check that we are at end of strict source route. 25416 * The options have been sanity checked by ip_wput_options(). 25417 */ 25418 static void 25419 ip_wput_local_options(ipha_t *ipha, ip_stack_t *ipst) 25420 { 25421 ipoptp_t opts; 25422 uchar_t *opt; 25423 uint8_t optval; 25424 uint8_t optlen; 25425 ipaddr_t dst; 25426 uint32_t ts; 25427 ire_t *ire; 25428 timestruc_t now; 25429 25430 ip2dbg(("ip_wput_local_options\n")); 25431 for (optval = ipoptp_first(&opts, ipha); 25432 optval != IPOPT_EOL; 25433 optval = ipoptp_next(&opts)) { 25434 opt = opts.ipoptp_cur; 25435 optlen = opts.ipoptp_len; 25436 ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0); 25437 switch (optval) { 25438 uint32_t off; 25439 case IPOPT_SSRR: 25440 case IPOPT_LSRR: 25441 off = opt[IPOPT_OFFSET]; 25442 off--; 25443 if (optlen < IP_ADDR_LEN || 25444 off > optlen - IP_ADDR_LEN) { 25445 /* End of source route */ 25446 break; 25447 } 25448 /* 25449 * This will only happen if two consecutive entries 25450 * in the source route contains our address or if 25451 * it is a packet with a loose source route which 25452 * reaches us before consuming the whole source route 25453 */ 25454 ip1dbg(("ip_wput_local_options: not end of SR\n")); 25455 if (optval == IPOPT_SSRR) { 25456 return; 25457 } 25458 /* 25459 * Hack: instead of dropping the packet truncate the 25460 * source route to what has been used by filling the 25461 * rest with IPOPT_NOP. 25462 */ 25463 opt[IPOPT_OLEN] = (uint8_t)off; 25464 while (off < optlen) { 25465 opt[off++] = IPOPT_NOP; 25466 } 25467 break; 25468 case IPOPT_RR: 25469 off = opt[IPOPT_OFFSET]; 25470 off--; 25471 if (optlen < IP_ADDR_LEN || 25472 off > optlen - IP_ADDR_LEN) { 25473 /* No more room - ignore */ 25474 ip1dbg(( 25475 "ip_wput_forward_options: end of RR\n")); 25476 break; 25477 } 25478 dst = htonl(INADDR_LOOPBACK); 25479 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN); 25480 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 25481 break; 25482 case IPOPT_TS: 25483 /* Insert timestamp if there is romm */ 25484 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 25485 case IPOPT_TS_TSONLY: 25486 off = IPOPT_TS_TIMELEN; 25487 break; 25488 case IPOPT_TS_PRESPEC: 25489 case IPOPT_TS_PRESPEC_RFC791: 25490 /* Verify that the address matched */ 25491 off = opt[IPOPT_OFFSET] - 1; 25492 bcopy((char *)opt + off, &dst, IP_ADDR_LEN); 25493 ire = ire_ctable_lookup(dst, 0, IRE_LOCAL, 25494 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 25495 ipst); 25496 if (ire == NULL) { 25497 /* Not for us */ 25498 break; 25499 } 25500 ire_refrele(ire); 25501 /* FALLTHRU */ 25502 case IPOPT_TS_TSANDADDR: 25503 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 25504 break; 25505 default: 25506 /* 25507 * ip_*put_options should have already 25508 * dropped this packet. 25509 */ 25510 cmn_err(CE_PANIC, "ip_wput_local_options: " 25511 "unknown IT - bug in ip_wput_options?\n"); 25512 return; /* Keep "lint" happy */ 25513 } 25514 if (opt[IPOPT_OFFSET] - 1 + off > optlen) { 25515 /* Increase overflow counter */ 25516 off = (opt[IPOPT_POS_OV_FLG] >> 4) + 1; 25517 opt[IPOPT_POS_OV_FLG] = (uint8_t) 25518 (opt[IPOPT_POS_OV_FLG] & 0x0F) | 25519 (off << 4); 25520 break; 25521 } 25522 off = opt[IPOPT_OFFSET] - 1; 25523 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 25524 case IPOPT_TS_PRESPEC: 25525 case IPOPT_TS_PRESPEC_RFC791: 25526 case IPOPT_TS_TSANDADDR: 25527 dst = htonl(INADDR_LOOPBACK); 25528 bcopy(&dst, (char *)opt + off, IP_ADDR_LEN); 25529 opt[IPOPT_OFFSET] += IP_ADDR_LEN; 25530 /* FALLTHRU */ 25531 case IPOPT_TS_TSONLY: 25532 off = opt[IPOPT_OFFSET] - 1; 25533 /* Compute # of milliseconds since midnight */ 25534 gethrestime(&now); 25535 ts = (now.tv_sec % (24 * 60 * 60)) * 1000 + 25536 now.tv_nsec / (NANOSEC / MILLISEC); 25537 bcopy(&ts, (char *)opt + off, IPOPT_TS_TIMELEN); 25538 opt[IPOPT_OFFSET] += IPOPT_TS_TIMELEN; 25539 break; 25540 } 25541 break; 25542 } 25543 } 25544 } 25545 25546 /* 25547 * Send out a multicast packet on interface ipif. 25548 * The sender does not have an conn. 25549 * Caller verifies that this isn't a PHYI_LOOPBACK. 25550 */ 25551 void 25552 ip_wput_multicast(queue_t *q, mblk_t *mp, ipif_t *ipif, zoneid_t zoneid) 25553 { 25554 ipha_t *ipha; 25555 ire_t *ire; 25556 ipaddr_t dst; 25557 mblk_t *first_mp; 25558 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 25559 25560 /* igmp_sendpkt always allocates a ipsec_out_t */ 25561 ASSERT(mp->b_datap->db_type == M_CTL); 25562 ASSERT(!ipif->ipif_isv6); 25563 ASSERT(!(ipif->ipif_ill->ill_phyint->phyint_flags & PHYI_LOOPBACK)); 25564 25565 first_mp = mp; 25566 mp = first_mp->b_cont; 25567 ASSERT(mp->b_datap->db_type == M_DATA); 25568 ipha = (ipha_t *)mp->b_rptr; 25569 25570 /* 25571 * Find an IRE which matches the destination and the outgoing 25572 * queue (i.e. the outgoing interface.) 25573 */ 25574 if (ipif->ipif_flags & IPIF_POINTOPOINT) 25575 dst = ipif->ipif_pp_dst_addr; 25576 else 25577 dst = ipha->ipha_dst; 25578 /* 25579 * The source address has already been initialized by the 25580 * caller and hence matching on ILL (MATCH_IRE_ILL) would 25581 * be sufficient rather than MATCH_IRE_IPIF. 25582 * 25583 * This function is used for sending IGMP packets. We need 25584 * to make sure that we send the packet out of the interface 25585 * (ipif->ipif_ill) where we joined the group. This is to 25586 * prevent from switches doing IGMP snooping to send us multicast 25587 * packets for a given group on the interface we have joined. 25588 * If we can't find an ire, igmp_sendpkt has already initialized 25589 * ipsec_out_attach_if so that this will not be load spread in 25590 * ip_newroute_ipif. 25591 */ 25592 ire = ire_ctable_lookup(dst, 0, 0, ipif, zoneid, NULL, 25593 MATCH_IRE_ILL, ipst); 25594 if (!ire) { 25595 /* 25596 * Mark this packet to make it be delivered to 25597 * ip_wput_ire after the new ire has been 25598 * created. 25599 */ 25600 mp->b_prev = NULL; 25601 mp->b_next = NULL; 25602 ip_newroute_ipif(q, first_mp, ipif, dst, NULL, RTF_SETSRC, 25603 zoneid, &zero_info); 25604 return; 25605 } 25606 25607 /* 25608 * Honor the RTF_SETSRC flag; this is the only case 25609 * where we force this addr whatever the current src addr is, 25610 * because this address is set by igmp_sendpkt(), and 25611 * cannot be specified by any user. 25612 */ 25613 if (ire->ire_flags & RTF_SETSRC) { 25614 ipha->ipha_src = ire->ire_src_addr; 25615 } 25616 25617 ip_wput_ire(q, first_mp, ire, NULL, B_FALSE, zoneid); 25618 } 25619 25620 /* 25621 * NOTE : This function does not ire_refrele the ire argument passed in. 25622 * 25623 * Copy the link layer header and do IPQoS if needed. Frees the mblk on 25624 * failure. The nce_fp_mp can vanish any time in the case of IRE_MIPRTUN 25625 * and IRE_BROADCAST due to DL_NOTE_FASTPATH_FLUSH. Hence we have to hold 25626 * the ire_lock to access the nce_fp_mp in this case. 25627 * IPQoS assumes that the first M_DATA contains the IP header. So, if we are 25628 * prepending a fastpath message IPQoS processing must precede it, we also set 25629 * the b_band of the fastpath message to that of the mblk returned by IPQoS 25630 * (IPQoS might have set the b_band for CoS marking). 25631 * However, if we are prepending DL_UNITDATA_REQ message, IPQoS processing 25632 * must follow it so that IPQoS can mark the dl_priority field for CoS 25633 * marking, if needed. 25634 */ 25635 static mblk_t * 25636 ip_wput_attach_llhdr(mblk_t *mp, ire_t *ire, ip_proc_t proc, uint32_t ill_index) 25637 { 25638 uint_t hlen; 25639 ipha_t *ipha; 25640 mblk_t *mp1; 25641 boolean_t qos_done = B_FALSE; 25642 uchar_t *ll_hdr; 25643 ip_stack_t *ipst = ire->ire_ipst; 25644 25645 #define rptr ((uchar_t *)ipha) 25646 25647 ipha = (ipha_t *)mp->b_rptr; 25648 hlen = 0; 25649 LOCK_IRE_FP_MP(ire); 25650 if ((mp1 = ire->ire_nce->nce_fp_mp) != NULL) { 25651 ASSERT(DB_TYPE(mp1) == M_DATA); 25652 /* Initiate IPPF processing */ 25653 if ((proc != 0) && IPP_ENABLED(proc, ipst)) { 25654 UNLOCK_IRE_FP_MP(ire); 25655 ip_process(proc, &mp, ill_index); 25656 if (mp == NULL) 25657 return (NULL); 25658 25659 ipha = (ipha_t *)mp->b_rptr; 25660 LOCK_IRE_FP_MP(ire); 25661 if ((mp1 = ire->ire_nce->nce_fp_mp) == NULL) { 25662 qos_done = B_TRUE; 25663 goto no_fp_mp; 25664 } 25665 ASSERT(DB_TYPE(mp1) == M_DATA); 25666 } 25667 hlen = MBLKL(mp1); 25668 /* 25669 * Check if we have enough room to prepend fastpath 25670 * header 25671 */ 25672 if (hlen != 0 && (rptr - mp->b_datap->db_base) >= hlen) { 25673 ll_hdr = rptr - hlen; 25674 bcopy(mp1->b_rptr, ll_hdr, hlen); 25675 /* 25676 * Set the b_rptr to the start of the link layer 25677 * header 25678 */ 25679 mp->b_rptr = ll_hdr; 25680 mp1 = mp; 25681 } else { 25682 mp1 = copyb(mp1); 25683 if (mp1 == NULL) 25684 goto unlock_err; 25685 mp1->b_band = mp->b_band; 25686 mp1->b_cont = mp; 25687 /* 25688 * certain system generated traffic may not 25689 * have cred/label in ip header block. This 25690 * is true even for a labeled system. But for 25691 * labeled traffic, inherit the label in the 25692 * new header. 25693 */ 25694 if (DB_CRED(mp) != NULL) 25695 mblk_setcred(mp1, DB_CRED(mp)); 25696 /* 25697 * XXX disable ICK_VALID and compute checksum 25698 * here; can happen if nce_fp_mp changes and 25699 * it can't be copied now due to insufficient 25700 * space. (unlikely, fp mp can change, but it 25701 * does not increase in length) 25702 */ 25703 } 25704 UNLOCK_IRE_FP_MP(ire); 25705 } else { 25706 no_fp_mp: 25707 mp1 = copyb(ire->ire_nce->nce_res_mp); 25708 if (mp1 == NULL) { 25709 unlock_err: 25710 UNLOCK_IRE_FP_MP(ire); 25711 freemsg(mp); 25712 return (NULL); 25713 } 25714 UNLOCK_IRE_FP_MP(ire); 25715 mp1->b_cont = mp; 25716 /* 25717 * certain system generated traffic may not 25718 * have cred/label in ip header block. This 25719 * is true even for a labeled system. But for 25720 * labeled traffic, inherit the label in the 25721 * new header. 25722 */ 25723 if (DB_CRED(mp) != NULL) 25724 mblk_setcred(mp1, DB_CRED(mp)); 25725 if (!qos_done && (proc != 0) && IPP_ENABLED(proc, ipst)) { 25726 ip_process(proc, &mp1, ill_index); 25727 if (mp1 == NULL) 25728 return (NULL); 25729 } 25730 } 25731 return (mp1); 25732 #undef rptr 25733 } 25734 25735 /* 25736 * Finish the outbound IPsec processing for an IPv6 packet. This function 25737 * is called from ipsec_out_process() if the IPsec packet was processed 25738 * synchronously, or from {ah,esp}_kcf_callback() if it was processed 25739 * asynchronously. 25740 */ 25741 void 25742 ip_wput_ipsec_out_v6(queue_t *q, mblk_t *ipsec_mp, ip6_t *ip6h, ill_t *ill, 25743 ire_t *ire_arg) 25744 { 25745 in6_addr_t *v6dstp; 25746 ire_t *ire; 25747 mblk_t *mp; 25748 ip6_t *ip6h1; 25749 uint_t ill_index; 25750 ipsec_out_t *io; 25751 boolean_t attach_if, hwaccel; 25752 uint32_t flags = IP6_NO_IPPOLICY; 25753 int match_flags; 25754 zoneid_t zoneid; 25755 boolean_t ill_need_rele = B_FALSE; 25756 boolean_t ire_need_rele = B_FALSE; 25757 ip_stack_t *ipst; 25758 25759 mp = ipsec_mp->b_cont; 25760 ip6h1 = (ip6_t *)mp->b_rptr; 25761 io = (ipsec_out_t *)ipsec_mp->b_rptr; 25762 ASSERT(io->ipsec_out_ns != NULL); 25763 ipst = io->ipsec_out_ns->netstack_ip; 25764 ill_index = io->ipsec_out_ill_index; 25765 if (io->ipsec_out_reachable) { 25766 flags |= IPV6_REACHABILITY_CONFIRMATION; 25767 } 25768 attach_if = io->ipsec_out_attach_if; 25769 hwaccel = io->ipsec_out_accelerated; 25770 zoneid = io->ipsec_out_zoneid; 25771 ASSERT(zoneid != ALL_ZONES); 25772 match_flags = MATCH_IRE_ILL_GROUP | MATCH_IRE_SECATTR; 25773 /* Multicast addresses should have non-zero ill_index. */ 25774 v6dstp = &ip6h->ip6_dst; 25775 ASSERT(ip6h->ip6_nxt != IPPROTO_RAW); 25776 ASSERT(!IN6_IS_ADDR_MULTICAST(v6dstp) || ill_index != 0); 25777 ASSERT(!attach_if || ill_index != 0); 25778 if (ill_index != 0) { 25779 if (ill == NULL) { 25780 ill = ip_grab_attach_ill(NULL, ipsec_mp, ill_index, 25781 B_TRUE, ipst); 25782 25783 /* Failure case frees things for us. */ 25784 if (ill == NULL) 25785 return; 25786 25787 ill_need_rele = B_TRUE; 25788 } 25789 /* 25790 * If this packet needs to go out on a particular interface 25791 * honor it. 25792 */ 25793 if (attach_if) { 25794 match_flags = MATCH_IRE_ILL; 25795 25796 /* 25797 * Check if we need an ire that will not be 25798 * looked up by anybody else i.e. HIDDEN. 25799 */ 25800 if (ill_is_probeonly(ill)) { 25801 match_flags |= MATCH_IRE_MARK_HIDDEN; 25802 } 25803 } 25804 } 25805 ASSERT(mp != NULL); 25806 25807 if (IN6_IS_ADDR_MULTICAST(v6dstp)) { 25808 boolean_t unspec_src; 25809 ipif_t *ipif; 25810 25811 /* 25812 * Use the ill_index to get the right ill. 25813 */ 25814 unspec_src = io->ipsec_out_unspec_src; 25815 (void) ipif_lookup_zoneid(ill, zoneid, 0, &ipif); 25816 if (ipif == NULL) { 25817 if (ill_need_rele) 25818 ill_refrele(ill); 25819 freemsg(ipsec_mp); 25820 return; 25821 } 25822 25823 if (ire_arg != NULL) { 25824 ire = ire_arg; 25825 } else { 25826 ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ipif, 25827 zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 25828 ire_need_rele = B_TRUE; 25829 } 25830 if (ire != NULL) { 25831 ipif_refrele(ipif); 25832 /* 25833 * XXX Do the multicast forwarding now, as the IPSEC 25834 * processing has been done. 25835 */ 25836 goto send; 25837 } 25838 25839 ip0dbg(("ip_wput_ipsec_out_v6: multicast: IRE disappeared\n")); 25840 mp->b_prev = NULL; 25841 mp->b_next = NULL; 25842 25843 /* 25844 * If the IPsec packet was processed asynchronously, 25845 * drop it now. 25846 */ 25847 if (q == NULL) { 25848 if (ill_need_rele) 25849 ill_refrele(ill); 25850 freemsg(ipsec_mp); 25851 return; 25852 } 25853 25854 ip_newroute_ipif_v6(q, ipsec_mp, ipif, *v6dstp, 25855 unspec_src, zoneid); 25856 ipif_refrele(ipif); 25857 } else { 25858 if (attach_if) { 25859 ipif_t *ipif; 25860 25861 ipif = ipif_get_next_ipif(NULL, ill); 25862 if (ipif == NULL) { 25863 if (ill_need_rele) 25864 ill_refrele(ill); 25865 freemsg(ipsec_mp); 25866 return; 25867 } 25868 ire = ire_ctable_lookup_v6(v6dstp, 0, 0, ipif, 25869 zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 25870 ire_need_rele = B_TRUE; 25871 ipif_refrele(ipif); 25872 } else { 25873 if (ire_arg != NULL) { 25874 ire = ire_arg; 25875 } else { 25876 ire = ire_cache_lookup_v6(v6dstp, zoneid, NULL, 25877 ipst); 25878 ire_need_rele = B_TRUE; 25879 } 25880 } 25881 if (ire != NULL) 25882 goto send; 25883 /* 25884 * ire disappeared underneath. 25885 * 25886 * What we need to do here is the ip_newroute 25887 * logic to get the ire without doing the IPSEC 25888 * processing. Follow the same old path. But this 25889 * time, ip_wput or ire_add_then_send will call us 25890 * directly as all the IPSEC operations are done. 25891 */ 25892 ip1dbg(("ip_wput_ipsec_out_v6: IRE disappeared\n")); 25893 mp->b_prev = NULL; 25894 mp->b_next = NULL; 25895 25896 /* 25897 * If the IPsec packet was processed asynchronously, 25898 * drop it now. 25899 */ 25900 if (q == NULL) { 25901 if (ill_need_rele) 25902 ill_refrele(ill); 25903 freemsg(ipsec_mp); 25904 return; 25905 } 25906 25907 ip_newroute_v6(q, ipsec_mp, v6dstp, &ip6h->ip6_src, ill, 25908 zoneid, ipst); 25909 } 25910 if (ill != NULL && ill_need_rele) 25911 ill_refrele(ill); 25912 return; 25913 send: 25914 if (ill != NULL && ill_need_rele) 25915 ill_refrele(ill); 25916 25917 /* Local delivery */ 25918 if (ire->ire_stq == NULL) { 25919 ill_t *out_ill; 25920 ASSERT(q != NULL); 25921 25922 /* PFHooks: LOOPBACK_OUT */ 25923 out_ill = ire->ire_ipif->ipif_ill; 25924 25925 DTRACE_PROBE4(ip6__loopback__out__start, 25926 ill_t *, NULL, ill_t *, out_ill, 25927 ip6_t *, ip6h1, mblk_t *, ipsec_mp); 25928 25929 FW_HOOKS6(ipst->ips_ip6_loopback_out_event, 25930 ipst->ips_ipv6firewall_loopback_out, 25931 NULL, out_ill, ip6h1, ipsec_mp, mp, ipst); 25932 25933 DTRACE_PROBE1(ip6__loopback__out__end, mblk_t *, ipsec_mp); 25934 25935 if (ipsec_mp != NULL) 25936 ip_wput_local_v6(RD(q), out_ill, 25937 ip6h, ipsec_mp, ire, 0); 25938 if (ire_need_rele) 25939 ire_refrele(ire); 25940 return; 25941 } 25942 /* 25943 * Everything is done. Send it out on the wire. 25944 * We force the insertion of a fragment header using the 25945 * IPH_FRAG_HDR flag in two cases: 25946 * - after reception of an ICMPv6 "packet too big" message 25947 * with a MTU < 1280 (cf. RFC 2460 section 5) 25948 * - for multirouted IPv6 packets, so that the receiver can 25949 * discard duplicates according to their fragment identifier 25950 */ 25951 /* XXX fix flow control problems. */ 25952 if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN > ire->ire_max_frag || 25953 (ire->ire_frag_flag & IPH_FRAG_HDR)) { 25954 if (hwaccel) { 25955 /* 25956 * hardware acceleration does not handle these 25957 * "slow path" cases. 25958 */ 25959 /* IPsec KSTATS: should bump bean counter here. */ 25960 if (ire_need_rele) 25961 ire_refrele(ire); 25962 freemsg(ipsec_mp); 25963 return; 25964 } 25965 if (ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN != 25966 (mp->b_cont ? msgdsize(mp) : 25967 mp->b_wptr - (uchar_t *)ip6h)) { 25968 /* IPsec KSTATS: should bump bean counter here. */ 25969 ip0dbg(("Packet length mismatch: %d, %ld\n", 25970 ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN, 25971 msgdsize(mp))); 25972 if (ire_need_rele) 25973 ire_refrele(ire); 25974 freemsg(ipsec_mp); 25975 return; 25976 } 25977 ASSERT(mp->b_prev == NULL); 25978 ip2dbg(("Fragmenting Size = %d, mtu = %d\n", 25979 ntohs(ip6h->ip6_plen) + 25980 IPV6_HDR_LEN, ire->ire_max_frag)); 25981 ip_wput_frag_v6(mp, ire, flags, NULL, B_FALSE, 25982 ire->ire_max_frag); 25983 } else { 25984 UPDATE_OB_PKT_COUNT(ire); 25985 ire->ire_last_used_time = lbolt; 25986 ip_xmit_v6(mp, ire, flags, NULL, B_FALSE, hwaccel ? io : NULL); 25987 } 25988 if (ire_need_rele) 25989 ire_refrele(ire); 25990 freeb(ipsec_mp); 25991 } 25992 25993 void 25994 ipsec_hw_putnext(queue_t *q, mblk_t *mp) 25995 { 25996 mblk_t *hada_mp; /* attributes M_CTL mblk */ 25997 da_ipsec_t *hada; /* data attributes */ 25998 ill_t *ill = (ill_t *)q->q_ptr; 25999 26000 IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_hw_putnext: accelerated packet\n")); 26001 26002 if ((ill->ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)) == 0) { 26003 /* IPsec KSTATS: Bump lose counter here! */ 26004 freemsg(mp); 26005 return; 26006 } 26007 26008 /* 26009 * It's an IPsec packet that must be 26010 * accelerated by the Provider, and the 26011 * outbound ill is IPsec acceleration capable. 26012 * Prepends the mblk with an IPHADA_M_CTL, and ship it 26013 * to the ill. 26014 * IPsec KSTATS: should bump packet counter here. 26015 */ 26016 26017 hada_mp = allocb(sizeof (da_ipsec_t), BPRI_HI); 26018 if (hada_mp == NULL) { 26019 /* IPsec KSTATS: should bump packet counter here. */ 26020 freemsg(mp); 26021 return; 26022 } 26023 26024 hada_mp->b_datap->db_type = M_CTL; 26025 hada_mp->b_wptr = hada_mp->b_rptr + sizeof (*hada); 26026 hada_mp->b_cont = mp; 26027 26028 hada = (da_ipsec_t *)hada_mp->b_rptr; 26029 bzero(hada, sizeof (da_ipsec_t)); 26030 hada->da_type = IPHADA_M_CTL; 26031 26032 putnext(q, hada_mp); 26033 } 26034 26035 /* 26036 * Finish the outbound IPsec processing. This function is called from 26037 * ipsec_out_process() if the IPsec packet was processed 26038 * synchronously, or from {ah,esp}_kcf_callback() if it was processed 26039 * asynchronously. 26040 */ 26041 void 26042 ip_wput_ipsec_out(queue_t *q, mblk_t *ipsec_mp, ipha_t *ipha, ill_t *ill, 26043 ire_t *ire_arg) 26044 { 26045 uint32_t v_hlen_tos_len; 26046 ipaddr_t dst; 26047 ipif_t *ipif = NULL; 26048 ire_t *ire; 26049 ire_t *ire1 = NULL; 26050 mblk_t *next_mp = NULL; 26051 uint32_t max_frag; 26052 boolean_t multirt_send = B_FALSE; 26053 mblk_t *mp; 26054 mblk_t *mp1; 26055 ipha_t *ipha1; 26056 uint_t ill_index; 26057 ipsec_out_t *io; 26058 boolean_t attach_if; 26059 int match_flags, offset; 26060 irb_t *irb = NULL; 26061 boolean_t ill_need_rele = B_FALSE, ire_need_rele = B_TRUE; 26062 zoneid_t zoneid; 26063 uint32_t cksum; 26064 uint16_t *up; 26065 ipxmit_state_t pktxmit_state; 26066 ip_stack_t *ipst; 26067 26068 #ifdef _BIG_ENDIAN 26069 #define LENGTH (v_hlen_tos_len & 0xFFFF) 26070 #else 26071 #define LENGTH ((v_hlen_tos_len >> 24) | ((v_hlen_tos_len >> 8) & 0xFF00)) 26072 #endif 26073 26074 mp = ipsec_mp->b_cont; 26075 ipha1 = (ipha_t *)mp->b_rptr; 26076 ASSERT(mp != NULL); 26077 v_hlen_tos_len = ((uint32_t *)ipha)[0]; 26078 dst = ipha->ipha_dst; 26079 26080 io = (ipsec_out_t *)ipsec_mp->b_rptr; 26081 ill_index = io->ipsec_out_ill_index; 26082 attach_if = io->ipsec_out_attach_if; 26083 zoneid = io->ipsec_out_zoneid; 26084 ASSERT(zoneid != ALL_ZONES); 26085 ipst = io->ipsec_out_ns->netstack_ip; 26086 ASSERT(io->ipsec_out_ns != NULL); 26087 26088 match_flags = MATCH_IRE_ILL_GROUP | MATCH_IRE_SECATTR; 26089 if (ill_index != 0) { 26090 if (ill == NULL) { 26091 ill = ip_grab_attach_ill(NULL, ipsec_mp, 26092 ill_index, B_FALSE, ipst); 26093 26094 /* Failure case frees things for us. */ 26095 if (ill == NULL) 26096 return; 26097 26098 ill_need_rele = B_TRUE; 26099 } 26100 /* 26101 * If this packet needs to go out on a particular interface 26102 * honor it. 26103 */ 26104 if (attach_if) { 26105 match_flags = MATCH_IRE_ILL | MATCH_IRE_SECATTR; 26106 26107 /* 26108 * Check if we need an ire that will not be 26109 * looked up by anybody else i.e. HIDDEN. 26110 */ 26111 if (ill_is_probeonly(ill)) { 26112 match_flags |= MATCH_IRE_MARK_HIDDEN; 26113 } 26114 } 26115 } 26116 26117 if (CLASSD(dst)) { 26118 boolean_t conn_dontroute; 26119 /* 26120 * Use the ill_index to get the right ipif. 26121 */ 26122 conn_dontroute = io->ipsec_out_dontroute; 26123 if (ill_index == 0) 26124 ipif = ipif_lookup_group(dst, zoneid, ipst); 26125 else 26126 (void) ipif_lookup_zoneid(ill, zoneid, 0, &ipif); 26127 if (ipif == NULL) { 26128 ip1dbg(("ip_wput_ipsec_out: No ipif for" 26129 " multicast\n")); 26130 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes); 26131 freemsg(ipsec_mp); 26132 goto done; 26133 } 26134 /* 26135 * ipha_src has already been intialized with the 26136 * value of the ipif in ip_wput. All we need now is 26137 * an ire to send this downstream. 26138 */ 26139 ire = ire_ctable_lookup(dst, 0, 0, ipif, zoneid, 26140 MBLK_GETLABEL(mp), match_flags, ipst); 26141 if (ire != NULL) { 26142 ill_t *ill1; 26143 /* 26144 * Do the multicast forwarding now, as the IPSEC 26145 * processing has been done. 26146 */ 26147 if (ipst->ips_ip_g_mrouter && !conn_dontroute && 26148 (ill1 = ire_to_ill(ire))) { 26149 if (ip_mforward(ill1, ipha, mp)) { 26150 freemsg(ipsec_mp); 26151 ip1dbg(("ip_wput_ipsec_out: mforward " 26152 "failed\n")); 26153 ire_refrele(ire); 26154 goto done; 26155 } 26156 } 26157 goto send; 26158 } 26159 26160 ip0dbg(("ip_wput_ipsec_out: multicast: IRE disappeared\n")); 26161 mp->b_prev = NULL; 26162 mp->b_next = NULL; 26163 26164 /* 26165 * If the IPsec packet was processed asynchronously, 26166 * drop it now. 26167 */ 26168 if (q == NULL) { 26169 freemsg(ipsec_mp); 26170 goto done; 26171 } 26172 26173 /* 26174 * We may be using a wrong ipif to create the ire. 26175 * But it is okay as the source address is assigned 26176 * for the packet already. Next outbound packet would 26177 * create the IRE with the right IPIF in ip_wput. 26178 * 26179 * Also handle RTF_MULTIRT routes. 26180 */ 26181 ip_newroute_ipif(q, ipsec_mp, ipif, dst, NULL, RTF_MULTIRT, 26182 zoneid, &zero_info); 26183 } else { 26184 if (attach_if) { 26185 ire = ire_ctable_lookup(dst, 0, 0, ill->ill_ipif, 26186 zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 26187 } else { 26188 if (ire_arg != NULL) { 26189 ire = ire_arg; 26190 ire_need_rele = B_FALSE; 26191 } else { 26192 ire = ire_cache_lookup(dst, zoneid, 26193 MBLK_GETLABEL(mp), ipst); 26194 } 26195 } 26196 if (ire != NULL) { 26197 goto send; 26198 } 26199 26200 /* 26201 * ire disappeared underneath. 26202 * 26203 * What we need to do here is the ip_newroute 26204 * logic to get the ire without doing the IPSEC 26205 * processing. Follow the same old path. But this 26206 * time, ip_wput or ire_add_then_put will call us 26207 * directly as all the IPSEC operations are done. 26208 */ 26209 ip1dbg(("ip_wput_ipsec_out: IRE disappeared\n")); 26210 mp->b_prev = NULL; 26211 mp->b_next = NULL; 26212 26213 /* 26214 * If the IPsec packet was processed asynchronously, 26215 * drop it now. 26216 */ 26217 if (q == NULL) { 26218 freemsg(ipsec_mp); 26219 goto done; 26220 } 26221 26222 /* 26223 * Since we're going through ip_newroute() again, we 26224 * need to make sure we don't: 26225 * 26226 * 1.) Trigger the ASSERT() with the ipha_ident 26227 * overloading. 26228 * 2.) Redo transport-layer checksumming, since we've 26229 * already done all that to get this far. 26230 * 26231 * The easiest way not do either of the above is to set 26232 * the ipha_ident field to IP_HDR_INCLUDED. 26233 */ 26234 ipha->ipha_ident = IP_HDR_INCLUDED; 26235 ip_newroute(q, ipsec_mp, dst, NULL, 26236 (CONN_Q(q) ? Q_TO_CONN(q) : NULL), zoneid, ipst); 26237 } 26238 goto done; 26239 send: 26240 if (ipha->ipha_protocol == IPPROTO_UDP && 26241 udp_compute_checksum(ipst->ips_netstack)) { 26242 /* 26243 * ESP NAT-Traversal packet. 26244 * 26245 * Just do software checksum for now. 26246 */ 26247 26248 offset = IP_SIMPLE_HDR_LENGTH + UDP_CHECKSUM_OFFSET; 26249 IP_STAT(ipst, ip_out_sw_cksum); 26250 IP_STAT_UPDATE(ipst, ip_udp_out_sw_cksum_bytes, 26251 ntohs(htons(ipha->ipha_length) - IP_SIMPLE_HDR_LENGTH)); 26252 #define iphs ((uint16_t *)ipha) 26253 cksum = IP_UDP_CSUM_COMP + iphs[6] + iphs[7] + iphs[8] + 26254 iphs[9] + ntohs(htons(ipha->ipha_length) - 26255 IP_SIMPLE_HDR_LENGTH); 26256 #undef iphs 26257 if ((cksum = IP_CSUM(mp, IP_SIMPLE_HDR_LENGTH, cksum)) == 0) 26258 cksum = 0xFFFF; 26259 for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) 26260 if (mp1->b_wptr - mp1->b_rptr >= 26261 offset + sizeof (uint16_t)) { 26262 up = (uint16_t *)(mp1->b_rptr + offset); 26263 *up = cksum; 26264 break; /* out of for loop */ 26265 } else { 26266 offset -= (mp->b_wptr - mp->b_rptr); 26267 } 26268 } /* Otherwise, just keep the all-zero checksum. */ 26269 26270 if (ire->ire_stq == NULL) { 26271 ill_t *out_ill; 26272 /* 26273 * Loopbacks go through ip_wput_local except for one case. 26274 * We come here if we generate a icmp_frag_needed message 26275 * after IPSEC processing is over. When this function calls 26276 * ip_wput_ire_fragmentit, ip_wput_frag might end up calling 26277 * icmp_frag_needed. The message generated comes back here 26278 * through icmp_frag_needed -> icmp_pkt -> ip_wput -> 26279 * ipsec_out_process -> ip_wput_ipsec_out. We need to set the 26280 * source address as it is usually set in ip_wput_ire. As 26281 * ipsec_out_proc_begin is set, ip_wput calls ipsec_out_process 26282 * and we end up here. We can't enter ip_wput_ire once the 26283 * IPSEC processing is over and hence we need to do it here. 26284 */ 26285 ASSERT(q != NULL); 26286 UPDATE_OB_PKT_COUNT(ire); 26287 ire->ire_last_used_time = lbolt; 26288 if (ipha->ipha_src == 0) 26289 ipha->ipha_src = ire->ire_src_addr; 26290 26291 /* PFHooks: LOOPBACK_OUT */ 26292 out_ill = ire->ire_ipif->ipif_ill; 26293 26294 DTRACE_PROBE4(ip4__loopback__out__start, 26295 ill_t *, NULL, ill_t *, out_ill, 26296 ipha_t *, ipha1, mblk_t *, ipsec_mp); 26297 26298 FW_HOOKS(ipst->ips_ip4_loopback_out_event, 26299 ipst->ips_ipv4firewall_loopback_out, 26300 NULL, out_ill, ipha1, ipsec_mp, mp, ipst); 26301 26302 DTRACE_PROBE1(ip4__loopback__out__end, mblk_t *, ipsec_mp); 26303 26304 if (ipsec_mp != NULL) 26305 ip_wput_local(RD(q), out_ill, 26306 ipha, ipsec_mp, ire, 0, zoneid); 26307 if (ire_need_rele) 26308 ire_refrele(ire); 26309 goto done; 26310 } 26311 26312 if (ire->ire_max_frag < (unsigned int)LENGTH) { 26313 /* 26314 * We are through with IPSEC processing. 26315 * Fragment this and send it on the wire. 26316 */ 26317 if (io->ipsec_out_accelerated) { 26318 /* 26319 * The packet has been accelerated but must 26320 * be fragmented. This should not happen 26321 * since AH and ESP must not accelerate 26322 * packets that need fragmentation, however 26323 * the configuration could have changed 26324 * since the AH or ESP processing. 26325 * Drop packet. 26326 * IPsec KSTATS: bump bean counter here. 26327 */ 26328 IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_wput_ipsec_out: " 26329 "fragmented accelerated packet!\n")); 26330 freemsg(ipsec_mp); 26331 } else { 26332 ip_wput_ire_fragmentit(ipsec_mp, ire, zoneid, ipst); 26333 } 26334 if (ire_need_rele) 26335 ire_refrele(ire); 26336 goto done; 26337 } 26338 26339 ip2dbg(("ip_wput_ipsec_out: ipsec_mp %p, ire %p, ire_ipif %p, " 26340 "ipif %p\n", (void *)ipsec_mp, (void *)ire, 26341 (void *)ire->ire_ipif, (void *)ipif)); 26342 26343 /* 26344 * Multiroute the secured packet, unless IPsec really 26345 * requires the packet to go out only through a particular 26346 * interface. 26347 */ 26348 if ((ire->ire_flags & RTF_MULTIRT) && !attach_if) { 26349 ire_t *first_ire; 26350 irb = ire->ire_bucket; 26351 ASSERT(irb != NULL); 26352 /* 26353 * This ire has been looked up as the one that 26354 * goes through the given ipif; 26355 * make sure we do not omit any other multiroute ire 26356 * that may be present in the bucket before this one. 26357 */ 26358 IRB_REFHOLD(irb); 26359 for (first_ire = irb->irb_ire; 26360 first_ire != NULL; 26361 first_ire = first_ire->ire_next) { 26362 if ((first_ire->ire_flags & RTF_MULTIRT) && 26363 (first_ire->ire_addr == ire->ire_addr) && 26364 !(first_ire->ire_marks & 26365 (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN))) 26366 break; 26367 } 26368 26369 if ((first_ire != NULL) && (first_ire != ire)) { 26370 /* 26371 * Don't change the ire if the packet must 26372 * be fragmented if sent via this new one. 26373 */ 26374 if (first_ire->ire_max_frag >= (unsigned int)LENGTH) { 26375 IRE_REFHOLD(first_ire); 26376 if (ire_need_rele) 26377 ire_refrele(ire); 26378 else 26379 ire_need_rele = B_TRUE; 26380 ire = first_ire; 26381 } 26382 } 26383 IRB_REFRELE(irb); 26384 26385 multirt_send = B_TRUE; 26386 max_frag = ire->ire_max_frag; 26387 } else { 26388 if ((ire->ire_flags & RTF_MULTIRT) && attach_if) { 26389 ip1dbg(("ip_wput_ipsec_out: ignoring multirouting " 26390 "flag, attach_if %d\n", attach_if)); 26391 } 26392 } 26393 26394 /* 26395 * In most cases, the emission loop below is entered only once. 26396 * Only in the case where the ire holds the RTF_MULTIRT 26397 * flag, we loop to process all RTF_MULTIRT ires in the 26398 * bucket, and send the packet through all crossed 26399 * RTF_MULTIRT routes. 26400 */ 26401 do { 26402 if (multirt_send) { 26403 /* 26404 * ire1 holds here the next ire to process in the 26405 * bucket. If multirouting is expected, 26406 * any non-RTF_MULTIRT ire that has the 26407 * right destination address is ignored. 26408 */ 26409 ASSERT(irb != NULL); 26410 IRB_REFHOLD(irb); 26411 for (ire1 = ire->ire_next; 26412 ire1 != NULL; 26413 ire1 = ire1->ire_next) { 26414 if ((ire1->ire_flags & RTF_MULTIRT) == 0) 26415 continue; 26416 if (ire1->ire_addr != ire->ire_addr) 26417 continue; 26418 if (ire1->ire_marks & 26419 (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)) 26420 continue; 26421 /* No loopback here */ 26422 if (ire1->ire_stq == NULL) 26423 continue; 26424 /* 26425 * Ensure we do not exceed the MTU 26426 * of the next route. 26427 */ 26428 if (ire1->ire_max_frag < (unsigned int)LENGTH) { 26429 ip_multirt_bad_mtu(ire1, max_frag); 26430 continue; 26431 } 26432 26433 IRE_REFHOLD(ire1); 26434 break; 26435 } 26436 IRB_REFRELE(irb); 26437 if (ire1 != NULL) { 26438 /* 26439 * We are in a multiple send case, need to 26440 * make a copy of the packet. 26441 */ 26442 next_mp = copymsg(ipsec_mp); 26443 if (next_mp == NULL) { 26444 ire_refrele(ire1); 26445 ire1 = NULL; 26446 } 26447 } 26448 } 26449 /* 26450 * Everything is done. Send it out on the wire 26451 * 26452 * ip_xmit_v4 will call ip_wput_attach_llhdr and then 26453 * either send it on the wire or, in the case of 26454 * HW acceleration, call ipsec_hw_putnext. 26455 */ 26456 if (ire->ire_nce && 26457 ire->ire_nce->nce_state != ND_REACHABLE) { 26458 DTRACE_PROBE2(ip__wput__ipsec__bail, 26459 (ire_t *), ire, (mblk_t *), ipsec_mp); 26460 /* 26461 * If ire's link-layer is unresolved (this 26462 * would only happen if the incomplete ire 26463 * was added to cachetable via forwarding path) 26464 * don't bother going to ip_xmit_v4. Just drop the 26465 * packet. 26466 * There is a slight risk here, in that, if we 26467 * have the forwarding path create an incomplete 26468 * IRE, then until the IRE is completed, any 26469 * transmitted IPSEC packets will be dropped 26470 * instead of being queued waiting for resolution. 26471 * 26472 * But the likelihood of a forwarding packet and a wput 26473 * packet sending to the same dst at the same time 26474 * and there not yet be an ARP entry for it is small. 26475 * Furthermore, if this actually happens, it might 26476 * be likely that wput would generate multiple 26477 * packets (and forwarding would also have a train 26478 * of packets) for that destination. If this is 26479 * the case, some of them would have been dropped 26480 * anyway, since ARP only queues a few packets while 26481 * waiting for resolution 26482 * 26483 * NOTE: We should really call ip_xmit_v4, 26484 * and let it queue the packet and send the 26485 * ARP query and have ARP come back thus: 26486 * <ARP> ip_wput->ip_output->ip-wput_nondata-> 26487 * ip_xmit_v4->ip_wput_attach_llhdr + ipsec 26488 * hw accel work. But it's too complex to get 26489 * the IPsec hw acceleration approach to fit 26490 * well with ip_xmit_v4 doing ARP without 26491 * doing IPSEC simplification. For now, we just 26492 * poke ip_xmit_v4 to trigger the arp resolve, so 26493 * that we can continue with the send on the next 26494 * attempt. 26495 * 26496 * XXX THis should be revisited, when 26497 * the IPsec/IP interaction is cleaned up 26498 */ 26499 ip1dbg(("ip_wput_ipsec_out: ire is incomplete" 26500 " - dropping packet\n")); 26501 freemsg(ipsec_mp); 26502 /* 26503 * Call ip_xmit_v4() to trigger ARP query 26504 * in case the nce_state is ND_INITIAL 26505 */ 26506 (void) ip_xmit_v4(NULL, ire, NULL, B_FALSE); 26507 goto drop_pkt; 26508 } 26509 26510 DTRACE_PROBE4(ip4__physical__out__start, ill_t *, NULL, 26511 ill_t *, ire->ire_ipif->ipif_ill, ipha_t *, ipha1, 26512 mblk_t *, mp); 26513 FW_HOOKS(ipst->ips_ip4_physical_out_event, 26514 ipst->ips_ipv4firewall_physical_out, 26515 NULL, ire->ire_ipif->ipif_ill, ipha1, mp, mp, ipst); 26516 DTRACE_PROBE1(ip4__physical__out__end, mblk_t *, mp); 26517 if (mp == NULL) 26518 goto drop_pkt; 26519 26520 ip1dbg(("ip_wput_ipsec_out: calling ip_xmit_v4\n")); 26521 pktxmit_state = ip_xmit_v4(mp, ire, 26522 (io->ipsec_out_accelerated ? io : NULL), B_FALSE); 26523 26524 if ((pktxmit_state == SEND_FAILED) || 26525 (pktxmit_state == LLHDR_RESLV_FAILED)) { 26526 26527 freeb(ipsec_mp); /* ip_xmit_v4 frees the mp */ 26528 drop_pkt: 26529 BUMP_MIB(((ill_t *)ire->ire_stq->q_ptr)->ill_ip_mib, 26530 ipIfStatsOutDiscards); 26531 if (ire_need_rele) 26532 ire_refrele(ire); 26533 if (ire1 != NULL) { 26534 ire_refrele(ire1); 26535 freemsg(next_mp); 26536 } 26537 goto done; 26538 } 26539 26540 freeb(ipsec_mp); 26541 if (ire_need_rele) 26542 ire_refrele(ire); 26543 26544 if (ire1 != NULL) { 26545 ire = ire1; 26546 ire_need_rele = B_TRUE; 26547 ASSERT(next_mp); 26548 ipsec_mp = next_mp; 26549 mp = ipsec_mp->b_cont; 26550 ire1 = NULL; 26551 next_mp = NULL; 26552 io = (ipsec_out_t *)ipsec_mp->b_rptr; 26553 } else { 26554 multirt_send = B_FALSE; 26555 } 26556 } while (multirt_send); 26557 done: 26558 if (ill != NULL && ill_need_rele) 26559 ill_refrele(ill); 26560 if (ipif != NULL) 26561 ipif_refrele(ipif); 26562 } 26563 26564 /* 26565 * Get the ill corresponding to the specified ire, and compare its 26566 * capabilities with the protocol and algorithms specified by the 26567 * the SA obtained from ipsec_out. If they match, annotate the 26568 * ipsec_out structure to indicate that the packet needs acceleration. 26569 * 26570 * 26571 * A packet is eligible for outbound hardware acceleration if the 26572 * following conditions are satisfied: 26573 * 26574 * 1. the packet will not be fragmented 26575 * 2. the provider supports the algorithm 26576 * 3. there is no pending control message being exchanged 26577 * 4. snoop is not attached 26578 * 5. the destination address is not a broadcast or multicast address. 26579 * 26580 * Rationale: 26581 * - Hardware drivers do not support fragmentation with 26582 * the current interface. 26583 * - snoop, multicast, and broadcast may result in exposure of 26584 * a cleartext datagram. 26585 * We check all five of these conditions here. 26586 * 26587 * XXX would like to nuke "ire_t *" parameter here; problem is that 26588 * IRE is only way to figure out if a v4 address is a broadcast and 26589 * thus ineligible for acceleration... 26590 */ 26591 static void 26592 ipsec_out_is_accelerated(mblk_t *ipsec_mp, ipsa_t *sa, ill_t *ill, ire_t *ire) 26593 { 26594 ipsec_out_t *io; 26595 mblk_t *data_mp; 26596 uint_t plen, overhead; 26597 ip_stack_t *ipst; 26598 26599 if ((sa->ipsa_flags & IPSA_F_HW) == 0) 26600 return; 26601 26602 if (ill == NULL) 26603 return; 26604 ipst = ill->ill_ipst; 26605 /* 26606 * Destination address is a broadcast or multicast. Punt. 26607 */ 26608 if ((ire != NULL) && (ire->ire_type & (IRE_BROADCAST|IRE_LOOPBACK| 26609 IRE_LOCAL))) 26610 return; 26611 26612 data_mp = ipsec_mp->b_cont; 26613 26614 if (ill->ill_isv6) { 26615 ip6_t *ip6h = (ip6_t *)data_mp->b_rptr; 26616 26617 if (IN6_IS_ADDR_MULTICAST(&ip6h->ip6_dst)) 26618 return; 26619 26620 plen = ip6h->ip6_plen; 26621 } else { 26622 ipha_t *ipha = (ipha_t *)data_mp->b_rptr; 26623 26624 if (CLASSD(ipha->ipha_dst)) 26625 return; 26626 26627 plen = ipha->ipha_length; 26628 } 26629 /* 26630 * Is there a pending DLPI control message being exchanged 26631 * between IP/IPsec and the DLS Provider? If there is, it 26632 * could be a SADB update, and the state of the DLS Provider 26633 * SADB might not be in sync with the SADB maintained by 26634 * IPsec. To avoid dropping packets or using the wrong keying 26635 * material, we do not accelerate this packet. 26636 */ 26637 if (ill->ill_dlpi_pending != DL_PRIM_INVAL) { 26638 IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_out_check_is_accelerated: " 26639 "ill_dlpi_pending! don't accelerate packet\n")); 26640 return; 26641 } 26642 26643 /* 26644 * Is the Provider in promiscous mode? If it does, we don't 26645 * accelerate the packet since it will bounce back up to the 26646 * listeners in the clear. 26647 */ 26648 if (ill->ill_promisc_on_phys) { 26649 IPSECHW_DEBUG(IPSECHW_PKT, ("ipsec_out_check_is_accelerated: " 26650 "ill in promiscous mode, don't accelerate packet\n")); 26651 return; 26652 } 26653 26654 /* 26655 * Will the packet require fragmentation? 26656 */ 26657 26658 /* 26659 * IPsec ESP note: this is a pessimistic estimate, but the same 26660 * as is used elsewhere. 26661 * SPI + sequence + MAC + IV(blocksize) + padding(blocksize-1) 26662 * + 2-byte trailer 26663 */ 26664 overhead = (sa->ipsa_type == SADB_SATYPE_AH) ? IPSEC_MAX_AH_HDR_SIZE : 26665 IPSEC_BASE_ESP_HDR_SIZE(sa); 26666 26667 if ((plen + overhead) > ill->ill_max_mtu) 26668 return; 26669 26670 io = (ipsec_out_t *)ipsec_mp->b_rptr; 26671 26672 /* 26673 * Can the ill accelerate this IPsec protocol and algorithm 26674 * specified by the SA? 26675 */ 26676 if (!ipsec_capab_match(ill, io->ipsec_out_capab_ill_index, 26677 ill->ill_isv6, sa, ipst->ips_netstack)) { 26678 return; 26679 } 26680 26681 /* 26682 * Tell AH or ESP that the outbound ill is capable of 26683 * accelerating this packet. 26684 */ 26685 io->ipsec_out_is_capab_ill = B_TRUE; 26686 } 26687 26688 /* 26689 * Select which AH & ESP SA's to use (if any) for the outbound packet. 26690 * 26691 * If this function returns B_TRUE, the requested SA's have been filled 26692 * into the ipsec_out_*_sa pointers. 26693 * 26694 * If the function returns B_FALSE, the packet has been "consumed", most 26695 * likely by an ACQUIRE sent up via PF_KEY to a key management daemon. 26696 * 26697 * The SA references created by the protocol-specific "select" 26698 * function will be released when the ipsec_mp is freed, thanks to the 26699 * ipsec_out_free destructor -- see spd.c. 26700 */ 26701 static boolean_t 26702 ipsec_out_select_sa(mblk_t *ipsec_mp) 26703 { 26704 boolean_t need_ah_acquire = B_FALSE, need_esp_acquire = B_FALSE; 26705 ipsec_out_t *io; 26706 ipsec_policy_t *pp; 26707 ipsec_action_t *ap; 26708 io = (ipsec_out_t *)ipsec_mp->b_rptr; 26709 ASSERT(io->ipsec_out_type == IPSEC_OUT); 26710 ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t)); 26711 26712 if (!io->ipsec_out_secure) { 26713 /* 26714 * We came here by mistake. 26715 * Don't bother with ipsec processing 26716 * We should "discourage" this path in the future. 26717 */ 26718 ASSERT(io->ipsec_out_proc_begin == B_FALSE); 26719 return (B_FALSE); 26720 } 26721 ASSERT(io->ipsec_out_need_policy == B_FALSE); 26722 ASSERT((io->ipsec_out_policy != NULL) || 26723 (io->ipsec_out_act != NULL)); 26724 26725 ASSERT(io->ipsec_out_failed == B_FALSE); 26726 26727 /* 26728 * IPSEC processing has started. 26729 */ 26730 io->ipsec_out_proc_begin = B_TRUE; 26731 ap = io->ipsec_out_act; 26732 if (ap == NULL) { 26733 pp = io->ipsec_out_policy; 26734 ASSERT(pp != NULL); 26735 ap = pp->ipsp_act; 26736 ASSERT(ap != NULL); 26737 } 26738 26739 /* 26740 * We have an action. now, let's select SA's. 26741 * (In the future, we can cache this in the conn_t..) 26742 */ 26743 if (ap->ipa_want_esp) { 26744 if (io->ipsec_out_esp_sa == NULL) { 26745 need_esp_acquire = !ipsec_outbound_sa(ipsec_mp, 26746 IPPROTO_ESP); 26747 } 26748 ASSERT(need_esp_acquire || io->ipsec_out_esp_sa != NULL); 26749 } 26750 26751 if (ap->ipa_want_ah) { 26752 if (io->ipsec_out_ah_sa == NULL) { 26753 need_ah_acquire = !ipsec_outbound_sa(ipsec_mp, 26754 IPPROTO_AH); 26755 } 26756 ASSERT(need_ah_acquire || io->ipsec_out_ah_sa != NULL); 26757 /* 26758 * The ESP and AH processing order needs to be preserved 26759 * when both protocols are required (ESP should be applied 26760 * before AH for an outbound packet). Force an ESP ACQUIRE 26761 * when both ESP and AH are required, and an AH ACQUIRE 26762 * is needed. 26763 */ 26764 if (ap->ipa_want_esp && need_ah_acquire) 26765 need_esp_acquire = B_TRUE; 26766 } 26767 26768 /* 26769 * Send an ACQUIRE (extended, regular, or both) if we need one. 26770 * Release SAs that got referenced, but will not be used until we 26771 * acquire _all_ of the SAs we need. 26772 */ 26773 if (need_ah_acquire || need_esp_acquire) { 26774 if (io->ipsec_out_ah_sa != NULL) { 26775 IPSA_REFRELE(io->ipsec_out_ah_sa); 26776 io->ipsec_out_ah_sa = NULL; 26777 } 26778 if (io->ipsec_out_esp_sa != NULL) { 26779 IPSA_REFRELE(io->ipsec_out_esp_sa); 26780 io->ipsec_out_esp_sa = NULL; 26781 } 26782 26783 sadb_acquire(ipsec_mp, io, need_ah_acquire, need_esp_acquire); 26784 return (B_FALSE); 26785 } 26786 26787 return (B_TRUE); 26788 } 26789 26790 /* 26791 * Process an IPSEC_OUT message and see what you can 26792 * do with it. 26793 * IPQoS Notes: 26794 * We do IPPF processing if IPP_LOCAL_OUT is enabled before processing for 26795 * IPSec. 26796 * XXX would like to nuke ire_t. 26797 * XXX ill_index better be "real" 26798 */ 26799 void 26800 ipsec_out_process(queue_t *q, mblk_t *ipsec_mp, ire_t *ire, uint_t ill_index) 26801 { 26802 ipsec_out_t *io; 26803 ipsec_policy_t *pp; 26804 ipsec_action_t *ap; 26805 ipha_t *ipha; 26806 ip6_t *ip6h; 26807 mblk_t *mp; 26808 ill_t *ill; 26809 zoneid_t zoneid; 26810 ipsec_status_t ipsec_rc; 26811 boolean_t ill_need_rele = B_FALSE; 26812 ip_stack_t *ipst; 26813 ipsec_stack_t *ipss; 26814 26815 io = (ipsec_out_t *)ipsec_mp->b_rptr; 26816 ASSERT(io->ipsec_out_type == IPSEC_OUT); 26817 ASSERT(io->ipsec_out_len == sizeof (ipsec_out_t)); 26818 ipst = io->ipsec_out_ns->netstack_ip; 26819 mp = ipsec_mp->b_cont; 26820 26821 /* 26822 * Initiate IPPF processing. We do it here to account for packets 26823 * coming here that don't have any policy (i.e. !io->ipsec_out_secure). 26824 * We can check for ipsec_out_proc_begin even for such packets, as 26825 * they will always be false (asserted below). 26826 */ 26827 if (IPP_ENABLED(IPP_LOCAL_OUT, ipst) && !io->ipsec_out_proc_begin) { 26828 ip_process(IPP_LOCAL_OUT, &mp, io->ipsec_out_ill_index != 0 ? 26829 io->ipsec_out_ill_index : ill_index); 26830 if (mp == NULL) { 26831 ip2dbg(("ipsec_out_process: packet dropped "\ 26832 "during IPPF processing\n")); 26833 freeb(ipsec_mp); 26834 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 26835 return; 26836 } 26837 } 26838 26839 if (!io->ipsec_out_secure) { 26840 /* 26841 * We came here by mistake. 26842 * Don't bother with ipsec processing 26843 * Should "discourage" this path in the future. 26844 */ 26845 ASSERT(io->ipsec_out_proc_begin == B_FALSE); 26846 goto done; 26847 } 26848 ASSERT(io->ipsec_out_need_policy == B_FALSE); 26849 ASSERT((io->ipsec_out_policy != NULL) || 26850 (io->ipsec_out_act != NULL)); 26851 ASSERT(io->ipsec_out_failed == B_FALSE); 26852 26853 ipss = ipst->ips_netstack->netstack_ipsec; 26854 if (!ipsec_loaded(ipss)) { 26855 ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr; 26856 if (IPH_HDR_VERSION(ipha) == IP_VERSION) { 26857 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 26858 } else { 26859 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards); 26860 } 26861 ip_drop_packet(ipsec_mp, B_FALSE, NULL, ire, 26862 DROPPER(ipss, ipds_ip_ipsec_not_loaded), 26863 &ipss->ipsec_dropper); 26864 return; 26865 } 26866 26867 /* 26868 * IPSEC processing has started. 26869 */ 26870 io->ipsec_out_proc_begin = B_TRUE; 26871 ap = io->ipsec_out_act; 26872 if (ap == NULL) { 26873 pp = io->ipsec_out_policy; 26874 ASSERT(pp != NULL); 26875 ap = pp->ipsp_act; 26876 ASSERT(ap != NULL); 26877 } 26878 26879 /* 26880 * Save the outbound ill index. When the packet comes back 26881 * from IPsec, we make sure the ill hasn't changed or disappeared 26882 * before sending it the accelerated packet. 26883 */ 26884 if ((ire != NULL) && (io->ipsec_out_capab_ill_index == 0)) { 26885 int ifindex; 26886 ill = ire_to_ill(ire); 26887 ifindex = ill->ill_phyint->phyint_ifindex; 26888 io->ipsec_out_capab_ill_index = ifindex; 26889 } 26890 26891 /* 26892 * The order of processing is first insert a IP header if needed. 26893 * Then insert the ESP header and then the AH header. 26894 */ 26895 if ((io->ipsec_out_se_done == B_FALSE) && 26896 (ap->ipa_want_se)) { 26897 /* 26898 * First get the outer IP header before sending 26899 * it to ESP. 26900 */ 26901 ipha_t *oipha, *iipha; 26902 mblk_t *outer_mp, *inner_mp; 26903 26904 if ((outer_mp = allocb(sizeof (ipha_t), BPRI_HI)) == NULL) { 26905 (void) mi_strlog(q, 0, SL_ERROR|SL_TRACE|SL_CONSOLE, 26906 "ipsec_out_process: " 26907 "Self-Encapsulation failed: Out of memory\n"); 26908 freemsg(ipsec_mp); 26909 if (ill != NULL) { 26910 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 26911 } else { 26912 BUMP_MIB(&ipst->ips_ip_mib, 26913 ipIfStatsOutDiscards); 26914 } 26915 return; 26916 } 26917 inner_mp = ipsec_mp->b_cont; 26918 ASSERT(inner_mp->b_datap->db_type == M_DATA); 26919 oipha = (ipha_t *)outer_mp->b_rptr; 26920 iipha = (ipha_t *)inner_mp->b_rptr; 26921 *oipha = *iipha; 26922 outer_mp->b_wptr += sizeof (ipha_t); 26923 oipha->ipha_length = htons(ntohs(iipha->ipha_length) + 26924 sizeof (ipha_t)); 26925 oipha->ipha_protocol = IPPROTO_ENCAP; 26926 oipha->ipha_version_and_hdr_length = 26927 IP_SIMPLE_HDR_VERSION; 26928 oipha->ipha_hdr_checksum = 0; 26929 oipha->ipha_hdr_checksum = ip_csum_hdr(oipha); 26930 outer_mp->b_cont = inner_mp; 26931 ipsec_mp->b_cont = outer_mp; 26932 26933 io->ipsec_out_se_done = B_TRUE; 26934 io->ipsec_out_tunnel = B_TRUE; 26935 } 26936 26937 if (((ap->ipa_want_ah && (io->ipsec_out_ah_sa == NULL)) || 26938 (ap->ipa_want_esp && (io->ipsec_out_esp_sa == NULL))) && 26939 !ipsec_out_select_sa(ipsec_mp)) 26940 return; 26941 26942 /* 26943 * By now, we know what SA's to use. Toss over to ESP & AH 26944 * to do the heavy lifting. 26945 */ 26946 zoneid = io->ipsec_out_zoneid; 26947 ASSERT(zoneid != ALL_ZONES); 26948 if ((io->ipsec_out_esp_done == B_FALSE) && (ap->ipa_want_esp)) { 26949 ASSERT(io->ipsec_out_esp_sa != NULL); 26950 io->ipsec_out_esp_done = B_TRUE; 26951 /* 26952 * Note that since hw accel can only apply one transform, 26953 * not two, we skip hw accel for ESP if we also have AH 26954 * This is an design limitation of the interface 26955 * which should be revisited. 26956 */ 26957 ASSERT(ire != NULL); 26958 if (io->ipsec_out_ah_sa == NULL) { 26959 ill = (ill_t *)ire->ire_stq->q_ptr; 26960 ipsec_out_is_accelerated(ipsec_mp, 26961 io->ipsec_out_esp_sa, ill, ire); 26962 } 26963 26964 ipsec_rc = io->ipsec_out_esp_sa->ipsa_output_func(ipsec_mp); 26965 switch (ipsec_rc) { 26966 case IPSEC_STATUS_SUCCESS: 26967 break; 26968 case IPSEC_STATUS_FAILED: 26969 if (ill != NULL) { 26970 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 26971 } else { 26972 BUMP_MIB(&ipst->ips_ip_mib, 26973 ipIfStatsOutDiscards); 26974 } 26975 /* FALLTHRU */ 26976 case IPSEC_STATUS_PENDING: 26977 return; 26978 } 26979 } 26980 26981 if ((io->ipsec_out_ah_done == B_FALSE) && (ap->ipa_want_ah)) { 26982 ASSERT(io->ipsec_out_ah_sa != NULL); 26983 io->ipsec_out_ah_done = B_TRUE; 26984 if (ire == NULL) { 26985 int idx = io->ipsec_out_capab_ill_index; 26986 ill = ill_lookup_on_ifindex(idx, B_FALSE, 26987 NULL, NULL, NULL, NULL, ipst); 26988 ill_need_rele = B_TRUE; 26989 } else { 26990 ill = (ill_t *)ire->ire_stq->q_ptr; 26991 } 26992 ipsec_out_is_accelerated(ipsec_mp, io->ipsec_out_ah_sa, ill, 26993 ire); 26994 26995 ipsec_rc = io->ipsec_out_ah_sa->ipsa_output_func(ipsec_mp); 26996 switch (ipsec_rc) { 26997 case IPSEC_STATUS_SUCCESS: 26998 break; 26999 case IPSEC_STATUS_FAILED: 27000 if (ill != NULL) { 27001 BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards); 27002 } else { 27003 BUMP_MIB(&ipst->ips_ip_mib, 27004 ipIfStatsOutDiscards); 27005 } 27006 /* FALLTHRU */ 27007 case IPSEC_STATUS_PENDING: 27008 if (ill != NULL && ill_need_rele) 27009 ill_refrele(ill); 27010 return; 27011 } 27012 } 27013 /* 27014 * We are done with IPSEC processing. Send it over 27015 * the wire. 27016 */ 27017 done: 27018 mp = ipsec_mp->b_cont; 27019 ipha = (ipha_t *)mp->b_rptr; 27020 if (IPH_HDR_VERSION(ipha) == IP_VERSION) { 27021 ip_wput_ipsec_out(q, ipsec_mp, ipha, ill, ire); 27022 } else { 27023 ip6h = (ip6_t *)ipha; 27024 ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h, ill, ire); 27025 } 27026 if (ill != NULL && ill_need_rele) 27027 ill_refrele(ill); 27028 } 27029 27030 /* ARGSUSED */ 27031 void 27032 ip_restart_optmgmt(ipsq_t *dummy_sq, queue_t *q, mblk_t *first_mp, void *dummy) 27033 { 27034 opt_restart_t *or; 27035 int err; 27036 conn_t *connp; 27037 27038 ASSERT(CONN_Q(q)); 27039 connp = Q_TO_CONN(q); 27040 27041 ASSERT(first_mp->b_datap->db_type == M_CTL); 27042 or = (opt_restart_t *)first_mp->b_rptr; 27043 /* 27044 * We don't need to pass any credentials here since this is just 27045 * a restart. The credentials are passed in when svr4_optcom_req 27046 * is called the first time (from ip_wput_nondata). 27047 */ 27048 if (or->or_type == T_SVR4_OPTMGMT_REQ) { 27049 err = svr4_optcom_req(q, first_mp, NULL, 27050 &ip_opt_obj); 27051 } else { 27052 ASSERT(or->or_type == T_OPTMGMT_REQ); 27053 err = tpi_optcom_req(q, first_mp, NULL, 27054 &ip_opt_obj); 27055 } 27056 if (err != EINPROGRESS) { 27057 /* operation is done */ 27058 CONN_OPER_PENDING_DONE(connp); 27059 } 27060 } 27061 27062 /* 27063 * ioctls that go through a down/up sequence may need to wait for the down 27064 * to complete. This involves waiting for the ire and ipif refcnts to go down 27065 * to zero. Subsequently the ioctl is restarted from ipif_ill_refrele_tail. 27066 */ 27067 /* ARGSUSED */ 27068 void 27069 ip_reprocess_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 27070 { 27071 struct iocblk *iocp; 27072 mblk_t *mp1; 27073 ip_ioctl_cmd_t *ipip; 27074 int err; 27075 sin_t *sin; 27076 struct lifreq *lifr; 27077 struct ifreq *ifr; 27078 27079 iocp = (struct iocblk *)mp->b_rptr; 27080 ASSERT(ipsq != NULL); 27081 /* Existence of mp1 verified in ip_wput_nondata */ 27082 mp1 = mp->b_cont->b_cont; 27083 ipip = ip_sioctl_lookup(iocp->ioc_cmd); 27084 if (ipip->ipi_cmd == SIOCSLIFNAME || ipip->ipi_cmd == IF_UNITSEL) { 27085 /* 27086 * Special case where ipsq_current_ipif is not set: 27087 * ill_phyint_reinit merged the v4 and v6 into a single ipsq. 27088 * ill could also have become part of a ipmp group in the 27089 * process, we are here as were not able to complete the 27090 * operation in ipif_set_values because we could not become 27091 * exclusive on the new ipsq, In such a case ipsq_current_ipif 27092 * will not be set so we need to set it. 27093 */ 27094 ill_t *ill = q->q_ptr; 27095 ipsq_current_start(ipsq, ill->ill_ipif, ipip->ipi_cmd); 27096 } 27097 ASSERT(ipsq->ipsq_current_ipif != NULL); 27098 27099 if (ipip->ipi_cmd_type == IF_CMD) { 27100 /* This a old style SIOC[GS]IF* command */ 27101 ifr = (struct ifreq *)mp1->b_rptr; 27102 sin = (sin_t *)&ifr->ifr_addr; 27103 } else if (ipip->ipi_cmd_type == LIF_CMD) { 27104 /* This a new style SIOC[GS]LIF* command */ 27105 lifr = (struct lifreq *)mp1->b_rptr; 27106 sin = (sin_t *)&lifr->lifr_addr; 27107 } else { 27108 sin = NULL; 27109 } 27110 27111 err = (*ipip->ipi_func_restart)(ipsq->ipsq_current_ipif, sin, q, mp, 27112 ipip, mp1->b_rptr); 27113 27114 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq); 27115 } 27116 27117 /* 27118 * ioctl processing 27119 * 27120 * ioctl processing starts with ip_sioctl_copyin_setup which looks up 27121 * the ioctl command in the ioctl tables and determines the copyin data size 27122 * from the ioctl property ipi_copyin_size, and does an mi_copyin() of that 27123 * size. 27124 * 27125 * ioctl processing then continues when the M_IOCDATA makes its way down. 27126 * Now the ioctl is looked up again in the ioctl table, and its properties are 27127 * extracted. The associated 'conn' is then refheld till the end of the ioctl 27128 * and the general ioctl processing function ip_process_ioctl is called. 27129 * ip_process_ioctl determines if the ioctl needs to be serialized, and if 27130 * so goes thru the serialization primitive ipsq_try_enter. Then the 27131 * appropriate function to handle the ioctl is called based on the entry in 27132 * the ioctl table. ioctl completion is encapsulated in ip_ioctl_finish 27133 * which also refreleases the 'conn' that was refheld at the start of the 27134 * ioctl. Finally ipsq_exit is called if needed to exit the ipsq. 27135 * ip_extract_lifreq_cmn extracts the interface name from the lifreq/ifreq 27136 * struct and looks up the ipif. ip_extract_tunreq handles the case of tunnel. 27137 * 27138 * Many exclusive ioctls go thru an internal down up sequence as part of 27139 * the operation. For example an attempt to change the IP address of an 27140 * ipif entails ipif_down, set address, ipif_up. Bringing down the interface 27141 * does all the cleanup such as deleting all ires that use this address. 27142 * Then we need to wait till all references to the interface go away. 27143 */ 27144 void 27145 ip_process_ioctl(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg) 27146 { 27147 struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 27148 ip_ioctl_cmd_t *ipip = (ip_ioctl_cmd_t *)arg; 27149 cmd_info_t ci; 27150 int err; 27151 boolean_t entered_ipsq = B_FALSE; 27152 27153 ip3dbg(("ip_process_ioctl: ioctl %X\n", iocp->ioc_cmd)); 27154 27155 if (ipip == NULL) 27156 ipip = ip_sioctl_lookup(iocp->ioc_cmd); 27157 27158 /* 27159 * SIOCLIFADDIF needs to go thru a special path since the 27160 * ill may not exist yet. This happens in the case of lo0 27161 * which is created using this ioctl. 27162 */ 27163 if (ipip->ipi_cmd == SIOCLIFADDIF) { 27164 err = ip_sioctl_addif(NULL, NULL, q, mp, NULL, NULL); 27165 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 27166 return; 27167 } 27168 27169 ci.ci_ipif = NULL; 27170 switch (ipip->ipi_cmd_type) { 27171 case IF_CMD: 27172 case LIF_CMD: 27173 /* 27174 * ioctls that pass in a [l]ifreq appear here. 27175 * ip_extract_lifreq_cmn returns a refheld ipif in 27176 * ci.ci_ipif 27177 */ 27178 err = ip_extract_lifreq_cmn(q, mp, ipip->ipi_cmd_type, 27179 ipip->ipi_flags, &ci, ip_process_ioctl); 27180 if (err != 0) { 27181 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 27182 return; 27183 } 27184 ASSERT(ci.ci_ipif != NULL); 27185 break; 27186 27187 case TUN_CMD: 27188 /* 27189 * SIOC[GS]TUNPARAM appear here. ip_extract_tunreq returns 27190 * a refheld ipif in ci.ci_ipif 27191 */ 27192 err = ip_extract_tunreq(q, mp, &ci.ci_ipif, ip_process_ioctl); 27193 if (err != 0) { 27194 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 27195 return; 27196 } 27197 ASSERT(ci.ci_ipif != NULL); 27198 break; 27199 27200 case MISC_CMD: 27201 /* 27202 * ioctls that neither pass in [l]ifreq or iftun_req come here 27203 * For eg. SIOCGLIFCONF will appear here. 27204 */ 27205 switch (ipip->ipi_cmd) { 27206 case IF_UNITSEL: 27207 /* ioctl comes down the ill */ 27208 ci.ci_ipif = ((ill_t *)q->q_ptr)->ill_ipif; 27209 ipif_refhold(ci.ci_ipif); 27210 break; 27211 case SIOCGMSFILTER: 27212 case SIOCSMSFILTER: 27213 case SIOCGIPMSFILTER: 27214 case SIOCSIPMSFILTER: 27215 err = ip_extract_msfilter(q, mp, &ci.ci_ipif, 27216 ip_process_ioctl); 27217 if (err != 0) { 27218 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), 27219 NULL); 27220 } 27221 break; 27222 } 27223 err = 0; 27224 ci.ci_sin = NULL; 27225 ci.ci_sin6 = NULL; 27226 ci.ci_lifr = NULL; 27227 break; 27228 } 27229 27230 /* 27231 * If ipsq is non-null, we are already being called exclusively 27232 */ 27233 ASSERT(ipsq == NULL || IAM_WRITER_IPSQ(ipsq)); 27234 if (!(ipip->ipi_flags & IPI_WR)) { 27235 /* 27236 * A return value of EINPROGRESS means the ioctl is 27237 * either queued and waiting for some reason or has 27238 * already completed. 27239 */ 27240 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, 27241 ci.ci_lifr); 27242 if (ci.ci_ipif != NULL) 27243 ipif_refrele(ci.ci_ipif); 27244 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), NULL); 27245 return; 27246 } 27247 27248 ASSERT(ci.ci_ipif != NULL); 27249 27250 if (ipsq == NULL) { 27251 ipsq = ipsq_try_enter(ci.ci_ipif, NULL, q, mp, 27252 ip_process_ioctl, NEW_OP, B_TRUE); 27253 entered_ipsq = B_TRUE; 27254 } 27255 /* 27256 * Release the ipif so that ipif_down and friends that wait for 27257 * references to go away are not misled about the current ipif_refcnt 27258 * values. We are writer so we can access the ipif even after releasing 27259 * the ipif. 27260 */ 27261 ipif_refrele(ci.ci_ipif); 27262 if (ipsq == NULL) 27263 return; 27264 27265 ipsq_current_start(ipsq, ci.ci_ipif, ipip->ipi_cmd); 27266 27267 /* 27268 * For most set ioctls that come here, this serves as a single point 27269 * where we set the IPIF_CHANGING flag. This ensures that there won't 27270 * be any new references to the ipif. This helps functions that go 27271 * through this path and end up trying to wait for the refcnts 27272 * associated with the ipif to go down to zero. Some exceptions are 27273 * Failover, Failback, and Groupname commands that operate on more than 27274 * just the ci.ci_ipif. These commands internally determine the 27275 * set of ipif's they operate on and set and clear the IPIF_CHANGING 27276 * flags on that set. Another exception is the Removeif command that 27277 * sets the IPIF_CONDEMNED flag internally after identifying the right 27278 * ipif to operate on. 27279 */ 27280 mutex_enter(&(ci.ci_ipif)->ipif_ill->ill_lock); 27281 if (ipip->ipi_cmd != SIOCLIFREMOVEIF && 27282 ipip->ipi_cmd != SIOCLIFFAILOVER && 27283 ipip->ipi_cmd != SIOCLIFFAILBACK && 27284 ipip->ipi_cmd != SIOCSLIFGROUPNAME) 27285 (ci.ci_ipif)->ipif_state_flags |= IPIF_CHANGING; 27286 mutex_exit(&(ci.ci_ipif)->ipif_ill->ill_lock); 27287 27288 /* 27289 * A return value of EINPROGRESS means the ioctl is 27290 * either queued and waiting for some reason or has 27291 * already completed. 27292 */ 27293 err = (*ipip->ipi_func)(ci.ci_ipif, ci.ci_sin, q, mp, ipip, ci.ci_lifr); 27294 27295 ip_ioctl_finish(q, mp, err, IPI2MODE(ipip), ipsq); 27296 27297 if (entered_ipsq) 27298 ipsq_exit(ipsq, B_TRUE, B_TRUE); 27299 } 27300 27301 /* 27302 * Complete the ioctl. Typically ioctls use the mi package and need to 27303 * do mi_copyout/mi_copy_done. 27304 */ 27305 void 27306 ip_ioctl_finish(queue_t *q, mblk_t *mp, int err, int mode, ipsq_t *ipsq) 27307 { 27308 conn_t *connp = NULL; 27309 27310 if (err == EINPROGRESS) 27311 return; 27312 27313 if (CONN_Q(q)) { 27314 connp = Q_TO_CONN(q); 27315 ASSERT(connp->conn_ref >= 2); 27316 } 27317 27318 switch (mode) { 27319 case COPYOUT: 27320 if (err == 0) 27321 mi_copyout(q, mp); 27322 else 27323 mi_copy_done(q, mp, err); 27324 break; 27325 27326 case NO_COPYOUT: 27327 mi_copy_done(q, mp, err); 27328 break; 27329 27330 default: 27331 ASSERT(mode == CONN_CLOSE); /* aborted through CONN_CLOSE */ 27332 break; 27333 } 27334 27335 /* 27336 * The refhold placed at the start of the ioctl is released here. 27337 */ 27338 if (connp != NULL) 27339 CONN_OPER_PENDING_DONE(connp); 27340 27341 if (ipsq != NULL) 27342 ipsq_current_finish(ipsq); 27343 } 27344 27345 /* 27346 * This is called from ip_wput_nondata to resume a deferred TCP bind. 27347 */ 27348 /* ARGSUSED */ 27349 void 27350 ip_resume_tcp_bind(void *arg, mblk_t *mp, void *arg2) 27351 { 27352 conn_t *connp = arg; 27353 tcp_t *tcp; 27354 27355 ASSERT(connp != NULL && IPCL_IS_TCP(connp) && connp->conn_tcp != NULL); 27356 tcp = connp->conn_tcp; 27357 27358 if (connp->conn_tcp->tcp_state == TCPS_CLOSED) 27359 freemsg(mp); 27360 else 27361 tcp_rput_other(tcp, mp); 27362 CONN_OPER_PENDING_DONE(connp); 27363 } 27364 27365 /* Called from ip_wput for all non data messages */ 27366 /* ARGSUSED */ 27367 void 27368 ip_wput_nondata(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg) 27369 { 27370 mblk_t *mp1; 27371 ire_t *ire, *fake_ire; 27372 ill_t *ill; 27373 struct iocblk *iocp; 27374 ip_ioctl_cmd_t *ipip; 27375 cred_t *cr; 27376 conn_t *connp; 27377 int cmd, err; 27378 nce_t *nce; 27379 ipif_t *ipif; 27380 ip_stack_t *ipst; 27381 char *proto_str; 27382 27383 if (CONN_Q(q)) { 27384 connp = Q_TO_CONN(q); 27385 ipst = connp->conn_netstack->netstack_ip; 27386 } else { 27387 connp = NULL; 27388 ipst = ILLQ_TO_IPST(q); 27389 } 27390 27391 cr = DB_CREDDEF(mp, GET_QUEUE_CRED(q)); 27392 27393 /* Check if it is a queue to /dev/sctp. */ 27394 if (connp != NULL && connp->conn_ulp == IPPROTO_SCTP && 27395 connp->conn_rq == NULL) { 27396 sctp_wput(q, mp); 27397 return; 27398 } 27399 27400 switch (DB_TYPE(mp)) { 27401 case M_IOCTL: 27402 /* 27403 * IOCTL processing begins in ip_sioctl_copyin_setup which 27404 * will arrange to copy in associated control structures. 27405 */ 27406 ip_sioctl_copyin_setup(q, mp); 27407 return; 27408 case M_IOCDATA: 27409 /* 27410 * Ensure that this is associated with one of our trans- 27411 * parent ioctls. If it's not ours, discard it if we're 27412 * running as a driver, or pass it on if we're a module. 27413 */ 27414 iocp = (struct iocblk *)mp->b_rptr; 27415 ipip = ip_sioctl_lookup(iocp->ioc_cmd); 27416 if (ipip == NULL) { 27417 if (q->q_next == NULL) { 27418 goto nak; 27419 } else { 27420 putnext(q, mp); 27421 } 27422 return; 27423 } else if ((q->q_next != NULL) && 27424 !(ipip->ipi_flags & IPI_MODOK)) { 27425 /* 27426 * the ioctl is one we recognise, but is not 27427 * consumed by IP as a module, pass M_IOCDATA 27428 * for processing downstream, but only for 27429 * common Streams ioctls. 27430 */ 27431 if (ipip->ipi_flags & IPI_PASS_DOWN) { 27432 putnext(q, mp); 27433 return; 27434 } else { 27435 goto nak; 27436 } 27437 } 27438 27439 /* IOCTL continuation following copyin or copyout. */ 27440 if (mi_copy_state(q, mp, NULL) == -1) { 27441 /* 27442 * The copy operation failed. mi_copy_state already 27443 * cleaned up, so we're out of here. 27444 */ 27445 return; 27446 } 27447 /* 27448 * If we just completed a copy in, we become writer and 27449 * continue processing in ip_sioctl_copyin_done. If it 27450 * was a copy out, we call mi_copyout again. If there is 27451 * nothing more to copy out, it will complete the IOCTL. 27452 */ 27453 if (MI_COPY_DIRECTION(mp) == MI_COPY_IN) { 27454 if (!(mp1 = mp->b_cont) || !(mp1 = mp1->b_cont)) { 27455 mi_copy_done(q, mp, EPROTO); 27456 return; 27457 } 27458 /* 27459 * Check for cases that need more copying. A return 27460 * value of 0 means a second copyin has been started, 27461 * so we return; a return value of 1 means no more 27462 * copying is needed, so we continue. 27463 */ 27464 cmd = iocp->ioc_cmd; 27465 if ((cmd == SIOCGMSFILTER || cmd == SIOCSMSFILTER || 27466 cmd == SIOCGIPMSFILTER || cmd == SIOCSIPMSFILTER) && 27467 MI_COPY_COUNT(mp) == 1) { 27468 if (ip_copyin_msfilter(q, mp) == 0) 27469 return; 27470 } 27471 /* 27472 * Refhold the conn, till the ioctl completes. This is 27473 * needed in case the ioctl ends up in the pending mp 27474 * list. Every mp in the ill_pending_mp list and 27475 * the ipsq_pending_mp must have a refhold on the conn 27476 * to resume processing. The refhold is released when 27477 * the ioctl completes. (normally or abnormally) 27478 * In all cases ip_ioctl_finish is called to finish 27479 * the ioctl. 27480 */ 27481 if (connp != NULL) { 27482 /* This is not a reentry */ 27483 ASSERT(ipsq == NULL); 27484 CONN_INC_REF(connp); 27485 } else { 27486 if (!(ipip->ipi_flags & IPI_MODOK)) { 27487 mi_copy_done(q, mp, EINVAL); 27488 return; 27489 } 27490 } 27491 27492 ip_process_ioctl(ipsq, q, mp, ipip); 27493 27494 } else { 27495 mi_copyout(q, mp); 27496 } 27497 return; 27498 nak: 27499 iocp->ioc_error = EINVAL; 27500 mp->b_datap->db_type = M_IOCNAK; 27501 iocp->ioc_count = 0; 27502 qreply(q, mp); 27503 return; 27504 27505 case M_IOCNAK: 27506 /* 27507 * The only way we could get here is if a resolver didn't like 27508 * an IOCTL we sent it. This shouldn't happen. 27509 */ 27510 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 27511 "ip_wput: unexpected M_IOCNAK, ioc_cmd 0x%x", 27512 ((struct iocblk *)mp->b_rptr)->ioc_cmd); 27513 freemsg(mp); 27514 return; 27515 case M_IOCACK: 27516 /* /dev/ip shouldn't see this */ 27517 if (CONN_Q(q)) 27518 goto nak; 27519 27520 /* Finish socket ioctls passed through to ARP. */ 27521 ip_sioctl_iocack(q, mp); 27522 return; 27523 case M_FLUSH: 27524 if (*mp->b_rptr & FLUSHW) 27525 flushq(q, FLUSHALL); 27526 if (q->q_next) { 27527 /* 27528 * M_FLUSH is sent up to IP by some drivers during 27529 * unbind. ip_rput has already replied to it. We are 27530 * here for the M_FLUSH that we originated in IP 27531 * before sending the unbind request to the driver. 27532 * Just free it as we don't queue packets in IP 27533 * on the write side of the device instance. 27534 */ 27535 freemsg(mp); 27536 return; 27537 } 27538 if (*mp->b_rptr & FLUSHR) { 27539 *mp->b_rptr &= ~FLUSHW; 27540 qreply(q, mp); 27541 return; 27542 } 27543 freemsg(mp); 27544 return; 27545 case IRE_DB_REQ_TYPE: 27546 if (connp == NULL) { 27547 proto_str = "IRE_DB_REQ_TYPE"; 27548 goto protonak; 27549 } 27550 /* An Upper Level Protocol wants a copy of an IRE. */ 27551 ip_ire_req(q, mp); 27552 return; 27553 case M_CTL: 27554 if (mp->b_wptr - mp->b_rptr < sizeof (uint32_t)) 27555 break; 27556 27557 if (((ipsec_info_t *)mp->b_rptr)->ipsec_info_type == 27558 TUN_HELLO) { 27559 ASSERT(connp != NULL); 27560 connp->conn_flags |= IPCL_IPTUN; 27561 freeb(mp); 27562 return; 27563 } 27564 27565 if (connp != NULL && *(uint32_t *)mp->b_rptr == 27566 IP_ULP_OUT_LABELED) { 27567 out_labeled_t *olp; 27568 27569 if (mp->b_wptr - mp->b_rptr != sizeof (*olp)) 27570 break; 27571 olp = (out_labeled_t *)mp->b_rptr; 27572 connp->conn_ulp_labeled = olp->out_qnext == q; 27573 freemsg(mp); 27574 return; 27575 } 27576 27577 /* M_CTL messages are used by ARP to tell us things. */ 27578 if ((mp->b_wptr - mp->b_rptr) < sizeof (arc_t)) 27579 break; 27580 switch (((arc_t *)mp->b_rptr)->arc_cmd) { 27581 case AR_ENTRY_SQUERY: 27582 ip_wput_ctl(q, mp); 27583 return; 27584 case AR_CLIENT_NOTIFY: 27585 ip_arp_news(q, mp); 27586 return; 27587 case AR_DLPIOP_DONE: 27588 ASSERT(q->q_next != NULL); 27589 ill = (ill_t *)q->q_ptr; 27590 /* qwriter_ip releases the refhold */ 27591 /* refhold on ill stream is ok without ILL_CAN_LOOKUP */ 27592 ill_refhold(ill); 27593 (void) qwriter_ip(NULL, ill, q, mp, ip_arp_done, 27594 CUR_OP, B_FALSE); 27595 return; 27596 case AR_ARP_CLOSING: 27597 /* 27598 * ARP (above us) is closing. If no ARP bringup is 27599 * currently pending, ack the message so that ARP 27600 * can complete its close. Also mark ill_arp_closing 27601 * so that new ARP bringups will fail. If any 27602 * ARP bringup is currently in progress, we will 27603 * ack this when the current ARP bringup completes. 27604 */ 27605 ASSERT(q->q_next != NULL); 27606 ill = (ill_t *)q->q_ptr; 27607 mutex_enter(&ill->ill_lock); 27608 ill->ill_arp_closing = 1; 27609 if (!ill->ill_arp_bringup_pending) { 27610 mutex_exit(&ill->ill_lock); 27611 qreply(q, mp); 27612 } else { 27613 mutex_exit(&ill->ill_lock); 27614 freemsg(mp); 27615 } 27616 return; 27617 case AR_ARP_EXTEND: 27618 /* 27619 * The ARP module above us is capable of duplicate 27620 * address detection. Old ATM drivers will not send 27621 * this message. 27622 */ 27623 ASSERT(q->q_next != NULL); 27624 ill = (ill_t *)q->q_ptr; 27625 ill->ill_arp_extend = B_TRUE; 27626 freemsg(mp); 27627 return; 27628 default: 27629 break; 27630 } 27631 break; 27632 case M_PROTO: 27633 case M_PCPROTO: 27634 /* 27635 * The only PROTO messages we expect are ULP binds and 27636 * copies of option negotiation acknowledgements. 27637 */ 27638 switch (((union T_primitives *)mp->b_rptr)->type) { 27639 case O_T_BIND_REQ: 27640 case T_BIND_REQ: { 27641 /* Request can get queued in bind */ 27642 if (connp == NULL) { 27643 proto_str = "O_T_BIND_REQ/T_BIND_REQ"; 27644 goto protonak; 27645 } 27646 /* 27647 * Both TCP and UDP call ip_bind_{v4,v6}() directly 27648 * instead of going through this path. We only get 27649 * here in the following cases: 27650 * 27651 * a. Bind retries, where ipsq is non-NULL. 27652 * b. T_BIND_REQ is issued from non TCP/UDP 27653 * transport, e.g. icmp for raw socket, 27654 * in which case ipsq will be NULL. 27655 */ 27656 ASSERT(ipsq != NULL || 27657 (!IPCL_IS_TCP(connp) && !IPCL_IS_UDP(connp))); 27658 27659 /* Don't increment refcnt if this is a re-entry */ 27660 if (ipsq == NULL) 27661 CONN_INC_REF(connp); 27662 mp = connp->conn_af_isv6 ? ip_bind_v6(q, mp, 27663 connp, NULL) : ip_bind_v4(q, mp, connp); 27664 if (mp == NULL) 27665 return; 27666 if (IPCL_IS_TCP(connp)) { 27667 /* 27668 * In the case of TCP endpoint we 27669 * come here only for bind retries 27670 */ 27671 ASSERT(ipsq != NULL); 27672 CONN_INC_REF(connp); 27673 squeue_fill(connp->conn_sqp, mp, 27674 ip_resume_tcp_bind, connp, 27675 SQTAG_BIND_RETRY); 27676 return; 27677 } else if (IPCL_IS_UDP(connp)) { 27678 /* 27679 * In the case of UDP endpoint we 27680 * come here only for bind retries 27681 */ 27682 ASSERT(ipsq != NULL); 27683 udp_resume_bind(connp, mp); 27684 return; 27685 } 27686 qreply(q, mp); 27687 CONN_OPER_PENDING_DONE(connp); 27688 return; 27689 } 27690 case T_SVR4_OPTMGMT_REQ: 27691 ip2dbg(("ip_wput: T_SVR4_OPTMGMT_REQ flags %x\n", 27692 ((struct T_optmgmt_req *)mp->b_rptr)->MGMT_flags)); 27693 27694 if (connp == NULL) { 27695 proto_str = "T_SVR4_OPTMGMT_REQ"; 27696 goto protonak; 27697 } 27698 27699 if (!snmpcom_req(q, mp, ip_snmp_set, 27700 ip_snmp_get, cr)) { 27701 /* 27702 * Call svr4_optcom_req so that it can 27703 * generate the ack. We don't come here 27704 * if this operation is being restarted. 27705 * ip_restart_optmgmt will drop the conn ref. 27706 * In the case of ipsec option after the ipsec 27707 * load is complete conn_restart_ipsec_waiter 27708 * drops the conn ref. 27709 */ 27710 ASSERT(ipsq == NULL); 27711 CONN_INC_REF(connp); 27712 if (ip_check_for_ipsec_opt(q, mp)) 27713 return; 27714 err = svr4_optcom_req(q, mp, cr, &ip_opt_obj); 27715 if (err != EINPROGRESS) { 27716 /* Operation is done */ 27717 CONN_OPER_PENDING_DONE(connp); 27718 } 27719 } 27720 return; 27721 case T_OPTMGMT_REQ: 27722 ip2dbg(("ip_wput: T_OPTMGMT_REQ\n")); 27723 /* 27724 * Note: No snmpcom_req support through new 27725 * T_OPTMGMT_REQ. 27726 * Call tpi_optcom_req so that it can 27727 * generate the ack. 27728 */ 27729 if (connp == NULL) { 27730 proto_str = "T_OPTMGMT_REQ"; 27731 goto protonak; 27732 } 27733 27734 ASSERT(ipsq == NULL); 27735 /* 27736 * We don't come here for restart. ip_restart_optmgmt 27737 * will drop the conn ref. In the case of ipsec option 27738 * after the ipsec load is complete 27739 * conn_restart_ipsec_waiter drops the conn ref. 27740 */ 27741 CONN_INC_REF(connp); 27742 if (ip_check_for_ipsec_opt(q, mp)) 27743 return; 27744 err = tpi_optcom_req(q, mp, cr, &ip_opt_obj); 27745 if (err != EINPROGRESS) { 27746 /* Operation is done */ 27747 CONN_OPER_PENDING_DONE(connp); 27748 } 27749 return; 27750 case T_UNBIND_REQ: 27751 if (connp == NULL) { 27752 proto_str = "T_UNBIND_REQ"; 27753 goto protonak; 27754 } 27755 mp = ip_unbind(q, mp); 27756 qreply(q, mp); 27757 return; 27758 default: 27759 /* 27760 * Have to drop any DLPI messages coming down from 27761 * arp (such as an info_req which would cause ip 27762 * to receive an extra info_ack if it was passed 27763 * through. 27764 */ 27765 ip1dbg(("ip_wput_nondata: dropping M_PROTO %d\n", 27766 (int)*(uint_t *)mp->b_rptr)); 27767 freemsg(mp); 27768 return; 27769 } 27770 /* NOTREACHED */ 27771 case IRE_DB_TYPE: { 27772 nce_t *nce; 27773 ill_t *ill; 27774 in6_addr_t gw_addr_v6; 27775 27776 27777 /* 27778 * This is a response back from a resolver. It 27779 * consists of a message chain containing: 27780 * IRE_MBLK-->LL_HDR_MBLK->pkt 27781 * The IRE_MBLK is the one we allocated in ip_newroute. 27782 * The LL_HDR_MBLK is the DLPI header to use to get 27783 * the attached packet, and subsequent ones for the 27784 * same destination, transmitted. 27785 */ 27786 if ((mp->b_wptr - mp->b_rptr) != sizeof (ire_t)) /* ire */ 27787 break; 27788 /* 27789 * First, check to make sure the resolution succeeded. 27790 * If it failed, the second mblk will be empty. 27791 * If it is, free the chain, dropping the packet. 27792 * (We must ire_delete the ire; that frees the ire mblk) 27793 * We're doing this now to support PVCs for ATM; it's 27794 * a partial xresolv implementation. When we fully implement 27795 * xresolv interfaces, instead of freeing everything here 27796 * we'll initiate neighbor discovery. 27797 * 27798 * For v4 (ARP and other external resolvers) the resolver 27799 * frees the message, so no check is needed. This check 27800 * is required, though, for a full xresolve implementation. 27801 * Including this code here now both shows how external 27802 * resolvers can NACK a resolution request using an 27803 * existing design that has no specific provisions for NACKs, 27804 * and also takes into account that the current non-ARP 27805 * external resolver has been coded to use this method of 27806 * NACKing for all IPv6 (xresolv) cases, 27807 * whether our xresolv implementation is complete or not. 27808 * 27809 */ 27810 ire = (ire_t *)mp->b_rptr; 27811 ill = ire_to_ill(ire); 27812 mp1 = mp->b_cont; /* dl_unitdata_req */ 27813 if (mp1->b_rptr == mp1->b_wptr) { 27814 if (ire->ire_ipversion == IPV6_VERSION) { 27815 /* 27816 * XRESOLV interface. 27817 */ 27818 ASSERT(ill->ill_flags & ILLF_XRESOLV); 27819 mutex_enter(&ire->ire_lock); 27820 gw_addr_v6 = ire->ire_gateway_addr_v6; 27821 mutex_exit(&ire->ire_lock); 27822 if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) { 27823 nce = ndp_lookup_v6(ill, 27824 &ire->ire_addr_v6, B_FALSE); 27825 } else { 27826 nce = ndp_lookup_v6(ill, &gw_addr_v6, 27827 B_FALSE); 27828 } 27829 if (nce != NULL) { 27830 nce_resolv_failed(nce); 27831 ndp_delete(nce); 27832 NCE_REFRELE(nce); 27833 } 27834 } 27835 mp->b_cont = NULL; 27836 freemsg(mp1); /* frees the pkt as well */ 27837 ASSERT(ire->ire_nce == NULL); 27838 ire_delete((ire_t *)mp->b_rptr); 27839 return; 27840 } 27841 27842 /* 27843 * Split them into IRE_MBLK and pkt and feed it into 27844 * ire_add_then_send. Then in ire_add_then_send 27845 * the IRE will be added, and then the packet will be 27846 * run back through ip_wput. This time it will make 27847 * it to the wire. 27848 */ 27849 mp->b_cont = NULL; 27850 mp = mp1->b_cont; /* now, mp points to pkt */ 27851 mp1->b_cont = NULL; 27852 ip1dbg(("ip_wput_nondata: reply from external resolver \n")); 27853 if (ire->ire_ipversion == IPV6_VERSION) { 27854 /* 27855 * XRESOLV interface. Find the nce and put a copy 27856 * of the dl_unitdata_req in nce_res_mp 27857 */ 27858 ASSERT(ill->ill_flags & ILLF_XRESOLV); 27859 mutex_enter(&ire->ire_lock); 27860 gw_addr_v6 = ire->ire_gateway_addr_v6; 27861 mutex_exit(&ire->ire_lock); 27862 if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) { 27863 nce = ndp_lookup_v6(ill, &ire->ire_addr_v6, 27864 B_FALSE); 27865 } else { 27866 nce = ndp_lookup_v6(ill, &gw_addr_v6, B_FALSE); 27867 } 27868 if (nce != NULL) { 27869 /* 27870 * We have to protect nce_res_mp here 27871 * from being accessed by other threads 27872 * while we change the mblk pointer. 27873 * Other functions will also lock the nce when 27874 * accessing nce_res_mp. 27875 * 27876 * The reason we change the mblk pointer 27877 * here rather than copying the resolved address 27878 * into the template is that, unlike with 27879 * ethernet, we have no guarantee that the 27880 * resolved address length will be 27881 * smaller than or equal to the lla length 27882 * with which the template was allocated, 27883 * (for ethernet, they're equal) 27884 * so we have to use the actual resolved 27885 * address mblk - which holds the real 27886 * dl_unitdata_req with the resolved address. 27887 * 27888 * Doing this is the same behavior as was 27889 * previously used in the v4 ARP case. 27890 */ 27891 mutex_enter(&nce->nce_lock); 27892 if (nce->nce_res_mp != NULL) 27893 freemsg(nce->nce_res_mp); 27894 nce->nce_res_mp = mp1; 27895 mutex_exit(&nce->nce_lock); 27896 /* 27897 * We do a fastpath probe here because 27898 * we have resolved the address without 27899 * using Neighbor Discovery. 27900 * In the non-XRESOLV v6 case, the fastpath 27901 * probe is done right after neighbor 27902 * discovery completes. 27903 */ 27904 if (nce->nce_res_mp != NULL) { 27905 int res; 27906 nce_fastpath_list_add(nce); 27907 res = ill_fastpath_probe(ill, 27908 nce->nce_res_mp); 27909 if (res != 0 && res != EAGAIN) 27910 nce_fastpath_list_delete(nce); 27911 } 27912 27913 ire_add_then_send(q, ire, mp); 27914 /* 27915 * Now we have to clean out any packets 27916 * that may have been queued on the nce 27917 * while it was waiting for address resolution 27918 * to complete. 27919 */ 27920 mutex_enter(&nce->nce_lock); 27921 mp1 = nce->nce_qd_mp; 27922 nce->nce_qd_mp = NULL; 27923 mutex_exit(&nce->nce_lock); 27924 while (mp1 != NULL) { 27925 mblk_t *nxt_mp; 27926 queue_t *fwdq = NULL; 27927 ill_t *inbound_ill; 27928 uint_t ifindex; 27929 27930 nxt_mp = mp1->b_next; 27931 mp1->b_next = NULL; 27932 /* 27933 * Retrieve ifindex stored in 27934 * ip_rput_data_v6() 27935 */ 27936 ifindex = 27937 (uint_t)(uintptr_t)mp1->b_prev; 27938 inbound_ill = 27939 ill_lookup_on_ifindex(ifindex, 27940 B_TRUE, NULL, NULL, NULL, 27941 NULL, ipst); 27942 mp1->b_prev = NULL; 27943 if (inbound_ill != NULL) 27944 fwdq = inbound_ill->ill_rq; 27945 27946 if (fwdq != NULL) { 27947 put(fwdq, mp1); 27948 ill_refrele(inbound_ill); 27949 } else 27950 put(WR(ill->ill_rq), mp1); 27951 mp1 = nxt_mp; 27952 } 27953 NCE_REFRELE(nce); 27954 } else { /* nce is NULL; clean up */ 27955 ire_delete(ire); 27956 freemsg(mp); 27957 freemsg(mp1); 27958 return; 27959 } 27960 } else { 27961 nce_t *arpce; 27962 /* 27963 * Link layer resolution succeeded. Recompute the 27964 * ire_nce. 27965 */ 27966 ASSERT(ire->ire_type & (IRE_CACHE|IRE_BROADCAST)); 27967 if ((arpce = ndp_lookup_v4(ill, 27968 (ire->ire_gateway_addr != INADDR_ANY ? 27969 &ire->ire_gateway_addr : &ire->ire_addr), 27970 B_FALSE)) == NULL) { 27971 freeb(ire->ire_mp); 27972 freeb(mp1); 27973 freemsg(mp); 27974 return; 27975 } 27976 mutex_enter(&arpce->nce_lock); 27977 arpce->nce_last = TICK_TO_MSEC(lbolt64); 27978 if (arpce->nce_state == ND_REACHABLE) { 27979 /* 27980 * Someone resolved this before us; 27981 * cleanup the res_mp. Since ire has 27982 * not been added yet, the call to ire_add_v4 27983 * from ire_add_then_send (when a dup is 27984 * detected) will clean up the ire. 27985 */ 27986 freeb(mp1); 27987 } else { 27988 if (arpce->nce_res_mp != NULL) 27989 freemsg(arpce->nce_res_mp); 27990 arpce->nce_res_mp = mp1; 27991 arpce->nce_state = ND_REACHABLE; 27992 } 27993 mutex_exit(&arpce->nce_lock); 27994 if (ire->ire_marks & IRE_MARK_NOADD) { 27995 /* 27996 * this ire will not be added to the ire 27997 * cache table, so we can set the ire_nce 27998 * here, as there are no atomicity constraints. 27999 */ 28000 ire->ire_nce = arpce; 28001 /* 28002 * We are associating this nce with the ire 28003 * so change the nce ref taken in 28004 * ndp_lookup_v4() from 28005 * NCE_REFHOLD to NCE_REFHOLD_NOTR 28006 */ 28007 NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce); 28008 } else { 28009 NCE_REFRELE(arpce); 28010 } 28011 ire_add_then_send(q, ire, mp); 28012 } 28013 return; /* All is well, the packet has been sent. */ 28014 } 28015 case IRE_ARPRESOLVE_TYPE: { 28016 28017 if ((mp->b_wptr - mp->b_rptr) != sizeof (ire_t)) /* fake_ire */ 28018 break; 28019 mp1 = mp->b_cont; /* dl_unitdata_req */ 28020 mp->b_cont = NULL; 28021 /* 28022 * First, check to make sure the resolution succeeded. 28023 * If it failed, the second mblk will be empty. 28024 */ 28025 if (mp1->b_rptr == mp1->b_wptr) { 28026 /* cleanup the incomplete ire, free queued packets */ 28027 freemsg(mp); /* fake ire */ 28028 freeb(mp1); /* dl_unitdata response */ 28029 return; 28030 } 28031 28032 /* 28033 * update any incomplete nce_t found. we lookup the ctable 28034 * and find the nce from the ire->ire_nce because we need 28035 * to pass the ire to ip_xmit_v4 later, and can find both 28036 * ire and nce in one lookup from the ctable. 28037 */ 28038 fake_ire = (ire_t *)mp->b_rptr; 28039 /* 28040 * By the time we come back here from ARP 28041 * the logical outgoing interface of the incomplete ire 28042 * we added in ire_forward could have disappeared, 28043 * causing the incomplete ire to also have 28044 * dissapeared. So we need to retreive the 28045 * proper ipif for the ire before looking 28046 * in ctable; do the ctablelookup based on ire_ipif_seqid 28047 */ 28048 ill = q->q_ptr; 28049 28050 /* Get the outgoing ipif */ 28051 mutex_enter(&ill->ill_lock); 28052 if (ill->ill_state_flags & ILL_CONDEMNED) { 28053 mutex_exit(&ill->ill_lock); 28054 freemsg(mp); /* fake ire */ 28055 freeb(mp1); /* dl_unitdata response */ 28056 return; 28057 } 28058 ipif = ipif_lookup_seqid(ill, fake_ire->ire_ipif_seqid); 28059 28060 if (ipif == NULL) { 28061 mutex_exit(&ill->ill_lock); 28062 ip1dbg(("logical intrf to incomplete ire vanished\n")); 28063 freemsg(mp); 28064 freeb(mp1); 28065 return; 28066 } 28067 ipif_refhold_locked(ipif); 28068 mutex_exit(&ill->ill_lock); 28069 ire = ire_ctable_lookup(fake_ire->ire_addr, 28070 fake_ire->ire_gateway_addr, IRE_CACHE, 28071 ipif, fake_ire->ire_zoneid, NULL, 28072 (MATCH_IRE_GW|MATCH_IRE_IPIF|MATCH_IRE_ZONEONLY), ipst); 28073 ipif_refrele(ipif); 28074 if (ire == NULL) { 28075 /* 28076 * no ire was found; check if there is an nce 28077 * for this lookup; if it has no ire's pointing at it 28078 * cleanup. 28079 */ 28080 if ((nce = ndp_lookup_v4(ill, 28081 (fake_ire->ire_gateway_addr != INADDR_ANY ? 28082 &fake_ire->ire_gateway_addr : &fake_ire->ire_addr), 28083 B_FALSE)) != NULL) { 28084 /* 28085 * cleanup: just reset nce. 28086 * We check for refcnt 2 (one for the nce 28087 * hash list + 1 for the ref taken by 28088 * ndp_lookup_v4) to ensure that there are 28089 * no ire's pointing at the nce. 28090 */ 28091 if (nce->nce_refcnt == 2) { 28092 nce = nce_reinit(nce); 28093 } 28094 if (nce != NULL) 28095 NCE_REFRELE(nce); 28096 } 28097 freeb(mp1); /* dl_unitdata response */ 28098 freemsg(mp); /* fake ire */ 28099 return; 28100 } 28101 nce = ire->ire_nce; 28102 DTRACE_PROBE2(ire__arpresolve__type, 28103 ire_t *, ire, nce_t *, nce); 28104 ASSERT(nce->nce_state != ND_INITIAL); 28105 mutex_enter(&nce->nce_lock); 28106 nce->nce_last = TICK_TO_MSEC(lbolt64); 28107 if (nce->nce_state == ND_REACHABLE) { 28108 /* 28109 * Someone resolved this before us; 28110 * our response is not needed any more. 28111 */ 28112 mutex_exit(&nce->nce_lock); 28113 freeb(mp1); /* dl_unitdata response */ 28114 } else { 28115 if (nce->nce_res_mp != NULL) { 28116 freemsg(nce->nce_res_mp); 28117 /* existing dl_unitdata template */ 28118 } 28119 nce->nce_res_mp = mp1; 28120 nce->nce_state = ND_REACHABLE; 28121 mutex_exit(&nce->nce_lock); 28122 nce_fastpath(nce); 28123 } 28124 /* 28125 * The cached nce_t has been updated to be reachable; 28126 * Set the IRE_MARK_UNCACHED flag and free the fake_ire. 28127 */ 28128 fake_ire->ire_marks &= ~IRE_MARK_UNCACHED; 28129 freemsg(mp); 28130 /* 28131 * send out queued packets. 28132 */ 28133 (void) ip_xmit_v4(NULL, ire, NULL, B_FALSE); 28134 28135 IRE_REFRELE(ire); 28136 return; 28137 } 28138 default: 28139 break; 28140 } 28141 if (q->q_next) { 28142 putnext(q, mp); 28143 } else 28144 freemsg(mp); 28145 return; 28146 28147 protonak: 28148 cmn_err(CE_NOTE, "IP doesn't process %s as a module", proto_str); 28149 if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, EINVAL)) != NULL) 28150 qreply(q, mp); 28151 } 28152 28153 /* 28154 * Process IP options in an outbound packet. Modify the destination if there 28155 * is a source route option. 28156 * Returns non-zero if something fails in which case an ICMP error has been 28157 * sent and mp freed. 28158 */ 28159 static int 28160 ip_wput_options(queue_t *q, mblk_t *ipsec_mp, ipha_t *ipha, 28161 boolean_t mctl_present, zoneid_t zoneid, ip_stack_t *ipst) 28162 { 28163 ipoptp_t opts; 28164 uchar_t *opt; 28165 uint8_t optval; 28166 uint8_t optlen; 28167 ipaddr_t dst; 28168 intptr_t code = 0; 28169 mblk_t *mp; 28170 ire_t *ire = NULL; 28171 28172 ip2dbg(("ip_wput_options\n")); 28173 mp = ipsec_mp; 28174 if (mctl_present) { 28175 mp = ipsec_mp->b_cont; 28176 } 28177 28178 dst = ipha->ipha_dst; 28179 for (optval = ipoptp_first(&opts, ipha); 28180 optval != IPOPT_EOL; 28181 optval = ipoptp_next(&opts)) { 28182 opt = opts.ipoptp_cur; 28183 optlen = opts.ipoptp_len; 28184 ip2dbg(("ip_wput_options: opt %d, len %d\n", 28185 optval, optlen)); 28186 switch (optval) { 28187 uint32_t off; 28188 case IPOPT_SSRR: 28189 case IPOPT_LSRR: 28190 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 28191 ip1dbg(( 28192 "ip_wput_options: bad option offset\n")); 28193 code = (char *)&opt[IPOPT_OLEN] - 28194 (char *)ipha; 28195 goto param_prob; 28196 } 28197 off = opt[IPOPT_OFFSET]; 28198 ip1dbg(("ip_wput_options: next hop 0x%x\n", 28199 ntohl(dst))); 28200 /* 28201 * For strict: verify that dst is directly 28202 * reachable. 28203 */ 28204 if (optval == IPOPT_SSRR) { 28205 ire = ire_ftable_lookup(dst, 0, 0, 28206 IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, 28207 MBLK_GETLABEL(mp), 28208 MATCH_IRE_TYPE | MATCH_IRE_SECATTR, ipst); 28209 if (ire == NULL) { 28210 ip1dbg(("ip_wput_options: SSRR not" 28211 " directly reachable: 0x%x\n", 28212 ntohl(dst))); 28213 goto bad_src_route; 28214 } 28215 ire_refrele(ire); 28216 } 28217 break; 28218 case IPOPT_RR: 28219 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 28220 ip1dbg(( 28221 "ip_wput_options: bad option offset\n")); 28222 code = (char *)&opt[IPOPT_OLEN] - 28223 (char *)ipha; 28224 goto param_prob; 28225 } 28226 break; 28227 case IPOPT_TS: 28228 /* 28229 * Verify that length >=5 and that there is either 28230 * room for another timestamp or that the overflow 28231 * counter is not maxed out. 28232 */ 28233 code = (char *)&opt[IPOPT_OLEN] - (char *)ipha; 28234 if (optlen < IPOPT_MINLEN_IT) { 28235 goto param_prob; 28236 } 28237 if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) { 28238 ip1dbg(( 28239 "ip_wput_options: bad option offset\n")); 28240 code = (char *)&opt[IPOPT_OFFSET] - 28241 (char *)ipha; 28242 goto param_prob; 28243 } 28244 switch (opt[IPOPT_POS_OV_FLG] & 0x0F) { 28245 case IPOPT_TS_TSONLY: 28246 off = IPOPT_TS_TIMELEN; 28247 break; 28248 case IPOPT_TS_TSANDADDR: 28249 case IPOPT_TS_PRESPEC: 28250 case IPOPT_TS_PRESPEC_RFC791: 28251 off = IP_ADDR_LEN + IPOPT_TS_TIMELEN; 28252 break; 28253 default: 28254 code = (char *)&opt[IPOPT_POS_OV_FLG] - 28255 (char *)ipha; 28256 goto param_prob; 28257 } 28258 if (opt[IPOPT_OFFSET] - 1 + off > optlen && 28259 (opt[IPOPT_POS_OV_FLG] & 0xF0) == 0xF0) { 28260 /* 28261 * No room and the overflow counter is 15 28262 * already. 28263 */ 28264 goto param_prob; 28265 } 28266 break; 28267 } 28268 } 28269 28270 if ((opts.ipoptp_flags & IPOPTP_ERROR) == 0) 28271 return (0); 28272 28273 ip1dbg(("ip_wput_options: error processing IP options.")); 28274 code = (char *)&opt[IPOPT_OFFSET] - (char *)ipha; 28275 28276 param_prob: 28277 /* 28278 * Since ip_wput() isn't close to finished, we fill 28279 * in enough of the header for credible error reporting. 28280 */ 28281 if (ip_hdr_complete((ipha_t *)mp->b_rptr, zoneid, ipst)) { 28282 /* Failed */ 28283 freemsg(ipsec_mp); 28284 return (-1); 28285 } 28286 icmp_param_problem(q, ipsec_mp, (uint8_t)code, zoneid, ipst); 28287 return (-1); 28288 28289 bad_src_route: 28290 /* 28291 * Since ip_wput() isn't close to finished, we fill 28292 * in enough of the header for credible error reporting. 28293 */ 28294 if (ip_hdr_complete((ipha_t *)mp->b_rptr, zoneid, ipst)) { 28295 /* Failed */ 28296 freemsg(ipsec_mp); 28297 return (-1); 28298 } 28299 icmp_unreachable(q, ipsec_mp, ICMP_SOURCE_ROUTE_FAILED, zoneid, ipst); 28300 return (-1); 28301 } 28302 28303 /* 28304 * The maximum value of conn_drain_list_cnt is CONN_MAXDRAINCNT. 28305 * conn_drain_list_cnt can be changed by setting conn_drain_nthreads 28306 * thru /etc/system. 28307 */ 28308 #define CONN_MAXDRAINCNT 64 28309 28310 static void 28311 conn_drain_init(ip_stack_t *ipst) 28312 { 28313 int i; 28314 28315 ipst->ips_conn_drain_list_cnt = conn_drain_nthreads; 28316 28317 if ((ipst->ips_conn_drain_list_cnt == 0) || 28318 (ipst->ips_conn_drain_list_cnt > CONN_MAXDRAINCNT)) { 28319 /* 28320 * Default value of the number of drainers is the 28321 * number of cpus, subject to maximum of 8 drainers. 28322 */ 28323 if (boot_max_ncpus != -1) 28324 ipst->ips_conn_drain_list_cnt = MIN(boot_max_ncpus, 8); 28325 else 28326 ipst->ips_conn_drain_list_cnt = MIN(max_ncpus, 8); 28327 } 28328 28329 ipst->ips_conn_drain_list = kmem_zalloc(ipst->ips_conn_drain_list_cnt * 28330 sizeof (idl_t), KM_SLEEP); 28331 28332 for (i = 0; i < ipst->ips_conn_drain_list_cnt; i++) { 28333 mutex_init(&ipst->ips_conn_drain_list[i].idl_lock, NULL, 28334 MUTEX_DEFAULT, NULL); 28335 } 28336 } 28337 28338 static void 28339 conn_drain_fini(ip_stack_t *ipst) 28340 { 28341 int i; 28342 28343 for (i = 0; i < ipst->ips_conn_drain_list_cnt; i++) 28344 mutex_destroy(&ipst->ips_conn_drain_list[i].idl_lock); 28345 kmem_free(ipst->ips_conn_drain_list, 28346 ipst->ips_conn_drain_list_cnt * sizeof (idl_t)); 28347 ipst->ips_conn_drain_list = NULL; 28348 } 28349 28350 /* 28351 * Note: For an overview of how flowcontrol is handled in IP please see the 28352 * IP Flowcontrol notes at the top of this file. 28353 * 28354 * Flow control has blocked us from proceeding. Insert the given conn in one 28355 * of the conn drain lists. These conn wq's will be qenabled later on when 28356 * STREAMS flow control does a backenable. conn_walk_drain will enable 28357 * the first conn in each of these drain lists. Each of these qenabled conns 28358 * in turn enables the next in the list, after it runs, or when it closes, 28359 * thus sustaining the drain process. 28360 * 28361 * The only possible calling sequence is ip_wsrv (on conn) -> ip_wput -> 28362 * conn_drain_insert. Thus there can be only 1 instance of conn_drain_insert 28363 * running at any time, on a given conn, since there can be only 1 service proc 28364 * running on a queue at any time. 28365 */ 28366 void 28367 conn_drain_insert(conn_t *connp) 28368 { 28369 idl_t *idl; 28370 uint_t index; 28371 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 28372 28373 mutex_enter(&connp->conn_lock); 28374 if (connp->conn_state_flags & CONN_CLOSING) { 28375 /* 28376 * The conn is closing as a result of which CONN_CLOSING 28377 * is set. Return. 28378 */ 28379 mutex_exit(&connp->conn_lock); 28380 return; 28381 } else if (connp->conn_idl == NULL) { 28382 /* 28383 * Assign the next drain list round robin. We dont' use 28384 * a lock, and thus it may not be strictly round robin. 28385 * Atomicity of load/stores is enough to make sure that 28386 * conn_drain_list_index is always within bounds. 28387 */ 28388 index = ipst->ips_conn_drain_list_index; 28389 ASSERT(index < ipst->ips_conn_drain_list_cnt); 28390 connp->conn_idl = &ipst->ips_conn_drain_list[index]; 28391 index++; 28392 if (index == ipst->ips_conn_drain_list_cnt) 28393 index = 0; 28394 ipst->ips_conn_drain_list_index = index; 28395 } 28396 mutex_exit(&connp->conn_lock); 28397 28398 mutex_enter(CONN_DRAIN_LIST_LOCK(connp)); 28399 if ((connp->conn_drain_prev != NULL) || 28400 (connp->conn_state_flags & CONN_CLOSING)) { 28401 /* 28402 * The conn is already in the drain list, OR 28403 * the conn is closing. We need to check again for 28404 * the closing case again since close can happen 28405 * after we drop the conn_lock, and before we 28406 * acquire the CONN_DRAIN_LIST_LOCK. 28407 */ 28408 mutex_exit(CONN_DRAIN_LIST_LOCK(connp)); 28409 return; 28410 } else { 28411 idl = connp->conn_idl; 28412 } 28413 28414 /* 28415 * The conn is not in the drain list. Insert it at the 28416 * tail of the drain list. The drain list is circular 28417 * and doubly linked. idl_conn points to the 1st element 28418 * in the list. 28419 */ 28420 if (idl->idl_conn == NULL) { 28421 idl->idl_conn = connp; 28422 connp->conn_drain_next = connp; 28423 connp->conn_drain_prev = connp; 28424 } else { 28425 conn_t *head = idl->idl_conn; 28426 28427 connp->conn_drain_next = head; 28428 connp->conn_drain_prev = head->conn_drain_prev; 28429 head->conn_drain_prev->conn_drain_next = connp; 28430 head->conn_drain_prev = connp; 28431 } 28432 mutex_exit(CONN_DRAIN_LIST_LOCK(connp)); 28433 } 28434 28435 /* 28436 * This conn is closing, and we are called from ip_close. OR 28437 * This conn has been serviced by ip_wsrv, and we need to do the tail 28438 * processing. 28439 * If this conn is part of the drain list, we may need to sustain the drain 28440 * process by qenabling the next conn in the drain list. We may also need to 28441 * remove this conn from the list, if it is done. 28442 */ 28443 static void 28444 conn_drain_tail(conn_t *connp, boolean_t closing) 28445 { 28446 idl_t *idl; 28447 28448 /* 28449 * connp->conn_idl is stable at this point, and no lock is needed 28450 * to check it. If we are called from ip_close, close has already 28451 * set CONN_CLOSING, thus freezing the value of conn_idl, and 28452 * called us only because conn_idl is non-null. If we are called thru 28453 * service, conn_idl could be null, but it cannot change because 28454 * service is single-threaded per queue, and there cannot be another 28455 * instance of service trying to call conn_drain_insert on this conn 28456 * now. 28457 */ 28458 ASSERT(!closing || (connp->conn_idl != NULL)); 28459 28460 /* 28461 * If connp->conn_idl is null, the conn has not been inserted into any 28462 * drain list even once since creation of the conn. Just return. 28463 */ 28464 if (connp->conn_idl == NULL) 28465 return; 28466 28467 mutex_enter(CONN_DRAIN_LIST_LOCK(connp)); 28468 28469 if (connp->conn_drain_prev == NULL) { 28470 /* This conn is currently not in the drain list. */ 28471 mutex_exit(CONN_DRAIN_LIST_LOCK(connp)); 28472 return; 28473 } 28474 idl = connp->conn_idl; 28475 if (idl->idl_conn_draining == connp) { 28476 /* 28477 * This conn is the current drainer. If this is the last conn 28478 * in the drain list, we need to do more checks, in the 'if' 28479 * below. Otherwwise we need to just qenable the next conn, 28480 * to sustain the draining, and is handled in the 'else' 28481 * below. 28482 */ 28483 if (connp->conn_drain_next == idl->idl_conn) { 28484 /* 28485 * This conn is the last in this list. This round 28486 * of draining is complete. If idl_repeat is set, 28487 * it means another flow enabling has happened from 28488 * the driver/streams and we need to another round 28489 * of draining. 28490 * If there are more than 2 conns in the drain list, 28491 * do a left rotate by 1, so that all conns except the 28492 * conn at the head move towards the head by 1, and the 28493 * the conn at the head goes to the tail. This attempts 28494 * a more even share for all queues that are being 28495 * drained. 28496 */ 28497 if ((connp->conn_drain_next != connp) && 28498 (idl->idl_conn->conn_drain_next != connp)) { 28499 idl->idl_conn = idl->idl_conn->conn_drain_next; 28500 } 28501 if (idl->idl_repeat) { 28502 qenable(idl->idl_conn->conn_wq); 28503 idl->idl_conn_draining = idl->idl_conn; 28504 idl->idl_repeat = 0; 28505 } else { 28506 idl->idl_conn_draining = NULL; 28507 } 28508 } else { 28509 /* 28510 * If the next queue that we are now qenable'ing, 28511 * is closing, it will remove itself from this list 28512 * and qenable the subsequent queue in ip_close(). 28513 * Serialization is acheived thru idl_lock. 28514 */ 28515 qenable(connp->conn_drain_next->conn_wq); 28516 idl->idl_conn_draining = connp->conn_drain_next; 28517 } 28518 } 28519 if (!connp->conn_did_putbq || closing) { 28520 /* 28521 * Remove ourself from the drain list, if we did not do 28522 * a putbq, or if the conn is closing. 28523 * Note: It is possible that q->q_first is non-null. It means 28524 * that these messages landed after we did a enableok() in 28525 * ip_wsrv. Thus STREAMS will call ip_wsrv once again to 28526 * service them. 28527 */ 28528 if (connp->conn_drain_next == connp) { 28529 /* Singleton in the list */ 28530 ASSERT(connp->conn_drain_prev == connp); 28531 idl->idl_conn = NULL; 28532 idl->idl_conn_draining = NULL; 28533 } else { 28534 connp->conn_drain_prev->conn_drain_next = 28535 connp->conn_drain_next; 28536 connp->conn_drain_next->conn_drain_prev = 28537 connp->conn_drain_prev; 28538 if (idl->idl_conn == connp) 28539 idl->idl_conn = connp->conn_drain_next; 28540 ASSERT(idl->idl_conn_draining != connp); 28541 28542 } 28543 connp->conn_drain_next = NULL; 28544 connp->conn_drain_prev = NULL; 28545 } 28546 mutex_exit(CONN_DRAIN_LIST_LOCK(connp)); 28547 } 28548 28549 /* 28550 * Write service routine. Shared perimeter entry point. 28551 * ip_wsrv can be called in any of the following ways. 28552 * 1. The device queue's messages has fallen below the low water mark 28553 * and STREAMS has backenabled the ill_wq. We walk thru all the 28554 * the drain lists and backenable the first conn in each list. 28555 * 2. The above causes STREAMS to run ip_wsrv on the conn_wq of the 28556 * qenabled non-tcp upper layers. We start dequeing messages and call 28557 * ip_wput for each message. 28558 */ 28559 28560 void 28561 ip_wsrv(queue_t *q) 28562 { 28563 conn_t *connp; 28564 ill_t *ill; 28565 mblk_t *mp; 28566 28567 if (q->q_next) { 28568 ill = (ill_t *)q->q_ptr; 28569 if (ill->ill_state_flags == 0) { 28570 /* 28571 * The device flow control has opened up. 28572 * Walk through conn drain lists and qenable the 28573 * first conn in each list. This makes sense only 28574 * if the stream is fully plumbed and setup. 28575 * Hence the if check above. 28576 */ 28577 ip1dbg(("ip_wsrv: walking\n")); 28578 conn_walk_drain(ill->ill_ipst); 28579 } 28580 return; 28581 } 28582 28583 connp = Q_TO_CONN(q); 28584 ip1dbg(("ip_wsrv: %p %p\n", (void *)q, (void *)connp)); 28585 28586 /* 28587 * 1. Set conn_draining flag to signal that service is active. 28588 * 28589 * 2. ip_output determines whether it has been called from service, 28590 * based on the last parameter. If it is IP_WSRV it concludes it 28591 * has been called from service. 28592 * 28593 * 3. Message ordering is preserved by the following logic. 28594 * i. A directly called ip_output (i.e. not thru service) will queue 28595 * the message at the tail, if conn_draining is set (i.e. service 28596 * is running) or if q->q_first is non-null. 28597 * 28598 * ii. If ip_output is called from service, and if ip_output cannot 28599 * putnext due to flow control, it does a putbq. 28600 * 28601 * 4. noenable the queue so that a putbq from ip_wsrv does not reenable 28602 * (causing an infinite loop). 28603 */ 28604 ASSERT(!connp->conn_did_putbq); 28605 while ((q->q_first != NULL) && !connp->conn_did_putbq) { 28606 connp->conn_draining = 1; 28607 noenable(q); 28608 while ((mp = getq(q)) != NULL) { 28609 ASSERT(CONN_Q(q)); 28610 28611 ip_output(Q_TO_CONN(q), mp, q, IP_WSRV); 28612 if (connp->conn_did_putbq) { 28613 /* ip_wput did a putbq */ 28614 break; 28615 } 28616 } 28617 /* 28618 * At this point, a thread coming down from top, calling 28619 * ip_wput, may end up queueing the message. We have not yet 28620 * enabled the queue, so ip_wsrv won't be called again. 28621 * To avoid this race, check q->q_first again (in the loop) 28622 * If the other thread queued the message before we call 28623 * enableok(), we will catch it in the q->q_first check. 28624 * If the other thread queues the message after we call 28625 * enableok(), ip_wsrv will be called again by STREAMS. 28626 */ 28627 connp->conn_draining = 0; 28628 enableok(q); 28629 } 28630 28631 /* Enable the next conn for draining */ 28632 conn_drain_tail(connp, B_FALSE); 28633 28634 connp->conn_did_putbq = 0; 28635 } 28636 28637 /* 28638 * Walk the list of all conn's calling the function provided with the 28639 * specified argument for each. Note that this only walks conn's that 28640 * have been bound. 28641 * Applies to both IPv4 and IPv6. 28642 */ 28643 static void 28644 conn_walk_fanout(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 28645 { 28646 conn_walk_fanout_table(ipst->ips_ipcl_udp_fanout, 28647 ipst->ips_ipcl_udp_fanout_size, 28648 func, arg, zoneid); 28649 conn_walk_fanout_table(ipst->ips_ipcl_conn_fanout, 28650 ipst->ips_ipcl_conn_fanout_size, 28651 func, arg, zoneid); 28652 conn_walk_fanout_table(ipst->ips_ipcl_bind_fanout, 28653 ipst->ips_ipcl_bind_fanout_size, 28654 func, arg, zoneid); 28655 conn_walk_fanout_table(ipst->ips_ipcl_proto_fanout, 28656 IPPROTO_MAX, func, arg, zoneid); 28657 conn_walk_fanout_table(ipst->ips_ipcl_proto_fanout_v6, 28658 IPPROTO_MAX, func, arg, zoneid); 28659 } 28660 28661 /* 28662 * Flowcontrol has relieved, and STREAMS has backenabled us. For each list 28663 * of conns that need to be drained, check if drain is already in progress. 28664 * If so set the idl_repeat bit, indicating that the last conn in the list 28665 * needs to reinitiate the drain once again, for the list. If drain is not 28666 * in progress for the list, initiate the draining, by qenabling the 1st 28667 * conn in the list. The drain is self-sustaining, each qenabled conn will 28668 * in turn qenable the next conn, when it is done/blocked/closing. 28669 */ 28670 static void 28671 conn_walk_drain(ip_stack_t *ipst) 28672 { 28673 int i; 28674 idl_t *idl; 28675 28676 IP_STAT(ipst, ip_conn_walk_drain); 28677 28678 for (i = 0; i < ipst->ips_conn_drain_list_cnt; i++) { 28679 idl = &ipst->ips_conn_drain_list[i]; 28680 mutex_enter(&idl->idl_lock); 28681 if (idl->idl_conn == NULL) { 28682 mutex_exit(&idl->idl_lock); 28683 continue; 28684 } 28685 /* 28686 * If this list is not being drained currently by 28687 * an ip_wsrv thread, start the process. 28688 */ 28689 if (idl->idl_conn_draining == NULL) { 28690 ASSERT(idl->idl_repeat == 0); 28691 qenable(idl->idl_conn->conn_wq); 28692 idl->idl_conn_draining = idl->idl_conn; 28693 } else { 28694 idl->idl_repeat = 1; 28695 } 28696 mutex_exit(&idl->idl_lock); 28697 } 28698 } 28699 28700 /* 28701 * Walk an conn hash table of `count' buckets, calling func for each entry. 28702 */ 28703 static void 28704 conn_walk_fanout_table(connf_t *connfp, uint_t count, pfv_t func, void *arg, 28705 zoneid_t zoneid) 28706 { 28707 conn_t *connp; 28708 28709 while (count-- > 0) { 28710 mutex_enter(&connfp->connf_lock); 28711 for (connp = connfp->connf_head; connp != NULL; 28712 connp = connp->conn_next) { 28713 if (zoneid == GLOBAL_ZONEID || 28714 zoneid == connp->conn_zoneid) { 28715 CONN_INC_REF(connp); 28716 mutex_exit(&connfp->connf_lock); 28717 (*func)(connp, arg); 28718 mutex_enter(&connfp->connf_lock); 28719 CONN_DEC_REF(connp); 28720 } 28721 } 28722 mutex_exit(&connfp->connf_lock); 28723 connfp++; 28724 } 28725 } 28726 28727 /* ipcl_walk routine invoked for ip_conn_report for each conn. */ 28728 static void 28729 conn_report1(conn_t *connp, void *mp) 28730 { 28731 char buf1[INET6_ADDRSTRLEN]; 28732 char buf2[INET6_ADDRSTRLEN]; 28733 uint_t print_len, buf_len; 28734 28735 ASSERT(connp != NULL); 28736 28737 buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr; 28738 if (buf_len <= 0) 28739 return; 28740 (void) inet_ntop(AF_INET6, &connp->conn_srcv6, buf1, sizeof (buf1)), 28741 (void) inet_ntop(AF_INET6, &connp->conn_remv6, buf2, sizeof (buf2)), 28742 print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len, 28743 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR 28744 "%5d %s/%05d %s/%05d\n", 28745 (void *)connp, (void *)CONNP_TO_RQ(connp), 28746 (void *)CONNP_TO_WQ(connp), connp->conn_zoneid, 28747 buf1, connp->conn_lport, 28748 buf2, connp->conn_fport); 28749 if (print_len < buf_len) { 28750 ((mblk_t *)mp)->b_wptr += print_len; 28751 } else { 28752 ((mblk_t *)mp)->b_wptr += buf_len; 28753 } 28754 } 28755 28756 /* 28757 * Named Dispatch routine to produce a formatted report on all conns 28758 * that are listed in one of the fanout tables. 28759 * This report is accessed by using the ndd utility to "get" ND variable 28760 * "ip_conn_status". 28761 */ 28762 /* ARGSUSED */ 28763 static int 28764 ip_conn_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 28765 { 28766 conn_t *connp = Q_TO_CONN(q); 28767 28768 (void) mi_mpprintf(mp, 28769 "CONN " MI_COL_HDRPAD_STR 28770 "rfq " MI_COL_HDRPAD_STR 28771 "stq " MI_COL_HDRPAD_STR 28772 " zone local remote"); 28773 28774 /* 28775 * Because of the ndd constraint, at most we can have 64K buffer 28776 * to put in all conn info. So to be more efficient, just 28777 * allocate a 64K buffer here, assuming we need that large buffer. 28778 * This should be OK as only privileged processes can do ndd /dev/ip. 28779 */ 28780 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 28781 /* The following may work even if we cannot get a large buf. */ 28782 (void) mi_mpprintf(mp, "<< Out of buffer >>\n"); 28783 return (0); 28784 } 28785 28786 conn_walk_fanout(conn_report1, mp->b_cont, connp->conn_zoneid, 28787 connp->conn_netstack->netstack_ip); 28788 return (0); 28789 } 28790 28791 /* 28792 * Determine if the ill and multicast aspects of that packets 28793 * "matches" the conn. 28794 */ 28795 boolean_t 28796 conn_wantpacket(conn_t *connp, ill_t *ill, ipha_t *ipha, int fanout_flags, 28797 zoneid_t zoneid) 28798 { 28799 ill_t *in_ill; 28800 boolean_t found; 28801 ipif_t *ipif; 28802 ire_t *ire; 28803 ipaddr_t dst, src; 28804 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 28805 28806 dst = ipha->ipha_dst; 28807 src = ipha->ipha_src; 28808 28809 /* 28810 * conn_incoming_ill is set by IP_BOUND_IF which limits 28811 * unicast, broadcast and multicast reception to 28812 * conn_incoming_ill. conn_wantpacket itself is called 28813 * only for BROADCAST and multicast. 28814 * 28815 * 1) ip_rput supresses duplicate broadcasts if the ill 28816 * is part of a group. Hence, we should be receiving 28817 * just one copy of broadcast for the whole group. 28818 * Thus, if it is part of the group the packet could 28819 * come on any ill of the group and hence we need a 28820 * match on the group. Otherwise, match on ill should 28821 * be sufficient. 28822 * 28823 * 2) ip_rput does not suppress duplicate multicast packets. 28824 * If there are two interfaces in a ill group and we have 28825 * 2 applications (conns) joined a multicast group G on 28826 * both the interfaces, ilm_lookup_ill filter in ip_rput 28827 * will give us two packets because we join G on both the 28828 * interfaces rather than nominating just one interface 28829 * for receiving multicast like broadcast above. So, 28830 * we have to call ilg_lookup_ill to filter out duplicate 28831 * copies, if ill is part of a group. 28832 */ 28833 in_ill = connp->conn_incoming_ill; 28834 if (in_ill != NULL) { 28835 if (in_ill->ill_group == NULL) { 28836 if (in_ill != ill) 28837 return (B_FALSE); 28838 } else if (in_ill->ill_group != ill->ill_group) { 28839 return (B_FALSE); 28840 } 28841 } 28842 28843 if (!CLASSD(dst)) { 28844 if (IPCL_ZONE_MATCH(connp, zoneid)) 28845 return (B_TRUE); 28846 /* 28847 * The conn is in a different zone; we need to check that this 28848 * broadcast address is configured in the application's zone and 28849 * on one ill in the group. 28850 */ 28851 ipif = ipif_get_next_ipif(NULL, ill); 28852 if (ipif == NULL) 28853 return (B_FALSE); 28854 ire = ire_ctable_lookup(dst, 0, IRE_BROADCAST, ipif, 28855 connp->conn_zoneid, NULL, 28856 (MATCH_IRE_TYPE | MATCH_IRE_ILL_GROUP), ipst); 28857 ipif_refrele(ipif); 28858 if (ire != NULL) { 28859 ire_refrele(ire); 28860 return (B_TRUE); 28861 } else { 28862 return (B_FALSE); 28863 } 28864 } 28865 28866 if ((fanout_flags & IP_FF_NO_MCAST_LOOP) && 28867 connp->conn_zoneid == zoneid) { 28868 /* 28869 * Loopback case: the sending endpoint has IP_MULTICAST_LOOP 28870 * disabled, therefore we don't dispatch the multicast packet to 28871 * the sending zone. 28872 */ 28873 return (B_FALSE); 28874 } 28875 28876 if ((ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) && 28877 connp->conn_zoneid != zoneid) { 28878 /* 28879 * Multicast packet on the loopback interface: we only match 28880 * conns who joined the group in the specified zone. 28881 */ 28882 return (B_FALSE); 28883 } 28884 28885 if (connp->conn_multi_router) { 28886 /* multicast packet and multicast router socket: send up */ 28887 return (B_TRUE); 28888 } 28889 28890 mutex_enter(&connp->conn_lock); 28891 found = (ilg_lookup_ill_withsrc(connp, dst, src, ill) != NULL); 28892 mutex_exit(&connp->conn_lock); 28893 return (found); 28894 } 28895 28896 /* 28897 * Finish processing of "arp_up" when AR_DLPIOP_DONE is received from arp. 28898 */ 28899 /* ARGSUSED */ 28900 static void 28901 ip_arp_done(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp, void *dummy_arg) 28902 { 28903 ill_t *ill = (ill_t *)q->q_ptr; 28904 mblk_t *mp1, *mp2; 28905 ipif_t *ipif; 28906 int err = 0; 28907 conn_t *connp = NULL; 28908 ipsq_t *ipsq; 28909 arc_t *arc; 28910 28911 ip1dbg(("ip_arp_done(%s)\n", ill->ill_name)); 28912 28913 ASSERT((mp->b_wptr - mp->b_rptr) >= sizeof (arc_t)); 28914 ASSERT(((arc_t *)mp->b_rptr)->arc_cmd == AR_DLPIOP_DONE); 28915 28916 ASSERT(IAM_WRITER_ILL(ill)); 28917 mp2 = mp->b_cont; 28918 mp->b_cont = NULL; 28919 28920 /* 28921 * We have now received the arp bringup completion message 28922 * from ARP. Mark the arp bringup as done. Also if the arp 28923 * stream has already started closing, send up the AR_ARP_CLOSING 28924 * ack now since ARP is waiting in close for this ack. 28925 */ 28926 mutex_enter(&ill->ill_lock); 28927 ill->ill_arp_bringup_pending = 0; 28928 if (ill->ill_arp_closing) { 28929 mutex_exit(&ill->ill_lock); 28930 /* Let's reuse the mp for sending the ack */ 28931 arc = (arc_t *)mp->b_rptr; 28932 mp->b_wptr = mp->b_rptr + sizeof (arc_t); 28933 arc->arc_cmd = AR_ARP_CLOSING; 28934 qreply(q, mp); 28935 } else { 28936 mutex_exit(&ill->ill_lock); 28937 freeb(mp); 28938 } 28939 28940 ipsq = ill->ill_phyint->phyint_ipsq; 28941 ipif = ipsq->ipsq_pending_ipif; 28942 mp1 = ipsq_pending_mp_get(ipsq, &connp); 28943 ASSERT(!((mp1 != NULL) ^ (ipif != NULL))); 28944 if (mp1 == NULL) { 28945 /* bringup was aborted by the user */ 28946 freemsg(mp2); 28947 return; 28948 } 28949 28950 /* 28951 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we 28952 * must have an associated conn_t. Otherwise, we're bringing this 28953 * interface back up as part of handling an asynchronous event (e.g., 28954 * physical address change). 28955 */ 28956 if (ipsq->ipsq_current_ioctl != 0) { 28957 ASSERT(connp != NULL); 28958 q = CONNP_TO_WQ(connp); 28959 } else { 28960 ASSERT(connp == NULL); 28961 q = ill->ill_rq; 28962 } 28963 28964 /* 28965 * If the DL_BIND_REQ fails, it is noted 28966 * in arc_name_offset. 28967 */ 28968 err = *((int *)mp2->b_rptr); 28969 if (err == 0) { 28970 if (ipif->ipif_isv6) { 28971 if ((err = ipif_up_done_v6(ipif)) != 0) 28972 ip0dbg(("ip_arp_done: init failed\n")); 28973 } else { 28974 if ((err = ipif_up_done(ipif)) != 0) 28975 ip0dbg(("ip_arp_done: init failed\n")); 28976 } 28977 } else { 28978 ip0dbg(("ip_arp_done: DL_BIND_REQ failed\n")); 28979 } 28980 28981 freemsg(mp2); 28982 28983 if ((err == 0) && (ill->ill_up_ipifs)) { 28984 err = ill_up_ipifs(ill, q, mp1); 28985 if (err == EINPROGRESS) 28986 return; 28987 } 28988 28989 if (ill->ill_up_ipifs) 28990 ill_group_cleanup(ill); 28991 28992 /* 28993 * The operation must complete without EINPROGRESS since 28994 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp. 28995 * Otherwise, the operation will be stuck forever in the ipsq. 28996 */ 28997 ASSERT(err != EINPROGRESS); 28998 if (ipsq->ipsq_current_ioctl != 0) 28999 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq); 29000 else 29001 ipsq_current_finish(ipsq); 29002 } 29003 29004 /* Allocate the private structure */ 29005 static int 29006 ip_priv_alloc(void **bufp) 29007 { 29008 void *buf; 29009 29010 if ((buf = kmem_alloc(sizeof (ip_priv_t), KM_NOSLEEP)) == NULL) 29011 return (ENOMEM); 29012 29013 *bufp = buf; 29014 return (0); 29015 } 29016 29017 /* Function to delete the private structure */ 29018 void 29019 ip_priv_free(void *buf) 29020 { 29021 ASSERT(buf != NULL); 29022 kmem_free(buf, sizeof (ip_priv_t)); 29023 } 29024 29025 /* 29026 * The entry point for IPPF processing. 29027 * If the classifier (IPGPC_CLASSIFY) is not loaded and configured, the 29028 * routine just returns. 29029 * 29030 * When called, ip_process generates an ipp_packet_t structure 29031 * which holds the state information for this packet and invokes the 29032 * the classifier (via ipp_packet_process). The classification, depending on 29033 * configured filters, results in a list of actions for this packet. Invoking 29034 * an action may cause the packet to be dropped, in which case the resulting 29035 * mblk (*mpp) is NULL. proc indicates the callout position for 29036 * this packet and ill_index is the interface this packet on or will leave 29037 * on (inbound and outbound resp.). 29038 */ 29039 void 29040 ip_process(ip_proc_t proc, mblk_t **mpp, uint32_t ill_index) 29041 { 29042 mblk_t *mp; 29043 ip_priv_t *priv; 29044 ipp_action_id_t aid; 29045 int rc = 0; 29046 ipp_packet_t *pp; 29047 #define IP_CLASS "ip" 29048 29049 /* If the classifier is not loaded, return */ 29050 if ((aid = ipp_action_lookup(IPGPC_CLASSIFY)) == IPP_ACTION_INVAL) { 29051 return; 29052 } 29053 29054 mp = *mpp; 29055 ASSERT(mp != NULL); 29056 29057 /* Allocate the packet structure */ 29058 rc = ipp_packet_alloc(&pp, IP_CLASS, aid); 29059 if (rc != 0) { 29060 *mpp = NULL; 29061 freemsg(mp); 29062 return; 29063 } 29064 29065 /* Allocate the private structure */ 29066 rc = ip_priv_alloc((void **)&priv); 29067 if (rc != 0) { 29068 *mpp = NULL; 29069 freemsg(mp); 29070 ipp_packet_free(pp); 29071 return; 29072 } 29073 priv->proc = proc; 29074 priv->ill_index = ill_index; 29075 ipp_packet_set_private(pp, priv, ip_priv_free); 29076 ipp_packet_set_data(pp, mp); 29077 29078 /* Invoke the classifier */ 29079 rc = ipp_packet_process(&pp); 29080 if (pp != NULL) { 29081 mp = ipp_packet_get_data(pp); 29082 ipp_packet_free(pp); 29083 if (rc != 0) { 29084 freemsg(mp); 29085 *mpp = NULL; 29086 } 29087 } else { 29088 *mpp = NULL; 29089 } 29090 #undef IP_CLASS 29091 } 29092 29093 /* 29094 * Propagate a multicast group membership operation (add/drop) on 29095 * all the interfaces crossed by the related multirt routes. 29096 * The call is considered successful if the operation succeeds 29097 * on at least one interface. 29098 */ 29099 static int 29100 ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t, ipaddr_t, ipaddr_t, 29101 uint_t *, mcast_record_t, ipaddr_t, mblk_t *), ire_t *ire, conn_t *connp, 29102 boolean_t checkonly, ipaddr_t group, mcast_record_t fmode, ipaddr_t src, 29103 mblk_t *first_mp) 29104 { 29105 ire_t *ire_gw; 29106 irb_t *irb; 29107 int error = 0; 29108 opt_restart_t *or; 29109 ip_stack_t *ipst = ire->ire_ipst; 29110 29111 irb = ire->ire_bucket; 29112 ASSERT(irb != NULL); 29113 29114 ASSERT(DB_TYPE(first_mp) == M_CTL); 29115 29116 or = (opt_restart_t *)first_mp->b_rptr; 29117 IRB_REFHOLD(irb); 29118 for (; ire != NULL; ire = ire->ire_next) { 29119 if ((ire->ire_flags & RTF_MULTIRT) == 0) 29120 continue; 29121 if (ire->ire_addr != group) 29122 continue; 29123 29124 ire_gw = ire_ftable_lookup(ire->ire_gateway_addr, 0, 0, 29125 IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, NULL, 29126 MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE, ipst); 29127 /* No resolver exists for the gateway; skip this ire. */ 29128 if (ire_gw == NULL) 29129 continue; 29130 29131 /* 29132 * This function can return EINPROGRESS. If so the operation 29133 * will be restarted from ip_restart_optmgmt which will 29134 * call ip_opt_set and option processing will restart for 29135 * this option. So we may end up calling 'fn' more than once. 29136 * This requires that 'fn' is idempotent except for the 29137 * return value. The operation is considered a success if 29138 * it succeeds at least once on any one interface. 29139 */ 29140 error = fn(connp, checkonly, group, ire_gw->ire_src_addr, 29141 NULL, fmode, src, first_mp); 29142 if (error == 0) 29143 or->or_private = CGTP_MCAST_SUCCESS; 29144 29145 if (ip_debug > 0) { 29146 ulong_t off; 29147 char *ksym; 29148 ksym = kobj_getsymname((uintptr_t)fn, &off); 29149 ip2dbg(("ip_multirt_apply_membership: " 29150 "called %s, multirt group 0x%08x via itf 0x%08x, " 29151 "error %d [success %u]\n", 29152 ksym ? ksym : "?", 29153 ntohl(group), ntohl(ire_gw->ire_src_addr), 29154 error, or->or_private)); 29155 } 29156 29157 ire_refrele(ire_gw); 29158 if (error == EINPROGRESS) { 29159 IRB_REFRELE(irb); 29160 return (error); 29161 } 29162 } 29163 IRB_REFRELE(irb); 29164 /* 29165 * Consider the call as successful if we succeeded on at least 29166 * one interface. Otherwise, return the last encountered error. 29167 */ 29168 return (or->or_private == CGTP_MCAST_SUCCESS ? 0 : error); 29169 } 29170 29171 29172 /* 29173 * Issue a warning regarding a route crossing an interface with an 29174 * incorrect MTU. Only one message every 'ip_multirt_log_interval' 29175 * amount of time is logged. 29176 */ 29177 static void 29178 ip_multirt_bad_mtu(ire_t *ire, uint32_t max_frag) 29179 { 29180 hrtime_t current = gethrtime(); 29181 char buf[INET_ADDRSTRLEN]; 29182 ip_stack_t *ipst = ire->ire_ipst; 29183 29184 /* Convert interval in ms to hrtime in ns */ 29185 if (ipst->ips_multirt_bad_mtu_last_time + 29186 ((hrtime_t)ipst->ips_ip_multirt_log_interval * (hrtime_t)1000000) <= 29187 current) { 29188 cmn_err(CE_WARN, "ip: ignoring multiroute " 29189 "to %s, incorrect MTU %u (expected %u)\n", 29190 ip_dot_addr(ire->ire_addr, buf), 29191 ire->ire_max_frag, max_frag); 29192 29193 ipst->ips_multirt_bad_mtu_last_time = current; 29194 } 29195 } 29196 29197 29198 /* 29199 * Get the CGTP (multirouting) filtering status. 29200 * If 0, the CGTP hooks are transparent. 29201 */ 29202 /* ARGSUSED */ 29203 static int 29204 ip_cgtp_filter_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr) 29205 { 29206 boolean_t *ip_cgtp_filter_value = (boolean_t *)cp; 29207 ip_stack_t *ipst = CONNQ_TO_IPST(q); 29208 29209 /* 29210 * Only applies to the shared stack since the filter_ops 29211 * do not carry an ip_stack_t or zoneid. 29212 */ 29213 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID) 29214 return (ENOTSUP); 29215 29216 (void) mi_mpprintf(mp, "%d", (int)*ip_cgtp_filter_value); 29217 return (0); 29218 } 29219 29220 29221 /* 29222 * Set the CGTP (multirouting) filtering status. 29223 * If the status is changed from active to transparent 29224 * or from transparent to active, forward the new status 29225 * to the filtering module (if loaded). 29226 */ 29227 /* ARGSUSED */ 29228 static int 29229 ip_cgtp_filter_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 29230 cred_t *ioc_cr) 29231 { 29232 long new_value; 29233 boolean_t *ip_cgtp_filter_value = (boolean_t *)cp; 29234 ip_stack_t *ipst = CONNQ_TO_IPST(q); 29235 29236 if (secpolicy_net_config(ioc_cr, B_FALSE) != 0) 29237 return (EPERM); 29238 29239 /* 29240 * Only applies to the shared stack since the filter_ops 29241 * do not carry an ip_stack_t or zoneid. 29242 */ 29243 if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID) 29244 return (ENOTSUP); 29245 29246 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 29247 new_value < 0 || new_value > 1) { 29248 return (EINVAL); 29249 } 29250 29251 /* 29252 * Do not enable CGTP filtering - thus preventing the hooks 29253 * from being invoked - if the version number of the 29254 * filtering module hooks does not match. 29255 */ 29256 if ((ip_cgtp_filter_ops != NULL) && 29257 (ip_cgtp_filter_ops->cfo_filter_rev != CGTP_FILTER_REV)) { 29258 cmn_err(CE_WARN, "IP: CGTP filtering version mismatch " 29259 "(module hooks version %d, expecting %d)\n", 29260 ip_cgtp_filter_ops->cfo_filter_rev, 29261 CGTP_FILTER_REV); 29262 return (ENOTSUP); 29263 } 29264 29265 if ((!*ip_cgtp_filter_value) && new_value) { 29266 cmn_err(CE_NOTE, "IP: enabling CGTP filtering%s", 29267 ip_cgtp_filter_ops == NULL ? 29268 " (module not loaded)" : ""); 29269 } 29270 if (*ip_cgtp_filter_value && (!new_value)) { 29271 cmn_err(CE_NOTE, "IP: disabling CGTP filtering%s", 29272 ip_cgtp_filter_ops == NULL ? 29273 " (module not loaded)" : ""); 29274 } 29275 29276 if (ip_cgtp_filter_ops != NULL) { 29277 int res; 29278 29279 res = ip_cgtp_filter_ops->cfo_change_state(new_value); 29280 if (res) 29281 return (res); 29282 } 29283 29284 *ip_cgtp_filter_value = (boolean_t)new_value; 29285 29286 return (0); 29287 } 29288 29289 29290 /* 29291 * Return the expected CGTP hooks version number. 29292 */ 29293 int 29294 ip_cgtp_filter_supported(void) 29295 { 29296 ip_stack_t *ipst; 29297 int ret; 29298 29299 ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip; 29300 if (ipst == NULL) 29301 return (-1); 29302 ret = ip_cgtp_filter_rev; 29303 netstack_rele(ipst->ips_netstack); 29304 return (ret); 29305 } 29306 29307 29308 /* 29309 * CGTP hooks can be registered by directly touching ip_cgtp_filter_ops 29310 * or by invoking this function. In the first case, the version number 29311 * of the registered structure is checked at hooks activation time 29312 * in ip_cgtp_filter_set(). 29313 * 29314 * Only applies to the shared stack since the filter_ops 29315 * do not carry an ip_stack_t or zoneid. 29316 */ 29317 int 29318 ip_cgtp_filter_register(cgtp_filter_ops_t *ops) 29319 { 29320 ip_stack_t *ipst; 29321 29322 if (ops->cfo_filter_rev != CGTP_FILTER_REV) 29323 return (ENOTSUP); 29324 29325 ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip; 29326 if (ipst == NULL) 29327 return (EINVAL); 29328 29329 ip_cgtp_filter_ops = ops; 29330 netstack_rele(ipst->ips_netstack); 29331 return (0); 29332 } 29333 29334 static squeue_func_t 29335 ip_squeue_switch(int val) 29336 { 29337 squeue_func_t rval = squeue_fill; 29338 29339 switch (val) { 29340 case IP_SQUEUE_ENTER_NODRAIN: 29341 rval = squeue_enter_nodrain; 29342 break; 29343 case IP_SQUEUE_ENTER: 29344 rval = squeue_enter; 29345 break; 29346 default: 29347 break; 29348 } 29349 return (rval); 29350 } 29351 29352 /* ARGSUSED */ 29353 static int 29354 ip_input_proc_set(queue_t *q, mblk_t *mp, char *value, 29355 caddr_t addr, cred_t *cr) 29356 { 29357 int *v = (int *)addr; 29358 long new_value; 29359 29360 if (secpolicy_net_config(cr, B_FALSE) != 0) 29361 return (EPERM); 29362 29363 if (ddi_strtol(value, NULL, 10, &new_value) != 0) 29364 return (EINVAL); 29365 29366 ip_input_proc = ip_squeue_switch(new_value); 29367 *v = new_value; 29368 return (0); 29369 } 29370 29371 /* ARGSUSED */ 29372 static int 29373 ip_int_set(queue_t *q, mblk_t *mp, char *value, 29374 caddr_t addr, cred_t *cr) 29375 { 29376 int *v = (int *)addr; 29377 long new_value; 29378 29379 if (secpolicy_net_config(cr, B_FALSE) != 0) 29380 return (EPERM); 29381 29382 if (ddi_strtol(value, NULL, 10, &new_value) != 0) 29383 return (EINVAL); 29384 29385 *v = new_value; 29386 return (0); 29387 } 29388 29389 static void * 29390 ip_kstat2_init(netstackid_t stackid, ip_stat_t *ip_statisticsp) 29391 { 29392 kstat_t *ksp; 29393 29394 ip_stat_t template = { 29395 { "ipsec_fanout_proto", KSTAT_DATA_UINT64 }, 29396 { "ip_udp_fannorm", KSTAT_DATA_UINT64 }, 29397 { "ip_udp_fanmb", KSTAT_DATA_UINT64 }, 29398 { "ip_udp_fanothers", KSTAT_DATA_UINT64 }, 29399 { "ip_udp_fast_path", KSTAT_DATA_UINT64 }, 29400 { "ip_udp_slow_path", KSTAT_DATA_UINT64 }, 29401 { "ip_udp_input_err", KSTAT_DATA_UINT64 }, 29402 { "ip_tcppullup", KSTAT_DATA_UINT64 }, 29403 { "ip_tcpoptions", KSTAT_DATA_UINT64 }, 29404 { "ip_multipkttcp", KSTAT_DATA_UINT64 }, 29405 { "ip_tcp_fast_path", KSTAT_DATA_UINT64 }, 29406 { "ip_tcp_slow_path", KSTAT_DATA_UINT64 }, 29407 { "ip_tcp_input_error", KSTAT_DATA_UINT64 }, 29408 { "ip_db_ref", KSTAT_DATA_UINT64 }, 29409 { "ip_notaligned1", KSTAT_DATA_UINT64 }, 29410 { "ip_notaligned2", KSTAT_DATA_UINT64 }, 29411 { "ip_multimblk3", KSTAT_DATA_UINT64 }, 29412 { "ip_multimblk4", KSTAT_DATA_UINT64 }, 29413 { "ip_ipoptions", KSTAT_DATA_UINT64 }, 29414 { "ip_classify_fail", KSTAT_DATA_UINT64 }, 29415 { "ip_opt", KSTAT_DATA_UINT64 }, 29416 { "ip_udp_rput_local", KSTAT_DATA_UINT64 }, 29417 { "ipsec_proto_ahesp", KSTAT_DATA_UINT64 }, 29418 { "ip_conn_flputbq", KSTAT_DATA_UINT64 }, 29419 { "ip_conn_walk_drain", KSTAT_DATA_UINT64 }, 29420 { "ip_out_sw_cksum", KSTAT_DATA_UINT64 }, 29421 { "ip_in_sw_cksum", KSTAT_DATA_UINT64 }, 29422 { "ip_trash_ire_reclaim_calls", KSTAT_DATA_UINT64 }, 29423 { "ip_trash_ire_reclaim_success", KSTAT_DATA_UINT64 }, 29424 { "ip_ire_arp_timer_expired", KSTAT_DATA_UINT64 }, 29425 { "ip_ire_redirect_timer_expired", KSTAT_DATA_UINT64 }, 29426 { "ip_ire_pmtu_timer_expired", KSTAT_DATA_UINT64 }, 29427 { "ip_input_multi_squeue", KSTAT_DATA_UINT64 }, 29428 { "ip_tcp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 }, 29429 { "ip_tcp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 }, 29430 { "ip_tcp_in_sw_cksum_err", KSTAT_DATA_UINT64 }, 29431 { "ip_tcp_out_sw_cksum_bytes", KSTAT_DATA_UINT64 }, 29432 { "ip_udp_in_full_hw_cksum_err", KSTAT_DATA_UINT64 }, 29433 { "ip_udp_in_part_hw_cksum_err", KSTAT_DATA_UINT64 }, 29434 { "ip_udp_in_sw_cksum_err", KSTAT_DATA_UINT64 }, 29435 { "ip_udp_out_sw_cksum_bytes", KSTAT_DATA_UINT64 }, 29436 { "ip_frag_mdt_pkt_out", KSTAT_DATA_UINT64 }, 29437 { "ip_frag_mdt_discarded", KSTAT_DATA_UINT64 }, 29438 { "ip_frag_mdt_allocfail", KSTAT_DATA_UINT64 }, 29439 { "ip_frag_mdt_addpdescfail", KSTAT_DATA_UINT64 }, 29440 { "ip_frag_mdt_allocd", KSTAT_DATA_UINT64 }, 29441 }; 29442 29443 ksp = kstat_create_netstack("ip", 0, "ipstat", "net", 29444 KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t), 29445 KSTAT_FLAG_VIRTUAL, stackid); 29446 29447 if (ksp == NULL) 29448 return (NULL); 29449 29450 bcopy(&template, ip_statisticsp, sizeof (template)); 29451 ksp->ks_data = (void *)ip_statisticsp; 29452 ksp->ks_private = (void *)(uintptr_t)stackid; 29453 29454 kstat_install(ksp); 29455 return (ksp); 29456 } 29457 29458 static void 29459 ip_kstat2_fini(netstackid_t stackid, kstat_t *ksp) 29460 { 29461 if (ksp != NULL) { 29462 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 29463 kstat_delete_netstack(ksp, stackid); 29464 } 29465 } 29466 29467 static void * 29468 ip_kstat_init(netstackid_t stackid, ip_stack_t *ipst) 29469 { 29470 kstat_t *ksp; 29471 29472 ip_named_kstat_t template = { 29473 { "forwarding", KSTAT_DATA_UINT32, 0 }, 29474 { "defaultTTL", KSTAT_DATA_UINT32, 0 }, 29475 { "inReceives", KSTAT_DATA_UINT64, 0 }, 29476 { "inHdrErrors", KSTAT_DATA_UINT32, 0 }, 29477 { "inAddrErrors", KSTAT_DATA_UINT32, 0 }, 29478 { "forwDatagrams", KSTAT_DATA_UINT64, 0 }, 29479 { "inUnknownProtos", KSTAT_DATA_UINT32, 0 }, 29480 { "inDiscards", KSTAT_DATA_UINT32, 0 }, 29481 { "inDelivers", KSTAT_DATA_UINT64, 0 }, 29482 { "outRequests", KSTAT_DATA_UINT64, 0 }, 29483 { "outDiscards", KSTAT_DATA_UINT32, 0 }, 29484 { "outNoRoutes", KSTAT_DATA_UINT32, 0 }, 29485 { "reasmTimeout", KSTAT_DATA_UINT32, 0 }, 29486 { "reasmReqds", KSTAT_DATA_UINT32, 0 }, 29487 { "reasmOKs", KSTAT_DATA_UINT32, 0 }, 29488 { "reasmFails", KSTAT_DATA_UINT32, 0 }, 29489 { "fragOKs", KSTAT_DATA_UINT32, 0 }, 29490 { "fragFails", KSTAT_DATA_UINT32, 0 }, 29491 { "fragCreates", KSTAT_DATA_UINT32, 0 }, 29492 { "addrEntrySize", KSTAT_DATA_INT32, 0 }, 29493 { "routeEntrySize", KSTAT_DATA_INT32, 0 }, 29494 { "netToMediaEntrySize", KSTAT_DATA_INT32, 0 }, 29495 { "routingDiscards", KSTAT_DATA_UINT32, 0 }, 29496 { "inErrs", KSTAT_DATA_UINT32, 0 }, 29497 { "noPorts", KSTAT_DATA_UINT32, 0 }, 29498 { "inCksumErrs", KSTAT_DATA_UINT32, 0 }, 29499 { "reasmDuplicates", KSTAT_DATA_UINT32, 0 }, 29500 { "reasmPartDups", KSTAT_DATA_UINT32, 0 }, 29501 { "forwProhibits", KSTAT_DATA_UINT32, 0 }, 29502 { "udpInCksumErrs", KSTAT_DATA_UINT32, 0 }, 29503 { "udpInOverflows", KSTAT_DATA_UINT32, 0 }, 29504 { "rawipInOverflows", KSTAT_DATA_UINT32, 0 }, 29505 { "ipsecInSucceeded", KSTAT_DATA_UINT32, 0 }, 29506 { "ipsecInFailed", KSTAT_DATA_INT32, 0 }, 29507 { "memberEntrySize", KSTAT_DATA_INT32, 0 }, 29508 { "inIPv6", KSTAT_DATA_UINT32, 0 }, 29509 { "outIPv6", KSTAT_DATA_UINT32, 0 }, 29510 { "outSwitchIPv6", KSTAT_DATA_UINT32, 0 }, 29511 }; 29512 29513 ksp = kstat_create_netstack("ip", 0, "ip", "mib2", KSTAT_TYPE_NAMED, 29514 NUM_OF_FIELDS(ip_named_kstat_t), 29515 0, stackid); 29516 if (ksp == NULL || ksp->ks_data == NULL) 29517 return (NULL); 29518 29519 template.forwarding.value.ui32 = WE_ARE_FORWARDING(ipst) ? 1:2; 29520 template.defaultTTL.value.ui32 = (uint32_t)ipst->ips_ip_def_ttl; 29521 template.reasmTimeout.value.ui32 = ipst->ips_ip_g_frag_timeout; 29522 template.addrEntrySize.value.i32 = sizeof (mib2_ipAddrEntry_t); 29523 template.routeEntrySize.value.i32 = sizeof (mib2_ipRouteEntry_t); 29524 29525 template.netToMediaEntrySize.value.i32 = 29526 sizeof (mib2_ipNetToMediaEntry_t); 29527 29528 template.memberEntrySize.value.i32 = sizeof (ipv6_member_t); 29529 29530 bcopy(&template, ksp->ks_data, sizeof (template)); 29531 ksp->ks_update = ip_kstat_update; 29532 ksp->ks_private = (void *)(uintptr_t)stackid; 29533 29534 kstat_install(ksp); 29535 return (ksp); 29536 } 29537 29538 static void 29539 ip_kstat_fini(netstackid_t stackid, kstat_t *ksp) 29540 { 29541 if (ksp != NULL) { 29542 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 29543 kstat_delete_netstack(ksp, stackid); 29544 } 29545 } 29546 29547 static int 29548 ip_kstat_update(kstat_t *kp, int rw) 29549 { 29550 ip_named_kstat_t *ipkp; 29551 mib2_ipIfStatsEntry_t ipmib; 29552 ill_walk_context_t ctx; 29553 ill_t *ill; 29554 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private; 29555 netstack_t *ns; 29556 ip_stack_t *ipst; 29557 29558 if (kp == NULL || kp->ks_data == NULL) 29559 return (EIO); 29560 29561 if (rw == KSTAT_WRITE) 29562 return (EACCES); 29563 29564 ns = netstack_find_by_stackid(stackid); 29565 if (ns == NULL) 29566 return (-1); 29567 ipst = ns->netstack_ip; 29568 if (ipst == NULL) { 29569 netstack_rele(ns); 29570 return (-1); 29571 } 29572 ipkp = (ip_named_kstat_t *)kp->ks_data; 29573 29574 bcopy(&ipst->ips_ip_mib, &ipmib, sizeof (ipmib)); 29575 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 29576 ill = ILL_START_WALK_V4(&ctx, ipst); 29577 for (; ill != NULL; ill = ill_next(&ctx, ill)) 29578 ip_mib2_add_ip_stats(&ipmib, ill->ill_ip_mib); 29579 rw_exit(&ipst->ips_ill_g_lock); 29580 29581 ipkp->forwarding.value.ui32 = ipmib.ipIfStatsForwarding; 29582 ipkp->defaultTTL.value.ui32 = ipmib.ipIfStatsDefaultTTL; 29583 ipkp->inReceives.value.ui64 = ipmib.ipIfStatsHCInReceives; 29584 ipkp->inHdrErrors.value.ui32 = ipmib.ipIfStatsInHdrErrors; 29585 ipkp->inAddrErrors.value.ui32 = ipmib.ipIfStatsInAddrErrors; 29586 ipkp->forwDatagrams.value.ui64 = ipmib.ipIfStatsHCOutForwDatagrams; 29587 ipkp->inUnknownProtos.value.ui32 = ipmib.ipIfStatsInUnknownProtos; 29588 ipkp->inDiscards.value.ui32 = ipmib.ipIfStatsInDiscards; 29589 ipkp->inDelivers.value.ui64 = ipmib.ipIfStatsHCInDelivers; 29590 ipkp->outRequests.value.ui64 = ipmib.ipIfStatsHCOutRequests; 29591 ipkp->outDiscards.value.ui32 = ipmib.ipIfStatsOutDiscards; 29592 ipkp->outNoRoutes.value.ui32 = ipmib.ipIfStatsOutNoRoutes; 29593 ipkp->reasmTimeout.value.ui32 = ipst->ips_ip_g_frag_timeout; 29594 ipkp->reasmReqds.value.ui32 = ipmib.ipIfStatsReasmReqds; 29595 ipkp->reasmOKs.value.ui32 = ipmib.ipIfStatsReasmOKs; 29596 ipkp->reasmFails.value.ui32 = ipmib.ipIfStatsReasmFails; 29597 ipkp->fragOKs.value.ui32 = ipmib.ipIfStatsOutFragOKs; 29598 ipkp->fragFails.value.ui32 = ipmib.ipIfStatsOutFragFails; 29599 ipkp->fragCreates.value.ui32 = ipmib.ipIfStatsOutFragCreates; 29600 29601 ipkp->routingDiscards.value.ui32 = 0; 29602 ipkp->inErrs.value.ui32 = ipmib.tcpIfStatsInErrs; 29603 ipkp->noPorts.value.ui32 = ipmib.udpIfStatsNoPorts; 29604 ipkp->inCksumErrs.value.ui32 = ipmib.ipIfStatsInCksumErrs; 29605 ipkp->reasmDuplicates.value.ui32 = ipmib.ipIfStatsReasmDuplicates; 29606 ipkp->reasmPartDups.value.ui32 = ipmib.ipIfStatsReasmPartDups; 29607 ipkp->forwProhibits.value.ui32 = ipmib.ipIfStatsForwProhibits; 29608 ipkp->udpInCksumErrs.value.ui32 = ipmib.udpIfStatsInCksumErrs; 29609 ipkp->udpInOverflows.value.ui32 = ipmib.udpIfStatsInOverflows; 29610 ipkp->rawipInOverflows.value.ui32 = ipmib.rawipIfStatsInOverflows; 29611 ipkp->ipsecInSucceeded.value.ui32 = ipmib.ipsecIfStatsInSucceeded; 29612 ipkp->ipsecInFailed.value.i32 = ipmib.ipsecIfStatsInFailed; 29613 29614 ipkp->inIPv6.value.ui32 = ipmib.ipIfStatsInWrongIPVersion; 29615 ipkp->outIPv6.value.ui32 = ipmib.ipIfStatsOutWrongIPVersion; 29616 ipkp->outSwitchIPv6.value.ui32 = ipmib.ipIfStatsOutSwitchIPVersion; 29617 29618 netstack_rele(ns); 29619 29620 return (0); 29621 } 29622 29623 static void * 29624 icmp_kstat_init(netstackid_t stackid) 29625 { 29626 kstat_t *ksp; 29627 29628 icmp_named_kstat_t template = { 29629 { "inMsgs", KSTAT_DATA_UINT32 }, 29630 { "inErrors", KSTAT_DATA_UINT32 }, 29631 { "inDestUnreachs", KSTAT_DATA_UINT32 }, 29632 { "inTimeExcds", KSTAT_DATA_UINT32 }, 29633 { "inParmProbs", KSTAT_DATA_UINT32 }, 29634 { "inSrcQuenchs", KSTAT_DATA_UINT32 }, 29635 { "inRedirects", KSTAT_DATA_UINT32 }, 29636 { "inEchos", KSTAT_DATA_UINT32 }, 29637 { "inEchoReps", KSTAT_DATA_UINT32 }, 29638 { "inTimestamps", KSTAT_DATA_UINT32 }, 29639 { "inTimestampReps", KSTAT_DATA_UINT32 }, 29640 { "inAddrMasks", KSTAT_DATA_UINT32 }, 29641 { "inAddrMaskReps", KSTAT_DATA_UINT32 }, 29642 { "outMsgs", KSTAT_DATA_UINT32 }, 29643 { "outErrors", KSTAT_DATA_UINT32 }, 29644 { "outDestUnreachs", KSTAT_DATA_UINT32 }, 29645 { "outTimeExcds", KSTAT_DATA_UINT32 }, 29646 { "outParmProbs", KSTAT_DATA_UINT32 }, 29647 { "outSrcQuenchs", KSTAT_DATA_UINT32 }, 29648 { "outRedirects", KSTAT_DATA_UINT32 }, 29649 { "outEchos", KSTAT_DATA_UINT32 }, 29650 { "outEchoReps", KSTAT_DATA_UINT32 }, 29651 { "outTimestamps", KSTAT_DATA_UINT32 }, 29652 { "outTimestampReps", KSTAT_DATA_UINT32 }, 29653 { "outAddrMasks", KSTAT_DATA_UINT32 }, 29654 { "outAddrMaskReps", KSTAT_DATA_UINT32 }, 29655 { "inChksumErrs", KSTAT_DATA_UINT32 }, 29656 { "inUnknowns", KSTAT_DATA_UINT32 }, 29657 { "inFragNeeded", KSTAT_DATA_UINT32 }, 29658 { "outFragNeeded", KSTAT_DATA_UINT32 }, 29659 { "outDrops", KSTAT_DATA_UINT32 }, 29660 { "inOverFlows", KSTAT_DATA_UINT32 }, 29661 { "inBadRedirects", KSTAT_DATA_UINT32 }, 29662 }; 29663 29664 ksp = kstat_create_netstack("ip", 0, "icmp", "mib2", KSTAT_TYPE_NAMED, 29665 NUM_OF_FIELDS(icmp_named_kstat_t), 29666 0, stackid); 29667 if (ksp == NULL || ksp->ks_data == NULL) 29668 return (NULL); 29669 29670 bcopy(&template, ksp->ks_data, sizeof (template)); 29671 29672 ksp->ks_update = icmp_kstat_update; 29673 ksp->ks_private = (void *)(uintptr_t)stackid; 29674 29675 kstat_install(ksp); 29676 return (ksp); 29677 } 29678 29679 static void 29680 icmp_kstat_fini(netstackid_t stackid, kstat_t *ksp) 29681 { 29682 if (ksp != NULL) { 29683 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 29684 kstat_delete_netstack(ksp, stackid); 29685 } 29686 } 29687 29688 static int 29689 icmp_kstat_update(kstat_t *kp, int rw) 29690 { 29691 icmp_named_kstat_t *icmpkp; 29692 netstackid_t stackid = (zoneid_t)(uintptr_t)kp->ks_private; 29693 netstack_t *ns; 29694 ip_stack_t *ipst; 29695 29696 if ((kp == NULL) || (kp->ks_data == NULL)) 29697 return (EIO); 29698 29699 if (rw == KSTAT_WRITE) 29700 return (EACCES); 29701 29702 ns = netstack_find_by_stackid(stackid); 29703 if (ns == NULL) 29704 return (-1); 29705 ipst = ns->netstack_ip; 29706 if (ipst == NULL) { 29707 netstack_rele(ns); 29708 return (-1); 29709 } 29710 icmpkp = (icmp_named_kstat_t *)kp->ks_data; 29711 29712 icmpkp->inMsgs.value.ui32 = ipst->ips_icmp_mib.icmpInMsgs; 29713 icmpkp->inErrors.value.ui32 = ipst->ips_icmp_mib.icmpInErrors; 29714 icmpkp->inDestUnreachs.value.ui32 = 29715 ipst->ips_icmp_mib.icmpInDestUnreachs; 29716 icmpkp->inTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpInTimeExcds; 29717 icmpkp->inParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpInParmProbs; 29718 icmpkp->inSrcQuenchs.value.ui32 = ipst->ips_icmp_mib.icmpInSrcQuenchs; 29719 icmpkp->inRedirects.value.ui32 = ipst->ips_icmp_mib.icmpInRedirects; 29720 icmpkp->inEchos.value.ui32 = ipst->ips_icmp_mib.icmpInEchos; 29721 icmpkp->inEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpInEchoReps; 29722 icmpkp->inTimestamps.value.ui32 = ipst->ips_icmp_mib.icmpInTimestamps; 29723 icmpkp->inTimestampReps.value.ui32 = 29724 ipst->ips_icmp_mib.icmpInTimestampReps; 29725 icmpkp->inAddrMasks.value.ui32 = ipst->ips_icmp_mib.icmpInAddrMasks; 29726 icmpkp->inAddrMaskReps.value.ui32 = 29727 ipst->ips_icmp_mib.icmpInAddrMaskReps; 29728 icmpkp->outMsgs.value.ui32 = ipst->ips_icmp_mib.icmpOutMsgs; 29729 icmpkp->outErrors.value.ui32 = ipst->ips_icmp_mib.icmpOutErrors; 29730 icmpkp->outDestUnreachs.value.ui32 = 29731 ipst->ips_icmp_mib.icmpOutDestUnreachs; 29732 icmpkp->outTimeExcds.value.ui32 = ipst->ips_icmp_mib.icmpOutTimeExcds; 29733 icmpkp->outParmProbs.value.ui32 = ipst->ips_icmp_mib.icmpOutParmProbs; 29734 icmpkp->outSrcQuenchs.value.ui32 = 29735 ipst->ips_icmp_mib.icmpOutSrcQuenchs; 29736 icmpkp->outRedirects.value.ui32 = ipst->ips_icmp_mib.icmpOutRedirects; 29737 icmpkp->outEchos.value.ui32 = ipst->ips_icmp_mib.icmpOutEchos; 29738 icmpkp->outEchoReps.value.ui32 = ipst->ips_icmp_mib.icmpOutEchoReps; 29739 icmpkp->outTimestamps.value.ui32 = 29740 ipst->ips_icmp_mib.icmpOutTimestamps; 29741 icmpkp->outTimestampReps.value.ui32 = 29742 ipst->ips_icmp_mib.icmpOutTimestampReps; 29743 icmpkp->outAddrMasks.value.ui32 = 29744 ipst->ips_icmp_mib.icmpOutAddrMasks; 29745 icmpkp->outAddrMaskReps.value.ui32 = 29746 ipst->ips_icmp_mib.icmpOutAddrMaskReps; 29747 icmpkp->inCksumErrs.value.ui32 = ipst->ips_icmp_mib.icmpInCksumErrs; 29748 icmpkp->inUnknowns.value.ui32 = ipst->ips_icmp_mib.icmpInUnknowns; 29749 icmpkp->inFragNeeded.value.ui32 = ipst->ips_icmp_mib.icmpInFragNeeded; 29750 icmpkp->outFragNeeded.value.ui32 = 29751 ipst->ips_icmp_mib.icmpOutFragNeeded; 29752 icmpkp->outDrops.value.ui32 = ipst->ips_icmp_mib.icmpOutDrops; 29753 icmpkp->inOverflows.value.ui32 = ipst->ips_icmp_mib.icmpInOverflows; 29754 icmpkp->inBadRedirects.value.ui32 = 29755 ipst->ips_icmp_mib.icmpInBadRedirects; 29756 29757 netstack_rele(ns); 29758 return (0); 29759 } 29760 29761 /* 29762 * This is the fanout function for raw socket opened for SCTP. Note 29763 * that it is called after SCTP checks that there is no socket which 29764 * wants a packet. Then before SCTP handles this out of the blue packet, 29765 * this function is called to see if there is any raw socket for SCTP. 29766 * If there is and it is bound to the correct address, the packet will 29767 * be sent to that socket. Note that only one raw socket can be bound to 29768 * a port. This is assured in ipcl_sctp_hash_insert(); 29769 */ 29770 void 29771 ip_fanout_sctp_raw(mblk_t *mp, ill_t *recv_ill, ipha_t *ipha, boolean_t isv4, 29772 uint32_t ports, boolean_t mctl_present, uint_t flags, boolean_t ip_policy, 29773 uint_t ipif_seqid, zoneid_t zoneid) 29774 { 29775 conn_t *connp; 29776 queue_t *rq; 29777 mblk_t *first_mp; 29778 boolean_t secure; 29779 ip6_t *ip6h; 29780 ip_stack_t *ipst = recv_ill->ill_ipst; 29781 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 29782 29783 first_mp = mp; 29784 if (mctl_present) { 29785 mp = first_mp->b_cont; 29786 secure = ipsec_in_is_secure(first_mp); 29787 ASSERT(mp != NULL); 29788 } else { 29789 secure = B_FALSE; 29790 } 29791 ip6h = (isv4) ? NULL : (ip6_t *)ipha; 29792 29793 connp = ipcl_classify_raw(mp, IPPROTO_SCTP, zoneid, ports, ipha, ipst); 29794 if (connp == NULL) { 29795 sctp_ootb_input(first_mp, recv_ill, ipif_seqid, zoneid, 29796 mctl_present); 29797 return; 29798 } 29799 rq = connp->conn_rq; 29800 if (!canputnext(rq)) { 29801 CONN_DEC_REF(connp); 29802 BUMP_MIB(recv_ill->ill_ip_mib, rawipIfStatsInOverflows); 29803 freemsg(first_mp); 29804 return; 29805 } 29806 if ((isv4 ? CONN_INBOUND_POLICY_PRESENT(connp, ipss) : 29807 CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) || secure) { 29808 first_mp = ipsec_check_inbound_policy(first_mp, connp, 29809 (isv4 ? ipha : NULL), ip6h, mctl_present); 29810 if (first_mp == NULL) { 29811 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsInDiscards); 29812 CONN_DEC_REF(connp); 29813 return; 29814 } 29815 } 29816 /* 29817 * We probably should not send M_CTL message up to 29818 * raw socket. 29819 */ 29820 if (mctl_present) 29821 freeb(first_mp); 29822 29823 /* Initiate IPPF processing here if needed. */ 29824 if ((isv4 && IPP_ENABLED(IPP_LOCAL_IN, ipst) && ip_policy) || 29825 (!isv4 && IP6_IN_IPP(flags, ipst))) { 29826 ip_process(IPP_LOCAL_IN, &mp, 29827 recv_ill->ill_phyint->phyint_ifindex); 29828 if (mp == NULL) { 29829 CONN_DEC_REF(connp); 29830 return; 29831 } 29832 } 29833 29834 if (connp->conn_recvif || connp->conn_recvslla || 29835 ((connp->conn_ip_recvpktinfo || 29836 (!isv4 && IN6_IS_ADDR_LINKLOCAL(&ip6h->ip6_src))) && 29837 (flags & IP_FF_IPINFO))) { 29838 int in_flags = 0; 29839 29840 /* 29841 * Since sctp does not support IP_RECVPKTINFO for v4, only pass 29842 * IPF_RECVIF. 29843 */ 29844 if (connp->conn_recvif || connp->conn_ip_recvpktinfo) { 29845 in_flags = IPF_RECVIF; 29846 } 29847 if (connp->conn_recvslla) { 29848 in_flags |= IPF_RECVSLLA; 29849 } 29850 if (isv4) { 29851 mp = ip_add_info(mp, recv_ill, in_flags, 29852 IPCL_ZONEID(connp), ipst); 29853 } else { 29854 mp = ip_add_info_v6(mp, recv_ill, &ip6h->ip6_dst); 29855 if (mp == NULL) { 29856 BUMP_MIB(recv_ill->ill_ip_mib, 29857 ipIfStatsInDiscards); 29858 CONN_DEC_REF(connp); 29859 return; 29860 } 29861 } 29862 } 29863 29864 BUMP_MIB(recv_ill->ill_ip_mib, ipIfStatsHCInDelivers); 29865 /* 29866 * We are sending the IPSEC_IN message also up. Refer 29867 * to comments above this function. 29868 */ 29869 putnext(rq, mp); 29870 CONN_DEC_REF(connp); 29871 } 29872 29873 #define UPDATE_IP_MIB_OB_COUNTERS(ill, len) \ 29874 { \ 29875 BUMP_MIB((ill)->ill_ip_mib, ipIfStatsHCOutTransmits); \ 29876 UPDATE_MIB((ill)->ill_ip_mib, ipIfStatsHCOutOctets, (len)); \ 29877 } 29878 /* 29879 * This function should be called only if all packet processing 29880 * including fragmentation is complete. Callers of this function 29881 * must set mp->b_prev to one of these values: 29882 * {0, IPP_FWD_OUT, IPP_LOCAL_OUT} 29883 * prior to handing over the mp as first argument to this function. 29884 * 29885 * If the ire passed by caller is incomplete, this function 29886 * queues the packet and if necessary, sends ARP request and bails. 29887 * If the ire passed is fully resolved, we simply prepend 29888 * the link-layer header to the packet, do ipsec hw acceleration 29889 * work if necessary, and send the packet out on the wire. 29890 * 29891 * NOTE: IPSEC will only call this function with fully resolved 29892 * ires if hw acceleration is involved. 29893 * TODO list : 29894 * a Handle M_MULTIDATA so that 29895 * tcp_multisend->tcp_multisend_data can 29896 * call ip_xmit_v4 directly 29897 * b Handle post-ARP work for fragments so that 29898 * ip_wput_frag can call this function. 29899 */ 29900 ipxmit_state_t 29901 ip_xmit_v4(mblk_t *mp, ire_t *ire, ipsec_out_t *io, boolean_t flow_ctl_enabled) 29902 { 29903 nce_t *arpce; 29904 queue_t *q; 29905 int ill_index; 29906 mblk_t *nxt_mp, *first_mp; 29907 boolean_t xmit_drop = B_FALSE; 29908 ip_proc_t proc; 29909 ill_t *out_ill; 29910 int pkt_len; 29911 29912 arpce = ire->ire_nce; 29913 ASSERT(arpce != NULL); 29914 29915 DTRACE_PROBE2(ip__xmit__v4, ire_t *, ire, nce_t *, arpce); 29916 29917 mutex_enter(&arpce->nce_lock); 29918 switch (arpce->nce_state) { 29919 case ND_REACHABLE: 29920 /* If there are other queued packets, queue this packet */ 29921 if (arpce->nce_qd_mp != NULL) { 29922 if (mp != NULL) 29923 nce_queue_mp_common(arpce, mp, B_FALSE); 29924 mp = arpce->nce_qd_mp; 29925 } 29926 arpce->nce_qd_mp = NULL; 29927 mutex_exit(&arpce->nce_lock); 29928 29929 /* 29930 * Flush the queue. In the common case, where the 29931 * ARP is already resolved, it will go through the 29932 * while loop only once. 29933 */ 29934 while (mp != NULL) { 29935 29936 nxt_mp = mp->b_next; 29937 mp->b_next = NULL; 29938 ASSERT(mp->b_datap->db_type != M_CTL); 29939 pkt_len = ntohs(((ipha_t *)mp->b_rptr)->ipha_length); 29940 /* 29941 * This info is needed for IPQOS to do COS marking 29942 * in ip_wput_attach_llhdr->ip_process. 29943 */ 29944 proc = (ip_proc_t)(uintptr_t)mp->b_prev; 29945 mp->b_prev = NULL; 29946 29947 /* set up ill index for outbound qos processing */ 29948 out_ill = ire->ire_ipif->ipif_ill; 29949 ill_index = out_ill->ill_phyint->phyint_ifindex; 29950 first_mp = ip_wput_attach_llhdr(mp, ire, proc, 29951 ill_index); 29952 if (first_mp == NULL) { 29953 xmit_drop = B_TRUE; 29954 BUMP_MIB(out_ill->ill_ip_mib, 29955 ipIfStatsOutDiscards); 29956 goto next_mp; 29957 } 29958 /* non-ipsec hw accel case */ 29959 if (io == NULL || !io->ipsec_out_accelerated) { 29960 /* send it */ 29961 q = ire->ire_stq; 29962 if (proc == IPP_FWD_OUT) { 29963 UPDATE_IB_PKT_COUNT(ire); 29964 } else { 29965 UPDATE_OB_PKT_COUNT(ire); 29966 } 29967 ire->ire_last_used_time = lbolt; 29968 29969 if (flow_ctl_enabled || canputnext(q)) { 29970 if (proc == IPP_FWD_OUT) { 29971 BUMP_MIB(out_ill->ill_ip_mib, 29972 ipIfStatsHCOutForwDatagrams); 29973 } 29974 UPDATE_IP_MIB_OB_COUNTERS(out_ill, 29975 pkt_len); 29976 29977 putnext(q, first_mp); 29978 } else { 29979 BUMP_MIB(out_ill->ill_ip_mib, 29980 ipIfStatsOutDiscards); 29981 xmit_drop = B_TRUE; 29982 freemsg(first_mp); 29983 } 29984 } else { 29985 /* 29986 * Safety Pup says: make sure this 29987 * is going to the right interface! 29988 */ 29989 ill_t *ill1 = 29990 (ill_t *)ire->ire_stq->q_ptr; 29991 int ifindex = 29992 ill1->ill_phyint->phyint_ifindex; 29993 if (ifindex != 29994 io->ipsec_out_capab_ill_index) { 29995 xmit_drop = B_TRUE; 29996 freemsg(mp); 29997 } else { 29998 UPDATE_IP_MIB_OB_COUNTERS(ill1, 29999 pkt_len); 30000 ipsec_hw_putnext(ire->ire_stq, mp); 30001 } 30002 } 30003 next_mp: 30004 mp = nxt_mp; 30005 } /* while (mp != NULL) */ 30006 if (xmit_drop) 30007 return (SEND_FAILED); 30008 else 30009 return (SEND_PASSED); 30010 30011 case ND_INITIAL: 30012 case ND_INCOMPLETE: 30013 30014 /* 30015 * While we do send off packets to dests that 30016 * use fully-resolved CGTP routes, we do not 30017 * handle unresolved CGTP routes. 30018 */ 30019 ASSERT(!(ire->ire_flags & RTF_MULTIRT)); 30020 ASSERT(io == NULL || !io->ipsec_out_accelerated); 30021 30022 if (mp != NULL) { 30023 /* queue the packet */ 30024 nce_queue_mp_common(arpce, mp, B_FALSE); 30025 } 30026 30027 if (arpce->nce_state == ND_INCOMPLETE) { 30028 mutex_exit(&arpce->nce_lock); 30029 DTRACE_PROBE3(ip__xmit__incomplete, 30030 (ire_t *), ire, (mblk_t *), mp, 30031 (ipsec_out_t *), io); 30032 return (LOOKUP_IN_PROGRESS); 30033 } 30034 30035 arpce->nce_state = ND_INCOMPLETE; 30036 mutex_exit(&arpce->nce_lock); 30037 /* 30038 * Note that ire_add() (called from ire_forward()) 30039 * holds a ref on the ire until ARP is completed. 30040 */ 30041 30042 ire_arpresolve(ire, ire_to_ill(ire)); 30043 return (LOOKUP_IN_PROGRESS); 30044 default: 30045 ASSERT(0); 30046 mutex_exit(&arpce->nce_lock); 30047 return (LLHDR_RESLV_FAILED); 30048 } 30049 } 30050 30051 #undef UPDATE_IP_MIB_OB_COUNTERS 30052 30053 /* 30054 * Return B_TRUE if the buffers differ in length or content. 30055 * This is used for comparing extension header buffers. 30056 * Note that an extension header would be declared different 30057 * even if all that changed was the next header value in that header i.e. 30058 * what really changed is the next extension header. 30059 */ 30060 boolean_t 30061 ip_cmpbuf(const void *abuf, uint_t alen, boolean_t b_valid, const void *bbuf, 30062 uint_t blen) 30063 { 30064 if (!b_valid) 30065 blen = 0; 30066 30067 if (alen != blen) 30068 return (B_TRUE); 30069 if (alen == 0) 30070 return (B_FALSE); /* Both zero length */ 30071 return (bcmp(abuf, bbuf, alen)); 30072 } 30073 30074 /* 30075 * Preallocate memory for ip_savebuf(). Returns B_TRUE if ok. 30076 * Return B_FALSE if memory allocation fails - don't change any state! 30077 */ 30078 boolean_t 30079 ip_allocbuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 30080 const void *src, uint_t srclen) 30081 { 30082 void *dst; 30083 30084 if (!src_valid) 30085 srclen = 0; 30086 30087 ASSERT(*dstlenp == 0); 30088 if (src != NULL && srclen != 0) { 30089 dst = mi_alloc(srclen, BPRI_MED); 30090 if (dst == NULL) 30091 return (B_FALSE); 30092 } else { 30093 dst = NULL; 30094 } 30095 if (*dstp != NULL) 30096 mi_free(*dstp); 30097 *dstp = dst; 30098 *dstlenp = dst == NULL ? 0 : srclen; 30099 return (B_TRUE); 30100 } 30101 30102 /* 30103 * Replace what is in *dst, *dstlen with the source. 30104 * Assumes ip_allocbuf has already been called. 30105 */ 30106 void 30107 ip_savebuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 30108 const void *src, uint_t srclen) 30109 { 30110 if (!src_valid) 30111 srclen = 0; 30112 30113 ASSERT(*dstlenp == srclen); 30114 if (src != NULL && srclen != 0) 30115 bcopy(src, *dstp, srclen); 30116 } 30117 30118 /* 30119 * Free the storage pointed to by the members of an ip6_pkt_t. 30120 */ 30121 void 30122 ip6_pkt_free(ip6_pkt_t *ipp) 30123 { 30124 ASSERT(ipp->ipp_pathmtu == NULL && !(ipp->ipp_fields & IPPF_PATHMTU)); 30125 30126 if (ipp->ipp_fields & IPPF_HOPOPTS) { 30127 kmem_free(ipp->ipp_hopopts, ipp->ipp_hopoptslen); 30128 ipp->ipp_hopopts = NULL; 30129 ipp->ipp_hopoptslen = 0; 30130 } 30131 if (ipp->ipp_fields & IPPF_RTDSTOPTS) { 30132 kmem_free(ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 30133 ipp->ipp_rtdstopts = NULL; 30134 ipp->ipp_rtdstoptslen = 0; 30135 } 30136 if (ipp->ipp_fields & IPPF_DSTOPTS) { 30137 kmem_free(ipp->ipp_dstopts, ipp->ipp_dstoptslen); 30138 ipp->ipp_dstopts = NULL; 30139 ipp->ipp_dstoptslen = 0; 30140 } 30141 if (ipp->ipp_fields & IPPF_RTHDR) { 30142 kmem_free(ipp->ipp_rthdr, ipp->ipp_rthdrlen); 30143 ipp->ipp_rthdr = NULL; 30144 ipp->ipp_rthdrlen = 0; 30145 } 30146 ipp->ipp_fields &= ~(IPPF_HOPOPTS | IPPF_RTDSTOPTS | IPPF_DSTOPTS | 30147 IPPF_RTHDR); 30148 } 30149