1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 25 * Copyright (c) 2016, Chris Fraire <cfraire@me.com>. 26 */ 27 28 #include <stdio.h> 29 #include <stdlib.h> 30 #include <string.h> 31 #include <errno.h> 32 #include <fcntl.h> 33 #include <unistd.h> 34 #include <stropts.h> 35 #include <sys/sockio.h> 36 #include <sys/types.h> 37 #include <sys/stat.h> 38 #include <sys/socket.h> 39 #include <net/route.h> 40 #include <netinet/in.h> 41 #include <inet/ip.h> 42 #include <arpa/inet.h> 43 #include <libintl.h> 44 #include <libdlpi.h> 45 #include <libinetutil.h> 46 #include <libdladm.h> 47 #include <libdllink.h> 48 #include <libdliptun.h> 49 #include <strings.h> 50 #include <zone.h> 51 #include <ctype.h> 52 #include <limits.h> 53 #include <assert.h> 54 #include <netdb.h> 55 #include <pwd.h> 56 #include <auth_attr.h> 57 #include <secdb.h> 58 #include <nss_dbdefs.h> 59 #include "libipadm_impl.h" 60 61 /* error codes and text description */ 62 static struct ipadm_error_info { 63 ipadm_status_t error_code; 64 const char *error_desc; 65 } ipadm_errors[] = { 66 { IPADM_SUCCESS, "Operation succeeded" }, 67 { IPADM_FAILURE, "Operation failed" }, 68 { IPADM_EAUTH, "Insufficient user authorizations" }, 69 { IPADM_EPERM, "Permission denied" }, 70 { IPADM_NO_BUFS, "No buffer space available" }, 71 { IPADM_NO_MEMORY, "Insufficient memory" }, 72 { IPADM_BAD_ADDR, "Invalid address" }, 73 { IPADM_BAD_PROTOCOL, "Incorrect protocol family for operation" }, 74 { IPADM_DAD_FOUND, "Duplicate address detected" }, 75 { IPADM_EXISTS, "Already exists" }, 76 { IPADM_IF_EXISTS, "Interface already exists" }, 77 { IPADM_ADDROBJ_EXISTS, "Address object already exists" }, 78 { IPADM_ADDRCONF_EXISTS, "Addrconf already in progress" }, 79 { IPADM_ENXIO, "Interface does not exist" }, 80 { IPADM_GRP_NOTEMPTY, "IPMP group is not empty" }, 81 { IPADM_INVALID_ARG, "Invalid argument provided" }, 82 { IPADM_INVALID_NAME, "Invalid name" }, 83 { IPADM_DLPI_FAILURE, "Could not open DLPI link" }, 84 { IPADM_DLADM_FAILURE, "Datalink does not exist" }, 85 { IPADM_PROP_UNKNOWN, "Unknown property" }, 86 { IPADM_ERANGE, "Value is outside the allowed range" }, 87 { IPADM_ESRCH, "Value does not exist" }, 88 { IPADM_EOVERFLOW, "Number of values exceeds the allowed limit" }, 89 { IPADM_NOTFOUND, "Object not found" }, 90 { IPADM_IF_INUSE, "Interface already in use" }, 91 { IPADM_ADDR_INUSE, "Address already in use" }, 92 { IPADM_BAD_HOSTNAME, "Hostname maps to multiple IP addresses" }, 93 { IPADM_ADDR_NOTAVAIL, "Can't assign requested address" }, 94 { IPADM_ALL_ADDRS_NOT_ENABLED, "All addresses could not be enabled" }, 95 { IPADM_NDPD_NOT_RUNNING, "IPv6 autoconf daemon in.ndpd not running" }, 96 { IPADM_DHCP_START_ERROR, "Could not start dhcpagent" }, 97 { IPADM_DHCP_IPC_ERROR, "Could not communicate with dhcpagent" }, 98 { IPADM_DHCP_IPC_TIMEOUT, "Communication with dhcpagent timed out" }, 99 { IPADM_TEMPORARY_OBJ, "Persistent operation on temporary object" }, 100 { IPADM_IPC_ERROR, "Could not communicate with ipmgmtd" }, 101 { IPADM_NOTSUP, "Operation not supported" }, 102 { IPADM_OP_DISABLE_OBJ, "Operation not supported on disabled object" }, 103 { IPADM_EBADE, "Invalid data exchange with daemon" }, 104 { IPADM_GZ_PERM, "Operation not permitted on from-gz interface"} 105 }; 106 107 #define IPADM_NUM_ERRORS (sizeof (ipadm_errors) / sizeof (*ipadm_errors)) 108 109 ipadm_status_t 110 ipadm_errno2status(int error) 111 { 112 switch (error) { 113 case 0: 114 return (IPADM_SUCCESS); 115 case ENXIO: 116 return (IPADM_ENXIO); 117 case ENOMEM: 118 return (IPADM_NO_MEMORY); 119 case ENOBUFS: 120 return (IPADM_NO_BUFS); 121 case EINVAL: 122 return (IPADM_INVALID_ARG); 123 case EBUSY: 124 return (IPADM_IF_INUSE); 125 case EEXIST: 126 return (IPADM_EXISTS); 127 case EADDRNOTAVAIL: 128 return (IPADM_ADDR_NOTAVAIL); 129 case EADDRINUSE: 130 return (IPADM_ADDR_INUSE); 131 case ENOENT: 132 return (IPADM_NOTFOUND); 133 case ERANGE: 134 return (IPADM_ERANGE); 135 case EPERM: 136 return (IPADM_EPERM); 137 case ENOTSUP: 138 case EOPNOTSUPP: 139 return (IPADM_NOTSUP); 140 case EBADF: 141 return (IPADM_IPC_ERROR); 142 case EBADE: 143 return (IPADM_EBADE); 144 case ESRCH: 145 return (IPADM_ESRCH); 146 case EOVERFLOW: 147 return (IPADM_EOVERFLOW); 148 default: 149 return (IPADM_FAILURE); 150 } 151 } 152 153 /* 154 * Returns a message string for the given libipadm error status. 155 */ 156 const char * 157 ipadm_status2str(ipadm_status_t status) 158 { 159 int i; 160 161 for (i = 0; i < IPADM_NUM_ERRORS; i++) { 162 if (status == ipadm_errors[i].error_code) 163 return (dgettext(TEXT_DOMAIN, 164 ipadm_errors[i].error_desc)); 165 } 166 167 return (dgettext(TEXT_DOMAIN, "<unknown error>")); 168 } 169 170 /* 171 * Opens a handle to libipadm. 172 * Possible values for flags: 173 * IPH_VRRP: Used by VRRP daemon to set the socket option SO_VRRP. 174 * IPH_LEGACY: This is used whenever an application needs to provide a 175 * logical interface name while creating or deleting 176 * interfaces and static addresses. 177 * IPH_INIT: Used by ipadm_init_prop(), to initialize protocol properties 178 * on reboot. 179 */ 180 ipadm_status_t 181 ipadm_open(ipadm_handle_t *handle, uint32_t flags) 182 { 183 ipadm_handle_t iph; 184 ipadm_status_t status = IPADM_SUCCESS; 185 zoneid_t zoneid; 186 ushort_t zflags; 187 int on = B_TRUE; 188 189 if (handle == NULL) 190 return (IPADM_INVALID_ARG); 191 *handle = NULL; 192 193 if (flags & ~(IPH_VRRP|IPH_LEGACY|IPH_INIT|IPH_IPMGMTD)) 194 return (IPADM_INVALID_ARG); 195 196 if ((iph = calloc(1, sizeof (struct ipadm_handle))) == NULL) 197 return (IPADM_NO_MEMORY); 198 iph->iph_sock = -1; 199 iph->iph_sock6 = -1; 200 iph->iph_door_fd = -1; 201 iph->iph_rtsock = -1; 202 iph->iph_flags = flags; 203 (void) pthread_mutex_init(&iph->iph_lock, NULL); 204 205 if ((iph->iph_sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0 || 206 (iph->iph_sock6 = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) { 207 goto errnofail; 208 } 209 210 /* 211 * We open a handle to libdladm here, to facilitate some daemons (like 212 * nwamd) which opens handle to libipadm before devfsadmd installs the 213 * right device permissions into the kernel and requires "all" 214 * privileges to open DLD_CONTROL_DEV. 215 * 216 * In a non-global shared-ip zone there will be no DLD_CONTROL_DEV node 217 * and dladm_open() will fail. So, we avoid this by not calling 218 * dladm_open() for such zones. 219 */ 220 zoneid = getzoneid(); 221 iph->iph_zoneid = zoneid; 222 if (zoneid != GLOBAL_ZONEID) { 223 if (zone_getattr(zoneid, ZONE_ATTR_FLAGS, &zflags, 224 sizeof (zflags)) < 0) { 225 goto errnofail; 226 } 227 } 228 if ((zoneid == GLOBAL_ZONEID) || (zflags & ZF_NET_EXCL)) { 229 if (dladm_open(&iph->iph_dlh) != DLADM_STATUS_OK) { 230 ipadm_close(iph); 231 return (IPADM_DLADM_FAILURE); 232 } 233 if (zoneid != GLOBAL_ZONEID) { 234 iph->iph_rtsock = socket(PF_ROUTE, SOCK_RAW, 0); 235 /* 236 * Failure to open rtsock is ignored as this is 237 * only used in non-global zones to initialize 238 * routing socket information. 239 */ 240 } 241 } else { 242 assert(zoneid != GLOBAL_ZONEID); 243 iph->iph_dlh = NULL; 244 } 245 if (flags & IPH_VRRP) { 246 if (setsockopt(iph->iph_sock6, SOL_SOCKET, SO_VRRP, &on, 247 sizeof (on)) < 0 || setsockopt(iph->iph_sock, SOL_SOCKET, 248 SO_VRRP, &on, sizeof (on)) < 0) { 249 goto errnofail; 250 } 251 } 252 *handle = iph; 253 return (status); 254 255 errnofail: 256 status = ipadm_errno2status(errno); 257 ipadm_close(iph); 258 return (status); 259 } 260 261 /* 262 * Closes and frees the libipadm handle. 263 */ 264 void 265 ipadm_close(ipadm_handle_t iph) 266 { 267 if (iph == NULL) 268 return; 269 if (iph->iph_sock != -1) 270 (void) close(iph->iph_sock); 271 if (iph->iph_sock6 != -1) 272 (void) close(iph->iph_sock6); 273 if (iph->iph_rtsock != -1) 274 (void) close(iph->iph_rtsock); 275 if (iph->iph_door_fd != -1) 276 (void) close(iph->iph_door_fd); 277 dladm_close(iph->iph_dlh); 278 (void) pthread_mutex_destroy(&iph->iph_lock); 279 free(iph); 280 } 281 282 /* 283 * Checks if the caller has the authorization to configure network 284 * interfaces. 285 */ 286 boolean_t 287 ipadm_check_auth(void) 288 { 289 struct passwd pwd; 290 char buf[NSS_BUFLEN_PASSWD]; 291 292 /* get the password entry for the given user ID */ 293 if (getpwuid_r(getuid(), &pwd, buf, sizeof (buf)) == NULL) 294 return (B_FALSE); 295 296 /* check for presence of given authorization */ 297 return (chkauthattr(NETWORK_INTERFACE_CONFIG_AUTH, pwd.pw_name) != 0); 298 } 299 300 /* 301 * Stores the index value of the interface in `ifname' for the address 302 * family `af' into the buffer pointed to by `index'. 303 */ 304 static ipadm_status_t 305 i_ipadm_get_index(ipadm_handle_t iph, const char *ifname, sa_family_t af, 306 int *index) 307 { 308 struct lifreq lifr; 309 int sock; 310 311 bzero(&lifr, sizeof (lifr)); 312 (void) strlcpy(lifr.lifr_name, ifname, sizeof (lifr.lifr_name)); 313 if (af == AF_INET) 314 sock = iph->iph_sock; 315 else 316 sock = iph->iph_sock6; 317 318 if (ioctl(sock, SIOCGLIFINDEX, (caddr_t)&lifr) < 0) 319 return (ipadm_errno2status(errno)); 320 *index = lifr.lifr_index; 321 322 return (IPADM_SUCCESS); 323 } 324 325 /* 326 * Maximum amount of time (in milliseconds) to wait for Duplicate Address 327 * Detection to complete in the kernel. 328 */ 329 #define DAD_WAIT_TIME 1000 330 331 /* 332 * Any time that flags are changed on an interface where either the new or the 333 * existing flags have IFF_UP set, we'll get a RTM_NEWADDR message to 334 * announce the new address added and its flag status. 335 * We wait here for that message and look for IFF_UP. 336 * If something's amiss with the kernel, though, we don't wait forever. 337 * (Note that IFF_DUPLICATE is a high-order bit, and we cannot see 338 * it in the routing socket messages.) 339 */ 340 static ipadm_status_t 341 i_ipadm_dad_wait(ipadm_handle_t handle, const char *lifname, sa_family_t af, 342 int rtsock) 343 { 344 struct pollfd fds[1]; 345 union { 346 struct if_msghdr ifm; 347 char buf[1024]; 348 } msg; 349 int index; 350 ipadm_status_t retv; 351 uint64_t flags; 352 hrtime_t starttime, now; 353 354 fds[0].fd = rtsock; 355 fds[0].events = POLLIN; 356 fds[0].revents = 0; 357 358 retv = i_ipadm_get_index(handle, lifname, af, &index); 359 if (retv != IPADM_SUCCESS) 360 return (retv); 361 362 starttime = gethrtime(); 363 for (;;) { 364 now = gethrtime(); 365 now = (now - starttime) / 1000000; 366 if (now >= DAD_WAIT_TIME) 367 break; 368 if (poll(fds, 1, DAD_WAIT_TIME - (int)now) <= 0) 369 break; 370 if (read(rtsock, &msg, sizeof (msg)) <= 0) 371 break; 372 if (msg.ifm.ifm_type != RTM_NEWADDR) 373 continue; 374 /* Note that ifm_index is just 16 bits */ 375 if (index == msg.ifm.ifm_index && (msg.ifm.ifm_flags & IFF_UP)) 376 return (IPADM_SUCCESS); 377 } 378 379 retv = i_ipadm_get_flags(handle, lifname, af, &flags); 380 if (retv != IPADM_SUCCESS) 381 return (retv); 382 if (flags & IFF_DUPLICATE) 383 return (IPADM_DAD_FOUND); 384 385 return (IPADM_SUCCESS); 386 } 387 388 /* 389 * Sets the flags `on_flags' and resets the flags `off_flags' for the logical 390 * interface in `lifname'. 391 * 392 * If the new flags value will transition the interface from "down" to "up" 393 * then duplicate address detection is performed by the kernel. This routine 394 * waits to get the outcome of that test. 395 */ 396 ipadm_status_t 397 i_ipadm_set_flags(ipadm_handle_t iph, const char *lifname, sa_family_t af, 398 uint64_t on_flags, uint64_t off_flags) 399 { 400 struct lifreq lifr; 401 uint64_t oflags; 402 ipadm_status_t ret; 403 int rtsock = -1; 404 int sock, err; 405 406 ret = i_ipadm_get_flags(iph, lifname, af, &oflags); 407 if (ret != IPADM_SUCCESS) 408 return (ret); 409 410 sock = (af == AF_INET ? iph->iph_sock : iph->iph_sock6); 411 412 /* 413 * Any time flags are changed on an interface that has IFF_UP set, 414 * we get a routing socket message. We care about the status, 415 * though, only when the new flags are marked "up." 416 */ 417 if (!(oflags & IFF_UP) && (on_flags & IFF_UP)) 418 rtsock = socket(PF_ROUTE, SOCK_RAW, af); 419 420 oflags |= on_flags; 421 oflags &= ~off_flags; 422 bzero(&lifr, sizeof (lifr)); 423 (void) strlcpy(lifr.lifr_name, lifname, sizeof (lifr.lifr_name)); 424 lifr.lifr_flags = oflags; 425 if (ioctl(sock, SIOCSLIFFLAGS, (caddr_t)&lifr) < 0) { 426 err = errno; 427 if (rtsock != -1) 428 (void) close(rtsock); 429 return (ipadm_errno2status(err)); 430 } 431 if (rtsock == -1) { 432 return (IPADM_SUCCESS); 433 } else { 434 /* Wait for DAD to complete. */ 435 ret = i_ipadm_dad_wait(iph, lifname, af, rtsock); 436 (void) close(rtsock); 437 return (ret); 438 } 439 } 440 441 /* 442 * Returns the flags value for the logical interface in `lifname' 443 * in the buffer pointed to by `flags'. 444 */ 445 ipadm_status_t 446 i_ipadm_get_flags(ipadm_handle_t iph, const char *lifname, sa_family_t af, 447 uint64_t *flags) 448 { 449 struct lifreq lifr; 450 int sock; 451 452 bzero(&lifr, sizeof (lifr)); 453 (void) strlcpy(lifr.lifr_name, lifname, sizeof (lifr.lifr_name)); 454 if (af == AF_INET) 455 sock = iph->iph_sock; 456 else 457 sock = iph->iph_sock6; 458 459 if (ioctl(sock, SIOCGLIFFLAGS, (caddr_t)&lifr) < 0) { 460 return (ipadm_errno2status(errno)); 461 } 462 *flags = lifr.lifr_flags; 463 464 return (IPADM_SUCCESS); 465 } 466 467 /* 468 * Determines whether or not an interface name represents a loopback 469 * interface, before the interface has been plumbed. 470 * It is assumed that the interface name in `ifname' is of correct format 471 * as verified by ifparse_ifspec(). 472 * 473 * Returns: B_TRUE if loopback, B_FALSE if not. 474 */ 475 boolean_t 476 i_ipadm_is_loopback(const char *ifname) 477 { 478 int len = strlen(LOOPBACK_IF); 479 480 return (strncmp(ifname, LOOPBACK_IF, len) == 0 && 481 (ifname[len] == '\0' || ifname[len] == IPADM_LOGICAL_SEP)); 482 } 483 484 /* 485 * Determines whether or not an interface name represents a vni 486 * interface, before the interface has been plumbed. 487 * It is assumed that the interface name in `ifname' is of correct format 488 * as verified by ifparse_ifspec(). 489 * 490 * Returns: B_TRUE if vni, B_FALSE if not. 491 */ 492 boolean_t 493 i_ipadm_is_vni(const char *ifname) 494 { 495 ifspec_t ifsp; 496 497 return (ifparse_ifspec(ifname, &ifsp) && 498 strcmp(ifsp.ifsp_devnm, "vni") == 0); 499 } 500 501 /* 502 * Returns B_TRUE if `ifname' is an IP interface on a 6to4 tunnel. 503 */ 504 boolean_t 505 i_ipadm_is_6to4(ipadm_handle_t iph, char *ifname) 506 { 507 dladm_status_t dlstatus; 508 datalink_class_t class; 509 iptun_params_t params; 510 datalink_id_t linkid; 511 512 if (iph->iph_dlh == NULL) { 513 assert(iph->iph_zoneid != GLOBAL_ZONEID); 514 return (B_FALSE); 515 } 516 dlstatus = dladm_name2info(iph->iph_dlh, ifname, &linkid, NULL, 517 &class, NULL); 518 if (dlstatus == DLADM_STATUS_OK && class == DATALINK_CLASS_IPTUN) { 519 params.iptun_param_linkid = linkid; 520 dlstatus = dladm_iptun_getparams(iph->iph_dlh, ¶ms, 521 DLADM_OPT_ACTIVE); 522 if (dlstatus == DLADM_STATUS_OK && 523 params.iptun_param_type == IPTUN_TYPE_6TO4) { 524 return (B_TRUE); 525 } 526 } 527 return (B_FALSE); 528 } 529 530 /* 531 * Returns B_TRUE if `ifname' represents an IPMP underlying interface. 532 */ 533 boolean_t 534 i_ipadm_is_under_ipmp(ipadm_handle_t iph, const char *ifname) 535 { 536 struct lifreq lifr; 537 538 (void) strlcpy(lifr.lifr_name, ifname, sizeof (lifr.lifr_name)); 539 if (ioctl(iph->iph_sock, SIOCGLIFGROUPNAME, (caddr_t)&lifr) < 0) { 540 if (ioctl(iph->iph_sock6, SIOCGLIFGROUPNAME, 541 (caddr_t)&lifr) < 0) { 542 return (B_FALSE); 543 } 544 } 545 return (lifr.lifr_groupname[0] != '\0'); 546 } 547 548 /* 549 * Returns B_TRUE if `ifname' represents an IPMP meta-interface. 550 */ 551 boolean_t 552 i_ipadm_is_ipmp(ipadm_handle_t iph, const char *ifname) 553 { 554 uint64_t flags; 555 556 if (i_ipadm_get_flags(iph, ifname, AF_INET, &flags) != IPADM_SUCCESS && 557 i_ipadm_get_flags(iph, ifname, AF_INET6, &flags) != IPADM_SUCCESS) 558 return (B_FALSE); 559 560 return ((flags & IFF_IPMP) != 0); 561 } 562 563 /* 564 * For a given interface name, ipadm_if_enabled() checks if v4 565 * or v6 or both IP interfaces exist in the active configuration. 566 */ 567 boolean_t 568 ipadm_if_enabled(ipadm_handle_t iph, const char *ifname, sa_family_t af) 569 { 570 struct lifreq lifr; 571 int s4 = iph->iph_sock; 572 int s6 = iph->iph_sock6; 573 574 bzero(&lifr, sizeof (lifr)); 575 (void) strlcpy(lifr.lifr_name, ifname, sizeof (lifr.lifr_name)); 576 switch (af) { 577 case AF_INET: 578 if (ioctl(s4, SIOCGLIFFLAGS, (caddr_t)&lifr) == 0) 579 return (B_TRUE); 580 break; 581 case AF_INET6: 582 if (ioctl(s6, SIOCGLIFFLAGS, (caddr_t)&lifr) == 0) 583 return (B_TRUE); 584 break; 585 case AF_UNSPEC: 586 if (ioctl(s4, SIOCGLIFFLAGS, (caddr_t)&lifr) == 0 || 587 ioctl(s6, SIOCGLIFFLAGS, (caddr_t)&lifr) == 0) { 588 return (B_TRUE); 589 } 590 } 591 return (B_FALSE); 592 } 593 594 /* 595 * Apply the interface property by retrieving information from nvl. 596 */ 597 static ipadm_status_t 598 i_ipadm_init_ifprop(ipadm_handle_t iph, nvlist_t *nvl) 599 { 600 nvpair_t *nvp; 601 char *name, *pname = NULL; 602 char *protostr = NULL, *ifname = NULL, *pval = NULL; 603 uint_t proto; 604 int err = 0; 605 606 for (nvp = nvlist_next_nvpair(nvl, NULL); nvp != NULL; 607 nvp = nvlist_next_nvpair(nvl, nvp)) { 608 name = nvpair_name(nvp); 609 if (strcmp(name, IPADM_NVP_IFNAME) == 0) { 610 if ((err = nvpair_value_string(nvp, &ifname)) != 0) 611 break; 612 } else if (strcmp(name, IPADM_NVP_PROTONAME) == 0) { 613 if ((err = nvpair_value_string(nvp, &protostr)) != 0) 614 break; 615 } else { 616 assert(!IPADM_PRIV_NVP(name)); 617 pname = name; 618 if ((err = nvpair_value_string(nvp, &pval)) != 0) 619 break; 620 } 621 } 622 if (err != 0) 623 return (ipadm_errno2status(err)); 624 proto = ipadm_str2proto(protostr); 625 return (ipadm_set_ifprop(iph, ifname, pname, pval, proto, 626 IPADM_OPT_ACTIVE)); 627 } 628 629 /* 630 * Instantiate the address object or set the address object property by 631 * retrieving the configuration from the nvlist `nvl'. 632 */ 633 ipadm_status_t 634 i_ipadm_init_addrobj(ipadm_handle_t iph, nvlist_t *nvl) 635 { 636 nvpair_t *nvp; 637 char *name; 638 char *aobjname = NULL, *pval = NULL, *ifname = NULL; 639 sa_family_t af = AF_UNSPEC; 640 ipadm_addr_type_t atype = IPADM_ADDR_NONE; 641 int err = 0; 642 ipadm_status_t status = IPADM_SUCCESS; 643 644 for (nvp = nvlist_next_nvpair(nvl, NULL); nvp != NULL; 645 nvp = nvlist_next_nvpair(nvl, nvp)) { 646 name = nvpair_name(nvp); 647 if (strcmp(name, IPADM_NVP_IFNAME) == 0) { 648 if ((err = nvpair_value_string(nvp, &ifname)) != 0) 649 break; 650 } else if (strcmp(name, IPADM_NVP_AOBJNAME) == 0) { 651 if ((err = nvpair_value_string(nvp, &aobjname)) != 0) 652 break; 653 } else if (i_ipadm_name2atype(name, &af, &atype)) { 654 break; 655 } else { 656 assert(!IPADM_PRIV_NVP(name)); 657 err = nvpair_value_string(nvp, &pval); 658 break; 659 } 660 } 661 if (err != 0) 662 return (ipadm_errno2status(err)); 663 664 switch (atype) { 665 case IPADM_ADDR_STATIC: 666 status = i_ipadm_enable_static(iph, ifname, nvl, af); 667 break; 668 case IPADM_ADDR_DHCP: 669 status = i_ipadm_enable_dhcp(iph, ifname, nvl); 670 if (status == IPADM_DHCP_IPC_TIMEOUT) 671 status = IPADM_SUCCESS; 672 break; 673 case IPADM_ADDR_IPV6_ADDRCONF: 674 status = i_ipadm_enable_addrconf(iph, ifname, nvl); 675 break; 676 case IPADM_ADDR_NONE: 677 status = ipadm_set_addrprop(iph, name, pval, aobjname, 678 IPADM_OPT_ACTIVE); 679 break; 680 } 681 682 return (status); 683 } 684 685 /* 686 * Instantiate the interface object by retrieving the configuration from 687 * `ifnvl'. The nvlist `ifnvl' contains all the persistent configuration 688 * (interface properties and address objects on that interface) for the 689 * given `ifname'. 690 */ 691 ipadm_status_t 692 i_ipadm_init_ifobj(ipadm_handle_t iph, const char *ifname, nvlist_t *ifnvl) 693 { 694 nvlist_t *nvl = NULL; 695 nvpair_t *nvp; 696 char *afstr; 697 ipadm_status_t status; 698 ipadm_status_t ret_status = IPADM_SUCCESS; 699 char newifname[LIFNAMSIZ]; 700 char *aobjstr; 701 sa_family_t af = AF_UNSPEC; 702 boolean_t is_ngz = (iph->iph_zoneid != GLOBAL_ZONEID); 703 704 (void) strlcpy(newifname, ifname, sizeof (newifname)); 705 /* 706 * First plumb the given interface and then apply all the persistent 707 * interface properties and then instantiate any persistent addresses 708 * objects on that interface. 709 */ 710 for (nvp = nvlist_next_nvpair(ifnvl, NULL); nvp != NULL; 711 nvp = nvlist_next_nvpair(ifnvl, nvp)) { 712 if (nvpair_value_nvlist(nvp, &nvl) != 0) 713 continue; 714 715 if (nvlist_lookup_string(nvl, IPADM_NVP_FAMILY, &afstr) == 0) { 716 status = i_ipadm_plumb_if(iph, newifname, atoi(afstr), 717 IPADM_OPT_ACTIVE); 718 /* 719 * If the interface is already plumbed, we should 720 * ignore this error because there might be address 721 * address objects on that interface that needs to 722 * be enabled again. 723 */ 724 if (status == IPADM_IF_EXISTS) 725 status = IPADM_SUCCESS; 726 727 if (is_ngz) 728 af = atoi(afstr); 729 } else if (nvlist_lookup_string(nvl, IPADM_NVP_AOBJNAME, 730 &aobjstr) == 0) { 731 /* 732 * For addresses, we need to relocate addrprops from the 733 * nvlist `ifnvl'. 734 */ 735 if (nvlist_exists(nvl, IPADM_NVP_IPV4ADDR) || 736 nvlist_exists(nvl, IPADM_NVP_IPV6ADDR) || 737 nvlist_exists(nvl, IPADM_NVP_DHCP)) { 738 status = i_ipadm_merge_addrprops_from_nvl(ifnvl, 739 nvl, aobjstr); 740 if (status != IPADM_SUCCESS) 741 continue; 742 } 743 status = i_ipadm_init_addrobj(iph, nvl); 744 /* 745 * If this address is in use on some other interface, 746 * we want to record an error to be returned as 747 * a soft error and continue processing the rest of 748 * the addresses. 749 */ 750 if (status == IPADM_ADDR_NOTAVAIL) { 751 ret_status = IPADM_ALL_ADDRS_NOT_ENABLED; 752 status = IPADM_SUCCESS; 753 } 754 } else { 755 assert(nvlist_exists(nvl, IPADM_NVP_PROTONAME)); 756 status = i_ipadm_init_ifprop(iph, nvl); 757 } 758 if (status != IPADM_SUCCESS) 759 return (status); 760 } 761 762 if (is_ngz && af != AF_UNSPEC) 763 ret_status = ipadm_init_net_from_gz(iph, newifname, NULL); 764 return (ret_status); 765 } 766 767 /* 768 * Retrieves the persistent configuration for the given interface(s) in `ifs' 769 * by contacting the daemon and dumps the information in `allifs'. 770 */ 771 ipadm_status_t 772 i_ipadm_init_ifs(ipadm_handle_t iph, const char *ifs, nvlist_t **allifs) 773 { 774 nvlist_t *nvl = NULL; 775 size_t nvlsize, bufsize; 776 ipmgmt_initif_arg_t *iargp; 777 char *buf = NULL, *nvlbuf = NULL; 778 ipmgmt_get_rval_t *rvalp = NULL; 779 int err; 780 ipadm_status_t status = IPADM_SUCCESS; 781 782 if ((err = ipadm_str2nvlist(ifs, &nvl, IPADM_NORVAL)) != 0) 783 return (ipadm_errno2status(err)); 784 785 err = nvlist_pack(nvl, &nvlbuf, &nvlsize, NV_ENCODE_NATIVE, 0); 786 if (err != 0) { 787 status = ipadm_errno2status(err); 788 goto done; 789 } 790 bufsize = sizeof (*iargp) + nvlsize; 791 if ((buf = malloc(bufsize)) == NULL) { 792 status = ipadm_errno2status(errno); 793 goto done; 794 } 795 796 /* populate the door_call argument structure */ 797 iargp = (void *)buf; 798 iargp->ia_cmd = IPMGMT_CMD_INITIF; 799 iargp->ia_flags = 0; 800 iargp->ia_family = AF_UNSPEC; 801 iargp->ia_nvlsize = nvlsize; 802 (void) bcopy(nvlbuf, buf + sizeof (*iargp), nvlsize); 803 804 if ((rvalp = malloc(sizeof (ipmgmt_get_rval_t))) == NULL) { 805 status = ipadm_errno2status(errno); 806 goto done; 807 } 808 if ((err = ipadm_door_call(iph, iargp, bufsize, (void **)&rvalp, 809 sizeof (*rvalp), B_TRUE)) != 0) { 810 status = ipadm_errno2status(err); 811 goto done; 812 } 813 814 /* 815 * Daemon reply pointed to by rvalp contains ipmgmt_get_rval_t structure 816 * followed by a list of packed nvlists, each of which represents 817 * configuration information for the given interface(s). 818 */ 819 err = nvlist_unpack((char *)rvalp + sizeof (ipmgmt_get_rval_t), 820 rvalp->ir_nvlsize, allifs, NV_ENCODE_NATIVE); 821 if (err != 0) 822 status = ipadm_errno2status(err); 823 done: 824 nvlist_free(nvl); 825 free(buf); 826 free(nvlbuf); 827 free(rvalp); 828 return (status); 829 } 830 831 /* 832 * Returns B_FALSE if 833 * (1) `ifname' is NULL or has no string or has a string of invalid length 834 * (2) ifname is a logical interface and IPH_LEGACY is not set, or 835 */ 836 boolean_t 837 i_ipadm_validate_ifname(ipadm_handle_t iph, const char *ifname) 838 { 839 ifspec_t ifsp; 840 841 if (ifname == NULL || ifname[0] == '\0' || 842 !ifparse_ifspec(ifname, &ifsp)) 843 return (B_FALSE); 844 if (ifsp.ifsp_lunvalid) 845 return (ifsp.ifsp_lun > 0 && (iph->iph_flags & IPH_LEGACY)); 846 return (B_TRUE); 847 } 848 849 /* 850 * Wrapper for sending a non-transparent I_STR ioctl(). 851 * Returns: Result from ioctl(). 852 */ 853 int 854 i_ipadm_strioctl(int s, int cmd, char *buf, int buflen) 855 { 856 struct strioctl ioc; 857 858 (void) memset(&ioc, 0, sizeof (ioc)); 859 ioc.ic_cmd = cmd; 860 ioc.ic_timout = 0; 861 ioc.ic_len = buflen; 862 ioc.ic_dp = buf; 863 864 return (ioctl(s, I_STR, (char *)&ioc)); 865 } 866 867 /* 868 * Make a door call to the server and checks if the door call succeeded or not. 869 * `is_varsize' specifies that the data returned by ipmgmtd daemon is of 870 * variable size and door will allocate buffer using mmap(). In such cases 871 * we re-allocate the required memory,n assign it to `rbufp', copy the data to 872 * `rbufp' and then call munmap() (see below). 873 * 874 * It also checks to see if the server side procedure ran successfully by 875 * checking for ir_err. Therefore, for some callers who just care about the 876 * return status can set `rbufp' to NULL and set `rsize' to 0. 877 */ 878 int 879 ipadm_door_call(ipadm_handle_t iph, void *arg, size_t asize, void **rbufp, 880 size_t rsize, boolean_t is_varsize) 881 { 882 door_arg_t darg; 883 int err; 884 ipmgmt_retval_t rval, *rvalp; 885 boolean_t reopen = B_FALSE; 886 887 if (rbufp == NULL) { 888 rvalp = &rval; 889 rbufp = (void **)&rvalp; 890 rsize = sizeof (rval); 891 } 892 893 darg.data_ptr = arg; 894 darg.data_size = asize; 895 darg.desc_ptr = NULL; 896 darg.desc_num = 0; 897 darg.rbuf = *rbufp; 898 darg.rsize = rsize; 899 900 reopen: 901 (void) pthread_mutex_lock(&iph->iph_lock); 902 /* The door descriptor is opened if it isn't already */ 903 if (iph->iph_door_fd == -1) { 904 if ((iph->iph_door_fd = open(IPMGMT_DOOR, O_RDONLY)) < 0) { 905 err = errno; 906 (void) pthread_mutex_unlock(&iph->iph_lock); 907 return (err); 908 } 909 } 910 (void) pthread_mutex_unlock(&iph->iph_lock); 911 912 if (door_call(iph->iph_door_fd, &darg) == -1) { 913 /* 914 * Stale door descriptor is possible if ipmgmtd was restarted 915 * since last iph_door_fd was opened, so try re-opening door 916 * descriptor. 917 */ 918 if (!reopen && errno == EBADF) { 919 (void) close(iph->iph_door_fd); 920 iph->iph_door_fd = -1; 921 reopen = B_TRUE; 922 goto reopen; 923 } 924 return (errno); 925 } 926 err = ((ipmgmt_retval_t *)(void *)(darg.rbuf))->ir_err; 927 if (darg.rbuf != *rbufp) { 928 /* 929 * if the caller is expecting the result to fit in specified 930 * buffer then return failure. 931 */ 932 if (!is_varsize) 933 err = EBADE; 934 /* 935 * The size of the buffer `*rbufp' was not big enough 936 * and the door itself allocated buffer, for us. We will 937 * hit this, on several occasion as for some cases 938 * we cannot predict the size of the return structure. 939 * Reallocate the buffer `*rbufp' and memcpy() the contents 940 * to new buffer. 941 */ 942 if (err == 0) { 943 void *newp; 944 945 /* allocated memory will be freed by the caller */ 946 if ((newp = realloc(*rbufp, darg.rsize)) == NULL) { 947 err = ENOMEM; 948 } else { 949 *rbufp = newp; 950 (void) memcpy(*rbufp, darg.rbuf, darg.rsize); 951 } 952 } 953 /* munmap() the door buffer */ 954 (void) munmap(darg.rbuf, darg.rsize); 955 } else { 956 if (darg.rsize != rsize) 957 err = EBADE; 958 } 959 return (err); 960 } 961 962 /* 963 * ipadm_is_nil_hostname() : Determine if the `hostname' is nil: i.e., 964 * NULL, empty, or a single space (e.g., as returned by 965 * domainname(1M)/sysinfo). 966 * 967 * input: const char *: the hostname to inspect; 968 * output: boolean_t: B_TRUE if `hostname' is not NULL satisfies the 969 * criteria above; otherwise, B_FALSE; 970 */ 971 972 boolean_t 973 ipadm_is_nil_hostname(const char *hostname) 974 { 975 return (hostname == NULL || *hostname == '\0' || 976 (*hostname == ' ' && hostname[1] == '\0')); 977 } 978 979 /* 980 * ipadm_is_valid_hostname(): check whether a string is a valid hostname 981 * 982 * input: const char *: the string to verify as a hostname 983 * output: boolean_t: B_TRUE if the string is a valid hostname 984 * 985 * Note that we accept host names beginning with a digit, which is not 986 * strictly legal according to the RFCs but is in common practice, so we 987 * endeavour to not break what customers are using. 988 * 989 * RFC 1035 limits a wire-format domain name to 255 octets. For a printable 990 * `hostname' as we have, the limit is therefore 253 characters (excluding 991 * the terminating '\0'--or 254 characters if the last character of 992 * `hostname' is a '.'. 993 * 994 * Excerpt from section 2.3.1., Preferred name syntax: 995 * 996 * <domain> ::= <subdomain> | " " 997 * <subdomain> ::= <label> | <subdomain> "." <label> 998 * <label> ::= <letter> [ [ <ldh-str> ] <let-dig> ] 999 * <ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str> 1000 * <let-dig-hyp> ::= <let-dig> | "-" 1001 * <let-dig> ::= <letter> | <digit> 1002 */ 1003 boolean_t 1004 ipadm_is_valid_hostname(const char *hostname) 1005 { 1006 const size_t MAX_READABLE_NAME_LEN = 253; 1007 char last_char; 1008 size_t has_last_dot, namelen, i; 1009 1010 if (hostname == NULL) 1011 return (B_FALSE); 1012 1013 namelen = strlen(hostname); 1014 if (namelen < 1) 1015 return (B_FALSE); 1016 1017 last_char = hostname[namelen - 1]; 1018 has_last_dot = last_char == '.'; 1019 1020 if (namelen > MAX_READABLE_NAME_LEN + has_last_dot || 1021 last_char == '-') 1022 return (B_FALSE); 1023 1024 for (i = 0; hostname[i] != '\0'; i++) { 1025 /* 1026 * As noted above, this deviates from RFC 1035 in that it 1027 * allows a leading digit. 1028 */ 1029 if (isalpha(hostname[i]) || isdigit(hostname[i]) || 1030 (((hostname[i] == '-') || (hostname[i] == '.')) && (i > 0))) 1031 continue; 1032 1033 return (B_FALSE); 1034 } 1035 1036 return (B_TRUE); 1037 } 1038