1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2013 by Delphix. All rights reserved. 24 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #include <sys/types.h> 29 #include <sys/stream.h> 30 #include <sys/stropts.h> 31 #include <sys/strlog.h> 32 #include <sys/strsun.h> 33 #define _SUN_TPI_VERSION 2 34 #include <sys/tihdr.h> 35 #include <sys/timod.h> 36 #include <sys/ddi.h> 37 #include <sys/sunddi.h> 38 #include <sys/strsubr.h> 39 #include <sys/suntpi.h> 40 #include <sys/xti_inet.h> 41 #include <sys/cmn_err.h> 42 #include <sys/kmem.h> 43 #include <sys/cred.h> 44 #include <sys/policy.h> 45 #include <sys/priv.h> 46 #include <sys/ucred.h> 47 #include <sys/zone.h> 48 49 #include <sys/sockio.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/vtrace.h> 53 #include <sys/sdt.h> 54 #include <sys/debug.h> 55 #include <sys/isa_defs.h> 56 #include <sys/random.h> 57 #include <netinet/in.h> 58 #include <netinet/ip6.h> 59 #include <netinet/icmp6.h> 60 #include <netinet/udp.h> 61 62 #include <inet/common.h> 63 #include <inet/ip.h> 64 #include <inet/ip_impl.h> 65 #include <inet/ipsec_impl.h> 66 #include <inet/ip6.h> 67 #include <inet/ip_ire.h> 68 #include <inet/ip_if.h> 69 #include <inet/ip_multi.h> 70 #include <inet/ip_ndp.h> 71 #include <inet/proto_set.h> 72 #include <inet/mib2.h> 73 #include <inet/nd.h> 74 #include <inet/optcom.h> 75 #include <inet/snmpcom.h> 76 #include <inet/kstatcom.h> 77 #include <inet/ipclassifier.h> 78 79 #include <sys/tsol/label.h> 80 #include <sys/tsol/tnet.h> 81 82 #include <inet/rawip_impl.h> 83 84 #include <sys/disp.h> 85 86 /* 87 * Synchronization notes: 88 * 89 * RAWIP is MT and uses the usual kernel synchronization primitives. We use 90 * conn_lock to protect the icmp_t. 91 * 92 * Plumbing notes: 93 * ICMP is always a device driver. For compatibility with mibopen() code 94 * it is possible to I_PUSH "icmp", but that results in pushing a passthrough 95 * dummy module. 96 */ 97 static void icmp_addr_req(queue_t *q, mblk_t *mp); 98 static void icmp_tpi_bind(queue_t *q, mblk_t *mp); 99 static void icmp_bind_proto(icmp_t *icmp); 100 static int icmp_build_hdr_template(conn_t *, const in6_addr_t *, 101 const in6_addr_t *, uint32_t); 102 static void icmp_capability_req(queue_t *q, mblk_t *mp); 103 static int icmp_close(queue_t *q, int flags, cred_t *); 104 static void icmp_close_free(conn_t *); 105 static void icmp_tpi_connect(queue_t *q, mblk_t *mp); 106 static void icmp_tpi_disconnect(queue_t *q, mblk_t *mp); 107 static void icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, 108 int sys_error); 109 static void icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 110 t_scalar_t tlierr, int sys_error); 111 static void icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, 112 ip_recv_attr_t *); 113 static void icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, 114 ip_recv_attr_t *); 115 static void icmp_info_req(queue_t *q, mblk_t *mp); 116 static void icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *); 117 static conn_t *icmp_open(int family, cred_t *credp, int *err, int flags); 118 static int icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, 119 cred_t *credp); 120 static int icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, 121 cred_t *credp); 122 static boolean_t icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name); 123 int icmp_opt_set(conn_t *connp, uint_t optset_context, 124 int level, int name, uint_t inlen, 125 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 126 void *thisdg_attrs, cred_t *cr); 127 int icmp_opt_get(conn_t *connp, int level, int name, 128 uchar_t *ptr); 129 static int icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, 130 sin6_t *sin6, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa); 131 static mblk_t *icmp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *, 132 const in6_addr_t *, const in6_addr_t *, uint32_t, mblk_t *, int *); 133 static mblk_t *icmp_prepend_header_template(conn_t *, ip_xmit_attr_t *, 134 mblk_t *, const in6_addr_t *, uint32_t, int *); 135 static int icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 136 uchar_t *ptr, int len); 137 static void icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err); 138 static void icmp_tpi_unbind(queue_t *q, mblk_t *mp); 139 static int icmp_wput(queue_t *q, mblk_t *mp); 140 static int icmp_wput_fallback(queue_t *q, mblk_t *mp); 141 static void icmp_wput_other(queue_t *q, mblk_t *mp); 142 static void icmp_wput_iocdata(queue_t *q, mblk_t *mp); 143 static void icmp_wput_restricted(queue_t *q, mblk_t *mp); 144 static void icmp_ulp_recv(conn_t *, mblk_t *, uint_t); 145 146 static void *rawip_stack_init(netstackid_t stackid, netstack_t *ns); 147 static void rawip_stack_fini(netstackid_t stackid, void *arg); 148 149 static void *rawip_kstat_init(netstackid_t stackid); 150 static void rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp); 151 static int rawip_kstat_update(kstat_t *kp, int rw); 152 static void rawip_stack_shutdown(netstackid_t stackid, void *arg); 153 154 /* Common routines for TPI and socket module */ 155 static conn_t *rawip_do_open(int, cred_t *, int *, int); 156 static void rawip_do_close(conn_t *); 157 static int rawip_do_bind(conn_t *, struct sockaddr *, socklen_t); 158 static int rawip_do_unbind(conn_t *); 159 static int rawip_do_connect(conn_t *, const struct sockaddr *, socklen_t, 160 cred_t *, pid_t); 161 162 int rawip_getsockname(sock_lower_handle_t, struct sockaddr *, 163 socklen_t *, cred_t *); 164 int rawip_getpeername(sock_lower_handle_t, struct sockaddr *, 165 socklen_t *, cred_t *); 166 167 static struct module_info icmp_mod_info = { 168 5707, "icmp", 1, INFPSZ, 512, 128 169 }; 170 171 /* 172 * Entry points for ICMP as a device. 173 * We have separate open functions for the /dev/icmp and /dev/icmp6 devices. 174 */ 175 static struct qinit icmprinitv4 = { 176 NULL, NULL, icmp_openv4, icmp_close, NULL, &icmp_mod_info 177 }; 178 179 static struct qinit icmprinitv6 = { 180 NULL, NULL, icmp_openv6, icmp_close, NULL, &icmp_mod_info 181 }; 182 183 static struct qinit icmpwinit = { 184 icmp_wput, ip_wsrv, NULL, NULL, NULL, &icmp_mod_info 185 }; 186 187 /* ICMP entry point during fallback */ 188 static struct qinit icmp_fallback_sock_winit = { 189 icmp_wput_fallback, NULL, NULL, NULL, NULL, &icmp_mod_info 190 }; 191 192 /* For AF_INET aka /dev/icmp */ 193 struct streamtab icmpinfov4 = { 194 &icmprinitv4, &icmpwinit 195 }; 196 197 /* For AF_INET6 aka /dev/icmp6 */ 198 struct streamtab icmpinfov6 = { 199 &icmprinitv6, &icmpwinit 200 }; 201 202 /* Default structure copied into T_INFO_ACK messages */ 203 static struct T_info_ack icmp_g_t_info_ack = { 204 T_INFO_ACK, 205 IP_MAXPACKET, /* TSDU_size. icmp allows maximum size messages. */ 206 T_INVALID, /* ETSDU_size. icmp does not support expedited data. */ 207 T_INVALID, /* CDATA_size. icmp does not support connect data. */ 208 T_INVALID, /* DDATA_size. icmp does not support disconnect data. */ 209 0, /* ADDR_size - filled in later. */ 210 0, /* OPT_size - not initialized here */ 211 IP_MAXPACKET, /* TIDU_size. icmp allows maximum size messages. */ 212 T_CLTS, /* SERV_type. icmp supports connection-less. */ 213 TS_UNBND, /* CURRENT_state. This is set from icmp_state. */ 214 (XPG4_1|SENDZERO) /* PROVIDER_flag */ 215 }; 216 217 static int 218 icmp_set_buf_prop(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo, 219 const char *ifname, const void *pval, uint_t flags) 220 { 221 return (mod_set_buf_prop(stack->netstack_icmp->is_propinfo_tbl, 222 stack, cr, pinfo, ifname, pval, flags)); 223 } 224 225 static int 226 icmp_get_buf_prop(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname, 227 void *val, uint_t psize, uint_t flags) 228 { 229 return (mod_get_buf_prop(stack->netstack_icmp->is_propinfo_tbl, stack, 230 pinfo, ifname, val, psize, flags)); 231 } 232 233 /* 234 * All of these are alterable, within the min/max values given, at run time. 235 * 236 * Note: All those tunables which do not start with "icmp_" are Committed and 237 * therefore are public. See PSARC 2010/080. 238 */ 239 static mod_prop_info_t icmp_propinfo_tbl[] = { 240 /* tunable - 0 */ 241 { "_wroff_extra", MOD_PROTO_RAWIP, 242 mod_set_uint32, mod_get_uint32, 243 {0, 128, 32}, {32} }, 244 245 { "_ipv4_ttl", MOD_PROTO_RAWIP, 246 mod_set_uint32, mod_get_uint32, 247 {1, 255, 255}, {255} }, 248 249 { "_ipv6_hoplimit", MOD_PROTO_RAWIP, 250 mod_set_uint32, mod_get_uint32, 251 {0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS}, 252 {IPV6_DEFAULT_HOPS} }, 253 254 { "_bsd_compat", MOD_PROTO_RAWIP, 255 mod_set_boolean, mod_get_boolean, 256 {B_TRUE}, {B_TRUE} }, 257 258 { "send_buf", MOD_PROTO_RAWIP, 259 icmp_set_buf_prop, icmp_get_buf_prop, 260 {4096, 65536, 8192}, {8192} }, 261 262 { "_xmit_lowat", MOD_PROTO_RAWIP, 263 mod_set_uint32, mod_get_uint32, 264 {0, 65536, 1024}, {1024} }, 265 266 { "recv_buf", MOD_PROTO_RAWIP, 267 icmp_set_buf_prop, icmp_get_buf_prop, 268 {4096, 65536, 8192}, {8192} }, 269 270 { "max_buf", MOD_PROTO_RAWIP, 271 mod_set_uint32, mod_get_uint32, 272 {65536, ULP_MAX_BUF, 256*1024}, {256*1024} }, 273 274 { "_pmtu_discovery", MOD_PROTO_RAWIP, 275 mod_set_boolean, mod_get_boolean, 276 {B_FALSE}, {B_FALSE} }, 277 278 { "_sendto_ignerr", MOD_PROTO_RAWIP, 279 mod_set_boolean, mod_get_boolean, 280 {B_FALSE}, {B_FALSE} }, 281 282 { "?", MOD_PROTO_RAWIP, NULL, mod_get_allprop, {0}, {0} }, 283 284 { NULL, 0, NULL, NULL, {0}, {0} } 285 }; 286 287 #define is_wroff_extra is_propinfo_tbl[0].prop_cur_uval 288 #define is_ipv4_ttl is_propinfo_tbl[1].prop_cur_uval 289 #define is_ipv6_hoplimit is_propinfo_tbl[2].prop_cur_uval 290 #define is_bsd_compat is_propinfo_tbl[3].prop_cur_bval 291 #define is_xmit_hiwat is_propinfo_tbl[4].prop_cur_uval 292 #define is_xmit_lowat is_propinfo_tbl[5].prop_cur_uval 293 #define is_recv_hiwat is_propinfo_tbl[6].prop_cur_uval 294 #define is_max_buf is_propinfo_tbl[7].prop_cur_uval 295 #define is_pmtu_discovery is_propinfo_tbl[8].prop_cur_bval 296 #define is_sendto_ignerr is_propinfo_tbl[9].prop_cur_bval 297 298 typedef union T_primitives *t_primp_t; 299 300 /* 301 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message 302 * passed to icmp_wput. 303 * It calls IP to verify the local IP address, and calls IP to insert 304 * the conn_t in the fanout table. 305 * If everything is ok it then sends the T_BIND_ACK back up. 306 */ 307 static void 308 icmp_tpi_bind(queue_t *q, mblk_t *mp) 309 { 310 int error; 311 struct sockaddr *sa; 312 struct T_bind_req *tbr; 313 socklen_t len; 314 sin_t *sin; 315 sin6_t *sin6; 316 icmp_t *icmp; 317 conn_t *connp = Q_TO_CONN(q); 318 mblk_t *mp1; 319 cred_t *cr; 320 321 /* 322 * All Solaris components should pass a db_credp 323 * for this TPI message, hence we ASSERT. 324 * But in case there is some other M_PROTO that looks 325 * like a TPI message sent by some other kernel 326 * component, we check and return an error. 327 */ 328 cr = msg_getcred(mp, NULL); 329 ASSERT(cr != NULL); 330 if (cr == NULL) { 331 icmp_err_ack(q, mp, TSYSERR, EINVAL); 332 return; 333 } 334 335 icmp = connp->conn_icmp; 336 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 337 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 338 "icmp_bind: bad req, len %u", 339 (uint_t)(mp->b_wptr - mp->b_rptr)); 340 icmp_err_ack(q, mp, TPROTO, 0); 341 return; 342 } 343 344 if (icmp->icmp_state != TS_UNBND) { 345 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 346 "icmp_bind: bad state, %u", icmp->icmp_state); 347 icmp_err_ack(q, mp, TOUTSTATE, 0); 348 return; 349 } 350 351 /* 352 * Reallocate the message to make sure we have enough room for an 353 * address. 354 */ 355 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1); 356 if (mp1 == NULL) { 357 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 358 return; 359 } 360 mp = mp1; 361 362 /* Reset the message type in preparation for shipping it back. */ 363 DB_TYPE(mp) = M_PCPROTO; 364 tbr = (struct T_bind_req *)mp->b_rptr; 365 len = tbr->ADDR_length; 366 switch (len) { 367 case 0: /* request for a generic port */ 368 tbr->ADDR_offset = sizeof (struct T_bind_req); 369 if (connp->conn_family == AF_INET) { 370 tbr->ADDR_length = sizeof (sin_t); 371 sin = (sin_t *)&tbr[1]; 372 *sin = sin_null; 373 sin->sin_family = AF_INET; 374 mp->b_wptr = (uchar_t *)&sin[1]; 375 sa = (struct sockaddr *)sin; 376 len = sizeof (sin_t); 377 } else { 378 ASSERT(connp->conn_family == AF_INET6); 379 tbr->ADDR_length = sizeof (sin6_t); 380 sin6 = (sin6_t *)&tbr[1]; 381 *sin6 = sin6_null; 382 sin6->sin6_family = AF_INET6; 383 mp->b_wptr = (uchar_t *)&sin6[1]; 384 sa = (struct sockaddr *)sin6; 385 len = sizeof (sin6_t); 386 } 387 break; 388 389 case sizeof (sin_t): /* Complete IPv4 address */ 390 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset, 391 sizeof (sin_t)); 392 break; 393 394 case sizeof (sin6_t): /* Complete IPv6 address */ 395 sa = (struct sockaddr *)mi_offset_param(mp, 396 tbr->ADDR_offset, sizeof (sin6_t)); 397 break; 398 399 default: 400 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE, 401 "icmp_bind: bad ADDR_length %u", tbr->ADDR_length); 402 icmp_err_ack(q, mp, TBADADDR, 0); 403 return; 404 } 405 406 error = rawip_do_bind(connp, sa, len); 407 if (error != 0) { 408 if (error > 0) { 409 icmp_err_ack(q, mp, TSYSERR, error); 410 } else { 411 icmp_err_ack(q, mp, -error, 0); 412 } 413 } else { 414 tbr->PRIM_type = T_BIND_ACK; 415 qreply(q, mp); 416 } 417 } 418 419 static int 420 rawip_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len) 421 { 422 sin_t *sin; 423 sin6_t *sin6; 424 icmp_t *icmp = connp->conn_icmp; 425 int error = 0; 426 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */ 427 in_port_t lport; /* Network byte order */ 428 ipaddr_t v4src; /* Set if AF_INET */ 429 in6_addr_t v6src; 430 uint_t scopeid = 0; 431 zoneid_t zoneid = IPCL_ZONEID(connp); 432 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 433 434 if (sa == NULL || !OK_32PTR((char *)sa)) { 435 return (EINVAL); 436 } 437 438 switch (len) { 439 case sizeof (sin_t): /* Complete IPv4 address */ 440 sin = (sin_t *)sa; 441 if (sin->sin_family != AF_INET || 442 connp->conn_family != AF_INET) { 443 /* TSYSERR, EAFNOSUPPORT */ 444 return (EAFNOSUPPORT); 445 } 446 v4src = sin->sin_addr.s_addr; 447 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src); 448 if (v4src != INADDR_ANY) { 449 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst, 450 B_TRUE); 451 } 452 lport = sin->sin_port; 453 break; 454 case sizeof (sin6_t): /* Complete IPv6 address */ 455 sin6 = (sin6_t *)sa; 456 if (sin6->sin6_family != AF_INET6 || 457 connp->conn_family != AF_INET6) { 458 /* TSYSERR, EAFNOSUPPORT */ 459 return (EAFNOSUPPORT); 460 } 461 /* No support for mapped addresses on raw sockets */ 462 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 463 /* TSYSERR, EADDRNOTAVAIL */ 464 return (EADDRNOTAVAIL); 465 } 466 v6src = sin6->sin6_addr; 467 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 468 if (IN6_IS_ADDR_LINKSCOPE(&v6src)) 469 scopeid = sin6->sin6_scope_id; 470 laddr_type = ip_laddr_verify_v6(&v6src, zoneid, ipst, 471 B_TRUE, scopeid); 472 } 473 lport = sin6->sin6_port; 474 break; 475 476 default: 477 /* TBADADDR */ 478 return (EADDRNOTAVAIL); 479 } 480 481 /* Is the local address a valid unicast, multicast, or broadcast? */ 482 if (laddr_type == IPVL_BAD) 483 return (EADDRNOTAVAIL); 484 485 /* 486 * The state must be TS_UNBND. 487 */ 488 mutex_enter(&connp->conn_lock); 489 if (icmp->icmp_state != TS_UNBND) { 490 mutex_exit(&connp->conn_lock); 491 return (-TOUTSTATE); 492 } 493 494 /* 495 * Copy the source address into our icmp structure. This address 496 * may still be zero; if so, ip will fill in the correct address 497 * each time an outbound packet is passed to it. 498 * If we are binding to a broadcast or multicast address then 499 * we just set the conn_bound_addr since we don't want to use 500 * that as the source address when sending. 501 */ 502 connp->conn_bound_addr_v6 = v6src; 503 connp->conn_laddr_v6 = v6src; 504 if (scopeid != 0) { 505 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 506 connp->conn_ixa->ixa_scopeid = scopeid; 507 connp->conn_incoming_ifindex = scopeid; 508 } else { 509 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 510 connp->conn_incoming_ifindex = connp->conn_bound_if; 511 } 512 513 switch (laddr_type) { 514 case IPVL_UNICAST_UP: 515 case IPVL_UNICAST_DOWN: 516 connp->conn_saddr_v6 = v6src; 517 connp->conn_mcbc_bind = B_FALSE; 518 break; 519 case IPVL_MCAST: 520 case IPVL_BCAST: 521 /* ip_set_destination will pick a source address later */ 522 connp->conn_saddr_v6 = ipv6_all_zeros; 523 connp->conn_mcbc_bind = B_TRUE; 524 break; 525 } 526 527 /* Any errors after this point should use late_error */ 528 529 /* 530 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 531 * with IPPROTO_TCP. 532 */ 533 connp->conn_lport = lport; 534 connp->conn_fport = 0; 535 536 if (connp->conn_family == AF_INET) { 537 ASSERT(connp->conn_ipversion == IPV4_VERSION); 538 } else { 539 ASSERT(connp->conn_ipversion == IPV6_VERSION); 540 } 541 542 icmp->icmp_state = TS_IDLE; 543 544 /* 545 * We create an initial header template here to make a subsequent 546 * sendto have a starting point. Since conn_last_dst is zero the 547 * first sendto will always follow the 'dst changed' code path. 548 * Note that we defer massaging options and the related checksum 549 * adjustment until we have a destination address. 550 */ 551 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 552 &connp->conn_faddr_v6, connp->conn_flowinfo); 553 if (error != 0) { 554 mutex_exit(&connp->conn_lock); 555 goto late_error; 556 } 557 /* Just in case */ 558 connp->conn_faddr_v6 = ipv6_all_zeros; 559 connp->conn_v6lastdst = ipv6_all_zeros; 560 mutex_exit(&connp->conn_lock); 561 562 error = ip_laddr_fanout_insert(connp); 563 if (error != 0) 564 goto late_error; 565 566 /* Bind succeeded */ 567 return (0); 568 569 late_error: 570 mutex_enter(&connp->conn_lock); 571 connp->conn_saddr_v6 = ipv6_all_zeros; 572 connp->conn_bound_addr_v6 = ipv6_all_zeros; 573 connp->conn_laddr_v6 = ipv6_all_zeros; 574 if (scopeid != 0) { 575 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 576 connp->conn_incoming_ifindex = connp->conn_bound_if; 577 } 578 icmp->icmp_state = TS_UNBND; 579 connp->conn_v6lastdst = ipv6_all_zeros; 580 connp->conn_lport = 0; 581 582 /* Restore the header that was built above - different source address */ 583 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 584 &connp->conn_faddr_v6, connp->conn_flowinfo); 585 mutex_exit(&connp->conn_lock); 586 return (error); 587 } 588 589 /* 590 * Tell IP to just bind to the protocol. 591 */ 592 static void 593 icmp_bind_proto(icmp_t *icmp) 594 { 595 conn_t *connp = icmp->icmp_connp; 596 597 mutex_enter(&connp->conn_lock); 598 connp->conn_saddr_v6 = ipv6_all_zeros; 599 connp->conn_laddr_v6 = ipv6_all_zeros; 600 connp->conn_faddr_v6 = ipv6_all_zeros; 601 connp->conn_v6lastdst = ipv6_all_zeros; 602 mutex_exit(&connp->conn_lock); 603 604 (void) ip_laddr_fanout_insert(connp); 605 } 606 607 /* 608 * This routine handles each T_CONN_REQ message passed to icmp. It 609 * associates a default destination address with the stream. 610 * 611 * After various error checks are completed, icmp_connect() lays 612 * the target address and port into the composite header template. 613 * Then we ask IP for information, including a source address if we didn't 614 * already have one. Finally we send up the T_OK_ACK reply message. 615 */ 616 static void 617 icmp_tpi_connect(queue_t *q, mblk_t *mp) 618 { 619 conn_t *connp = Q_TO_CONN(q); 620 struct T_conn_req *tcr; 621 struct sockaddr *sa; 622 socklen_t len; 623 int error; 624 cred_t *cr; 625 pid_t pid; 626 /* 627 * All Solaris components should pass a db_credp 628 * for this TPI message, hence we ASSERT. 629 * But in case there is some other M_PROTO that looks 630 * like a TPI message sent by some other kernel 631 * component, we check and return an error. 632 */ 633 cr = msg_getcred(mp, &pid); 634 ASSERT(cr != NULL); 635 if (cr == NULL) { 636 icmp_err_ack(q, mp, TSYSERR, EINVAL); 637 return; 638 } 639 640 tcr = (struct T_conn_req *)mp->b_rptr; 641 /* Sanity checks */ 642 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) { 643 icmp_err_ack(q, mp, TPROTO, 0); 644 return; 645 } 646 647 if (tcr->OPT_length != 0) { 648 icmp_err_ack(q, mp, TBADOPT, 0); 649 return; 650 } 651 652 len = tcr->DEST_length; 653 654 switch (len) { 655 default: 656 icmp_err_ack(q, mp, TBADADDR, 0); 657 return; 658 case sizeof (sin_t): 659 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset, 660 sizeof (sin_t)); 661 break; 662 case sizeof (sin6_t): 663 sa = (struct sockaddr *)mi_offset_param(mp, 664 tcr->DEST_offset, sizeof (sin6_t)); 665 break; 666 } 667 668 error = proto_verify_ip_addr(connp->conn_family, sa, len); 669 if (error != 0) { 670 icmp_err_ack(q, mp, TSYSERR, error); 671 return; 672 } 673 674 error = rawip_do_connect(connp, sa, len, cr, pid); 675 if (error != 0) { 676 if (error < 0) { 677 icmp_err_ack(q, mp, -error, 0); 678 } else { 679 icmp_err_ack(q, mp, 0, error); 680 } 681 } else { 682 mblk_t *mp1; 683 684 /* 685 * We have to send a connection confirmation to 686 * keep TLI happy. 687 */ 688 if (connp->conn_family == AF_INET) { 689 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 690 sizeof (sin_t), NULL, 0); 691 } else { 692 ASSERT(connp->conn_family == AF_INET6); 693 mp1 = mi_tpi_conn_con(NULL, (char *)sa, 694 sizeof (sin6_t), NULL, 0); 695 } 696 if (mp1 == NULL) { 697 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 698 return; 699 } 700 701 /* 702 * Send ok_ack for T_CONN_REQ 703 */ 704 mp = mi_tpi_ok_ack_alloc(mp); 705 if (mp == NULL) { 706 /* Unable to reuse the T_CONN_REQ for the ack. */ 707 icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM); 708 return; 709 } 710 putnext(connp->conn_rq, mp); 711 putnext(connp->conn_rq, mp1); 712 } 713 } 714 715 static int 716 rawip_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 717 cred_t *cr, pid_t pid) 718 { 719 icmp_t *icmp; 720 sin_t *sin; 721 sin6_t *sin6; 722 int error; 723 uint16_t dstport; 724 ipaddr_t v4dst; 725 in6_addr_t v6dst; 726 uint32_t flowinfo; 727 ip_xmit_attr_t *ixa; 728 ip_xmit_attr_t *oldixa; 729 uint_t scopeid = 0; 730 uint_t srcid = 0; 731 in6_addr_t v6src = connp->conn_saddr_v6; 732 733 icmp = connp->conn_icmp; 734 735 if (sa == NULL || !OK_32PTR((char *)sa)) { 736 return (EINVAL); 737 } 738 739 ASSERT(sa != NULL && len != 0); 740 741 /* 742 * Determine packet type based on type of address passed in 743 * the request should contain an IPv4 or IPv6 address. 744 * Make sure that address family matches the type of 745 * family of the address passed down. 746 */ 747 switch (len) { 748 case sizeof (sin_t): 749 sin = (sin_t *)sa; 750 751 v4dst = sin->sin_addr.s_addr; 752 dstport = sin->sin_port; 753 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 754 ASSERT(connp->conn_ipversion == IPV4_VERSION); 755 break; 756 757 case sizeof (sin6_t): 758 sin6 = (sin6_t *)sa; 759 760 /* No support for mapped addresses on raw sockets */ 761 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 762 return (EADDRNOTAVAIL); 763 } 764 v6dst = sin6->sin6_addr; 765 dstport = sin6->sin6_port; 766 ASSERT(connp->conn_ipversion == IPV6_VERSION); 767 flowinfo = sin6->sin6_flowinfo; 768 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) 769 scopeid = sin6->sin6_scope_id; 770 srcid = sin6->__sin6_src_id; 771 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 772 /* Due to check above, we know sin6_addr is v6-only. */ 773 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 774 B_FALSE, connp->conn_netstack)) { 775 /* Mismatch - v6src would be v4mapped. */ 776 return (EADDRNOTAVAIL); 777 } 778 } 779 break; 780 } 781 782 /* 783 * If there is a different thread using conn_ixa then we get a new 784 * copy and cut the old one loose from conn_ixa. Otherwise we use 785 * conn_ixa and prevent any other thread from using/changing it. 786 * Once connect() is done other threads can use conn_ixa since the 787 * refcnt will be back at one. 788 * We defer updating conn_ixa until later to handle any concurrent 789 * conn_ixa_cleanup thread. 790 */ 791 ixa = conn_get_ixa(connp, B_FALSE); 792 if (ixa == NULL) 793 return (ENOMEM); 794 795 mutex_enter(&connp->conn_lock); 796 /* 797 * This icmp_t must have bound already before doing a connect. 798 * Reject if a connect is in progress (we drop conn_lock during 799 * rawip_do_connect). 800 */ 801 if (icmp->icmp_state == TS_UNBND || icmp->icmp_state == TS_WCON_CREQ) { 802 mutex_exit(&connp->conn_lock); 803 ixa_refrele(ixa); 804 return (-TOUTSTATE); 805 } 806 807 if (icmp->icmp_state == TS_DATA_XFER) { 808 /* Already connected - clear out state */ 809 if (connp->conn_mcbc_bind) 810 connp->conn_saddr_v6 = ipv6_all_zeros; 811 else 812 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 813 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 814 connp->conn_faddr_v6 = ipv6_all_zeros; 815 icmp->icmp_state = TS_IDLE; 816 } 817 818 /* 819 * Use sin_port/sin6_port since applications like psh use SOCK_RAW 820 * with IPPROTO_TCP. 821 */ 822 connp->conn_fport = dstport; 823 if (connp->conn_ipversion == IPV4_VERSION) { 824 /* 825 * Interpret a zero destination to mean loopback. 826 * Update the T_CONN_REQ (sin/sin6) since it is used to 827 * generate the T_CONN_CON. 828 */ 829 if (v4dst == INADDR_ANY) { 830 v4dst = htonl(INADDR_LOOPBACK); 831 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst); 832 ASSERT(connp->conn_family == AF_INET); 833 sin->sin_addr.s_addr = v4dst; 834 } 835 connp->conn_faddr_v6 = v6dst; 836 connp->conn_flowinfo = 0; 837 } else { 838 ASSERT(connp->conn_ipversion == IPV6_VERSION); 839 /* 840 * Interpret a zero destination to mean loopback. 841 * Update the T_CONN_REQ (sin/sin6) since it is used to 842 * generate the T_CONN_CON. 843 */ 844 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) { 845 v6dst = ipv6_loopback; 846 sin6->sin6_addr = v6dst; 847 } 848 connp->conn_faddr_v6 = v6dst; 849 connp->conn_flowinfo = flowinfo; 850 } 851 852 /* 853 * We update our cred/cpid based on the caller of connect 854 */ 855 if (connp->conn_cred != cr) { 856 crhold(cr); 857 crfree(connp->conn_cred); 858 connp->conn_cred = cr; 859 } 860 connp->conn_cpid = pid; 861 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 862 ixa->ixa_cred = cr; 863 ixa->ixa_cpid = pid; 864 if (is_system_labeled()) { 865 /* We need to restart with a label based on the cred */ 866 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 867 } 868 869 if (scopeid != 0) { 870 ixa->ixa_flags |= IXAF_SCOPEID_SET; 871 ixa->ixa_scopeid = scopeid; 872 connp->conn_incoming_ifindex = scopeid; 873 } else { 874 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 875 connp->conn_incoming_ifindex = connp->conn_bound_if; 876 } 877 878 /* 879 * conn_connect will drop conn_lock and reacquire it. 880 * To prevent a send* from messing with this icmp_t while the lock 881 * is dropped we set icmp_state and clear conn_v6lastdst. 882 * That will make all send* fail with EISCONN. 883 */ 884 connp->conn_v6lastdst = ipv6_all_zeros; 885 icmp->icmp_state = TS_WCON_CREQ; 886 887 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC); 888 mutex_exit(&connp->conn_lock); 889 if (error != 0) 890 goto connect_failed; 891 892 /* 893 * The addresses have been verified. Time to insert in 894 * the correct fanout list. 895 */ 896 error = ipcl_conn_insert(connp); 897 if (error != 0) 898 goto connect_failed; 899 900 mutex_enter(&connp->conn_lock); 901 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 902 &connp->conn_faddr_v6, connp->conn_flowinfo); 903 if (error != 0) { 904 mutex_exit(&connp->conn_lock); 905 goto connect_failed; 906 } 907 908 icmp->icmp_state = TS_DATA_XFER; 909 /* Record this as the "last" send even though we haven't sent any */ 910 connp->conn_v6lastdst = connp->conn_faddr_v6; 911 connp->conn_lastipversion = connp->conn_ipversion; 912 connp->conn_lastdstport = connp->conn_fport; 913 connp->conn_lastflowinfo = connp->conn_flowinfo; 914 connp->conn_lastscopeid = scopeid; 915 connp->conn_lastsrcid = srcid; 916 /* Also remember a source to use together with lastdst */ 917 connp->conn_v6lastsrc = v6src; 918 919 oldixa = conn_replace_ixa(connp, ixa); 920 mutex_exit(&connp->conn_lock); 921 ixa_refrele(oldixa); 922 923 ixa_refrele(ixa); 924 return (0); 925 926 connect_failed: 927 if (ixa != NULL) 928 ixa_refrele(ixa); 929 mutex_enter(&connp->conn_lock); 930 icmp->icmp_state = TS_IDLE; 931 /* In case the source address was set above */ 932 if (connp->conn_mcbc_bind) 933 connp->conn_saddr_v6 = ipv6_all_zeros; 934 else 935 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 936 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 937 connp->conn_faddr_v6 = ipv6_all_zeros; 938 connp->conn_v6lastdst = ipv6_all_zeros; 939 connp->conn_flowinfo = 0; 940 941 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 942 &connp->conn_faddr_v6, connp->conn_flowinfo); 943 mutex_exit(&connp->conn_lock); 944 return (error); 945 } 946 947 static void 948 rawip_do_close(conn_t *connp) 949 { 950 ASSERT(connp != NULL && IPCL_IS_RAWIP(connp)); 951 952 ip_quiesce_conn(connp); 953 954 if (!IPCL_IS_NONSTR(connp)) { 955 qprocsoff(connp->conn_rq); 956 } 957 958 icmp_close_free(connp); 959 960 /* 961 * Now we are truly single threaded on this stream, and can 962 * delete the things hanging off the connp, and finally the connp. 963 * We removed this connp from the fanout list, it cannot be 964 * accessed thru the fanouts, and we already waited for the 965 * conn_ref to drop to 0. We are already in close, so 966 * there cannot be any other thread from the top. qprocsoff 967 * has completed, and service has completed or won't run in 968 * future. 969 */ 970 ASSERT(connp->conn_ref == 1); 971 972 if (!IPCL_IS_NONSTR(connp)) { 973 inet_minor_free(connp->conn_minor_arena, connp->conn_dev); 974 } else { 975 ip_free_helper_stream(connp); 976 } 977 978 connp->conn_ref--; 979 ipcl_conn_destroy(connp); 980 } 981 982 /* ARGSUSED */ 983 static int 984 icmp_close(queue_t *q, int flags, cred_t *credp __unused) 985 { 986 conn_t *connp; 987 988 if (flags & SO_FALLBACK) { 989 /* 990 * stream is being closed while in fallback 991 * simply free the resources that were allocated 992 */ 993 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr)); 994 qprocsoff(q); 995 goto done; 996 } 997 998 connp = Q_TO_CONN(q); 999 (void) rawip_do_close(connp); 1000 done: 1001 q->q_ptr = WR(q)->q_ptr = NULL; 1002 return (0); 1003 } 1004 1005 static void 1006 icmp_close_free(conn_t *connp) 1007 { 1008 icmp_t *icmp = connp->conn_icmp; 1009 1010 if (icmp->icmp_filter != NULL) { 1011 kmem_free(icmp->icmp_filter, sizeof (icmp6_filter_t)); 1012 icmp->icmp_filter = NULL; 1013 } 1014 1015 /* 1016 * Clear any fields which the kmem_cache constructor clears. 1017 * Only icmp_connp needs to be preserved. 1018 * TBD: We should make this more efficient to avoid clearing 1019 * everything. 1020 */ 1021 ASSERT(icmp->icmp_connp == connp); 1022 bzero(icmp, sizeof (icmp_t)); 1023 icmp->icmp_connp = connp; 1024 } 1025 1026 /* 1027 * This routine handles each T_DISCON_REQ message passed to icmp 1028 * as an indicating that ICMP is no longer connected. This results 1029 * in telling IP to restore the binding to just the local address. 1030 */ 1031 static int 1032 icmp_do_disconnect(conn_t *connp) 1033 { 1034 icmp_t *icmp = connp->conn_icmp; 1035 int error; 1036 1037 mutex_enter(&connp->conn_lock); 1038 if (icmp->icmp_state != TS_DATA_XFER) { 1039 mutex_exit(&connp->conn_lock); 1040 return (-TOUTSTATE); 1041 } 1042 if (connp->conn_mcbc_bind) 1043 connp->conn_saddr_v6 = ipv6_all_zeros; 1044 else 1045 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 1046 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 1047 connp->conn_faddr_v6 = ipv6_all_zeros; 1048 icmp->icmp_state = TS_IDLE; 1049 1050 connp->conn_v6lastdst = ipv6_all_zeros; 1051 error = icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 1052 &connp->conn_faddr_v6, connp->conn_flowinfo); 1053 mutex_exit(&connp->conn_lock); 1054 if (error != 0) 1055 return (error); 1056 1057 /* 1058 * Tell IP to remove the full binding and revert 1059 * to the local address binding. 1060 */ 1061 return (ip_laddr_fanout_insert(connp)); 1062 } 1063 1064 static void 1065 icmp_tpi_disconnect(queue_t *q, mblk_t *mp) 1066 { 1067 conn_t *connp = Q_TO_CONN(q); 1068 int error; 1069 1070 /* 1071 * Allocate the largest primitive we need to send back 1072 * T_error_ack is > than T_ok_ack 1073 */ 1074 mp = reallocb(mp, sizeof (struct T_error_ack), 1); 1075 if (mp == NULL) { 1076 /* Unable to reuse the T_DISCON_REQ for the ack. */ 1077 icmp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM); 1078 return; 1079 } 1080 1081 error = icmp_do_disconnect(connp); 1082 1083 if (error != 0) { 1084 if (error > 0) { 1085 icmp_err_ack(q, mp, 0, error); 1086 } else { 1087 icmp_err_ack(q, mp, -error, 0); 1088 } 1089 } else { 1090 mp = mi_tpi_ok_ack_alloc(mp); 1091 ASSERT(mp != NULL); 1092 qreply(q, mp); 1093 } 1094 } 1095 1096 static int 1097 icmp_disconnect(conn_t *connp) 1098 { 1099 int error; 1100 1101 connp->conn_dgram_errind = B_FALSE; 1102 1103 error = icmp_do_disconnect(connp); 1104 1105 if (error < 0) 1106 error = proto_tlitosyserr(-error); 1107 return (error); 1108 } 1109 1110 /* This routine creates a T_ERROR_ACK message and passes it upstream. */ 1111 static void 1112 icmp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error) 1113 { 1114 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 1115 qreply(q, mp); 1116 } 1117 1118 /* Shorthand to generate and send TPI error acks to our client */ 1119 static void 1120 icmp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive, 1121 t_scalar_t t_error, int sys_error) 1122 { 1123 struct T_error_ack *teackp; 1124 1125 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 1126 M_PCPROTO, T_ERROR_ACK)) != NULL) { 1127 teackp = (struct T_error_ack *)mp->b_rptr; 1128 teackp->ERROR_prim = primitive; 1129 teackp->TLI_error = t_error; 1130 teackp->UNIX_error = sys_error; 1131 qreply(q, mp); 1132 } 1133 } 1134 1135 /* 1136 * icmp_icmp_input is called as conn_recvicmp to process ICMP messages. 1137 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1138 * Assumes that IP has pulled up everything up to and including the ICMP header. 1139 */ 1140 /* ARGSUSED2 */ 1141 static void 1142 icmp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 1143 { 1144 conn_t *connp = (conn_t *)arg1; 1145 icmp_t *icmp = connp->conn_icmp; 1146 icmph_t *icmph; 1147 ipha_t *ipha; 1148 int iph_hdr_length; 1149 sin_t sin; 1150 mblk_t *mp1; 1151 int error = 0; 1152 1153 ipha = (ipha_t *)mp->b_rptr; 1154 1155 ASSERT(OK_32PTR(mp->b_rptr)); 1156 1157 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) { 1158 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 1159 icmp_icmp_error_ipv6(connp, mp, ira); 1160 return; 1161 } 1162 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 1163 1164 /* Skip past the outer IP and ICMP headers */ 1165 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length); 1166 iph_hdr_length = ira->ira_ip_hdr_length; 1167 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 1168 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */ 1169 1170 iph_hdr_length = IPH_HDR_LENGTH(ipha); 1171 1172 switch (icmph->icmph_type) { 1173 case ICMP_DEST_UNREACHABLE: 1174 switch (icmph->icmph_code) { 1175 case ICMP_FRAGMENTATION_NEEDED: { 1176 ipha_t *ipha; 1177 ip_xmit_attr_t *ixa; 1178 /* 1179 * IP has already adjusted the path MTU. 1180 * But we need to adjust DF for IPv4. 1181 */ 1182 if (connp->conn_ipversion != IPV4_VERSION) 1183 break; 1184 1185 ixa = conn_get_ixa(connp, B_FALSE); 1186 if (ixa == NULL || ixa->ixa_ire == NULL) { 1187 /* 1188 * Some other thread holds conn_ixa. We will 1189 * redo this on the next ICMP too big. 1190 */ 1191 if (ixa != NULL) 1192 ixa_refrele(ixa); 1193 break; 1194 } 1195 (void) ip_get_pmtu(ixa); 1196 1197 mutex_enter(&connp->conn_lock); 1198 ipha = (ipha_t *)connp->conn_ht_iphc; 1199 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 1200 ipha->ipha_fragment_offset_and_flags |= 1201 IPH_DF_HTONS; 1202 } else { 1203 ipha->ipha_fragment_offset_and_flags &= 1204 ~IPH_DF_HTONS; 1205 } 1206 mutex_exit(&connp->conn_lock); 1207 ixa_refrele(ixa); 1208 break; 1209 } 1210 case ICMP_PORT_UNREACHABLE: 1211 case ICMP_PROTOCOL_UNREACHABLE: 1212 error = ECONNREFUSED; 1213 break; 1214 default: 1215 /* Transient errors */ 1216 break; 1217 } 1218 break; 1219 default: 1220 /* Transient errors */ 1221 break; 1222 } 1223 if (error == 0) { 1224 freemsg(mp); 1225 return; 1226 } 1227 1228 /* 1229 * Deliver T_UDERROR_IND when the application has asked for it. 1230 * The socket layer enables this automatically when connected. 1231 */ 1232 if (!connp->conn_dgram_errind) { 1233 freemsg(mp); 1234 return; 1235 } 1236 1237 sin = sin_null; 1238 sin.sin_family = AF_INET; 1239 sin.sin_addr.s_addr = ipha->ipha_dst; 1240 1241 if (IPCL_IS_NONSTR(connp)) { 1242 mutex_enter(&connp->conn_lock); 1243 if (icmp->icmp_state == TS_DATA_XFER) { 1244 if (sin.sin_addr.s_addr == connp->conn_faddr_v4) { 1245 mutex_exit(&connp->conn_lock); 1246 (*connp->conn_upcalls->su_set_error) 1247 (connp->conn_upper_handle, error); 1248 goto done; 1249 } 1250 } else { 1251 icmp->icmp_delayed_error = error; 1252 *((sin_t *)&icmp->icmp_delayed_addr) = sin; 1253 } 1254 mutex_exit(&connp->conn_lock); 1255 } else { 1256 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t), NULL, 0, 1257 error); 1258 if (mp1 != NULL) 1259 putnext(connp->conn_rq, mp1); 1260 } 1261 done: 1262 freemsg(mp); 1263 } 1264 1265 /* 1266 * icmp_icmp_error_ipv6 is called by icmp_icmp_error to process ICMP for IPv6. 1267 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors. 1268 * Assumes that IP has pulled up all the extension headers as well as the 1269 * ICMPv6 header. 1270 */ 1271 static void 1272 icmp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira) 1273 { 1274 icmp6_t *icmp6; 1275 ip6_t *ip6h, *outer_ip6h; 1276 uint16_t iph_hdr_length; 1277 uint8_t *nexthdrp; 1278 sin6_t sin6; 1279 mblk_t *mp1; 1280 int error = 0; 1281 icmp_t *icmp = connp->conn_icmp; 1282 1283 outer_ip6h = (ip6_t *)mp->b_rptr; 1284 #ifdef DEBUG 1285 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6) 1286 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h); 1287 else 1288 iph_hdr_length = IPV6_HDR_LEN; 1289 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length); 1290 #endif 1291 /* Skip past the outer IP and ICMP headers */ 1292 iph_hdr_length = ira->ira_ip_hdr_length; 1293 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 1294 1295 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */ 1296 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) { 1297 freemsg(mp); 1298 return; 1299 } 1300 1301 switch (icmp6->icmp6_type) { 1302 case ICMP6_DST_UNREACH: 1303 switch (icmp6->icmp6_code) { 1304 case ICMP6_DST_UNREACH_NOPORT: 1305 error = ECONNREFUSED; 1306 break; 1307 case ICMP6_DST_UNREACH_ADMIN: 1308 case ICMP6_DST_UNREACH_NOROUTE: 1309 case ICMP6_DST_UNREACH_BEYONDSCOPE: 1310 case ICMP6_DST_UNREACH_ADDR: 1311 /* Transient errors */ 1312 break; 1313 default: 1314 break; 1315 } 1316 break; 1317 case ICMP6_PACKET_TOO_BIG: { 1318 struct T_unitdata_ind *tudi; 1319 struct T_opthdr *toh; 1320 size_t udi_size; 1321 mblk_t *newmp; 1322 t_scalar_t opt_length = sizeof (struct T_opthdr) + 1323 sizeof (struct ip6_mtuinfo); 1324 sin6_t *sin6; 1325 struct ip6_mtuinfo *mtuinfo; 1326 1327 /* 1328 * If the application has requested to receive path mtu 1329 * information, send up an empty message containing an 1330 * IPV6_PATHMTU ancillary data item. 1331 */ 1332 if (!connp->conn_ipv6_recvpathmtu) 1333 break; 1334 1335 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) + 1336 opt_length; 1337 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) { 1338 BUMP_MIB(&icmp->icmp_is->is_rawip_mib, rawipInErrors); 1339 break; 1340 } 1341 1342 /* 1343 * newmp->b_cont is left to NULL on purpose. This is an 1344 * empty message containing only ancillary data. 1345 */ 1346 newmp->b_datap->db_type = M_PROTO; 1347 tudi = (struct T_unitdata_ind *)newmp->b_rptr; 1348 newmp->b_wptr = (uchar_t *)tudi + udi_size; 1349 tudi->PRIM_type = T_UNITDATA_IND; 1350 tudi->SRC_length = sizeof (sin6_t); 1351 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 1352 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t); 1353 tudi->OPT_length = opt_length; 1354 1355 sin6 = (sin6_t *)&tudi[1]; 1356 bzero(sin6, sizeof (sin6_t)); 1357 sin6->sin6_family = AF_INET6; 1358 sin6->sin6_addr = connp->conn_faddr_v6; 1359 1360 toh = (struct T_opthdr *)&sin6[1]; 1361 toh->level = IPPROTO_IPV6; 1362 toh->name = IPV6_PATHMTU; 1363 toh->len = opt_length; 1364 toh->status = 0; 1365 1366 mtuinfo = (struct ip6_mtuinfo *)&toh[1]; 1367 bzero(mtuinfo, sizeof (struct ip6_mtuinfo)); 1368 mtuinfo->ip6m_addr.sin6_family = AF_INET6; 1369 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst; 1370 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu; 1371 /* 1372 * We've consumed everything we need from the original 1373 * message. Free it, then send our empty message. 1374 */ 1375 freemsg(mp); 1376 icmp_ulp_recv(connp, newmp, msgdsize(newmp)); 1377 return; 1378 } 1379 case ICMP6_TIME_EXCEEDED: 1380 /* Transient errors */ 1381 break; 1382 case ICMP6_PARAM_PROB: 1383 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 1384 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 1385 (uchar_t *)ip6h + icmp6->icmp6_pptr == 1386 (uchar_t *)nexthdrp) { 1387 error = ECONNREFUSED; 1388 break; 1389 } 1390 break; 1391 } 1392 if (error == 0) { 1393 freemsg(mp); 1394 return; 1395 } 1396 1397 /* 1398 * Deliver T_UDERROR_IND when the application has asked for it. 1399 * The socket layer enables this automatically when connected. 1400 */ 1401 if (!connp->conn_dgram_errind) { 1402 freemsg(mp); 1403 return; 1404 } 1405 1406 sin6 = sin6_null; 1407 sin6.sin6_family = AF_INET6; 1408 sin6.sin6_addr = ip6h->ip6_dst; 1409 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 1410 if (IPCL_IS_NONSTR(connp)) { 1411 mutex_enter(&connp->conn_lock); 1412 if (icmp->icmp_state == TS_DATA_XFER) { 1413 if (IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr, 1414 &connp->conn_faddr_v6)) { 1415 mutex_exit(&connp->conn_lock); 1416 (*connp->conn_upcalls->su_set_error) 1417 (connp->conn_upper_handle, error); 1418 goto done; 1419 } 1420 } else { 1421 icmp->icmp_delayed_error = error; 1422 *((sin6_t *)&icmp->icmp_delayed_addr) = sin6; 1423 } 1424 mutex_exit(&connp->conn_lock); 1425 } else { 1426 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t), 1427 NULL, 0, error); 1428 if (mp1 != NULL) 1429 putnext(connp->conn_rq, mp1); 1430 } 1431 done: 1432 freemsg(mp); 1433 } 1434 1435 /* 1436 * This routine responds to T_ADDR_REQ messages. It is called by icmp_wput. 1437 * The local address is filled in if endpoint is bound. The remote address 1438 * is filled in if remote address has been precified ("connected endpoint") 1439 * (The concept of connected CLTS sockets is alien to published TPI 1440 * but we support it anyway). 1441 */ 1442 static void 1443 icmp_addr_req(queue_t *q, mblk_t *mp) 1444 { 1445 struct sockaddr *sa; 1446 mblk_t *ackmp; 1447 struct T_addr_ack *taa; 1448 icmp_t *icmp = Q_TO_ICMP(q); 1449 conn_t *connp = icmp->icmp_connp; 1450 uint_t addrlen; 1451 1452 /* Make it large enough for worst case */ 1453 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 1454 2 * sizeof (sin6_t), 1); 1455 if (ackmp == NULL) { 1456 icmp_err_ack(q, mp, TSYSERR, ENOMEM); 1457 return; 1458 } 1459 taa = (struct T_addr_ack *)ackmp->b_rptr; 1460 1461 bzero(taa, sizeof (struct T_addr_ack)); 1462 ackmp->b_wptr = (uchar_t *)&taa[1]; 1463 1464 taa->PRIM_type = T_ADDR_ACK; 1465 ackmp->b_datap->db_type = M_PCPROTO; 1466 1467 if (connp->conn_family == AF_INET) 1468 addrlen = sizeof (sin_t); 1469 else 1470 addrlen = sizeof (sin6_t); 1471 1472 mutex_enter(&connp->conn_lock); 1473 /* 1474 * Note: Following code assumes 32 bit alignment of basic 1475 * data structures like sin_t and struct T_addr_ack. 1476 */ 1477 if (icmp->icmp_state != TS_UNBND) { 1478 /* 1479 * Fill in local address first 1480 */ 1481 taa->LOCADDR_offset = sizeof (*taa); 1482 taa->LOCADDR_length = addrlen; 1483 sa = (struct sockaddr *)&taa[1]; 1484 (void) conn_getsockname(connp, sa, &addrlen); 1485 ackmp->b_wptr += addrlen; 1486 } 1487 if (icmp->icmp_state == TS_DATA_XFER) { 1488 /* 1489 * connected, fill remote address too 1490 */ 1491 taa->REMADDR_length = addrlen; 1492 /* assumed 32-bit alignment */ 1493 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length; 1494 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset); 1495 (void) conn_getpeername(connp, sa, &addrlen); 1496 ackmp->b_wptr += addrlen; 1497 } 1498 mutex_exit(&connp->conn_lock); 1499 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim); 1500 qreply(q, ackmp); 1501 } 1502 1503 static void 1504 icmp_copy_info(struct T_info_ack *tap, icmp_t *icmp) 1505 { 1506 conn_t *connp = icmp->icmp_connp; 1507 1508 *tap = icmp_g_t_info_ack; 1509 1510 if (connp->conn_family == AF_INET6) 1511 tap->ADDR_size = sizeof (sin6_t); 1512 else 1513 tap->ADDR_size = sizeof (sin_t); 1514 tap->CURRENT_state = icmp->icmp_state; 1515 tap->OPT_size = icmp_max_optsize; 1516 } 1517 1518 static void 1519 icmp_do_capability_ack(icmp_t *icmp, struct T_capability_ack *tcap, 1520 t_uscalar_t cap_bits1) 1521 { 1522 tcap->CAP_bits1 = 0; 1523 1524 if (cap_bits1 & TC1_INFO) { 1525 icmp_copy_info(&tcap->INFO_ack, icmp); 1526 tcap->CAP_bits1 |= TC1_INFO; 1527 } 1528 } 1529 1530 /* 1531 * This routine responds to T_CAPABILITY_REQ messages. It is called by 1532 * icmp_wput. Much of the T_CAPABILITY_ACK information is copied from 1533 * icmp_g_t_info_ack. The current state of the stream is copied from 1534 * icmp_state. 1535 */ 1536 static void 1537 icmp_capability_req(queue_t *q, mblk_t *mp) 1538 { 1539 icmp_t *icmp = Q_TO_ICMP(q); 1540 t_uscalar_t cap_bits1; 1541 struct T_capability_ack *tcap; 1542 1543 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 1544 1545 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 1546 mp->b_datap->db_type, T_CAPABILITY_ACK); 1547 if (!mp) 1548 return; 1549 1550 tcap = (struct T_capability_ack *)mp->b_rptr; 1551 1552 icmp_do_capability_ack(icmp, tcap, cap_bits1); 1553 1554 qreply(q, mp); 1555 } 1556 1557 /* 1558 * This routine responds to T_INFO_REQ messages. It is called by icmp_wput. 1559 * Most of the T_INFO_ACK information is copied from icmp_g_t_info_ack. 1560 * The current state of the stream is copied from icmp_state. 1561 */ 1562 static void 1563 icmp_info_req(queue_t *q, mblk_t *mp) 1564 { 1565 icmp_t *icmp = Q_TO_ICMP(q); 1566 1567 /* Create a T_INFO_ACK message. */ 1568 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 1569 T_INFO_ACK); 1570 if (!mp) 1571 return; 1572 icmp_copy_info((struct T_info_ack *)mp->b_rptr, icmp); 1573 qreply(q, mp); 1574 } 1575 1576 static int 1577 icmp_tpi_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 1578 int family) 1579 { 1580 conn_t *connp; 1581 dev_t conn_dev; 1582 int error; 1583 1584 /* If the stream is already open, return immediately. */ 1585 if (q->q_ptr != NULL) 1586 return (0); 1587 1588 if (sflag == MODOPEN) 1589 return (EINVAL); 1590 1591 /* 1592 * Since ICMP is not used so heavily, allocating from the small 1593 * arena should be sufficient. 1594 */ 1595 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 1596 return (EBUSY); 1597 } 1598 1599 if (flag & SO_FALLBACK) { 1600 /* 1601 * Non streams socket needs a stream to fallback to 1602 */ 1603 RD(q)->q_ptr = (void *)conn_dev; 1604 WR(q)->q_qinfo = &icmp_fallback_sock_winit; 1605 WR(q)->q_ptr = (void *)ip_minor_arena_sa; 1606 qprocson(q); 1607 return (0); 1608 } 1609 1610 connp = rawip_do_open(family, credp, &error, KM_SLEEP); 1611 if (connp == NULL) { 1612 ASSERT(error != 0); 1613 inet_minor_free(ip_minor_arena_sa, conn_dev); 1614 return (error); 1615 } 1616 1617 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 1618 connp->conn_dev = conn_dev; 1619 connp->conn_minor_arena = ip_minor_arena_sa; 1620 1621 /* 1622 * Initialize the icmp_t structure for this stream. 1623 */ 1624 q->q_ptr = connp; 1625 WR(q)->q_ptr = connp; 1626 connp->conn_rq = q; 1627 connp->conn_wq = WR(q); 1628 1629 WR(q)->q_hiwat = connp->conn_sndbuf; 1630 WR(q)->q_lowat = connp->conn_sndlowat; 1631 1632 qprocson(q); 1633 1634 /* Set the Stream head write offset. */ 1635 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff); 1636 (void) proto_set_rx_hiwat(connp->conn_rq, connp, connp->conn_rcvbuf); 1637 1638 mutex_enter(&connp->conn_lock); 1639 connp->conn_state_flags &= ~CONN_INCIPIENT; 1640 mutex_exit(&connp->conn_lock); 1641 1642 icmp_bind_proto(connp->conn_icmp); 1643 1644 return (0); 1645 } 1646 1647 /* For /dev/icmp aka AF_INET open */ 1648 static int 1649 icmp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1650 { 1651 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET)); 1652 } 1653 1654 /* For /dev/icmp6 aka AF_INET6 open */ 1655 static int 1656 icmp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 1657 { 1658 return (icmp_tpi_open(q, devp, flag, sflag, credp, AF_INET6)); 1659 } 1660 1661 /* 1662 * This is the open routine for icmp. It allocates a icmp_t structure for 1663 * the stream and, on the first open of the module, creates an ND table. 1664 */ 1665 static conn_t * 1666 rawip_do_open(int family, cred_t *credp, int *err, int flags) 1667 { 1668 icmp_t *icmp; 1669 conn_t *connp; 1670 zoneid_t zoneid; 1671 netstack_t *ns; 1672 icmp_stack_t *is; 1673 int len; 1674 boolean_t isv6 = B_FALSE; 1675 1676 *err = secpolicy_net_icmpaccess(credp); 1677 if (*err != 0) 1678 return (NULL); 1679 1680 if (family == AF_INET6) 1681 isv6 = B_TRUE; 1682 1683 ns = netstack_find_by_cred(credp); 1684 ASSERT(ns != NULL); 1685 is = ns->netstack_icmp; 1686 ASSERT(is != NULL); 1687 1688 /* 1689 * For exclusive stacks we set the zoneid to zero 1690 * to make ICMP operate as if in the global zone. 1691 */ 1692 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1693 zoneid = GLOBAL_ZONEID; 1694 else 1695 zoneid = crgetzoneid(credp); 1696 1697 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP); 1698 1699 connp = ipcl_conn_create(IPCL_RAWIPCONN, flags, ns); 1700 icmp = connp->conn_icmp; 1701 1702 /* 1703 * ipcl_conn_create did a netstack_hold. Undo the hold that was 1704 * done by netstack_find_by_cred() 1705 */ 1706 netstack_rele(ns); 1707 1708 /* 1709 * Since this conn_t/icmp_t is not yet visible to anybody else we don't 1710 * need to lock anything. 1711 */ 1712 ASSERT(connp->conn_proto == IPPROTO_ICMP); 1713 ASSERT(connp->conn_icmp == icmp); 1714 ASSERT(icmp->icmp_connp == connp); 1715 1716 /* Set the initial state of the stream and the privilege status. */ 1717 icmp->icmp_state = TS_UNBND; 1718 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 1719 if (isv6) { 1720 connp->conn_family = AF_INET6; 1721 connp->conn_ipversion = IPV6_VERSION; 1722 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4; 1723 connp->conn_proto = IPPROTO_ICMPV6; 1724 /* May be changed by a SO_PROTOTYPE socket option. */ 1725 connp->conn_proto = IPPROTO_ICMPV6; 1726 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1727 connp->conn_ixa->ixa_raw_cksum_offset = 2; 1728 connp->conn_default_ttl = is->is_ipv6_hoplimit; 1729 len = sizeof (ip6_t); 1730 } else { 1731 connp->conn_family = AF_INET; 1732 connp->conn_ipversion = IPV4_VERSION; 1733 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4; 1734 /* May be changed by a SO_PROTOTYPE socket option. */ 1735 connp->conn_proto = IPPROTO_ICMP; 1736 connp->conn_ixa->ixa_protocol = connp->conn_proto; 1737 connp->conn_default_ttl = is->is_ipv4_ttl; 1738 len = sizeof (ipha_t); 1739 } 1740 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 1741 1742 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1743 1744 /* 1745 * For the socket of protocol IPPROTO_RAW or when IP_HDRINCL is set, 1746 * the checksum is provided in the pre-built packet. We clear 1747 * IXAF_SET_ULP_CKSUM to tell IP that the application has sent a 1748 * complete IP header and not to compute the transport checksum. 1749 */ 1750 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM; 1751 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 1752 connp->conn_ixa->ixa_zoneid = zoneid; 1753 1754 connp->conn_zoneid = zoneid; 1755 1756 /* 1757 * If the caller has the process-wide flag set, then default to MAC 1758 * exempt mode. This allows read-down to unlabeled hosts. 1759 */ 1760 if (getpflags(NET_MAC_AWARE, credp) != 0) 1761 connp->conn_mac_mode = CONN_MAC_AWARE; 1762 1763 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 1764 1765 icmp->icmp_is = is; 1766 1767 connp->conn_rcvbuf = is->is_recv_hiwat; 1768 connp->conn_sndbuf = is->is_xmit_hiwat; 1769 connp->conn_sndlowat = is->is_xmit_lowat; 1770 connp->conn_rcvlowat = icmp_mod_info.mi_lowat; 1771 1772 connp->conn_wroff = len + is->is_wroff_extra; 1773 connp->conn_so_type = SOCK_RAW; 1774 1775 connp->conn_recv = icmp_input; 1776 connp->conn_recvicmp = icmp_icmp_input; 1777 crhold(credp); 1778 connp->conn_cred = credp; 1779 connp->conn_cpid = curproc->p_pid; 1780 connp->conn_open_time = ddi_get_lbolt64(); 1781 /* Cache things in ixa without an extra refhold */ 1782 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 1783 connp->conn_ixa->ixa_cred = connp->conn_cred; 1784 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 1785 if (is_system_labeled()) 1786 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 1787 1788 connp->conn_flow_cntrld = B_FALSE; 1789 1790 if (is->is_pmtu_discovery) 1791 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 1792 1793 return (connp); 1794 } 1795 1796 /* 1797 * Which ICMP options OK to set through T_UNITDATA_REQ... 1798 */ 1799 /* ARGSUSED */ 1800 static boolean_t 1801 icmp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name) 1802 { 1803 return (B_TRUE); 1804 } 1805 1806 /* 1807 * This routine gets default values of certain options whose default 1808 * values are maintained by protcol specific code 1809 */ 1810 int 1811 icmp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr) 1812 { 1813 icmp_t *icmp = Q_TO_ICMP(q); 1814 icmp_stack_t *is = icmp->icmp_is; 1815 int *i1 = (int *)ptr; 1816 1817 switch (level) { 1818 case IPPROTO_IP: 1819 switch (name) { 1820 case IP_MULTICAST_TTL: 1821 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL; 1822 return (sizeof (uchar_t)); 1823 case IP_MULTICAST_LOOP: 1824 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP; 1825 return (sizeof (uchar_t)); 1826 } 1827 break; 1828 case IPPROTO_IPV6: 1829 switch (name) { 1830 case IPV6_MULTICAST_HOPS: 1831 *i1 = IP_DEFAULT_MULTICAST_TTL; 1832 return (sizeof (int)); 1833 case IPV6_MULTICAST_LOOP: 1834 *i1 = IP_DEFAULT_MULTICAST_LOOP; 1835 return (sizeof (int)); 1836 case IPV6_UNICAST_HOPS: 1837 *i1 = is->is_ipv6_hoplimit; 1838 return (sizeof (int)); 1839 } 1840 break; 1841 case IPPROTO_ICMPV6: 1842 switch (name) { 1843 case ICMP6_FILTER: 1844 /* Make it look like "pass all" */ 1845 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1846 return (sizeof (icmp6_filter_t)); 1847 } 1848 break; 1849 } 1850 return (-1); 1851 } 1852 1853 /* 1854 * This routine retrieves the current status of socket options. 1855 * It returns the size of the option retrieved, or -1. 1856 */ 1857 int 1858 icmp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr) 1859 { 1860 icmp_t *icmp = connp->conn_icmp; 1861 int *i1 = (int *)ptr; 1862 conn_opt_arg_t coas; 1863 int retval; 1864 1865 coas.coa_connp = connp; 1866 coas.coa_ixa = connp->conn_ixa; 1867 coas.coa_ipp = &connp->conn_xmit_ipp; 1868 coas.coa_ancillary = B_FALSE; 1869 coas.coa_changed = 0; 1870 1871 /* 1872 * We assume that the optcom framework has checked for the set 1873 * of levels and names that are supported, hence we don't worry 1874 * about rejecting based on that. 1875 * First check for ICMP specific handling, then pass to common routine. 1876 */ 1877 switch (level) { 1878 case IPPROTO_IP: 1879 /* 1880 * Only allow IPv4 option processing on IPv4 sockets. 1881 */ 1882 if (connp->conn_family != AF_INET) 1883 return (-1); 1884 1885 switch (name) { 1886 case IP_OPTIONS: 1887 case T_IP_OPTIONS: 1888 /* Options are passed up with each packet */ 1889 return (0); 1890 case IP_HDRINCL: 1891 mutex_enter(&connp->conn_lock); 1892 *i1 = (int)icmp->icmp_hdrincl; 1893 mutex_exit(&connp->conn_lock); 1894 return (sizeof (int)); 1895 } 1896 break; 1897 1898 case IPPROTO_IPV6: 1899 /* 1900 * Only allow IPv6 option processing on native IPv6 sockets. 1901 */ 1902 if (connp->conn_family != AF_INET6) 1903 return (-1); 1904 1905 switch (name) { 1906 case IPV6_CHECKSUM: 1907 /* 1908 * Return offset or -1 if no checksum offset. 1909 * Does not apply to IPPROTO_ICMPV6 1910 */ 1911 if (connp->conn_proto == IPPROTO_ICMPV6) 1912 return (-1); 1913 1914 mutex_enter(&connp->conn_lock); 1915 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) 1916 *i1 = connp->conn_ixa->ixa_raw_cksum_offset; 1917 else 1918 *i1 = -1; 1919 mutex_exit(&connp->conn_lock); 1920 return (sizeof (int)); 1921 } 1922 break; 1923 1924 case IPPROTO_ICMPV6: 1925 /* 1926 * Only allow IPv6 option processing on native IPv6 sockets. 1927 */ 1928 if (connp->conn_family != AF_INET6) 1929 return (-1); 1930 1931 if (connp->conn_proto != IPPROTO_ICMPV6) 1932 return (-1); 1933 1934 switch (name) { 1935 case ICMP6_FILTER: 1936 mutex_enter(&connp->conn_lock); 1937 if (icmp->icmp_filter == NULL) { 1938 /* Make it look like "pass all" */ 1939 ICMP6_FILTER_SETPASSALL((icmp6_filter_t *)ptr); 1940 } else { 1941 (void) bcopy(icmp->icmp_filter, ptr, 1942 sizeof (icmp6_filter_t)); 1943 } 1944 mutex_exit(&connp->conn_lock); 1945 return (sizeof (icmp6_filter_t)); 1946 } 1947 } 1948 mutex_enter(&connp->conn_lock); 1949 retval = conn_opt_get(&coas, level, name, ptr); 1950 mutex_exit(&connp->conn_lock); 1951 return (retval); 1952 } 1953 1954 /* 1955 * This routine retrieves the current status of socket options. 1956 * It returns the size of the option retrieved, or -1. 1957 */ 1958 int 1959 icmp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 1960 { 1961 conn_t *connp = Q_TO_CONN(q); 1962 int err; 1963 1964 err = icmp_opt_get(connp, level, name, ptr); 1965 return (err); 1966 } 1967 1968 /* 1969 * This routine sets socket options. 1970 */ 1971 int 1972 icmp_do_opt_set(conn_opt_arg_t *coa, int level, int name, 1973 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly) 1974 { 1975 conn_t *connp = coa->coa_connp; 1976 ip_xmit_attr_t *ixa = coa->coa_ixa; 1977 icmp_t *icmp = connp->conn_icmp; 1978 icmp_stack_t *is = icmp->icmp_is; 1979 int *i1 = (int *)invalp; 1980 boolean_t onoff = (*i1 == 0) ? 0 : 1; 1981 int error; 1982 1983 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock)); 1984 1985 /* 1986 * For fixed length options, no sanity check 1987 * of passed in length is done. It is assumed *_optcom_req() 1988 * routines do the right thing. 1989 */ 1990 1991 switch (level) { 1992 case SOL_SOCKET: 1993 switch (name) { 1994 case SO_PROTOTYPE: 1995 if ((*i1 & 0xFF) != IPPROTO_ICMP && 1996 (*i1 & 0xFF) != IPPROTO_ICMPV6 && 1997 secpolicy_net_rawaccess(cr) != 0) { 1998 return (EACCES); 1999 } 2000 if (checkonly) 2001 break; 2002 2003 mutex_enter(&connp->conn_lock); 2004 connp->conn_proto = *i1 & 0xFF; 2005 ixa->ixa_protocol = connp->conn_proto; 2006 if ((connp->conn_proto == IPPROTO_RAW || 2007 connp->conn_proto == IPPROTO_IGMP) && 2008 connp->conn_family == AF_INET) { 2009 icmp->icmp_hdrincl = 1; 2010 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2011 } else if (connp->conn_proto == IPPROTO_UDP || 2012 connp->conn_proto == IPPROTO_TCP || 2013 connp->conn_proto == IPPROTO_SCTP) { 2014 /* Used by test applications like psh */ 2015 icmp->icmp_hdrincl = 0; 2016 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2017 } else { 2018 icmp->icmp_hdrincl = 0; 2019 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2020 } 2021 2022 if (connp->conn_family == AF_INET6 && 2023 connp->conn_proto == IPPROTO_ICMPV6) { 2024 /* Set offset for icmp6_cksum */ 2025 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 2026 ixa->ixa_raw_cksum_offset = 2; 2027 } 2028 if (icmp->icmp_filter != NULL && 2029 connp->conn_proto != IPPROTO_ICMPV6) { 2030 kmem_free(icmp->icmp_filter, 2031 sizeof (icmp6_filter_t)); 2032 icmp->icmp_filter = NULL; 2033 } 2034 mutex_exit(&connp->conn_lock); 2035 2036 coa->coa_changed |= COA_HEADER_CHANGED; 2037 /* 2038 * For SCTP, we don't use icmp_bind_proto() for 2039 * raw socket binding. 2040 */ 2041 if (connp->conn_proto == IPPROTO_SCTP) 2042 return (0); 2043 2044 coa->coa_changed |= COA_ICMP_BIND_NEEDED; 2045 return (0); 2046 2047 case SO_SNDBUF: 2048 if (*i1 > is->is_max_buf) { 2049 return (ENOBUFS); 2050 } 2051 break; 2052 case SO_RCVBUF: 2053 if (*i1 > is->is_max_buf) { 2054 return (ENOBUFS); 2055 } 2056 break; 2057 } 2058 break; 2059 2060 case IPPROTO_IP: 2061 /* 2062 * Only allow IPv4 option processing on IPv4 sockets. 2063 */ 2064 if (connp->conn_family != AF_INET) 2065 return (EINVAL); 2066 2067 switch (name) { 2068 case IP_HDRINCL: 2069 if (!checkonly) { 2070 mutex_enter(&connp->conn_lock); 2071 icmp->icmp_hdrincl = onoff; 2072 if (onoff) 2073 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2074 else 2075 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2076 mutex_exit(&connp->conn_lock); 2077 } 2078 break; 2079 } 2080 break; 2081 2082 case IPPROTO_IPV6: 2083 if (connp->conn_family != AF_INET6) 2084 return (EINVAL); 2085 2086 switch (name) { 2087 case IPV6_CHECKSUM: 2088 /* 2089 * Integer offset into the user data of where the 2090 * checksum is located. 2091 * Offset of -1 disables option. 2092 * Does not apply to IPPROTO_ICMPV6. 2093 */ 2094 if (connp->conn_proto == IPPROTO_ICMPV6 || 2095 coa->coa_ancillary) { 2096 return (EINVAL); 2097 } 2098 if ((*i1 != -1) && ((*i1 < 0) || (*i1 & 0x1) != 0)) { 2099 /* Negative or not 16 bit aligned offset */ 2100 return (EINVAL); 2101 } 2102 if (checkonly) 2103 break; 2104 2105 mutex_enter(&connp->conn_lock); 2106 if (*i1 == -1) { 2107 ixa->ixa_flags &= ~IXAF_SET_RAW_CKSUM; 2108 ixa->ixa_raw_cksum_offset = 0; 2109 ixa->ixa_flags &= ~IXAF_SET_ULP_CKSUM; 2110 } else { 2111 ixa->ixa_flags |= IXAF_SET_RAW_CKSUM; 2112 ixa->ixa_raw_cksum_offset = *i1; 2113 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM; 2114 } 2115 mutex_exit(&connp->conn_lock); 2116 break; 2117 } 2118 break; 2119 2120 case IPPROTO_ICMPV6: 2121 /* 2122 * Only allow IPv6 option processing on IPv6 sockets. 2123 */ 2124 if (connp->conn_family != AF_INET6) 2125 return (EINVAL); 2126 if (connp->conn_proto != IPPROTO_ICMPV6) 2127 return (EINVAL); 2128 2129 switch (name) { 2130 case ICMP6_FILTER: 2131 if (checkonly) 2132 break; 2133 2134 if ((inlen != 0) && 2135 (inlen != sizeof (icmp6_filter_t))) 2136 return (EINVAL); 2137 2138 mutex_enter(&connp->conn_lock); 2139 if (inlen == 0) { 2140 if (icmp->icmp_filter != NULL) { 2141 kmem_free(icmp->icmp_filter, 2142 sizeof (icmp6_filter_t)); 2143 icmp->icmp_filter = NULL; 2144 } 2145 } else { 2146 if (icmp->icmp_filter == NULL) { 2147 icmp->icmp_filter = kmem_alloc( 2148 sizeof (icmp6_filter_t), 2149 KM_NOSLEEP); 2150 if (icmp->icmp_filter == NULL) { 2151 mutex_exit(&connp->conn_lock); 2152 return (ENOBUFS); 2153 } 2154 } 2155 (void) bcopy(invalp, icmp->icmp_filter, inlen); 2156 } 2157 mutex_exit(&connp->conn_lock); 2158 break; 2159 } 2160 break; 2161 } 2162 error = conn_opt_set(coa, level, name, inlen, invalp, 2163 checkonly, cr); 2164 return (error); 2165 } 2166 2167 /* 2168 * This routine sets socket options. 2169 */ 2170 int 2171 icmp_opt_set(conn_t *connp, uint_t optset_context, int level, int name, 2172 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2173 void *thisdg_attrs, cred_t *cr) 2174 { 2175 icmp_t *icmp = connp->conn_icmp; 2176 int err; 2177 conn_opt_arg_t coas, *coa; 2178 boolean_t checkonly; 2179 icmp_stack_t *is = icmp->icmp_is; 2180 2181 switch (optset_context) { 2182 case SETFN_OPTCOM_CHECKONLY: 2183 checkonly = B_TRUE; 2184 /* 2185 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 2186 * inlen != 0 implies value supplied and 2187 * we have to "pretend" to set it. 2188 * inlen == 0 implies that there is no 2189 * value part in T_CHECK request and just validation 2190 * done elsewhere should be enough, we just return here. 2191 */ 2192 if (inlen == 0) { 2193 *outlenp = 0; 2194 return (0); 2195 } 2196 break; 2197 case SETFN_OPTCOM_NEGOTIATE: 2198 checkonly = B_FALSE; 2199 break; 2200 case SETFN_UD_NEGOTIATE: 2201 case SETFN_CONN_NEGOTIATE: 2202 checkonly = B_FALSE; 2203 /* 2204 * Negotiating local and "association-related" options 2205 * through T_UNITDATA_REQ. 2206 * 2207 * Following routine can filter out ones we do not 2208 * want to be "set" this way. 2209 */ 2210 if (!icmp_opt_allow_udr_set(level, name)) { 2211 *outlenp = 0; 2212 return (EINVAL); 2213 } 2214 break; 2215 default: 2216 /* 2217 * We should never get here 2218 */ 2219 *outlenp = 0; 2220 return (EINVAL); 2221 } 2222 2223 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 2224 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 2225 2226 if (thisdg_attrs != NULL) { 2227 /* Options from T_UNITDATA_REQ */ 2228 coa = (conn_opt_arg_t *)thisdg_attrs; 2229 ASSERT(coa->coa_connp == connp); 2230 ASSERT(coa->coa_ixa != NULL); 2231 ASSERT(coa->coa_ipp != NULL); 2232 ASSERT(coa->coa_ancillary); 2233 } else { 2234 coa = &coas; 2235 coas.coa_connp = connp; 2236 /* Get a reference on conn_ixa to prevent concurrent mods */ 2237 coas.coa_ixa = conn_get_ixa(connp, B_TRUE); 2238 if (coas.coa_ixa == NULL) { 2239 *outlenp = 0; 2240 return (ENOMEM); 2241 } 2242 coas.coa_ipp = &connp->conn_xmit_ipp; 2243 coas.coa_ancillary = B_FALSE; 2244 coas.coa_changed = 0; 2245 } 2246 2247 err = icmp_do_opt_set(coa, level, name, inlen, invalp, 2248 cr, checkonly); 2249 if (err != 0) { 2250 errout: 2251 if (!coa->coa_ancillary) 2252 ixa_refrele(coa->coa_ixa); 2253 *outlenp = 0; 2254 return (err); 2255 } 2256 2257 /* 2258 * Common case of OK return with outval same as inval. 2259 */ 2260 if (invalp != outvalp) { 2261 /* don't trust bcopy for identical src/dst */ 2262 (void) bcopy(invalp, outvalp, inlen); 2263 } 2264 *outlenp = inlen; 2265 2266 /* 2267 * If this was not ancillary data, then we rebuild the headers, 2268 * update the IRE/NCE, and IPsec as needed. 2269 * Since the label depends on the destination we go through 2270 * ip_set_destination first. 2271 */ 2272 if (coa->coa_ancillary) { 2273 return (0); 2274 } 2275 2276 if (coa->coa_changed & COA_ROUTE_CHANGED) { 2277 in6_addr_t saddr, faddr, nexthop; 2278 in_port_t fport; 2279 2280 /* 2281 * We clear lastdst to make sure we pick up the change 2282 * next time sending. 2283 * If we are connected we re-cache the information. 2284 * We ignore errors to preserve BSD behavior. 2285 * Note that we don't redo IPsec policy lookup here 2286 * since the final destination (or source) didn't change. 2287 */ 2288 mutex_enter(&connp->conn_lock); 2289 connp->conn_v6lastdst = ipv6_all_zeros; 2290 2291 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa, 2292 &connp->conn_faddr_v6, &nexthop); 2293 saddr = connp->conn_saddr_v6; 2294 faddr = connp->conn_faddr_v6; 2295 fport = connp->conn_fport; 2296 mutex_exit(&connp->conn_lock); 2297 2298 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) && 2299 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) { 2300 (void) ip_attr_connect(connp, coa->coa_ixa, 2301 &saddr, &faddr, &nexthop, fport, NULL, NULL, 2302 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 2303 } 2304 } 2305 2306 ixa_refrele(coa->coa_ixa); 2307 2308 if (coa->coa_changed & COA_HEADER_CHANGED) { 2309 /* 2310 * Rebuild the header template if we are connected. 2311 * Otherwise clear conn_v6lastdst so we rebuild the header 2312 * in the data path. 2313 */ 2314 mutex_enter(&connp->conn_lock); 2315 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) && 2316 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) { 2317 err = icmp_build_hdr_template(connp, 2318 &connp->conn_saddr_v6, &connp->conn_faddr_v6, 2319 connp->conn_flowinfo); 2320 if (err != 0) { 2321 mutex_exit(&connp->conn_lock); 2322 return (err); 2323 } 2324 } else { 2325 connp->conn_v6lastdst = ipv6_all_zeros; 2326 } 2327 mutex_exit(&connp->conn_lock); 2328 } 2329 if (coa->coa_changed & COA_RCVBUF_CHANGED) { 2330 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 2331 connp->conn_rcvbuf); 2332 } 2333 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) { 2334 connp->conn_wq->q_hiwat = connp->conn_sndbuf; 2335 } 2336 if (coa->coa_changed & COA_WROFF_CHANGED) { 2337 /* Increase wroff if needed */ 2338 uint_t wroff; 2339 2340 mutex_enter(&connp->conn_lock); 2341 wroff = connp->conn_ht_iphc_allocated + is->is_wroff_extra; 2342 if (wroff > connp->conn_wroff) { 2343 connp->conn_wroff = wroff; 2344 mutex_exit(&connp->conn_lock); 2345 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff); 2346 } else { 2347 mutex_exit(&connp->conn_lock); 2348 } 2349 } 2350 if (coa->coa_changed & COA_ICMP_BIND_NEEDED) { 2351 icmp_bind_proto(icmp); 2352 } 2353 return (err); 2354 } 2355 2356 /* This routine sets socket options. */ 2357 int 2358 icmp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name, 2359 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 2360 void *thisdg_attrs, cred_t *cr) 2361 { 2362 conn_t *connp = Q_TO_CONN(q); 2363 int error; 2364 2365 error = icmp_opt_set(connp, optset_context, level, name, inlen, invalp, 2366 outlenp, outvalp, thisdg_attrs, cr); 2367 return (error); 2368 } 2369 2370 /* 2371 * Setup IP headers. 2372 * 2373 * Note that IP_HDRINCL has ipha_protocol that is different than conn_proto, 2374 * but icmp_output_hdrincl restores ipha_protocol once we return. 2375 */ 2376 mblk_t * 2377 icmp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp, 2378 const in6_addr_t *v6src, const in6_addr_t *v6dst, uint32_t flowinfo, 2379 mblk_t *data_mp, int *errorp) 2380 { 2381 mblk_t *mp; 2382 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2383 uint_t data_len; 2384 uint32_t cksum; 2385 2386 data_len = msgdsize(data_mp); 2387 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, connp->conn_proto, 2388 flowinfo, 0, data_mp, data_len, is->is_wroff_extra, &cksum, errorp); 2389 if (mp == NULL) { 2390 ASSERT(*errorp != 0); 2391 return (NULL); 2392 } 2393 2394 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length; 2395 2396 /* 2397 * If there was a routing option/header then conn_prepend_hdr 2398 * has massaged it and placed the pseudo-header checksum difference 2399 * in the cksum argument. 2400 * 2401 * Prepare for ICMPv6 checksum done in IP. 2402 * 2403 * We make it easy for IP to include our pseudo header 2404 * by putting our length (and any routing header adjustment) 2405 * in the ICMPv6 checksum field. 2406 * The IP source, destination, and length have already been set by 2407 * conn_prepend_hdr. 2408 */ 2409 cksum += data_len; 2410 cksum = (cksum >> 16) + (cksum & 0xFFFF); 2411 ASSERT(cksum < 0x10000); 2412 2413 if (ixa->ixa_flags & IXAF_IS_IPV4) { 2414 ipha_t *ipha = (ipha_t *)mp->b_rptr; 2415 2416 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen); 2417 } else { 2418 ip6_t *ip6h = (ip6_t *)mp->b_rptr; 2419 uint_t cksum_offset = 0; 2420 2421 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen); 2422 2423 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 2424 if (connp->conn_proto == IPPROTO_ICMPV6) { 2425 cksum_offset = ixa->ixa_ip_hdr_length + 2426 offsetof(icmp6_t, icmp6_cksum); 2427 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2428 cksum_offset = ixa->ixa_ip_hdr_length + 2429 ixa->ixa_raw_cksum_offset; 2430 } 2431 } 2432 if (cksum_offset != 0) { 2433 uint16_t *ptr; 2434 2435 /* Make sure the checksum fits in the first mblk */ 2436 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 2437 mblk_t *mp1; 2438 2439 mp1 = msgpullup(mp, 2440 cksum_offset + sizeof (short)); 2441 freemsg(mp); 2442 if (mp1 == NULL) { 2443 *errorp = ENOMEM; 2444 return (NULL); 2445 } 2446 mp = mp1; 2447 ip6h = (ip6_t *)mp->b_rptr; 2448 } 2449 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 2450 *ptr = htons(cksum); 2451 } 2452 } 2453 2454 /* Note that we don't try to update wroff due to ancillary data */ 2455 return (mp); 2456 } 2457 2458 static int 2459 icmp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src, 2460 const in6_addr_t *v6dst, uint32_t flowinfo) 2461 { 2462 int error; 2463 2464 ASSERT(MUTEX_HELD(&connp->conn_lock)); 2465 /* 2466 * We clear lastdst to make sure we don't use the lastdst path 2467 * next time sending since we might not have set v6dst yet. 2468 */ 2469 connp->conn_v6lastdst = ipv6_all_zeros; 2470 2471 error = conn_build_hdr_template(connp, 0, 0, v6src, v6dst, flowinfo); 2472 if (error != 0) 2473 return (error); 2474 2475 /* 2476 * Any routing header/option has been massaged. The checksum difference 2477 * is stored in conn_sum. 2478 */ 2479 return (0); 2480 } 2481 2482 static mblk_t * 2483 icmp_queue_fallback(icmp_t *icmp, mblk_t *mp) 2484 { 2485 ASSERT(MUTEX_HELD(&icmp->icmp_recv_lock)); 2486 if (IPCL_IS_NONSTR(icmp->icmp_connp)) { 2487 /* 2488 * fallback has started but messages have not been moved yet 2489 */ 2490 if (icmp->icmp_fallback_queue_head == NULL) { 2491 ASSERT(icmp->icmp_fallback_queue_tail == NULL); 2492 icmp->icmp_fallback_queue_head = mp; 2493 icmp->icmp_fallback_queue_tail = mp; 2494 } else { 2495 ASSERT(icmp->icmp_fallback_queue_tail != NULL); 2496 icmp->icmp_fallback_queue_tail->b_next = mp; 2497 icmp->icmp_fallback_queue_tail = mp; 2498 } 2499 return (NULL); 2500 } else { 2501 /* 2502 * Fallback completed, let the caller putnext() the mblk. 2503 */ 2504 return (mp); 2505 } 2506 } 2507 2508 /* 2509 * Deliver data to ULP. In case we have a socket, and it's falling back to 2510 * TPI, then we'll queue the mp for later processing. 2511 */ 2512 static void 2513 icmp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len) 2514 { 2515 if (IPCL_IS_NONSTR(connp)) { 2516 icmp_t *icmp = connp->conn_icmp; 2517 int error; 2518 2519 ASSERT(len == msgdsize(mp)); 2520 if ((*connp->conn_upcalls->su_recv) 2521 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) { 2522 mutex_enter(&icmp->icmp_recv_lock); 2523 if (error == ENOSPC) { 2524 /* 2525 * let's confirm while holding the lock 2526 */ 2527 if ((*connp->conn_upcalls->su_recv) 2528 (connp->conn_upper_handle, NULL, 0, 0, 2529 &error, NULL) < 0) { 2530 ASSERT(error == ENOSPC); 2531 if (error == ENOSPC) { 2532 connp->conn_flow_cntrld = 2533 B_TRUE; 2534 } 2535 } 2536 mutex_exit(&icmp->icmp_recv_lock); 2537 } else { 2538 ASSERT(error == EOPNOTSUPP); 2539 mp = icmp_queue_fallback(icmp, mp); 2540 mutex_exit(&icmp->icmp_recv_lock); 2541 if (mp != NULL) 2542 putnext(connp->conn_rq, mp); 2543 } 2544 } 2545 ASSERT(MUTEX_NOT_HELD(&icmp->icmp_recv_lock)); 2546 } else { 2547 putnext(connp->conn_rq, mp); 2548 } 2549 } 2550 2551 /* 2552 * This is the inbound data path. 2553 * IP has already pulled up the IP headers and verified alignment 2554 * etc. 2555 */ 2556 /* ARGSUSED2 */ 2557 static void 2558 icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2559 { 2560 conn_t *connp = (conn_t *)arg1; 2561 struct T_unitdata_ind *tudi; 2562 uchar_t *rptr; /* Pointer to IP header */ 2563 int ip_hdr_length; 2564 int udi_size; /* Size of T_unitdata_ind */ 2565 int pkt_len; 2566 icmp_t *icmp; 2567 ip_pkt_t ipps; 2568 ip6_t *ip6h; 2569 mblk_t *mp1; 2570 crb_t recv_ancillary; 2571 icmp_stack_t *is; 2572 sin_t *sin; 2573 sin6_t *sin6; 2574 ipha_t *ipha; 2575 2576 ASSERT(connp->conn_flags & IPCL_RAWIPCONN); 2577 2578 icmp = connp->conn_icmp; 2579 is = icmp->icmp_is; 2580 rptr = mp->b_rptr; 2581 2582 ASSERT(DB_TYPE(mp) == M_DATA); 2583 ASSERT(OK_32PTR(rptr)); 2584 ASSERT(ira->ira_pktlen == msgdsize(mp)); 2585 pkt_len = ira->ira_pktlen; 2586 2587 /* 2588 * Get a snapshot of these and allow other threads to change 2589 * them after that. We need the same recv_ancillary when determining 2590 * the size as when adding the ancillary data items. 2591 */ 2592 mutex_enter(&connp->conn_lock); 2593 recv_ancillary = connp->conn_recv_ancillary; 2594 mutex_exit(&connp->conn_lock); 2595 2596 ip_hdr_length = ira->ira_ip_hdr_length; 2597 ASSERT(MBLKL(mp) >= ip_hdr_length); /* IP did a pullup */ 2598 2599 /* Initialize regardless of IP version */ 2600 ipps.ipp_fields = 0; 2601 2602 if (ira->ira_flags & IRAF_IS_IPV4) { 2603 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION); 2604 ASSERT(MBLKL(mp) >= sizeof (ipha_t)); 2605 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr)); 2606 2607 ipha = (ipha_t *)mp->b_rptr; 2608 if (recv_ancillary.crb_all != 0) 2609 (void) ip_find_hdr_v4(ipha, &ipps, B_FALSE); 2610 2611 /* 2612 * BSD for some reason adjusts ipha_length to exclude the 2613 * IP header length. We do the same. 2614 */ 2615 if (is->is_bsd_compat) { 2616 ushort_t len; 2617 2618 len = ntohs(ipha->ipha_length); 2619 if (mp->b_datap->db_ref > 1) { 2620 /* 2621 * Allocate a new IP header so that we can 2622 * modify ipha_length. 2623 */ 2624 mblk_t *mp1; 2625 2626 mp1 = allocb(ip_hdr_length, BPRI_MED); 2627 if (mp1 == NULL) { 2628 freemsg(mp); 2629 BUMP_MIB(&is->is_rawip_mib, 2630 rawipInErrors); 2631 return; 2632 } 2633 bcopy(rptr, mp1->b_rptr, ip_hdr_length); 2634 mp->b_rptr = rptr + ip_hdr_length; 2635 rptr = mp1->b_rptr; 2636 ipha = (ipha_t *)rptr; 2637 mp1->b_cont = mp; 2638 mp1->b_wptr = rptr + ip_hdr_length; 2639 mp = mp1; 2640 } 2641 len -= ip_hdr_length; 2642 ipha->ipha_length = htons(len); 2643 } 2644 2645 /* 2646 * For RAW sockets we not pass ICMP/IPv4 packets to AF_INET6 2647 * sockets. This is ensured by icmp_bind and the IP fanout code. 2648 */ 2649 ASSERT(connp->conn_family == AF_INET); 2650 2651 /* 2652 * This is the inbound data path. Packets are passed upstream 2653 * as T_UNITDATA_IND messages with full IPv4 headers still 2654 * attached. 2655 */ 2656 2657 /* 2658 * Normally only send up the source address. 2659 * If any ancillary data items are wanted we add those. 2660 */ 2661 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t); 2662 if (recv_ancillary.crb_all != 0) { 2663 udi_size += conn_recvancillary_size(connp, 2664 recv_ancillary, ira, mp, &ipps); 2665 } 2666 2667 /* Allocate a message block for the T_UNITDATA_IND structure. */ 2668 mp1 = allocb(udi_size, BPRI_MED); 2669 if (mp1 == NULL) { 2670 freemsg(mp); 2671 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2672 return; 2673 } 2674 mp1->b_cont = mp; 2675 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2676 mp1->b_datap->db_type = M_PROTO; 2677 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2678 tudi->PRIM_type = T_UNITDATA_IND; 2679 tudi->SRC_length = sizeof (sin_t); 2680 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2681 sin = (sin_t *)&tudi[1]; 2682 *sin = sin_null; 2683 sin->sin_family = AF_INET; 2684 sin->sin_addr.s_addr = ipha->ipha_src; 2685 *(uint32_t *)&sin->sin_zero[0] = 0; 2686 *(uint32_t *)&sin->sin_zero[4] = 0; 2687 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + 2688 sizeof (sin_t); 2689 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t)); 2690 tudi->OPT_length = udi_size; 2691 2692 /* 2693 * Add options if IP_RECVIF etc is set 2694 */ 2695 if (udi_size != 0) { 2696 conn_recvancillary_add(connp, recv_ancillary, ira, 2697 &ipps, (uchar_t *)&sin[1], udi_size); 2698 } 2699 goto deliver; 2700 } 2701 2702 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION); 2703 /* 2704 * IPv6 packets can only be received by applications 2705 * that are prepared to receive IPv6 addresses. 2706 * The IP fanout must ensure this. 2707 */ 2708 ASSERT(connp->conn_family == AF_INET6); 2709 2710 /* 2711 * Handle IPv6 packets. We don't pass up the IP headers with the 2712 * payload for IPv6. 2713 */ 2714 2715 ip6h = (ip6_t *)rptr; 2716 if (recv_ancillary.crb_all != 0) { 2717 /* 2718 * Call on ip_find_hdr_v6 which gets individual lenghts of 2719 * extension headers (and pointers to them). 2720 */ 2721 uint8_t nexthdr; 2722 2723 /* We don't care about the length or nextheader. */ 2724 (void) ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps, &nexthdr); 2725 2726 /* 2727 * We do not pass up hop-by-hop options or any other 2728 * extension header as part of the packet. Applications 2729 * that want to see them have to specify IPV6_RECV* socket 2730 * options. And conn_recvancillary_size/add explicitly 2731 * drops the TX option from IPV6_HOPOPTS as it does for UDP. 2732 * 2733 * If we had multilevel ICMP sockets, then we'd want to 2734 * modify conn_recvancillary_size/add to 2735 * allow the user to see the label. 2736 */ 2737 } 2738 2739 /* 2740 * Check a filter for ICMPv6 types if needed. 2741 * Verify raw checksums if needed. 2742 */ 2743 mutex_enter(&connp->conn_lock); 2744 if (icmp->icmp_filter != NULL) { 2745 int type; 2746 2747 /* Assumes that IP has done the pullupmsg */ 2748 type = mp->b_rptr[ip_hdr_length]; 2749 2750 ASSERT(mp->b_rptr + ip_hdr_length <= mp->b_wptr); 2751 if (ICMP6_FILTER_WILLBLOCK(type, icmp->icmp_filter)) { 2752 mutex_exit(&connp->conn_lock); 2753 freemsg(mp); 2754 return; 2755 } 2756 } 2757 if (connp->conn_ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 2758 /* Checksum */ 2759 uint16_t *up; 2760 uint32_t sum; 2761 int remlen; 2762 2763 up = (uint16_t *)&ip6h->ip6_src; 2764 2765 remlen = msgdsize(mp) - ip_hdr_length; 2766 sum = htons(connp->conn_proto + remlen) 2767 + up[0] + up[1] + up[2] + up[3] 2768 + up[4] + up[5] + up[6] + up[7] 2769 + up[8] + up[9] + up[10] + up[11] 2770 + up[12] + up[13] + up[14] + up[15]; 2771 sum = (sum & 0xffff) + (sum >> 16); 2772 sum = IP_CSUM(mp, ip_hdr_length, sum); 2773 if (sum != 0) { 2774 /* IPv6 RAW checksum failed */ 2775 ip0dbg(("icmp_rput: RAW checksum failed %x\n", sum)); 2776 mutex_exit(&connp->conn_lock); 2777 freemsg(mp); 2778 BUMP_MIB(&is->is_rawip_mib, rawipInCksumErrs); 2779 return; 2780 } 2781 } 2782 mutex_exit(&connp->conn_lock); 2783 2784 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2785 2786 if (recv_ancillary.crb_all != 0) { 2787 udi_size += conn_recvancillary_size(connp, 2788 recv_ancillary, ira, mp, &ipps); 2789 } 2790 2791 mp1 = allocb(udi_size, BPRI_MED); 2792 if (mp1 == NULL) { 2793 freemsg(mp); 2794 BUMP_MIB(&is->is_rawip_mib, rawipInErrors); 2795 return; 2796 } 2797 mp1->b_cont = mp; 2798 mp1->b_datap->db_type = M_PROTO; 2799 tudi = (struct T_unitdata_ind *)mp1->b_rptr; 2800 mp1->b_wptr = (uchar_t *)tudi + udi_size; 2801 tudi->PRIM_type = T_UNITDATA_IND; 2802 tudi->SRC_length = sizeof (sin6_t); 2803 tudi->SRC_offset = sizeof (struct T_unitdata_ind); 2804 tudi->OPT_offset = sizeof (struct T_unitdata_ind) + sizeof (sin6_t); 2805 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t)); 2806 tudi->OPT_length = udi_size; 2807 sin6 = (sin6_t *)&tudi[1]; 2808 *sin6 = sin6_null; 2809 sin6->sin6_port = 0; 2810 sin6->sin6_family = AF_INET6; 2811 2812 sin6->sin6_addr = ip6h->ip6_src; 2813 /* No sin6_flowinfo per API */ 2814 sin6->sin6_flowinfo = 0; 2815 /* For link-scope pass up scope id */ 2816 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) 2817 sin6->sin6_scope_id = ira->ira_ruifindex; 2818 else 2819 sin6->sin6_scope_id = 0; 2820 sin6->__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 2821 IPCL_ZONEID(connp), is->is_netstack); 2822 2823 if (udi_size != 0) { 2824 conn_recvancillary_add(connp, recv_ancillary, ira, 2825 &ipps, (uchar_t *)&sin6[1], udi_size); 2826 } 2827 2828 /* Skip all the IPv6 headers per API */ 2829 mp->b_rptr += ip_hdr_length; 2830 pkt_len -= ip_hdr_length; 2831 2832 deliver: 2833 BUMP_MIB(&is->is_rawip_mib, rawipInDatagrams); 2834 icmp_ulp_recv(connp, mp1, pkt_len); 2835 } 2836 2837 /* 2838 * return SNMP stuff in buffer in mpdata. We don't hold any lock and report 2839 * information that can be changing beneath us. 2840 */ 2841 mblk_t * 2842 icmp_snmp_get(queue_t *q, mblk_t *mpctl) 2843 { 2844 mblk_t *mpdata; 2845 struct opthdr *optp; 2846 conn_t *connp = Q_TO_CONN(q); 2847 icmp_stack_t *is = connp->conn_netstack->netstack_icmp; 2848 mblk_t *mp2ctl; 2849 2850 /* 2851 * make a copy of the original message 2852 */ 2853 mp2ctl = copymsg(mpctl); 2854 2855 if (mpctl == NULL || 2856 (mpdata = mpctl->b_cont) == NULL) { 2857 freemsg(mpctl); 2858 freemsg(mp2ctl); 2859 return (0); 2860 } 2861 2862 /* fixed length structure for IPv4 and IPv6 counters */ 2863 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 2864 optp->level = EXPER_RAWIP; 2865 optp->name = 0; 2866 (void) snmp_append_data(mpdata, (char *)&is->is_rawip_mib, 2867 sizeof (is->is_rawip_mib)); 2868 optp->len = msgdsize(mpdata); 2869 qreply(q, mpctl); 2870 2871 return (mp2ctl); 2872 } 2873 2874 /* 2875 * Return 0 if invalid set request, 1 otherwise, including non-rawip requests. 2876 * TODO: If this ever actually tries to set anything, it needs to be 2877 * to do the appropriate locking. 2878 */ 2879 /* ARGSUSED */ 2880 int 2881 icmp_snmp_set(queue_t *q, t_scalar_t level, t_scalar_t name, 2882 uchar_t *ptr, int len) 2883 { 2884 switch (level) { 2885 case EXPER_RAWIP: 2886 return (0); 2887 default: 2888 return (1); 2889 } 2890 } 2891 2892 /* 2893 * This routine creates a T_UDERROR_IND message and passes it upstream. 2894 * The address and options are copied from the T_UNITDATA_REQ message 2895 * passed in mp. This message is freed. 2896 */ 2897 static void 2898 icmp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err) 2899 { 2900 struct T_unitdata_req *tudr; 2901 mblk_t *mp1; 2902 uchar_t *destaddr; 2903 t_scalar_t destlen; 2904 uchar_t *optaddr; 2905 t_scalar_t optlen; 2906 2907 if ((mp->b_wptr < mp->b_rptr) || 2908 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) { 2909 goto done; 2910 } 2911 tudr = (struct T_unitdata_req *)mp->b_rptr; 2912 destaddr = mp->b_rptr + tudr->DEST_offset; 2913 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr || 2914 destaddr + tudr->DEST_length < mp->b_rptr || 2915 destaddr + tudr->DEST_length > mp->b_wptr) { 2916 goto done; 2917 } 2918 optaddr = mp->b_rptr + tudr->OPT_offset; 2919 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr || 2920 optaddr + tudr->OPT_length < mp->b_rptr || 2921 optaddr + tudr->OPT_length > mp->b_wptr) { 2922 goto done; 2923 } 2924 destlen = tudr->DEST_length; 2925 optlen = tudr->OPT_length; 2926 2927 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen, 2928 (char *)optaddr, optlen, err); 2929 if (mp1 != NULL) 2930 qreply(q, mp1); 2931 2932 done: 2933 freemsg(mp); 2934 } 2935 2936 static int 2937 rawip_do_unbind(conn_t *connp) 2938 { 2939 icmp_t *icmp = connp->conn_icmp; 2940 2941 mutex_enter(&connp->conn_lock); 2942 /* If a bind has not been done, we can't unbind. */ 2943 if (icmp->icmp_state == TS_UNBND) { 2944 mutex_exit(&connp->conn_lock); 2945 return (-TOUTSTATE); 2946 } 2947 connp->conn_saddr_v6 = ipv6_all_zeros; 2948 connp->conn_bound_addr_v6 = ipv6_all_zeros; 2949 connp->conn_laddr_v6 = ipv6_all_zeros; 2950 connp->conn_mcbc_bind = B_FALSE; 2951 connp->conn_lport = 0; 2952 connp->conn_fport = 0; 2953 /* In case we were also connected */ 2954 connp->conn_faddr_v6 = ipv6_all_zeros; 2955 connp->conn_v6lastdst = ipv6_all_zeros; 2956 2957 icmp->icmp_state = TS_UNBND; 2958 2959 (void) icmp_build_hdr_template(connp, &connp->conn_saddr_v6, 2960 &connp->conn_faddr_v6, connp->conn_flowinfo); 2961 mutex_exit(&connp->conn_lock); 2962 2963 ip_unbind(connp); 2964 return (0); 2965 } 2966 2967 /* 2968 * This routine is called by icmp_wput to handle T_UNBIND_REQ messages. 2969 * After some error checking, the message is passed downstream to ip. 2970 */ 2971 static void 2972 icmp_tpi_unbind(queue_t *q, mblk_t *mp) 2973 { 2974 conn_t *connp = Q_TO_CONN(q); 2975 int error; 2976 2977 ASSERT(mp->b_cont == NULL); 2978 error = rawip_do_unbind(connp); 2979 if (error) { 2980 if (error < 0) { 2981 icmp_err_ack(q, mp, -error, 0); 2982 } else { 2983 icmp_err_ack(q, mp, 0, error); 2984 } 2985 return; 2986 } 2987 2988 /* 2989 * Convert mp into a T_OK_ACK 2990 */ 2991 2992 mp = mi_tpi_ok_ack_alloc(mp); 2993 2994 /* 2995 * should not happen in practice... T_OK_ACK is smaller than the 2996 * original message. 2997 */ 2998 ASSERT(mp != NULL); 2999 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK); 3000 qreply(q, mp); 3001 } 3002 3003 /* 3004 * Process IPv4 packets that already include an IP header. 3005 * Used when IP_HDRINCL has been set (implicit for IPPROTO_RAW and 3006 * IPPROTO_IGMP). 3007 * In this case we ignore the address and any options in the T_UNITDATA_REQ. 3008 * 3009 * The packet is assumed to have a base (20 byte) IP header followed 3010 * by the upper-layer protocol. We include any IP_OPTIONS including a 3011 * CIPSO label but otherwise preserve the base IP header. 3012 */ 3013 static int 3014 icmp_output_hdrincl(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3015 { 3016 icmp_t *icmp = connp->conn_icmp; 3017 icmp_stack_t *is = icmp->icmp_is; 3018 ipha_t iphas; 3019 ipha_t *ipha; 3020 int ip_hdr_length; 3021 int tp_hdr_len; 3022 ip_xmit_attr_t *ixa; 3023 ip_pkt_t *ipp; 3024 in6_addr_t v6src; 3025 in6_addr_t v6dst; 3026 in6_addr_t v6nexthop; 3027 int error; 3028 boolean_t do_ipsec; 3029 3030 /* 3031 * We need an exclusive copy of conn_ixa since the included IP 3032 * header could have any destination. 3033 * That copy has no pointers hence we 3034 * need to set them up once we've parsed the ancillary data. 3035 */ 3036 ixa = conn_get_ixa_exclusive(connp); 3037 if (ixa == NULL) { 3038 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3039 freemsg(mp); 3040 return (ENOMEM); 3041 } 3042 ASSERT(cr != NULL); 3043 /* 3044 * Caller has a reference on cr; from db_credp or because we 3045 * are running in process context. 3046 */ 3047 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3048 ixa->ixa_cred = cr; 3049 ixa->ixa_cpid = pid; 3050 if (is_system_labeled()) { 3051 /* We need to restart with a label based on the cred */ 3052 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3053 } 3054 3055 /* In case previous destination was multicast or multirt */ 3056 ip_attr_newdst(ixa); 3057 3058 /* Get a copy of conn_xmit_ipp since the TX label might change it */ 3059 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3060 if (ipp == NULL) { 3061 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3062 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3063 ixa->ixa_cpid = connp->conn_cpid; 3064 ixa_refrele(ixa); 3065 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3066 freemsg(mp); 3067 return (ENOMEM); 3068 } 3069 mutex_enter(&connp->conn_lock); 3070 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3071 mutex_exit(&connp->conn_lock); 3072 if (error != 0) { 3073 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3074 freemsg(mp); 3075 goto done; 3076 } 3077 3078 /* Sanity check length of packet */ 3079 ipha = (ipha_t *)mp->b_rptr; 3080 3081 ip_hdr_length = IP_SIMPLE_HDR_LENGTH; 3082 if ((mp->b_wptr - mp->b_rptr) < IP_SIMPLE_HDR_LENGTH) { 3083 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 3084 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3085 freemsg(mp); 3086 goto done; 3087 } 3088 ipha = (ipha_t *)mp->b_rptr; 3089 } 3090 ipha->ipha_version_and_hdr_length = 3091 (IP_VERSION<<4) | (ip_hdr_length>>2); 3092 3093 /* 3094 * We set IXAF_DONTFRAG if the application set DF which makes 3095 * IP not fragment. 3096 */ 3097 ipha->ipha_fragment_offset_and_flags &= htons(IPH_DF); 3098 if (ipha->ipha_fragment_offset_and_flags & htons(IPH_DF)) 3099 ixa->ixa_flags |= (IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3100 else 3101 ixa->ixa_flags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 3102 3103 /* Even for multicast and broadcast we honor the apps ttl */ 3104 ixa->ixa_flags |= IXAF_NO_TTL_CHANGE; 3105 3106 /* 3107 * No source verification for non-local addresses 3108 */ 3109 if (ipha->ipha_src != INADDR_ANY && 3110 ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid, 3111 is->is_netstack->netstack_ip, B_FALSE) 3112 != IPVL_UNICAST_UP) { 3113 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3114 } 3115 3116 if (ipha->ipha_dst == INADDR_ANY) 3117 ipha->ipha_dst = htonl(INADDR_LOOPBACK); 3118 3119 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src); 3120 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 3121 3122 /* Defer IPsec if it might need to look at ICMP type/code */ 3123 do_ipsec = ipha->ipha_protocol != IPPROTO_ICMP; 3124 ixa->ixa_flags |= IXAF_IS_IPV4; 3125 3126 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3127 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, 3128 connp->conn_fport, &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3129 (do_ipsec ? IPDF_IPSEC : 0)); 3130 switch (error) { 3131 case 0: 3132 break; 3133 case EADDRNOTAVAIL: 3134 /* 3135 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3136 * Don't have the application see that errno 3137 */ 3138 error = ENETUNREACH; 3139 goto failed; 3140 case ENETDOWN: 3141 /* 3142 * Have !ipif_addr_ready address; drop packet silently 3143 * until we can get applications to not send until we 3144 * are ready. 3145 */ 3146 error = 0; 3147 goto failed; 3148 case EHOSTUNREACH: 3149 case ENETUNREACH: 3150 if (ixa->ixa_ire != NULL) { 3151 /* 3152 * Let conn_ip_output/ire_send_noroute return 3153 * the error and send any local ICMP error. 3154 */ 3155 error = 0; 3156 break; 3157 } 3158 /* FALLTHRU */ 3159 default: 3160 failed: 3161 freemsg(mp); 3162 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3163 goto done; 3164 } 3165 if (ipha->ipha_src == INADDR_ANY) 3166 IN6_V4MAPPED_TO_IPADDR(&v6src, ipha->ipha_src); 3167 3168 /* 3169 * We might be going to a different destination than last time, 3170 * thus check that TX allows the communication and compute any 3171 * needed label. 3172 * 3173 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3174 * don't have to worry about concurrent threads. 3175 */ 3176 if (is_system_labeled()) { 3177 /* 3178 * Check whether Trusted Solaris policy allows communication 3179 * with this host, and pretend that the destination is 3180 * unreachable if not. 3181 * Compute any needed label and place it in ipp_label_v4/v6. 3182 * 3183 * Later conn_build_hdr_template/conn_prepend_hdr takes 3184 * ipp_label_v4/v6 to form the packet. 3185 * 3186 * Tsol note: We have ipp structure local to this thread so 3187 * no locking is needed. 3188 */ 3189 error = conn_update_label(connp, ixa, &v6dst, ipp); 3190 if (error != 0) { 3191 freemsg(mp); 3192 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3193 goto done; 3194 } 3195 } 3196 3197 /* 3198 * Save away a copy of the IPv4 header the application passed down 3199 * and then prepend an IPv4 header complete with any IP options 3200 * including label. 3201 * We need a struct copy since icmp_prepend_hdr will reuse the available 3202 * space in the mblk. 3203 */ 3204 iphas = *ipha; 3205 mp->b_rptr += IP_SIMPLE_HDR_LENGTH; 3206 3207 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, 0, mp, &error); 3208 if (mp == NULL) { 3209 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3210 ASSERT(error != 0); 3211 goto done; 3212 } 3213 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3214 error = EMSGSIZE; 3215 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3216 freemsg(mp); 3217 goto done; 3218 } 3219 /* Restore key parts of the header that the application passed down */ 3220 ipha = (ipha_t *)mp->b_rptr; 3221 ipha->ipha_type_of_service = iphas.ipha_type_of_service; 3222 ipha->ipha_ident = iphas.ipha_ident; 3223 ipha->ipha_fragment_offset_and_flags = 3224 iphas.ipha_fragment_offset_and_flags; 3225 ipha->ipha_ttl = iphas.ipha_ttl; 3226 ipha->ipha_protocol = iphas.ipha_protocol; 3227 ipha->ipha_src = iphas.ipha_src; 3228 ipha->ipha_dst = iphas.ipha_dst; 3229 3230 ixa->ixa_protocol = ipha->ipha_protocol; 3231 3232 /* 3233 * Make sure that the IP header plus any transport header that is 3234 * checksumed by ip_output is in the first mblk. (ip_output assumes 3235 * that at least the checksum field is in the first mblk.) 3236 */ 3237 switch (ipha->ipha_protocol) { 3238 case IPPROTO_UDP: 3239 tp_hdr_len = 8; 3240 break; 3241 case IPPROTO_TCP: 3242 tp_hdr_len = 20; 3243 break; 3244 default: 3245 tp_hdr_len = 0; 3246 break; 3247 } 3248 ip_hdr_length = IPH_HDR_LENGTH(ipha); 3249 if (mp->b_wptr - mp->b_rptr < ip_hdr_length + tp_hdr_len) { 3250 if (!pullupmsg(mp, ip_hdr_length + tp_hdr_len)) { 3251 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3252 if (mp->b_cont == NULL) 3253 error = EINVAL; 3254 else 3255 error = ENOMEM; 3256 freemsg(mp); 3257 goto done; 3258 } 3259 } 3260 3261 if (!do_ipsec) { 3262 /* Policy might differ for different ICMP type/code */ 3263 if (ixa->ixa_ipsec_policy != NULL) { 3264 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3265 ixa->ixa_ipsec_policy = NULL; 3266 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3267 } 3268 mp = ip_output_attach_policy(mp, ipha, NULL, connp, ixa); 3269 if (mp == NULL) { 3270 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3271 error = EHOSTUNREACH; /* IPsec policy failure */ 3272 goto done; 3273 } 3274 } 3275 3276 /* We're done. Pass the packet to ip. */ 3277 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3278 3279 error = conn_ip_output(mp, ixa); 3280 /* No rawipOutErrors if an error since IP increases its error counter */ 3281 switch (error) { 3282 case 0: 3283 break; 3284 case EWOULDBLOCK: 3285 (void) ixa_check_drain_insert(connp, ixa); 3286 error = 0; 3287 break; 3288 case EADDRNOTAVAIL: 3289 /* 3290 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3291 * Don't have the application see that errno 3292 */ 3293 error = ENETUNREACH; 3294 break; 3295 } 3296 done: 3297 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3298 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3299 ixa->ixa_cpid = connp->conn_cpid; 3300 ixa_refrele(ixa); 3301 ip_pkt_free(ipp); 3302 kmem_free(ipp, sizeof (*ipp)); 3303 return (error); 3304 } 3305 3306 static mblk_t * 3307 icmp_output_attach_policy(mblk_t *mp, conn_t *connp, ip_xmit_attr_t *ixa) 3308 { 3309 ipha_t *ipha = NULL; 3310 ip6_t *ip6h = NULL; 3311 3312 if (ixa->ixa_flags & IXAF_IS_IPV4) 3313 ipha = (ipha_t *)mp->b_rptr; 3314 else 3315 ip6h = (ip6_t *)mp->b_rptr; 3316 3317 if (ixa->ixa_ipsec_policy != NULL) { 3318 IPPOL_REFRELE(ixa->ixa_ipsec_policy); 3319 ixa->ixa_ipsec_policy = NULL; 3320 ixa->ixa_flags &= ~IXAF_IPSEC_SECURE; 3321 } 3322 return (ip_output_attach_policy(mp, ipha, ip6h, connp, ixa)); 3323 } 3324 3325 /* 3326 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6 3327 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from 3328 * the TPI options, otherwise we take them from msg_control. 3329 * If both sin and sin6 is set it is a connected socket and we use conn_faddr. 3330 * Always consumes mp; never consumes tudr_mp. 3331 */ 3332 static int 3333 icmp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp, 3334 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid) 3335 { 3336 icmp_t *icmp = connp->conn_icmp; 3337 icmp_stack_t *is = icmp->icmp_is; 3338 int error; 3339 ip_xmit_attr_t *ixa; 3340 ip_pkt_t *ipp; 3341 in6_addr_t v6src; 3342 in6_addr_t v6dst; 3343 in6_addr_t v6nexthop; 3344 in_port_t dstport; 3345 uint32_t flowinfo; 3346 int is_absreq_failure = 0; 3347 conn_opt_arg_t coas, *coa; 3348 3349 ASSERT(tudr_mp != NULL || msg != NULL); 3350 3351 /* 3352 * Get ixa before checking state to handle a disconnect race. 3353 * 3354 * We need an exclusive copy of conn_ixa since the ancillary data 3355 * options might modify it. That copy has no pointers hence we 3356 * need to set them up once we've parsed the ancillary data. 3357 */ 3358 ixa = conn_get_ixa_exclusive(connp); 3359 if (ixa == NULL) { 3360 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3361 freemsg(mp); 3362 return (ENOMEM); 3363 } 3364 ASSERT(cr != NULL); 3365 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3366 ixa->ixa_cred = cr; 3367 ixa->ixa_cpid = pid; 3368 if (is_system_labeled()) { 3369 /* We need to restart with a label based on the cred */ 3370 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 3371 } 3372 3373 /* In case previous destination was multicast or multirt */ 3374 ip_attr_newdst(ixa); 3375 3376 /* Get a copy of conn_xmit_ipp since the options might change it */ 3377 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP); 3378 if (ipp == NULL) { 3379 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3380 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3381 ixa->ixa_cpid = connp->conn_cpid; 3382 ixa_refrele(ixa); 3383 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3384 freemsg(mp); 3385 return (ENOMEM); 3386 } 3387 mutex_enter(&connp->conn_lock); 3388 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP); 3389 mutex_exit(&connp->conn_lock); 3390 if (error != 0) { 3391 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3392 freemsg(mp); 3393 goto done; 3394 } 3395 3396 /* 3397 * Parse the options and update ixa and ipp as a result. 3398 */ 3399 3400 coa = &coas; 3401 coa->coa_connp = connp; 3402 coa->coa_ixa = ixa; 3403 coa->coa_ipp = ipp; 3404 coa->coa_ancillary = B_TRUE; 3405 coa->coa_changed = 0; 3406 3407 if (msg != NULL) { 3408 error = process_auxiliary_options(connp, msg->msg_control, 3409 msg->msg_controllen, coa, &icmp_opt_obj, icmp_opt_set, cr); 3410 } else { 3411 struct T_unitdata_req *tudr; 3412 3413 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr; 3414 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ); 3415 error = tpi_optcom_buf(connp->conn_wq, tudr_mp, 3416 &tudr->OPT_length, tudr->OPT_offset, cr, &icmp_opt_obj, 3417 coa, &is_absreq_failure); 3418 } 3419 if (error != 0) { 3420 /* 3421 * Note: No special action needed in this 3422 * module for "is_absreq_failure" 3423 */ 3424 freemsg(mp); 3425 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3426 goto done; 3427 } 3428 ASSERT(is_absreq_failure == 0); 3429 3430 mutex_enter(&connp->conn_lock); 3431 /* 3432 * If laddr is unspecified then we look at sin6_src_id. 3433 * We will give precedence to a source address set with IPV6_PKTINFO 3434 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 3435 * want ip_attr_connect to select a source (since it can fail) when 3436 * IPV6_PKTINFO is specified. 3437 * If this doesn't result in a source address then we get a source 3438 * from ip_attr_connect() below. 3439 */ 3440 v6src = connp->conn_saddr_v6; 3441 if (sin != NULL) { 3442 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 3443 dstport = sin->sin_port; 3444 flowinfo = 0; 3445 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3446 ixa->ixa_flags |= IXAF_IS_IPV4; 3447 } else if (sin6 != NULL) { 3448 boolean_t v4mapped; 3449 uint_t srcid; 3450 3451 v6dst = sin6->sin6_addr; 3452 dstport = sin6->sin6_port; 3453 flowinfo = sin6->sin6_flowinfo; 3454 srcid = sin6->__sin6_src_id; 3455 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 3456 ixa->ixa_scopeid = sin6->sin6_scope_id; 3457 ixa->ixa_flags |= IXAF_SCOPEID_SET; 3458 } else { 3459 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 3460 } 3461 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst); 3462 if (v4mapped) 3463 ixa->ixa_flags |= IXAF_IS_IPV4; 3464 else 3465 ixa->ixa_flags &= ~IXAF_IS_IPV4; 3466 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 3467 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 3468 v4mapped, connp->conn_netstack)) { 3469 /* Mismatched v4mapped/v6 specified by srcid. */ 3470 mutex_exit(&connp->conn_lock); 3471 error = EADDRNOTAVAIL; 3472 goto failed; /* Does freemsg() and mib. */ 3473 } 3474 } 3475 } else { 3476 /* Connected case */ 3477 v6dst = connp->conn_faddr_v6; 3478 flowinfo = connp->conn_flowinfo; 3479 } 3480 mutex_exit(&connp->conn_lock); 3481 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */ 3482 if (ipp->ipp_fields & IPPF_ADDR) { 3483 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3484 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3485 v6src = ipp->ipp_addr; 3486 } else { 3487 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 3488 v6src = ipp->ipp_addr; 3489 } 3490 } 3491 /* 3492 * Allow source not assigned to the system 3493 * only if it is not a local addresses 3494 */ 3495 if (!V6_OR_V4_INADDR_ANY(v6src)) { 3496 ip_laddr_t laddr_type; 3497 3498 if (ixa->ixa_flags & IXAF_IS_IPV4) { 3499 ipaddr_t v4src; 3500 3501 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src); 3502 laddr_type = ip_laddr_verify_v4(v4src, ixa->ixa_zoneid, 3503 is->is_netstack->netstack_ip, B_FALSE); 3504 } else { 3505 laddr_type = ip_laddr_verify_v6(&v6src, ixa->ixa_zoneid, 3506 is->is_netstack->netstack_ip, B_FALSE, B_FALSE); 3507 } 3508 if (laddr_type != IPVL_UNICAST_UP) 3509 ixa->ixa_flags &= ~IXAF_VERIFY_SOURCE; 3510 } 3511 3512 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop); 3513 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 3514 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST); 3515 3516 switch (error) { 3517 case 0: 3518 break; 3519 case EADDRNOTAVAIL: 3520 /* 3521 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3522 * Don't have the application see that errno 3523 */ 3524 error = ENETUNREACH; 3525 goto failed; 3526 case ENETDOWN: 3527 /* 3528 * Have !ipif_addr_ready address; drop packet silently 3529 * until we can get applications to not send until we 3530 * are ready. 3531 */ 3532 error = 0; 3533 goto failed; 3534 case EHOSTUNREACH: 3535 case ENETUNREACH: 3536 if (ixa->ixa_ire != NULL) { 3537 /* 3538 * Let conn_ip_output/ire_send_noroute return 3539 * the error and send any local ICMP error. 3540 */ 3541 error = 0; 3542 break; 3543 } 3544 /* FALLTHRU */ 3545 default: 3546 failed: 3547 freemsg(mp); 3548 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3549 goto done; 3550 } 3551 3552 /* 3553 * We might be going to a different destination than last time, 3554 * thus check that TX allows the communication and compute any 3555 * needed label. 3556 * 3557 * TSOL Note: We have an exclusive ipp and ixa for this thread so we 3558 * don't have to worry about concurrent threads. 3559 */ 3560 if (is_system_labeled()) { 3561 /* 3562 * Check whether Trusted Solaris policy allows communication 3563 * with this host, and pretend that the destination is 3564 * unreachable if not. 3565 * Compute any needed label and place it in ipp_label_v4/v6. 3566 * 3567 * Later conn_build_hdr_template/conn_prepend_hdr takes 3568 * ipp_label_v4/v6 to form the packet. 3569 * 3570 * Tsol note: We have ipp structure local to this thread so 3571 * no locking is needed. 3572 */ 3573 error = conn_update_label(connp, ixa, &v6dst, ipp); 3574 if (error != 0) { 3575 freemsg(mp); 3576 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3577 goto done; 3578 } 3579 } 3580 mp = icmp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, flowinfo, mp, 3581 &error); 3582 if (mp == NULL) { 3583 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3584 ASSERT(error != 0); 3585 goto done; 3586 } 3587 if (ixa->ixa_pktlen > IP_MAXPACKET) { 3588 error = EMSGSIZE; 3589 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3590 freemsg(mp); 3591 goto done; 3592 } 3593 3594 /* Policy might differ for different ICMP type/code */ 3595 mp = icmp_output_attach_policy(mp, connp, ixa); 3596 if (mp == NULL) { 3597 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3598 error = EHOSTUNREACH; /* IPsec policy failure */ 3599 goto done; 3600 } 3601 3602 /* We're done. Pass the packet to ip. */ 3603 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3604 3605 error = conn_ip_output(mp, ixa); 3606 if (!connp->conn_unspec_src) 3607 ixa->ixa_flags |= IXAF_VERIFY_SOURCE; 3608 /* No rawipOutErrors if an error since IP increases its error counter */ 3609 switch (error) { 3610 case 0: 3611 break; 3612 case EWOULDBLOCK: 3613 (void) ixa_check_drain_insert(connp, ixa); 3614 error = 0; 3615 break; 3616 case EADDRNOTAVAIL: 3617 /* 3618 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3619 * Don't have the application see that errno 3620 */ 3621 error = ENETUNREACH; 3622 /* FALLTHRU */ 3623 default: 3624 mutex_enter(&connp->conn_lock); 3625 /* 3626 * Clear the source and v6lastdst so we call ip_attr_connect 3627 * for the next packet and try to pick a better source. 3628 */ 3629 if (connp->conn_mcbc_bind) 3630 connp->conn_saddr_v6 = ipv6_all_zeros; 3631 else 3632 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3633 connp->conn_v6lastdst = ipv6_all_zeros; 3634 mutex_exit(&connp->conn_lock); 3635 break; 3636 } 3637 done: 3638 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3639 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3640 ixa->ixa_cpid = connp->conn_cpid; 3641 ixa_refrele(ixa); 3642 ip_pkt_free(ipp); 3643 kmem_free(ipp, sizeof (*ipp)); 3644 return (error); 3645 } 3646 3647 /* 3648 * Handle sending an M_DATA for a connected socket. 3649 * Handles both IPv4 and IPv6. 3650 */ 3651 int 3652 icmp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid) 3653 { 3654 icmp_t *icmp = connp->conn_icmp; 3655 icmp_stack_t *is = icmp->icmp_is; 3656 int error; 3657 ip_xmit_attr_t *ixa; 3658 boolean_t do_ipsec; 3659 3660 /* 3661 * If no other thread is using conn_ixa this just gets a reference to 3662 * conn_ixa. Otherwise we get a safe copy of conn_ixa. 3663 */ 3664 ixa = conn_get_ixa(connp, B_FALSE); 3665 if (ixa == NULL) { 3666 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3667 freemsg(mp); 3668 return (ENOMEM); 3669 } 3670 3671 ASSERT(cr != NULL); 3672 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3673 ixa->ixa_cred = cr; 3674 ixa->ixa_cpid = pid; 3675 3676 /* Defer IPsec if it might need to look at ICMP type/code */ 3677 switch (ixa->ixa_protocol) { 3678 case IPPROTO_ICMP: 3679 case IPPROTO_ICMPV6: 3680 do_ipsec = B_FALSE; 3681 break; 3682 default: 3683 do_ipsec = B_TRUE; 3684 } 3685 3686 mutex_enter(&connp->conn_lock); 3687 mp = icmp_prepend_header_template(connp, ixa, mp, 3688 &connp->conn_saddr_v6, connp->conn_flowinfo, &error); 3689 3690 if (mp == NULL) { 3691 ASSERT(error != 0); 3692 mutex_exit(&connp->conn_lock); 3693 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3694 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3695 ixa->ixa_cpid = connp->conn_cpid; 3696 ixa_refrele(ixa); 3697 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3698 freemsg(mp); 3699 return (error); 3700 } 3701 3702 if (!do_ipsec) { 3703 /* Policy might differ for different ICMP type/code */ 3704 mp = icmp_output_attach_policy(mp, connp, ixa); 3705 if (mp == NULL) { 3706 mutex_exit(&connp->conn_lock); 3707 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3708 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3709 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3710 ixa->ixa_cpid = connp->conn_cpid; 3711 ixa_refrele(ixa); 3712 return (EHOSTUNREACH); /* IPsec policy failure */ 3713 } 3714 } 3715 3716 /* 3717 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3718 * safe copy, then we need to fill in any pointers in it. 3719 */ 3720 if (ixa->ixa_ire == NULL) { 3721 in6_addr_t faddr, saddr; 3722 in6_addr_t nexthop; 3723 in_port_t fport; 3724 3725 saddr = connp->conn_saddr_v6; 3726 faddr = connp->conn_faddr_v6; 3727 fport = connp->conn_fport; 3728 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop); 3729 mutex_exit(&connp->conn_lock); 3730 3731 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop, 3732 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 3733 (do_ipsec ? IPDF_IPSEC : 0)); 3734 switch (error) { 3735 case 0: 3736 break; 3737 case EADDRNOTAVAIL: 3738 /* 3739 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3740 * Don't have the application see that errno 3741 */ 3742 error = ENETUNREACH; 3743 goto failed; 3744 case ENETDOWN: 3745 /* 3746 * Have !ipif_addr_ready address; drop packet silently 3747 * until we can get applications to not send until we 3748 * are ready. 3749 */ 3750 error = 0; 3751 goto failed; 3752 case EHOSTUNREACH: 3753 case ENETUNREACH: 3754 if (ixa->ixa_ire != NULL) { 3755 /* 3756 * Let conn_ip_output/ire_send_noroute return 3757 * the error and send any local ICMP error. 3758 */ 3759 error = 0; 3760 break; 3761 } 3762 /* FALLTHRU */ 3763 default: 3764 failed: 3765 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3766 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3767 ixa->ixa_cpid = connp->conn_cpid; 3768 ixa_refrele(ixa); 3769 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3770 freemsg(mp); 3771 return (error); 3772 } 3773 } else { 3774 /* Done with conn_t */ 3775 mutex_exit(&connp->conn_lock); 3776 } 3777 3778 /* We're done. Pass the packet to ip. */ 3779 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3780 3781 error = conn_ip_output(mp, ixa); 3782 /* No rawipOutErrors if an error since IP increases its error counter */ 3783 switch (error) { 3784 case 0: 3785 break; 3786 case EWOULDBLOCK: 3787 (void) ixa_check_drain_insert(connp, ixa); 3788 error = 0; 3789 break; 3790 case EADDRNOTAVAIL: 3791 /* 3792 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3793 * Don't have the application see that errno 3794 */ 3795 error = ENETUNREACH; 3796 break; 3797 } 3798 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3799 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3800 ixa->ixa_cpid = connp->conn_cpid; 3801 ixa_refrele(ixa); 3802 return (error); 3803 } 3804 3805 /* 3806 * Handle sending an M_DATA to the last destination. 3807 * Handles both IPv4 and IPv6. 3808 * 3809 * NOTE: The caller must hold conn_lock and we drop it here. 3810 */ 3811 int 3812 icmp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid, 3813 ip_xmit_attr_t *ixa) 3814 { 3815 icmp_t *icmp = connp->conn_icmp; 3816 icmp_stack_t *is = icmp->icmp_is; 3817 int error; 3818 boolean_t do_ipsec; 3819 3820 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3821 ASSERT(ixa != NULL); 3822 3823 ASSERT(cr != NULL); 3824 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3825 ixa->ixa_cred = cr; 3826 ixa->ixa_cpid = pid; 3827 3828 /* Defer IPsec if it might need to look at ICMP type/code */ 3829 switch (ixa->ixa_protocol) { 3830 case IPPROTO_ICMP: 3831 case IPPROTO_ICMPV6: 3832 do_ipsec = B_FALSE; 3833 break; 3834 default: 3835 do_ipsec = B_TRUE; 3836 } 3837 3838 3839 mp = icmp_prepend_header_template(connp, ixa, mp, 3840 &connp->conn_v6lastsrc, connp->conn_lastflowinfo, &error); 3841 3842 if (mp == NULL) { 3843 ASSERT(error != 0); 3844 mutex_exit(&connp->conn_lock); 3845 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3846 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3847 ixa->ixa_cpid = connp->conn_cpid; 3848 ixa_refrele(ixa); 3849 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3850 freemsg(mp); 3851 return (error); 3852 } 3853 3854 if (!do_ipsec) { 3855 /* Policy might differ for different ICMP type/code */ 3856 mp = icmp_output_attach_policy(mp, connp, ixa); 3857 if (mp == NULL) { 3858 mutex_exit(&connp->conn_lock); 3859 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3860 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3861 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3862 ixa->ixa_cpid = connp->conn_cpid; 3863 ixa_refrele(ixa); 3864 return (EHOSTUNREACH); /* IPsec policy failure */ 3865 } 3866 } 3867 3868 /* 3869 * In case we got a safe copy of conn_ixa, or if opt_set made us a new 3870 * safe copy, then we need to fill in any pointers in it. 3871 */ 3872 if (ixa->ixa_ire == NULL) { 3873 in6_addr_t lastdst, lastsrc; 3874 in6_addr_t nexthop; 3875 in_port_t lastport; 3876 3877 lastsrc = connp->conn_v6lastsrc; 3878 lastdst = connp->conn_v6lastdst; 3879 lastport = connp->conn_lastdstport; 3880 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop); 3881 mutex_exit(&connp->conn_lock); 3882 3883 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst, 3884 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC | 3885 IPDF_VERIFY_DST | (do_ipsec ? IPDF_IPSEC : 0)); 3886 switch (error) { 3887 case 0: 3888 break; 3889 case EADDRNOTAVAIL: 3890 /* 3891 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3892 * Don't have the application see that errno 3893 */ 3894 error = ENETUNREACH; 3895 goto failed; 3896 case ENETDOWN: 3897 /* 3898 * Have !ipif_addr_ready address; drop packet silently 3899 * until we can get applications to not send until we 3900 * are ready. 3901 */ 3902 error = 0; 3903 goto failed; 3904 case EHOSTUNREACH: 3905 case ENETUNREACH: 3906 if (ixa->ixa_ire != NULL) { 3907 /* 3908 * Let conn_ip_output/ire_send_noroute return 3909 * the error and send any local ICMP error. 3910 */ 3911 error = 0; 3912 break; 3913 } 3914 /* FALLTHRU */ 3915 default: 3916 failed: 3917 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3918 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3919 ixa->ixa_cpid = connp->conn_cpid; 3920 ixa_refrele(ixa); 3921 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 3922 freemsg(mp); 3923 return (error); 3924 } 3925 } else { 3926 /* Done with conn_t */ 3927 mutex_exit(&connp->conn_lock); 3928 } 3929 3930 /* We're done. Pass the packet to ip. */ 3931 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 3932 error = conn_ip_output(mp, ixa); 3933 /* No rawipOutErrors if an error since IP increases its error counter */ 3934 switch (error) { 3935 case 0: 3936 break; 3937 case EWOULDBLOCK: 3938 (void) ixa_check_drain_insert(connp, ixa); 3939 error = 0; 3940 break; 3941 case EADDRNOTAVAIL: 3942 /* 3943 * IXAF_VERIFY_SOURCE tells us to pick a better source. 3944 * Don't have the application see that errno 3945 */ 3946 error = ENETUNREACH; 3947 /* FALLTHRU */ 3948 default: 3949 mutex_enter(&connp->conn_lock); 3950 /* 3951 * Clear the source and v6lastdst so we call ip_attr_connect 3952 * for the next packet and try to pick a better source. 3953 */ 3954 if (connp->conn_mcbc_bind) 3955 connp->conn_saddr_v6 = ipv6_all_zeros; 3956 else 3957 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 3958 connp->conn_v6lastdst = ipv6_all_zeros; 3959 mutex_exit(&connp->conn_lock); 3960 break; 3961 } 3962 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 3963 ixa->ixa_cred = connp->conn_cred; /* Restore */ 3964 ixa->ixa_cpid = connp->conn_cpid; 3965 ixa_refrele(ixa); 3966 return (error); 3967 } 3968 3969 3970 /* 3971 * Prepend the header template and then fill in the source and 3972 * flowinfo. The caller needs to handle the destination address since 3973 * it's setting is different if rthdr or source route. 3974 * 3975 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET. 3976 * When it returns NULL it sets errorp. 3977 */ 3978 static mblk_t * 3979 icmp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp, 3980 const in6_addr_t *v6src, uint32_t flowinfo, int *errorp) 3981 { 3982 icmp_t *icmp = connp->conn_icmp; 3983 icmp_stack_t *is = icmp->icmp_is; 3984 uint_t pktlen; 3985 uint_t copylen; 3986 uint8_t *iph; 3987 uint_t ip_hdr_length; 3988 uint32_t cksum; 3989 ip_pkt_t *ipp; 3990 3991 ASSERT(MUTEX_HELD(&connp->conn_lock)); 3992 3993 /* 3994 * Copy the header template. 3995 */ 3996 copylen = connp->conn_ht_iphc_len; 3997 pktlen = copylen + msgdsize(mp); 3998 if (pktlen > IP_MAXPACKET) { 3999 freemsg(mp); 4000 *errorp = EMSGSIZE; 4001 return (NULL); 4002 } 4003 ixa->ixa_pktlen = pktlen; 4004 4005 /* check/fix buffer config, setup pointers into it */ 4006 iph = mp->b_rptr - copylen; 4007 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) { 4008 mblk_t *mp1; 4009 4010 mp1 = allocb(copylen + is->is_wroff_extra, BPRI_MED); 4011 if (mp1 == NULL) { 4012 freemsg(mp); 4013 *errorp = ENOMEM; 4014 return (NULL); 4015 } 4016 mp1->b_wptr = DB_LIM(mp1); 4017 mp1->b_cont = mp; 4018 mp = mp1; 4019 iph = (mp->b_wptr - copylen); 4020 } 4021 mp->b_rptr = iph; 4022 bcopy(connp->conn_ht_iphc, iph, copylen); 4023 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc); 4024 4025 ixa->ixa_ip_hdr_length = ip_hdr_length; 4026 4027 /* 4028 * Prepare for ICMPv6 checksum done in IP. 4029 * 4030 * icmp_build_hdr_template has already massaged any routing header 4031 * and placed the result in conn_sum. 4032 * 4033 * We make it easy for IP to include our pseudo header 4034 * by putting our length (and any routing header adjustment) 4035 * in the ICMPv6 checksum field. 4036 */ 4037 cksum = pktlen - ip_hdr_length; 4038 4039 cksum += connp->conn_sum; 4040 cksum = (cksum >> 16) + (cksum & 0xFFFF); 4041 ASSERT(cksum < 0x10000); 4042 4043 ipp = &connp->conn_xmit_ipp; 4044 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4045 ipha_t *ipha = (ipha_t *)iph; 4046 4047 ipha->ipha_length = htons((uint16_t)pktlen); 4048 4049 /* if IP_PKTINFO specified an addres it wins over bind() */ 4050 if ((ipp->ipp_fields & IPPF_ADDR) && 4051 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4052 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY); 4053 ipha->ipha_src = ipp->ipp_addr_v4; 4054 } else { 4055 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src); 4056 } 4057 } else { 4058 ip6_t *ip6h = (ip6_t *)iph; 4059 uint_t cksum_offset = 0; 4060 4061 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN)); 4062 4063 /* if IP_PKTINFO specified an addres it wins over bind() */ 4064 if ((ipp->ipp_fields & IPPF_ADDR) && 4065 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) { 4066 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)); 4067 ip6h->ip6_src = ipp->ipp_addr; 4068 } else { 4069 ip6h->ip6_src = *v6src; 4070 } 4071 ip6h->ip6_vcf = 4072 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 4073 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 4074 if (ipp->ipp_fields & IPPF_TCLASS) { 4075 /* Overrides the class part of flowinfo */ 4076 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf, 4077 ipp->ipp_tclass); 4078 } 4079 4080 if (ixa->ixa_flags & IXAF_SET_ULP_CKSUM) { 4081 if (connp->conn_proto == IPPROTO_ICMPV6) { 4082 cksum_offset = ixa->ixa_ip_hdr_length + 4083 offsetof(icmp6_t, icmp6_cksum); 4084 } else if (ixa->ixa_flags & IXAF_SET_RAW_CKSUM) { 4085 cksum_offset = ixa->ixa_ip_hdr_length + 4086 ixa->ixa_raw_cksum_offset; 4087 } 4088 } 4089 if (cksum_offset != 0) { 4090 uint16_t *ptr; 4091 4092 /* Make sure the checksum fits in the first mblk */ 4093 if (cksum_offset + sizeof (short) > MBLKL(mp)) { 4094 mblk_t *mp1; 4095 4096 mp1 = msgpullup(mp, 4097 cksum_offset + sizeof (short)); 4098 freemsg(mp); 4099 if (mp1 == NULL) { 4100 *errorp = ENOMEM; 4101 return (NULL); 4102 } 4103 mp = mp1; 4104 iph = mp->b_rptr; 4105 ip6h = (ip6_t *)iph; 4106 } 4107 ptr = (uint16_t *)(mp->b_rptr + cksum_offset); 4108 *ptr = htons(cksum); 4109 } 4110 } 4111 4112 return (mp); 4113 } 4114 4115 /* 4116 * This routine handles all messages passed downstream. It either 4117 * consumes the message or passes it downstream; it never queues a 4118 * a message. 4119 */ 4120 int 4121 icmp_wput(queue_t *q, mblk_t *mp) 4122 { 4123 sin6_t *sin6; 4124 sin_t *sin = NULL; 4125 uint_t srcid; 4126 conn_t *connp = Q_TO_CONN(q); 4127 icmp_t *icmp = connp->conn_icmp; 4128 int error = 0; 4129 struct sockaddr *addr = NULL; 4130 socklen_t addrlen; 4131 icmp_stack_t *is = icmp->icmp_is; 4132 struct T_unitdata_req *tudr; 4133 mblk_t *data_mp; 4134 cred_t *cr; 4135 pid_t pid; 4136 4137 /* 4138 * We directly handle several cases here: T_UNITDATA_REQ message 4139 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected 4140 * socket. 4141 */ 4142 switch (DB_TYPE(mp)) { 4143 case M_DATA: 4144 /* sockfs never sends down M_DATA */ 4145 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4146 freemsg(mp); 4147 return (0); 4148 4149 case M_PROTO: 4150 case M_PCPROTO: 4151 tudr = (struct T_unitdata_req *)mp->b_rptr; 4152 if (MBLKL(mp) < sizeof (*tudr) || 4153 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) { 4154 icmp_wput_other(q, mp); 4155 return (0); 4156 } 4157 break; 4158 4159 default: 4160 icmp_wput_other(q, mp); 4161 return (0); 4162 } 4163 4164 /* Handle valid T_UNITDATA_REQ here */ 4165 data_mp = mp->b_cont; 4166 if (data_mp == NULL) { 4167 error = EPROTO; 4168 goto ud_error2; 4169 } 4170 mp->b_cont = NULL; 4171 4172 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) { 4173 error = EADDRNOTAVAIL; 4174 goto ud_error2; 4175 } 4176 4177 /* 4178 * All Solaris components should pass a db_credp 4179 * for this message, hence we ASSERT. 4180 * On production kernels we return an error to be robust against 4181 * random streams modules sitting on top of us. 4182 */ 4183 cr = msg_getcred(mp, &pid); 4184 ASSERT(cr != NULL); 4185 if (cr == NULL) { 4186 error = EINVAL; 4187 goto ud_error2; 4188 } 4189 4190 /* 4191 * If a port has not been bound to the stream, fail. 4192 * This is not a problem when sockfs is directly 4193 * above us, because it will ensure that the socket 4194 * is first bound before allowing data to be sent. 4195 */ 4196 if (icmp->icmp_state == TS_UNBND) { 4197 error = EPROTO; 4198 goto ud_error2; 4199 } 4200 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset]; 4201 addrlen = tudr->DEST_length; 4202 4203 switch (connp->conn_family) { 4204 case AF_INET6: 4205 sin6 = (sin6_t *)addr; 4206 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) || 4207 (sin6->sin6_family != AF_INET6)) { 4208 error = EADDRNOTAVAIL; 4209 goto ud_error2; 4210 } 4211 4212 /* No support for mapped addresses on raw sockets */ 4213 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4214 error = EADDRNOTAVAIL; 4215 goto ud_error2; 4216 } 4217 srcid = sin6->__sin6_src_id; 4218 4219 /* 4220 * If the local address is a mapped address return 4221 * an error. 4222 * It would be possible to send an IPv6 packet but the 4223 * response would never make it back to the application 4224 * since it is bound to a mapped address. 4225 */ 4226 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 4227 error = EADDRNOTAVAIL; 4228 goto ud_error2; 4229 } 4230 4231 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 4232 sin6->sin6_addr = ipv6_loopback; 4233 4234 if (tudr->OPT_length != 0) { 4235 /* 4236 * If we are connected then the destination needs to be 4237 * the same as the connected one. 4238 */ 4239 if (icmp->icmp_state == TS_DATA_XFER && 4240 !conn_same_as_last_v6(connp, sin6)) { 4241 error = EISCONN; 4242 goto ud_error2; 4243 } 4244 error = icmp_output_ancillary(connp, NULL, sin6, 4245 data_mp, mp, NULL, cr, pid); 4246 } else { 4247 ip_xmit_attr_t *ixa; 4248 4249 /* 4250 * We have to allocate an ip_xmit_attr_t before we grab 4251 * conn_lock and we need to hold conn_lock once we've 4252 * checked conn_same_as_last_v6 to handle concurrent 4253 * send* calls on a socket. 4254 */ 4255 ixa = conn_get_ixa(connp, B_FALSE); 4256 if (ixa == NULL) { 4257 error = ENOMEM; 4258 goto ud_error2; 4259 } 4260 mutex_enter(&connp->conn_lock); 4261 4262 if (conn_same_as_last_v6(connp, sin6) && 4263 connp->conn_lastsrcid == srcid && 4264 ipsec_outbound_policy_current(ixa)) { 4265 /* icmp_output_lastdst drops conn_lock */ 4266 error = icmp_output_lastdst(connp, data_mp, cr, 4267 pid, ixa); 4268 } else { 4269 /* icmp_output_newdst drops conn_lock */ 4270 error = icmp_output_newdst(connp, data_mp, NULL, 4271 sin6, cr, pid, ixa); 4272 } 4273 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4274 } 4275 if (error == 0) { 4276 freeb(mp); 4277 return (0); 4278 } 4279 break; 4280 4281 case AF_INET: 4282 sin = (sin_t *)addr; 4283 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) || 4284 (sin->sin_family != AF_INET)) { 4285 error = EADDRNOTAVAIL; 4286 goto ud_error2; 4287 } 4288 if (sin->sin_addr.s_addr == INADDR_ANY) 4289 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 4290 4291 /* Protocol 255 contains full IP headers */ 4292 /* Read without holding lock */ 4293 if (icmp->icmp_hdrincl) { 4294 if (MBLKL(data_mp) < IP_SIMPLE_HDR_LENGTH) { 4295 if (!pullupmsg(data_mp, IP_SIMPLE_HDR_LENGTH)) { 4296 error = EINVAL; 4297 goto ud_error2; 4298 } 4299 } 4300 error = icmp_output_hdrincl(connp, data_mp, cr, pid); 4301 if (error == 0) { 4302 freeb(mp); 4303 return (0); 4304 } 4305 /* data_mp consumed above */ 4306 data_mp = NULL; 4307 goto ud_error2; 4308 } 4309 4310 if (tudr->OPT_length != 0) { 4311 /* 4312 * If we are connected then the destination needs to be 4313 * the same as the connected one. 4314 */ 4315 if (icmp->icmp_state == TS_DATA_XFER && 4316 !conn_same_as_last_v4(connp, sin)) { 4317 error = EISCONN; 4318 goto ud_error2; 4319 } 4320 error = icmp_output_ancillary(connp, sin, NULL, 4321 data_mp, mp, NULL, cr, pid); 4322 } else { 4323 ip_xmit_attr_t *ixa; 4324 4325 /* 4326 * We have to allocate an ip_xmit_attr_t before we grab 4327 * conn_lock and we need to hold conn_lock once we've 4328 * checked conn_same_as_last_v4 to handle concurrent 4329 * send* calls on a socket. 4330 */ 4331 ixa = conn_get_ixa(connp, B_FALSE); 4332 if (ixa == NULL) { 4333 error = ENOMEM; 4334 goto ud_error2; 4335 } 4336 mutex_enter(&connp->conn_lock); 4337 4338 if (conn_same_as_last_v4(connp, sin) && 4339 ipsec_outbound_policy_current(ixa)) { 4340 /* icmp_output_lastdst drops conn_lock */ 4341 error = icmp_output_lastdst(connp, data_mp, cr, 4342 pid, ixa); 4343 } else { 4344 /* icmp_output_newdst drops conn_lock */ 4345 error = icmp_output_newdst(connp, data_mp, sin, 4346 NULL, cr, pid, ixa); 4347 } 4348 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 4349 } 4350 if (error == 0) { 4351 freeb(mp); 4352 return (0); 4353 } 4354 break; 4355 } 4356 ASSERT(mp != NULL); 4357 /* mp is freed by the following routine */ 4358 icmp_ud_err(q, mp, (t_scalar_t)error); 4359 return (0); 4360 4361 ud_error2: 4362 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4363 freemsg(data_mp); 4364 ASSERT(mp != NULL); 4365 /* mp is freed by the following routine */ 4366 icmp_ud_err(q, mp, (t_scalar_t)error); 4367 return (0); 4368 } 4369 4370 /* 4371 * Handle the case of the IP address or flow label being different 4372 * for both IPv4 and IPv6. 4373 * 4374 * NOTE: The caller must hold conn_lock and we drop it here. 4375 */ 4376 static int 4377 icmp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6, 4378 cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa) 4379 { 4380 icmp_t *icmp = connp->conn_icmp; 4381 icmp_stack_t *is = icmp->icmp_is; 4382 int error; 4383 ip_xmit_attr_t *oldixa; 4384 boolean_t do_ipsec; 4385 uint_t srcid; 4386 uint32_t flowinfo; 4387 in6_addr_t v6src; 4388 in6_addr_t v6dst; 4389 in6_addr_t v6nexthop; 4390 in_port_t dstport; 4391 4392 ASSERT(MUTEX_HELD(&connp->conn_lock)); 4393 ASSERT(ixa != NULL); 4394 4395 /* 4396 * We hold conn_lock across all the use and modifications of 4397 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they 4398 * stay consistent. 4399 */ 4400 4401 ASSERT(cr != NULL); 4402 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4403 ixa->ixa_cred = cr; 4404 ixa->ixa_cpid = pid; 4405 if (is_system_labeled()) { 4406 /* We need to restart with a label based on the cred */ 4407 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4408 } 4409 /* 4410 * If we are connected then the destination needs to be the 4411 * same as the connected one, which is not the case here since we 4412 * checked for that above. 4413 */ 4414 if (icmp->icmp_state == TS_DATA_XFER) { 4415 mutex_exit(&connp->conn_lock); 4416 error = EISCONN; 4417 goto ud_error; 4418 } 4419 4420 /* In case previous destination was multicast or multirt */ 4421 ip_attr_newdst(ixa); 4422 4423 /* 4424 * If laddr is unspecified then we look at sin6_src_id. 4425 * We will give precedence to a source address set with IPV6_PKTINFO 4426 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't 4427 * want ip_attr_connect to select a source (since it can fail) when 4428 * IPV6_PKTINFO is specified. 4429 * If this doesn't result in a source address then we get a source 4430 * from ip_attr_connect() below. 4431 */ 4432 v6src = connp->conn_saddr_v6; 4433 if (sin != NULL) { 4434 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst); 4435 dstport = sin->sin_port; 4436 flowinfo = 0; 4437 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */ 4438 srcid = 0; 4439 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4440 ixa->ixa_flags |= IXAF_IS_IPV4; 4441 } else { 4442 boolean_t v4mapped; 4443 4444 v6dst = sin6->sin6_addr; 4445 dstport = sin6->sin6_port; 4446 flowinfo = sin6->sin6_flowinfo; 4447 srcid = sin6->__sin6_src_id; 4448 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) { 4449 ixa->ixa_scopeid = sin6->sin6_scope_id; 4450 ixa->ixa_flags |= IXAF_SCOPEID_SET; 4451 } else { 4452 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 4453 } 4454 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst); 4455 if (v4mapped) 4456 ixa->ixa_flags |= IXAF_IS_IPV4; 4457 else 4458 ixa->ixa_flags &= ~IXAF_IS_IPV4; 4459 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) { 4460 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp), 4461 v4mapped, connp->conn_netstack)) { 4462 /* Mismatched v4mapped/v6 specified by srcid. */ 4463 mutex_exit(&connp->conn_lock); 4464 error = EADDRNOTAVAIL; 4465 goto ud_error; 4466 } 4467 } 4468 } 4469 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */ 4470 if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) { 4471 ip_pkt_t *ipp = &connp->conn_xmit_ipp; 4472 4473 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4474 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4475 v6src = ipp->ipp_addr; 4476 } else { 4477 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) 4478 v6src = ipp->ipp_addr; 4479 } 4480 } 4481 4482 /* Defer IPsec if it might need to look at ICMP type/code */ 4483 switch (ixa->ixa_protocol) { 4484 case IPPROTO_ICMP: 4485 case IPPROTO_ICMPV6: 4486 do_ipsec = B_FALSE; 4487 break; 4488 default: 4489 do_ipsec = B_TRUE; 4490 } 4491 4492 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop); 4493 mutex_exit(&connp->conn_lock); 4494 4495 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport, 4496 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | 4497 (do_ipsec ? IPDF_IPSEC : 0)); 4498 switch (error) { 4499 case 0: 4500 break; 4501 case EADDRNOTAVAIL: 4502 /* 4503 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4504 * Don't have the application see that errno 4505 */ 4506 error = ENETUNREACH; 4507 goto failed; 4508 case ENETDOWN: 4509 /* 4510 * Have !ipif_addr_ready address; drop packet silently 4511 * until we can get applications to not send until we 4512 * are ready. 4513 */ 4514 error = 0; 4515 goto failed; 4516 case EHOSTUNREACH: 4517 case ENETUNREACH: 4518 if (ixa->ixa_ire != NULL) { 4519 /* 4520 * Let conn_ip_output/ire_send_noroute return 4521 * the error and send any local ICMP error. 4522 */ 4523 error = 0; 4524 break; 4525 } 4526 /* FALLTHRU */ 4527 default: 4528 failed: 4529 goto ud_error; 4530 } 4531 4532 mutex_enter(&connp->conn_lock); 4533 /* 4534 * While we dropped the lock some other thread might have connected 4535 * this socket. If so we bail out with EISCONN to ensure that the 4536 * connecting thread is the one that updates conn_ixa, conn_ht_* 4537 * and conn_*last*. 4538 */ 4539 if (icmp->icmp_state == TS_DATA_XFER) { 4540 mutex_exit(&connp->conn_lock); 4541 error = EISCONN; 4542 goto ud_error; 4543 } 4544 4545 /* 4546 * We need to rebuild the headers if 4547 * - we are labeling packets (could be different for different 4548 * destinations) 4549 * - we have a source route (or routing header) since we need to 4550 * massage that to get the pseudo-header checksum 4551 * - a socket option with COA_HEADER_CHANGED has been set which 4552 * set conn_v6lastdst to zero. 4553 * 4554 * Otherwise the prepend function will just update the src, dst, 4555 * and flow label. 4556 */ 4557 if (is_system_labeled()) { 4558 /* TX MLP requires SCM_UCRED and don't have that here */ 4559 if (connp->conn_mlp_type != mlptSingle) { 4560 mutex_exit(&connp->conn_lock); 4561 error = ECONNREFUSED; 4562 goto ud_error; 4563 } 4564 /* 4565 * Check whether Trusted Solaris policy allows communication 4566 * with this host, and pretend that the destination is 4567 * unreachable if not. 4568 * Compute any needed label and place it in ipp_label_v4/v6. 4569 * 4570 * Later conn_build_hdr_template/conn_prepend_hdr takes 4571 * ipp_label_v4/v6 to form the packet. 4572 * 4573 * Tsol note: Since we hold conn_lock we know no other 4574 * thread manipulates conn_xmit_ipp. 4575 */ 4576 error = conn_update_label(connp, ixa, &v6dst, 4577 &connp->conn_xmit_ipp); 4578 if (error != 0) { 4579 mutex_exit(&connp->conn_lock); 4580 goto ud_error; 4581 } 4582 /* Rebuild the header template */ 4583 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4584 flowinfo); 4585 if (error != 0) { 4586 mutex_exit(&connp->conn_lock); 4587 goto ud_error; 4588 } 4589 } else if (connp->conn_xmit_ipp.ipp_fields & 4590 (IPPF_IPV4_OPTIONS|IPPF_RTHDR) || 4591 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) { 4592 /* Rebuild the header template */ 4593 error = icmp_build_hdr_template(connp, &v6src, &v6dst, 4594 flowinfo); 4595 if (error != 0) { 4596 mutex_exit(&connp->conn_lock); 4597 goto ud_error; 4598 } 4599 } else { 4600 /* Simply update the destination address if no source route */ 4601 if (ixa->ixa_flags & IXAF_IS_IPV4) { 4602 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc; 4603 4604 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst); 4605 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) { 4606 ipha->ipha_fragment_offset_and_flags |= 4607 IPH_DF_HTONS; 4608 } else { 4609 ipha->ipha_fragment_offset_and_flags &= 4610 ~IPH_DF_HTONS; 4611 } 4612 } else { 4613 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc; 4614 ip6h->ip6_dst = v6dst; 4615 } 4616 } 4617 4618 /* 4619 * Remember the dst etc which corresponds to the built header 4620 * template and conn_ixa. 4621 */ 4622 oldixa = conn_replace_ixa(connp, ixa); 4623 connp->conn_v6lastdst = v6dst; 4624 connp->conn_lastflowinfo = flowinfo; 4625 connp->conn_lastscopeid = ixa->ixa_scopeid; 4626 connp->conn_lastsrcid = srcid; 4627 /* Also remember a source to use together with lastdst */ 4628 connp->conn_v6lastsrc = v6src; 4629 4630 data_mp = icmp_prepend_header_template(connp, ixa, data_mp, &v6src, 4631 flowinfo, &error); 4632 4633 /* Done with conn_t */ 4634 mutex_exit(&connp->conn_lock); 4635 ixa_refrele(oldixa); 4636 4637 if (data_mp == NULL) { 4638 ASSERT(error != 0); 4639 goto ud_error; 4640 } 4641 4642 if (!do_ipsec) { 4643 /* Policy might differ for different ICMP type/code */ 4644 data_mp = icmp_output_attach_policy(data_mp, connp, ixa); 4645 if (data_mp == NULL) { 4646 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4647 error = EHOSTUNREACH; /* IPsec policy failure */ 4648 goto done; 4649 } 4650 } 4651 4652 /* We're done. Pass the packet to ip. */ 4653 BUMP_MIB(&is->is_rawip_mib, rawipOutDatagrams); 4654 4655 error = conn_ip_output(data_mp, ixa); 4656 /* No rawipOutErrors if an error since IP increases its error counter */ 4657 switch (error) { 4658 case 0: 4659 break; 4660 case EWOULDBLOCK: 4661 (void) ixa_check_drain_insert(connp, ixa); 4662 error = 0; 4663 break; 4664 case EADDRNOTAVAIL: 4665 /* 4666 * IXAF_VERIFY_SOURCE tells us to pick a better source. 4667 * Don't have the application see that errno 4668 */ 4669 error = ENETUNREACH; 4670 /* FALLTHRU */ 4671 default: 4672 mutex_enter(&connp->conn_lock); 4673 /* 4674 * Clear the source and v6lastdst so we call ip_attr_connect 4675 * for the next packet and try to pick a better source. 4676 */ 4677 if (connp->conn_mcbc_bind) 4678 connp->conn_saddr_v6 = ipv6_all_zeros; 4679 else 4680 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 4681 connp->conn_v6lastdst = ipv6_all_zeros; 4682 mutex_exit(&connp->conn_lock); 4683 break; 4684 } 4685 done: 4686 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4687 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4688 ixa->ixa_cpid = connp->conn_cpid; 4689 ixa_refrele(ixa); 4690 return (error); 4691 4692 ud_error: 4693 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4694 ixa->ixa_cred = connp->conn_cred; /* Restore */ 4695 ixa->ixa_cpid = connp->conn_cpid; 4696 ixa_refrele(ixa); 4697 4698 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 4699 freemsg(data_mp); 4700 return (error); 4701 } 4702 4703 /* ARGSUSED */ 4704 static int 4705 icmp_wput_fallback(queue_t *q, mblk_t *mp) 4706 { 4707 #ifdef DEBUG 4708 cmn_err(CE_CONT, "icmp_wput_fallback: Message during fallback \n"); 4709 #endif 4710 freemsg(mp); 4711 return (0); 4712 } 4713 4714 static void 4715 icmp_wput_other(queue_t *q, mblk_t *mp) 4716 { 4717 uchar_t *rptr = mp->b_rptr; 4718 struct iocblk *iocp; 4719 conn_t *connp = Q_TO_CONN(q); 4720 icmp_t *icmp = connp->conn_icmp; 4721 cred_t *cr; 4722 4723 switch (mp->b_datap->db_type) { 4724 case M_PROTO: 4725 case M_PCPROTO: 4726 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) { 4727 /* 4728 * If the message does not contain a PRIM_type, 4729 * throw it away. 4730 */ 4731 freemsg(mp); 4732 return; 4733 } 4734 switch (((t_primp_t)rptr)->type) { 4735 case T_ADDR_REQ: 4736 icmp_addr_req(q, mp); 4737 return; 4738 case O_T_BIND_REQ: 4739 case T_BIND_REQ: 4740 icmp_tpi_bind(q, mp); 4741 return; 4742 case T_CONN_REQ: 4743 icmp_tpi_connect(q, mp); 4744 return; 4745 case T_CAPABILITY_REQ: 4746 icmp_capability_req(q, mp); 4747 return; 4748 case T_INFO_REQ: 4749 icmp_info_req(q, mp); 4750 return; 4751 case T_UNITDATA_REQ: 4752 /* 4753 * If a T_UNITDATA_REQ gets here, the address must 4754 * be bad. Valid T_UNITDATA_REQs are handled 4755 * in icmp_wput. 4756 */ 4757 icmp_ud_err(q, mp, EADDRNOTAVAIL); 4758 return; 4759 case T_UNBIND_REQ: 4760 icmp_tpi_unbind(q, mp); 4761 return; 4762 case T_SVR4_OPTMGMT_REQ: 4763 /* 4764 * All Solaris components should pass a db_credp 4765 * for this TPI message, hence we ASSERT. 4766 * But in case there is some other M_PROTO that looks 4767 * like a TPI message sent by some other kernel 4768 * component, we check and return an error. 4769 */ 4770 cr = msg_getcred(mp, NULL); 4771 ASSERT(cr != NULL); 4772 if (cr == NULL) { 4773 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4774 return; 4775 } 4776 4777 if (!snmpcom_req(q, mp, icmp_snmp_set, ip_snmp_get, 4778 cr)) { 4779 svr4_optcom_req(q, mp, cr, &icmp_opt_obj); 4780 } 4781 return; 4782 4783 case T_OPTMGMT_REQ: 4784 /* 4785 * All Solaris components should pass a db_credp 4786 * for this TPI message, hence we ASSERT. 4787 * But in case there is some other M_PROTO that looks 4788 * like a TPI message sent by some other kernel 4789 * component, we check and return an error. 4790 */ 4791 cr = msg_getcred(mp, NULL); 4792 ASSERT(cr != NULL); 4793 if (cr == NULL) { 4794 icmp_err_ack(q, mp, TSYSERR, EINVAL); 4795 return; 4796 } 4797 tpi_optcom_req(q, mp, cr, &icmp_opt_obj); 4798 return; 4799 4800 case T_DISCON_REQ: 4801 icmp_tpi_disconnect(q, mp); 4802 return; 4803 4804 /* The following TPI message is not supported by icmp. */ 4805 case O_T_CONN_RES: 4806 case T_CONN_RES: 4807 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4808 return; 4809 4810 /* The following 3 TPI requests are illegal for icmp. */ 4811 case T_DATA_REQ: 4812 case T_EXDATA_REQ: 4813 case T_ORDREL_REQ: 4814 icmp_err_ack(q, mp, TNOTSUPPORT, 0); 4815 return; 4816 default: 4817 break; 4818 } 4819 break; 4820 case M_FLUSH: 4821 if (*rptr & FLUSHW) 4822 flushq(q, FLUSHDATA); 4823 break; 4824 case M_IOCTL: 4825 iocp = (struct iocblk *)mp->b_rptr; 4826 switch (iocp->ioc_cmd) { 4827 case TI_GETPEERNAME: 4828 if (icmp->icmp_state != TS_DATA_XFER) { 4829 /* 4830 * If a default destination address has not 4831 * been associated with the stream, then we 4832 * don't know the peer's name. 4833 */ 4834 iocp->ioc_error = ENOTCONN; 4835 iocp->ioc_count = 0; 4836 mp->b_datap->db_type = M_IOCACK; 4837 qreply(q, mp); 4838 return; 4839 } 4840 /* FALLTHRU */ 4841 case TI_GETMYNAME: 4842 /* 4843 * For TI_GETPEERNAME and TI_GETMYNAME, we first 4844 * need to copyin the user's strbuf structure. 4845 * Processing will continue in the M_IOCDATA case 4846 * below. 4847 */ 4848 mi_copyin(q, mp, NULL, 4849 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 4850 return; 4851 default: 4852 break; 4853 } 4854 break; 4855 case M_IOCDATA: 4856 icmp_wput_iocdata(q, mp); 4857 return; 4858 default: 4859 /* Unrecognized messages are passed through without change. */ 4860 break; 4861 } 4862 ip_wput_nondata(q, mp); 4863 } 4864 4865 /* 4866 * icmp_wput_iocdata is called by icmp_wput_other to handle all M_IOCDATA 4867 * messages. 4868 */ 4869 static void 4870 icmp_wput_iocdata(queue_t *q, mblk_t *mp) 4871 { 4872 mblk_t *mp1; 4873 STRUCT_HANDLE(strbuf, sb); 4874 uint_t addrlen; 4875 conn_t *connp = Q_TO_CONN(q); 4876 icmp_t *icmp = connp->conn_icmp; 4877 4878 /* Make sure it is one of ours. */ 4879 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4880 case TI_GETMYNAME: 4881 case TI_GETPEERNAME: 4882 break; 4883 default: 4884 ip_wput_nondata(q, mp); 4885 return; 4886 } 4887 4888 switch (mi_copy_state(q, mp, &mp1)) { 4889 case -1: 4890 return; 4891 case MI_COPY_CASE(MI_COPY_IN, 1): 4892 break; 4893 case MI_COPY_CASE(MI_COPY_OUT, 1): 4894 /* 4895 * The address has been copied out, so now 4896 * copyout the strbuf. 4897 */ 4898 mi_copyout(q, mp); 4899 return; 4900 case MI_COPY_CASE(MI_COPY_OUT, 2): 4901 /* 4902 * The address and strbuf have been copied out. 4903 * We're done, so just acknowledge the original 4904 * M_IOCTL. 4905 */ 4906 mi_copy_done(q, mp, 0); 4907 return; 4908 default: 4909 /* 4910 * Something strange has happened, so acknowledge 4911 * the original M_IOCTL with an EPROTO error. 4912 */ 4913 mi_copy_done(q, mp, EPROTO); 4914 return; 4915 } 4916 4917 /* 4918 * Now we have the strbuf structure for TI_GETMYNAME 4919 * and TI_GETPEERNAME. Next we copyout the requested 4920 * address and then we'll copyout the strbuf. 4921 */ 4922 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 4923 (void *)mp1->b_rptr); 4924 4925 if (connp->conn_family == AF_INET) 4926 addrlen = sizeof (sin_t); 4927 else 4928 addrlen = sizeof (sin6_t); 4929 4930 if (STRUCT_FGET(sb, maxlen) < addrlen) { 4931 mi_copy_done(q, mp, EINVAL); 4932 return; 4933 } 4934 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4935 case TI_GETMYNAME: 4936 break; 4937 case TI_GETPEERNAME: 4938 if (icmp->icmp_state != TS_DATA_XFER) { 4939 mi_copy_done(q, mp, ENOTCONN); 4940 return; 4941 } 4942 break; 4943 default: 4944 mi_copy_done(q, mp, EPROTO); 4945 return; 4946 } 4947 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 4948 if (!mp1) 4949 return; 4950 4951 STRUCT_FSET(sb, len, addrlen); 4952 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 4953 case TI_GETMYNAME: 4954 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr, 4955 &addrlen); 4956 break; 4957 case TI_GETPEERNAME: 4958 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr, 4959 &addrlen); 4960 break; 4961 } 4962 mp1->b_wptr += addrlen; 4963 /* Copy out the address */ 4964 mi_copyout(q, mp); 4965 } 4966 4967 void 4968 icmp_ddi_g_init(void) 4969 { 4970 icmp_max_optsize = optcom_max_optsize(icmp_opt_obj.odb_opt_des_arr, 4971 icmp_opt_obj.odb_opt_arr_cnt); 4972 4973 /* 4974 * We want to be informed each time a stack is created or 4975 * destroyed in the kernel, so we can maintain the 4976 * set of icmp_stack_t's. 4977 */ 4978 netstack_register(NS_ICMP, rawip_stack_init, NULL, rawip_stack_fini); 4979 } 4980 4981 void 4982 icmp_ddi_g_destroy(void) 4983 { 4984 netstack_unregister(NS_ICMP); 4985 } 4986 4987 #define INET_NAME "ip" 4988 4989 /* 4990 * Initialize the ICMP stack instance. 4991 */ 4992 static void * 4993 rawip_stack_init(netstackid_t stackid, netstack_t *ns) 4994 { 4995 icmp_stack_t *is; 4996 int error = 0; 4997 size_t arrsz; 4998 major_t major; 4999 5000 is = (icmp_stack_t *)kmem_zalloc(sizeof (*is), KM_SLEEP); 5001 is->is_netstack = ns; 5002 5003 arrsz = sizeof (icmp_propinfo_tbl); 5004 is->is_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, KM_SLEEP); 5005 bcopy(icmp_propinfo_tbl, is->is_propinfo_tbl, arrsz); 5006 5007 is->is_ksp = rawip_kstat_init(stackid); 5008 5009 major = mod_name_to_major(INET_NAME); 5010 error = ldi_ident_from_major(major, &is->is_ldi_ident); 5011 ASSERT(error == 0); 5012 return (is); 5013 } 5014 5015 /* 5016 * Free the ICMP stack instance. 5017 */ 5018 static void 5019 rawip_stack_fini(netstackid_t stackid, void *arg) 5020 { 5021 icmp_stack_t *is = (icmp_stack_t *)arg; 5022 5023 kmem_free(is->is_propinfo_tbl, sizeof (icmp_propinfo_tbl)); 5024 is->is_propinfo_tbl = NULL; 5025 5026 rawip_kstat_fini(stackid, is->is_ksp); 5027 is->is_ksp = NULL; 5028 ldi_ident_release(is->is_ldi_ident); 5029 kmem_free(is, sizeof (*is)); 5030 } 5031 5032 static void * 5033 rawip_kstat_init(netstackid_t stackid) 5034 { 5035 kstat_t *ksp; 5036 5037 rawip_named_kstat_t template = { 5038 { "inDatagrams", KSTAT_DATA_UINT32, 0 }, 5039 { "inCksumErrs", KSTAT_DATA_UINT32, 0 }, 5040 { "inErrors", KSTAT_DATA_UINT32, 0 }, 5041 { "outDatagrams", KSTAT_DATA_UINT32, 0 }, 5042 { "outErrors", KSTAT_DATA_UINT32, 0 }, 5043 }; 5044 5045 ksp = kstat_create_netstack("icmp", 0, "rawip", "mib2", 5046 KSTAT_TYPE_NAMED, NUM_OF_FIELDS(rawip_named_kstat_t), 0, stackid); 5047 if (ksp == NULL || ksp->ks_data == NULL) 5048 return (NULL); 5049 5050 bcopy(&template, ksp->ks_data, sizeof (template)); 5051 ksp->ks_update = rawip_kstat_update; 5052 ksp->ks_private = (void *)(uintptr_t)stackid; 5053 5054 kstat_install(ksp); 5055 return (ksp); 5056 } 5057 5058 static void 5059 rawip_kstat_fini(netstackid_t stackid, kstat_t *ksp) 5060 { 5061 if (ksp != NULL) { 5062 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 5063 kstat_delete_netstack(ksp, stackid); 5064 } 5065 } 5066 5067 static int 5068 rawip_kstat_update(kstat_t *ksp, int rw) 5069 { 5070 rawip_named_kstat_t *rawipkp; 5071 netstackid_t stackid = (netstackid_t)(uintptr_t)ksp->ks_private; 5072 netstack_t *ns; 5073 icmp_stack_t *is; 5074 5075 if ((ksp == NULL) || (ksp->ks_data == NULL)) 5076 return (EIO); 5077 5078 if (rw == KSTAT_WRITE) 5079 return (EACCES); 5080 5081 rawipkp = (rawip_named_kstat_t *)ksp->ks_data; 5082 5083 ns = netstack_find_by_stackid(stackid); 5084 if (ns == NULL) 5085 return (-1); 5086 is = ns->netstack_icmp; 5087 if (is == NULL) { 5088 netstack_rele(ns); 5089 return (-1); 5090 } 5091 rawipkp->inDatagrams.value.ui32 = is->is_rawip_mib.rawipInDatagrams; 5092 rawipkp->inCksumErrs.value.ui32 = is->is_rawip_mib.rawipInCksumErrs; 5093 rawipkp->inErrors.value.ui32 = is->is_rawip_mib.rawipInErrors; 5094 rawipkp->outDatagrams.value.ui32 = is->is_rawip_mib.rawipOutDatagrams; 5095 rawipkp->outErrors.value.ui32 = is->is_rawip_mib.rawipOutErrors; 5096 netstack_rele(ns); 5097 return (0); 5098 } 5099 5100 /* ARGSUSED */ 5101 int 5102 rawip_accept(sock_lower_handle_t lproto_handle, 5103 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle, 5104 cred_t *cr) 5105 { 5106 return (EOPNOTSUPP); 5107 } 5108 5109 /* ARGSUSED */ 5110 int 5111 rawip_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5112 socklen_t len, cred_t *cr) 5113 { 5114 conn_t *connp = (conn_t *)proto_handle; 5115 int error; 5116 5117 /* All Solaris components should pass a cred for this operation. */ 5118 ASSERT(cr != NULL); 5119 5120 /* Binding to a NULL address really means unbind */ 5121 if (sa == NULL) 5122 error = rawip_do_unbind(connp); 5123 else 5124 error = rawip_do_bind(connp, sa, len); 5125 5126 if (error < 0) { 5127 if (error == -TOUTSTATE) 5128 error = EINVAL; 5129 else 5130 error = proto_tlitosyserr(-error); 5131 } 5132 return (error); 5133 } 5134 5135 static int 5136 rawip_implicit_bind(conn_t *connp) 5137 { 5138 sin6_t sin6addr; 5139 sin_t *sin; 5140 sin6_t *sin6; 5141 socklen_t len; 5142 int error; 5143 5144 if (connp->conn_family == AF_INET) { 5145 len = sizeof (struct sockaddr_in); 5146 sin = (sin_t *)&sin6addr; 5147 *sin = sin_null; 5148 sin->sin_family = AF_INET; 5149 sin->sin_addr.s_addr = INADDR_ANY; 5150 } else { 5151 ASSERT(connp->conn_family == AF_INET6); 5152 len = sizeof (sin6_t); 5153 sin6 = (sin6_t *)&sin6addr; 5154 *sin6 = sin6_null; 5155 sin6->sin6_family = AF_INET6; 5156 V6_SET_ZERO(sin6->sin6_addr); 5157 } 5158 5159 error = rawip_do_bind(connp, (struct sockaddr *)&sin6addr, len); 5160 5161 return ((error < 0) ? proto_tlitosyserr(-error) : error); 5162 } 5163 5164 static int 5165 rawip_unbind(conn_t *connp) 5166 { 5167 int error; 5168 5169 error = rawip_do_unbind(connp); 5170 if (error < 0) { 5171 error = proto_tlitosyserr(-error); 5172 } 5173 return (error); 5174 } 5175 5176 /* ARGSUSED */ 5177 int 5178 rawip_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr) 5179 { 5180 return (EOPNOTSUPP); 5181 } 5182 5183 int 5184 rawip_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa, 5185 socklen_t len, sock_connid_t *id, cred_t *cr) 5186 { 5187 conn_t *connp = (conn_t *)proto_handle; 5188 icmp_t *icmp = connp->conn_icmp; 5189 int error; 5190 boolean_t did_bind = B_FALSE; 5191 pid_t pid = curproc->p_pid; 5192 5193 /* All Solaris components should pass a cred for this operation. */ 5194 ASSERT(cr != NULL); 5195 5196 if (sa == NULL) { 5197 /* 5198 * Disconnect 5199 * Make sure we are connected 5200 */ 5201 if (icmp->icmp_state != TS_DATA_XFER) 5202 return (EINVAL); 5203 5204 error = icmp_disconnect(connp); 5205 return (error); 5206 } 5207 5208 error = proto_verify_ip_addr(connp->conn_family, sa, len); 5209 if (error != 0) 5210 return (error); 5211 5212 /* do an implicit bind if necessary */ 5213 if (icmp->icmp_state == TS_UNBND) { 5214 error = rawip_implicit_bind(connp); 5215 /* 5216 * We could be racing with an actual bind, in which case 5217 * we would see EPROTO. We cross our fingers and try 5218 * to connect. 5219 */ 5220 if (!(error == 0 || error == EPROTO)) 5221 return (error); 5222 did_bind = B_TRUE; 5223 } 5224 5225 /* 5226 * set SO_DGRAM_ERRIND 5227 */ 5228 connp->conn_dgram_errind = B_TRUE; 5229 5230 error = rawip_do_connect(connp, sa, len, cr, pid); 5231 if (error != 0 && did_bind) { 5232 int unbind_err; 5233 5234 unbind_err = rawip_unbind(connp); 5235 ASSERT(unbind_err == 0); 5236 } 5237 5238 if (error == 0) { 5239 *id = 0; 5240 (*connp->conn_upcalls->su_connected)(connp->conn_upper_handle, 5241 0, NULL, -1); 5242 } else if (error < 0) { 5243 error = proto_tlitosyserr(-error); 5244 } 5245 return (error); 5246 } 5247 5248 /* ARGSUSED2 */ 5249 int 5250 rawip_fallback(sock_lower_handle_t proto_handle, queue_t *q, 5251 boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb, 5252 sock_quiesce_arg_t *arg) 5253 { 5254 conn_t *connp = (conn_t *)proto_handle; 5255 icmp_t *icmp; 5256 struct T_capability_ack tca; 5257 struct sockaddr_in6 laddr, faddr; 5258 socklen_t laddrlen, faddrlen; 5259 short opts; 5260 struct stroptions *stropt; 5261 mblk_t *mp, *stropt_mp; 5262 int error; 5263 5264 icmp = connp->conn_icmp; 5265 5266 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL); 5267 5268 /* 5269 * setup the fallback stream that was allocated 5270 */ 5271 connp->conn_dev = (dev_t)RD(q)->q_ptr; 5272 connp->conn_minor_arena = WR(q)->q_ptr; 5273 5274 RD(q)->q_ptr = WR(q)->q_ptr = connp; 5275 5276 WR(q)->q_qinfo = &icmpwinit; 5277 5278 connp->conn_rq = RD(q); 5279 connp->conn_wq = WR(q); 5280 5281 /* Notify stream head about options before sending up data */ 5282 stropt_mp->b_datap->db_type = M_SETOPTS; 5283 stropt_mp->b_wptr += sizeof (*stropt); 5284 stropt = (struct stroptions *)stropt_mp->b_rptr; 5285 stropt->so_flags = SO_WROFF | SO_HIWAT; 5286 stropt->so_wroff = connp->conn_wroff; 5287 stropt->so_hiwat = connp->conn_rcvbuf; 5288 putnext(RD(q), stropt_mp); 5289 5290 /* 5291 * free helper stream 5292 */ 5293 ip_free_helper_stream(connp); 5294 5295 /* 5296 * Collect the information needed to sync with the sonode 5297 */ 5298 icmp_do_capability_ack(icmp, &tca, TC1_INFO); 5299 5300 laddrlen = faddrlen = sizeof (sin6_t); 5301 (void) rawip_getsockname((sock_lower_handle_t)connp, 5302 (struct sockaddr *)&laddr, &laddrlen, CRED()); 5303 error = rawip_getpeername((sock_lower_handle_t)connp, 5304 (struct sockaddr *)&faddr, &faddrlen, CRED()); 5305 if (error != 0) 5306 faddrlen = 0; 5307 opts = 0; 5308 if (connp->conn_dgram_errind) 5309 opts |= SO_DGRAM_ERRIND; 5310 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE) 5311 opts |= SO_DONTROUTE; 5312 5313 mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca, 5314 (struct sockaddr *)&laddr, laddrlen, 5315 (struct sockaddr *)&faddr, faddrlen, opts); 5316 5317 /* 5318 * Attempts to send data up during fallback will result in it being 5319 * queued in icmp_t. Now we push up any queued packets. 5320 */ 5321 mutex_enter(&icmp->icmp_recv_lock); 5322 if (mp != NULL) { 5323 mp->b_next = icmp->icmp_fallback_queue_head; 5324 icmp->icmp_fallback_queue_head = mp; 5325 } 5326 while (icmp->icmp_fallback_queue_head != NULL) { 5327 mp = icmp->icmp_fallback_queue_head; 5328 icmp->icmp_fallback_queue_head = mp->b_next; 5329 mp->b_next = NULL; 5330 mutex_exit(&icmp->icmp_recv_lock); 5331 putnext(RD(q), mp); 5332 mutex_enter(&icmp->icmp_recv_lock); 5333 } 5334 icmp->icmp_fallback_queue_tail = icmp->icmp_fallback_queue_head; 5335 5336 /* 5337 * No longer a streams less socket 5338 */ 5339 mutex_enter(&connp->conn_lock); 5340 connp->conn_flags &= ~IPCL_NONSTR; 5341 mutex_exit(&connp->conn_lock); 5342 5343 mutex_exit(&icmp->icmp_recv_lock); 5344 5345 ASSERT(icmp->icmp_fallback_queue_head == NULL && 5346 icmp->icmp_fallback_queue_tail == NULL); 5347 5348 ASSERT(connp->conn_ref >= 1); 5349 5350 return (0); 5351 } 5352 5353 /* ARGSUSED2 */ 5354 sock_lower_handle_t 5355 rawip_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls, 5356 uint_t *smodep, int *errorp, int flags, cred_t *credp) 5357 { 5358 conn_t *connp; 5359 5360 if (type != SOCK_RAW || (family != AF_INET && family != AF_INET6)) { 5361 *errorp = EPROTONOSUPPORT; 5362 return (NULL); 5363 } 5364 5365 connp = rawip_do_open(family, credp, errorp, flags); 5366 if (connp != NULL) { 5367 connp->conn_flags |= IPCL_NONSTR; 5368 5369 mutex_enter(&connp->conn_lock); 5370 connp->conn_state_flags &= ~CONN_INCIPIENT; 5371 mutex_exit(&connp->conn_lock); 5372 *sock_downcalls = &sock_rawip_downcalls; 5373 *smodep = SM_ATOMIC; 5374 } else { 5375 ASSERT(*errorp != 0); 5376 } 5377 5378 return ((sock_lower_handle_t)connp); 5379 } 5380 5381 /* ARGSUSED3 */ 5382 void 5383 rawip_activate(sock_lower_handle_t proto_handle, 5384 sock_upper_handle_t sock_handle, sock_upcalls_t *sock_upcalls, int flags, 5385 cred_t *cr) 5386 { 5387 conn_t *connp = (conn_t *)proto_handle; 5388 struct sock_proto_props sopp; 5389 5390 /* All Solaris components should pass a cred for this operation. */ 5391 ASSERT(cr != NULL); 5392 5393 connp->conn_upcalls = sock_upcalls; 5394 connp->conn_upper_handle = sock_handle; 5395 5396 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT | 5397 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ; 5398 sopp.sopp_wroff = connp->conn_wroff; 5399 sopp.sopp_rxhiwat = connp->conn_rcvbuf; 5400 sopp.sopp_rxlowat = connp->conn_rcvlowat; 5401 sopp.sopp_maxblk = INFPSZ; 5402 sopp.sopp_maxpsz = IP_MAXPACKET; 5403 sopp.sopp_minpsz = (icmp_mod_info.mi_minpsz == 1) ? 0 : 5404 icmp_mod_info.mi_minpsz; 5405 5406 (*connp->conn_upcalls->su_set_proto_props) 5407 (connp->conn_upper_handle, &sopp); 5408 5409 icmp_bind_proto(connp->conn_icmp); 5410 } 5411 5412 /* ARGSUSED3 */ 5413 int 5414 rawip_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5415 socklen_t *salenp, cred_t *cr) 5416 { 5417 conn_t *connp = (conn_t *)proto_handle; 5418 icmp_t *icmp = connp->conn_icmp; 5419 int error; 5420 5421 /* All Solaris components should pass a cred for this operation. */ 5422 ASSERT(cr != NULL); 5423 5424 mutex_enter(&connp->conn_lock); 5425 if (icmp->icmp_state != TS_DATA_XFER) 5426 error = ENOTCONN; 5427 else 5428 error = conn_getpeername(connp, sa, salenp); 5429 mutex_exit(&connp->conn_lock); 5430 return (error); 5431 } 5432 5433 /* ARGSUSED3 */ 5434 int 5435 rawip_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa, 5436 socklen_t *salenp, cred_t *cr) 5437 { 5438 conn_t *connp = (conn_t *)proto_handle; 5439 int error; 5440 5441 /* All Solaris components should pass a cred for this operation. */ 5442 ASSERT(cr != NULL); 5443 5444 mutex_enter(&connp->conn_lock); 5445 error = conn_getsockname(connp, sa, salenp); 5446 mutex_exit(&connp->conn_lock); 5447 return (error); 5448 } 5449 5450 int 5451 rawip_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5452 const void *optvalp, socklen_t optlen, cred_t *cr) 5453 { 5454 conn_t *connp = (conn_t *)proto_handle; 5455 int error; 5456 5457 /* All Solaris components should pass a cred for this operation. */ 5458 ASSERT(cr != NULL); 5459 5460 error = proto_opt_check(level, option_name, optlen, NULL, 5461 icmp_opt_obj.odb_opt_des_arr, 5462 icmp_opt_obj.odb_opt_arr_cnt, 5463 B_TRUE, B_FALSE, cr); 5464 5465 if (error != 0) { 5466 /* 5467 * option not recognized 5468 */ 5469 if (error < 0) { 5470 error = proto_tlitosyserr(-error); 5471 } 5472 return (error); 5473 } 5474 5475 error = icmp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, 5476 option_name, optlen, (uchar_t *)optvalp, (uint_t *)&optlen, 5477 (uchar_t *)optvalp, NULL, cr); 5478 5479 ASSERT(error >= 0); 5480 5481 return (error); 5482 } 5483 5484 int 5485 rawip_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 5486 void *optvalp, socklen_t *optlen, cred_t *cr) 5487 { 5488 int error; 5489 conn_t *connp = (conn_t *)proto_handle; 5490 t_uscalar_t max_optbuf_len; 5491 void *optvalp_buf; 5492 int len; 5493 5494 /* All Solaris components should pass a cred for this operation. */ 5495 ASSERT(cr != NULL); 5496 5497 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len, 5498 icmp_opt_obj.odb_opt_des_arr, 5499 icmp_opt_obj.odb_opt_arr_cnt, 5500 B_FALSE, B_TRUE, cr); 5501 5502 if (error != 0) { 5503 if (error < 0) { 5504 error = proto_tlitosyserr(-error); 5505 } 5506 return (error); 5507 } 5508 5509 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP); 5510 len = icmp_opt_get(connp, level, option_name, optvalp_buf); 5511 if (len == -1) { 5512 kmem_free(optvalp_buf, max_optbuf_len); 5513 return (EINVAL); 5514 } 5515 5516 /* 5517 * update optlen and copy option value 5518 */ 5519 t_uscalar_t size = MIN(len, *optlen); 5520 5521 bcopy(optvalp_buf, optvalp, size); 5522 bcopy(&size, optlen, sizeof (size)); 5523 5524 kmem_free(optvalp_buf, max_optbuf_len); 5525 return (0); 5526 } 5527 5528 /* ARGSUSED1 */ 5529 int 5530 rawip_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr) 5531 { 5532 conn_t *connp = (conn_t *)proto_handle; 5533 5534 /* All Solaris components should pass a cred for this operation. */ 5535 ASSERT(cr != NULL); 5536 5537 (void) rawip_do_close(connp); 5538 return (0); 5539 } 5540 5541 /* ARGSUSED2 */ 5542 int 5543 rawip_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr) 5544 { 5545 conn_t *connp = (conn_t *)proto_handle; 5546 5547 /* All Solaris components should pass a cred for this operation. */ 5548 ASSERT(cr != NULL); 5549 5550 /* shut down the send side */ 5551 if (how != SHUT_RD) 5552 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5553 SOCK_OPCTL_SHUT_SEND, 0); 5554 /* shut down the recv side */ 5555 if (how != SHUT_WR) 5556 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 5557 SOCK_OPCTL_SHUT_RECV, 0); 5558 return (0); 5559 } 5560 5561 void 5562 rawip_clr_flowctrl(sock_lower_handle_t proto_handle) 5563 { 5564 conn_t *connp = (conn_t *)proto_handle; 5565 icmp_t *icmp = connp->conn_icmp; 5566 5567 mutex_enter(&icmp->icmp_recv_lock); 5568 connp->conn_flow_cntrld = B_FALSE; 5569 mutex_exit(&icmp->icmp_recv_lock); 5570 } 5571 5572 int 5573 rawip_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg, 5574 int mode, int32_t *rvalp, cred_t *cr) 5575 { 5576 conn_t *connp = (conn_t *)proto_handle; 5577 int error; 5578 5579 /* All Solaris components should pass a cred for this operation. */ 5580 ASSERT(cr != NULL); 5581 5582 /* 5583 * If we don't have a helper stream then create one. 5584 * ip_create_helper_stream takes care of locking the conn_t, 5585 * so this check for NULL is just a performance optimization. 5586 */ 5587 if (connp->conn_helper_info == NULL) { 5588 icmp_stack_t *is = connp->conn_icmp->icmp_is; 5589 5590 ASSERT(is->is_ldi_ident != NULL); 5591 5592 /* 5593 * Create a helper stream for non-STREAMS socket. 5594 */ 5595 error = ip_create_helper_stream(connp, is->is_ldi_ident); 5596 if (error != 0) { 5597 ip0dbg(("rawip_ioctl: create of IP helper stream " 5598 "failed %d\n", error)); 5599 return (error); 5600 } 5601 } 5602 5603 switch (cmd) { 5604 case _SIOCSOCKFALLBACK: 5605 case TI_GETPEERNAME: 5606 case TI_GETMYNAME: 5607 #ifdef DEBUG 5608 cmn_err(CE_CONT, "icmp_ioctl cmd 0x%x on non streams" 5609 " socket", cmd); 5610 #endif 5611 error = EINVAL; 5612 break; 5613 default: 5614 /* 5615 * Pass on to IP using helper stream 5616 */ 5617 error = ldi_ioctl(connp->conn_helper_info->iphs_handle, 5618 cmd, arg, mode, cr, rvalp); 5619 break; 5620 } 5621 return (error); 5622 } 5623 5624 int 5625 rawip_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg, 5626 cred_t *cr) 5627 { 5628 sin6_t *sin6; 5629 sin_t *sin = NULL; 5630 uint_t srcid; 5631 conn_t *connp = (conn_t *)proto_handle; 5632 icmp_t *icmp = connp->conn_icmp; 5633 int error = 0; 5634 icmp_stack_t *is = icmp->icmp_is; 5635 pid_t pid = curproc->p_pid; 5636 ip_xmit_attr_t *ixa; 5637 5638 ASSERT(DB_TYPE(mp) == M_DATA); 5639 5640 /* All Solaris components should pass a cred for this operation. */ 5641 ASSERT(cr != NULL); 5642 5643 /* do an implicit bind if necessary */ 5644 if (icmp->icmp_state == TS_UNBND) { 5645 error = rawip_implicit_bind(connp); 5646 /* 5647 * We could be racing with an actual bind, in which case 5648 * we would see EPROTO. We cross our fingers and try 5649 * to connect. 5650 */ 5651 if (!(error == 0 || error == EPROTO)) { 5652 freemsg(mp); 5653 return (error); 5654 } 5655 } 5656 5657 /* Protocol 255 contains full IP headers */ 5658 /* Read without holding lock */ 5659 if (icmp->icmp_hdrincl) { 5660 ASSERT(connp->conn_ipversion == IPV4_VERSION); 5661 if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH) { 5662 if (!pullupmsg(mp, IP_SIMPLE_HDR_LENGTH)) { 5663 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5664 freemsg(mp); 5665 return (EINVAL); 5666 } 5667 } 5668 error = icmp_output_hdrincl(connp, mp, cr, pid); 5669 if (is->is_sendto_ignerr) 5670 return (0); 5671 else 5672 return (error); 5673 } 5674 5675 /* Connected? */ 5676 if (msg->msg_name == NULL) { 5677 if (icmp->icmp_state != TS_DATA_XFER) { 5678 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5679 return (EDESTADDRREQ); 5680 } 5681 if (msg->msg_controllen != 0) { 5682 error = icmp_output_ancillary(connp, NULL, NULL, mp, 5683 NULL, msg, cr, pid); 5684 } else { 5685 error = icmp_output_connected(connp, mp, cr, pid); 5686 } 5687 if (is->is_sendto_ignerr) 5688 return (0); 5689 else 5690 return (error); 5691 } 5692 if (icmp->icmp_state == TS_DATA_XFER) { 5693 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5694 return (EISCONN); 5695 } 5696 error = proto_verify_ip_addr(connp->conn_family, 5697 (struct sockaddr *)msg->msg_name, msg->msg_namelen); 5698 if (error != 0) { 5699 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5700 return (error); 5701 } 5702 switch (connp->conn_family) { 5703 case AF_INET6: 5704 sin6 = (sin6_t *)msg->msg_name; 5705 5706 /* No support for mapped addresses on raw sockets */ 5707 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 5708 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5709 return (EADDRNOTAVAIL); 5710 } 5711 srcid = sin6->__sin6_src_id; 5712 5713 /* 5714 * If the local address is a mapped address return 5715 * an error. 5716 * It would be possible to send an IPv6 packet but the 5717 * response would never make it back to the application 5718 * since it is bound to a mapped address. 5719 */ 5720 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) { 5721 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5722 return (EADDRNOTAVAIL); 5723 } 5724 5725 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 5726 sin6->sin6_addr = ipv6_loopback; 5727 5728 /* 5729 * We have to allocate an ip_xmit_attr_t before we grab 5730 * conn_lock and we need to hold conn_lock once we've check 5731 * conn_same_as_last_v6 to handle concurrent send* calls on a 5732 * socket. 5733 */ 5734 if (msg->msg_controllen == 0) { 5735 ixa = conn_get_ixa(connp, B_FALSE); 5736 if (ixa == NULL) { 5737 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5738 return (ENOMEM); 5739 } 5740 } else { 5741 ixa = NULL; 5742 } 5743 mutex_enter(&connp->conn_lock); 5744 if (icmp->icmp_delayed_error != 0) { 5745 sin6_t *sin2 = (sin6_t *)&icmp->icmp_delayed_addr; 5746 5747 error = icmp->icmp_delayed_error; 5748 icmp->icmp_delayed_error = 0; 5749 5750 /* Compare IP address and family */ 5751 5752 if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, 5753 &sin2->sin6_addr) && 5754 sin6->sin6_family == sin2->sin6_family) { 5755 mutex_exit(&connp->conn_lock); 5756 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5757 if (ixa != NULL) 5758 ixa_refrele(ixa); 5759 return (error); 5760 } 5761 } 5762 if (msg->msg_controllen != 0) { 5763 mutex_exit(&connp->conn_lock); 5764 ASSERT(ixa == NULL); 5765 error = icmp_output_ancillary(connp, NULL, sin6, mp, 5766 NULL, msg, cr, pid); 5767 } else if (conn_same_as_last_v6(connp, sin6) && 5768 connp->conn_lastsrcid == srcid && 5769 ipsec_outbound_policy_current(ixa)) { 5770 /* icmp_output_lastdst drops conn_lock */ 5771 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5772 } else { 5773 /* icmp_output_newdst drops conn_lock */ 5774 error = icmp_output_newdst(connp, mp, NULL, sin6, cr, 5775 pid, ixa); 5776 } 5777 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5778 if (is->is_sendto_ignerr) 5779 return (0); 5780 else 5781 return (error); 5782 case AF_INET: 5783 sin = (sin_t *)msg->msg_name; 5784 5785 if (sin->sin_addr.s_addr == INADDR_ANY) 5786 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK); 5787 5788 /* 5789 * We have to allocate an ip_xmit_attr_t before we grab 5790 * conn_lock and we need to hold conn_lock once we've check 5791 * conn_same_as_last_v6 to handle concurrent send* on a socket. 5792 */ 5793 if (msg->msg_controllen == 0) { 5794 ixa = conn_get_ixa(connp, B_FALSE); 5795 if (ixa == NULL) { 5796 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5797 return (ENOMEM); 5798 } 5799 } else { 5800 ixa = NULL; 5801 } 5802 mutex_enter(&connp->conn_lock); 5803 if (icmp->icmp_delayed_error != 0) { 5804 sin_t *sin2 = (sin_t *)&icmp->icmp_delayed_addr; 5805 5806 error = icmp->icmp_delayed_error; 5807 icmp->icmp_delayed_error = 0; 5808 5809 /* Compare IP address */ 5810 5811 if (sin->sin_addr.s_addr == sin2->sin_addr.s_addr) { 5812 mutex_exit(&connp->conn_lock); 5813 BUMP_MIB(&is->is_rawip_mib, rawipOutErrors); 5814 if (ixa != NULL) 5815 ixa_refrele(ixa); 5816 return (error); 5817 } 5818 } 5819 5820 if (msg->msg_controllen != 0) { 5821 mutex_exit(&connp->conn_lock); 5822 ASSERT(ixa == NULL); 5823 error = icmp_output_ancillary(connp, sin, NULL, mp, 5824 NULL, msg, cr, pid); 5825 } else if (conn_same_as_last_v4(connp, sin) && 5826 ipsec_outbound_policy_current(ixa)) { 5827 /* icmp_output_lastdst drops conn_lock */ 5828 error = icmp_output_lastdst(connp, mp, cr, pid, ixa); 5829 } else { 5830 /* icmp_output_newdst drops conn_lock */ 5831 error = icmp_output_newdst(connp, mp, sin, NULL, cr, 5832 pid, ixa); 5833 } 5834 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock)); 5835 if (is->is_sendto_ignerr) 5836 return (0); 5837 else 5838 return (error); 5839 default: 5840 return (EINVAL); 5841 } 5842 } 5843 5844 sock_downcalls_t sock_rawip_downcalls = { 5845 rawip_activate, 5846 rawip_accept, 5847 rawip_bind, 5848 rawip_listen, 5849 rawip_connect, 5850 rawip_getpeername, 5851 rawip_getsockname, 5852 rawip_getsockopt, 5853 rawip_setsockopt, 5854 rawip_send, 5855 NULL, 5856 NULL, 5857 NULL, 5858 rawip_shutdown, 5859 rawip_clr_flowctrl, 5860 rawip_ioctl, 5861 rawip_close 5862 }; 5863