xref: /illumos-gate/usr/src/uts/common/inet/ip/ip.c (revision 221e47fb)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 1990 Mentat Inc.
25  * Copyright (c) 2017 OmniTI Computer Consulting, Inc. All rights reserved.
26  * Copyright (c) 2016 by Delphix. All rights reserved.
27  * Copyright (c) 2019 Joyent, Inc. All rights reserved.
28  * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
29  */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/dlpi.h>
34 #include <sys/stropts.h>
35 #include <sys/sysmacros.h>
36 #include <sys/strsubr.h>
37 #include <sys/strlog.h>
38 #include <sys/strsun.h>
39 #include <sys/zone.h>
40 #define	_SUN_TPI_VERSION 2
41 #include <sys/tihdr.h>
42 #include <sys/xti_inet.h>
43 #include <sys/ddi.h>
44 #include <sys/suntpi.h>
45 #include <sys/cmn_err.h>
46 #include <sys/debug.h>
47 #include <sys/kobj.h>
48 #include <sys/modctl.h>
49 #include <sys/atomic.h>
50 #include <sys/policy.h>
51 #include <sys/priv.h>
52 #include <sys/taskq.h>
53 
54 #include <sys/systm.h>
55 #include <sys/param.h>
56 #include <sys/kmem.h>
57 #include <sys/sdt.h>
58 #include <sys/socket.h>
59 #include <sys/vtrace.h>
60 #include <sys/isa_defs.h>
61 #include <sys/mac.h>
62 #include <net/if.h>
63 #include <net/if_arp.h>
64 #include <net/route.h>
65 #include <sys/sockio.h>
66 #include <netinet/in.h>
67 #include <net/if_dl.h>
68 
69 #include <inet/common.h>
70 #include <inet/mi.h>
71 #include <inet/mib2.h>
72 #include <inet/nd.h>
73 #include <inet/arp.h>
74 #include <inet/snmpcom.h>
75 #include <inet/optcom.h>
76 #include <inet/kstatcom.h>
77 
78 #include <netinet/igmp_var.h>
79 #include <netinet/ip6.h>
80 #include <netinet/icmp6.h>
81 #include <netinet/sctp.h>
82 
83 #include <inet/ip.h>
84 #include <inet/ip_impl.h>
85 #include <inet/ip6.h>
86 #include <inet/ip6_asp.h>
87 #include <inet/tcp.h>
88 #include <inet/tcp_impl.h>
89 #include <inet/ip_multi.h>
90 #include <inet/ip_if.h>
91 #include <inet/ip_ire.h>
92 #include <inet/ip_ftable.h>
93 #include <inet/ip_rts.h>
94 #include <inet/ip_ndp.h>
95 #include <inet/ip_listutils.h>
96 #include <netinet/igmp.h>
97 #include <netinet/ip_mroute.h>
98 #include <inet/ipp_common.h>
99 #include <inet/cc.h>
100 
101 #include <net/pfkeyv2.h>
102 #include <inet/sadb.h>
103 #include <inet/ipsec_impl.h>
104 #include <inet/iptun/iptun_impl.h>
105 #include <inet/ipdrop.h>
106 #include <inet/ip_netinfo.h>
107 #include <inet/ilb_ip.h>
108 
109 #include <sys/ethernet.h>
110 #include <net/if_types.h>
111 #include <sys/cpuvar.h>
112 
113 #include <ipp/ipp.h>
114 #include <ipp/ipp_impl.h>
115 #include <ipp/ipgpc/ipgpc.h>
116 
117 #include <sys/pattr.h>
118 #include <inet/ipclassifier.h>
119 #include <inet/sctp_ip.h>
120 #include <inet/sctp/sctp_impl.h>
121 #include <inet/udp_impl.h>
122 #include <inet/rawip_impl.h>
123 #include <inet/rts_impl.h>
124 
125 #include <sys/tsol/label.h>
126 #include <sys/tsol/tnet.h>
127 
128 #include <sys/squeue_impl.h>
129 #include <inet/ip_arp.h>
130 
131 #include <sys/clock_impl.h>	/* For LBOLT_FASTPATH{,64} */
132 
133 /*
134  * Values for squeue switch:
135  * IP_SQUEUE_ENTER_NODRAIN: SQ_NODRAIN
136  * IP_SQUEUE_ENTER: SQ_PROCESS
137  * IP_SQUEUE_FILL: SQ_FILL
138  */
139 int ip_squeue_enter = IP_SQUEUE_ENTER;	/* Setable in /etc/system */
140 
141 int ip_squeue_flag;
142 
143 /*
144  * Setable in /etc/system
145  */
146 int ip_poll_normal_ms = 100;
147 int ip_poll_normal_ticks = 0;
148 int ip_modclose_ackwait_ms = 3000;
149 
150 /*
151  * It would be nice to have these present only in DEBUG systems, but the
152  * current design of the global symbol checking logic requires them to be
153  * unconditionally present.
154  */
155 uint_t ip_thread_data;			/* TSD key for debug support */
156 krwlock_t ip_thread_rwlock;
157 list_t	ip_thread_list;
158 
159 /*
160  * Structure to represent a linked list of msgblks. Used by ip_snmp_ functions.
161  */
162 
163 struct listptr_s {
164 	mblk_t	*lp_head;	/* pointer to the head of the list */
165 	mblk_t	*lp_tail;	/* pointer to the tail of the list */
166 };
167 
168 typedef struct listptr_s listptr_t;
169 
170 /*
171  * This is used by ip_snmp_get_mib2_ip_route_media and
172  * ip_snmp_get_mib2_ip6_route_media to carry the lists of return data.
173  */
174 typedef struct iproutedata_s {
175 	uint_t		ird_idx;
176 	uint_t		ird_flags;	/* see below */
177 	listptr_t	ird_route;	/* ipRouteEntryTable */
178 	listptr_t	ird_netmedia;	/* ipNetToMediaEntryTable */
179 	listptr_t	ird_attrs;	/* ipRouteAttributeTable */
180 } iproutedata_t;
181 
182 /* Include ire_testhidden and IRE_IF_CLONE routes */
183 #define	IRD_REPORT_ALL	0x01
184 
185 /*
186  * Cluster specific hooks. These should be NULL when booted as a non-cluster
187  */
188 
189 /*
190  * Hook functions to enable cluster networking
191  * On non-clustered systems these vectors must always be NULL.
192  *
193  * Hook function to Check ip specified ip address is a shared ip address
194  * in the cluster
195  *
196  */
197 int (*cl_inet_isclusterwide)(netstackid_t stack_id, uint8_t protocol,
198     sa_family_t addr_family, uint8_t *laddrp, void *args) = NULL;
199 
200 /*
201  * Hook function to generate cluster wide ip fragment identifier
202  */
203 uint32_t (*cl_inet_ipident)(netstackid_t stack_id, uint8_t protocol,
204     sa_family_t addr_family, uint8_t *laddrp, uint8_t *faddrp,
205     void *args) = NULL;
206 
207 /*
208  * Hook function to generate cluster wide SPI.
209  */
210 void (*cl_inet_getspi)(netstackid_t, uint8_t, uint8_t *, size_t,
211     void *) = NULL;
212 
213 /*
214  * Hook function to verify if the SPI is already utlized.
215  */
216 
217 int (*cl_inet_checkspi)(netstackid_t, uint8_t, uint32_t, void *) = NULL;
218 
219 /*
220  * Hook function to delete the SPI from the cluster wide repository.
221  */
222 
223 void (*cl_inet_deletespi)(netstackid_t, uint8_t, uint32_t, void *) = NULL;
224 
225 /*
226  * Hook function to inform the cluster when packet received on an IDLE SA
227  */
228 
229 void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, sa_family_t,
230     in6_addr_t, in6_addr_t, void *) = NULL;
231 
232 /*
233  * Synchronization notes:
234  *
235  * IP is a fully D_MP STREAMS module/driver. Thus it does not depend on any
236  * MT level protection given by STREAMS. IP uses a combination of its own
237  * internal serialization mechanism and standard Solaris locking techniques.
238  * The internal serialization is per phyint.  This is used to serialize
239  * plumbing operations, IPMP operations, most set ioctls, etc.
240  *
241  * Plumbing is a long sequence of operations involving message
242  * exchanges between IP, ARP and device drivers. Many set ioctls are typically
243  * involved in plumbing operations. A natural model is to serialize these
244  * ioctls one per ill. For example plumbing of hme0 and qfe0 can go on in
245  * parallel without any interference. But various set ioctls on hme0 are best
246  * serialized, along with IPMP operations and processing of DLPI control
247  * messages received from drivers on a per phyint basis. This serialization is
248  * provided by the ipsq_t and primitives operating on this. Details can
249  * be found in ip_if.c above the core primitives operating on ipsq_t.
250  *
251  * Lookups of an ipif or ill by a thread return a refheld ipif / ill.
252  * Simiarly lookup of an ire by a thread also returns a refheld ire.
253  * In addition ipif's and ill's referenced by the ire are also indirectly
254  * refheld. Thus no ipif or ill can vanish as long as an ipif is refheld
255  * directly or indirectly. For example an SIOCSLIFADDR ioctl that changes the
256  * address of an ipif has to go through the ipsq_t. This ensures that only
257  * one such exclusive operation proceeds at any time on the ipif. It then
258  * waits for all refcnts
259  * associated with this ipif to come down to zero. The address is changed
260  * only after the ipif has been quiesced. Then the ipif is brought up again.
261  * More details are described above the comment in ip_sioctl_flags.
262  *
263  * Packet processing is based mostly on IREs and are fully multi-threaded
264  * using standard Solaris MT techniques.
265  *
266  * There are explicit locks in IP to handle:
267  * - The ip_g_head list maintained by mi_open_link() and friends.
268  *
269  * - The reassembly data structures (one lock per hash bucket)
270  *
271  * - conn_lock is meant to protect conn_t fields. The fields actually
272  *   protected by conn_lock are documented in the conn_t definition.
273  *
274  * - ire_lock to protect some of the fields of the ire, IRE tables
275  *   (one lock per hash bucket). Refer to ip_ire.c for details.
276  *
277  * - ndp_g_lock and ncec_lock for protecting NCEs.
278  *
279  * - ill_lock protects fields of the ill and ipif. Details in ip.h
280  *
281  * - ill_g_lock: This is a global reader/writer lock. Protects the following
282  *	* The AVL tree based global multi list of all ills.
283  *	* The linked list of all ipifs of an ill
284  *	* The <ipsq-xop> mapping
285  *	* <ill-phyint> association
286  *   Insertion/deletion of an ill in the system, insertion/deletion of an ipif
287  *   into an ill, changing the <ipsq-xop> mapping of an ill, changing the
288  *   <ill-phyint> assoc of an ill will all have to hold the ill_g_lock as
289  *   writer for the actual duration of the insertion/deletion/change.
290  *
291  * - ill_lock:  This is a per ill mutex.
292  *   It protects some members of the ill_t struct; see ip.h for details.
293  *   It also protects the <ill-phyint> assoc.
294  *   It also protects the list of ipifs hanging off the ill.
295  *
296  * - ipsq_lock: This is a per ipsq_t mutex lock.
297  *   This protects some members of the ipsq_t struct; see ip.h for details.
298  *   It also protects the <ipsq-ipxop> mapping
299  *
300  * - ipx_lock: This is a per ipxop_t mutex lock.
301  *   This protects some members of the ipxop_t struct; see ip.h for details.
302  *
303  * - phyint_lock: This is a per phyint mutex lock. Protects just the
304  *   phyint_flags
305  *
306  * - ip_addr_avail_lock: This is used to ensure the uniqueness of IP addresses.
307  *   This lock is held in ipif_up_done and the ipif is marked IPIF_UP and the
308  *   uniqueness check also done atomically.
309  *
310  * - ill_g_usesrc_lock: This readers/writer lock protects the usesrc
311  *   group list linked by ill_usesrc_grp_next. It also protects the
312  *   ill_usesrc_ifindex field. It is taken as a writer when a member of the
313  *   group is being added or deleted.  This lock is taken as a reader when
314  *   walking the list/group(eg: to get the number of members in a usesrc group).
315  *   Note, it is only necessary to take this lock if the ill_usesrc_grp_next
316  *   field is changing state i.e from NULL to non-NULL or vice-versa. For
317  *   example, it is not necessary to take this lock in the initial portion
318  *   of ip_sioctl_slifusesrc or at all in ip_sioctl_flags since these
319  *   operations are executed exclusively and that ensures that the "usesrc
320  *   group state" cannot change. The "usesrc group state" change can happen
321  *   only in the latter part of ip_sioctl_slifusesrc and in ill_delete.
322  *
323  * Changing <ill-phyint>, <ipsq-xop> assocications:
324  *
325  * To change the <ill-phyint> association, the ill_g_lock must be held
326  * as writer, and the ill_locks of both the v4 and v6 instance of the ill
327  * must be held.
328  *
329  * To change the <ipsq-xop> association, the ill_g_lock must be held as
330  * writer, the ipsq_lock must be held, and one must be writer on the ipsq.
331  * This is only done when ills are added or removed from IPMP groups.
332  *
333  * To add or delete an ipif from the list of ipifs hanging off the ill,
334  * ill_g_lock (writer) and ill_lock must be held and the thread must be
335  * a writer on the associated ipsq.
336  *
337  * To add or delete an ill to the system, the ill_g_lock must be held as
338  * writer and the thread must be a writer on the associated ipsq.
339  *
340  * To add or delete an ilm to an ill, the ill_lock must be held and the thread
341  * must be a writer on the associated ipsq.
342  *
343  * Lock hierarchy
344  *
345  * Some lock hierarchy scenarios are listed below.
346  *
347  * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock
348  * ill_g_lock -> ill_lock(s) -> phyint_lock
349  * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock
350  * ill_g_lock -> ip_addr_avail_lock
351  * conn_lock -> irb_lock -> ill_lock -> ire_lock
352  * ill_g_lock -> ip_g_nd_lock
353  * ill_g_lock -> ips_ipmp_lock -> ill_lock -> nce_lock
354  * ill_g_lock -> ndp_g_lock -> ill_lock -> ncec_lock -> nce_lock
355  * arl_lock -> ill_lock
356  * ips_ire_dep_lock -> irb_lock
357  *
358  * When more than 1 ill lock is needed to be held, all ill lock addresses
359  * are sorted on address and locked starting from highest addressed lock
360  * downward.
361  *
362  * Multicast scenarios
363  * ips_ill_g_lock -> ill_mcast_lock
364  * conn_ilg_lock -> ips_ill_g_lock -> ill_lock
365  * ill_mcast_serializer -> ill_mcast_lock -> ips_ipmp_lock -> ill_lock
366  * ill_mcast_serializer -> ill_mcast_lock -> connf_lock -> conn_lock
367  * ill_mcast_serializer -> ill_mcast_lock -> conn_ilg_lock
368  * ill_mcast_serializer -> ill_mcast_lock -> ips_igmp_timer_lock
369  *
370  * IPsec scenarios
371  *
372  * ipsa_lock -> ill_g_lock -> ill_lock
373  * ill_g_usesrc_lock -> ill_g_lock -> ill_lock
374  *
375  * Trusted Solaris scenarios
376  *
377  * igsa_lock -> gcgrp_rwlock -> gcgrp_lock
378  * igsa_lock -> gcdb_lock
379  * gcgrp_rwlock -> ire_lock
380  * gcgrp_rwlock -> gcdb_lock
381  *
382  * squeue(sq_lock), flow related (ft_lock, fe_lock) locking
383  *
384  * cpu_lock --> ill_lock --> sqset_lock --> sq_lock
385  * sq_lock -> conn_lock -> QLOCK(q)
386  * ill_lock -> ft_lock -> fe_lock
387  *
388  * Routing/forwarding table locking notes:
389  *
390  * Lock acquisition order: Radix tree lock, irb_lock.
391  * Requirements:
392  * i.  Walker must not hold any locks during the walker callback.
393  * ii  Walker must not see a truncated tree during the walk because of any node
394  *     deletion.
395  * iii Existing code assumes ire_bucket is valid if it is non-null and is used
396  *     in many places in the code to walk the irb list. Thus even if all the
397  *     ires in a bucket have been deleted, we still can't free the radix node
398  *     until the ires have actually been inactive'd (freed).
399  *
400  * Tree traversal - Need to hold the global tree lock in read mode.
401  * Before dropping the global tree lock, need to either increment the ire_refcnt
402  * to ensure that the radix node can't be deleted.
403  *
404  * Tree add - Need to hold the global tree lock in write mode to add a
405  * radix node. To prevent the node from being deleted, increment the
406  * irb_refcnt, after the node is added to the tree. The ire itself is
407  * added later while holding the irb_lock, but not the tree lock.
408  *
409  * Tree delete - Need to hold the global tree lock and irb_lock in write mode.
410  * All associated ires must be inactive (i.e. freed), and irb_refcnt
411  * must be zero.
412  *
413  * Walker - Increment irb_refcnt before calling the walker callback. Hold the
414  * global tree lock (read mode) for traversal.
415  *
416  * IRE dependencies - In some cases we hold ips_ire_dep_lock across ire_refrele
417  * hence we will acquire irb_lock while holding ips_ire_dep_lock.
418  *
419  * IPsec notes :
420  *
421  * IP interacts with the IPsec code (AH/ESP) by storing IPsec attributes
422  * in the ip_xmit_attr_t ip_recv_attr_t. For outbound datagrams, the
423  * ip_xmit_attr_t has the
424  * information used by the IPsec code for applying the right level of
425  * protection. The information initialized by IP in the ip_xmit_attr_t
426  * is determined by the per-socket policy or global policy in the system.
427  * For inbound datagrams, the ip_recv_attr_t
428  * starts out with nothing in it. It gets filled
429  * with the right information if it goes through the AH/ESP code, which
430  * happens if the incoming packet is secure. The information initialized
431  * by AH/ESP, is later used by IP (during fanouts to ULP) to see whether
432  * the policy requirements needed by per-socket policy or global policy
433  * is met or not.
434  *
435  * For fully connected sockets i.e dst, src [addr, port] is known,
436  * conn_policy_cached is set indicating that policy has been cached.
437  * conn_in_enforce_policy may or may not be set depending on whether
438  * there is a global policy match or per-socket policy match.
439  * Policy inheriting happpens in ip_policy_set once the destination is known.
440  * Once the right policy is set on the conn_t, policy cannot change for
441  * this socket. This makes life simpler for TCP (UDP ?) where
442  * re-transmissions go out with the same policy. For symmetry, policy
443  * is cached for fully connected UDP sockets also. Thus if policy is cached,
444  * it also implies that policy is latched i.e policy cannot change
445  * on these sockets. As we have the right policy on the conn, we don't
446  * have to lookup global policy for every outbound and inbound datagram
447  * and thus serving as an optimization. Note that a global policy change
448  * does not affect fully connected sockets if they have policy. If fully
449  * connected sockets did not have any policy associated with it, global
450  * policy change may affect them.
451  *
452  * IP Flow control notes:
453  * ---------------------
454  * Non-TCP streams are flow controlled by IP. The way this is accomplished
455  * differs when ILL_CAPAB_DLD_DIRECT is enabled for that IP instance. When
456  * ILL_DIRECT_CAPABLE(ill) is TRUE, IP can do direct function calls into
457  * GLDv3. Otherwise packets are sent down to lower layers using STREAMS
458  * functions.
459  *
460  * Per Tx ring udp flow control:
461  * This is applicable only when ILL_CAPAB_DLD_DIRECT capability is set in
462  * the ill (i.e. ILL_DIRECT_CAPABLE(ill) is true).
463  *
464  * The underlying link can expose multiple Tx rings to the GLDv3 mac layer.
465  * To achieve best performance, outgoing traffic need to be fanned out among
466  * these Tx ring. mac_tx() is called (via str_mdata_fastpath_put()) to send
467  * traffic out of the NIC and it takes a fanout hint. UDP connections pass
468  * the address of connp as fanout hint to mac_tx(). Under flow controlled
469  * condition, mac_tx() returns a non-NULL cookie (ip_mac_tx_cookie_t). This
470  * cookie points to a specific Tx ring that is blocked. The cookie is used to
471  * hash into an idl_tx_list[] entry in idl_tx_list[] array. Each idl_tx_list_t
472  * point to drain_lists (idl_t's). These drain list will store the blocked UDP
473  * connp's. The drain list is not a single list but a configurable number of
474  * lists.
475  *
476  * The diagram below shows idl_tx_list_t's and their drain_lists. ip_stack_t
477  * has an array of idl_tx_list_t. The size of the array is TX_FANOUT_SIZE
478  * which is equal to 128. This array in turn contains a pointer to idl_t[],
479  * the ip drain list. The idl_t[] array size is MIN(max_ncpus, 8). The drain
480  * list will point to the list of connp's that are flow controlled.
481  *
482  *                      ---------------   -------   -------   -------
483  *                   |->|drain_list[0]|-->|connp|-->|connp|-->|connp|-->
484  *                   |  ---------------   -------   -------   -------
485  *                   |  ---------------   -------   -------   -------
486  *                   |->|drain_list[1]|-->|connp|-->|connp|-->|connp|-->
487  * ----------------  |  ---------------   -------   -------   -------
488  * |idl_tx_list[0]|->|  ---------------   -------   -------   -------
489  * ----------------  |->|drain_list[2]|-->|connp|-->|connp|-->|connp|-->
490  *                   |  ---------------   -------   -------   -------
491  *                   .        .              .         .         .
492  *                   |  ---------------   -------   -------   -------
493  *                   |->|drain_list[n]|-->|connp|-->|connp|-->|connp|-->
494  *                      ---------------   -------   -------   -------
495  *                      ---------------   -------   -------   -------
496  *                   |->|drain_list[0]|-->|connp|-->|connp|-->|connp|-->
497  *                   |  ---------------   -------   -------   -------
498  *                   |  ---------------   -------   -------   -------
499  * ----------------  |->|drain_list[1]|-->|connp|-->|connp|-->|connp|-->
500  * |idl_tx_list[1]|->|  ---------------   -------   -------   -------
501  * ----------------  |        .              .         .         .
502  *                   |  ---------------   -------   -------   -------
503  *                   |->|drain_list[n]|-->|connp|-->|connp|-->|connp|-->
504  *                      ---------------   -------   -------   -------
505  *     .....
506  * ----------------
507  * |idl_tx_list[n]|-> ...
508  * ----------------
509  *
510  * When mac_tx() returns a cookie, the cookie is hashed into an index into
511  * ips_idl_tx_list[], and conn_drain_insert() is called with the idl_tx_list
512  * to insert the conn onto.  conn_drain_insert() asserts flow control for the
513  * sockets via su_txq_full() (non-STREAMS) or QFULL on conn_wq (STREAMS).
514  * Further, conn_blocked is set to indicate that the conn is blocked.
515  *
516  * GLDv3 calls ill_flow_enable() when flow control is relieved.  The cookie
517  * passed in the call to ill_flow_enable() identifies the blocked Tx ring and
518  * is again hashed to locate the appropriate idl_tx_list, which is then
519  * drained via conn_walk_drain().  conn_walk_drain() goes through each conn in
520  * the drain list and calls conn_drain_remove() to clear flow control (via
521  * calling su_txq_full() or clearing QFULL), and remove the conn from the
522  * drain list.
523  *
524  * Note that the drain list is not a single list but a (configurable) array of
525  * lists (8 elements by default).  Synchronization between drain insertion and
526  * flow control wakeup is handled by using idl_txl->txl_lock, and only
527  * conn_drain_insert() and conn_drain_remove() manipulate the drain list.
528  *
529  * Flow control via STREAMS is used when ILL_DIRECT_CAPABLE() returns FALSE.
530  * On the send side, if the packet cannot be sent down to the driver by IP
531  * (canput() fails), ip_xmit() drops the packet and returns EWOULDBLOCK to the
532  * caller, who may then invoke ixa_check_drain_insert() to insert the conn on
533  * the 0'th drain list.  When ip_wsrv() runs on the ill_wq because flow
534  * control has been relieved, the blocked conns in the 0'th drain list are
535  * drained as in the non-STREAMS case.
536  *
537  * In both the STREAMS and non-STREAMS cases, the sockfs upcall to set QFULL
538  * is done when the conn is inserted into the drain list (conn_drain_insert())
539  * and cleared when the conn is removed from the it (conn_drain_remove()).
540  *
541  * IPQOS notes:
542  *
543  * IPQoS Policies are applied to packets using IPPF (IP Policy framework)
544  * and IPQoS modules. IPPF includes hooks in IP at different control points
545  * (callout positions) which direct packets to IPQoS modules for policy
546  * processing. Policies, if present, are global.
547  *
548  * The callout positions are located in the following paths:
549  *		o local_in (packets destined for this host)
550  *		o local_out (packets orginating from this host )
551  *		o fwd_in  (packets forwarded by this m/c - inbound)
552  *		o fwd_out (packets forwarded by this m/c - outbound)
553  * Hooks at these callout points can be enabled/disabled using the ndd variable
554  * ip_policy_mask (a bit mask with the 4 LSB indicating the callout positions).
555  * By default all the callout positions are enabled.
556  *
557  * Outbound (local_out)
558  * Hooks are placed in ire_send_wire_v4 and ire_send_wire_v6.
559  *
560  * Inbound (local_in)
561  * Hooks are placed in ip_fanout_v4 and ip_fanout_v6.
562  *
563  * Forwarding (in and out)
564  * Hooks are placed in ire_recv_forward_v4/v6.
565  *
566  * IP Policy Framework processing (IPPF processing)
567  * Policy processing for a packet is initiated by ip_process, which ascertains
568  * that the classifier (ipgpc) is loaded and configured, failing which the
569  * packet resumes normal processing in IP. If the clasifier is present, the
570  * packet is acted upon by one or more IPQoS modules (action instances), per
571  * filters configured in ipgpc and resumes normal IP processing thereafter.
572  * An action instance can drop a packet in course of its processing.
573  *
574  * Zones notes:
575  *
576  * The partitioning rules for networking are as follows:
577  * 1) Packets coming from a zone must have a source address belonging to that
578  * zone.
579  * 2) Packets coming from a zone can only be sent on a physical interface on
580  * which the zone has an IP address.
581  * 3) Between two zones on the same machine, packet delivery is only allowed if
582  * there's a matching route for the destination and zone in the forwarding
583  * table.
584  * 4) The TCP and UDP port spaces are per-zone; that is, two processes in
585  * different zones can bind to the same port with the wildcard address
586  * (INADDR_ANY).
587  *
588  * The granularity of interface partitioning is at the logical interface level.
589  * Therefore, every zone has its own IP addresses, and incoming packets can be
590  * attributed to a zone unambiguously. A logical interface is placed into a zone
591  * using the SIOCSLIFZONE ioctl; this sets the ipif_zoneid field in the ipif_t
592  * structure. Rule (1) is implemented by modifying the source address selection
593  * algorithm so that the list of eligible addresses is filtered based on the
594  * sending process zone.
595  *
596  * The Internet Routing Entries (IREs) are either exclusive to a zone or shared
597  * across all zones, depending on their type. Here is the break-up:
598  *
599  * IRE type				Shared/exclusive
600  * --------				----------------
601  * IRE_BROADCAST			Exclusive
602  * IRE_DEFAULT (default routes)		Shared (*)
603  * IRE_LOCAL				Exclusive (x)
604  * IRE_LOOPBACK				Exclusive
605  * IRE_PREFIX (net routes)		Shared (*)
606  * IRE_IF_NORESOLVER (interface routes)	Exclusive
607  * IRE_IF_RESOLVER (interface routes)	Exclusive
608  * IRE_IF_CLONE (interface routes)	Exclusive
609  * IRE_HOST (host routes)		Shared (*)
610  *
611  * (*) A zone can only use a default or off-subnet route if the gateway is
612  * directly reachable from the zone, that is, if the gateway's address matches
613  * one of the zone's logical interfaces.
614  *
615  * (x) IRE_LOCAL are handled a bit differently.
616  * When ip_restrict_interzone_loopback is set (the default),
617  * ire_route_recursive restricts loopback using an IRE_LOCAL
618  * between zone to the case when L2 would have conceptually looped the packet
619  * back, i.e. the loopback which is required since neither Ethernet drivers
620  * nor Ethernet hardware loops them back. This is the case when the normal
621  * routes (ignoring IREs with different zoneids) would send out the packet on
622  * the same ill as the ill with which is IRE_LOCAL is associated.
623  *
624  * Multiple zones can share a common broadcast address; typically all zones
625  * share the 255.255.255.255 address. Incoming as well as locally originated
626  * broadcast packets must be dispatched to all the zones on the broadcast
627  * network. For directed broadcasts (e.g. 10.16.72.255) this is not trivial
628  * since some zones may not be on the 10.16.72/24 network. To handle this, each
629  * zone has its own set of IRE_BROADCAST entries; then, broadcast packets are
630  * sent to every zone that has an IRE_BROADCAST entry for the destination
631  * address on the input ill, see ip_input_broadcast().
632  *
633  * Applications in different zones can join the same multicast group address.
634  * The same logic applies for multicast as for broadcast. ip_input_multicast
635  * dispatches packets to all zones that have members on the physical interface.
636  */
637 
638 /*
639  * Squeue Fanout flags:
640  *	0: No fanout.
641  *	1: Fanout across all squeues
642  */
643 boolean_t	ip_squeue_fanout = 0;
644 
645 /*
646  * Maximum dups allowed per packet.
647  */
648 uint_t ip_max_frag_dups = 10;
649 
650 static int	ip_open(queue_t *q, dev_t *devp, int flag, int sflag,
651 		    cred_t *credp, boolean_t isv6);
652 static mblk_t	*ip_xmit_attach_llhdr(mblk_t *, nce_t *);
653 
654 static boolean_t icmp_inbound_verify_v4(mblk_t *, icmph_t *, ip_recv_attr_t *);
655 static void	icmp_inbound_too_big_v4(icmph_t *, ip_recv_attr_t *);
656 static void	icmp_inbound_error_fanout_v4(mblk_t *, icmph_t *,
657     ip_recv_attr_t *);
658 static void	icmp_options_update(ipha_t *);
659 static void	icmp_param_problem(mblk_t *, uint8_t,  ip_recv_attr_t *);
660 static void	icmp_pkt(mblk_t *, void *, size_t, ip_recv_attr_t *);
661 static mblk_t	*icmp_pkt_err_ok(mblk_t *, ip_recv_attr_t *);
662 static void	icmp_redirect_v4(mblk_t *mp, ipha_t *, icmph_t *,
663     ip_recv_attr_t *);
664 static void	icmp_send_redirect(mblk_t *, ipaddr_t, ip_recv_attr_t *);
665 static void	icmp_send_reply_v4(mblk_t *, ipha_t *, icmph_t *,
666     ip_recv_attr_t *);
667 
668 mblk_t		*ip_dlpi_alloc(size_t, t_uscalar_t);
669 char		*ip_dot_addr(ipaddr_t, char *);
670 mblk_t		*ip_carve_mp(mblk_t **, ssize_t);
671 static char	*ip_dot_saddr(uchar_t *, char *);
672 static int	ip_lrput(queue_t *, mblk_t *);
673 ipaddr_t	ip_net_mask(ipaddr_t);
674 char		*ip_nv_lookup(nv_t *, int);
675 int		ip_rput(queue_t *, mblk_t *);
676 static void	ip_rput_dlpi_writer(ipsq_t *dummy_sq, queue_t *q, mblk_t *mp,
677 		    void *dummy_arg);
678 int		ip_snmp_get(queue_t *, mblk_t *, int, boolean_t);
679 static mblk_t	*ip_snmp_get_mib2_ip(queue_t *, mblk_t *,
680 		    mib2_ipIfStatsEntry_t *, ip_stack_t *, boolean_t);
681 static mblk_t	*ip_snmp_get_mib2_ip_traffic_stats(queue_t *, mblk_t *,
682 		    ip_stack_t *, boolean_t);
683 static mblk_t	*ip_snmp_get_mib2_ip6(queue_t *, mblk_t *, ip_stack_t *,
684 		    boolean_t);
685 static mblk_t	*ip_snmp_get_mib2_icmp(queue_t *, mblk_t *, ip_stack_t *ipst);
686 static mblk_t	*ip_snmp_get_mib2_icmp6(queue_t *, mblk_t *, ip_stack_t *ipst);
687 static mblk_t	*ip_snmp_get_mib2_igmp(queue_t *, mblk_t *, ip_stack_t *ipst);
688 static mblk_t	*ip_snmp_get_mib2_multi(queue_t *, mblk_t *, ip_stack_t *ipst);
689 static mblk_t	*ip_snmp_get_mib2_ip_addr(queue_t *, mblk_t *,
690 		    ip_stack_t *ipst, boolean_t);
691 static mblk_t	*ip_snmp_get_mib2_ip6_addr(queue_t *, mblk_t *,
692 		    ip_stack_t *ipst, boolean_t);
693 static mblk_t	*ip_snmp_get_mib2_ip_group_src(queue_t *, mblk_t *,
694 		    ip_stack_t *ipst);
695 static mblk_t	*ip_snmp_get_mib2_ip6_group_src(queue_t *, mblk_t *,
696 		    ip_stack_t *ipst);
697 static mblk_t	*ip_snmp_get_mib2_ip_group_mem(queue_t *, mblk_t *,
698 		    ip_stack_t *ipst);
699 static mblk_t	*ip_snmp_get_mib2_ip6_group_mem(queue_t *, mblk_t *,
700 		    ip_stack_t *ipst);
701 static mblk_t	*ip_snmp_get_mib2_virt_multi(queue_t *, mblk_t *,
702 		    ip_stack_t *ipst);
703 static mblk_t	*ip_snmp_get_mib2_multi_rtable(queue_t *, mblk_t *,
704 		    ip_stack_t *ipst);
705 static mblk_t	*ip_snmp_get_mib2_ip_route_media(queue_t *, mblk_t *, int,
706 		    ip_stack_t *ipst);
707 static mblk_t	*ip_snmp_get_mib2_ip6_route_media(queue_t *, mblk_t *, int,
708 		    ip_stack_t *ipst);
709 static void	ip_snmp_get2_v4(ire_t *, iproutedata_t *);
710 static void	ip_snmp_get2_v6_route(ire_t *, iproutedata_t *);
711 static void	ip_snmp_get2_v4_media(ncec_t *, void *);
712 static void	ip_snmp_get2_v6_media(ncec_t *, void *);
713 int		ip_snmp_set(queue_t *, int, int, uchar_t *, int);
714 
715 static mblk_t	*ip_fragment_copyhdr(uchar_t *, int, int, ip_stack_t *,
716 		    mblk_t *);
717 
718 static void	conn_drain_init(ip_stack_t *);
719 static void	conn_drain_fini(ip_stack_t *);
720 static void	conn_drain(conn_t *connp, boolean_t closing);
721 
722 static void	conn_walk_drain(ip_stack_t *, idl_tx_list_t *);
723 static void	conn_walk_sctp(pfv_t, void *, zoneid_t, netstack_t *);
724 
725 static void	*ip_stack_init(netstackid_t stackid, netstack_t *ns);
726 static void	ip_stack_shutdown(netstackid_t stackid, void *arg);
727 static void	ip_stack_fini(netstackid_t stackid, void *arg);
728 
729 static int	ip_multirt_apply_membership(int (*fn)(conn_t *, boolean_t,
730     const in6_addr_t *, ipaddr_t, uint_t, mcast_record_t, const in6_addr_t *),
731     ire_t *, conn_t *, boolean_t, const in6_addr_t *,  mcast_record_t,
732     const in6_addr_t *);
733 
734 static int	ip_squeue_switch(int);
735 
736 static void	*ip_kstat_init(netstackid_t, ip_stack_t *);
737 static void	ip_kstat_fini(netstackid_t, kstat_t *);
738 static int	ip_kstat_update(kstat_t *kp, int rw);
739 static void	*icmp_kstat_init(netstackid_t);
740 static void	icmp_kstat_fini(netstackid_t, kstat_t *);
741 static int	icmp_kstat_update(kstat_t *kp, int rw);
742 static void	*ip_kstat2_init(netstackid_t, ip_stat_t *);
743 static void	ip_kstat2_fini(netstackid_t, kstat_t *);
744 
745 static void	ipobs_init(ip_stack_t *);
746 static void	ipobs_fini(ip_stack_t *);
747 
748 static int	ip_tp_cpu_update(cpu_setup_t, int, void *);
749 
750 ipaddr_t	ip_g_all_ones = IP_HOST_MASK;
751 
752 static long ip_rput_pullups;
753 int	dohwcksum = 1;	/* use h/w cksum if supported by the hardware */
754 
755 vmem_t *ip_minor_arena_sa; /* for minor nos. from INET_MIN_DEV+2 thru 2^^18-1 */
756 vmem_t *ip_minor_arena_la; /* for minor nos. from 2^^18 thru 2^^32-1 */
757 
758 int	ip_debug;
759 
760 /*
761  * Multirouting/CGTP stuff
762  */
763 int	ip_cgtp_filter_rev = CGTP_FILTER_REV;	/* CGTP hooks version */
764 
765 /*
766  * IP tunables related declarations. Definitions are in ip_tunables.c
767  */
768 extern mod_prop_info_t ip_propinfo_tbl[];
769 extern int ip_propinfo_count;
770 
771 /*
772  * Table of IP ioctls encoding the various properties of the ioctl and
773  * indexed based on the last byte of the ioctl command. Occasionally there
774  * is a clash, and there is more than 1 ioctl with the same last byte.
775  * In such a case 1 ioctl is encoded in the ndx table and the remaining
776  * ioctls are encoded in the misc table. An entry in the ndx table is
777  * retrieved by indexing on the last byte of the ioctl command and comparing
778  * the ioctl command with the value in the ndx table. In the event of a
779  * mismatch the misc table is then searched sequentially for the desired
780  * ioctl command.
781  *
782  * Entry: <command> <copyin_size> <flags> <cmd_type> <function> <restart_func>
783  */
784 ip_ioctl_cmd_t ip_ndx_ioctl_table[] = {
785 	/* 000 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
786 	/* 001 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
787 	/* 002 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
788 	/* 003 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
789 	/* 004 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
790 	/* 005 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
791 	/* 006 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
792 	/* 007 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
793 	/* 008 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
794 	/* 009 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
795 
796 	/* 010 */ { SIOCADDRT,	sizeof (struct rtentry), IPI_PRIV,
797 			MISC_CMD, ip_siocaddrt, NULL },
798 	/* 011 */ { SIOCDELRT,	sizeof (struct rtentry), IPI_PRIV,
799 			MISC_CMD, ip_siocdelrt, NULL },
800 
801 	/* 012 */ { SIOCSIFADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
802 			IF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
803 	/* 013 */ { SIOCGIFADDR, sizeof (struct ifreq), IPI_GET_CMD,
804 			IF_CMD, ip_sioctl_get_addr, NULL },
805 
806 	/* 014 */ { SIOCSIFDSTADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
807 			IF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
808 	/* 015 */ { SIOCGIFDSTADDR, sizeof (struct ifreq),
809 			IPI_GET_CMD, IF_CMD, ip_sioctl_get_dstaddr, NULL },
810 
811 	/* 016 */ { SIOCSIFFLAGS, sizeof (struct ifreq),
812 			IPI_PRIV | IPI_WR,
813 			IF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
814 	/* 017 */ { SIOCGIFFLAGS, sizeof (struct ifreq),
815 			IPI_MODOK | IPI_GET_CMD,
816 			IF_CMD, ip_sioctl_get_flags, NULL },
817 
818 	/* 018 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
819 	/* 019 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
820 
821 	/* copyin size cannot be coded for SIOCGIFCONF */
822 	/* 020 */ { O_SIOCGIFCONF, 0, IPI_GET_CMD,
823 			MISC_CMD, ip_sioctl_get_ifconf, NULL },
824 
825 	/* 021 */ { SIOCSIFMTU,	sizeof (struct ifreq), IPI_PRIV | IPI_WR,
826 			IF_CMD, ip_sioctl_mtu, NULL },
827 	/* 022 */ { SIOCGIFMTU,	sizeof (struct ifreq), IPI_GET_CMD,
828 			IF_CMD, ip_sioctl_get_mtu, NULL },
829 	/* 023 */ { SIOCGIFBRDADDR, sizeof (struct ifreq),
830 			IPI_GET_CMD, IF_CMD, ip_sioctl_get_brdaddr, NULL },
831 	/* 024 */ { SIOCSIFBRDADDR, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
832 			IF_CMD, ip_sioctl_brdaddr, NULL },
833 	/* 025 */ { SIOCGIFNETMASK, sizeof (struct ifreq),
834 			IPI_GET_CMD, IF_CMD, ip_sioctl_get_netmask, NULL },
835 	/* 026 */ { SIOCSIFNETMASK, sizeof (struct ifreq), IPI_PRIV | IPI_WR,
836 			IF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
837 	/* 027 */ { SIOCGIFMETRIC, sizeof (struct ifreq),
838 			IPI_GET_CMD, IF_CMD, ip_sioctl_get_metric, NULL },
839 	/* 028 */ { SIOCSIFMETRIC, sizeof (struct ifreq), IPI_PRIV,
840 			IF_CMD, ip_sioctl_metric, NULL },
841 	/* 029 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
842 
843 	/* See 166-168 below for extended SIOC*XARP ioctls */
844 	/* 030 */ { SIOCSARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR,
845 			ARP_CMD, ip_sioctl_arp, NULL },
846 	/* 031 */ { SIOCGARP, sizeof (struct arpreq), IPI_GET_CMD,
847 			ARP_CMD, ip_sioctl_arp, NULL },
848 	/* 032 */ { SIOCDARP, sizeof (struct arpreq), IPI_PRIV | IPI_WR,
849 			ARP_CMD, ip_sioctl_arp, NULL },
850 
851 	/* 033 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
852 	/* 034 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
853 	/* 035 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
854 	/* 036 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
855 	/* 037 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
856 	/* 038 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
857 	/* 039 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
858 	/* 040 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
859 	/* 041 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
860 	/* 042 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
861 	/* 043 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
862 	/* 044 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
863 	/* 045 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
864 	/* 046 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
865 	/* 047 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
866 	/* 048 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
867 	/* 049 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
868 	/* 050 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
869 	/* 051 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
870 	/* 052 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
871 	/* 053 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
872 
873 	/* 054 */ { IF_UNITSEL,	sizeof (int), IPI_PRIV | IPI_WR | IPI_MODOK,
874 			MISC_CMD, if_unitsel, if_unitsel_restart },
875 
876 	/* 055 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
877 	/* 056 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
878 	/* 057 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
879 	/* 058 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
880 	/* 059 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
881 	/* 060 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
882 	/* 061 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
883 	/* 062 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
884 	/* 063 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
885 	/* 064 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
886 	/* 065 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
887 	/* 066 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
888 	/* 067 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
889 	/* 068 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
890 	/* 069 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
891 	/* 070 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
892 	/* 071 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
893 	/* 072 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
894 
895 	/* 073 */ { SIOCSIFNAME, sizeof (struct ifreq),
896 			IPI_PRIV | IPI_WR | IPI_MODOK,
897 			IF_CMD, ip_sioctl_sifname, NULL },
898 
899 	/* 074 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
900 	/* 075 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
901 	/* 076 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
902 	/* 077 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
903 	/* 078 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
904 	/* 079 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
905 	/* 080 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
906 	/* 081 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
907 	/* 082 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
908 	/* 083 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
909 	/* 084 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
910 	/* 085 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
911 	/* 086 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
912 
913 	/* 087 */ { SIOCGIFNUM, sizeof (int), IPI_GET_CMD,
914 			MISC_CMD, ip_sioctl_get_ifnum, NULL },
915 	/* 088 */ { SIOCGIFMUXID, sizeof (struct ifreq), IPI_GET_CMD,
916 			IF_CMD, ip_sioctl_get_muxid, NULL },
917 	/* 089 */ { SIOCSIFMUXID, sizeof (struct ifreq),
918 			IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_muxid, NULL },
919 
920 	/* Both if and lif variants share same func */
921 	/* 090 */ { SIOCGIFINDEX, sizeof (struct ifreq), IPI_GET_CMD,
922 			IF_CMD, ip_sioctl_get_lifindex, NULL },
923 	/* Both if and lif variants share same func */
924 	/* 091 */ { SIOCSIFINDEX, sizeof (struct ifreq),
925 			IPI_PRIV | IPI_WR, IF_CMD, ip_sioctl_slifindex, NULL },
926 
927 	/* copyin size cannot be coded for SIOCGIFCONF */
928 	/* 092 */ { SIOCGIFCONF, 0, IPI_GET_CMD,
929 			MISC_CMD, ip_sioctl_get_ifconf, NULL },
930 	/* 093 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
931 	/* 094 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
932 	/* 095 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
933 	/* 096 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
934 	/* 097 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
935 	/* 098 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
936 	/* 099 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
937 	/* 100 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
938 	/* 101 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
939 	/* 102 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
940 	/* 103 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
941 	/* 104 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
942 	/* 105 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
943 	/* 106 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
944 	/* 107 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
945 	/* 108 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
946 	/* 109 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
947 
948 	/* 110 */ { SIOCLIFREMOVEIF, sizeof (struct lifreq),
949 			IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_removeif,
950 			ip_sioctl_removeif_restart },
951 	/* 111 */ { SIOCLIFADDIF, sizeof (struct lifreq),
952 			IPI_GET_CMD | IPI_PRIV | IPI_WR,
953 			LIF_CMD, ip_sioctl_addif, NULL },
954 #define	SIOCLIFADDR_NDX 112
955 	/* 112 */ { SIOCSLIFADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
956 			LIF_CMD, ip_sioctl_addr, ip_sioctl_addr_restart },
957 	/* 113 */ { SIOCGLIFADDR, sizeof (struct lifreq),
958 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_addr, NULL },
959 	/* 114 */ { SIOCSLIFDSTADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
960 			LIF_CMD, ip_sioctl_dstaddr, ip_sioctl_dstaddr_restart },
961 	/* 115 */ { SIOCGLIFDSTADDR, sizeof (struct lifreq),
962 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dstaddr, NULL },
963 	/* 116 */ { SIOCSLIFFLAGS, sizeof (struct lifreq),
964 			IPI_PRIV | IPI_WR,
965 			LIF_CMD, ip_sioctl_flags, ip_sioctl_flags_restart },
966 	/* 117 */ { SIOCGLIFFLAGS, sizeof (struct lifreq),
967 			IPI_GET_CMD | IPI_MODOK,
968 			LIF_CMD, ip_sioctl_get_flags, NULL },
969 
970 	/* 118 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
971 	/* 119 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
972 
973 	/* 120 */ { O_SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD,
974 			ip_sioctl_get_lifconf, NULL },
975 	/* 121 */ { SIOCSLIFMTU, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
976 			LIF_CMD, ip_sioctl_mtu, NULL },
977 	/* 122 */ { SIOCGLIFMTU, sizeof (struct lifreq), IPI_GET_CMD,
978 			LIF_CMD, ip_sioctl_get_mtu, NULL },
979 	/* 123 */ { SIOCGLIFBRDADDR, sizeof (struct lifreq),
980 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_brdaddr, NULL },
981 	/* 124 */ { SIOCSLIFBRDADDR, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
982 			LIF_CMD, ip_sioctl_brdaddr, NULL },
983 	/* 125 */ { SIOCGLIFNETMASK, sizeof (struct lifreq),
984 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_netmask, NULL },
985 	/* 126 */ { SIOCSLIFNETMASK, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
986 			LIF_CMD, ip_sioctl_netmask, ip_sioctl_netmask_restart },
987 	/* 127 */ { SIOCGLIFMETRIC, sizeof (struct lifreq),
988 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_metric, NULL },
989 	/* 128 */ { SIOCSLIFMETRIC, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
990 			LIF_CMD, ip_sioctl_metric, NULL },
991 	/* 129 */ { SIOCSLIFNAME, sizeof (struct lifreq),
992 			IPI_PRIV | IPI_WR | IPI_MODOK,
993 			LIF_CMD, ip_sioctl_slifname,
994 			ip_sioctl_slifname_restart },
995 
996 	/* 130 */ { SIOCGLIFNUM, sizeof (struct lifnum), IPI_GET_CMD,
997 			MISC_CMD, ip_sioctl_get_lifnum, NULL },
998 	/* 131 */ { SIOCGLIFMUXID, sizeof (struct lifreq),
999 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_muxid, NULL },
1000 	/* 132 */ { SIOCSLIFMUXID, sizeof (struct lifreq),
1001 			IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_muxid, NULL },
1002 	/* 133 */ { SIOCGLIFINDEX, sizeof (struct lifreq),
1003 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifindex, 0 },
1004 	/* 134 */ { SIOCSLIFINDEX, sizeof (struct lifreq),
1005 			IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifindex, 0 },
1006 	/* 135 */ { SIOCSLIFTOKEN, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1007 			LIF_CMD, ip_sioctl_token, NULL },
1008 	/* 136 */ { SIOCGLIFTOKEN, sizeof (struct lifreq),
1009 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_token, NULL },
1010 	/* 137 */ { SIOCSLIFSUBNET, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1011 			LIF_CMD, ip_sioctl_subnet, ip_sioctl_subnet_restart },
1012 	/* 138 */ { SIOCGLIFSUBNET, sizeof (struct lifreq),
1013 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_subnet, NULL },
1014 	/* 139 */ { SIOCSLIFLNKINFO, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1015 			LIF_CMD, ip_sioctl_lnkinfo, NULL },
1016 
1017 	/* 140 */ { SIOCGLIFLNKINFO, sizeof (struct lifreq),
1018 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lnkinfo, NULL },
1019 	/* 141 */ { SIOCLIFDELND, sizeof (struct lifreq), IPI_PRIV,
1020 			LIF_CMD, ip_siocdelndp_v6, NULL },
1021 	/* 142 */ { SIOCLIFGETND, sizeof (struct lifreq), IPI_GET_CMD,
1022 			LIF_CMD, ip_siocqueryndp_v6, NULL },
1023 	/* 143 */ { SIOCLIFSETND, sizeof (struct lifreq), IPI_PRIV,
1024 			LIF_CMD, ip_siocsetndp_v6, NULL },
1025 	/* 144 */ { SIOCTMYADDR, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1026 			MISC_CMD, ip_sioctl_tmyaddr, NULL },
1027 	/* 145 */ { SIOCTONLINK, sizeof (struct sioc_addrreq), IPI_GET_CMD,
1028 			MISC_CMD, ip_sioctl_tonlink, NULL },
1029 	/* 146 */ { SIOCTMYSITE, sizeof (struct sioc_addrreq), 0,
1030 			MISC_CMD, ip_sioctl_tmysite, NULL },
1031 	/* 147 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1032 	/* 148 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1033 
1034 	/* Old *IPSECONFIG ioctls are now deprecated, now see spdsock.c */
1035 	/* 149 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1036 	/* 150 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1037 	/* 151 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1038 	/* 152 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1039 
1040 	/* 153 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1041 
1042 	/* 154 */ { SIOCGLIFBINDING, sizeof (struct lifreq), IPI_GET_CMD,
1043 			LIF_CMD, ip_sioctl_get_binding, NULL },
1044 	/* 155 */ { SIOCSLIFGROUPNAME, sizeof (struct lifreq),
1045 			IPI_PRIV | IPI_WR,
1046 			LIF_CMD, ip_sioctl_groupname, ip_sioctl_groupname },
1047 	/* 156 */ { SIOCGLIFGROUPNAME, sizeof (struct lifreq),
1048 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_groupname, NULL },
1049 	/* 157 */ { SIOCGLIFGROUPINFO, sizeof (lifgroupinfo_t),
1050 			IPI_GET_CMD, MISC_CMD, ip_sioctl_groupinfo, NULL },
1051 
1052 	/* Leave 158-160 unused; used to be SIOC*IFARP ioctls */
1053 	/* 158 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1054 	/* 159 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1055 	/* 160 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1056 
1057 	/* 161 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1058 
1059 	/* These are handled in ip_sioctl_copyin_setup itself */
1060 	/* 162 */ { SIOCGIP6ADDRPOLICY, 0, IPI_NULL_BCONT,
1061 			MISC_CMD, NULL, NULL },
1062 	/* 163 */ { SIOCSIP6ADDRPOLICY, 0, IPI_PRIV | IPI_NULL_BCONT,
1063 			MISC_CMD, NULL, NULL },
1064 	/* 164 */ { SIOCGDSTINFO, 0, IPI_GET_CMD, MISC_CMD, NULL, NULL },
1065 
1066 	/* 165 */ { SIOCGLIFCONF, 0, IPI_GET_CMD, MISC_CMD,
1067 			ip_sioctl_get_lifconf, NULL },
1068 
1069 	/* 166 */ { SIOCSXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR,
1070 			XARP_CMD, ip_sioctl_arp, NULL },
1071 	/* 167 */ { SIOCGXARP, sizeof (struct xarpreq), IPI_GET_CMD,
1072 			XARP_CMD, ip_sioctl_arp, NULL },
1073 	/* 168 */ { SIOCDXARP, sizeof (struct xarpreq), IPI_PRIV | IPI_WR,
1074 			XARP_CMD, ip_sioctl_arp, NULL },
1075 
1076 	/* SIOCPOPSOCKFS is not handled by IP */
1077 	/* 169 */ { IPI_DONTCARE /* SIOCPOPSOCKFS */, 0, 0, 0, NULL, NULL },
1078 
1079 	/* 170 */ { SIOCGLIFZONE, sizeof (struct lifreq),
1080 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_lifzone, NULL },
1081 	/* 171 */ { SIOCSLIFZONE, sizeof (struct lifreq),
1082 			IPI_PRIV | IPI_WR, LIF_CMD, ip_sioctl_slifzone,
1083 			ip_sioctl_slifzone_restart },
1084 	/* 172-174 are SCTP ioctls and not handled by IP */
1085 	/* 172 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1086 	/* 173 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1087 	/* 174 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1088 	/* 175 */ { SIOCGLIFUSESRC, sizeof (struct lifreq),
1089 			IPI_GET_CMD, LIF_CMD,
1090 			ip_sioctl_get_lifusesrc, 0 },
1091 	/* 176 */ { SIOCSLIFUSESRC, sizeof (struct lifreq),
1092 			IPI_PRIV | IPI_WR,
1093 			LIF_CMD, ip_sioctl_slifusesrc,
1094 			NULL },
1095 	/* 177 */ { SIOCGLIFSRCOF, 0, IPI_GET_CMD, MISC_CMD,
1096 			ip_sioctl_get_lifsrcof, NULL },
1097 	/* 178 */ { SIOCGMSFILTER, sizeof (struct group_filter), IPI_GET_CMD,
1098 			MSFILT_CMD, ip_sioctl_msfilter, NULL },
1099 	/* 179 */ { SIOCSMSFILTER, sizeof (struct group_filter), 0,
1100 			MSFILT_CMD, ip_sioctl_msfilter, NULL },
1101 	/* 180 */ { SIOCGIPMSFILTER, sizeof (struct ip_msfilter), IPI_GET_CMD,
1102 			MSFILT_CMD, ip_sioctl_msfilter, NULL },
1103 	/* 181 */ { SIOCSIPMSFILTER, sizeof (struct ip_msfilter), 0,
1104 			MSFILT_CMD, ip_sioctl_msfilter, NULL },
1105 	/* 182 */ { IPI_DONTCARE, 0, 0, 0, NULL, NULL },
1106 	/* SIOCSENABLESDP is handled by SDP */
1107 	/* 183 */ { IPI_DONTCARE /* SIOCSENABLESDP */, 0, 0, 0, NULL, NULL },
1108 	/* 184 */ { IPI_DONTCARE /* SIOCSQPTR */, 0, 0, 0, NULL, NULL },
1109 	/* 185 */ { SIOCGIFHWADDR, sizeof (struct ifreq), IPI_GET_CMD,
1110 			IF_CMD, ip_sioctl_get_ifhwaddr, NULL },
1111 	/* 186 */ { IPI_DONTCARE /* SIOCGSTAMP */, 0, 0, 0, NULL, NULL },
1112 	/* 187 */ { SIOCILB, 0, IPI_PRIV | IPI_GET_CMD, MISC_CMD,
1113 			ip_sioctl_ilb_cmd, NULL },
1114 	/* 188 */ { SIOCGETPROP, 0, IPI_GET_CMD, 0, NULL, NULL },
1115 	/* 189 */ { SIOCSETPROP, 0, IPI_PRIV | IPI_WR, 0, NULL, NULL},
1116 	/* 190 */ { SIOCGLIFDADSTATE, sizeof (struct lifreq),
1117 			IPI_GET_CMD, LIF_CMD, ip_sioctl_get_dadstate, NULL },
1118 	/* 191 */ { SIOCSLIFPREFIX, sizeof (struct lifreq), IPI_PRIV | IPI_WR,
1119 			LIF_CMD, ip_sioctl_prefix, ip_sioctl_prefix_restart },
1120 	/* 192 */ { SIOCGLIFHWADDR, sizeof (struct lifreq), IPI_GET_CMD,
1121 			LIF_CMD, ip_sioctl_get_lifhwaddr, NULL }
1122 };
1123 
1124 int ip_ndx_ioctl_count = sizeof (ip_ndx_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1125 
1126 ip_ioctl_cmd_t ip_misc_ioctl_table[] = {
1127 	{ I_LINK,	0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1128 	{ I_UNLINK,	0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1129 	{ I_PLINK,	0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1130 	{ I_PUNLINK,	0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1131 	{ ND_GET,	0, 0, 0, NULL, NULL },
1132 	{ ND_SET,	0, IPI_PRIV | IPI_WR, 0, NULL, NULL },
1133 	{ IP_IOCTL,	0, 0, 0, NULL, NULL },
1134 	{ SIOCGETVIFCNT, sizeof (struct sioc_vif_req), IPI_GET_CMD,
1135 		MISC_CMD, mrt_ioctl},
1136 	{ SIOCGETSGCNT,	sizeof (struct sioc_sg_req), IPI_GET_CMD,
1137 		MISC_CMD, mrt_ioctl},
1138 	{ SIOCGETLSGCNT, sizeof (struct sioc_lsg_req), IPI_GET_CMD,
1139 		MISC_CMD, mrt_ioctl}
1140 };
1141 
1142 int ip_misc_ioctl_count =
1143     sizeof (ip_misc_ioctl_table) / sizeof (ip_ioctl_cmd_t);
1144 
1145 int	conn_drain_nthreads;		/* Number of drainers reqd. */
1146 					/* Settable in /etc/system */
1147 /* Defined in ip_ire.c */
1148 extern uint32_t ip_ire_max_bucket_cnt, ip6_ire_max_bucket_cnt;
1149 extern uint32_t ip_ire_min_bucket_cnt, ip6_ire_min_bucket_cnt;
1150 extern uint32_t ip_ire_mem_ratio, ip_ire_cpu_ratio;
1151 
1152 static nv_t	ire_nv_arr[] = {
1153 	{ IRE_BROADCAST, "BROADCAST" },
1154 	{ IRE_LOCAL, "LOCAL" },
1155 	{ IRE_LOOPBACK, "LOOPBACK" },
1156 	{ IRE_DEFAULT, "DEFAULT" },
1157 	{ IRE_PREFIX, "PREFIX" },
1158 	{ IRE_IF_NORESOLVER, "IF_NORESOL" },
1159 	{ IRE_IF_RESOLVER, "IF_RESOLV" },
1160 	{ IRE_IF_CLONE, "IF_CLONE" },
1161 	{ IRE_HOST, "HOST" },
1162 	{ IRE_MULTICAST, "MULTICAST" },
1163 	{ IRE_NOROUTE, "NOROUTE" },
1164 	{ 0 }
1165 };
1166 
1167 nv_t	*ire_nv_tbl = ire_nv_arr;
1168 
1169 /* Simple ICMP IP Header Template */
1170 static ipha_t icmp_ipha = {
1171 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
1172 };
1173 
1174 struct module_info ip_mod_info = {
1175 	IP_MOD_ID, IP_MOD_NAME, IP_MOD_MINPSZ, IP_MOD_MAXPSZ, IP_MOD_HIWAT,
1176 	IP_MOD_LOWAT
1177 };
1178 
1179 /*
1180  * Duplicate static symbols within a module confuses mdb; so we avoid the
1181  * problem by making the symbols here distinct from those in udp.c.
1182  */
1183 
1184 /*
1185  * Entry points for IP as a device and as a module.
1186  * We have separate open functions for the /dev/ip and /dev/ip6 devices.
1187  */
1188 static struct qinit iprinitv4 = {
1189 	ip_rput, NULL, ip_openv4, ip_close, NULL, &ip_mod_info
1190 };
1191 
1192 struct qinit iprinitv6 = {
1193 	ip_rput_v6, NULL, ip_openv6, ip_close, NULL, &ip_mod_info
1194 };
1195 
1196 static struct qinit ipwinit = {
1197 	ip_wput_nondata, ip_wsrv, NULL, NULL, NULL, &ip_mod_info
1198 };
1199 
1200 static struct qinit iplrinit = {
1201 	ip_lrput, NULL, ip_openv4, ip_close, NULL, &ip_mod_info
1202 };
1203 
1204 static struct qinit iplwinit = {
1205 	ip_lwput, NULL, NULL, NULL, NULL, &ip_mod_info
1206 };
1207 
1208 /* For AF_INET aka /dev/ip */
1209 struct streamtab ipinfov4 = {
1210 	&iprinitv4, &ipwinit, &iplrinit, &iplwinit
1211 };
1212 
1213 /* For AF_INET6 aka /dev/ip6 */
1214 struct streamtab ipinfov6 = {
1215 	&iprinitv6, &ipwinit, &iplrinit, &iplwinit
1216 };
1217 
1218 #ifdef	DEBUG
1219 boolean_t skip_sctp_cksum = B_FALSE;
1220 #endif
1221 
1222 /*
1223  * Generate an ICMP fragmentation needed message.
1224  * When called from ip_output side a minimal ip_recv_attr_t needs to be
1225  * constructed by the caller.
1226  */
1227 void
icmp_frag_needed(mblk_t * mp,int mtu,ip_recv_attr_t * ira)1228 icmp_frag_needed(mblk_t *mp, int mtu, ip_recv_attr_t *ira)
1229 {
1230 	icmph_t	icmph;
1231 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
1232 
1233 	mp = icmp_pkt_err_ok(mp, ira);
1234 	if (mp == NULL)
1235 		return;
1236 
1237 	bzero(&icmph, sizeof (icmph_t));
1238 	icmph.icmph_type = ICMP_DEST_UNREACHABLE;
1239 	icmph.icmph_code = ICMP_FRAGMENTATION_NEEDED;
1240 	icmph.icmph_du_mtu = htons((uint16_t)mtu);
1241 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutFragNeeded);
1242 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs);
1243 
1244 	icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
1245 }
1246 
1247 /*
1248  * icmp_inbound_v4 deals with ICMP messages that are handled by IP.
1249  * If the ICMP message is consumed by IP, i.e., it should not be delivered
1250  * to any IPPROTO_ICMP raw sockets, then it returns NULL.
1251  * Likewise, if the ICMP error is misformed (too short, etc), then it
1252  * returns NULL. The caller uses this to determine whether or not to send
1253  * to raw sockets.
1254  *
1255  * All error messages are passed to the matching transport stream.
1256  *
1257  * The following cases are handled by icmp_inbound:
1258  * 1) It needs to send a reply back and possibly delivering it
1259  *    to the "interested" upper clients.
1260  * 2) Return the mblk so that the caller can pass it to the RAW socket clients.
1261  * 3) It needs to change some values in IP only.
1262  * 4) It needs to change some values in IP and upper layers e.g TCP
1263  *    by delivering an error to the upper layers.
1264  *
1265  * We handle the above three cases in the context of IPsec in the
1266  * following way :
1267  *
1268  * 1) Send the reply back in the same way as the request came in.
1269  *    If it came in encrypted, it goes out encrypted. If it came in
1270  *    clear, it goes out in clear. Thus, this will prevent chosen
1271  *    plain text attack.
1272  * 2) The client may or may not expect things to come in secure.
1273  *    If it comes in secure, the policy constraints are checked
1274  *    before delivering it to the upper layers. If it comes in
1275  *    clear, ipsec_inbound_accept_clear will decide whether to
1276  *    accept this in clear or not. In both the cases, if the returned
1277  *    message (IP header + 8 bytes) that caused the icmp message has
1278  *    AH/ESP headers, it is sent up to AH/ESP for validation before
1279  *    sending up. If there are only 8 bytes of returned message, then
1280  *    upper client will not be notified.
1281  * 3) Check with global policy to see whether it matches the constaints.
1282  *    But this will be done only if icmp_accept_messages_in_clear is
1283  *    zero.
1284  * 4) If we need to change both in IP and ULP, then the decision taken
1285  *    while affecting the values in IP and while delivering up to TCP
1286  *    should be the same.
1287  *
1288  *	There are two cases.
1289  *
1290  *	a) If we reject data at the IP layer (ipsec_check_global_policy()
1291  *	   failed), we will not deliver it to the ULP, even though they
1292  *	   are *willing* to accept in *clear*. This is fine as our global
1293  *	   disposition to icmp messages asks us reject the datagram.
1294  *
1295  *	b) If we accept data at the IP layer (ipsec_check_global_policy()
1296  *	   succeeded or icmp_accept_messages_in_clear is 1), and not able
1297  *	   to deliver it to ULP (policy failed), it can lead to
1298  *	   consistency problems. The cases known at this time are
1299  *	   ICMP_DESTINATION_UNREACHABLE  messages with following code
1300  *	   values :
1301  *
1302  *	   - ICMP_FRAGMENTATION_NEEDED : IP adapts to the new value
1303  *	     and Upper layer rejects. Then the communication will
1304  *	     come to a stop. This is solved by making similar decisions
1305  *	     at both levels. Currently, when we are unable to deliver
1306  *	     to the Upper Layer (due to policy failures) while IP has
1307  *	     adjusted dce_pmtu, the next outbound datagram would
1308  *	     generate a local ICMP_FRAGMENTATION_NEEDED message - which
1309  *	     will be with the right level of protection. Thus the right
1310  *	     value will be communicated even if we are not able to
1311  *	     communicate when we get from the wire initially. But this
1312  *	     assumes there would be at least one outbound datagram after
1313  *	     IP has adjusted its dce_pmtu value. To make things
1314  *	     simpler, we accept in clear after the validation of
1315  *	     AH/ESP headers.
1316  *
1317  *	   - Other ICMP ERRORS : We may not be able to deliver it to the
1318  *	     upper layer depending on the level of protection the upper
1319  *	     layer expects and the disposition in ipsec_inbound_accept_clear().
1320  *	     ipsec_inbound_accept_clear() decides whether a given ICMP error
1321  *	     should be accepted in clear when the Upper layer expects secure.
1322  *	     Thus the communication may get aborted by some bad ICMP
1323  *	     packets.
1324  */
1325 mblk_t *
icmp_inbound_v4(mblk_t * mp,ip_recv_attr_t * ira)1326 icmp_inbound_v4(mblk_t *mp, ip_recv_attr_t *ira)
1327 {
1328 	icmph_t		*icmph;
1329 	ipha_t		*ipha;		/* Outer header */
1330 	int		ip_hdr_length;	/* Outer header length */
1331 	boolean_t	interested;
1332 	ipif_t		*ipif;
1333 	uint32_t	ts;
1334 	uint32_t	*tsp;
1335 	timestruc_t	now;
1336 	ill_t		*ill = ira->ira_ill;
1337 	ip_stack_t	*ipst = ill->ill_ipst;
1338 	zoneid_t	zoneid = ira->ira_zoneid;
1339 	int		len_needed;
1340 	mblk_t		*mp_ret = NULL;
1341 
1342 	ipha = (ipha_t *)mp->b_rptr;
1343 
1344 	BUMP_MIB(&ipst->ips_icmp_mib, icmpInMsgs);
1345 
1346 	ip_hdr_length = ira->ira_ip_hdr_length;
1347 	if ((mp->b_wptr - mp->b_rptr) < (ip_hdr_length + ICMPH_SIZE)) {
1348 		if (ira->ira_pktlen < (ip_hdr_length + ICMPH_SIZE)) {
1349 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
1350 			ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
1351 			freemsg(mp);
1352 			return (NULL);
1353 		}
1354 		/* Last chance to get real. */
1355 		ipha = ip_pullup(mp, ip_hdr_length + ICMPH_SIZE, ira);
1356 		if (ipha == NULL) {
1357 			BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
1358 			freemsg(mp);
1359 			return (NULL);
1360 		}
1361 	}
1362 
1363 	/* The IP header will always be a multiple of four bytes */
1364 	icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1365 	ip2dbg(("icmp_inbound_v4: type %d code %d\n", icmph->icmph_type,
1366 	    icmph->icmph_code));
1367 
1368 	/*
1369 	 * We will set "interested" to "true" if we should pass a copy to
1370 	 * the transport or if we handle the packet locally.
1371 	 */
1372 	interested = B_FALSE;
1373 	switch (icmph->icmph_type) {
1374 	case ICMP_ECHO_REPLY:
1375 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchoReps);
1376 		break;
1377 	case ICMP_DEST_UNREACHABLE:
1378 		if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED)
1379 			BUMP_MIB(&ipst->ips_icmp_mib, icmpInFragNeeded);
1380 		interested = B_TRUE;	/* Pass up to transport */
1381 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInDestUnreachs);
1382 		break;
1383 	case ICMP_SOURCE_QUENCH:
1384 		interested = B_TRUE;	/* Pass up to transport */
1385 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInSrcQuenchs);
1386 		break;
1387 	case ICMP_REDIRECT:
1388 		if (!ipst->ips_ip_ignore_redirect)
1389 			interested = B_TRUE;
1390 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInRedirects);
1391 		break;
1392 	case ICMP_ECHO_REQUEST:
1393 		/*
1394 		 * Whether to respond to echo requests that come in as IP
1395 		 * broadcasts or as IP multicast is subject to debate
1396 		 * (what isn't?).  We aim to please, you pick it.
1397 		 * Default is do it.
1398 		 */
1399 		if (ira->ira_flags & IRAF_MULTICAST) {
1400 			/* multicast: respond based on tunable */
1401 			interested = ipst->ips_ip_g_resp_to_echo_mcast;
1402 		} else if (ira->ira_flags & IRAF_BROADCAST) {
1403 			/* broadcast: respond based on tunable */
1404 			interested = ipst->ips_ip_g_resp_to_echo_bcast;
1405 		} else {
1406 			/* unicast: always respond */
1407 			interested = B_TRUE;
1408 		}
1409 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInEchos);
1410 		if (!interested) {
1411 			/* We never pass these to RAW sockets */
1412 			freemsg(mp);
1413 			return (NULL);
1414 		}
1415 
1416 		/* Check db_ref to make sure we can modify the packet. */
1417 		if (mp->b_datap->db_ref > 1) {
1418 			mblk_t	*mp1;
1419 
1420 			mp1 = copymsg(mp);
1421 			freemsg(mp);
1422 			if (!mp1) {
1423 				BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1424 				return (NULL);
1425 			}
1426 			mp = mp1;
1427 			ipha = (ipha_t *)mp->b_rptr;
1428 			icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1429 		}
1430 		icmph->icmph_type = ICMP_ECHO_REPLY;
1431 		BUMP_MIB(&ipst->ips_icmp_mib, icmpOutEchoReps);
1432 		icmp_send_reply_v4(mp, ipha, icmph, ira);
1433 		return (NULL);
1434 
1435 	case ICMP_ROUTER_ADVERTISEMENT:
1436 	case ICMP_ROUTER_SOLICITATION:
1437 		break;
1438 	case ICMP_TIME_EXCEEDED:
1439 		interested = B_TRUE;	/* Pass up to transport */
1440 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimeExcds);
1441 		break;
1442 	case ICMP_PARAM_PROBLEM:
1443 		interested = B_TRUE;	/* Pass up to transport */
1444 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInParmProbs);
1445 		break;
1446 	case ICMP_TIME_STAMP_REQUEST:
1447 		/* Response to Time Stamp Requests is local policy. */
1448 		if (ipst->ips_ip_g_resp_to_timestamp) {
1449 			if (ira->ira_flags & IRAF_MULTIBROADCAST)
1450 				interested =
1451 				    ipst->ips_ip_g_resp_to_timestamp_bcast;
1452 			else
1453 				interested = B_TRUE;
1454 		}
1455 		if (!interested) {
1456 			/* We never pass these to RAW sockets */
1457 			freemsg(mp);
1458 			return (NULL);
1459 		}
1460 
1461 		/* Make sure we have enough of the packet */
1462 		len_needed = ip_hdr_length + ICMPH_SIZE +
1463 		    3 * sizeof (uint32_t);
1464 
1465 		if (mp->b_wptr - mp->b_rptr < len_needed) {
1466 			ipha = ip_pullup(mp, len_needed, ira);
1467 			if (ipha == NULL) {
1468 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1469 				ip_drop_input("ipIfStatsInDiscards - ip_pullup",
1470 				    mp, ill);
1471 				freemsg(mp);
1472 				return (NULL);
1473 			}
1474 			/* Refresh following the pullup. */
1475 			icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1476 		}
1477 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestamps);
1478 		/* Check db_ref to make sure we can modify the packet. */
1479 		if (mp->b_datap->db_ref > 1) {
1480 			mblk_t	*mp1;
1481 
1482 			mp1 = copymsg(mp);
1483 			freemsg(mp);
1484 			if (!mp1) {
1485 				BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1486 				return (NULL);
1487 			}
1488 			mp = mp1;
1489 			ipha = (ipha_t *)mp->b_rptr;
1490 			icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1491 		}
1492 		icmph->icmph_type = ICMP_TIME_STAMP_REPLY;
1493 		tsp = (uint32_t *)&icmph[1];
1494 		tsp++;		/* Skip past 'originate time' */
1495 		/* Compute # of milliseconds since midnight */
1496 		gethrestime(&now);
1497 		ts = (now.tv_sec % (24 * 60 * 60)) * 1000 +
1498 		    NSEC2MSEC(now.tv_nsec);
1499 		*tsp++ = htonl(ts);	/* Lay in 'receive time' */
1500 		*tsp++ = htonl(ts);	/* Lay in 'send time' */
1501 		BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimestampReps);
1502 		icmp_send_reply_v4(mp, ipha, icmph, ira);
1503 		return (NULL);
1504 
1505 	case ICMP_TIME_STAMP_REPLY:
1506 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInTimestampReps);
1507 		break;
1508 	case ICMP_INFO_REQUEST:
1509 		/* Per RFC 1122 3.2.2.7, ignore this. */
1510 	case ICMP_INFO_REPLY:
1511 		break;
1512 	case ICMP_ADDRESS_MASK_REQUEST:
1513 		if (ira->ira_flags & IRAF_MULTIBROADCAST) {
1514 			interested =
1515 			    ipst->ips_ip_respond_to_address_mask_broadcast;
1516 		} else {
1517 			interested = B_TRUE;
1518 		}
1519 		if (!interested) {
1520 			/* We never pass these to RAW sockets */
1521 			freemsg(mp);
1522 			return (NULL);
1523 		}
1524 		len_needed = ip_hdr_length + ICMPH_SIZE + IP_ADDR_LEN;
1525 		if (mp->b_wptr - mp->b_rptr < len_needed) {
1526 			ipha = ip_pullup(mp, len_needed, ira);
1527 			if (ipha == NULL) {
1528 				BUMP_MIB(ill->ill_ip_mib,
1529 				    ipIfStatsInTruncatedPkts);
1530 				ip_drop_input("ipIfStatsInTruncatedPkts", mp,
1531 				    ill);
1532 				freemsg(mp);
1533 				return (NULL);
1534 			}
1535 			/* Refresh following the pullup. */
1536 			icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1537 		}
1538 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMasks);
1539 		/* Check db_ref to make sure we can modify the packet. */
1540 		if (mp->b_datap->db_ref > 1) {
1541 			mblk_t	*mp1;
1542 
1543 			mp1 = copymsg(mp);
1544 			freemsg(mp);
1545 			if (!mp1) {
1546 				BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
1547 				return (NULL);
1548 			}
1549 			mp = mp1;
1550 			ipha = (ipha_t *)mp->b_rptr;
1551 			icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1552 		}
1553 		/*
1554 		 * Need the ipif with the mask be the same as the source
1555 		 * address of the mask reply. For unicast we have a specific
1556 		 * ipif. For multicast/broadcast we only handle onlink
1557 		 * senders, and use the source address to pick an ipif.
1558 		 */
1559 		ipif = ipif_lookup_addr(ipha->ipha_dst, ill, zoneid, ipst);
1560 		if (ipif == NULL) {
1561 			/* Broadcast or multicast */
1562 			ipif = ipif_lookup_remote(ill, ipha->ipha_src, zoneid);
1563 			if (ipif == NULL) {
1564 				freemsg(mp);
1565 				return (NULL);
1566 			}
1567 		}
1568 		icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
1569 		bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
1570 		ipif_refrele(ipif);
1571 		BUMP_MIB(&ipst->ips_icmp_mib, icmpOutAddrMaskReps);
1572 		icmp_send_reply_v4(mp, ipha, icmph, ira);
1573 		return (NULL);
1574 
1575 	case ICMP_ADDRESS_MASK_REPLY:
1576 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInAddrMaskReps);
1577 		break;
1578 	default:
1579 		interested = B_TRUE;	/* Pass up to transport */
1580 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInUnknowns);
1581 		break;
1582 	}
1583 	/*
1584 	 * See if there is an ICMP client to avoid an extra copymsg/freemsg
1585 	 * if there isn't one.
1586 	 */
1587 	if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_ICMP].connf_head != NULL) {
1588 		/* If there is an ICMP client and we want one too, copy it. */
1589 
1590 		if (!interested) {
1591 			/* Caller will deliver to RAW sockets */
1592 			return (mp);
1593 		}
1594 		mp_ret = copymsg(mp);
1595 		if (mp_ret == NULL) {
1596 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1597 			ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill);
1598 		}
1599 	} else if (!interested) {
1600 		/* Neither we nor raw sockets are interested. Drop packet now */
1601 		freemsg(mp);
1602 		return (NULL);
1603 	}
1604 
1605 	/*
1606 	 * ICMP error or redirect packet. Make sure we have enough of
1607 	 * the header and that db_ref == 1 since we might end up modifying
1608 	 * the packet.
1609 	 */
1610 	if (mp->b_cont != NULL) {
1611 		if (ip_pullup(mp, -1, ira) == NULL) {
1612 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1613 			ip_drop_input("ipIfStatsInDiscards - ip_pullup",
1614 			    mp, ill);
1615 			freemsg(mp);
1616 			return (mp_ret);
1617 		}
1618 	}
1619 
1620 	if (mp->b_datap->db_ref > 1) {
1621 		mblk_t	*mp1;
1622 
1623 		mp1 = copymsg(mp);
1624 		if (mp1 == NULL) {
1625 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1626 			ip_drop_input("ipIfStatsInDiscards - copymsg", mp, ill);
1627 			freemsg(mp);
1628 			return (mp_ret);
1629 		}
1630 		freemsg(mp);
1631 		mp = mp1;
1632 	}
1633 
1634 	/*
1635 	 * In case mp has changed, verify the message before any further
1636 	 * processes.
1637 	 */
1638 	ipha = (ipha_t *)mp->b_rptr;
1639 	icmph = (icmph_t *)&mp->b_rptr[ip_hdr_length];
1640 	if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
1641 		freemsg(mp);
1642 		return (mp_ret);
1643 	}
1644 
1645 	switch (icmph->icmph_type) {
1646 	case ICMP_REDIRECT:
1647 		icmp_redirect_v4(mp, ipha, icmph, ira);
1648 		break;
1649 	case ICMP_DEST_UNREACHABLE:
1650 		if (icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED) {
1651 			/* Update DCE and adjust MTU is icmp header if needed */
1652 			icmp_inbound_too_big_v4(icmph, ira);
1653 		}
1654 		/* FALLTHROUGH */
1655 	default:
1656 		icmp_inbound_error_fanout_v4(mp, icmph, ira);
1657 		break;
1658 	}
1659 	return (mp_ret);
1660 }
1661 
1662 /*
1663  * Send an ICMP echo, timestamp or address mask reply.
1664  * The caller has already updated the payload part of the packet.
1665  * We handle the ICMP checksum, IP source address selection and feed
1666  * the packet into ip_output_simple.
1667  */
1668 static void
icmp_send_reply_v4(mblk_t * mp,ipha_t * ipha,icmph_t * icmph,ip_recv_attr_t * ira)1669 icmp_send_reply_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph,
1670     ip_recv_attr_t *ira)
1671 {
1672 	uint_t		ip_hdr_length = ira->ira_ip_hdr_length;
1673 	ill_t		*ill = ira->ira_ill;
1674 	ip_stack_t	*ipst = ill->ill_ipst;
1675 	ip_xmit_attr_t	ixas;
1676 
1677 	/* Send out an ICMP packet */
1678 	icmph->icmph_checksum = 0;
1679 	icmph->icmph_checksum = IP_CSUM(mp, ip_hdr_length, 0);
1680 	/* Reset time to live. */
1681 	ipha->ipha_ttl = ipst->ips_ip_def_ttl;
1682 	{
1683 		/* Swap source and destination addresses */
1684 		ipaddr_t tmp;
1685 
1686 		tmp = ipha->ipha_src;
1687 		ipha->ipha_src = ipha->ipha_dst;
1688 		ipha->ipha_dst = tmp;
1689 	}
1690 	ipha->ipha_ident = 0;
1691 	if (!IS_SIMPLE_IPH(ipha))
1692 		icmp_options_update(ipha);
1693 
1694 	bzero(&ixas, sizeof (ixas));
1695 	ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
1696 	ixas.ixa_zoneid = ira->ira_zoneid;
1697 	ixas.ixa_cred = kcred;
1698 	ixas.ixa_cpid = NOPID;
1699 	ixas.ixa_tsl = ira->ira_tsl;	/* Behave as a multi-level responder */
1700 	ixas.ixa_ifindex = 0;
1701 	ixas.ixa_ipst = ipst;
1702 	ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1703 
1704 	if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
1705 		/*
1706 		 * This packet should go out the same way as it
1707 		 * came in i.e in clear, independent of the IPsec policy
1708 		 * for transmitting packets.
1709 		 */
1710 		ixas.ixa_flags |= IXAF_NO_IPSEC;
1711 	} else {
1712 		if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) {
1713 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1714 			/* Note: mp already consumed and ip_drop_packet done */
1715 			return;
1716 		}
1717 	}
1718 	if (ira->ira_flags & IRAF_MULTIBROADCAST) {
1719 		/*
1720 		 * Not one or our addresses (IRE_LOCALs), thus we let
1721 		 * ip_output_simple pick the source.
1722 		 */
1723 		ipha->ipha_src = INADDR_ANY;
1724 		ixas.ixa_flags |= IXAF_SET_SOURCE;
1725 	}
1726 	/* Should we send with DF and use dce_pmtu? */
1727 	if (ipst->ips_ipv4_icmp_return_pmtu) {
1728 		ixas.ixa_flags |= IXAF_PMTU_DISCOVERY;
1729 		ipha->ipha_fragment_offset_and_flags |= IPH_DF_HTONS;
1730 	}
1731 
1732 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs);
1733 
1734 	(void) ip_output_simple(mp, &ixas);
1735 	ixa_cleanup(&ixas);
1736 }
1737 
1738 /*
1739  * Verify the ICMP messages for either for ICMP error or redirect packet.
1740  * The caller should have fully pulled up the message. If it's a redirect
1741  * packet, only basic checks on IP header will be done; otherwise, verify
1742  * the packet by looking at the included ULP header.
1743  *
1744  * Called before icmp_inbound_error_fanout_v4 is called.
1745  */
1746 static boolean_t
icmp_inbound_verify_v4(mblk_t * mp,icmph_t * icmph,ip_recv_attr_t * ira)1747 icmp_inbound_verify_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira)
1748 {
1749 	ill_t		*ill = ira->ira_ill;
1750 	int		hdr_length;
1751 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
1752 	conn_t		*connp;
1753 	ipha_t		*ipha;	/* Inner IP header */
1754 
1755 	ipha = (ipha_t *)&icmph[1];
1756 	if ((uchar_t *)ipha + IP_SIMPLE_HDR_LENGTH > mp->b_wptr)
1757 		goto truncated;
1758 
1759 	hdr_length = IPH_HDR_LENGTH(ipha);
1760 
1761 	if ((IPH_HDR_VERSION(ipha) != IPV4_VERSION))
1762 		goto discard_pkt;
1763 
1764 	if (hdr_length < sizeof (ipha_t))
1765 		goto truncated;
1766 
1767 	if ((uchar_t *)ipha + hdr_length > mp->b_wptr)
1768 		goto truncated;
1769 
1770 	/*
1771 	 * Stop here for ICMP_REDIRECT.
1772 	 */
1773 	if (icmph->icmph_type == ICMP_REDIRECT)
1774 		return (B_TRUE);
1775 
1776 	/*
1777 	 * ICMP errors only.
1778 	 */
1779 	switch (ipha->ipha_protocol) {
1780 	case IPPROTO_UDP:
1781 		/*
1782 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1783 		 * transport header.
1784 		 */
1785 		if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1786 		    mp->b_wptr)
1787 			goto truncated;
1788 		break;
1789 	case IPPROTO_TCP: {
1790 		tcpha_t		*tcpha;
1791 
1792 		/*
1793 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1794 		 * transport header.
1795 		 */
1796 		if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1797 		    mp->b_wptr)
1798 			goto truncated;
1799 
1800 		tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length);
1801 		connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN,
1802 		    ipst);
1803 		if (connp == NULL)
1804 			goto discard_pkt;
1805 
1806 		if ((connp->conn_verifyicmp != NULL) &&
1807 		    !connp->conn_verifyicmp(connp, tcpha, icmph, NULL, ira)) {
1808 			CONN_DEC_REF(connp);
1809 			goto discard_pkt;
1810 		}
1811 		CONN_DEC_REF(connp);
1812 		break;
1813 	}
1814 	case IPPROTO_SCTP:
1815 		/*
1816 		 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
1817 		 * transport header.
1818 		 */
1819 		if ((uchar_t *)ipha + hdr_length + ICMP_MIN_TP_HDR_LEN >
1820 		    mp->b_wptr)
1821 			goto truncated;
1822 		break;
1823 	case IPPROTO_ESP:
1824 	case IPPROTO_AH:
1825 		break;
1826 	case IPPROTO_ENCAP:
1827 		if ((uchar_t *)ipha + hdr_length + sizeof (ipha_t) >
1828 		    mp->b_wptr)
1829 			goto truncated;
1830 		break;
1831 	default:
1832 		break;
1833 	}
1834 
1835 	return (B_TRUE);
1836 
1837 discard_pkt:
1838 	/* Bogus ICMP error. */
1839 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1840 	return (B_FALSE);
1841 
1842 truncated:
1843 	/* We pulled up everthing already. Must be truncated */
1844 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
1845 	ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
1846 	return (B_FALSE);
1847 }
1848 
1849 /* Table from RFC 1191 */
1850 static int icmp_frag_size_table[] =
1851 { 32000, 17914, 8166, 4352, 2002, 1496, 1006, 508, 296, 68 };
1852 
1853 /*
1854  * Process received ICMP Packet too big.
1855  * Just handles the DCE create/update, including using the above table of
1856  * PMTU guesses. The caller is responsible for validating the packet before
1857  * passing it in and also to fanout the ICMP error to any matching transport
1858  * conns. Assumes the message has been fully pulled up and verified.
1859  *
1860  * Before getting here, the caller has called icmp_inbound_verify_v4()
1861  * that should have verified with ULP to prevent undoing the changes we're
1862  * going to make to DCE. For example, TCP might have verified that the packet
1863  * which generated error is in the send window.
1864  *
1865  * In some cases modified this MTU in the ICMP header packet; the caller
1866  * should pass to the matching ULP after this returns.
1867  */
1868 static void
icmp_inbound_too_big_v4(icmph_t * icmph,ip_recv_attr_t * ira)1869 icmp_inbound_too_big_v4(icmph_t *icmph, ip_recv_attr_t *ira)
1870 {
1871 	dce_t		*dce;
1872 	int		old_mtu;
1873 	int		mtu, orig_mtu;
1874 	ipaddr_t	dst;
1875 	boolean_t	disable_pmtud;
1876 	ill_t		*ill = ira->ira_ill;
1877 	ip_stack_t	*ipst = ill->ill_ipst;
1878 	uint_t		hdr_length;
1879 	ipha_t		*ipha;
1880 
1881 	/* Caller already pulled up everything. */
1882 	ipha = (ipha_t *)&icmph[1];
1883 	ASSERT(icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
1884 	    icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED);
1885 	ASSERT(ill != NULL);
1886 
1887 	hdr_length = IPH_HDR_LENGTH(ipha);
1888 
1889 	/*
1890 	 * We handle path MTU for source routed packets since the DCE
1891 	 * is looked up using the final destination.
1892 	 */
1893 	dst = ip_get_dst(ipha);
1894 
1895 	dce = dce_lookup_and_add_v4(dst, ipst);
1896 	if (dce == NULL) {
1897 		/* Couldn't add a unique one - ENOMEM */
1898 		ip1dbg(("icmp_inbound_too_big_v4: no dce for 0x%x\n",
1899 		    ntohl(dst)));
1900 		return;
1901 	}
1902 
1903 	/* Check for MTU discovery advice as described in RFC 1191 */
1904 	mtu = ntohs(icmph->icmph_du_mtu);
1905 	orig_mtu = mtu;
1906 	disable_pmtud = B_FALSE;
1907 
1908 	mutex_enter(&dce->dce_lock);
1909 	if (dce->dce_flags & DCEF_PMTU)
1910 		old_mtu = dce->dce_pmtu;
1911 	else
1912 		old_mtu = ill->ill_mtu;
1913 
1914 	if (icmph->icmph_du_zero != 0 || mtu < ipst->ips_ip_pmtu_min) {
1915 		uint32_t length;
1916 		int	i;
1917 
1918 		/*
1919 		 * Use the table from RFC 1191 to figure out
1920 		 * the next "plateau" based on the length in
1921 		 * the original IP packet.
1922 		 */
1923 		length = ntohs(ipha->ipha_length);
1924 		DTRACE_PROBE2(ip4__pmtu__guess, dce_t *, dce,
1925 		    uint32_t, length);
1926 		if (old_mtu <= length &&
1927 		    old_mtu >= length - hdr_length) {
1928 			/*
1929 			 * Handle broken BSD 4.2 systems that
1930 			 * return the wrong ipha_length in ICMP
1931 			 * errors.
1932 			 */
1933 			ip1dbg(("Wrong mtu: sent %d, dce %d\n",
1934 			    length, old_mtu));
1935 			length -= hdr_length;
1936 		}
1937 		for (i = 0; i < A_CNT(icmp_frag_size_table); i++) {
1938 			if (length > icmp_frag_size_table[i])
1939 				break;
1940 		}
1941 		if (i == A_CNT(icmp_frag_size_table)) {
1942 			/* Smaller than IP_MIN_MTU! */
1943 			ip1dbg(("Too big for packet size %d\n",
1944 			    length));
1945 			disable_pmtud = B_TRUE;
1946 			mtu = ipst->ips_ip_pmtu_min;
1947 		} else {
1948 			mtu = icmp_frag_size_table[i];
1949 			ip1dbg(("Calculated mtu %d, packet size %d, "
1950 			    "before %d\n", mtu, length, old_mtu));
1951 			if (mtu < ipst->ips_ip_pmtu_min) {
1952 				mtu = ipst->ips_ip_pmtu_min;
1953 				disable_pmtud = B_TRUE;
1954 			}
1955 		}
1956 	}
1957 	if (disable_pmtud)
1958 		dce->dce_flags |= DCEF_TOO_SMALL_PMTU;
1959 	else
1960 		dce->dce_flags &= ~DCEF_TOO_SMALL_PMTU;
1961 
1962 	dce->dce_pmtu = MIN(old_mtu, mtu);
1963 	/* Prepare to send the new max frag size for the ULP. */
1964 	icmph->icmph_du_zero = 0;
1965 	icmph->icmph_du_mtu =  htons((uint16_t)dce->dce_pmtu);
1966 	DTRACE_PROBE4(ip4__pmtu__change, icmph_t *, icmph, dce_t *,
1967 	    dce, int, orig_mtu, int, mtu);
1968 
1969 	/* We now have a PMTU for sure */
1970 	dce->dce_flags |= DCEF_PMTU;
1971 	dce->dce_last_change_time = TICK_TO_SEC(ddi_get_lbolt64());
1972 	mutex_exit(&dce->dce_lock);
1973 	/*
1974 	 * After dropping the lock the new value is visible to everyone.
1975 	 * Then we bump the generation number so any cached values reinspect
1976 	 * the dce_t.
1977 	 */
1978 	dce_increment_generation(dce);
1979 	dce_refrele(dce);
1980 }
1981 
1982 /*
1983  * If the packet in error is Self-Encapsulated, icmp_inbound_error_fanout_v4
1984  * calls this function.
1985  */
1986 static mblk_t *
icmp_inbound_self_encap_error_v4(mblk_t * mp,ipha_t * ipha,ipha_t * in_ipha)1987 icmp_inbound_self_encap_error_v4(mblk_t *mp, ipha_t *ipha, ipha_t *in_ipha)
1988 {
1989 	int length;
1990 
1991 	ASSERT(mp->b_datap->db_type == M_DATA);
1992 
1993 	/* icmp_inbound_v4 has already pulled up the whole error packet */
1994 	ASSERT(mp->b_cont == NULL);
1995 
1996 	/*
1997 	 * The length that we want to overlay is the inner header
1998 	 * and what follows it.
1999 	 */
2000 	length = msgdsize(mp) - ((uchar_t *)in_ipha - mp->b_rptr);
2001 
2002 	/*
2003 	 * Overlay the inner header and whatever follows it over the
2004 	 * outer header.
2005 	 */
2006 	bcopy((uchar_t *)in_ipha, (uchar_t *)ipha, length);
2007 
2008 	/* Adjust for what we removed */
2009 	mp->b_wptr -= (uchar_t *)in_ipha - (uchar_t *)ipha;
2010 	return (mp);
2011 }
2012 
2013 /*
2014  * Try to pass the ICMP message upstream in case the ULP cares.
2015  *
2016  * If the packet that caused the ICMP error is secure, we send
2017  * it to AH/ESP to make sure that the attached packet has a
2018  * valid association. ipha in the code below points to the
2019  * IP header of the packet that caused the error.
2020  *
2021  * For IPsec cases, we let the next-layer-up (which has access to
2022  * cached policy on the conn_t, or can query the SPD directly)
2023  * subtract out any IPsec overhead if they must.  We therefore make no
2024  * adjustments here for IPsec overhead.
2025  *
2026  * IFN could have been generated locally or by some router.
2027  *
2028  * LOCAL : ire_send_wire (before calling ipsec_out_process) can call
2029  * icmp_frag_needed/icmp_pkt2big_v6 to generated a local IFN.
2030  *	    This happens because IP adjusted its value of MTU on an
2031  *	    earlier IFN message and could not tell the upper layer,
2032  *	    the new adjusted value of MTU e.g. Packet was encrypted
2033  *	    or there was not enough information to fanout to upper
2034  *	    layers. Thus on the next outbound datagram, ire_send_wire
2035  *	    generates the IFN, where IPsec processing has *not* been
2036  *	    done.
2037  *
2038  *	    Note that we retain ixa_fragsize across IPsec thus once
2039  *	    we have picking ixa_fragsize and entered ipsec_out_process we do
2040  *	    no change the fragsize even if the path MTU changes before
2041  *	    we reach ip_output_post_ipsec.
2042  *
2043  *	    In the local case, IRAF_LOOPBACK will be set indicating
2044  *	    that IFN was generated locally.
2045  *
2046  * ROUTER : IFN could be secure or non-secure.
2047  *
2048  *	    * SECURE : We use the IPSEC_IN to fanout to AH/ESP if the
2049  *	      packet in error has AH/ESP headers to validate the AH/ESP
2050  *	      headers. AH/ESP will verify whether there is a valid SA or
2051  *	      not and send it back. We will fanout again if we have more
2052  *	      data in the packet.
2053  *
2054  *	      If the packet in error does not have AH/ESP, we handle it
2055  *	      like any other case.
2056  *
2057  *	    * NON_SECURE : If the packet in error has AH/ESP headers, we send it
2058  *	      up to AH/ESP for validation. AH/ESP will verify whether there is a
2059  *	      valid SA or not and send it back. We will fanout again if
2060  *	      we have more data in the packet.
2061  *
2062  *	      If the packet in error does not have AH/ESP, we handle it
2063  *	      like any other case.
2064  *
2065  * The caller must have called icmp_inbound_verify_v4.
2066  */
2067 static void
icmp_inbound_error_fanout_v4(mblk_t * mp,icmph_t * icmph,ip_recv_attr_t * ira)2068 icmp_inbound_error_fanout_v4(mblk_t *mp, icmph_t *icmph, ip_recv_attr_t *ira)
2069 {
2070 	uint16_t	*up;	/* Pointer to ports in ULP header */
2071 	uint32_t	ports;	/* reversed ports for fanout */
2072 	ipha_t		ripha;	/* With reversed addresses */
2073 	ipha_t		*ipha;  /* Inner IP header */
2074 	uint_t		hdr_length; /* Inner IP header length */
2075 	tcpha_t		*tcpha;
2076 	conn_t		*connp;
2077 	ill_t		*ill = ira->ira_ill;
2078 	ip_stack_t	*ipst = ill->ill_ipst;
2079 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
2080 	ill_t		*rill = ira->ira_rill;
2081 
2082 	/* Caller already pulled up everything. */
2083 	ipha = (ipha_t *)&icmph[1];
2084 	ASSERT((uchar_t *)&ipha[1] <= mp->b_wptr);
2085 	ASSERT(mp->b_cont == NULL);
2086 
2087 	hdr_length = IPH_HDR_LENGTH(ipha);
2088 	ira->ira_protocol = ipha->ipha_protocol;
2089 
2090 	/*
2091 	 * We need a separate IP header with the source and destination
2092 	 * addresses reversed to do fanout/classification because the ipha in
2093 	 * the ICMP error is in the form we sent it out.
2094 	 */
2095 	ripha.ipha_src = ipha->ipha_dst;
2096 	ripha.ipha_dst = ipha->ipha_src;
2097 	ripha.ipha_protocol = ipha->ipha_protocol;
2098 	ripha.ipha_version_and_hdr_length = ipha->ipha_version_and_hdr_length;
2099 
2100 	ip2dbg(("icmp_inbound_error_v4: proto %d %x to %x: %d/%d\n",
2101 	    ripha.ipha_protocol, ntohl(ipha->ipha_src),
2102 	    ntohl(ipha->ipha_dst),
2103 	    icmph->icmph_type, icmph->icmph_code));
2104 
2105 	switch (ipha->ipha_protocol) {
2106 	case IPPROTO_UDP:
2107 		up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2108 
2109 		/* Attempt to find a client stream based on port. */
2110 		ip2dbg(("icmp_inbound_error_v4: UDP ports %d to %d\n",
2111 		    ntohs(up[0]), ntohs(up[1])));
2112 
2113 		/* Note that we send error to all matches. */
2114 		ira->ira_flags |= IRAF_ICMP_ERROR;
2115 		ip_fanout_udp_multi_v4(mp, &ripha, up[0], up[1], ira);
2116 		ira->ira_flags &= ~IRAF_ICMP_ERROR;
2117 		return;
2118 
2119 	case IPPROTO_TCP:
2120 		/*
2121 		 * Find a TCP client stream for this packet.
2122 		 * Note that we do a reverse lookup since the header is
2123 		 * in the form we sent it out.
2124 		 */
2125 		tcpha = (tcpha_t *)((uchar_t *)ipha + hdr_length);
2126 		connp = ipcl_tcp_lookup_reversed_ipv4(ipha, tcpha, TCPS_LISTEN,
2127 		    ipst);
2128 		if (connp == NULL)
2129 			goto discard_pkt;
2130 
2131 		if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2132 		    (ira->ira_flags & IRAF_IPSEC_SECURE)) {
2133 			mp = ipsec_check_inbound_policy(mp, connp,
2134 			    ipha, NULL, ira);
2135 			if (mp == NULL) {
2136 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2137 				/* Note that mp is NULL */
2138 				ip_drop_input("ipIfStatsInDiscards", mp, ill);
2139 				CONN_DEC_REF(connp);
2140 				return;
2141 			}
2142 		}
2143 
2144 		ira->ira_flags |= IRAF_ICMP_ERROR;
2145 		ira->ira_ill = ira->ira_rill = NULL;
2146 		if (IPCL_IS_TCP(connp)) {
2147 			SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2148 			    connp->conn_recvicmp, connp, ira, SQ_FILL,
2149 			    SQTAG_TCP_INPUT_ICMP_ERR);
2150 		} else {
2151 			/* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2152 			(connp->conn_recv)(connp, mp, NULL, ira);
2153 			CONN_DEC_REF(connp);
2154 		}
2155 		ira->ira_ill = ill;
2156 		ira->ira_rill = rill;
2157 		ira->ira_flags &= ~IRAF_ICMP_ERROR;
2158 		return;
2159 
2160 	case IPPROTO_SCTP:
2161 		up = (uint16_t *)((uchar_t *)ipha + hdr_length);
2162 		/* Find a SCTP client stream for this packet. */
2163 		((uint16_t *)&ports)[0] = up[1];
2164 		((uint16_t *)&ports)[1] = up[0];
2165 
2166 		ira->ira_flags |= IRAF_ICMP_ERROR;
2167 		ip_fanout_sctp(mp, &ripha, NULL, ports, ira);
2168 		ira->ira_flags &= ~IRAF_ICMP_ERROR;
2169 		return;
2170 
2171 	case IPPROTO_ESP:
2172 	case IPPROTO_AH:
2173 		if (!ipsec_loaded(ipss)) {
2174 			ip_proto_not_sup(mp, ira);
2175 			return;
2176 		}
2177 
2178 		if (ipha->ipha_protocol == IPPROTO_ESP)
2179 			mp = ipsecesp_icmp_error(mp, ira);
2180 		else
2181 			mp = ipsecah_icmp_error(mp, ira);
2182 		if (mp == NULL)
2183 			return;
2184 
2185 		/* Just in case ipsec didn't preserve the NULL b_cont */
2186 		if (mp->b_cont != NULL) {
2187 			if (!pullupmsg(mp, -1))
2188 				goto discard_pkt;
2189 		}
2190 
2191 		/*
2192 		 * Note that ira_pktlen and ira_ip_hdr_length are no longer
2193 		 * correct, but we don't use them any more here.
2194 		 *
2195 		 * If succesful, the mp has been modified to not include
2196 		 * the ESP/AH header so we can fanout to the ULP's icmp
2197 		 * error handler.
2198 		 */
2199 		if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH)
2200 			goto truncated;
2201 
2202 		/* Verify the modified message before any further processes. */
2203 		ipha = (ipha_t *)mp->b_rptr;
2204 		hdr_length = IPH_HDR_LENGTH(ipha);
2205 		icmph = (icmph_t *)&mp->b_rptr[hdr_length];
2206 		if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
2207 			freemsg(mp);
2208 			return;
2209 		}
2210 
2211 		icmp_inbound_error_fanout_v4(mp, icmph, ira);
2212 		return;
2213 
2214 	case IPPROTO_ENCAP: {
2215 		/* Look for self-encapsulated packets that caused an error */
2216 		ipha_t *in_ipha;
2217 
2218 		/*
2219 		 * Caller has verified that length has to be
2220 		 * at least the size of IP header.
2221 		 */
2222 		ASSERT(hdr_length >= sizeof (ipha_t));
2223 		/*
2224 		 * Check the sanity of the inner IP header like
2225 		 * we did for the outer header.
2226 		 */
2227 		in_ipha = (ipha_t *)((uchar_t *)ipha + hdr_length);
2228 		if ((IPH_HDR_VERSION(in_ipha) != IPV4_VERSION)) {
2229 			goto discard_pkt;
2230 		}
2231 		if (IPH_HDR_LENGTH(in_ipha) < sizeof (ipha_t)) {
2232 			goto discard_pkt;
2233 		}
2234 		/* Check for Self-encapsulated tunnels */
2235 		if (in_ipha->ipha_src == ipha->ipha_src &&
2236 		    in_ipha->ipha_dst == ipha->ipha_dst) {
2237 
2238 			mp = icmp_inbound_self_encap_error_v4(mp, ipha,
2239 			    in_ipha);
2240 			if (mp == NULL)
2241 				goto discard_pkt;
2242 
2243 			/*
2244 			 * Just in case self_encap didn't preserve the NULL
2245 			 * b_cont
2246 			 */
2247 			if (mp->b_cont != NULL) {
2248 				if (!pullupmsg(mp, -1))
2249 					goto discard_pkt;
2250 			}
2251 			/*
2252 			 * Note that ira_pktlen and ira_ip_hdr_length are no
2253 			 * longer correct, but we don't use them any more here.
2254 			 */
2255 			if (mp->b_wptr - mp->b_rptr < IP_SIMPLE_HDR_LENGTH)
2256 				goto truncated;
2257 
2258 			/*
2259 			 * Verify the modified message before any further
2260 			 * processes.
2261 			 */
2262 			ipha = (ipha_t *)mp->b_rptr;
2263 			hdr_length = IPH_HDR_LENGTH(ipha);
2264 			icmph = (icmph_t *)&mp->b_rptr[hdr_length];
2265 			if (!icmp_inbound_verify_v4(mp, icmph, ira)) {
2266 				freemsg(mp);
2267 				return;
2268 			}
2269 
2270 			/*
2271 			 * The packet in error is self-encapsualted.
2272 			 * And we are finding it further encapsulated
2273 			 * which we could not have possibly generated.
2274 			 */
2275 			if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2276 				goto discard_pkt;
2277 			}
2278 			icmp_inbound_error_fanout_v4(mp, icmph, ira);
2279 			return;
2280 		}
2281 		/* No self-encapsulated */
2282 	}
2283 	/* FALLTHROUGH */
2284 	case IPPROTO_IPV6:
2285 		if ((connp = ipcl_iptun_classify_v4(&ripha.ipha_src,
2286 		    &ripha.ipha_dst, ipst)) != NULL) {
2287 			ira->ira_flags |= IRAF_ICMP_ERROR;
2288 			connp->conn_recvicmp(connp, mp, NULL, ira);
2289 			CONN_DEC_REF(connp);
2290 			ira->ira_flags &= ~IRAF_ICMP_ERROR;
2291 			return;
2292 		}
2293 		/*
2294 		 * No IP tunnel is interested, fallthrough and see
2295 		 * if a raw socket will want it.
2296 		 */
2297 		/* FALLTHROUGH */
2298 	default:
2299 		ira->ira_flags |= IRAF_ICMP_ERROR;
2300 		ip_fanout_proto_v4(mp, &ripha, ira);
2301 		ira->ira_flags &= ~IRAF_ICMP_ERROR;
2302 		return;
2303 	}
2304 	/* NOTREACHED */
2305 discard_pkt:
2306 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2307 	ip1dbg(("icmp_inbound_error_fanout_v4: drop pkt\n"));
2308 	ip_drop_input("ipIfStatsInDiscards", mp, ill);
2309 	freemsg(mp);
2310 	return;
2311 
2312 truncated:
2313 	/* We pulled up everthing already. Must be truncated */
2314 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2315 	ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2316 	freemsg(mp);
2317 }
2318 
2319 /*
2320  * Common IP options parser.
2321  *
2322  * Setup routine: fill in *optp with options-parsing state, then
2323  * tail-call ipoptp_next to return the first option.
2324  */
2325 uint8_t
ipoptp_first(ipoptp_t * optp,ipha_t * ipha)2326 ipoptp_first(ipoptp_t *optp, ipha_t *ipha)
2327 {
2328 	uint32_t totallen; /* total length of all options */
2329 
2330 	totallen = ipha->ipha_version_and_hdr_length -
2331 	    (uint8_t)((IP_VERSION << 4) + IP_SIMPLE_HDR_LENGTH_IN_WORDS);
2332 	totallen <<= 2;
2333 	optp->ipoptp_next = (uint8_t *)(&ipha[1]);
2334 	optp->ipoptp_end = optp->ipoptp_next + totallen;
2335 	optp->ipoptp_flags = 0;
2336 	return (ipoptp_next(optp));
2337 }
2338 
2339 /* Like above but without an ipha_t */
2340 uint8_t
ipoptp_first2(ipoptp_t * optp,uint32_t totallen,uint8_t * opt)2341 ipoptp_first2(ipoptp_t *optp, uint32_t totallen, uint8_t *opt)
2342 {
2343 	optp->ipoptp_next = opt;
2344 	optp->ipoptp_end = optp->ipoptp_next + totallen;
2345 	optp->ipoptp_flags = 0;
2346 	return (ipoptp_next(optp));
2347 }
2348 
2349 /*
2350  * Common IP options parser: extract next option.
2351  */
2352 uint8_t
ipoptp_next(ipoptp_t * optp)2353 ipoptp_next(ipoptp_t *optp)
2354 {
2355 	uint8_t *end = optp->ipoptp_end;
2356 	uint8_t *cur = optp->ipoptp_next;
2357 	uint8_t opt, len, pointer;
2358 
2359 	/*
2360 	 * If cur > end already, then the ipoptp_end or ipoptp_next pointer
2361 	 * has been corrupted.
2362 	 */
2363 	ASSERT(cur <= end);
2364 
2365 	if (cur == end)
2366 		return (IPOPT_EOL);
2367 
2368 	opt = cur[IPOPT_OPTVAL];
2369 
2370 	/*
2371 	 * Skip any NOP options.
2372 	 */
2373 	while (opt == IPOPT_NOP) {
2374 		cur++;
2375 		if (cur == end)
2376 			return (IPOPT_EOL);
2377 		opt = cur[IPOPT_OPTVAL];
2378 	}
2379 
2380 	if (opt == IPOPT_EOL)
2381 		return (IPOPT_EOL);
2382 
2383 	/*
2384 	 * Option requiring a length.
2385 	 */
2386 	if ((cur + 1) >= end) {
2387 		optp->ipoptp_flags |= IPOPTP_ERROR;
2388 		return (IPOPT_EOL);
2389 	}
2390 	len = cur[IPOPT_OLEN];
2391 	if (len < 2) {
2392 		optp->ipoptp_flags |= IPOPTP_ERROR;
2393 		return (IPOPT_EOL);
2394 	}
2395 	optp->ipoptp_cur = cur;
2396 	optp->ipoptp_len = len;
2397 	optp->ipoptp_next = cur + len;
2398 	if (cur + len > end) {
2399 		optp->ipoptp_flags |= IPOPTP_ERROR;
2400 		return (IPOPT_EOL);
2401 	}
2402 
2403 	/*
2404 	 * For the options which require a pointer field, make sure
2405 	 * its there, and make sure it points to either something
2406 	 * inside this option, or the end of the option.
2407 	 */
2408 	pointer = IPOPT_EOL;
2409 	switch (opt) {
2410 	case IPOPT_RR:
2411 	case IPOPT_TS:
2412 	case IPOPT_LSRR:
2413 	case IPOPT_SSRR:
2414 		if (len <= IPOPT_OFFSET) {
2415 			optp->ipoptp_flags |= IPOPTP_ERROR;
2416 			return (opt);
2417 		}
2418 		pointer = cur[IPOPT_OFFSET];
2419 		if (pointer - 1 > len) {
2420 			optp->ipoptp_flags |= IPOPTP_ERROR;
2421 			return (opt);
2422 		}
2423 		break;
2424 	}
2425 
2426 	/*
2427 	 * Sanity check the pointer field based on the type of the
2428 	 * option.
2429 	 */
2430 	switch (opt) {
2431 	case IPOPT_RR:
2432 	case IPOPT_SSRR:
2433 	case IPOPT_LSRR:
2434 		if (pointer < IPOPT_MINOFF_SR)
2435 			optp->ipoptp_flags |= IPOPTP_ERROR;
2436 		break;
2437 	case IPOPT_TS:
2438 		if (pointer < IPOPT_MINOFF_IT)
2439 			optp->ipoptp_flags |= IPOPTP_ERROR;
2440 		/*
2441 		 * Note that the Internet Timestamp option also
2442 		 * contains two four bit fields (the Overflow field,
2443 		 * and the Flag field), which follow the pointer
2444 		 * field.  We don't need to check that these fields
2445 		 * fall within the length of the option because this
2446 		 * was implicitely done above.  We've checked that the
2447 		 * pointer value is at least IPOPT_MINOFF_IT, and that
2448 		 * it falls within the option.  Since IPOPT_MINOFF_IT >
2449 		 * IPOPT_POS_OV_FLG, we don't need the explicit check.
2450 		 */
2451 		ASSERT(len > IPOPT_POS_OV_FLG);
2452 		break;
2453 	}
2454 
2455 	return (opt);
2456 }
2457 
2458 /*
2459  * Use the outgoing IP header to create an IP_OPTIONS option the way
2460  * it was passed down from the application.
2461  *
2462  * This is compatible with BSD in that it returns
2463  * the reverse source route with the final destination
2464  * as the last entry. The first 4 bytes of the option
2465  * will contain the final destination.
2466  */
2467 int
ip_opt_get_user(conn_t * connp,uchar_t * buf)2468 ip_opt_get_user(conn_t *connp, uchar_t *buf)
2469 {
2470 	ipoptp_t	opts;
2471 	uchar_t		*opt;
2472 	uint8_t		optval;
2473 	uint8_t		optlen;
2474 	uint32_t	len = 0;
2475 	uchar_t		*buf1 = buf;
2476 	uint32_t	totallen;
2477 	ipaddr_t	dst;
2478 	ip_pkt_t	*ipp = &connp->conn_xmit_ipp;
2479 
2480 	if (!(ipp->ipp_fields & IPPF_IPV4_OPTIONS))
2481 		return (0);
2482 
2483 	totallen = ipp->ipp_ipv4_options_len;
2484 	if (totallen & 0x3)
2485 		return (0);
2486 
2487 	buf += IP_ADDR_LEN;	/* Leave room for final destination */
2488 	len += IP_ADDR_LEN;
2489 	bzero(buf1, IP_ADDR_LEN);
2490 
2491 	dst = connp->conn_faddr_v4;
2492 
2493 	for (optval = ipoptp_first2(&opts, totallen, ipp->ipp_ipv4_options);
2494 	    optval != IPOPT_EOL;
2495 	    optval = ipoptp_next(&opts)) {
2496 		int	off;
2497 
2498 		opt = opts.ipoptp_cur;
2499 		if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
2500 			break;
2501 		}
2502 		optlen = opts.ipoptp_len;
2503 
2504 		switch (optval) {
2505 		case IPOPT_SSRR:
2506 		case IPOPT_LSRR:
2507 
2508 			/*
2509 			 * Insert destination as the first entry in the source
2510 			 * route and move down the entries on step.
2511 			 * The last entry gets placed at buf1.
2512 			 */
2513 			buf[IPOPT_OPTVAL] = optval;
2514 			buf[IPOPT_OLEN] = optlen;
2515 			buf[IPOPT_OFFSET] = optlen;
2516 
2517 			off = optlen - IP_ADDR_LEN;
2518 			if (off < 0) {
2519 				/* No entries in source route */
2520 				break;
2521 			}
2522 			/* Last entry in source route if not already set */
2523 			if (dst == INADDR_ANY)
2524 				bcopy(opt + off, buf1, IP_ADDR_LEN);
2525 			off -= IP_ADDR_LEN;
2526 
2527 			while (off > 0) {
2528 				bcopy(opt + off,
2529 				    buf + off + IP_ADDR_LEN,
2530 				    IP_ADDR_LEN);
2531 				off -= IP_ADDR_LEN;
2532 			}
2533 			/* ipha_dst into first slot */
2534 			bcopy(&dst, buf + off + IP_ADDR_LEN,
2535 			    IP_ADDR_LEN);
2536 			buf += optlen;
2537 			len += optlen;
2538 			break;
2539 
2540 		default:
2541 			bcopy(opt, buf, optlen);
2542 			buf += optlen;
2543 			len += optlen;
2544 			break;
2545 		}
2546 	}
2547 done:
2548 	/* Pad the resulting options */
2549 	while (len & 0x3) {
2550 		*buf++ = IPOPT_EOL;
2551 		len++;
2552 	}
2553 	return (len);
2554 }
2555 
2556 /*
2557  * Update any record route or timestamp options to include this host.
2558  * Reverse any source route option.
2559  * This routine assumes that the options are well formed i.e. that they
2560  * have already been checked.
2561  */
2562 static void
icmp_options_update(ipha_t * ipha)2563 icmp_options_update(ipha_t *ipha)
2564 {
2565 	ipoptp_t	opts;
2566 	uchar_t		*opt;
2567 	uint8_t		optval;
2568 	ipaddr_t	src;		/* Our local address */
2569 	ipaddr_t	dst;
2570 
2571 	ip2dbg(("icmp_options_update\n"));
2572 	src = ipha->ipha_src;
2573 	dst = ipha->ipha_dst;
2574 
2575 	for (optval = ipoptp_first(&opts, ipha);
2576 	    optval != IPOPT_EOL;
2577 	    optval = ipoptp_next(&opts)) {
2578 		ASSERT((opts.ipoptp_flags & IPOPTP_ERROR) == 0);
2579 		opt = opts.ipoptp_cur;
2580 		ip2dbg(("icmp_options_update: opt %d, len %d\n",
2581 		    optval, opts.ipoptp_len));
2582 		switch (optval) {
2583 			int off1, off2;
2584 		case IPOPT_SSRR:
2585 		case IPOPT_LSRR:
2586 			/*
2587 			 * Reverse the source route.  The first entry
2588 			 * should be the next to last one in the current
2589 			 * source route (the last entry is our address).
2590 			 * The last entry should be the final destination.
2591 			 */
2592 			off1 = IPOPT_MINOFF_SR - 1;
2593 			off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
2594 			if (off2 < 0) {
2595 				/* No entries in source route */
2596 				ip1dbg((
2597 				    "icmp_options_update: bad src route\n"));
2598 				break;
2599 			}
2600 			bcopy((char *)opt + off2, &dst, IP_ADDR_LEN);
2601 			bcopy(&ipha->ipha_dst, (char *)opt + off2, IP_ADDR_LEN);
2602 			bcopy(&dst, &ipha->ipha_dst, IP_ADDR_LEN);
2603 			off2 -= IP_ADDR_LEN;
2604 
2605 			while (off1 < off2) {
2606 				bcopy((char *)opt + off1, &src, IP_ADDR_LEN);
2607 				bcopy((char *)opt + off2, (char *)opt + off1,
2608 				    IP_ADDR_LEN);
2609 				bcopy(&src, (char *)opt + off2, IP_ADDR_LEN);
2610 				off1 += IP_ADDR_LEN;
2611 				off2 -= IP_ADDR_LEN;
2612 			}
2613 			opt[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
2614 			break;
2615 		}
2616 	}
2617 }
2618 
2619 /*
2620  * Process received ICMP Redirect messages.
2621  * Assumes the caller has verified that the headers are in the pulled up mblk.
2622  * Consumes mp.
2623  */
2624 static void
icmp_redirect_v4(mblk_t * mp,ipha_t * ipha,icmph_t * icmph,ip_recv_attr_t * ira)2625 icmp_redirect_v4(mblk_t *mp, ipha_t *ipha, icmph_t *icmph, ip_recv_attr_t *ira)
2626 {
2627 	ire_t		*ire, *nire;
2628 	ire_t		*prev_ire;
2629 	ipaddr_t	src, dst, gateway;
2630 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
2631 	ipha_t		*inner_ipha;	/* Inner IP header */
2632 
2633 	/* Caller already pulled up everything. */
2634 	inner_ipha = (ipha_t *)&icmph[1];
2635 	src = ipha->ipha_src;
2636 	dst = inner_ipha->ipha_dst;
2637 	gateway = icmph->icmph_rd_gateway;
2638 	/* Make sure the new gateway is reachable somehow. */
2639 	ire = ire_ftable_lookup_v4(gateway, 0, 0, IRE_ONLINK, NULL,
2640 	    ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
2641 	/*
2642 	 * Make sure we had a route for the dest in question and that
2643 	 * that route was pointing to the old gateway (the source of the
2644 	 * redirect packet.)
2645 	 * We do longest match and then compare ire_gateway_addr below.
2646 	 */
2647 	prev_ire = ire_ftable_lookup_v4(dst, 0, 0, 0, NULL, ALL_ZONES,
2648 	    NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
2649 	/*
2650 	 * Check that
2651 	 *	the redirect was not from ourselves
2652 	 *	the new gateway and the old gateway are directly reachable
2653 	 */
2654 	if (prev_ire == NULL || ire == NULL ||
2655 	    (prev_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) ||
2656 	    (prev_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2657 	    !(ire->ire_type & IRE_IF_ALL) ||
2658 	    prev_ire->ire_gateway_addr != src) {
2659 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects);
2660 		ip_drop_input("icmpInBadRedirects - ire", mp, ira->ira_ill);
2661 		freemsg(mp);
2662 		if (ire != NULL)
2663 			ire_refrele(ire);
2664 		if (prev_ire != NULL)
2665 			ire_refrele(prev_ire);
2666 		return;
2667 	}
2668 
2669 	ire_refrele(prev_ire);
2670 	ire_refrele(ire);
2671 
2672 	/*
2673 	 * TODO: more precise handling for cases 0, 2, 3, the latter two
2674 	 * require TOS routing
2675 	 */
2676 	switch (icmph->icmph_code) {
2677 	case 0:
2678 	case 1:
2679 		/* TODO: TOS specificity for cases 2 and 3 */
2680 	case 2:
2681 	case 3:
2682 		break;
2683 	default:
2684 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInBadRedirects);
2685 		ip_drop_input("icmpInBadRedirects - code", mp, ira->ira_ill);
2686 		freemsg(mp);
2687 		return;
2688 	}
2689 	/*
2690 	 * Create a Route Association.  This will allow us to remember that
2691 	 * someone we believe told us to use the particular gateway.
2692 	 */
2693 	ire = ire_create(
2694 	    (uchar_t *)&dst,			/* dest addr */
2695 	    (uchar_t *)&ip_g_all_ones,		/* mask */
2696 	    (uchar_t *)&gateway,		/* gateway addr */
2697 	    IRE_HOST,
2698 	    NULL,				/* ill */
2699 	    ALL_ZONES,
2700 	    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST),
2701 	    NULL,				/* tsol_gc_t */
2702 	    ipst);
2703 
2704 	if (ire == NULL) {
2705 		freemsg(mp);
2706 		return;
2707 	}
2708 	nire = ire_add(ire);
2709 	/* Check if it was a duplicate entry */
2710 	if (nire != NULL && nire != ire) {
2711 		ASSERT(nire->ire_identical_ref > 1);
2712 		ire_delete(nire);
2713 		ire_refrele(nire);
2714 		nire = NULL;
2715 	}
2716 	ire = nire;
2717 	if (ire != NULL) {
2718 		ire_refrele(ire);		/* Held in ire_add */
2719 
2720 		/* tell routing sockets that we received a redirect */
2721 		ip_rts_change(RTM_REDIRECT, dst, gateway, IP_HOST_MASK, 0, src,
2722 		    (RTF_DYNAMIC | RTF_GATEWAY | RTF_HOST), 0,
2723 		    (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_AUTHOR), ipst);
2724 	}
2725 
2726 	/*
2727 	 * Delete any existing IRE_HOST type redirect ires for this destination.
2728 	 * This together with the added IRE has the effect of
2729 	 * modifying an existing redirect.
2730 	 */
2731 	prev_ire = ire_ftable_lookup_v4(dst, 0, src, IRE_HOST, NULL,
2732 	    ALL_ZONES, NULL, (MATCH_IRE_GW | MATCH_IRE_TYPE), 0, ipst, NULL);
2733 	if (prev_ire != NULL) {
2734 		if (prev_ire ->ire_flags & RTF_DYNAMIC)
2735 			ire_delete(prev_ire);
2736 		ire_refrele(prev_ire);
2737 	}
2738 
2739 	freemsg(mp);
2740 }
2741 
2742 /*
2743  * Generate an ICMP parameter problem message.
2744  * When called from ip_output side a minimal ip_recv_attr_t needs to be
2745  * constructed by the caller.
2746  */
2747 static void
icmp_param_problem(mblk_t * mp,uint8_t ptr,ip_recv_attr_t * ira)2748 icmp_param_problem(mblk_t *mp, uint8_t ptr, ip_recv_attr_t *ira)
2749 {
2750 	icmph_t	icmph;
2751 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
2752 
2753 	mp = icmp_pkt_err_ok(mp, ira);
2754 	if (mp == NULL)
2755 		return;
2756 
2757 	bzero(&icmph, sizeof (icmph_t));
2758 	icmph.icmph_type = ICMP_PARAM_PROBLEM;
2759 	icmph.icmph_pp_ptr = ptr;
2760 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutParmProbs);
2761 	icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
2762 }
2763 
2764 /*
2765  * Build and ship an IPv4 ICMP message using the packet data in mp, and
2766  * the ICMP header pointed to by "stuff".  (May be called as writer.)
2767  * Note: assumes that icmp_pkt_err_ok has been called to verify that
2768  * an icmp error packet can be sent.
2769  * Assigns an appropriate source address to the packet. If ipha_dst is
2770  * one of our addresses use it for source. Otherwise let ip_output_simple
2771  * pick the source address.
2772  */
2773 static void
icmp_pkt(mblk_t * mp,void * stuff,size_t len,ip_recv_attr_t * ira)2774 icmp_pkt(mblk_t *mp, void *stuff, size_t len, ip_recv_attr_t *ira)
2775 {
2776 	ipaddr_t dst;
2777 	icmph_t	*icmph;
2778 	ipha_t	*ipha;
2779 	uint_t	len_needed;
2780 	size_t	msg_len;
2781 	mblk_t	*mp1;
2782 	ipaddr_t src;
2783 	ire_t	*ire;
2784 	ip_xmit_attr_t ixas;
2785 	ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2786 
2787 	ipha = (ipha_t *)mp->b_rptr;
2788 
2789 	bzero(&ixas, sizeof (ixas));
2790 	ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
2791 	ixas.ixa_zoneid = ira->ira_zoneid;
2792 	ixas.ixa_ifindex = 0;
2793 	ixas.ixa_ipst = ipst;
2794 	ixas.ixa_cred = kcred;
2795 	ixas.ixa_cpid = NOPID;
2796 	ixas.ixa_tsl = ira->ira_tsl;	/* Behave as a multi-level responder */
2797 	ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
2798 
2799 	if (ira->ira_flags & IRAF_IPSEC_SECURE) {
2800 		/*
2801 		 * Apply IPsec based on how IPsec was applied to
2802 		 * the packet that had the error.
2803 		 *
2804 		 * If it was an outbound packet that caused the ICMP
2805 		 * error, then the caller will have setup the IRA
2806 		 * appropriately.
2807 		 */
2808 		if (!ipsec_in_to_out(ira, &ixas, mp, ipha, NULL)) {
2809 			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
2810 			/* Note: mp already consumed and ip_drop_packet done */
2811 			return;
2812 		}
2813 	} else {
2814 		/*
2815 		 * This is in clear. The icmp message we are building
2816 		 * here should go out in clear, independent of our policy.
2817 		 */
2818 		ixas.ixa_flags |= IXAF_NO_IPSEC;
2819 	}
2820 
2821 	/* Remember our eventual destination */
2822 	dst = ipha->ipha_src;
2823 
2824 	/*
2825 	 * If the packet was for one of our unicast addresses, make
2826 	 * sure we respond with that as the source. Otherwise
2827 	 * have ip_output_simple pick the source address.
2828 	 */
2829 	ire = ire_ftable_lookup_v4(ipha->ipha_dst, 0, 0,
2830 	    (IRE_LOCAL|IRE_LOOPBACK), NULL, ira->ira_zoneid, NULL,
2831 	    MATCH_IRE_TYPE|MATCH_IRE_ZONEONLY, 0, ipst, NULL);
2832 	if (ire != NULL) {
2833 		ire_refrele(ire);
2834 		src = ipha->ipha_dst;
2835 	} else {
2836 		src = INADDR_ANY;
2837 		ixas.ixa_flags |= IXAF_SET_SOURCE;
2838 	}
2839 
2840 	/*
2841 	 * Check if we can send back more then 8 bytes in addition to
2842 	 * the IP header.  We try to send 64 bytes of data and the internal
2843 	 * header in the special cases of ipv4 encapsulated ipv4 or ipv6.
2844 	 */
2845 	len_needed = IPH_HDR_LENGTH(ipha);
2846 	if (ipha->ipha_protocol == IPPROTO_ENCAP ||
2847 	    ipha->ipha_protocol == IPPROTO_IPV6) {
2848 		if (!pullupmsg(mp, -1)) {
2849 			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
2850 			ip_drop_output("ipIfStatsOutDiscards", mp, NULL);
2851 			freemsg(mp);
2852 			return;
2853 		}
2854 		ipha = (ipha_t *)mp->b_rptr;
2855 
2856 		if (ipha->ipha_protocol == IPPROTO_ENCAP) {
2857 			len_needed += IPH_HDR_LENGTH(((uchar_t *)ipha +
2858 			    len_needed));
2859 		} else {
2860 			ip6_t *ip6h = (ip6_t *)((uchar_t *)ipha + len_needed);
2861 
2862 			ASSERT(ipha->ipha_protocol == IPPROTO_IPV6);
2863 			len_needed += ip_hdr_length_v6(mp, ip6h);
2864 		}
2865 	}
2866 	len_needed += ipst->ips_ip_icmp_return;
2867 	msg_len = msgdsize(mp);
2868 	if (msg_len > len_needed) {
2869 		(void) adjmsg(mp, len_needed - msg_len);
2870 		msg_len = len_needed;
2871 	}
2872 	mp1 = allocb(sizeof (icmp_ipha) + len, BPRI_MED);
2873 	if (mp1 == NULL) {
2874 		BUMP_MIB(&ipst->ips_icmp_mib, icmpOutErrors);
2875 		freemsg(mp);
2876 		return;
2877 	}
2878 	mp1->b_cont = mp;
2879 	mp = mp1;
2880 
2881 	/*
2882 	 * Set IXAF_TRUSTED_ICMP so we can let the ICMP messages this
2883 	 * node generates be accepted in peace by all on-host destinations.
2884 	 * If we do NOT assume that all on-host destinations trust
2885 	 * self-generated ICMP messages, then rework here, ip6.c, and spd.c.
2886 	 * (Look for IXAF_TRUSTED_ICMP).
2887 	 */
2888 	ixas.ixa_flags |= IXAF_TRUSTED_ICMP;
2889 
2890 	ipha = (ipha_t *)mp->b_rptr;
2891 	mp1->b_wptr = (uchar_t *)ipha + (sizeof (icmp_ipha) + len);
2892 	*ipha = icmp_ipha;
2893 	ipha->ipha_src = src;
2894 	ipha->ipha_dst = dst;
2895 	ipha->ipha_ttl = ipst->ips_ip_def_ttl;
2896 	msg_len += sizeof (icmp_ipha) + len;
2897 	if (msg_len > IP_MAXPACKET) {
2898 		(void) adjmsg(mp, IP_MAXPACKET - msg_len);
2899 		msg_len = IP_MAXPACKET;
2900 	}
2901 	ipha->ipha_length = htons((uint16_t)msg_len);
2902 	icmph = (icmph_t *)&ipha[1];
2903 	bcopy(stuff, icmph, len);
2904 	icmph->icmph_checksum = 0;
2905 	icmph->icmph_checksum = IP_CSUM(mp, (int32_t)sizeof (ipha_t), 0);
2906 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutMsgs);
2907 
2908 	(void) ip_output_simple(mp, &ixas);
2909 	ixa_cleanup(&ixas);
2910 }
2911 
2912 /*
2913  * Determine if an ICMP error packet can be sent given the rate limit.
2914  * The limit consists of an average frequency (icmp_pkt_err_interval measured
2915  * in milliseconds) and a burst size. Burst size number of packets can
2916  * be sent arbitrarely closely spaced.
2917  * The state is tracked using two variables to implement an approximate
2918  * token bucket filter:
2919  *	icmp_pkt_err_last - lbolt value when the last burst started
2920  *	icmp_pkt_err_sent - number of packets sent in current burst
2921  */
2922 boolean_t
icmp_err_rate_limit(ip_stack_t * ipst)2923 icmp_err_rate_limit(ip_stack_t *ipst)
2924 {
2925 	clock_t now = TICK_TO_MSEC(ddi_get_lbolt());
2926 	uint_t refilled; /* Number of packets refilled in tbf since last */
2927 	/* Guard against changes by loading into local variable */
2928 	uint_t err_interval = ipst->ips_ip_icmp_err_interval;
2929 
2930 	if (err_interval == 0)
2931 		return (B_FALSE);
2932 
2933 	if (ipst->ips_icmp_pkt_err_last > now) {
2934 		/* 100HZ lbolt in ms for 32bit arch wraps every 49.7 days */
2935 		ipst->ips_icmp_pkt_err_last = 0;
2936 		ipst->ips_icmp_pkt_err_sent = 0;
2937 	}
2938 	/*
2939 	 * If we are in a burst update the token bucket filter.
2940 	 * Update the "last" time to be close to "now" but make sure
2941 	 * we don't loose precision.
2942 	 */
2943 	if (ipst->ips_icmp_pkt_err_sent != 0) {
2944 		refilled = (now - ipst->ips_icmp_pkt_err_last)/err_interval;
2945 		if (refilled > ipst->ips_icmp_pkt_err_sent) {
2946 			ipst->ips_icmp_pkt_err_sent = 0;
2947 		} else {
2948 			ipst->ips_icmp_pkt_err_sent -= refilled;
2949 			ipst->ips_icmp_pkt_err_last += refilled * err_interval;
2950 		}
2951 	}
2952 	if (ipst->ips_icmp_pkt_err_sent == 0) {
2953 		/* Start of new burst */
2954 		ipst->ips_icmp_pkt_err_last = now;
2955 	}
2956 	if (ipst->ips_icmp_pkt_err_sent < ipst->ips_ip_icmp_err_burst) {
2957 		ipst->ips_icmp_pkt_err_sent++;
2958 		ip1dbg(("icmp_err_rate_limit: %d sent in burst\n",
2959 		    ipst->ips_icmp_pkt_err_sent));
2960 		return (B_FALSE);
2961 	}
2962 	ip1dbg(("icmp_err_rate_limit: dropped\n"));
2963 	return (B_TRUE);
2964 }
2965 
2966 /*
2967  * Check if it is ok to send an IPv4 ICMP error packet in
2968  * response to the IPv4 packet in mp.
2969  * Free the message and return null if no
2970  * ICMP error packet should be sent.
2971  */
2972 static mblk_t *
icmp_pkt_err_ok(mblk_t * mp,ip_recv_attr_t * ira)2973 icmp_pkt_err_ok(mblk_t *mp, ip_recv_attr_t *ira)
2974 {
2975 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
2976 	icmph_t	*icmph;
2977 	ipha_t	*ipha;
2978 	uint_t	len_needed;
2979 
2980 	if (!mp)
2981 		return (NULL);
2982 	ipha = (ipha_t *)mp->b_rptr;
2983 	if (ip_csum_hdr(ipha)) {
2984 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInCksumErrs);
2985 		ip_drop_input("ipIfStatsInCksumErrs", mp, NULL);
2986 		freemsg(mp);
2987 		return (NULL);
2988 	}
2989 	if (ip_type_v4(ipha->ipha_dst, ipst) == IRE_BROADCAST ||
2990 	    ip_type_v4(ipha->ipha_src, ipst) == IRE_BROADCAST ||
2991 	    CLASSD(ipha->ipha_dst) ||
2992 	    CLASSD(ipha->ipha_src) ||
2993 	    (ntohs(ipha->ipha_fragment_offset_and_flags) & IPH_OFFSET)) {
2994 		/* Note: only errors to the fragment with offset 0 */
2995 		BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
2996 		freemsg(mp);
2997 		return (NULL);
2998 	}
2999 	if (ipha->ipha_protocol == IPPROTO_ICMP) {
3000 		/*
3001 		 * Check the ICMP type.  RFC 1122 sez:  don't send ICMP
3002 		 * errors in response to any ICMP errors.
3003 		 */
3004 		len_needed = IPH_HDR_LENGTH(ipha) + ICMPH_SIZE;
3005 		if (mp->b_wptr - mp->b_rptr < len_needed) {
3006 			if (!pullupmsg(mp, len_needed)) {
3007 				BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
3008 				freemsg(mp);
3009 				return (NULL);
3010 			}
3011 			ipha = (ipha_t *)mp->b_rptr;
3012 		}
3013 		icmph = (icmph_t *)
3014 		    (&((char *)ipha)[IPH_HDR_LENGTH(ipha)]);
3015 		switch (icmph->icmph_type) {
3016 		case ICMP_DEST_UNREACHABLE:
3017 		case ICMP_SOURCE_QUENCH:
3018 		case ICMP_TIME_EXCEEDED:
3019 		case ICMP_PARAM_PROBLEM:
3020 		case ICMP_REDIRECT:
3021 			BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3022 			freemsg(mp);
3023 			return (NULL);
3024 		default:
3025 			break;
3026 		}
3027 	}
3028 	/*
3029 	 * If this is a labeled system, then check to see if we're allowed to
3030 	 * send a response to this particular sender.  If not, then just drop.
3031 	 */
3032 	if (is_system_labeled() && !tsol_can_reply_error(mp, ira)) {
3033 		ip2dbg(("icmp_pkt_err_ok: can't respond to packet\n"));
3034 		BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDrops);
3035 		freemsg(mp);
3036 		return (NULL);
3037 	}
3038 	if (icmp_err_rate_limit(ipst)) {
3039 		/*
3040 		 * Only send ICMP error packets every so often.
3041 		 * This should be done on a per port/source basis,
3042 		 * but for now this will suffice.
3043 		 */
3044 		freemsg(mp);
3045 		return (NULL);
3046 	}
3047 	return (mp);
3048 }
3049 
3050 /*
3051  * Called when a packet was sent out the same link that it arrived on.
3052  * Check if it is ok to send a redirect and then send it.
3053  */
3054 void
ip_send_potential_redirect_v4(mblk_t * mp,ipha_t * ipha,ire_t * ire,ip_recv_attr_t * ira)3055 ip_send_potential_redirect_v4(mblk_t *mp, ipha_t *ipha, ire_t *ire,
3056     ip_recv_attr_t *ira)
3057 {
3058 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
3059 	ipaddr_t	src, nhop;
3060 	mblk_t		*mp1;
3061 	ire_t		*nhop_ire;
3062 
3063 	/*
3064 	 * Check the source address to see if it originated
3065 	 * on the same logical subnet it is going back out on.
3066 	 * If so, we should be able to send it a redirect.
3067 	 * Avoid sending a redirect if the destination
3068 	 * is directly connected (i.e., we matched an IRE_ONLINK),
3069 	 * or if the packet was source routed out this interface.
3070 	 *
3071 	 * We avoid sending a redirect if the
3072 	 * destination is directly connected
3073 	 * because it is possible that multiple
3074 	 * IP subnets may have been configured on
3075 	 * the link, and the source may not
3076 	 * be on the same subnet as ip destination,
3077 	 * even though they are on the same
3078 	 * physical link.
3079 	 */
3080 	if ((ire->ire_type & IRE_ONLINK) ||
3081 	    ip_source_routed(ipha, ipst))
3082 		return;
3083 
3084 	nhop_ire = ire_nexthop(ire);
3085 	if (nhop_ire == NULL)
3086 		return;
3087 
3088 	nhop = nhop_ire->ire_addr;
3089 
3090 	if (nhop_ire->ire_type & IRE_IF_CLONE) {
3091 		ire_t	*ire2;
3092 
3093 		/* Follow ire_dep_parent to find non-clone IRE_INTERFACE */
3094 		mutex_enter(&nhop_ire->ire_lock);
3095 		ire2 = nhop_ire->ire_dep_parent;
3096 		if (ire2 != NULL)
3097 			ire_refhold(ire2);
3098 		mutex_exit(&nhop_ire->ire_lock);
3099 		ire_refrele(nhop_ire);
3100 		nhop_ire = ire2;
3101 	}
3102 	if (nhop_ire == NULL)
3103 		return;
3104 
3105 	ASSERT(!(nhop_ire->ire_type & IRE_IF_CLONE));
3106 
3107 	src = ipha->ipha_src;
3108 
3109 	/*
3110 	 * We look at the interface ire for the nexthop,
3111 	 * to see if ipha_src is in the same subnet
3112 	 * as the nexthop.
3113 	 */
3114 	if ((src & nhop_ire->ire_mask) == (nhop & nhop_ire->ire_mask)) {
3115 		/*
3116 		 * The source is directly connected.
3117 		 */
3118 		mp1 = copymsg(mp);
3119 		if (mp1 != NULL) {
3120 			icmp_send_redirect(mp1, nhop, ira);
3121 		}
3122 	}
3123 	ire_refrele(nhop_ire);
3124 }
3125 
3126 /*
3127  * Generate an ICMP redirect message.
3128  */
3129 static void
icmp_send_redirect(mblk_t * mp,ipaddr_t gateway,ip_recv_attr_t * ira)3130 icmp_send_redirect(mblk_t *mp, ipaddr_t gateway, ip_recv_attr_t *ira)
3131 {
3132 	icmph_t	icmph;
3133 	ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3134 
3135 	mp = icmp_pkt_err_ok(mp, ira);
3136 	if (mp == NULL)
3137 		return;
3138 
3139 	bzero(&icmph, sizeof (icmph_t));
3140 	icmph.icmph_type = ICMP_REDIRECT;
3141 	icmph.icmph_code = 1;
3142 	icmph.icmph_rd_gateway = gateway;
3143 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutRedirects);
3144 	icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3145 }
3146 
3147 /*
3148  * Generate an ICMP time exceeded message.
3149  */
3150 void
icmp_time_exceeded(mblk_t * mp,uint8_t code,ip_recv_attr_t * ira)3151 icmp_time_exceeded(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira)
3152 {
3153 	icmph_t	icmph;
3154 	ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3155 
3156 	mp = icmp_pkt_err_ok(mp, ira);
3157 	if (mp == NULL)
3158 		return;
3159 
3160 	bzero(&icmph, sizeof (icmph_t));
3161 	icmph.icmph_type = ICMP_TIME_EXCEEDED;
3162 	icmph.icmph_code = code;
3163 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutTimeExcds);
3164 	icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3165 }
3166 
3167 /*
3168  * Generate an ICMP unreachable message.
3169  * When called from ip_output side a minimal ip_recv_attr_t needs to be
3170  * constructed by the caller.
3171  */
3172 void
icmp_unreachable(mblk_t * mp,uint8_t code,ip_recv_attr_t * ira)3173 icmp_unreachable(mblk_t *mp, uint8_t code, ip_recv_attr_t *ira)
3174 {
3175 	icmph_t	icmph;
3176 	ip_stack_t *ipst = ira->ira_ill->ill_ipst;
3177 
3178 	mp = icmp_pkt_err_ok(mp, ira);
3179 	if (mp == NULL)
3180 		return;
3181 
3182 	bzero(&icmph, sizeof (icmph_t));
3183 	icmph.icmph_type = ICMP_DEST_UNREACHABLE;
3184 	icmph.icmph_code = code;
3185 	BUMP_MIB(&ipst->ips_icmp_mib, icmpOutDestUnreachs);
3186 	icmp_pkt(mp, &icmph, sizeof (icmph_t), ira);
3187 }
3188 
3189 /*
3190  * Latch in the IPsec state for a stream based the policy in the listener
3191  * and the actions in the ip_recv_attr_t.
3192  * Called directly from TCP and SCTP.
3193  */
3194 boolean_t
ip_ipsec_policy_inherit(conn_t * connp,conn_t * lconnp,ip_recv_attr_t * ira)3195 ip_ipsec_policy_inherit(conn_t *connp, conn_t *lconnp, ip_recv_attr_t *ira)
3196 {
3197 	ASSERT(lconnp->conn_policy != NULL);
3198 	ASSERT(connp->conn_policy == NULL);
3199 
3200 	IPPH_REFHOLD(lconnp->conn_policy);
3201 	connp->conn_policy = lconnp->conn_policy;
3202 
3203 	if (ira->ira_ipsec_action != NULL) {
3204 		if (connp->conn_latch == NULL) {
3205 			connp->conn_latch = iplatch_create();
3206 			if (connp->conn_latch == NULL)
3207 				return (B_FALSE);
3208 		}
3209 		ipsec_latch_inbound(connp, ira);
3210 	}
3211 	return (B_TRUE);
3212 }
3213 
3214 /*
3215  * Verify whether or not the IP address is a valid local address.
3216  * Could be a unicast, including one for a down interface.
3217  * If allow_mcbc then a multicast or broadcast address is also
3218  * acceptable.
3219  *
3220  * In the case of a broadcast/multicast address, however, the
3221  * upper protocol is expected to reset the src address
3222  * to zero when we return IPVL_MCAST/IPVL_BCAST so that
3223  * no packets are emitted with broadcast/multicast address as
3224  * source address (that violates hosts requirements RFC 1122)
3225  * The addresses valid for bind are:
3226  *	(1) - INADDR_ANY (0)
3227  *	(2) - IP address of an UP interface
3228  *	(3) - IP address of a DOWN interface
3229  *	(4) - valid local IP broadcast addresses. In this case
3230  *	the conn will only receive packets destined to
3231  *	the specified broadcast address.
3232  *	(5) - a multicast address. In this case
3233  *	the conn will only receive packets destined to
3234  *	the specified multicast address. Note: the
3235  *	application still has to issue an
3236  *	IP_ADD_MEMBERSHIP socket option.
3237  *
3238  * In all the above cases, the bound address must be valid in the current zone.
3239  * When the address is loopback, multicast or broadcast, there might be many
3240  * matching IREs so bind has to look up based on the zone.
3241  */
3242 ip_laddr_t
ip_laddr_verify_v4(ipaddr_t src_addr,zoneid_t zoneid,ip_stack_t * ipst,boolean_t allow_mcbc)3243 ip_laddr_verify_v4(ipaddr_t src_addr, zoneid_t zoneid,
3244     ip_stack_t *ipst, boolean_t allow_mcbc)
3245 {
3246 	ire_t *src_ire;
3247 
3248 	ASSERT(src_addr != INADDR_ANY);
3249 
3250 	src_ire = ire_ftable_lookup_v4(src_addr, 0, 0, 0,
3251 	    NULL, zoneid, NULL, MATCH_IRE_ZONEONLY, 0, ipst, NULL);
3252 
3253 	/*
3254 	 * If an address other than in6addr_any is requested,
3255 	 * we verify that it is a valid address for bind
3256 	 * Note: Following code is in if-else-if form for
3257 	 * readability compared to a condition check.
3258 	 */
3259 	if (src_ire != NULL && (src_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK))) {
3260 		/*
3261 		 * (2) Bind to address of local UP interface
3262 		 */
3263 		ire_refrele(src_ire);
3264 		return (IPVL_UNICAST_UP);
3265 	} else if (src_ire != NULL && src_ire->ire_type & IRE_BROADCAST) {
3266 		/*
3267 		 * (4) Bind to broadcast address
3268 		 */
3269 		ire_refrele(src_ire);
3270 		if (allow_mcbc)
3271 			return (IPVL_BCAST);
3272 		else
3273 			return (IPVL_BAD);
3274 	} else if (CLASSD(src_addr)) {
3275 		/* (5) bind to multicast address. */
3276 		if (src_ire != NULL)
3277 			ire_refrele(src_ire);
3278 
3279 		if (allow_mcbc)
3280 			return (IPVL_MCAST);
3281 		else
3282 			return (IPVL_BAD);
3283 	} else {
3284 		ipif_t *ipif;
3285 
3286 		/*
3287 		 * (3) Bind to address of local DOWN interface?
3288 		 * (ipif_lookup_addr() looks up all interfaces
3289 		 * but we do not get here for UP interfaces
3290 		 * - case (2) above)
3291 		 */
3292 		if (src_ire != NULL)
3293 			ire_refrele(src_ire);
3294 
3295 		ipif = ipif_lookup_addr(src_addr, NULL, zoneid, ipst);
3296 		if (ipif == NULL)
3297 			return (IPVL_BAD);
3298 
3299 		/* Not a useful source? */
3300 		if (ipif->ipif_flags & (IPIF_NOLOCAL | IPIF_ANYCAST)) {
3301 			ipif_refrele(ipif);
3302 			return (IPVL_BAD);
3303 		}
3304 		ipif_refrele(ipif);
3305 		return (IPVL_UNICAST_DOWN);
3306 	}
3307 }
3308 
3309 /*
3310  * Insert in the bind fanout for IPv4 and IPv6.
3311  * The caller should already have used ip_laddr_verify_v*() before calling
3312  * this.
3313  */
3314 int
ip_laddr_fanout_insert(conn_t * connp)3315 ip_laddr_fanout_insert(conn_t *connp)
3316 {
3317 	int		error;
3318 
3319 	/*
3320 	 * Allow setting new policies. For example, disconnects result
3321 	 * in us being called. As we would have set conn_policy_cached
3322 	 * to B_TRUE before, we should set it to B_FALSE, so that policy
3323 	 * can change after the disconnect.
3324 	 */
3325 	connp->conn_policy_cached = B_FALSE;
3326 
3327 	error = ipcl_bind_insert(connp);
3328 	if (error != 0) {
3329 		if (connp->conn_anon_port) {
3330 			(void) tsol_mlp_anon(crgetzone(connp->conn_cred),
3331 			    connp->conn_mlp_type, connp->conn_proto,
3332 			    ntohs(connp->conn_lport), B_FALSE);
3333 		}
3334 		connp->conn_mlp_type = mlptSingle;
3335 	}
3336 	return (error);
3337 }
3338 
3339 /*
3340  * Verify that both the source and destination addresses are valid. If
3341  * IPDF_VERIFY_DST is not set, then the destination address may be unreachable,
3342  * i.e. have no route to it.  Protocols like TCP want to verify destination
3343  * reachability, while tunnels do not.
3344  *
3345  * Determine the route, the interface, and (optionally) the source address
3346  * to use to reach a given destination.
3347  * Note that we allow connect to broadcast and multicast addresses when
3348  * IPDF_ALLOW_MCBC is set.
3349  * first_hop and dst_addr are normally the same, but if source routing
3350  * they will differ; in that case the first_hop is what we'll use for the
3351  * routing lookup but the dce and label checks will be done on dst_addr,
3352  *
3353  * If uinfo is set, then we fill in the best available information
3354  * we have for the destination. This is based on (in priority order) any
3355  * metrics and path MTU stored in a dce_t, route metrics, and finally the
3356  * ill_mtu/ill_mc_mtu.
3357  *
3358  * Tsol note: If we have a source route then dst_addr != firsthop. But we
3359  * always do the label check on dst_addr.
3360  */
3361 int
ip_set_destination_v4(ipaddr_t * src_addrp,ipaddr_t dst_addr,ipaddr_t firsthop,ip_xmit_attr_t * ixa,iulp_t * uinfo,uint32_t flags,uint_t mac_mode)3362 ip_set_destination_v4(ipaddr_t *src_addrp, ipaddr_t dst_addr, ipaddr_t firsthop,
3363     ip_xmit_attr_t *ixa, iulp_t *uinfo, uint32_t flags, uint_t mac_mode)
3364 {
3365 	ire_t		*ire = NULL;
3366 	int		error = 0;
3367 	ipaddr_t	setsrc;				/* RTF_SETSRC */
3368 	zoneid_t	zoneid = ixa->ixa_zoneid;	/* Honors SO_ALLZONES */
3369 	ip_stack_t	*ipst = ixa->ixa_ipst;
3370 	dce_t		*dce;
3371 	uint_t		pmtu;
3372 	uint_t		generation;
3373 	nce_t		*nce;
3374 	ill_t		*ill = NULL;
3375 	boolean_t	multirt = B_FALSE;
3376 
3377 	ASSERT(ixa->ixa_flags & IXAF_IS_IPV4);
3378 
3379 	/*
3380 	 * We never send to zero; the ULPs map it to the loopback address.
3381 	 * We can't allow it since we use zero to mean unitialized in some
3382 	 * places.
3383 	 */
3384 	ASSERT(dst_addr != INADDR_ANY);
3385 
3386 	if (is_system_labeled()) {
3387 		ts_label_t *tsl = NULL;
3388 
3389 		error = tsol_check_dest(ixa->ixa_tsl, &dst_addr, IPV4_VERSION,
3390 		    mac_mode, (flags & IPDF_ZONE_IS_GLOBAL) != 0, &tsl);
3391 		if (error != 0)
3392 			return (error);
3393 		if (tsl != NULL) {
3394 			/* Update the label */
3395 			ip_xmit_attr_replace_tsl(ixa, tsl);
3396 		}
3397 	}
3398 
3399 	setsrc = INADDR_ANY;
3400 	/*
3401 	 * Select a route; For IPMP interfaces, we would only select
3402 	 * a "hidden" route (i.e., going through a specific under_ill)
3403 	 * if ixa_ifindex has been specified.
3404 	 */
3405 	ire = ip_select_route_v4(firsthop, *src_addrp, ixa,
3406 	    &generation, &setsrc, &error, &multirt);
3407 	ASSERT(ire != NULL);	/* IRE_NOROUTE if none found */
3408 	if (error != 0)
3409 		goto bad_addr;
3410 
3411 	/*
3412 	 * ire can't be a broadcast or multicast unless IPDF_ALLOW_MCBC is set.
3413 	 * If IPDF_VERIFY_DST is set, the destination must be reachable;
3414 	 * Otherwise the destination needn't be reachable.
3415 	 *
3416 	 * If we match on a reject or black hole, then we've got a
3417 	 * local failure.  May as well fail out the connect() attempt,
3418 	 * since it's never going to succeed.
3419 	 */
3420 	if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
3421 		/*
3422 		 * If we're verifying destination reachability, we always want
3423 		 * to complain here.
3424 		 *
3425 		 * If we're not verifying destination reachability but the
3426 		 * destination has a route, we still want to fail on the
3427 		 * temporary address and broadcast address tests.
3428 		 *
3429 		 * In both cases do we let the code continue so some reasonable
3430 		 * information is returned to the caller. That enables the
3431 		 * caller to use (and even cache) the IRE. conn_ip_ouput will
3432 		 * use the generation mismatch path to check for the unreachable
3433 		 * case thereby avoiding any specific check in the main path.
3434 		 */
3435 		ASSERT(generation == IRE_GENERATION_VERIFY);
3436 		if (flags & IPDF_VERIFY_DST) {
3437 			/*
3438 			 * Set errno but continue to set up ixa_ire to be
3439 			 * the RTF_REJECT|RTF_BLACKHOLE IRE.
3440 			 * That allows callers to use ip_output to get an
3441 			 * ICMP error back.
3442 			 */
3443 			if (!(ire->ire_type & IRE_HOST))
3444 				error = ENETUNREACH;
3445 			else
3446 				error = EHOSTUNREACH;
3447 		}
3448 	}
3449 
3450 	if ((ire->ire_type & (IRE_BROADCAST|IRE_MULTICAST)) &&
3451 	    !(flags & IPDF_ALLOW_MCBC)) {
3452 		ire_refrele(ire);
3453 		ire = ire_reject(ipst, B_FALSE);
3454 		generation = IRE_GENERATION_VERIFY;
3455 		error = ENETUNREACH;
3456 	}
3457 
3458 	/* Cache things */
3459 	if (ixa->ixa_ire != NULL)
3460