xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_tunables.c (revision 05b5eb98)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2013 by Delphix. All rights reserved.
 * Copyright (c) 2012, Joyent, Inc. All rights reserved.
 */
/* Copyright (c) 1990 Mentat Inc. */

#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/ip_if.h>
#include <inet/ip_ire.h>
#include <inet/ipclassifier.h>
#include <inet/ip_impl.h>
#include <inet/tunables.h>
#include <sys/sunddi.h>
#include <sys/policy.h>

/* How long, in seconds, we allow frags to hang around. */
#define	IP_REASM_TIMEOUT	15
#define	IPV6_REASM_TIMEOUT	60

/*
 * Set ip{,6}_forwarding values. If the value is being set on an ill,
 * find the ill and set the value on it. On the other hand if we are modifying
 * global property, modify the global value and set the value on all the ills.
 */
/* ARGSUSED */
static int
ip_set_forwarding(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
	char			*end;
	unsigned long		new_value;
	boolean_t		per_ill, isv6;
	ill_walk_context_t	ctx;
	ill_t			*ill;
	ip_stack_t		*ipst = stack->netstack_ip;

	if (flags & MOD_PROP_DEFAULT) {
		new_value = pinfo->prop_def_bval;
	} else {
		if (ddi_strtoul(pval, &end, 10, &new_value) != 0 ||
		    *end != '\0')
			return (EINVAL);
		if (new_value != B_TRUE && new_value != B_FALSE)
			return (EINVAL);
	}

	per_ill = (ifname != NULL && ifname[0] != '\0');
	/*
	 * if it's not per ill then set the global property and bring all the
	 * ills up to date with the new global value.
	 */
	if (!per_ill)
		pinfo->prop_cur_bval = (new_value == 1 ? B_TRUE : B_FALSE);

	isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6 ? B_TRUE : B_FALSE);
	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
	if (isv6)
		ill = ILL_START_WALK_V6(&ctx, ipst);
	else
		ill = ILL_START_WALK_V4(&ctx, ipst);

	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
		/*
		 * if the property needs to be set on a particular
		 * interface, look for that interface.
		 */
		if (per_ill && strcmp(ifname, ill->ill_name) != 0)
			continue;
		(void) ill_forward_set(ill, new_value != 0);
	}
	rw_exit(&ipst->ips_ill_g_lock);

	return (0);
}

static int
ip_get_forwarding(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t pr_size, uint_t flags)
{
	boolean_t		value;
	ill_walk_context_t	ctx;
	ill_t			*ill;
	ip_stack_t		*ipst = stack->netstack_ip;
	boolean_t		get_def = (flags & MOD_PROP_DEFAULT);
	boolean_t		get_perm = (flags & MOD_PROP_PERM);
	boolean_t		isv6;
	size_t			nbytes = 0;

	if (get_perm) {
		nbytes = snprintf(pval, pr_size, "%d", MOD_PROP_PERM_RW);
		goto ret;
	} else if (get_def) {
		nbytes = snprintf(pval, pr_size, "%d", pinfo->prop_def_bval);
		goto ret;
	}

	/*
	 * if per interface value is not asked for return the current
	 * global value
	 */
	if (ifname == NULL || ifname[0] == '\0') {
		nbytes = snprintf(pval, pr_size, "%d", pinfo->prop_cur_bval);
		goto ret;
	}

	isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6 ? B_TRUE : B_FALSE);
	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
	if (isv6)
		ill = ILL_START_WALK_V6(&ctx, ipst);
	else
		ill = ILL_START_WALK_V4(&ctx, ipst);
	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
		/*
		 * if the property needs to be obtained on a particular
		 * interface, look for that interface.
		 */
		if (strcmp(ifname, ill->ill_name) == 0)
			break;
	}
	if (ill == NULL) {
		rw_exit(&ipst->ips_ill_g_lock);
		return (ENXIO);
	}
	value = ((ill->ill_flags & ILLF_ROUTER) ? B_TRUE : B_FALSE);
	rw_exit(&ipst->ips_ill_g_lock);
	nbytes = snprintf(pval, pr_size, "%d", value);
ret:
	if (nbytes >= pr_size)
		return (ENOBUFS);
	return (0);
}

/*
 * `ip_debug' is a global variable. So, we will be modifying the global
 * variable here.
 */
/* ARGSUSED */
int
ip_set_debug(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
	unsigned long	new_value;
	int		err;

	if (cr != NULL && secpolicy_net_config(cr, B_FALSE) != 0)
		return (EPERM);

	if ((err = mod_uint32_value(pval, pinfo, flags, &new_value)) != 0)
		return (err);
	ip_debug = (uint32_t)new_value;
	return (0);
}

/*
 * ip_debug is a global property. For default, permission and value range
 * we retrieve the value from `pinfo'. However for the current value we
 * retrieve the value from the global variable `ip_debug'
 */
/* ARGSUSED */
int
ip_get_debug(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t psize, uint_t flags)
{
	boolean_t	get_def = (flags & MOD_PROP_DEFAULT);
	boolean_t	get_perm = (flags & MOD_PROP_PERM);
	boolean_t	get_range = (flags & MOD_PROP_POSSIBLE);
	size_t		nbytes;

	bzero(pval, psize);
	if (get_perm)
		nbytes = snprintf(pval, psize, "%u", MOD_PROP_PERM_RW);
	else if (get_range)
		nbytes = snprintf(pval, psize, "%u-%u",
		    pinfo->prop_min_uval, pinfo->prop_max_uval);
	else if (get_def)
		nbytes = snprintf(pval, psize, "%u", pinfo->prop_def_uval);
	else
		nbytes = snprintf(pval, psize, "%u", ip_debug);
	if (nbytes >= psize)
		return (ENOBUFS);
	return (0);
}

/*
 * Set the CGTP (multirouting) filtering status. If the status is changed
 * from active to transparent or from transparent to active, forward the
 * new status to the filtering module (if loaded).
 */
/* ARGSUSED */
static int
ip_set_cgtp_filter(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
	unsigned long	new_value;
	ip_stack_t	*ipst = stack->netstack_ip;
	char		*end;

	if (flags & MOD_PROP_DEFAULT) {
		new_value = pinfo->prop_def_bval;
	} else {
		if (ddi_strtoul(pval, &end, 10, &new_value) != 0 ||
		    *end != '\0' || new_value > 1) {
			return (EINVAL);
		}
	}
	if (!pinfo->prop_cur_bval && new_value) {
		cmn_err(CE_NOTE, "IP: enabling CGTP filtering%s",
		    ipst->ips_ip_cgtp_filter_ops == NULL ?
		    " (module not loaded)" : "");
	}
	if (pinfo->prop_cur_bval && !new_value) {
		cmn_err(CE_NOTE, "IP: disabling CGTP filtering%s",
		    ipst->ips_ip_cgtp_filter_ops == NULL ?
		    " (module not loaded)" : "");
	}
	if (ipst->ips_ip_cgtp_filter_ops != NULL) {
		int	res;
		netstackid_t stackid = ipst->ips_netstack->netstack_stackid;

		res = ipst->ips_ip_cgtp_filter_ops->cfo_change_state(stackid,
		    new_value);
		if (res)
			return (res);
	}
	pinfo->prop_cur_bval = (new_value == 1 ? B_TRUE : B_FALSE);
	ill_set_inputfn_all(ipst);
	return (0);
}

/*
 * Retrieve the default MTU or min-max MTU range for a given interface.
 *
 *  -- ill_max_frag value tells us the maximum MTU that can be handled by the
 *     datalink. This value is advertised by the driver via DLPI messages
 *     (DL_NOTE_SDU_SIZE/DL_INFO_ACK).
 *
 *  -- ill_current_frag for the most link-types will be same as ill_max_frag
 *     to begin with. However it is dynamically computed for some link-types
 *     like tunnels, based on the tunnel PMTU.
 *
 *  -- ill_mtu is the user set MTU using SIOCSLIFMTU and must lie between
 *     (IPV6_MIN_MTU/IP_MIN_MTU) and ill_max_frag.
 *
 *  -- ill_user_mtu is set by in.ndpd using SIOCSLIFLNKINFO and must lie between
 *     (IPV6_MIN_MTU/IP_MIN_MTU) and ill_max_frag.
 */
int
ip_get_mtu(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t psize, uint_t flags)
{
	ill_walk_context_t	ctx;
	ill_t			*ill;
	ip_stack_t		*ipst = stack->netstack_ip;
	boolean_t		isv6;
	uint32_t		max_mtu, def_mtu;
	size_t			nbytes = 0;

	if (!(flags & (MOD_PROP_DEFAULT|MOD_PROP_POSSIBLE)))
		return (ENOTSUP);

	if (ifname == NULL || ifname[0] == '\0')
		return (ENOTSUP);

	isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6 ? B_TRUE : B_FALSE);
	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
	if (isv6)
		ill = ILL_START_WALK_V6(&ctx, ipst);
	else
		ill = ILL_START_WALK_V4(&ctx, ipst);
	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
		if (strcmp(ifname, ill->ill_name) == 0)
			break;
	}
	if (ill == NULL) {
		rw_exit(&ipst->ips_ill_g_lock);
		return (ENXIO);
	}
	max_mtu = ill->ill_max_frag;
	def_mtu = ill->ill_current_frag;
	rw_exit(&ipst->ips_ill_g_lock);

	if (flags & MOD_PROP_DEFAULT) {
		nbytes = snprintf(pval, psize, "%u", def_mtu);
	} else if (flags & MOD_PROP_POSSIBLE) {
		uint32_t	min_mtu;

		min_mtu = isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
		nbytes = snprintf(pval, psize, "%u-%u", min_mtu, max_mtu);
	} else {
		return (ENOTSUP);
	}

	if (nbytes >= psize)
		return (ENOBUFS);
	return (0);
}

/*
 * See the comments for ip[6]_strict_src_multihoming for an explanation
 * of the semanitcs.
 */
void
ip_set_src_multihoming_common(ulong_t new_value, ulong_t old_value,
    boolean_t isv6, ip_stack_t *ipst)
{
	if (isv6)
		ipst->ips_ipv6_strict_src_multihoming = new_value;
	else
		ipst->ips_ip_strict_src_multihoming = new_value;
	if (new_value != old_value) {
		if (!isv6) {
			if (old_value == 0) {
				ire_walk_v4(ip_ire_rebind_walker, NULL,
				    ALL_ZONES, ipst);
			} else if (new_value == 0) {
				ire_walk_v4(ip_ire_unbind_walker, NULL,
				    ALL_ZONES, ipst);
			}
			ipcl_walk(conn_ire_revalidate, (void *)B_FALSE, ipst);
		} else {
			if (old_value == 0) {
				ire_walk_v6(ip_ire_rebind_walker, NULL,
				    ALL_ZONES, ipst);
			} else if (new_value == 0) {
				ire_walk_v6(ip_ire_unbind_walker, NULL,
				    ALL_ZONES, ipst);
			}
			ipcl_walk(conn_ire_revalidate, (void *)B_TRUE, ipst);
		}
	}
}

/* ARGSUSED */
static int
ip_set_src_multihoming(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
	unsigned long	new_value, old_value;
	boolean_t	isv6;
	ip_stack_t	*ipst = stack->netstack_ip;
	int		err;

	old_value = pinfo->prop_cur_uval;

	if ((err = mod_uint32_value(pval, pinfo, flags, &new_value)) != 0)
		return (err);
	pinfo->prop_cur_uval = new_value;
	isv6 = (strcmp(pinfo->mpi_name, "ip6_strict_src_multihoming") == 0);
	ip_set_src_multihoming_common(new_value, old_value, isv6, ipst);
	return (0);
}


/* ARGSUSED */
static int
ip_set_hostmodel(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
	ip_hostmodel_t	new_value, old_value;
	ip_stack_t	*ipst = stack->netstack_ip;
	uint32_t	old_src_multihoming;
	int		err;
	ulong_t		tmp;
	boolean_t	isv6;

	old_value = pinfo->prop_cur_uval;

	if ((err = mod_uint32_value(pval, pinfo, flags, &tmp)) != 0)
		return (err);
	new_value = tmp;
	pinfo->prop_cur_uval = new_value;

	switch (old_value) {
	case IP_WEAK_ES:
		old_src_multihoming = 0;
		break;
	case IP_SRC_PRI_ES:
		old_src_multihoming = 1;
		break;
	case IP_STRONG_ES:
		old_src_multihoming = 2;
		break;
	default:
		ASSERT(0);
		old_src_multihoming = IP_MAXVAL_ES;
		break;
	}
	/*
	 * Changes to src_multihoming may require ire's to be rebound/unbound,
	 * and also require generation number resets. Changes to dst_multihoming
	 * require a simple reset of the value.
	 */
	isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6);
	if (new_value != old_value) {
		switch (new_value) {
		case IP_WEAK_ES:
			ip_set_src_multihoming_common(0, old_src_multihoming,
			    isv6, ipst);
			if (isv6)
				ipst->ips_ipv6_strict_dst_multihoming = 0;
			else
				ipst->ips_ip_strict_dst_multihoming = 0;
			break;
		case IP_SRC_PRI_ES:
			ip_set_src_multihoming_common(1, old_src_multihoming,
			    isv6, ipst);
			if (isv6)
				ipst->ips_ipv6_strict_dst_multihoming = 0;
			else
				ipst->ips_ip_strict_dst_multihoming = 0;
			break;
		case IP_STRONG_ES:
			ip_set_src_multihoming_common(2, old_src_multihoming,
			    isv6, ipst);
			if (isv6)
				ipst->ips_ipv6_strict_dst_multihoming = 1;
			else
				ipst->ips_ip_strict_dst_multihoming = 1;
			break;
		default:
			return (EINVAL);
		}
	}
	return (0);
}

/* ARGSUSED */
int
ip_get_hostmodel(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t psize, uint_t flags)
{
	boolean_t	isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6);
	ip_stack_t	*ipst = stack->netstack_ip;
	ip_hostmodel_t	hostmodel;

	if (psize < sizeof (hostmodel))
		return (ENOBUFS);
	bzero(pval, psize);
	if (!isv6) {
		if (ipst->ips_ip_strict_src_multihoming == 0 &&
		    ipst->ips_ip_strict_dst_multihoming == 0)
			hostmodel = IP_WEAK_ES;
		else if (ipst->ips_ip_strict_src_multihoming == 1 &&
		    ipst->ips_ip_strict_dst_multihoming == 0)
			hostmodel = IP_SRC_PRI_ES;
		else if (ipst->ips_ip_strict_src_multihoming == 2 &&
		    ipst->ips_ip_strict_dst_multihoming == 1)
			hostmodel = IP_STRONG_ES;
		else
			hostmodel = IP_MAXVAL_ES;
	} else {
		if (ipst->ips_ipv6_strict_src_multihoming == 0 &&
		    ipst->ips_ipv6_strict_dst_multihoming == 0)
			hostmodel = IP_WEAK_ES;
		else if (ipst->ips_ipv6_strict_src_multihoming == 1 &&
		    ipst->ips_ipv6_strict_dst_multihoming == 0)
			hostmodel = IP_SRC_PRI_ES;
		else if (ipst->ips_ipv6_strict_src_multihoming == 2 &&
		    ipst->ips_ipv6_strict_dst_multihoming == 1)
			hostmodel = IP_STRONG_ES;
		else
			hostmodel = IP_MAXVAL_ES;
	}
	bcopy(&hostmodel, pval, sizeof (hostmodel));
	return (0);
}

/*
 * All of these are alterable, within the min/max values given, at run time.
 *
 * Note: All those tunables which do not start with "_" are Committed and
 * therefore are public. See PSARC 2010/080.
 */
mod_prop_info_t ip_propinfo_tbl[] = {
	/* tunable - 0 */
	{ "_respond_to_address_mask_broadcast", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_respond_to_echo_broadcast", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE},  {B_TRUE} },

	{ "_respond_to_echo_multicast", MOD_PROTO_IPV4,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_respond_to_timestamp", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_respond_to_timestamp_broadcast", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_send_redirects", MOD_PROTO_IPV4,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_forward_directed_broadcasts", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_mrtdebug", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 10, 0}, {0} },

	{ "_ire_reclaim_fraction", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 8, 3}, {3} },

	{ "_nce_reclaim_fraction", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 8, 3}, {3} },

	/* tunable - 10 */
	{ "_dce_reclaim_fraction", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 8, 3}, {3} },

	{ "ttl", MOD_PROTO_IPV4,
	    mod_set_uint32, mod_get_uint32,
	    {1, 255, 255}, {255} },

	{ "_forward_src_routed", MOD_PROTO_IPV4,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_wroff_extra", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 256, 32}, {32} },

	/* following tunable is in seconds - a deviant! */
	{ "_pathmtu_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {2, 999999999, 60*20}, {60*20} },

	{ "_icmp_return_data_bytes", MOD_PROTO_IPV4,
	    mod_set_uint32, mod_get_uint32,
	    {8, 65536, 64}, {64} },

	{ "_path_mtu_discovery", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_pmtu_min", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {68, 65535, 576}, {576} },

	{ "_ignore_redirect", MOD_PROTO_IPV4,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_arp_icmp_error", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	/* tunable - 20 */
	{ "_broadcast_ttl", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 254, 1}, {1} },

	{ "_icmp_err_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 99999, 100}, {100} },

	{ "_icmp_err_burst", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 99999, 10}, {10} },

	{ "_reass_queue_bytes", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 999999999, 1000000}, {1000000} },

	/*
	 * See comments for ip_strict_src_multihoming for an explanation
	 * of the semantics of ip_strict_dst_multihoming
	 */
	{ "_strict_dst_multihoming", MOD_PROTO_IPV4,
	    mod_set_uint32, mod_get_uint32,
	    {0, 1, 0}, {0} },

	{ "_addrs_per_if", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, MAX_ADDRS_PER_IF, 256}, {256} },

	{ "_ipsec_override_persocket_policy", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_icmp_accept_clear_messages", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_igmp_accept_clear_messages", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_ndp_delay_first_probe_time", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {2, 999999999, ND_DELAY_FIRST_PROBE_TIME},
	    {ND_DELAY_FIRST_PROBE_TIME} },

	/* tunable - 30 */
	{ "_ndp_max_unicast_solicit", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 999999999, ND_MAX_UNICAST_SOLICIT}, {ND_MAX_UNICAST_SOLICIT} },

	{ "hoplimit", MOD_PROTO_IPV6,
	    mod_set_uint32, mod_get_uint32,
	    {1, 255, IPV6_MAX_HOPS}, {IPV6_MAX_HOPS} },

	{ "_icmp_return_data_bytes", MOD_PROTO_IPV6,
	    mod_set_uint32, mod_get_uint32,
	    {8, IPV6_MIN_MTU, IPV6_MIN_MTU}, {IPV6_MIN_MTU} },

	{ "_forward_src_routed", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	{ "_respond_to_echo_multicast", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_send_redirects", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_ignore_redirect", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	/*
	 * See comments for ip6_strict_src_multihoming for an explanation
	 * of the semantics of ip6_strict_dst_multihoming
	 */
	{ "_strict_dst_multihoming", MOD_PROTO_IPV6,
	    mod_set_uint32, mod_get_uint32,
	    {0, 1, 0}, {0} },

	{ "_src_check", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 2, 2}, {2} },

	{ "_ipsec_policy_log_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 999999, 0}, {0} },

	/* tunable - 40 */
	{ "_pim_accept_clear_messages", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_ndp_unsolicit_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1000, 20000, 2000}, {2000} },

	{ "_ndp_unsolicit_count", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 20, 3}, {3} },

	{ "_ignore_home_address_opt", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_policy_mask", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 15, 0}, {0} },

	{ "_ecmp_behavior", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 2, 2}, {2} },

	{ "_multirt_ttl", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 255, 1}, {1} },

	/* following tunable is in seconds - a deviant */
	{ "_ire_badcnt_lifetime", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 3600, 60}, {60} },

	{ "_max_temp_idle", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 999999, 60*60*24}, {60*60*24} },

	{ "_max_temp_defend", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 1000, 1}, {1} },

	/* tunable - 50 */
	/*
	 * when a conflict of an active address is detected,
	 * defend up to ip_max_defend times, within any
	 * ip_defend_interval span.
	 */
	{ "_max_defend", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 1000, 3}, {3} },

	{ "_defend_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 999999, 30}, {30} },

	{ "_dup_recovery", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 3600000, 300000}, {300000} },

	{ "_restrict_interzone_loopback", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_lso_outbound", MOD_PROTO_IP,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_igmp_max_version", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {IGMP_V1_ROUTER, IGMP_V3_ROUTER, IGMP_V3_ROUTER},
	    {IGMP_V3_ROUTER} },

	{ "_mld_max_version", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {MLD_V1_ROUTER, MLD_V2_ROUTER, MLD_V2_ROUTER}, {MLD_V2_ROUTER} },

	{ "forwarding", MOD_PROTO_IPV4,
	    ip_set_forwarding, ip_get_forwarding,
	    {IP_FORWARD_NEVER}, {IP_FORWARD_NEVER} },

	{ "forwarding", MOD_PROTO_IPV6,
	    ip_set_forwarding, ip_get_forwarding,
	    {IP_FORWARD_NEVER}, {IP_FORWARD_NEVER} },

	{ "_reasm_timeout", MOD_PROTO_IPV4,
	    mod_set_uint32, mod_get_uint32,
	    {5, 255, IP_REASM_TIMEOUT},
	    {IP_REASM_TIMEOUT} },

	/* tunable - 60 */
	{ "_reasm_timeout", MOD_PROTO_IPV6,
	    mod_set_uint32, mod_get_uint32,
	    {5, 255, IPV6_REASM_TIMEOUT},
	    {IPV6_REASM_TIMEOUT} },

	{ "_cgtp_filter", MOD_PROTO_IP,
	    ip_set_cgtp_filter, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },

	/* delay before sending first probe: */
	{ "_arp_probe_delay", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 20000, 1000}, {1000} },

	{ "_arp_fastprobe_delay", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 20000, 100}, {100} },

	/* interval at which DAD probes are sent: */
	{ "_arp_probe_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {10, 20000, 1500}, {1500} },

	{ "_arp_fastprobe_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {10, 20000, 150}, {150} },

	{ "_arp_probe_count", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 20, 3}, {3} },

	{ "_arp_fastprobe_count", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 20, 3}, {3} },

	{ "_dad_announce_interval", MOD_PROTO_IPV4,
	    mod_set_uint32, mod_get_uint32,
	    {0, 3600000, 15000}, {15000} },

	{ "_dad_announce_interval", MOD_PROTO_IPV6,
	    mod_set_uint32, mod_get_uint32,
	    {0, 3600000, 15000}, {15000} },

	/* tunable - 70 */
	/*
	 * Rate limiting parameters for DAD defense used in
	 * ill_defend_rate_limit():
	 * defend_rate : pkts/hour permitted
	 * defend_interval : time that can elapse before we send out a
	 *			DAD defense.
	 * defend_period: denominator for defend_rate (in seconds).
	 */
	{ "_arp_defend_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 3600000, 300000}, {300000} },

	{ "_arp_defend_rate", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 20000, 100}, {100} },

	{ "_ndp_defend_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 3600000, 300000}, {300000} },

	{ "_ndp_defend_rate", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {0, 20000, 100}, {100} },

	{ "_arp_defend_period", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {5, 86400, 3600}, {3600} },

	{ "_ndp_defend_period", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {5, 86400, 3600}, {3600} },

	{ "_icmp_return_pmtu", MOD_PROTO_IPV4,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	{ "_icmp_return_pmtu", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_TRUE}, {B_TRUE} },

	/*
	 * publish count/interval values used to announce local addresses
	 * for IPv4, IPv6.
	 */
	{ "_arp_publish_count", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 20, 5}, {5} },

	{ "_arp_publish_interval", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1000, 20000, 2000}, {2000} },

	/* tunable - 80 */
	/*
	 * The ip*strict_src_multihoming and ip*strict_dst_multihoming provide
	 * a range of choices for setting strong/weak/preferred end-system
	 * behavior. The semantics for setting these are:
	 *
	 * ip*_strict_dst_multihoming = 0
	 *    weak end system model for managing ip destination addresses.
	 *    A packet with IP dst D1 that's received on interface I1 will be
	 *    accepted as long as D1 is one of the local addresses on
	 *    the machine, even if D1 is not configured on I1.
	 * ip*strict_dst_multihioming = 1
	 *    strong end system model for managing ip destination addresses.
	 *    A packet with IP dst D1 that's received on interface I1 will be
	 *    accepted if, and only if, D1 is configured on I1.
	 *
	 * ip*strict_src_multihoming = 0
	 *    Source agnostic route selection for outgoing packets: the
	 *    outgoing interface for a packet will be computed using
	 *    default algorithms for route selection, where the route
	 *    with the longest matching prefix is chosen for the output
	 *    unless other route selection constraints are explicitly
	 *    specified during routing table lookup.  This may result
	 *    in packet being sent out on interface I2 with source
	 *    address S1, even though S1 is not a configured address on I2.
	 * ip*strict_src_multihoming = 1
	 *    Preferred source aware route selection for outgoing packets: for
	 *    a packet with source S2, destination D2, the route selection
	 *    algorithm will first attempt to find a route for the destination
	 *    that goes out through an interface where S2 is
	 *    configured. If such a route cannot be found, then the
	 *    best-matching route for D2 will be selected.
	 * ip*strict_src_multihoming = 2
	 *    Source aware route selection for outgoing packets: a packet will
	 *    be sent out on an interface I2 only if the src address S2 of the
	 *    packet is a configured address on I2. In conjunction with
	 *    the setting 'ip_strict_dst_multihoming == 1', this will result in
	 *    the implementation of Strong ES as defined in Section 3.3.4.2 of
	 *    RFC 1122
	 */
	{ "_strict_src_multihoming", MOD_PROTO_IPV4,
	    ip_set_src_multihoming, mod_get_uint32,
	    {0, 2, 0}, {0} },

	{ "_strict_src_multihoming", MOD_PROTO_IPV6,
	    ip_set_src_multihoming, mod_get_uint32,
	    {0, 2, 0}, {0} },

#ifdef DEBUG
	{ "_drop_inbound_icmpv6", MOD_PROTO_IPV6,
	    mod_set_boolean, mod_get_boolean,
	    {B_FALSE}, {B_FALSE} },
#else
	{ "", 0, NULL, NULL, {0}, {0} },
#endif

	{ "_dce_reclaim_threshold", MOD_PROTO_IP,
	    mod_set_uint32, mod_get_uint32,
	    {1, 100000, 32}, {32} },

	{ "mtu", MOD_PROTO_IPV4, NULL, ip_get_mtu, {0}, {0} },

	{ "mtu", MOD_PROTO_IPV6, NULL, ip_get_mtu, {0}, {0} },

	/*
	 * The following entry is a placeholder for `ip_debug' global
	 * variable. Within these callback functions, we will be
	 * setting/getting the global variable
	 */
	{ "_debug", MOD_PROTO_IP,
	    ip_set_debug, ip_get_debug,
	    {0, 20, 0}, {0} },

	{ "hostmodel", MOD_PROTO_IPV4, ip_set_hostmodel, ip_get_hostmodel,
	    {IP_WEAK_ES, IP_STRONG_ES, IP_WEAK_ES}, {IP_WEAK_ES} },

	{ "hostmodel", MOD_PROTO_IPV6, ip_set_hostmodel, ip_get_hostmodel,
	    {IP_WEAK_ES, IP_STRONG_ES, IP_WEAK_ES}, {IP_WEAK_ES} },

	{ "?", MOD_PROTO_IP, NULL, mod_get_allprop, {0}, {0} },

	{ NULL, 0, NULL, NULL, {0}, {0} }
};

int ip_propinfo_count = A_CNT(ip_propinfo_tbl);