17c478bd9Sstevel@tonic-gate /* 2ab25eeb5Syz * Copyright (C) 1993-2001, 2003 by Darren Reed. 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 57c478bd9Sstevel@tonic-gate * 6ab25eeb5Syz * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 77c478bd9Sstevel@tonic-gate * Use is subject to license terms. 87c478bd9Sstevel@tonic-gate */ 97c478bd9Sstevel@tonic-gate 107c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 117c478bd9Sstevel@tonic-gate 127c478bd9Sstevel@tonic-gate #if !defined(lint) 13c793af95Ssangeeta static const char sccsid[] = "@(#)ip_fil_solaris.c 1.7 07/22/06 (C) 1993-2000 Darren Reed"; 14ab25eeb5Syz static const char rcsid[] = "@(#)$Id: ip_fil_solaris.c,v 2.62.2.19 2005/07/13 21:40:46 darrenr Exp $"; 157c478bd9Sstevel@tonic-gate #endif 167c478bd9Sstevel@tonic-gate 177c478bd9Sstevel@tonic-gate #include <sys/types.h> 187c478bd9Sstevel@tonic-gate #include <sys/errno.h> 197c478bd9Sstevel@tonic-gate #include <sys/param.h> 207c478bd9Sstevel@tonic-gate #include <sys/cpuvar.h> 217c478bd9Sstevel@tonic-gate #include <sys/open.h> 227c478bd9Sstevel@tonic-gate #include <sys/ioctl.h> 237c478bd9Sstevel@tonic-gate #include <sys/filio.h> 247c478bd9Sstevel@tonic-gate #include <sys/systm.h> 25ab25eeb5Syz #include <sys/strsubr.h> 267c478bd9Sstevel@tonic-gate #include <sys/cred.h> 277c478bd9Sstevel@tonic-gate #include <sys/ddi.h> 287c478bd9Sstevel@tonic-gate #include <sys/sunddi.h> 297c478bd9Sstevel@tonic-gate #include <sys/ksynch.h> 307c478bd9Sstevel@tonic-gate #include <sys/kmem.h> 317c478bd9Sstevel@tonic-gate #include <sys/mkdev.h> 327c478bd9Sstevel@tonic-gate #include <sys/protosw.h> 337c478bd9Sstevel@tonic-gate #include <sys/socket.h> 347c478bd9Sstevel@tonic-gate #include <sys/dditypes.h> 357c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 367c478bd9Sstevel@tonic-gate #include <net/if.h> 377c478bd9Sstevel@tonic-gate #include <net/af.h> 387c478bd9Sstevel@tonic-gate #include <net/route.h> 397c478bd9Sstevel@tonic-gate #include <netinet/in.h> 407c478bd9Sstevel@tonic-gate #include <netinet/in_systm.h> 417c478bd9Sstevel@tonic-gate #include <netinet/ip.h> 427c478bd9Sstevel@tonic-gate #include <netinet/ip_var.h> 437c478bd9Sstevel@tonic-gate #include <netinet/tcp.h> 447c478bd9Sstevel@tonic-gate #include <netinet/udp.h> 457c478bd9Sstevel@tonic-gate #include <netinet/tcpip.h> 467c478bd9Sstevel@tonic-gate #include <netinet/ip_icmp.h> 47ab25eeb5Syz #include "netinet/ip_compat.h" 487c478bd9Sstevel@tonic-gate #ifdef USE_INET6 497c478bd9Sstevel@tonic-gate # include <netinet/icmp6.h> 507c478bd9Sstevel@tonic-gate #endif 51ab25eeb5Syz #include "netinet/ip_fil.h" 52ab25eeb5Syz #include "netinet/ip_nat.h" 53ab25eeb5Syz #include "netinet/ip_frag.h" 54ab25eeb5Syz #include "netinet/ip_state.h" 55ab25eeb5Syz #include "netinet/ip_auth.h" 56ab25eeb5Syz #include "netinet/ip_proxy.h" 577c478bd9Sstevel@tonic-gate #ifdef IPFILTER_LOOKUP 58ab25eeb5Syz # include "netinet/ip_lookup.h" 597c478bd9Sstevel@tonic-gate #endif 607c478bd9Sstevel@tonic-gate #include <inet/ip_ire.h> 617c478bd9Sstevel@tonic-gate 627c478bd9Sstevel@tonic-gate #include <sys/md5.h> 63*381a2a9aSdr #include <sys/neti.h> 647c478bd9Sstevel@tonic-gate 65ab25eeb5Syz extern int fr_flags, fr_active; 667c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 7 67ab25eeb5Syz timeout_id_t fr_timer_id; 687c478bd9Sstevel@tonic-gate #else 69ab25eeb5Syz int fr_timer_id; 707c478bd9Sstevel@tonic-gate #endif 71*381a2a9aSdr #if SOLARIS2 >= 10 72*381a2a9aSdr extern int ipf_loopback; 73*381a2a9aSdr #endif 747c478bd9Sstevel@tonic-gate 757c478bd9Sstevel@tonic-gate 76*381a2a9aSdr static int fr_setipfloopback __P((int)); 77ab25eeb5Syz static int fr_send_ip __P((fr_info_t *fin, mblk_t *m, mblk_t **mp)); 78*381a2a9aSdr static int ipf_nic_event_v4 __P((hook_event_token_t, hook_data_t)); 79*381a2a9aSdr static int ipf_nic_event_v6 __P((hook_event_token_t, hook_data_t)); 80*381a2a9aSdr static int ipf_hook_out __P((hook_event_token_t, hook_data_t)); 81*381a2a9aSdr static int ipf_hook_in __P((hook_event_token_t, hook_data_t)); 82*381a2a9aSdr static int ipf_hook_loop_out __P((hook_event_token_t, hook_data_t)); 83*381a2a9aSdr static int ipf_hook_loop_in __P((hook_event_token_t, hook_data_t)); 84*381a2a9aSdr static int ipf_hook __P((hook_data_t, int, int)); 85*381a2a9aSdr 86*381a2a9aSdr static hook_t ipfhook_in; 87*381a2a9aSdr static hook_t ipfhook_out; 88*381a2a9aSdr static hook_t ipfhook_nicevents; 89*381a2a9aSdr 90*381a2a9aSdr /* flags to indicate whether hooks are registered. */ 91*381a2a9aSdr static boolean_t hook4_physical_in = B_FALSE; 92*381a2a9aSdr static boolean_t hook4_physical_out = B_FALSE; 93*381a2a9aSdr static boolean_t hook4_nic_events = B_FALSE; 94*381a2a9aSdr static boolean_t hook4_loopback_in = B_FALSE; 95*381a2a9aSdr static boolean_t hook4_loopback_out = B_FALSE; 96*381a2a9aSdr static boolean_t hook6_physical_in = B_FALSE; 97*381a2a9aSdr static boolean_t hook6_physical_out = B_FALSE; 98*381a2a9aSdr static boolean_t hook6_nic_events = B_FALSE; 99*381a2a9aSdr static boolean_t hook6_loopback_in = B_FALSE; 100*381a2a9aSdr static boolean_t hook6_loopback_out = B_FALSE; 1017c478bd9Sstevel@tonic-gate 1027c478bd9Sstevel@tonic-gate ipfmutex_t ipl_mutex, ipf_authmx, ipf_rw, ipf_stinsert; 1037c478bd9Sstevel@tonic-gate ipfmutex_t ipf_nat_new, ipf_natio, ipf_timeoutlock; 104ab25eeb5Syz ipfrwlock_t ipf_mutex, ipf_global, ipf_ipidfrag, ipf_frcache; 1057c478bd9Sstevel@tonic-gate ipfrwlock_t ipf_frag, ipf_state, ipf_nat, ipf_natfrag, ipf_auth; 1067c478bd9Sstevel@tonic-gate kcondvar_t iplwait, ipfauthwait; 1077c478bd9Sstevel@tonic-gate #if SOLARIS2 < 10 1087c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 7 109ab25eeb5Syz timeout_id_t fr_timer_id; 110ab25eeb5Syz u_int *ip_ttl_ptr = NULL; 111ab25eeb5Syz u_int *ip_mtudisc = NULL; 1127c478bd9Sstevel@tonic-gate # if SOLARIS2 >= 8 113ab25eeb5Syz int *ip_forwarding = NULL; 114ab25eeb5Syz u_int *ip6_forwarding = NULL; 1157c478bd9Sstevel@tonic-gate # else 116ab25eeb5Syz u_int *ip_forwarding = NULL; 1177c478bd9Sstevel@tonic-gate # endif 1187c478bd9Sstevel@tonic-gate #else 119ab25eeb5Syz int fr_timer_id; 120ab25eeb5Syz u_long *ip_ttl_ptr = NULL; 121ab25eeb5Syz u_long *ip_mtudisc = NULL; 122ab25eeb5Syz u_long *ip_forwarding = NULL; 1237c478bd9Sstevel@tonic-gate #endif 1247c478bd9Sstevel@tonic-gate #endif 125*381a2a9aSdr #if SOLARIS2 >= 10 126*381a2a9aSdr extern net_data_t ipf_ipv4; 127*381a2a9aSdr extern net_data_t ipf_ipv6; 128*381a2a9aSdr #endif 1297c478bd9Sstevel@tonic-gate int ipf_locks_done = 0; 1307c478bd9Sstevel@tonic-gate 1317c478bd9Sstevel@tonic-gate 1327c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1337c478bd9Sstevel@tonic-gate /* Function: ipldetach */ 1347c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, else error. */ 1357c478bd9Sstevel@tonic-gate /* Parameters: Nil */ 1367c478bd9Sstevel@tonic-gate /* */ 1377c478bd9Sstevel@tonic-gate /* This function is responsible for undoing anything that might have been */ 1387c478bd9Sstevel@tonic-gate /* done in a call to iplattach(). It must be able to clean up from a call */ 1397c478bd9Sstevel@tonic-gate /* to iplattach() that did not succeed. Why might that happen? Someone */ 1407c478bd9Sstevel@tonic-gate /* configures a table to be so large that we cannot allocate enough memory */ 1417c478bd9Sstevel@tonic-gate /* for it. */ 1427c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1437c478bd9Sstevel@tonic-gate int ipldetach() 1447c478bd9Sstevel@tonic-gate { 1457c478bd9Sstevel@tonic-gate 1467c478bd9Sstevel@tonic-gate ASSERT(rw_read_locked(&ipf_global.ipf_lk) == 0); 1477c478bd9Sstevel@tonic-gate 1487c478bd9Sstevel@tonic-gate #if SOLARIS2 < 10 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate if (fr_control_forwarding & 2) { 151ab25eeb5Syz if (ip_forwarding != NULL) 152ab25eeb5Syz *ip_forwarding = 0; 1537c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 8 154ab25eeb5Syz if (ip6_forwarding != NULL) 155ab25eeb5Syz *ip6_forwarding = 0; 1567c478bd9Sstevel@tonic-gate #endif 1577c478bd9Sstevel@tonic-gate } 1587c478bd9Sstevel@tonic-gate #endif 1597c478bd9Sstevel@tonic-gate 160*381a2a9aSdr /* 161*381a2a9aSdr * This lock needs to be dropped around the net_unregister_hook calls 162*381a2a9aSdr * because we can deadlock here with: 163*381a2a9aSdr * W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs 164*381a2a9aSdr * R(hook_family)->R(hei_lock)->R(ipf_global) (active hook running) 165*381a2a9aSdr */ 166*381a2a9aSdr RWLOCK_EXIT(&ipf_global); 167*381a2a9aSdr 168*381a2a9aSdr /* 169*381a2a9aSdr * Remove IPv6 Hooks 170*381a2a9aSdr */ 171*381a2a9aSdr if (ipf_ipv6 != NULL) { 172*381a2a9aSdr if (hook6_physical_in) { 173*381a2a9aSdr hook6_physical_in = (net_unregister_hook(ipf_ipv6, 174*381a2a9aSdr NH_PHYSICAL_IN, &ipfhook_in) != 0); 175*381a2a9aSdr } 176*381a2a9aSdr if (hook6_physical_out) { 177*381a2a9aSdr hook6_physical_out = (net_unregister_hook(ipf_ipv6, 178*381a2a9aSdr NH_PHYSICAL_OUT, &ipfhook_out) != 0); 179*381a2a9aSdr } 180*381a2a9aSdr if (hook6_nic_events) { 181*381a2a9aSdr hook6_nic_events = (net_unregister_hook(ipf_ipv6, 182*381a2a9aSdr NH_NIC_EVENTS, &ipfhook_nicevents) != 0); 183*381a2a9aSdr } 184*381a2a9aSdr if (hook6_loopback_in) { 185*381a2a9aSdr hook6_loopback_in = (net_unregister_hook(ipf_ipv6, 186*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) != 0); 187*381a2a9aSdr } 188*381a2a9aSdr if (hook6_loopback_out) { 189*381a2a9aSdr hook6_loopback_out = (net_unregister_hook(ipf_ipv6, 190*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) != 0); 191*381a2a9aSdr } 192*381a2a9aSdr 193*381a2a9aSdr if (net_release(ipf_ipv6) != 0) 194*381a2a9aSdr goto detach_failed; 195*381a2a9aSdr ipf_ipv6 = NULL; 196*381a2a9aSdr } 197*381a2a9aSdr 198*381a2a9aSdr /* 199*381a2a9aSdr * Remove IPv4 Hooks 200*381a2a9aSdr */ 201*381a2a9aSdr if (ipf_ipv4 != NULL) { 202*381a2a9aSdr if (hook4_physical_in) { 203*381a2a9aSdr hook4_physical_in = (net_unregister_hook(ipf_ipv4, 204*381a2a9aSdr NH_PHYSICAL_IN, &ipfhook_in) != 0); 205*381a2a9aSdr } 206*381a2a9aSdr if (hook4_physical_out) { 207*381a2a9aSdr hook4_physical_out = (net_unregister_hook(ipf_ipv4, 208*381a2a9aSdr NH_PHYSICAL_OUT, &ipfhook_out) != 0); 209*381a2a9aSdr } 210*381a2a9aSdr if (hook4_nic_events) { 211*381a2a9aSdr hook4_nic_events = (net_unregister_hook(ipf_ipv4, 212*381a2a9aSdr NH_NIC_EVENTS, &ipfhook_nicevents) != 0); 213*381a2a9aSdr } 214*381a2a9aSdr if (hook4_loopback_in) { 215*381a2a9aSdr hook4_loopback_in = (net_unregister_hook(ipf_ipv4, 216*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) != 0); 217*381a2a9aSdr } 218*381a2a9aSdr if (hook4_loopback_out) { 219*381a2a9aSdr hook4_loopback_out = (net_unregister_hook(ipf_ipv4, 220*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) != 0); 221*381a2a9aSdr } 222*381a2a9aSdr 223*381a2a9aSdr if (net_release(ipf_ipv4) != 0) 224*381a2a9aSdr goto detach_failed; 225*381a2a9aSdr ipf_ipv4 = NULL; 226*381a2a9aSdr } 227*381a2a9aSdr 2287c478bd9Sstevel@tonic-gate #ifdef IPFDEBUG 2297c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "ipldetach()\n"); 2307c478bd9Sstevel@tonic-gate #endif 2317c478bd9Sstevel@tonic-gate 232*381a2a9aSdr WRITE_ENTER(&ipf_global); 233ab25eeb5Syz fr_deinitialise(); 2347c478bd9Sstevel@tonic-gate 2357663b816Sml (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 2367663b816Sml (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE); 2377c478bd9Sstevel@tonic-gate 2387c478bd9Sstevel@tonic-gate if (ipf_locks_done == 1) { 2397c478bd9Sstevel@tonic-gate MUTEX_DESTROY(&ipf_timeoutlock); 2407c478bd9Sstevel@tonic-gate MUTEX_DESTROY(&ipf_rw); 2417c478bd9Sstevel@tonic-gate RW_DESTROY(&ipf_ipidfrag); 2427c478bd9Sstevel@tonic-gate ipf_locks_done = 0; 2437c478bd9Sstevel@tonic-gate } 244*381a2a9aSdr 245*381a2a9aSdr if (hook4_physical_in || hook4_physical_out || hook4_nic_events || 246*381a2a9aSdr hook4_loopback_in || hook4_loopback_out || hook6_nic_events || 247*381a2a9aSdr hook6_physical_in || hook6_physical_out || hook6_loopback_in || 248*381a2a9aSdr hook6_loopback_out) 249*381a2a9aSdr return -1; 250*381a2a9aSdr 2517c478bd9Sstevel@tonic-gate return 0; 252*381a2a9aSdr 253*381a2a9aSdr detach_failed: 254*381a2a9aSdr WRITE_ENTER(&ipf_global); 255*381a2a9aSdr return -1; 2567c478bd9Sstevel@tonic-gate } 2577c478bd9Sstevel@tonic-gate 2587c478bd9Sstevel@tonic-gate 2597c478bd9Sstevel@tonic-gate int iplattach __P((void)) 2607c478bd9Sstevel@tonic-gate { 2617c478bd9Sstevel@tonic-gate #if SOLARIS2 < 10 2627c478bd9Sstevel@tonic-gate int i; 2637c478bd9Sstevel@tonic-gate #endif 2647c478bd9Sstevel@tonic-gate 2657c478bd9Sstevel@tonic-gate #ifdef IPFDEBUG 2667c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "iplattach()\n"); 2677c478bd9Sstevel@tonic-gate #endif 2687c478bd9Sstevel@tonic-gate 2697c478bd9Sstevel@tonic-gate ASSERT(rw_read_locked(&ipf_global.ipf_lk) == 0); 2707c478bd9Sstevel@tonic-gate 2717c478bd9Sstevel@tonic-gate bzero((char *)frcache, sizeof(frcache)); 2727c478bd9Sstevel@tonic-gate MUTEX_INIT(&ipf_rw, "ipf rw mutex"); 2737c478bd9Sstevel@tonic-gate MUTEX_INIT(&ipf_timeoutlock, "ipf timeout lock mutex"); 2747c478bd9Sstevel@tonic-gate RWLOCK_INIT(&ipf_ipidfrag, "ipf IP NAT-Frag rwlock"); 2757c478bd9Sstevel@tonic-gate ipf_locks_done = 1; 2767c478bd9Sstevel@tonic-gate 277ab25eeb5Syz if (fr_initialise() < 0) 2787c478bd9Sstevel@tonic-gate return -1; 2797c478bd9Sstevel@tonic-gate 280*381a2a9aSdr HOOK_INIT(&ipfhook_nicevents, ipf_nic_event_v4, 281*381a2a9aSdr "ipfilter_hook_nicevents"); 282*381a2a9aSdr HOOK_INIT(&ipfhook_in, ipf_hook_in, "ipfilter_hook_in"); 283*381a2a9aSdr HOOK_INIT(&ipfhook_out, ipf_hook_out, "ipfilter_hook_out"); 284*381a2a9aSdr 285*381a2a9aSdr /* 286*381a2a9aSdr * If we hold this lock over all of the net_register_hook calls, we 287*381a2a9aSdr * can cause a deadlock to occur with the following lock ordering: 288*381a2a9aSdr * W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs 289*381a2a9aSdr * R(hook_family)->R(hei_lock)->R(ipf_global) (packet path) 290*381a2a9aSdr */ 291*381a2a9aSdr RWLOCK_EXIT(&ipf_global); 292*381a2a9aSdr 293*381a2a9aSdr /* 294*381a2a9aSdr * Add IPv4 hooks 295*381a2a9aSdr */ 296*381a2a9aSdr ipf_ipv4 = net_lookup(NHF_INET); 297*381a2a9aSdr if (ipf_ipv4 == NULL) 298*381a2a9aSdr goto hookup_failed; 299*381a2a9aSdr 300*381a2a9aSdr hook4_nic_events = (net_register_hook(ipf_ipv4, NH_NIC_EVENTS, 301*381a2a9aSdr &ipfhook_nicevents) == 0); 302*381a2a9aSdr if (!hook4_nic_events) 303*381a2a9aSdr goto hookup_failed; 304*381a2a9aSdr 305*381a2a9aSdr ipfhook_in.h_func = ipf_hook_in; 306*381a2a9aSdr hook4_physical_in = (net_register_hook(ipf_ipv4, NH_PHYSICAL_IN, 307*381a2a9aSdr &ipfhook_in) == 0); 308*381a2a9aSdr if (!hook4_physical_in) 309*381a2a9aSdr goto hookup_failed; 310*381a2a9aSdr 311*381a2a9aSdr ipfhook_in.h_func = ipf_hook_out; 312*381a2a9aSdr hook4_physical_out = (net_register_hook(ipf_ipv4, NH_PHYSICAL_OUT, 313*381a2a9aSdr &ipfhook_out) == 0); 314*381a2a9aSdr if (!hook4_physical_out) 315*381a2a9aSdr goto hookup_failed; 316*381a2a9aSdr 317*381a2a9aSdr if (ipf_loopback) { 318*381a2a9aSdr ipfhook_in.h_func = ipf_hook_loop_in; 319*381a2a9aSdr hook4_loopback_in = (net_register_hook(ipf_ipv4, 320*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) == 0); 321*381a2a9aSdr if (!hook4_loopback_in) 322*381a2a9aSdr goto hookup_failed; 323*381a2a9aSdr 324*381a2a9aSdr ipfhook_in.h_func = ipf_hook_loop_out; 325*381a2a9aSdr hook4_loopback_out = (net_register_hook(ipf_ipv4, 326*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) == 0); 327*381a2a9aSdr if (!hook4_loopback_out) 328*381a2a9aSdr goto hookup_failed; 329*381a2a9aSdr } 330*381a2a9aSdr /* 331*381a2a9aSdr * Add IPv6 hooks 332*381a2a9aSdr */ 333*381a2a9aSdr ipf_ipv6 = net_lookup(NHF_INET6); 334*381a2a9aSdr if (ipf_ipv6 == NULL) 335*381a2a9aSdr goto hookup_failed; 336*381a2a9aSdr 337*381a2a9aSdr HOOK_INIT(&ipfhook_nicevents, ipf_nic_event_v6, 338*381a2a9aSdr "ipfilter_hook_nicevents"); 339*381a2a9aSdr hook6_nic_events = (net_register_hook(ipf_ipv6, NH_NIC_EVENTS, 340*381a2a9aSdr &ipfhook_nicevents) == 0); 341*381a2a9aSdr if (!hook6_nic_events) 342*381a2a9aSdr goto hookup_failed; 343*381a2a9aSdr 344*381a2a9aSdr ipfhook_in.h_func = ipf_hook_in; 345*381a2a9aSdr hook6_physical_in = (net_register_hook(ipf_ipv6, NH_PHYSICAL_IN, 346*381a2a9aSdr &ipfhook_in) == 0); 347*381a2a9aSdr if (!hook6_physical_in) 348*381a2a9aSdr goto hookup_failed; 349*381a2a9aSdr 350*381a2a9aSdr ipfhook_in.h_func = ipf_hook_out; 351*381a2a9aSdr hook6_physical_out = (net_register_hook(ipf_ipv6, NH_PHYSICAL_OUT, 352*381a2a9aSdr &ipfhook_out) == 0); 353*381a2a9aSdr if (!hook6_physical_out) 354*381a2a9aSdr goto hookup_failed; 355*381a2a9aSdr 356*381a2a9aSdr if (ipf_loopback) { 357*381a2a9aSdr ipfhook_in.h_func = ipf_hook_loop_in; 358*381a2a9aSdr hook6_loopback_in = (net_register_hook(ipf_ipv6, 359*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) == 0); 360*381a2a9aSdr if (!hook6_loopback_in) 361*381a2a9aSdr goto hookup_failed; 362*381a2a9aSdr 363*381a2a9aSdr ipfhook_in.h_func = ipf_hook_loop_out; 364*381a2a9aSdr hook6_loopback_out = (net_register_hook(ipf_ipv6, 365*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) == 0); 366*381a2a9aSdr if (!hook6_loopback_out) 367*381a2a9aSdr goto hookup_failed; 368*381a2a9aSdr } 369*381a2a9aSdr 370*381a2a9aSdr /* 371*381a2a9aSdr * Reacquire ipf_global, now it is safe. 372*381a2a9aSdr */ 373*381a2a9aSdr WRITE_ENTER(&ipf_global); 374*381a2a9aSdr 3757c478bd9Sstevel@tonic-gate /* Do not use private interface ip_params_arr[] in Solaris 10 */ 3767c478bd9Sstevel@tonic-gate #if SOLARIS2 < 10 3777c478bd9Sstevel@tonic-gate 3787c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 8 3797c478bd9Sstevel@tonic-gate ip_forwarding = &ip_g_forward; 3807c478bd9Sstevel@tonic-gate #endif 3817c478bd9Sstevel@tonic-gate /* 3827c478bd9Sstevel@tonic-gate * XXX - There is no terminator for this array, so it is not possible 3837c478bd9Sstevel@tonic-gate * to tell if what we are looking for is missing and go off the end 3847c478bd9Sstevel@tonic-gate * of the array. 3857c478bd9Sstevel@tonic-gate */ 3867c478bd9Sstevel@tonic-gate 387ab25eeb5Syz #if SOLARIS2 <= 8 3887c478bd9Sstevel@tonic-gate for (i = 0; ; i++) { 3897c478bd9Sstevel@tonic-gate if (!strcmp(ip_param_arr[i].ip_param_name, "ip_def_ttl")) { 3907c478bd9Sstevel@tonic-gate ip_ttl_ptr = &ip_param_arr[i].ip_param_value; 3917c478bd9Sstevel@tonic-gate } else if (!strcmp(ip_param_arr[i].ip_param_name, 3927c478bd9Sstevel@tonic-gate "ip_path_mtu_discovery")) { 3937c478bd9Sstevel@tonic-gate ip_mtudisc = &ip_param_arr[i].ip_param_value; 3947c478bd9Sstevel@tonic-gate } 3957c478bd9Sstevel@tonic-gate #if SOLARIS2 < 8 3967c478bd9Sstevel@tonic-gate else if (!strcmp(ip_param_arr[i].ip_param_name, 3977c478bd9Sstevel@tonic-gate "ip_forwarding")) { 3987c478bd9Sstevel@tonic-gate ip_forwarding = &ip_param_arr[i].ip_param_value; 3997c478bd9Sstevel@tonic-gate } 4007c478bd9Sstevel@tonic-gate #else 4017c478bd9Sstevel@tonic-gate else if (!strcmp(ip_param_arr[i].ip_param_name, 4027c478bd9Sstevel@tonic-gate "ip6_forwarding")) { 4037c478bd9Sstevel@tonic-gate ip6_forwarding = &ip_param_arr[i].ip_param_value; 4047c478bd9Sstevel@tonic-gate } 4057c478bd9Sstevel@tonic-gate #endif 4067c478bd9Sstevel@tonic-gate 4077c478bd9Sstevel@tonic-gate if (ip_mtudisc != NULL && ip_ttl_ptr != NULL && 4087c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 8 4097c478bd9Sstevel@tonic-gate ip6_forwarding != NULL && 4107c478bd9Sstevel@tonic-gate #endif 4117c478bd9Sstevel@tonic-gate ip_forwarding != NULL) 4127c478bd9Sstevel@tonic-gate break; 4137c478bd9Sstevel@tonic-gate } 414ab25eeb5Syz #endif 4157c478bd9Sstevel@tonic-gate 4167c478bd9Sstevel@tonic-gate if (fr_control_forwarding & 1) { 417ab25eeb5Syz if (ip_forwarding != NULL) 418ab25eeb5Syz *ip_forwarding = 1; 4197c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 8 420ab25eeb5Syz if (ip6_forwarding != NULL) 421ab25eeb5Syz *ip6_forwarding = 1; 4227c478bd9Sstevel@tonic-gate #endif 4237c478bd9Sstevel@tonic-gate } 4247c478bd9Sstevel@tonic-gate 4257c478bd9Sstevel@tonic-gate #endif 4267c478bd9Sstevel@tonic-gate 427*381a2a9aSdr return 0; 428*381a2a9aSdr hookup_failed: 429*381a2a9aSdr WRITE_ENTER(&ipf_global); 430*381a2a9aSdr return -1; 431*381a2a9aSdr } 432*381a2a9aSdr 433*381a2a9aSdr static int fr_setipfloopback(set) 434*381a2a9aSdr int set; 435*381a2a9aSdr { 436*381a2a9aSdr if (ipf_ipv4 == NULL || ipf_ipv6 == NULL) 437*381a2a9aSdr return EFAULT; 438*381a2a9aSdr 439*381a2a9aSdr if (set && !ipf_loopback) { 440*381a2a9aSdr ipf_loopback = 1; 441*381a2a9aSdr 442*381a2a9aSdr hook4_loopback_in = (net_register_hook(ipf_ipv4, 443*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) == 0); 444*381a2a9aSdr if (!hook4_loopback_in) 445*381a2a9aSdr return EINVAL; 446*381a2a9aSdr 447*381a2a9aSdr hook4_loopback_out = (net_register_hook(ipf_ipv4, 448*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) == 0); 449*381a2a9aSdr if (!hook4_loopback_out) 450*381a2a9aSdr return EINVAL; 451*381a2a9aSdr 452*381a2a9aSdr hook6_loopback_in = (net_register_hook(ipf_ipv6, 453*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) == 0); 454*381a2a9aSdr if (!hook6_loopback_in) 455*381a2a9aSdr return EINVAL; 456*381a2a9aSdr 457*381a2a9aSdr hook6_loopback_out = (net_register_hook(ipf_ipv6, 458*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) == 0); 459*381a2a9aSdr if (!hook6_loopback_out) 460*381a2a9aSdr return EINVAL; 461*381a2a9aSdr 462*381a2a9aSdr } else if (!set && ipf_loopback) { 463*381a2a9aSdr ipf_loopback = 0; 464*381a2a9aSdr 465*381a2a9aSdr hook4_loopback_in = (net_unregister_hook(ipf_ipv4, 466*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) != 0); 467*381a2a9aSdr if (hook4_loopback_in) 468*381a2a9aSdr return EBUSY; 469*381a2a9aSdr 470*381a2a9aSdr hook4_loopback_out = (net_unregister_hook(ipf_ipv4, 471*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) != 0); 472*381a2a9aSdr if (hook4_loopback_out) 473*381a2a9aSdr return EBUSY; 474*381a2a9aSdr 475*381a2a9aSdr hook6_loopback_in = (net_unregister_hook(ipf_ipv6, 476*381a2a9aSdr NH_LOOPBACK_IN, &ipfhook_in) != 0); 477*381a2a9aSdr if (hook6_loopback_in) 478*381a2a9aSdr return EBUSY; 479*381a2a9aSdr 480*381a2a9aSdr hook6_loopback_out = (net_unregister_hook(ipf_ipv6, 481*381a2a9aSdr NH_LOOPBACK_OUT, &ipfhook_out) != 0); 482*381a2a9aSdr if (hook6_loopback_out) 483*381a2a9aSdr return EBUSY; 484*381a2a9aSdr } 4857c478bd9Sstevel@tonic-gate return 0; 4867c478bd9Sstevel@tonic-gate } 4877c478bd9Sstevel@tonic-gate 4887c478bd9Sstevel@tonic-gate 4897c478bd9Sstevel@tonic-gate /* 4907c478bd9Sstevel@tonic-gate * Filter ioctl interface. 4917c478bd9Sstevel@tonic-gate */ 4927c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 4937c478bd9Sstevel@tonic-gate int iplioctl(dev, cmd, data, mode, cp, rp) 4947c478bd9Sstevel@tonic-gate dev_t dev; 4957c478bd9Sstevel@tonic-gate int cmd; 4967c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 7 4977c478bd9Sstevel@tonic-gate intptr_t data; 4987c478bd9Sstevel@tonic-gate #else 4997c478bd9Sstevel@tonic-gate int *data; 5007c478bd9Sstevel@tonic-gate #endif 5017c478bd9Sstevel@tonic-gate int mode; 5027c478bd9Sstevel@tonic-gate cred_t *cp; 5037c478bd9Sstevel@tonic-gate int *rp; 5047c478bd9Sstevel@tonic-gate { 5057c478bd9Sstevel@tonic-gate int error = 0, tmp; 5067c478bd9Sstevel@tonic-gate friostat_t fio; 5077c478bd9Sstevel@tonic-gate minor_t unit; 5087c478bd9Sstevel@tonic-gate u_int enable; 5097c478bd9Sstevel@tonic-gate 5107c478bd9Sstevel@tonic-gate #ifdef IPFDEBUG 5117c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "iplioctl(%x,%x,%x,%d,%x,%d)\n", 5127c478bd9Sstevel@tonic-gate dev, cmd, data, mode, cp, rp); 5137c478bd9Sstevel@tonic-gate #endif 5147c478bd9Sstevel@tonic-gate unit = getminor(dev); 5157c478bd9Sstevel@tonic-gate if (IPL_LOGMAX < unit) 5167c478bd9Sstevel@tonic-gate return ENXIO; 5177c478bd9Sstevel@tonic-gate 5187c478bd9Sstevel@tonic-gate if (fr_running <= 0) { 5197c478bd9Sstevel@tonic-gate if (unit != IPL_LOGIPF) 5207c478bd9Sstevel@tonic-gate return EIO; 5217c478bd9Sstevel@tonic-gate if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET && 522ab25eeb5Syz cmd != SIOCIPFSET && cmd != SIOCFRENB && 523ab25eeb5Syz cmd != SIOCGETFS && cmd != SIOCGETFF) 5247c478bd9Sstevel@tonic-gate return EIO; 5257c478bd9Sstevel@tonic-gate } 5267c478bd9Sstevel@tonic-gate 5277c478bd9Sstevel@tonic-gate READ_ENTER(&ipf_global); 5287c478bd9Sstevel@tonic-gate 5297c478bd9Sstevel@tonic-gate error = fr_ioctlswitch(unit, (caddr_t)data, cmd, mode); 5307c478bd9Sstevel@tonic-gate if (error != -1) { 5317c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_global); 5327c478bd9Sstevel@tonic-gate return error; 5337c478bd9Sstevel@tonic-gate } 5347c478bd9Sstevel@tonic-gate error = 0; 5357c478bd9Sstevel@tonic-gate 5367c478bd9Sstevel@tonic-gate switch (cmd) 5377c478bd9Sstevel@tonic-gate { 5387c478bd9Sstevel@tonic-gate case SIOCFRENB : 5397c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 5407c478bd9Sstevel@tonic-gate error = EPERM; 5417c478bd9Sstevel@tonic-gate else { 5427c478bd9Sstevel@tonic-gate error = COPYIN((caddr_t)data, (caddr_t)&enable, 5437c478bd9Sstevel@tonic-gate sizeof(enable)); 5447c478bd9Sstevel@tonic-gate if (error != 0) { 5457c478bd9Sstevel@tonic-gate error = EFAULT; 5467c478bd9Sstevel@tonic-gate break; 5477c478bd9Sstevel@tonic-gate } 5487c478bd9Sstevel@tonic-gate 5497c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_global); 5507c478bd9Sstevel@tonic-gate WRITE_ENTER(&ipf_global); 5517c478bd9Sstevel@tonic-gate if (enable) { 5527c478bd9Sstevel@tonic-gate if (fr_running > 0) 5537c478bd9Sstevel@tonic-gate error = 0; 5547c478bd9Sstevel@tonic-gate else 5557c478bd9Sstevel@tonic-gate error = iplattach(); 5567c478bd9Sstevel@tonic-gate if (error == 0) 5577c478bd9Sstevel@tonic-gate fr_running = 1; 5587c478bd9Sstevel@tonic-gate else 5597c478bd9Sstevel@tonic-gate (void) ipldetach(); 5607c478bd9Sstevel@tonic-gate } else { 5617c478bd9Sstevel@tonic-gate error = ipldetach(); 5627c478bd9Sstevel@tonic-gate if (error == 0) 5637c478bd9Sstevel@tonic-gate fr_running = -1; 5647c478bd9Sstevel@tonic-gate } 5657c478bd9Sstevel@tonic-gate } 5667c478bd9Sstevel@tonic-gate break; 5677c478bd9Sstevel@tonic-gate case SIOCIPFSET : 5687c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) { 5697c478bd9Sstevel@tonic-gate error = EPERM; 5707c478bd9Sstevel@tonic-gate break; 5717c478bd9Sstevel@tonic-gate } 5727c478bd9Sstevel@tonic-gate /* FALLTHRU */ 5737c478bd9Sstevel@tonic-gate case SIOCIPFGETNEXT : 5747c478bd9Sstevel@tonic-gate case SIOCIPFGET : 575ab25eeb5Syz error = fr_ipftune(cmd, (void *)data); 5767c478bd9Sstevel@tonic-gate break; 5777c478bd9Sstevel@tonic-gate case SIOCSETFF : 5787c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 5797c478bd9Sstevel@tonic-gate error = EPERM; 5807c478bd9Sstevel@tonic-gate else { 5817c478bd9Sstevel@tonic-gate error = COPYIN((caddr_t)data, (caddr_t)&fr_flags, 5827c478bd9Sstevel@tonic-gate sizeof(fr_flags)); 5837c478bd9Sstevel@tonic-gate if (error != 0) 5847c478bd9Sstevel@tonic-gate error = EFAULT; 5857c478bd9Sstevel@tonic-gate } 5867c478bd9Sstevel@tonic-gate break; 587*381a2a9aSdr case SIOCIPFLP : 588*381a2a9aSdr error = COPYIN((caddr_t)data, (caddr_t)&tmp, 589*381a2a9aSdr sizeof(tmp)); 590*381a2a9aSdr if (error != 0) 591*381a2a9aSdr error = EFAULT; 592*381a2a9aSdr else 593*381a2a9aSdr error = fr_setipfloopback(tmp); 594*381a2a9aSdr break; 5957c478bd9Sstevel@tonic-gate case SIOCGETFF : 5967c478bd9Sstevel@tonic-gate error = COPYOUT((caddr_t)&fr_flags, (caddr_t)data, 5977c478bd9Sstevel@tonic-gate sizeof(fr_flags)); 5987c478bd9Sstevel@tonic-gate if (error != 0) 5997c478bd9Sstevel@tonic-gate error = EFAULT; 6007c478bd9Sstevel@tonic-gate break; 6017c478bd9Sstevel@tonic-gate case SIOCFUNCL : 6027c478bd9Sstevel@tonic-gate error = fr_resolvefunc((void *)data); 6037c478bd9Sstevel@tonic-gate break; 6047c478bd9Sstevel@tonic-gate case SIOCINAFR : 6057c478bd9Sstevel@tonic-gate case SIOCRMAFR : 6067c478bd9Sstevel@tonic-gate case SIOCADAFR : 6077c478bd9Sstevel@tonic-gate case SIOCZRLST : 6087c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 6097c478bd9Sstevel@tonic-gate error = EPERM; 6107c478bd9Sstevel@tonic-gate else 6117c478bd9Sstevel@tonic-gate error = frrequest(unit, cmd, (caddr_t)data, 6127c478bd9Sstevel@tonic-gate fr_active, 1); 6137c478bd9Sstevel@tonic-gate break; 6147c478bd9Sstevel@tonic-gate case SIOCINIFR : 6157c478bd9Sstevel@tonic-gate case SIOCRMIFR : 6167c478bd9Sstevel@tonic-gate case SIOCADIFR : 6177c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 6187c478bd9Sstevel@tonic-gate error = EPERM; 6197c478bd9Sstevel@tonic-gate else 6207c478bd9Sstevel@tonic-gate error = frrequest(unit, cmd, (caddr_t)data, 6217c478bd9Sstevel@tonic-gate 1 - fr_active, 1); 6227c478bd9Sstevel@tonic-gate break; 6237c478bd9Sstevel@tonic-gate case SIOCSWAPA : 6247c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 6257c478bd9Sstevel@tonic-gate error = EPERM; 6267c478bd9Sstevel@tonic-gate else { 6277c478bd9Sstevel@tonic-gate WRITE_ENTER(&ipf_mutex); 6287c478bd9Sstevel@tonic-gate bzero((char *)frcache, sizeof(frcache[0]) * 2); 6297c478bd9Sstevel@tonic-gate error = COPYOUT((caddr_t)&fr_active, (caddr_t)data, 6307c478bd9Sstevel@tonic-gate sizeof(fr_active)); 6317c478bd9Sstevel@tonic-gate if (error != 0) 6327c478bd9Sstevel@tonic-gate error = EFAULT; 6337c478bd9Sstevel@tonic-gate else 6347c478bd9Sstevel@tonic-gate fr_active = 1 - fr_active; 6357c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_mutex); 6367c478bd9Sstevel@tonic-gate } 6377c478bd9Sstevel@tonic-gate break; 6387c478bd9Sstevel@tonic-gate case SIOCGETFS : 6397c478bd9Sstevel@tonic-gate fr_getstat(&fio); 6407c478bd9Sstevel@tonic-gate error = fr_outobj((void *)data, &fio, IPFOBJ_IPFSTAT); 6417c478bd9Sstevel@tonic-gate break; 6427c478bd9Sstevel@tonic-gate case SIOCFRZST : 6437c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 6447c478bd9Sstevel@tonic-gate error = EPERM; 6457c478bd9Sstevel@tonic-gate else 646ab25eeb5Syz error = fr_zerostats((caddr_t)data); 6477c478bd9Sstevel@tonic-gate break; 6487c478bd9Sstevel@tonic-gate case SIOCIPFFL : 6497c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 6507c478bd9Sstevel@tonic-gate error = EPERM; 6517c478bd9Sstevel@tonic-gate else { 6527c478bd9Sstevel@tonic-gate error = COPYIN((caddr_t)data, (caddr_t)&tmp, 6537c478bd9Sstevel@tonic-gate sizeof(tmp)); 6547c478bd9Sstevel@tonic-gate if (!error) { 6557663b816Sml tmp = frflush(unit, 4, tmp); 6567c478bd9Sstevel@tonic-gate error = COPYOUT((caddr_t)&tmp, (caddr_t)data, 6577c478bd9Sstevel@tonic-gate sizeof(tmp)); 6587c478bd9Sstevel@tonic-gate if (error != 0) 6597c478bd9Sstevel@tonic-gate error = EFAULT; 6607c478bd9Sstevel@tonic-gate } else 6617c478bd9Sstevel@tonic-gate error = EFAULT; 6627c478bd9Sstevel@tonic-gate } 6637c478bd9Sstevel@tonic-gate break; 6647663b816Sml #ifdef USE_INET6 6657663b816Sml case SIOCIPFL6 : 6667663b816Sml if (!(mode & FWRITE)) 6677663b816Sml error = EPERM; 6687663b816Sml else { 6697663b816Sml error = COPYIN((caddr_t)data, (caddr_t)&tmp, 6707663b816Sml sizeof(tmp)); 6717663b816Sml if (!error) { 6727663b816Sml tmp = frflush(unit, 6, tmp); 6737663b816Sml error = COPYOUT((caddr_t)&tmp, (caddr_t)data, 6747663b816Sml sizeof(tmp)); 6757663b816Sml if (error != 0) 6767663b816Sml error = EFAULT; 6777663b816Sml } else 6787663b816Sml error = EFAULT; 6797663b816Sml } 6807663b816Sml break; 6817663b816Sml #endif 6827c478bd9Sstevel@tonic-gate case SIOCSTLCK : 6837c478bd9Sstevel@tonic-gate error = COPYIN((caddr_t)data, (caddr_t)&tmp, sizeof(tmp)); 6847c478bd9Sstevel@tonic-gate if (error == 0) { 6857c478bd9Sstevel@tonic-gate fr_state_lock = tmp; 6867c478bd9Sstevel@tonic-gate fr_nat_lock = tmp; 6877c478bd9Sstevel@tonic-gate fr_frag_lock = tmp; 6887c478bd9Sstevel@tonic-gate fr_auth_lock = tmp; 6897c478bd9Sstevel@tonic-gate } else 6907c478bd9Sstevel@tonic-gate error = EFAULT; 6917c478bd9Sstevel@tonic-gate break; 6927c478bd9Sstevel@tonic-gate #ifdef IPFILTER_LOG 6937c478bd9Sstevel@tonic-gate case SIOCIPFFB : 6947c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 6957c478bd9Sstevel@tonic-gate error = EPERM; 6967c478bd9Sstevel@tonic-gate else { 6977c478bd9Sstevel@tonic-gate tmp = ipflog_clear(unit); 6987c478bd9Sstevel@tonic-gate error = COPYOUT((caddr_t)&tmp, (caddr_t)data, 6997c478bd9Sstevel@tonic-gate sizeof(tmp)); 7007c478bd9Sstevel@tonic-gate if (error) 7017c478bd9Sstevel@tonic-gate error = EFAULT; 7027c478bd9Sstevel@tonic-gate } 7037c478bd9Sstevel@tonic-gate break; 7047c478bd9Sstevel@tonic-gate #endif /* IPFILTER_LOG */ 7057c478bd9Sstevel@tonic-gate case SIOCFRSYN : 7067c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) 7077c478bd9Sstevel@tonic-gate error = EPERM; 7087c478bd9Sstevel@tonic-gate else { 7097c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_global); 7107c478bd9Sstevel@tonic-gate WRITE_ENTER(&ipf_global); 711*381a2a9aSdr 712*381a2a9aSdr frsync(IPFSYNC_RESYNC, 0, NULL, NULL); 713*381a2a9aSdr fr_natifpsync(IPFSYNC_RESYNC, NULL, NULL); 714*381a2a9aSdr fr_nataddrsync(NULL, NULL); 715*381a2a9aSdr fr_statesync(IPFSYNC_RESYNC, 0, NULL, NULL); 716*381a2a9aSdr error = 0; 7177c478bd9Sstevel@tonic-gate } 7187c478bd9Sstevel@tonic-gate break; 7197c478bd9Sstevel@tonic-gate case SIOCGFRST : 7207c478bd9Sstevel@tonic-gate error = fr_outobj((void *)data, fr_fragstats(), 7217c478bd9Sstevel@tonic-gate IPFOBJ_FRAGSTAT); 7227c478bd9Sstevel@tonic-gate break; 7237c478bd9Sstevel@tonic-gate case FIONREAD : 7247c478bd9Sstevel@tonic-gate #ifdef IPFILTER_LOG 7257c478bd9Sstevel@tonic-gate tmp = (int)iplused[IPL_LOGIPF]; 7267c478bd9Sstevel@tonic-gate 7277c478bd9Sstevel@tonic-gate error = COPYOUT((caddr_t)&tmp, (caddr_t)data, sizeof(tmp)); 7287c478bd9Sstevel@tonic-gate if (error != 0) 7297c478bd9Sstevel@tonic-gate error = EFAULT; 7307c478bd9Sstevel@tonic-gate #endif 7317c478bd9Sstevel@tonic-gate break; 7327c478bd9Sstevel@tonic-gate default : 733ab25eeb5Syz cmn_err(CE_NOTE, "Unknown: cmd 0x%x data %p", cmd, (void *)data); 7347c478bd9Sstevel@tonic-gate error = EINVAL; 7357c478bd9Sstevel@tonic-gate break; 7367c478bd9Sstevel@tonic-gate } 7377c478bd9Sstevel@tonic-gate RWLOCK_EXIT(&ipf_global); 7387c478bd9Sstevel@tonic-gate return error; 7397c478bd9Sstevel@tonic-gate } 7407c478bd9Sstevel@tonic-gate 7417c478bd9Sstevel@tonic-gate 742*381a2a9aSdr phy_if_t get_unit(name, v) 743*381a2a9aSdr char *name; 744*381a2a9aSdr int v; 7457c478bd9Sstevel@tonic-gate { 746*381a2a9aSdr phy_if_t phy; 747*381a2a9aSdr net_data_t nif; 748*381a2a9aSdr 749*381a2a9aSdr if (v == 4) 750*381a2a9aSdr nif = ipf_ipv4; 751*381a2a9aSdr else if (v == 6) 752*381a2a9aSdr nif = ipf_ipv6; 753*381a2a9aSdr else 754*381a2a9aSdr return 0; 755*381a2a9aSdr 756*381a2a9aSdr phy = net_phylookup(nif, name); 757*381a2a9aSdr 758*381a2a9aSdr return (phy); 7597c478bd9Sstevel@tonic-gate } 7607c478bd9Sstevel@tonic-gate 7617c478bd9Sstevel@tonic-gate /* 7627c478bd9Sstevel@tonic-gate * routines below for saving IP headers to buffer 7637c478bd9Sstevel@tonic-gate */ 7647c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 7657c478bd9Sstevel@tonic-gate int iplopen(devp, flags, otype, cred) 7667c478bd9Sstevel@tonic-gate dev_t *devp; 7677c478bd9Sstevel@tonic-gate int flags, otype; 7687c478bd9Sstevel@tonic-gate cred_t *cred; 7697c478bd9Sstevel@tonic-gate { 7707c478bd9Sstevel@tonic-gate minor_t min = getminor(*devp); 7717c478bd9Sstevel@tonic-gate 7727c478bd9Sstevel@tonic-gate #ifdef IPFDEBUG 7737c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "iplopen(%x,%x,%x,%x)\n", devp, flags, otype, cred); 7747c478bd9Sstevel@tonic-gate #endif 7757c478bd9Sstevel@tonic-gate if (!(otype & OTYP_CHR)) 7767c478bd9Sstevel@tonic-gate return ENXIO; 7777c478bd9Sstevel@tonic-gate 7787c478bd9Sstevel@tonic-gate min = (IPL_LOGMAX < min) ? ENXIO : 0; 7797c478bd9Sstevel@tonic-gate return min; 7807c478bd9Sstevel@tonic-gate } 7817c478bd9Sstevel@tonic-gate 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 7847c478bd9Sstevel@tonic-gate int iplclose(dev, flags, otype, cred) 7857c478bd9Sstevel@tonic-gate dev_t dev; 7867c478bd9Sstevel@tonic-gate int flags, otype; 7877c478bd9Sstevel@tonic-gate cred_t *cred; 7887c478bd9Sstevel@tonic-gate { 7897c478bd9Sstevel@tonic-gate minor_t min = getminor(dev); 7907c478bd9Sstevel@tonic-gate 7917c478bd9Sstevel@tonic-gate #ifdef IPFDEBUG 7927c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "iplclose(%x,%x,%x,%x)\n", dev, flags, otype, cred); 7937c478bd9Sstevel@tonic-gate #endif 7947c478bd9Sstevel@tonic-gate 7957c478bd9Sstevel@tonic-gate min = (IPL_LOGMAX < min) ? ENXIO : 0; 7967c478bd9Sstevel@tonic-gate return min; 7977c478bd9Sstevel@tonic-gate } 7987c478bd9Sstevel@tonic-gate 7997c478bd9Sstevel@tonic-gate #ifdef IPFILTER_LOG 8007c478bd9Sstevel@tonic-gate /* 8017c478bd9Sstevel@tonic-gate * iplread/ipllog 8027c478bd9Sstevel@tonic-gate * both of these must operate with at least splnet() lest they be 8037c478bd9Sstevel@tonic-gate * called during packet processing and cause an inconsistancy to appear in 8047c478bd9Sstevel@tonic-gate * the filter lists. 8057c478bd9Sstevel@tonic-gate */ 8067c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 8077c478bd9Sstevel@tonic-gate int iplread(dev, uio, cp) 8087c478bd9Sstevel@tonic-gate dev_t dev; 8097c478bd9Sstevel@tonic-gate register struct uio *uio; 8107c478bd9Sstevel@tonic-gate cred_t *cp; 8117c478bd9Sstevel@tonic-gate { 8127c478bd9Sstevel@tonic-gate # ifdef IPFDEBUG 8137c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "iplread(%x,%x,%x)\n", dev, uio, cp); 8147c478bd9Sstevel@tonic-gate # endif 8157c478bd9Sstevel@tonic-gate # ifdef IPFILTER_SYNC 8167c478bd9Sstevel@tonic-gate if (getminor(dev) == IPL_LOGSYNC) 8177c478bd9Sstevel@tonic-gate return ipfsync_read(uio); 8187c478bd9Sstevel@tonic-gate # endif 8197c478bd9Sstevel@tonic-gate 8207c478bd9Sstevel@tonic-gate return ipflog_read(getminor(dev), uio); 8217c478bd9Sstevel@tonic-gate } 8227c478bd9Sstevel@tonic-gate #endif /* IPFILTER_LOG */ 8237c478bd9Sstevel@tonic-gate 8247c478bd9Sstevel@tonic-gate 8257c478bd9Sstevel@tonic-gate /* 8267c478bd9Sstevel@tonic-gate * iplread/ipllog 8277c478bd9Sstevel@tonic-gate * both of these must operate with at least splnet() lest they be 8287c478bd9Sstevel@tonic-gate * called during packet processing and cause an inconsistancy to appear in 8297c478bd9Sstevel@tonic-gate * the filter lists. 8307c478bd9Sstevel@tonic-gate */ 8317c478bd9Sstevel@tonic-gate int iplwrite(dev, uio, cp) 8327c478bd9Sstevel@tonic-gate dev_t dev; 8337c478bd9Sstevel@tonic-gate register struct uio *uio; 8347c478bd9Sstevel@tonic-gate cred_t *cp; 8357c478bd9Sstevel@tonic-gate { 8367c478bd9Sstevel@tonic-gate #ifdef IPFDEBUG 8377c478bd9Sstevel@tonic-gate cmn_err(CE_CONT, "iplwrite(%x,%x,%x)\n", dev, uio, cp); 8387c478bd9Sstevel@tonic-gate #endif 839ab25eeb5Syz #ifdef IPFILTER_SYNC 840ab25eeb5Syz if (getminor(dev) == IPL_LOGSYNC) 841ab25eeb5Syz return ipfsync_write(uio); 8427c478bd9Sstevel@tonic-gate #endif /* IPFILTER_SYNC */ 843ab25eeb5Syz dev = dev; /* LINT */ 844ab25eeb5Syz uio = uio; /* LINT */ 845ab25eeb5Syz cp = cp; /* LINT */ 846ab25eeb5Syz return ENXIO; 847ab25eeb5Syz } 8487c478bd9Sstevel@tonic-gate 8497c478bd9Sstevel@tonic-gate 8507c478bd9Sstevel@tonic-gate /* 8517c478bd9Sstevel@tonic-gate * fr_send_reset - this could conceivably be a call to tcp_respond(), but that 8527c478bd9Sstevel@tonic-gate * requires a large amount of setting up and isn't any more efficient. 8537c478bd9Sstevel@tonic-gate */ 8547c478bd9Sstevel@tonic-gate int fr_send_reset(fin) 8557c478bd9Sstevel@tonic-gate fr_info_t *fin; 8567c478bd9Sstevel@tonic-gate { 8577c478bd9Sstevel@tonic-gate tcphdr_t *tcp, *tcp2; 8587c478bd9Sstevel@tonic-gate int tlen, hlen; 8597c478bd9Sstevel@tonic-gate mblk_t *m; 8607c478bd9Sstevel@tonic-gate #ifdef USE_INET6 8617c478bd9Sstevel@tonic-gate ip6_t *ip6; 8627c478bd9Sstevel@tonic-gate #endif 8637c478bd9Sstevel@tonic-gate ip_t *ip; 8647c478bd9Sstevel@tonic-gate 8657c478bd9Sstevel@tonic-gate tcp = fin->fin_dp; 8667c478bd9Sstevel@tonic-gate if (tcp->th_flags & TH_RST) 8677c478bd9Sstevel@tonic-gate return -1; 8687c478bd9Sstevel@tonic-gate 8697c478bd9Sstevel@tonic-gate #ifndef IPFILTER_CKSUM 8707c478bd9Sstevel@tonic-gate if (fr_checkl4sum(fin) == -1) 8717c478bd9Sstevel@tonic-gate return -1; 8727c478bd9Sstevel@tonic-gate #endif 8737c478bd9Sstevel@tonic-gate 8747c478bd9Sstevel@tonic-gate tlen = (tcp->th_flags & (TH_SYN|TH_FIN)) ? 1 : 0; 8757c478bd9Sstevel@tonic-gate #ifdef USE_INET6 8767c478bd9Sstevel@tonic-gate if (fin->fin_v == 6) 8777c478bd9Sstevel@tonic-gate hlen = sizeof(ip6_t); 8787c478bd9Sstevel@tonic-gate else 8797c478bd9Sstevel@tonic-gate #endif 8807c478bd9Sstevel@tonic-gate hlen = sizeof(ip_t); 8817c478bd9Sstevel@tonic-gate hlen += sizeof(*tcp2); 8827c478bd9Sstevel@tonic-gate if ((m = (mblk_t *)allocb(hlen + 64, BPRI_HI)) == NULL) 8837c478bd9Sstevel@tonic-gate return -1; 8847c478bd9Sstevel@tonic-gate 8857c478bd9Sstevel@tonic-gate m->b_rptr += 64; 8867c478bd9Sstevel@tonic-gate MTYPE(m) = M_DATA; 8877c478bd9Sstevel@tonic-gate m->b_wptr = m->b_rptr + hlen; 888ab25eeb5Syz ip = (ip_t *)m->b_rptr; 889ab25eeb5Syz bzero((char *)ip, hlen); 8907c478bd9Sstevel@tonic-gate tcp2 = (struct tcphdr *)(m->b_rptr + hlen - sizeof(*tcp2)); 8917c478bd9Sstevel@tonic-gate tcp2->th_dport = tcp->th_sport; 8927c478bd9Sstevel@tonic-gate tcp2->th_sport = tcp->th_dport; 8937c478bd9Sstevel@tonic-gate if (tcp->th_flags & TH_ACK) { 8947c478bd9Sstevel@tonic-gate tcp2->th_seq = tcp->th_ack; 8957c478bd9Sstevel@tonic-gate tcp2->th_flags = TH_RST; 8967c478bd9Sstevel@tonic-gate } else { 8977c478bd9Sstevel@tonic-gate tcp2->th_ack = ntohl(tcp->th_seq); 8987c478bd9Sstevel@tonic-gate tcp2->th_ack += tlen; 8997c478bd9Sstevel@tonic-gate tcp2->th_ack = htonl(tcp2->th_ack); 9007c478bd9Sstevel@tonic-gate tcp2->th_flags = TH_RST|TH_ACK; 9017c478bd9Sstevel@tonic-gate } 9027c478bd9Sstevel@tonic-gate tcp2->th_off = sizeof(struct tcphdr) >> 2; 9037c478bd9Sstevel@tonic-gate 904ab25eeb5Syz ip->ip_v = fin->fin_v; 9057c478bd9Sstevel@tonic-gate #ifdef USE_INET6 9067c478bd9Sstevel@tonic-gate if (fin->fin_v == 6) { 9077c478bd9Sstevel@tonic-gate ip6 = (ip6_t *)m->b_rptr; 9087663b816Sml ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 9097c478bd9Sstevel@tonic-gate ip6->ip6_src = fin->fin_dst6; 9107c478bd9Sstevel@tonic-gate ip6->ip6_dst = fin->fin_src6; 9117c478bd9Sstevel@tonic-gate ip6->ip6_plen = htons(sizeof(*tcp)); 9127c478bd9Sstevel@tonic-gate ip6->ip6_nxt = IPPROTO_TCP; 9137663b816Sml tcp2->th_sum = fr_cksum(m, (ip_t *)ip6, IPPROTO_TCP, tcp2); 9147c478bd9Sstevel@tonic-gate } else 9157c478bd9Sstevel@tonic-gate #endif 9167c478bd9Sstevel@tonic-gate { 9177c478bd9Sstevel@tonic-gate ip->ip_src.s_addr = fin->fin_daddr; 9187c478bd9Sstevel@tonic-gate ip->ip_dst.s_addr = fin->fin_saddr; 9197c478bd9Sstevel@tonic-gate ip->ip_id = fr_nextipid(fin); 9207c478bd9Sstevel@tonic-gate ip->ip_hl = sizeof(*ip) >> 2; 9217c478bd9Sstevel@tonic-gate ip->ip_p = IPPROTO_TCP; 92237b40788Sekozlow ip->ip_len = sizeof(*ip) + sizeof(*tcp); 9237c478bd9Sstevel@tonic-gate ip->ip_tos = fin->fin_ip->ip_tos; 9247c478bd9Sstevel@tonic-gate tcp2->th_sum = fr_cksum(m, ip, IPPROTO_TCP, tcp2); 9257c478bd9Sstevel@tonic-gate } 926ab25eeb5Syz return fr_send_ip(fin, m, &m); 9277c478bd9Sstevel@tonic-gate } 9287c478bd9Sstevel@tonic-gate 92937b40788Sekozlow /* 93037b40788Sekozlow * Function: fr_send_ip 93137b40788Sekozlow * Returns: 0: success 93237b40788Sekozlow * -1: failed 93337b40788Sekozlow * Parameters: 93437b40788Sekozlow * fin: packet information 93537b40788Sekozlow * m: the message block where ip head starts 93637b40788Sekozlow * 93737b40788Sekozlow * Send a new packet through the IP stack. 93837b40788Sekozlow * 93937b40788Sekozlow * For IPv4 packets, ip_len must be in host byte order, and ip_v, 94037b40788Sekozlow * ip_ttl, ip_off, and ip_sum are ignored (filled in by this 94137b40788Sekozlow * function). 94237b40788Sekozlow * 94337b40788Sekozlow * For IPv6 packets, ip6_flow, ip6_vfc, and ip6_hlim are filled 94437b40788Sekozlow * in by this function. 94537b40788Sekozlow * 94637b40788Sekozlow * All other portions of the packet must be in on-the-wire format. 94737b40788Sekozlow */ 948ab25eeb5Syz /*ARGSUSED*/ 949ab25eeb5Syz static int fr_send_ip(fin, m, mpp) 9507c478bd9Sstevel@tonic-gate fr_info_t *fin; 951ab25eeb5Syz mblk_t *m, **mpp; 9527c478bd9Sstevel@tonic-gate { 953ab25eeb5Syz qpktinfo_t qpi, *qpip; 954ab25eeb5Syz fr_info_t fnew; 955ab25eeb5Syz ip_t *ip; 956ab25eeb5Syz int i, hlen; 957ab25eeb5Syz 958ab25eeb5Syz ip = (ip_t *)m->b_rptr; 959ab25eeb5Syz bzero((char *)&fnew, sizeof(fnew)); 9607c478bd9Sstevel@tonic-gate 9617c478bd9Sstevel@tonic-gate #ifdef USE_INET6 9627c478bd9Sstevel@tonic-gate if (fin->fin_v == 6) { 9637c478bd9Sstevel@tonic-gate ip6_t *ip6; 9647c478bd9Sstevel@tonic-gate 965ab25eeb5Syz ip6 = (ip6_t *)ip; 9667c478bd9Sstevel@tonic-gate ip6->ip6_vfc = 0x60; 9677c478bd9Sstevel@tonic-gate ip6->ip6_hlim = 127; 968ab25eeb5Syz fnew.fin_v = 6; 969ab25eeb5Syz hlen = sizeof(*ip6); 970923d6102Szf fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen; 9717c478bd9Sstevel@tonic-gate } else 9727c478bd9Sstevel@tonic-gate #endif 9737c478bd9Sstevel@tonic-gate { 974ab25eeb5Syz fnew.fin_v = 4; 9757c478bd9Sstevel@tonic-gate #if SOLARIS2 >= 10 9767c478bd9Sstevel@tonic-gate ip->ip_ttl = 255; 977*381a2a9aSdr if (net_getpmtuenabled(ipf_ipv4) == 1) 978*381a2a9aSdr ip->ip_off = htons(IP_DF); 9797c478bd9Sstevel@tonic-gate #else 980ab25eeb5Syz if (ip_ttl_ptr != NULL) 981ab25eeb5Syz ip->ip_ttl = (u_char)(*ip_ttl_ptr); 982ab25eeb5Syz else 983ab25eeb5Syz ip->ip_ttl = 63; 984ab25eeb5Syz if (ip_mtudisc != NULL) 985ab25eeb5Syz ip->ip_off = htons(*ip_mtudisc ? IP_DF : 0); 986ab25eeb5Syz else 987ab25eeb5Syz ip->ip_off = htons(IP_DF); 9887c478bd9Sstevel@tonic-gate #endif 989ab25eeb5Syz /* 990ab25eeb5Syz * The dance with byte order and ip_len/ip_off is because in 991ab25eeb5Syz * fr_fastroute, it expects them to be in host byte order but 992ab25eeb5Syz * ipf_cksum expects them to be in network byte order. 993ab25eeb5Syz */ 994ab25eeb5Syz ip->ip_len = htons(ip->ip_len); 9957c478bd9Sstevel@tonic-gate ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip)); 996ab25eeb5Syz ip->ip_len = ntohs(ip->ip_len); 997ab25eeb5Syz ip->ip_off = ntohs(ip->ip_off); 998ab25eeb5Syz hlen = sizeof(*ip); 999923d6102Szf fnew.fin_plen = ip->ip_len; 10007c478bd9Sstevel@tonic-gate } 1001ab25eeb5Syz 1002ab25eeb5Syz qpip = fin->fin_qpi; 1003ab25eeb5Syz qpi.qpi_off = 0; 1004*381a2a9aSdr qpi.qpi_ill = qpip->qpi_ill; 1005ab25eeb5Syz qpi.qpi_m = m; 1006ab25eeb5Syz qpi.qpi_data = ip; 1007ab25eeb5Syz fnew.fin_qpi = &qpi; 1008ab25eeb5Syz fnew.fin_ifp = fin->fin_ifp; 1009ab25eeb5Syz fnew.fin_flx = FI_NOCKSUM; 1010ab25eeb5Syz fnew.fin_m = m; 1011ab25eeb5Syz fnew.fin_ip = ip; 1012ab25eeb5Syz fnew.fin_mp = mpp; 1013ab25eeb5Syz fnew.fin_hlen = hlen; 1014ab25eeb5Syz fnew.fin_dp = (char *)ip + hlen; 1015ab25eeb5Syz (void) fr_makefrip(hlen, ip, &fnew); 1016ab25eeb5Syz 1017ab25eeb5Syz i = fr_fastroute(m, mpp, &fnew, NULL); 10187c478bd9Sstevel@tonic-gate return i; 10197c478bd9Sstevel@tonic-gate } 10207c478bd9Sstevel@tonic-gate 10217c478bd9Sstevel@tonic-gate 10227c478bd9Sstevel@tonic-gate int fr_send_icmp_err(type, fin, dst) 10237c478bd9Sstevel@tonic-gate int type; 10247c478bd9Sstevel@tonic-gate fr_info_t *fin; 10257c478bd9Sstevel@tonic-gate int dst; 10267c478bd9Sstevel@tonic-gate { 10277c478bd9Sstevel@tonic-gate struct in_addr dst4; 10287c478bd9Sstevel@tonic-gate struct icmp *icmp; 1029ab25eeb5Syz qpktinfo_t *qpi; 10307c478bd9Sstevel@tonic-gate int hlen, code; 1031*381a2a9aSdr phy_if_t phy; 10327c478bd9Sstevel@tonic-gate u_short sz; 10337c478bd9Sstevel@tonic-gate #ifdef USE_INET6 10347c478bd9Sstevel@tonic-gate mblk_t *mb; 10357c478bd9Sstevel@tonic-gate #endif 10367c478bd9Sstevel@tonic-gate mblk_t *m; 10377c478bd9Sstevel@tonic-gate #ifdef USE_INET6 10387c478bd9Sstevel@tonic-gate ip6_t *ip6; 10397c478bd9Sstevel@tonic-gate #endif 10407c478bd9Sstevel@tonic-gate ip_t *ip; 10417c478bd9Sstevel@tonic-gate 10427c478bd9Sstevel@tonic-gate if ((type < 0) || (type > ICMP_MAXTYPE)) 10437c478bd9Sstevel@tonic-gate return -1; 10447c478bd9Sstevel@tonic-gate 10457c478bd9Sstevel@tonic-gate code = fin->fin_icode; 10467c478bd9Sstevel@tonic-gate #ifdef USE_INET6 10477c478bd9Sstevel@tonic-gate if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int))) 10487c478bd9Sstevel@tonic-gate return -1; 10497c478bd9Sstevel@tonic-gate #endif 10507c478bd9Sstevel@tonic-gate 10517c478bd9Sstevel@tonic-gate #ifndef IPFILTER_CKSUM 10527c478bd9Sstevel@tonic-gate if (fr_checkl4sum(fin) == -1) 10537c478bd9Sstevel@tonic-gate return -1; 10547c478bd9Sstevel@tonic-gate #endif 10557c478bd9Sstevel@tonic-gate 1056ab25eeb5Syz qpi = fin->fin_qpi; 10577c478bd9Sstevel@tonic-gate 10587c478bd9Sstevel@tonic-gate #ifdef USE_INET6 10597c478bd9Sstevel@tonic-gate mb = fin->fin_qfm; 10607c478bd9Sstevel@tonic-gate 10617c478bd9Sstevel@tonic-gate if (fin->fin_v == 6) { 10627c478bd9Sstevel@tonic-gate sz = sizeof(ip6_t); 10637c478bd9Sstevel@tonic-gate sz += MIN(mb->b_wptr - mb->b_rptr, 512); 10647c478bd9Sstevel@tonic-gate hlen = sizeof(ip6_t); 10657c478bd9Sstevel@tonic-gate type = icmptoicmp6types[type]; 10667c478bd9Sstevel@tonic-gate if (type == ICMP6_DST_UNREACH) 10677c478bd9Sstevel@tonic-gate code = icmptoicmp6unreach[code]; 10687c478bd9Sstevel@tonic-gate } else 10697c478bd9Sstevel@tonic-gate #endif 10707c478bd9Sstevel@tonic-gate { 10717c478bd9Sstevel@tonic-gate if ((fin->fin_p == IPPROTO_ICMP) && 10727c478bd9Sstevel@tonic-gate !(fin->fin_flx & FI_SHORT)) 10737c478bd9Sstevel@tonic-gate switch (ntohs(fin->fin_data[0]) >> 8) 10747c478bd9Sstevel@tonic-gate { 10757c478bd9Sstevel@tonic-gate case ICMP_ECHO : 10767c478bd9Sstevel@tonic-gate case ICMP_TSTAMP : 10777c478bd9Sstevel@tonic-gate case ICMP_IREQ : 10787c478bd9Sstevel@tonic-gate case ICMP_MASKREQ : 10797c478bd9Sstevel@tonic-gate break; 10807c478bd9Sstevel@tonic-gate default : 10817c478bd9Sstevel@tonic-gate return 0; 10827c478bd9Sstevel@tonic-gate } 10837c478bd9Sstevel@tonic-gate 10847c478bd9Sstevel@tonic-gate sz = sizeof(ip_t) * 2; 10857c478bd9Sstevel@tonic-gate sz += 8; /* 64 bits of data */ 10867c478bd9Sstevel@tonic-gate hlen = sizeof(ip_t); 10877c478bd9Sstevel@tonic-gate } 10887c478bd9Sstevel@tonic-gate 10897c478bd9Sstevel@tonic-gate sz += offsetof(struct icmp, icmp_ip); 10907c478bd9Sstevel@tonic-gate if ((m = (mblk_t *)allocb((size_t)sz + 64, BPRI_HI)) == NULL) 10917c478bd9Sstevel@tonic-gate return -1; 10927c478bd9Sstevel@tonic-gate MTYPE(m) = M_DATA; 10937c478bd9Sstevel@tonic-gate m->b_rptr += 64; 10947c478bd9Sstevel@tonic-gate m->b_wptr = m->b_rptr + sz; 10957c478bd9Sstevel@tonic-gate bzero((char *)m->b_rptr, (size_t)sz); 1096ab25eeb5Syz ip = (ip_t *)m->b_rptr; 1097ab25eeb5Syz ip->ip_v = fin->fin_v; 10987c478bd9Sstevel@tonic-gate icmp = (struct icmp *)(m->b_rptr + hlen); 10997c478bd9Sstevel@tonic-gate icmp->icmp_type = type & 0xff; 11007c478bd9Sstevel@tonic-gate icmp->icmp_code = code & 0xff; 1101*381a2a9aSdr phy = (phy_if_t)qpi->qpi_ill; 1102*381a2a9aSdr if (type == ICMP_UNREACH && (phy != 0) && 11037c478bd9Sstevel@tonic-gate fin->fin_icode == ICMP_UNREACH_NEEDFRAG) 1104*381a2a9aSdr icmp->icmp_nextmtu = net_getmtu(ipf_ipv4, phy,0 ); 11057c478bd9Sstevel@tonic-gate 11067c478bd9Sstevel@tonic-gate #ifdef USE_INET6 11077c478bd9Sstevel@tonic-gate if (fin->fin_v == 6) { 11087c478bd9Sstevel@tonic-gate struct in6_addr dst6; 11097c478bd9Sstevel@tonic-gate int csz; 11107c478bd9Sstevel@tonic-gate 11117c478bd9Sstevel@tonic-gate if (dst == 0) { 1112*381a2a9aSdr if (fr_ifpaddr(6, FRI_NORMAL, (void *)phy, 1113*381a2a9aSdr (void *)&dst6, NULL) == -1) { 11147c478bd9Sstevel@tonic-gate FREE_MB_T(m); 11157c478bd9Sstevel@tonic-gate return -1; 11167c478bd9Sstevel@tonic-gate } 11177c478bd9Sstevel@tonic-gate } else 11187c478bd9Sstevel@tonic-gate dst6 = fin->fin_dst6; 11197c478bd9Sstevel@tonic-gate 11207c478bd9Sstevel@tonic-gate csz = sz; 11217c478bd9Sstevel@tonic-gate sz -= sizeof(ip6_t); 11227c478bd9Sstevel@tonic-gate ip6 = (ip6_t *)m->b_rptr; 11237663b816Sml ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 11247c478bd9Sstevel@tonic-gate ip6->ip6_plen = htons((u_short)sz); 11257c478bd9Sstevel@tonic-gate ip6->ip6_nxt = IPPROTO_ICMPV6; 11267c478bd9Sstevel@tonic-gate ip6->ip6_src = dst6; 11277c478bd9Sstevel@tonic-gate ip6->ip6_dst = fin->fin_src6; 11287c478bd9Sstevel@tonic-gate sz -= offsetof(struct icmp, icmp_ip); 11297c478bd9Sstevel@tonic-gate bcopy((char *)mb->b_rptr, (char *)&icmp->icmp_ip, sz); 11307c478bd9Sstevel@tonic-gate icmp->icmp_cksum = csz - sizeof(ip6_t); 11317c478bd9Sstevel@tonic-gate } else 11327c478bd9Sstevel@tonic-gate #endif 11337c478bd9Sstevel@tonic-gate { 11347c478bd9Sstevel@tonic-gate ip->ip_hl = sizeof(*ip) >> 2; 11357c478bd9Sstevel@tonic-gate ip->ip_p = IPPROTO_ICMP; 11367c478bd9Sstevel@tonic-gate ip->ip_id = fin->fin_ip->ip_id; 11377c478bd9Sstevel@tonic-gate ip->ip_tos = fin->fin_ip->ip_tos; 113837b40788Sekozlow ip->ip_len = (u_short)sz; 11397c478bd9Sstevel@tonic-gate if (dst == 0) { 1140*381a2a9aSdr if (fr_ifpaddr(4, FRI_NORMAL, (void *)phy, 1141*381a2a9aSdr (void *)&dst4, NULL) == -1) { 11427c478bd9Sstevel@tonic-gate FREE_MB_T(m); 11437c478bd9Sstevel@tonic-gate return -1; 11447c478bd9Sstevel@tonic-gate } 1145*381a2a9aSdr } else { 11467c478bd9Sstevel@tonic-gate dst4 = fin->fin_dst; 1147*381a2a9aSdr } 11487c478bd9Sstevel@tonic-gate ip->ip_src = dst4; 11497c478bd9Sstevel@tonic-gate ip->ip_dst = fin->fin_src; 11507c478bd9Sstevel@tonic-gate bcopy((char *)fin->fin_ip, (char *)&icmp->icmp_ip, 11517c478bd9Sstevel@tonic-gate sizeof(*fin->fin_ip)); 11527c478bd9Sstevel@tonic-gate bcopy((char *)fin->fin_ip + fin->fin_hlen, 11537c478bd9Sstevel@tonic-gate (char *)&icmp->icmp_ip + sizeof(*fin->fin_ip), 8); 11547663b816Sml icmp->icmp_ip.ip_len = htons(icmp->icmp_ip.ip_len); 1155ab25eeb5Syz icmp->icmp_ip.ip_off = htons(icmp->icmp_ip.ip_off); 11567c478bd9Sstevel@tonic-gate icmp->icmp_cksum = ipf_cksum((u_short *)icmp, 11577c478bd9Sstevel@tonic-gate sz - sizeof(ip_t)); 11587c478bd9Sstevel@tonic-gate } 11597c478bd9Sstevel@tonic-gate 11607c478bd9Sstevel@tonic-gate /* 11617c478bd9Sstevel@tonic-gate * Need to exit out of these so we don't recursively call rw_enter 11627c478bd9Sstevel@tonic-gate * from fr_qout. 11637c478bd9Sstevel@tonic-gate */ 1164ab25eeb5Syz return fr_send_ip(fin, m, &m); 11657c478bd9Sstevel@tonic-gate } 11667c478bd9Sstevel@tonic-gate 11677c478bd9Sstevel@tonic-gate #include <sys/time.h> 11687c478bd9Sstevel@tonic-gate #include <sys/varargs.h> 11697c478bd9Sstevel@tonic-gate 11707c478bd9Sstevel@tonic-gate #ifndef _KERNEL 11717c478bd9Sstevel@tonic-gate #include <stdio.h> 11727c478bd9Sstevel@tonic-gate #endif 11737c478bd9Sstevel@tonic-gate 11747c478bd9Sstevel@tonic-gate #define NULLADDR_RATE_LIMIT 10 /* 10 seconds */ 11757c478bd9Sstevel@tonic-gate 11767c478bd9Sstevel@tonic-gate 11777c478bd9Sstevel@tonic-gate /* 11787c478bd9Sstevel@tonic-gate * Print out warning message at rate-limited speed. 11797c478bd9Sstevel@tonic-gate */ 11807c478bd9Sstevel@tonic-gate static void rate_limit_message(int rate, const char *message, ...) 11817c478bd9Sstevel@tonic-gate { 11827c478bd9Sstevel@tonic-gate static time_t last_time = 0; 11837c478bd9Sstevel@tonic-gate time_t now; 11847c478bd9Sstevel@tonic-gate va_list args; 11857c478bd9Sstevel@tonic-gate char msg_buf[256]; 11867c478bd9Sstevel@tonic-gate int need_printed = 0; 11877c478bd9Sstevel@tonic-gate 11887c478bd9Sstevel@tonic-gate now = ddi_get_time(); 11897c478bd9Sstevel@tonic-gate 11907c478bd9Sstevel@tonic-gate /* make sure, no multiple entries */ 11917c478bd9Sstevel@tonic-gate ASSERT(MUTEX_NOT_HELD(&(ipf_rw.ipf_lk))); 11927c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipf_rw); 11937c478bd9Sstevel@tonic-gate if (now - last_time >= rate) { 11947c478bd9Sstevel@tonic-gate need_printed = 1; 11957c478bd9Sstevel@tonic-gate last_time = now; 11967c478bd9Sstevel@tonic-gate } 11977c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipf_rw); 11987c478bd9Sstevel@tonic-gate 11997c478bd9Sstevel@tonic-gate if (need_printed) { 12007c478bd9Sstevel@tonic-gate va_start(args, message); 12017c478bd9Sstevel@tonic-gate (void)vsnprintf(msg_buf, 255, message, args); 12027c478bd9Sstevel@tonic-gate va_end(args); 12037c478bd9Sstevel@tonic-gate #ifdef _KERNEL 12047c478bd9Sstevel@tonic-gate cmn_err(CE_WARN, msg_buf); 12057c478bd9Sstevel@tonic-gate #else 12067c478bd9Sstevel@tonic-gate fprintf(std_err, msg_buf); 12077c478bd9Sstevel@tonic-gate #endif 12087c478bd9Sstevel@tonic-gate } 12097c478bd9Sstevel@tonic-gate } 12107c478bd9Sstevel@tonic-gate 12117c478bd9Sstevel@tonic-gate /* 12127c478bd9Sstevel@tonic-gate * return the first IP Address associated with an interface 12137c478bd9Sstevel@tonic-gate */ 12147c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 1215*381a2a9aSdr int fr_ifpaddr(v, atype, ifptr, inp, inpmask) 12167c478bd9Sstevel@tonic-gate int v, atype; 1217*381a2a9aSdr void *ifptr; 1218*381a2a9aSdr struct in_addr *inp, *inpmask; 12197c478bd9Sstevel@tonic-gate { 1220*381a2a9aSdr struct sockaddr_in6 v6addr[2]; 1221*381a2a9aSdr struct sockaddr_in v4addr[2]; 1222*381a2a9aSdr net_ifaddr_t type[2]; 1223*381a2a9aSdr net_data_t net_data; 1224*381a2a9aSdr phy_if_t phyif; 1225*381a2a9aSdr void *array; 1226*381a2a9aSdr 1227*381a2a9aSdr switch (v) 1228*381a2a9aSdr { 1229*381a2a9aSdr case 4: 1230*381a2a9aSdr net_data = ipf_ipv4; 1231*381a2a9aSdr array = v4addr; 1232*381a2a9aSdr break; 1233*381a2a9aSdr case 6: 1234*381a2a9aSdr net_data = ipf_ipv6; 1235*381a2a9aSdr array = v6addr; 1236*381a2a9aSdr break; 1237*381a2a9aSdr default: 1238*381a2a9aSdr net_data = NULL; 1239*381a2a9aSdr break; 1240*381a2a9aSdr } 12417c478bd9Sstevel@tonic-gate 1242*381a2a9aSdr if (net_data == NULL) 12437c478bd9Sstevel@tonic-gate return -1; 12447c478bd9Sstevel@tonic-gate 1245*381a2a9aSdr phyif = (phy_if_t)ifptr; 1246ab25eeb5Syz 1247ab25eeb5Syz switch (atype) 1248ab25eeb5Syz { 1249ab25eeb5Syz case FRI_PEERADDR : 1250*381a2a9aSdr type[0] = NA_PEER; 1251ab25eeb5Syz break; 1252*381a2a9aSdr 1253*381a2a9aSdr case FRI_BROADCAST : 1254*381a2a9aSdr type[0] = NA_BROADCAST; 1255*381a2a9aSdr break; 1256*381a2a9aSdr 1257ab25eeb5Syz default : 1258*381a2a9aSdr type[0] = NA_ADDRESS; 1259ab25eeb5Syz break; 1260ab25eeb5Syz } 12617c478bd9Sstevel@tonic-gate 1262*381a2a9aSdr type[1] = NA_NETMASK; 1263*381a2a9aSdr 1264*381a2a9aSdr if (net_getlifaddr(net_data, phyif, 0, 2, type, array) < 0) 12657c478bd9Sstevel@tonic-gate return -1; 1266*381a2a9aSdr 1267*381a2a9aSdr if (v == 6) { 1268*381a2a9aSdr return fr_ifpfillv6addr(atype, &v6addr[0], &v6addr[1], 1269*381a2a9aSdr inp, inpmask); 12707c478bd9Sstevel@tonic-gate } 1271*381a2a9aSdr return fr_ifpfillv4addr(atype, &v4addr[0], &v4addr[1], inp, inpmask); 12727c478bd9Sstevel@tonic-gate } 12737c478bd9Sstevel@tonic-gate 12747c478bd9Sstevel@tonic-gate 12757c478bd9Sstevel@tonic-gate u_32_t fr_newisn(fin) 12767c478bd9Sstevel@tonic-gate fr_info_t *fin; 12777c478bd9Sstevel@tonic-gate { 12787c478bd9Sstevel@tonic-gate static int iss_seq_off = 0; 12797c478bd9Sstevel@tonic-gate u_char hash[16]; 12807c478bd9Sstevel@tonic-gate u_32_t newiss; 12817c478bd9Sstevel@tonic-gate MD5_CTX ctx; 12827c478bd9Sstevel@tonic-gate 12837c478bd9Sstevel@tonic-gate /* 12847c478bd9Sstevel@tonic-gate * Compute the base value of the ISS. It is a hash 12857c478bd9Sstevel@tonic-gate * of (saddr, sport, daddr, dport, secret). 12867c478bd9Sstevel@tonic-gate */ 12877c478bd9Sstevel@tonic-gate MD5Init(&ctx); 12887c478bd9Sstevel@tonic-gate 12897c478bd9Sstevel@tonic-gate MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src, 12907c478bd9Sstevel@tonic-gate sizeof(fin->fin_fi.fi_src)); 12917c478bd9Sstevel@tonic-gate MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst, 12927c478bd9Sstevel@tonic-gate sizeof(fin->fin_fi.fi_dst)); 12937c478bd9Sstevel@tonic-gate MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat)); 12947c478bd9Sstevel@tonic-gate 12957c478bd9Sstevel@tonic-gate MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret)); 12967c478bd9Sstevel@tonic-gate 12977c478bd9Sstevel@tonic-gate MD5Final(hash, &ctx); 12987c478bd9Sstevel@tonic-gate 12997c478bd9Sstevel@tonic-gate bcopy(hash, &newiss, sizeof(newiss)); 13007c478bd9Sstevel@tonic-gate 13017c478bd9Sstevel@tonic-gate /* 13027c478bd9Sstevel@tonic-gate * Now increment our "timer", and add it in to 13037c478bd9Sstevel@tonic-gate * the computed value. 13047c478bd9Sstevel@tonic-gate * 13057c478bd9Sstevel@tonic-gate * XXX Use `addin'? 13067c478bd9Sstevel@tonic-gate * XXX TCP_ISSINCR too large to use? 13077c478bd9Sstevel@tonic-gate */ 13087c478bd9Sstevel@tonic-gate iss_seq_off += 0x00010000; 13097c478bd9Sstevel@tonic-gate newiss += iss_seq_off; 13107c478bd9Sstevel@tonic-gate return newiss; 13117c478bd9Sstevel@tonic-gate } 13127c478bd9Sstevel@tonic-gate 13137c478bd9Sstevel@tonic-gate 13147c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 13157c478bd9Sstevel@tonic-gate /* Function: fr_nextipid */ 13167c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 13177c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */ 13187c478bd9Sstevel@tonic-gate /* */ 13197c478bd9Sstevel@tonic-gate /* Returns the next IPv4 ID to use for this packet. */ 13207c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */ 1321ab25eeb5Syz u_short fr_nextipid(fin) 13227c478bd9Sstevel@tonic-gate fr_info_t *fin; 13237c478bd9Sstevel@tonic-gate { 13247c478bd9Sstevel@tonic-gate static u_short ipid = 0; 13257c478bd9Sstevel@tonic-gate ipstate_t *is; 13267c478bd9Sstevel@tonic-gate nat_t *nat; 13277c478bd9Sstevel@tonic-gate u_short id; 13287c478bd9Sstevel@tonic-gate 13297c478bd9Sstevel@tonic-gate MUTEX_ENTER(&ipf_rw); 13307c478bd9Sstevel@tonic-gate if (fin->fin_state != NULL) { 13317c478bd9Sstevel@tonic-gate is = fin->fin_state; 13327c478bd9Sstevel@tonic-gate id = (u_short)(is->is_pkts[(fin->fin_rev << 1) + 1] & 0xffff); 13337c478bd9Sstevel@tonic-gate } else if (fin->fin_nat != NULL) { 13347c478bd9Sstevel@tonic-gate nat = fin->fin_nat; 13357c478bd9Sstevel@tonic-gate id = (u_short)(nat->nat_pkts[fin->fin_out] & 0xffff); 13367c478bd9Sstevel@tonic-gate } else 13377c478bd9Sstevel@tonic-gate id = ipid++; 13387c478bd9Sstevel@tonic-gate MUTEX_EXIT(&ipf_rw); 13397c478bd9Sstevel@tonic-gate 13407c478bd9Sstevel@tonic-gate return id; 13417c478bd9Sstevel@tonic-gate } 13427c478bd9Sstevel@tonic-gate 13437c478bd9Sstevel@tonic-gate 13447c478bd9Sstevel@tonic-gate #ifndef IPFILTER_CKSUM 13457c478bd9Sstevel@tonic-gate /* ARGSUSED */ 13467c478bd9Sstevel@tonic-gate #endif 13477c478bd9Sstevel@tonic-gate INLINE void fr_checkv4sum(fin) 13487c478bd9Sstevel@tonic-gate fr_info_t *fin; 13497c478bd9Sstevel@tonic-gate { 13507c478bd9Sstevel@tonic-gate #ifdef IPFILTER_CKSUM 13517c478bd9Sstevel@tonic-gate if (fr_checkl4sum(fin) == -1) 13527c478bd9Sstevel@tonic-gate fin->fin_flx |= FI_BAD; 13537c478bd9Sstevel@tonic-gate #endif 13547c478bd9Sstevel@tonic-gate } 13557c478bd9Sstevel@tonic-gate 13567c478bd9Sstevel@tonic-gate 13577c478bd9Sstevel@tonic-gate #ifdef USE_INET6 1358ab25eeb5Syz # ifndef IPFILTER_CKSUM 13597663b816Sml /* ARGSUSED */ 1360ab25eeb5Syz # endif 13617c478bd9Sstevel@tonic-gate INLINE void fr_checkv6sum(fin) 13627c478bd9Sstevel@tonic-gate fr_info_t *fin; 13637c478bd9Sstevel@tonic-gate { 13647c478bd9Sstevel@tonic-gate # ifdef IPFILTER_CKSUM 13657c478bd9Sstevel@tonic-gate if (fr_checkl4sum(fin) == -1) 13667c478bd9Sstevel@tonic-gate fin->fin_flx |= FI_BAD; 13677c478bd9Sstevel@tonic-gate # endif 13687c478bd9Sstevel@tonic-gate } 13697c478bd9Sstevel@tonic-gate #endif /* USE_INET6 */ 1370ab25eeb5Syz 1371ab25eeb5Syz 1372ab25eeb5Syz #if (SOLARIS2 < 7) 1373ab25eeb5Syz void fr_slowtimer() 1374ab25eeb5Syz #else 1375ab25eeb5Syz /*ARGSUSED*/ 1376ab25eeb5Syz void fr_slowtimer __P((void *ptr)) 1377ab25eeb5Syz #endif 1378ab25eeb5Syz { 1379ab25eeb5Syz 1380ab25eeb5Syz WRITE_ENTER(&ipf_global); 1381ab25eeb5Syz if (fr_running <= 0) { 1382ab25eeb5Syz if (fr_running == -1) 1383ab25eeb5Syz fr_timer_id = timeout(fr_slowtimer, NULL, 1384ab25eeb5Syz drv_usectohz(500000)); 1385ab25eeb5Syz else 1386ab25eeb5Syz fr_timer_id = NULL; 1387ab25eeb5Syz RWLOCK_EXIT(&ipf_global); 1388ab25eeb5Syz return; 1389ab25eeb5Syz } 1390ab25eeb5Syz MUTEX_DOWNGRADE(&ipf_global); 1391ab25eeb5Syz 1392ab25eeb5Syz fr_fragexpire(); 1393ab25eeb5Syz fr_timeoutstate(); 1394ab25eeb5Syz fr_natexpire(); 1395ab25eeb5Syz fr_authexpire(); 1396ab25eeb5Syz fr_ticks++; 1397ab25eeb5Syz if (fr_running == -1 || fr_running == 1) 1398ab25eeb5Syz fr_timer_id = timeout(fr_slowtimer, NULL, drv_usectohz(500000)); 1399ab25eeb5Syz else 1400ab25eeb5Syz fr_timer_id = NULL; 1401ab25eeb5Syz RWLOCK_EXIT(&ipf_global); 1402ab25eeb5Syz } 1403ab25eeb5Syz 1404ab25eeb5Syz 1405*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1406*381a2a9aSdr /* Function: fr_pullup */ 1407*381a2a9aSdr /* Returns: NULL == pullup failed, else pointer to protocol header */ 1408*381a2a9aSdr /* Parameters: m(I) - pointer to buffer where data packet starts */ 1409*381a2a9aSdr /* fin(I) - pointer to packet information */ 1410*381a2a9aSdr /* len(I) - number of bytes to pullup */ 1411*381a2a9aSdr /* */ 1412*381a2a9aSdr /* Attempt to move at least len bytes (from the start of the buffer) into a */ 1413*381a2a9aSdr /* single buffer for ease of access. Operating system native functions are */ 1414*381a2a9aSdr /* used to manage buffers - if necessary. If the entire packet ends up in */ 1415*381a2a9aSdr /* a single buffer, set the FI_COALESCE flag even though fr_coalesce() has */ 1416*381a2a9aSdr /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */ 1417*381a2a9aSdr /* and ONLY if the pullup succeeds. */ 1418*381a2a9aSdr /* */ 1419*381a2a9aSdr /* We assume that 'min' is a pointer to a buffer that is part of the chain */ 1420*381a2a9aSdr /* of buffers that starts at *fin->fin_mp. */ 1421*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1422*381a2a9aSdr void *fr_pullup(min, fin, len) 1423*381a2a9aSdr mb_t *min; 1424*381a2a9aSdr fr_info_t *fin; 1425*381a2a9aSdr int len; 1426*381a2a9aSdr { 1427*381a2a9aSdr qpktinfo_t *qpi = fin->fin_qpi; 1428*381a2a9aSdr int out = fin->fin_out, dpoff, ipoff; 1429*381a2a9aSdr mb_t *m = min, *m1, *m2; 1430*381a2a9aSdr char *ip; 1431*381a2a9aSdr 1432*381a2a9aSdr if (m == NULL) 1433*381a2a9aSdr return NULL; 1434*381a2a9aSdr 1435*381a2a9aSdr ip = (char *)fin->fin_ip; 1436*381a2a9aSdr if ((fin->fin_flx & FI_COALESCE) != 0) 1437*381a2a9aSdr return ip; 1438*381a2a9aSdr 1439*381a2a9aSdr ipoff = fin->fin_ipoff; 1440*381a2a9aSdr if (fin->fin_dp != NULL) 1441*381a2a9aSdr dpoff = (char *)fin->fin_dp - (char *)ip; 1442*381a2a9aSdr else 1443*381a2a9aSdr dpoff = 0; 1444*381a2a9aSdr 1445*381a2a9aSdr if (M_LEN(m) < len) { 1446*381a2a9aSdr 1447*381a2a9aSdr /* 1448*381a2a9aSdr * pfil_precheck ensures the IP header is on a 32bit 1449*381a2a9aSdr * aligned address so simply fail if that isn't currently 1450*381a2a9aSdr * the case (should never happen). 1451*381a2a9aSdr */ 1452*381a2a9aSdr int inc = 0; 1453*381a2a9aSdr 1454*381a2a9aSdr if (ipoff > 0) { 1455*381a2a9aSdr if ((ipoff & 3) != 0) { 1456*381a2a9aSdr inc = 4 - (ipoff & 3); 1457*381a2a9aSdr if (m->b_rptr - inc >= m->b_datap->db_base) 1458*381a2a9aSdr m->b_rptr -= inc; 1459*381a2a9aSdr else 1460*381a2a9aSdr inc = 0; 1461*381a2a9aSdr } 1462*381a2a9aSdr } 1463*381a2a9aSdr 1464*381a2a9aSdr /* 1465*381a2a9aSdr * XXX This is here as a work around for a bug with DEBUG 1466*381a2a9aSdr * XXX Solaris kernels. The problem is b_prev is used by IP 1467*381a2a9aSdr * XXX code as a way to stash the phyint_index for a packet, 1468*381a2a9aSdr * XXX this doesn't get reset by IP but freeb does an ASSERT() 1469*381a2a9aSdr * XXX for both of these to be NULL. See 6442390. 1470*381a2a9aSdr */ 1471*381a2a9aSdr m1 = m; 1472*381a2a9aSdr m2 = m->b_prev; 1473*381a2a9aSdr 1474*381a2a9aSdr do { 1475*381a2a9aSdr m1->b_next = NULL; 1476*381a2a9aSdr m1->b_prev = NULL; 1477*381a2a9aSdr m1 = m1->b_cont; 1478*381a2a9aSdr } while (m1); 1479*381a2a9aSdr if (pullupmsg(m, len + ipoff + inc) == 0) { 1480*381a2a9aSdr ATOMIC_INCL(frstats[out].fr_pull[1]); 1481*381a2a9aSdr FREE_MB_T(*fin->fin_mp); 1482*381a2a9aSdr *fin->fin_mp = NULL; 1483*381a2a9aSdr fin->fin_m = NULL; 1484*381a2a9aSdr fin->fin_ip = NULL; 1485*381a2a9aSdr fin->fin_dp = NULL; 1486*381a2a9aSdr qpi->qpi_data = NULL; 1487*381a2a9aSdr return NULL; 1488*381a2a9aSdr } 1489*381a2a9aSdr m->b_prev = m2; 1490*381a2a9aSdr m->b_rptr += inc; 1491*381a2a9aSdr fin->fin_m = m; 1492*381a2a9aSdr ip = MTOD(m, char *) + ipoff; 1493*381a2a9aSdr qpi->qpi_data = ip; 1494*381a2a9aSdr } 1495*381a2a9aSdr 1496*381a2a9aSdr ATOMIC_INCL(frstats[out].fr_pull[0]); 1497*381a2a9aSdr fin->fin_ip = (ip_t *)ip; 1498*381a2a9aSdr if (fin->fin_dp != NULL) 1499*381a2a9aSdr fin->fin_dp = (char *)fin->fin_ip + dpoff; 1500*381a2a9aSdr 1501*381a2a9aSdr if (len == fin->fin_plen) 1502*381a2a9aSdr fin->fin_flx |= FI_COALESCE; 1503*381a2a9aSdr return ip; 1504*381a2a9aSdr } 1505*381a2a9aSdr 1506*381a2a9aSdr 1507ab25eeb5Syz /* 1508*381a2a9aSdr * Function: fr_verifysrc 1509*381a2a9aSdr * Returns: int (really boolean) 1510*381a2a9aSdr * Parameters: fin - packet information 1511*381a2a9aSdr * 1512*381a2a9aSdr * Check whether the packet has a valid source address for the interface on 1513*381a2a9aSdr * which the packet arrived, implementing the "fr_chksrc" feature. 1514*381a2a9aSdr * Returns true iff the packet's source address is valid. 1515*381a2a9aSdr */ 1516*381a2a9aSdr int fr_verifysrc(fin) 1517*381a2a9aSdr fr_info_t *fin; 1518*381a2a9aSdr { 1519*381a2a9aSdr net_data_t net_data_p; 1520*381a2a9aSdr phy_if_t phy_ifdata_routeto; 1521*381a2a9aSdr struct sockaddr sin; 1522*381a2a9aSdr 1523*381a2a9aSdr if (fin->fin_v == 4) { 1524*381a2a9aSdr net_data_p = ipf_ipv4; 1525*381a2a9aSdr } else if (fin->fin_v == 6) { 1526*381a2a9aSdr net_data_p = ipf_ipv6; 1527*381a2a9aSdr } else { 1528*381a2a9aSdr return (0); 1529*381a2a9aSdr } 1530*381a2a9aSdr 1531*381a2a9aSdr /* Get the index corresponding to the if name */ 1532*381a2a9aSdr sin.sa_family = (fin->fin_v == 4) ? AF_INET : AF_INET6; 1533*381a2a9aSdr bcopy(&fin->fin_saddr, &sin.sa_data, sizeof (struct in_addr)); 1534*381a2a9aSdr phy_ifdata_routeto = net_routeto(net_data_p, &sin); 1535*381a2a9aSdr 1536*381a2a9aSdr return (((phy_if_t)fin->fin_ifp == phy_ifdata_routeto) ? 1 : 0); 1537*381a2a9aSdr } 1538*381a2a9aSdr 1539*381a2a9aSdr 1540*381a2a9aSdr /* 1541*381a2a9aSdr * Function: fr_fastroute 1542*381a2a9aSdr * Returns: 0: success; 1543*381a2a9aSdr * -1: failed 1544ab25eeb5Syz * Parameters: 1545*381a2a9aSdr * mb: the message block where ip head starts 1546*381a2a9aSdr * mpp: the pointer to the pointer of the orignal 1547*381a2a9aSdr * packet message 1548*381a2a9aSdr * fin: packet information 1549*381a2a9aSdr * fdp: destination interface information 1550*381a2a9aSdr * if it is NULL, no interface information provided. 1551ab25eeb5Syz * 1552ab25eeb5Syz * This function is for fastroute/to/dup-to rules. It calls 1553ab25eeb5Syz * pfil_make_lay2_packet to search route, make lay-2 header 1554ab25eeb5Syz * ,and identify output queue for the IP packet. 1555ab25eeb5Syz * The destination address depends on the following conditions: 1556ab25eeb5Syz * 1: for fastroute rule, fdp is passed in as NULL, so the 1557*381a2a9aSdr * destination address is the IP Packet's destination address 1558ab25eeb5Syz * 2: for to/dup-to rule, if an ip address is specified after 1559*381a2a9aSdr * the interface name, this address is the as destination 1560*381a2a9aSdr * address. Otherwise IP Packet's destination address is used 1561ab25eeb5Syz */ 1562ab25eeb5Syz int fr_fastroute(mb, mpp, fin, fdp) 1563ab25eeb5Syz mblk_t *mb, **mpp; 1564ab25eeb5Syz fr_info_t *fin; 1565ab25eeb5Syz frdest_t *fdp; 1566ab25eeb5Syz { 1567*381a2a9aSdr net_data_t net_data_p; 1568*381a2a9aSdr net_inject_t inj_data; 1569ab25eeb5Syz mblk_t *mp = NULL; 1570*381a2a9aSdr frentry_t *fr = fin->fin_fr; 1571ab25eeb5Syz qpktinfo_t *qpi; 1572ab25eeb5Syz ip_t *ip; 1573*381a2a9aSdr 1574*381a2a9aSdr struct sockaddr_in *sin; 1575*381a2a9aSdr struct sockaddr_in6 *sin6; 1576*381a2a9aSdr struct sockaddr *sinp; 1577ab25eeb5Syz #ifndef sparc 1578ab25eeb5Syz u_short __iplen, __ipoff; 1579ab25eeb5Syz #endif 1580*381a2a9aSdr 1581*381a2a9aSdr if (fin->fin_v == 4) { 1582*381a2a9aSdr net_data_p = ipf_ipv4; 1583*381a2a9aSdr } else if (fin->fin_v == 6) { 1584*381a2a9aSdr net_data_p = ipf_ipv6; 1585*381a2a9aSdr } else { 1586*381a2a9aSdr return (-1); 1587*381a2a9aSdr } 1588*381a2a9aSdr 1589ab25eeb5Syz ip = fin->fin_ip; 1590ab25eeb5Syz qpi = fin->fin_qpi; 1591ab25eeb5Syz 1592ab25eeb5Syz /* 1593ab25eeb5Syz * If this is a duplicate mblk then we want ip to point at that 1594ab25eeb5Syz * data, not the original, if and only if it is already pointing at 1595ab25eeb5Syz * the current mblk data. 1596*381a2a9aSdr * 1597*381a2a9aSdr * Otherwise, if it's not a duplicate, and we're not already pointing 1598e6c6c1faSyz * at the current mblk data, then we want to ensure that the data 1599e6c6c1faSyz * points at ip. 1600ab25eeb5Syz */ 1601*381a2a9aSdr 1602*381a2a9aSdr if ((ip == (ip_t *)qpi->qpi_m->b_rptr) && (qpi->qpi_m != mb)) { 1603ab25eeb5Syz ip = (ip_t *)mb->b_rptr; 1604*381a2a9aSdr } else if ((qpi->qpi_m == mb) && (ip != (ip_t *)qpi->qpi_m->b_rptr)) { 1605*381a2a9aSdr qpi->qpi_m->b_rptr = (uchar_t *)ip; 1606e6c6c1faSyz qpi->qpi_off = 0; 1607e6c6c1faSyz } 1608ab25eeb5Syz 1609ab25eeb5Syz /* 1610ab25eeb5Syz * If there is another M_PROTO, we don't want it 1611ab25eeb5Syz */ 1612ab25eeb5Syz if (*mpp != mb) { 1613ab25eeb5Syz mp = unlinkb(*mpp); 1614ab25eeb5Syz freeb(*mpp); 1615ab25eeb5Syz *mpp = mp; 1616ab25eeb5Syz } 1617ab25eeb5Syz 1618*381a2a9aSdr sinp = (struct sockaddr *)&inj_data.ni_addr; 1619*381a2a9aSdr sin = (struct sockaddr_in *)sinp; 1620*381a2a9aSdr sin6 = (struct sockaddr_in6 *)sinp; 1621*381a2a9aSdr bzero((char *)&inj_data.ni_addr, sizeof (inj_data.ni_addr)); 1622*381a2a9aSdr inj_data.ni_addr.ss_family = (fin->fin_v == 4) ? AF_INET : AF_INET6; 1623*381a2a9aSdr inj_data.ni_packet = mb; 1624ab25eeb5Syz 1625ab25eeb5Syz /* 1626ab25eeb5Syz * In case we're here due to "to <if>" being used with 1627ab25eeb5Syz * "keep state", check that we're going in the correct 1628ab25eeb5Syz * direction. 1629ab25eeb5Syz */ 1630*381a2a9aSdr if (fdp != NULL) { 1631*381a2a9aSdr if ((fr != NULL) && (fdp->fd_ifp != NULL) && 1632*381a2a9aSdr (fin->fin_rev != 0) && (fdp == &fr->fr_tif)) 1633*381a2a9aSdr goto bad_fastroute; 1634*381a2a9aSdr inj_data.ni_physical = (phy_if_t)fdp->fd_ifp; 1635ab25eeb5Syz if (fin->fin_v == 4) { 1636*381a2a9aSdr sin->sin_addr = fdp->fd_ip; 1637*381a2a9aSdr } else { 1638*381a2a9aSdr sin6->sin6_addr = fdp->fd_ip6.in6; 1639ab25eeb5Syz } 1640*381a2a9aSdr } else { 1641*381a2a9aSdr if (fin->fin_v == 4) { 1642*381a2a9aSdr sin->sin_addr = ip->ip_dst; 1643*381a2a9aSdr } else { 1644*381a2a9aSdr sin6->sin6_addr = ((ip6_t *)ip)->ip6_dst; 1645ab25eeb5Syz } 1646*381a2a9aSdr inj_data.ni_physical = net_routeto(net_data_p, sinp); 1647ab25eeb5Syz } 1648ab25eeb5Syz 1649*381a2a9aSdr /* disable hardware checksum */ 1650*381a2a9aSdr DB_CKSUMFLAGS(mb) = 0; 1651c793af95Ssangeeta 1652*381a2a9aSdr *mpp = mb; 1653ab25eeb5Syz 1654*381a2a9aSdr if (fin->fin_out == 0) { 1655*381a2a9aSdr void *saveifp; 1656*381a2a9aSdr u_32_t pass; 1657ab25eeb5Syz 1658*381a2a9aSdr saveifp = fin->fin_ifp; 1659*381a2a9aSdr fin->fin_ifp = (void *)inj_data.ni_physical; 1660*381a2a9aSdr fin->fin_out = 1; 1661*381a2a9aSdr (void) fr_acctpkt(fin, &pass); 1662*381a2a9aSdr fin->fin_fr = NULL; 1663*381a2a9aSdr if (!fr || !(fr->fr_flags & FR_RETMASK)) 1664*381a2a9aSdr (void) fr_checkstate(fin, &pass); 1665*381a2a9aSdr switch (fr_checknatout(fin, NULL)) 1666*381a2a9aSdr { 1667*381a2a9aSdr /* FALLTHROUGH */ 1668*381a2a9aSdr case 0 : 1669*381a2a9aSdr case 1 : 1670*381a2a9aSdr break; 1671*381a2a9aSdr case -1 : 1672*381a2a9aSdr goto bad_fastroute; 1673ab25eeb5Syz } 1674*381a2a9aSdr fin->fin_out = 0; 1675*381a2a9aSdr fin->fin_ifp = saveifp; 1676ab25eeb5Syz 1677*381a2a9aSdr if (fin->fin_nat != NULL) 1678*381a2a9aSdr fr_natderef((nat_t **)&fin->fin_nat); 1679*381a2a9aSdr } 1680*381a2a9aSdr #ifndef sparc 1681*381a2a9aSdr if (fin->fin_v == 4) { 1682*381a2a9aSdr __iplen = (u_short)ip->ip_len, 1683*381a2a9aSdr __ipoff = (u_short)ip->ip_off; 1684ab25eeb5Syz 1685*381a2a9aSdr ip->ip_len = htons(__iplen); 1686*381a2a9aSdr ip->ip_off = htons(__ipoff); 1687*381a2a9aSdr } 1688ab25eeb5Syz #endif 1689*381a2a9aSdr 1690*381a2a9aSdr if (net_data_p) { 1691*381a2a9aSdr if (net_inject(net_data_p, NI_DIRECT_OUT, &inj_data) < 0) { 1692*381a2a9aSdr return (-1); 1693ab25eeb5Syz } 1694ab25eeb5Syz } 1695*381a2a9aSdr 1696*381a2a9aSdr fr_frouteok[0]++; 1697*381a2a9aSdr return 0; 1698ab25eeb5Syz bad_fastroute: 1699ab25eeb5Syz freemsg(mb); 1700*381a2a9aSdr fr_frouteok[1]++; 1701ab25eeb5Syz return -1; 1702ab25eeb5Syz } 1703ab25eeb5Syz 1704ab25eeb5Syz 1705ab25eeb5Syz /* ------------------------------------------------------------------------ */ 1706*381a2a9aSdr /* Function: ipf_hook_out */ 1707*381a2a9aSdr /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1708*381a2a9aSdr /* Parameters: event(I) - pointer to event */ 1709*381a2a9aSdr /* info(I) - pointer to hook information for firewalling */ 1710ab25eeb5Syz /* */ 1711*381a2a9aSdr /* Calling ipf_hook. */ 1712*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1713*381a2a9aSdr /*ARGSUSED*/ 1714*381a2a9aSdr int ipf_hook_out(hook_event_token_t token, hook_data_t info) 1715*381a2a9aSdr { 1716*381a2a9aSdr return ipf_hook(info, 1, 0); 1717*381a2a9aSdr } 1718*381a2a9aSdr 1719*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1720*381a2a9aSdr /* Function: ipf_hook_in */ 1721*381a2a9aSdr /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1722*381a2a9aSdr /* Parameters: event(I) - pointer to event */ 1723*381a2a9aSdr /* info(I) - pointer to hook information for firewalling */ 1724ab25eeb5Syz /* */ 1725*381a2a9aSdr /* Calling ipf_hook. */ 1726ab25eeb5Syz /* ------------------------------------------------------------------------ */ 1727*381a2a9aSdr /*ARGSUSED*/ 1728*381a2a9aSdr int ipf_hook_in(hook_event_token_t token, hook_data_t info) 1729ab25eeb5Syz { 1730*381a2a9aSdr return ipf_hook(info, 0, 0); 1731*381a2a9aSdr } 1732ab25eeb5Syz 1733ab25eeb5Syz 1734*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1735*381a2a9aSdr /* Function: ipf_hook_loop_out */ 1736*381a2a9aSdr /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1737*381a2a9aSdr /* Parameters: event(I) - pointer to event */ 1738*381a2a9aSdr /* info(I) - pointer to hook information for firewalling */ 1739*381a2a9aSdr /* */ 1740*381a2a9aSdr /* Calling ipf_hook. */ 1741*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1742*381a2a9aSdr /*ARGSUSED*/ 1743*381a2a9aSdr int ipf_hook_loop_out(hook_event_token_t token, hook_data_t info) 1744*381a2a9aSdr { 1745*381a2a9aSdr return ipf_hook(info, 1, 1); 1746*381a2a9aSdr } 1747ab25eeb5Syz 1748*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1749*381a2a9aSdr /* Function: ipf_hook_loop_in */ 1750*381a2a9aSdr /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1751*381a2a9aSdr /* Parameters: event(I) - pointer to event */ 1752*381a2a9aSdr /* info(I) - pointer to hook information for firewalling */ 1753*381a2a9aSdr /* */ 1754*381a2a9aSdr /* Calling ipf_hook. */ 1755*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1756*381a2a9aSdr /*ARGSUSED*/ 1757*381a2a9aSdr int ipf_hook_loop_in(hook_event_token_t token, hook_data_t info) 1758*381a2a9aSdr { 1759*381a2a9aSdr return ipf_hook(info, 0, 1); 1760*381a2a9aSdr } 1761*381a2a9aSdr 1762*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1763*381a2a9aSdr /* Function: ipf_hook */ 1764*381a2a9aSdr /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1765*381a2a9aSdr /* Parameters: info(I) - pointer to hook information for firewalling */ 1766*381a2a9aSdr /* out(I) - whether packet is going in or out */ 1767*381a2a9aSdr /* loopback(I) - whether packet is a loopback packet or not */ 1768*381a2a9aSdr /* */ 1769*381a2a9aSdr /* Stepping stone function between the IP mainline and IPFilter. Extracts */ 1770*381a2a9aSdr /* parameters out of the info structure and forms them up to be useful for */ 1771*381a2a9aSdr /* calling ipfilter. */ 1772*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1773*381a2a9aSdr int ipf_hook(hook_data_t info, int out, int loopback) 1774*381a2a9aSdr { 1775*381a2a9aSdr hook_pkt_event_t *fw; 1776*381a2a9aSdr int rval, v, hlen; 1777*381a2a9aSdr qpktinfo_t qpi; 1778*381a2a9aSdr u_short swap; 1779*381a2a9aSdr phy_if_t phy; 1780*381a2a9aSdr ip_t *ip; 1781*381a2a9aSdr 1782*381a2a9aSdr fw = (hook_pkt_event_t *)info; 1783*381a2a9aSdr 1784*381a2a9aSdr ASSERT(fw != NULL); 1785*381a2a9aSdr phy = (out == 0) ? fw->hpe_ifp : fw->hpe_ofp; 1786*381a2a9aSdr 1787*381a2a9aSdr ip = fw->hpe_hdr; 1788*381a2a9aSdr v = ip->ip_v; 1789*381a2a9aSdr if (v == IPV4_VERSION) { 1790*381a2a9aSdr swap = ntohs(ip->ip_len); 1791*381a2a9aSdr ip->ip_len = swap; 1792*381a2a9aSdr swap = ntohs(ip->ip_off); 1793*381a2a9aSdr ip->ip_off = swap; 1794*381a2a9aSdr 1795*381a2a9aSdr hlen = IPH_HDR_LENGTH(ip); 1796*381a2a9aSdr } else 1797*381a2a9aSdr hlen = sizeof (ip6_t); 1798*381a2a9aSdr 1799*381a2a9aSdr bzero(&qpi, sizeof (qpktinfo_t)); 1800*381a2a9aSdr 1801*381a2a9aSdr qpi.qpi_m = fw->hpe_mb; 1802*381a2a9aSdr qpi.qpi_data = fw->hpe_hdr; 1803*381a2a9aSdr qpi.qpi_off = (char *)qpi.qpi_data - (char *)fw->hpe_mb->b_rptr; 1804*381a2a9aSdr qpi.qpi_ill = (void *)phy; 1805*381a2a9aSdr if (loopback) 1806*381a2a9aSdr qpi.qpi_flags = QPI_NOCKSUM; 1807ab25eeb5Syz else 1808*381a2a9aSdr qpi.qpi_flags = 0; 1809*381a2a9aSdr 1810*381a2a9aSdr rval = fr_check(fw->hpe_hdr, hlen, qpi.qpi_ill, out, &qpi, fw->hpe_mp); 1811*381a2a9aSdr 1812*381a2a9aSdr /* For fastroute cases, fr_check returns 0 with mp set to NULL */ 1813*381a2a9aSdr if (rval == 0 && *(fw->hpe_mp) == NULL) 1814*381a2a9aSdr rval = 1; 1815*381a2a9aSdr 1816*381a2a9aSdr /* Notify IP the packet mblk_t and IP header pointers. */ 1817*381a2a9aSdr fw->hpe_mb = qpi.qpi_m; 1818*381a2a9aSdr fw->hpe_hdr = qpi.qpi_data; 1819*381a2a9aSdr if ((rval == 0) && (v == IPV4_VERSION)) { 1820*381a2a9aSdr ip = qpi.qpi_data; 1821*381a2a9aSdr swap = ntohs(ip->ip_len); 1822*381a2a9aSdr ip->ip_len = swap; 1823*381a2a9aSdr swap = ntohs(ip->ip_off); 1824*381a2a9aSdr ip->ip_off = swap; 1825*381a2a9aSdr } 1826*381a2a9aSdr return rval; 1827ab25eeb5Syz 1828*381a2a9aSdr } 1829ab25eeb5Syz 1830ab25eeb5Syz 1831*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1832*381a2a9aSdr /* Function: ipf_nic_event_v4 */ 1833*381a2a9aSdr /* Returns: int - 0 == no problems encountered */ 1834*381a2a9aSdr /* Parameters: event(I) - pointer to event */ 1835*381a2a9aSdr /* info(I) - pointer to information about a NIC event */ 1836*381a2a9aSdr /* */ 1837*381a2a9aSdr /* Function to receive asynchronous NIC events from IP */ 1838*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1839*381a2a9aSdr /*ARGSUSED*/ 1840*381a2a9aSdr int ipf_nic_event_v4(hook_event_token_t event, hook_data_t info) 1841*381a2a9aSdr { 1842*381a2a9aSdr struct sockaddr_in *sin; 1843*381a2a9aSdr hook_nic_event_t *hn; 1844*381a2a9aSdr 1845*381a2a9aSdr hn = (hook_nic_event_t *)info; 1846*381a2a9aSdr 1847*381a2a9aSdr switch (hn->hne_event) 1848*381a2a9aSdr { 1849*381a2a9aSdr case NE_PLUMB : 1850*381a2a9aSdr frsync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic, hn->hne_data); 1851*381a2a9aSdr fr_natifpsync(IPFSYNC_NEWIFP, (void *)hn->hne_nic, 1852*381a2a9aSdr hn->hne_data); 1853*381a2a9aSdr fr_statesync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic, 1854*381a2a9aSdr hn->hne_data); 1855*381a2a9aSdr break; 1856*381a2a9aSdr 1857*381a2a9aSdr case NE_UNPLUMB : 1858*381a2a9aSdr frsync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL); 1859*381a2a9aSdr fr_natifpsync(IPFSYNC_OLDIFP, (void *)hn->hne_nic, NULL); 1860*381a2a9aSdr fr_statesync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL); 1861*381a2a9aSdr break; 1862*381a2a9aSdr 1863*381a2a9aSdr case NE_ADDRESS_CHANGE : 1864*381a2a9aSdr sin = hn->hne_data; 1865*381a2a9aSdr fr_nataddrsync((void *)hn->hne_nic, &sin->sin_addr); 1866*381a2a9aSdr break; 1867*381a2a9aSdr 1868*381a2a9aSdr default : 1869*381a2a9aSdr break; 1870ab25eeb5Syz } 1871ab25eeb5Syz 1872*381a2a9aSdr return 0; 1873*381a2a9aSdr } 1874ab25eeb5Syz 1875*381a2a9aSdr 1876*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1877*381a2a9aSdr /* Function: ipf_nic_event_v6 */ 1878*381a2a9aSdr /* Returns: int - 0 == no problems encountered */ 1879*381a2a9aSdr /* Parameters: event(I) - pointer to event */ 1880*381a2a9aSdr /* info(I) - pointer to information about a NIC event */ 1881*381a2a9aSdr /* */ 1882*381a2a9aSdr /* Function to receive asynchronous NIC events from IP */ 1883*381a2a9aSdr /* ------------------------------------------------------------------------ */ 1884*381a2a9aSdr /*ARGSUSED*/ 1885*381a2a9aSdr int ipf_nic_event_v6(hook_event_token_t event, hook_data_t info) 1886*381a2a9aSdr { 1887*381a2a9aSdr hook_nic_event_t *hn; 1888*381a2a9aSdr 1889*381a2a9aSdr hn = (hook_nic_event_t *)info; 1890*381a2a9aSdr 1891*381a2a9aSdr switch (hn->hne_event) 1892*381a2a9aSdr { 1893*381a2a9aSdr case NE_PLUMB : 1894*381a2a9aSdr frsync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic, hn->hne_data); 1895*381a2a9aSdr fr_statesync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic, 1896*381a2a9aSdr hn->hne_data); 1897*381a2a9aSdr break; 1898*381a2a9aSdr 1899*381a2a9aSdr case NE_UNPLUMB : 1900*381a2a9aSdr frsync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL); 1901*381a2a9aSdr fr_statesync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL); 1902*381a2a9aSdr break; 1903*381a2a9aSdr 1904*381a2a9aSdr case NE_ADDRESS_CHANGE : 1905*381a2a9aSdr break; 1906*381a2a9aSdr default : 1907*381a2a9aSdr break; 1908*381a2a9aSdr } 1909*381a2a9aSdr 1910*381a2a9aSdr return 0; 1911ab25eeb5Syz } 1912