1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  24  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
  25  * Copyright (c) 2012 by Delphix. All rights reserved.
  26  * Copyright 2012 Marcel Telka <marcel@telka.sk>
  27  * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
  28  */
  29 
  30 /*      Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
  31 /*      All Rights Reserved     */
  32 
  33 /*
  34  * Portions of this source code were derived from Berkeley 4.3 BSD
  35  * under license from the Regents of the University of California.
  36  */
  37 
  38 /*
  39  * svc_clts.c
  40  * Server side for RPC in the kernel.
  41  *
  42  */
  43 
  44 #include <sys/param.h>
  45 #include <sys/types.h>
  46 #include <sys/sysmacros.h>
  47 #include <sys/file.h>
  48 #include <sys/stream.h>
  49 #include <sys/strsun.h>
  50 #include <sys/strsubr.h>
  51 #include <sys/tihdr.h>
  52 #include <sys/tiuser.h>
  53 #include <sys/t_kuser.h>
  54 #include <sys/fcntl.h>
  55 #include <sys/errno.h>
  56 #include <sys/kmem.h>
  57 #include <sys/systm.h>
  58 #include <sys/cmn_err.h>
  59 #include <sys/kstat.h>
  60 #include <sys/vtrace.h>
  61 #include <sys/debug.h>
  62 
  63 #include <rpc/types.h>
  64 #include <rpc/xdr.h>
  65 #include <rpc/auth.h>
  66 #include <rpc/clnt.h>
  67 #include <rpc/rpc_msg.h>
  68 #include <rpc/svc.h>
  69 #include <inet/ip.h>
  70 
  71 /*
  72  * Routines exported through ops vector.
  73  */
  74 static bool_t           svc_clts_krecv(SVCXPRT *, mblk_t *, struct rpc_msg *);
  75 static bool_t           svc_clts_ksend(SVCXPRT *, struct rpc_msg *);
  76 static bool_t           svc_clts_kgetargs(SVCXPRT *, xdrproc_t, caddr_t);
  77 static bool_t           svc_clts_kfreeargs(SVCXPRT *, xdrproc_t, caddr_t);
  78 static void             svc_clts_kdestroy(SVCMASTERXPRT *);
  79 static int              svc_clts_kdup(struct svc_req *, caddr_t, int,
  80                                 struct dupreq **, bool_t *);
  81 static void             svc_clts_kdupdone(struct dupreq *, caddr_t,
  82                                 void (*)(), int, int);
  83 static int32_t          *svc_clts_kgetres(SVCXPRT *, int);
  84 static void             svc_clts_kclone_destroy(SVCXPRT *);
  85 static void             svc_clts_kfreeres(SVCXPRT *);
  86 static void             svc_clts_kstart(SVCMASTERXPRT *);
  87 static void             svc_clts_kclone_xprt(SVCXPRT *, SVCXPRT *);
  88 static void             svc_clts_ktattrs(SVCXPRT *, int, void **);
  89 
  90 /*
  91  * Server transport operations vector.
  92  */
  93 struct svc_ops svc_clts_op = {
  94         svc_clts_krecv,         /* Get requests */
  95         svc_clts_kgetargs,      /* Deserialize arguments */
  96         svc_clts_ksend,         /* Send reply */
  97         svc_clts_kfreeargs,     /* Free argument data space */
  98         svc_clts_kdestroy,      /* Destroy transport handle */
  99         svc_clts_kdup,          /* Check entry in dup req cache */
 100         svc_clts_kdupdone,      /* Mark entry in dup req cache as done */
 101         svc_clts_kgetres,       /* Get pointer to response buffer */
 102         svc_clts_kfreeres,      /* Destroy pre-serialized response header */
 103         svc_clts_kclone_destroy, /* Destroy a clone xprt */
 104         svc_clts_kstart,        /* Tell `ready-to-receive' to rpcmod */
 105         svc_clts_kclone_xprt,   /* transport specific clone xprt function */
 106         svc_clts_ktattrs,       /* Transport specific attributes */
 107         rpcmod_hold,            /* Increment transport reference count */
 108         rpcmod_release          /* Decrement transport reference count */
 109 };
 110 
 111 /*
 112  * Transport private data.
 113  * Kept in xprt->xp_p2buf.
 114  */
 115 struct udp_data {
 116         mblk_t  *ud_resp;                       /* buffer for response */
 117         mblk_t  *ud_inmp;                       /* mblk chain of request */
 118         sin6_t  ud_local;                       /* local address */
 119 };
 120 
 121 #define UD_MAXSIZE      8800
 122 #define UD_INITSIZE     2048
 123 
 124 /*
 125  * Connectionless server statistics
 126  */
 127 static const struct rpc_clts_server {
 128         kstat_named_t   rscalls;
 129         kstat_named_t   rsbadcalls;
 130         kstat_named_t   rsnullrecv;
 131         kstat_named_t   rsbadlen;
 132         kstat_named_t   rsxdrcall;
 133         kstat_named_t   rsdupchecks;
 134         kstat_named_t   rsdupreqs;
 135 } clts_rsstat_tmpl = {
 136         { "calls",      KSTAT_DATA_UINT64 },
 137         { "badcalls",   KSTAT_DATA_UINT64 },
 138         { "nullrecv",   KSTAT_DATA_UINT64 },
 139         { "badlen",     KSTAT_DATA_UINT64 },
 140         { "xdrcall",    KSTAT_DATA_UINT64 },
 141         { "dupchecks",  KSTAT_DATA_UINT64 },
 142         { "dupreqs",    KSTAT_DATA_UINT64 }
 143 };
 144 
 145 static uint_t clts_rsstat_ndata =
 146         sizeof (clts_rsstat_tmpl) / sizeof (kstat_named_t);
 147 
 148 #define CLONE2STATS(clone_xprt) \
 149         (struct rpc_clts_server *)(clone_xprt)->xp_master->xp_p2
 150 
 151 #define RSSTAT_INCR(stats, x)   \
 152         atomic_inc_64(&(stats)->x.value.ui64)
 153 
 154 /*
 155  * Create a transport record.
 156  * The transport record, output buffer, and private data structure
 157  * are allocated.  The output buffer is serialized into using xdrmem.
 158  * There is one transport record per user process which implements a
 159  * set of services.
 160  */
 161 /* ARGSUSED */
 162 int
 163 svc_clts_kcreate(file_t *fp, uint_t sendsz, struct T_info_ack *tinfo,
 164     SVCMASTERXPRT **nxprt)
 165 {
 166         SVCMASTERXPRT *xprt;
 167         struct rpcstat *rpcstat;
 168 
 169         if (nxprt == NULL)
 170                 return (EINVAL);
 171 
 172         rpcstat = zone_getspecific(rpcstat_zone_key, curproc->p_zone);
 173         ASSERT(rpcstat != NULL);
 174 
 175         xprt = kmem_zalloc(sizeof (*xprt), KM_SLEEP);
 176         xprt->xp_lcladdr.buf = kmem_zalloc(sizeof (sin6_t), KM_SLEEP);
 177         xprt->xp_p2 = (caddr_t)rpcstat->rpc_clts_server;
 178         xprt->xp_ops = &svc_clts_op;
 179         xprt->xp_msg_size = tinfo->TSDU_size;
 180 
 181         xprt->xp_rtaddr.buf = NULL;
 182         xprt->xp_rtaddr.maxlen = tinfo->ADDR_size;
 183         xprt->xp_rtaddr.len = 0;
 184 
 185         *nxprt = xprt;
 186 
 187         return (0);
 188 }
 189 
 190 /*
 191  * Destroy a transport record.
 192  * Frees the space allocated for a transport record.
 193  */
 194 static void
 195 svc_clts_kdestroy(SVCMASTERXPRT *xprt)
 196 {
 197         if (xprt->xp_netid)
 198                 kmem_free(xprt->xp_netid, strlen(xprt->xp_netid) + 1);
 199         if (xprt->xp_addrmask.maxlen)
 200                 kmem_free(xprt->xp_addrmask.buf, xprt->xp_addrmask.maxlen);
 201 
 202         mutex_destroy(&xprt->xp_req_lock);
 203         mutex_destroy(&xprt->xp_thread_lock);
 204 
 205         kmem_free(xprt->xp_lcladdr.buf, sizeof (sin6_t));
 206         kmem_free(xprt, sizeof (SVCMASTERXPRT));
 207 }
 208 
 209 /*
 210  * Transport-type specific part of svc_xprt_cleanup().
 211  * Frees the message buffer space allocated for a clone of a transport record
 212  */
 213 static void
 214 svc_clts_kclone_destroy(SVCXPRT *clone_xprt)
 215 {
 216         /* LINTED pointer alignment */
 217         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 218 
 219         if (ud->ud_resp) {
 220                 /*
 221                  * There should not be any left over results buffer.
 222                  */
 223                 ASSERT(ud->ud_resp->b_cont == NULL);
 224 
 225                 /*
 226                  * Free the T_UNITDATA_{REQ/IND} that svc_clts_krecv
 227                  * saved.
 228                  */
 229                 freeb(ud->ud_resp);
 230         }
 231         if (ud->ud_inmp)
 232                 freemsg(ud->ud_inmp);
 233 }
 234 
 235 /*
 236  * svc_tli_kcreate() calls this function at the end to tell
 237  * rpcmod that the transport is ready to receive requests.
 238  */
 239 /* ARGSUSED */
 240 static void
 241 svc_clts_kstart(SVCMASTERXPRT *xprt)
 242 {
 243 }
 244 
 245 static void
 246 svc_clts_kclone_xprt(SVCXPRT *src_xprt, SVCXPRT *dst_xprt)
 247 {
 248         struct udp_data *ud_src =
 249             (struct udp_data *)src_xprt->xp_p2buf;
 250         struct udp_data *ud_dst =
 251             (struct udp_data *)dst_xprt->xp_p2buf;
 252 
 253         if (ud_src->ud_resp)
 254                 ud_dst->ud_resp = dupb(ud_src->ud_resp);
 255 
 256 }
 257 
 258 static void
 259 svc_clts_ktattrs(SVCXPRT *clone_xprt, int attrflag, void **tattr)
 260 {
 261         *tattr = NULL;
 262 
 263         switch (attrflag) {
 264         case SVC_TATTR_ADDRMASK:
 265                 *tattr = (void *)&clone_xprt->xp_master->xp_addrmask;
 266         }
 267 }
 268 
 269 /*
 270  * Receive rpc requests.
 271  * Pulls a request in off the socket, checks if the packet is intact,
 272  * and deserializes the call packet.
 273  */
 274 static bool_t
 275 svc_clts_krecv(SVCXPRT *clone_xprt, mblk_t *mp, struct rpc_msg *msg)
 276 {
 277         /* LINTED pointer alignment */
 278         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 279         XDR *xdrs = &clone_xprt->xp_xdrin;
 280         struct rpc_clts_server *stats = CLONE2STATS(clone_xprt);
 281         union T_primitives *pptr;
 282         int hdrsz;
 283         cred_t *cr;
 284 
 285         TRACE_0(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_START,
 286             "svc_clts_krecv_start:");
 287 
 288         RSSTAT_INCR(stats, rscalls);
 289 
 290         /*
 291          * The incoming request should start with an M_PROTO message.
 292          */
 293         if (mp->b_datap->db_type != M_PROTO) {
 294                 goto bad;
 295         }
 296 
 297         /*
 298          * The incoming request should be an T_UNITDTA_IND.  There
 299          * might be other messages coming up the stream, but we can
 300          * ignore them.
 301          */
 302         pptr = (union T_primitives *)mp->b_rptr;
 303         if (pptr->type != T_UNITDATA_IND) {
 304                 goto bad;
 305         }
 306         /*
 307          * Do some checking to make sure that the header at least looks okay.
 308          */
 309         hdrsz = (int)(mp->b_wptr - mp->b_rptr);
 310         if (hdrsz < TUNITDATAINDSZ ||
 311             hdrsz < (pptr->unitdata_ind.OPT_offset +
 312             pptr->unitdata_ind.OPT_length) ||
 313             hdrsz < (pptr->unitdata_ind.SRC_offset +
 314             pptr->unitdata_ind.SRC_length)) {
 315                 goto bad;
 316         }
 317 
 318         /*
 319          * Make sure that the transport provided a usable address.
 320          */
 321         if (pptr->unitdata_ind.SRC_length <= 0) {
 322                 goto bad;
 323         }
 324         /*
 325          * Point the remote transport address in the service_transport
 326          * handle at the address in the request.
 327          */
 328         clone_xprt->xp_rtaddr.buf = (char *)mp->b_rptr +
 329             pptr->unitdata_ind.SRC_offset;
 330         clone_xprt->xp_rtaddr.len = pptr->unitdata_ind.SRC_length;
 331 
 332         clone_xprt->xp_lcladdr.buf = (char *)&ud->ud_local;
 333 
 334         /*
 335          * Copy the local transport address in the service_transport
 336          * handle at the address in the request. We will have only
 337          * the local IP address in options.
 338          */
 339         ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family = AF_UNSPEC;
 340         if (pptr->unitdata_ind.OPT_length && pptr->unitdata_ind.OPT_offset) {
 341                 char *dstopt = (char *)mp->b_rptr +
 342                     pptr->unitdata_ind.OPT_offset;
 343                 struct T_opthdr *toh = (struct T_opthdr *)dstopt;
 344 
 345                 if (toh->level == IPPROTO_IPV6 && toh->status == 0 &&
 346                     toh->name == IPV6_PKTINFO) {
 347                         struct in6_pktinfo *pkti;
 348 
 349                         dstopt += sizeof (struct T_opthdr);
 350                         pkti = (struct in6_pktinfo *)dstopt;
 351                         ((sin6_t *)(clone_xprt->xp_lcladdr.buf))->sin6_addr
 352                             = pkti->ipi6_addr;
 353                         ((sin6_t *)(clone_xprt->xp_lcladdr.buf))->sin6_family
 354                             = AF_INET6;
 355                 } else if (toh->level == IPPROTO_IP && toh->status == 0 &&
 356                     toh->name == IP_RECVDSTADDR) {
 357                         dstopt += sizeof (struct T_opthdr);
 358                         ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_addr
 359                             = *(struct in_addr *)dstopt;
 360                         ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family
 361                             = AF_INET;
 362                 }
 363         }
 364 
 365         /*
 366          * Save the first mblk which contains the T_unidata_ind in
 367          * ud_resp.  It will be used to generate the T_unitdata_req
 368          * during the reply.
 369          * We reuse any options in the T_unitdata_ind for the T_unitdata_req
 370          * since we must pass any SCM_UCRED across in order for TX to
 371          * work. We also make sure any cred_t is carried across.
 372          */
 373         if (ud->ud_resp) {
 374                 if (ud->ud_resp->b_cont != NULL) {
 375                         cmn_err(CE_WARN, "svc_clts_krecv: ud_resp %p, "
 376                             "b_cont %p", (void *)ud->ud_resp,
 377                             (void *)ud->ud_resp->b_cont);
 378                 }
 379                 freeb(ud->ud_resp);
 380         }
 381         /* Move any cred_t to the first mblk in the message */
 382         cr = msg_getcred(mp, NULL);
 383         if (cr != NULL)
 384                 mblk_setcred(mp, cr, NOPID);
 385 
 386         ud->ud_resp = mp;
 387         mp = mp->b_cont;
 388         ud->ud_resp->b_cont = NULL;
 389 
 390         xdrmblk_init(xdrs, mp, XDR_DECODE, 0);
 391 
 392         TRACE_0(TR_FAC_KRPC, TR_XDR_CALLMSG_START,
 393             "xdr_callmsg_start:");
 394         if (! xdr_callmsg(xdrs, msg)) {
 395                 XDR_DESTROY(xdrs);
 396                 TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
 397                     "xdr_callmsg_end:(%S)", "bad");
 398                 RSSTAT_INCR(stats, rsxdrcall);
 399                 goto bad;
 400         }
 401         TRACE_1(TR_FAC_KRPC, TR_XDR_CALLMSG_END,
 402             "xdr_callmsg_end:(%S)", "good");
 403 
 404         clone_xprt->xp_xid = msg->rm_xid;
 405         ud->ud_inmp = mp;
 406 
 407         TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_END,
 408             "svc_clts_krecv_end:(%S)", "good");
 409         return (TRUE);
 410 
 411 bad:
 412         freemsg(mp);
 413         if (ud->ud_resp) {
 414                 /*
 415                  * There should not be any left over results buffer.
 416                  */
 417                 ASSERT(ud->ud_resp->b_cont == NULL);
 418                 freeb(ud->ud_resp);
 419                 ud->ud_resp = NULL;
 420         }
 421 
 422         RSSTAT_INCR(stats, rsbadcalls);
 423         TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KRECV_END,
 424             "svc_clts_krecv_end:(%S)", "bad");
 425         return (FALSE);
 426 }
 427 
 428 /*
 429  * Send rpc reply.
 430  * Serialize the reply packet into the output buffer then
 431  * call t_ksndudata to send it.
 432  */
 433 static bool_t
 434 svc_clts_ksend(SVCXPRT *clone_xprt, struct rpc_msg *msg)
 435 {
 436         /* LINTED pointer alignment */
 437         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 438         XDR *xdrs = &clone_xprt->xp_xdrout;
 439         int stat = FALSE;
 440         mblk_t *mp;
 441         int msgsz;
 442         struct T_unitdata_req *udreq;
 443         xdrproc_t xdr_results;
 444         caddr_t xdr_location;
 445         bool_t has_args;
 446 
 447         TRACE_0(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_START,
 448             "svc_clts_ksend_start:");
 449 
 450         ASSERT(ud->ud_resp != NULL);
 451 
 452         /*
 453          * If there is a result procedure specified in the reply message,
 454          * it will be processed in the xdr_replymsg and SVCAUTH_WRAP.
 455          * We need to make sure it won't be processed twice, so we null
 456          * it for xdr_replymsg here.
 457          */
 458         has_args = FALSE;
 459         if (msg->rm_reply.rp_stat == MSG_ACCEPTED &&
 460             msg->rm_reply.rp_acpt.ar_stat == SUCCESS) {
 461                 if ((xdr_results = msg->acpted_rply.ar_results.proc) != NULL) {
 462                         has_args = TRUE;
 463                         xdr_location = msg->acpted_rply.ar_results.where;
 464                         msg->acpted_rply.ar_results.proc = xdr_void;
 465                         msg->acpted_rply.ar_results.where = NULL;
 466                 }
 467         }
 468 
 469         if (ud->ud_resp->b_cont == NULL) {
 470                 /*
 471                  * Allocate an initial mblk for the response data.
 472                  */
 473                 while ((mp = allocb(UD_INITSIZE, BPRI_LO)) == NULL) {
 474                         if (strwaitbuf(UD_INITSIZE, BPRI_LO)) {
 475                                 TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_END,
 476                                     "svc_clts_ksend_end:(%S)", "strwaitbuf");
 477                                 return (FALSE);
 478                         }
 479                 }
 480 
 481                 /*
 482                  * Initialize the XDR encode stream.  Additional mblks
 483                  * will be allocated if necessary.  They will be UD_MAXSIZE
 484                  * sized.
 485                  */
 486                 xdrmblk_init(xdrs, mp, XDR_ENCODE, UD_MAXSIZE);
 487 
 488                 /*
 489                  * Leave some space for protocol headers.
 490                  */
 491                 (void) XDR_SETPOS(xdrs, 512);
 492                 mp->b_rptr += 512;
 493 
 494                 msg->rm_xid = clone_xprt->xp_xid;
 495 
 496                 ud->ud_resp->b_cont = mp;
 497 
 498                 TRACE_0(TR_FAC_KRPC, TR_XDR_REPLYMSG_START,
 499                     "xdr_replymsg_start:");
 500                 if (!(xdr_replymsg(xdrs, msg) &&
 501                     (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
 502                     xdr_results, xdr_location)))) {
 503                         XDR_DESTROY(xdrs);
 504                         TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
 505                             "xdr_replymsg_end:(%S)", "bad");
 506                         RPCLOG0(1, "xdr_replymsg/SVCAUTH_WRAP failed\n");
 507                         goto out;
 508                 }
 509                 TRACE_1(TR_FAC_KRPC, TR_XDR_REPLYMSG_END,
 510                     "xdr_replymsg_end:(%S)", "good");
 511 
 512         } else if (!(xdr_replymsg_body(xdrs, msg) &&
 513             (!has_args || SVCAUTH_WRAP(&clone_xprt->xp_auth, xdrs,
 514             xdr_results, xdr_location)))) {
 515                 XDR_DESTROY(xdrs);
 516                 RPCLOG0(1, "xdr_replymsg_body/SVCAUTH_WRAP failed\n");
 517                 goto out;
 518         }
 519 
 520         XDR_DESTROY(xdrs);
 521 
 522         msgsz = (int)xmsgsize(ud->ud_resp->b_cont);
 523 
 524         if (msgsz <= 0 || (clone_xprt->xp_msg_size != -1 &&
 525             msgsz > clone_xprt->xp_msg_size)) {
 526 #ifdef  DEBUG
 527                 cmn_err(CE_NOTE,
 528 "KRPC: server response message of %d bytes; transport limits are [0, %d]",
 529                     msgsz, clone_xprt->xp_msg_size);
 530 #endif
 531                 goto out;
 532         }
 533 
 534         /*
 535          * Construct the T_unitdata_req.  We take advantage of the fact that
 536          * T_unitdata_ind looks just like T_unitdata_req, except for the
 537          * primitive type.  Reusing it means we preserve the SCM_UCRED, and
 538          * we must preserve it for TX to work.
 539          *
 540          * This has the side effect that we can also pass certain receive-side
 541          * options like IPV6_PKTINFO back down the send side.  This implies
 542          * that we can not ASSERT on a non-NULL db_credp when we have send-side
 543          * options in UDP.
 544          */
 545         ASSERT(MBLKL(ud->ud_resp) >= TUNITDATAREQSZ);
 546         udreq = (struct T_unitdata_req *)ud->ud_resp->b_rptr;
 547         ASSERT(udreq->PRIM_type == T_UNITDATA_IND);
 548         udreq->PRIM_type = T_UNITDATA_REQ;
 549 
 550         /*
 551          * If the local IPv4 transport address is known use it as a source
 552          * address for the outgoing UDP packet.
 553          */
 554         if (((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_family == AF_INET) {
 555                 struct T_opthdr *opthdr;
 556                 in_pktinfo_t *pktinfo;
 557                 size_t size;
 558 
 559                 if (udreq->DEST_length == 0)
 560                         udreq->OPT_offset = _TPI_ALIGN_TOPT(TUNITDATAREQSZ);
 561                 else
 562                         udreq->OPT_offset = _TPI_ALIGN_TOPT(udreq->DEST_offset +
 563                             udreq->DEST_length);
 564 
 565                 udreq->OPT_length = sizeof (struct T_opthdr) +
 566                     sizeof (in_pktinfo_t);
 567 
 568                 size = udreq->OPT_length + udreq->OPT_offset;
 569 
 570                 /* make sure we have enough space for the option data */
 571                 mp = reallocb(ud->ud_resp, size, 1);
 572                 if (mp == NULL)
 573                         goto out;
 574                 ud->ud_resp = mp;
 575                 udreq = (struct T_unitdata_req *)mp->b_rptr;
 576 
 577                 /* set desired option header */
 578                 opthdr = (struct T_opthdr *)(mp->b_rptr + udreq->OPT_offset);
 579                 opthdr->len = udreq->OPT_length;
 580                 opthdr->level = IPPROTO_IP;
 581                 opthdr->name = IP_PKTINFO;
 582 
 583                 /*
 584                  * 1. set source IP of outbound packet
 585                  * 2. value '0' for index means IP layer uses this as source
 586                  *    address
 587                  */
 588                 pktinfo = (in_pktinfo_t *)(opthdr + 1);
 589                 (void) memset(pktinfo, 0, sizeof (in_pktinfo_t));
 590                 pktinfo->ipi_spec_dst.s_addr =
 591                     ((sin_t *)(clone_xprt->xp_lcladdr.buf))->sin_addr.s_addr;
 592                 pktinfo->ipi_ifindex = 0;
 593 
 594                 /* adjust the end of active data */
 595                 mp->b_wptr = mp->b_rptr + size;
 596         }
 597 
 598         put(clone_xprt->xp_wq, ud->ud_resp);
 599         stat = TRUE;
 600         ud->ud_resp = NULL;
 601 
 602 out:
 603         if (stat == FALSE) {
 604                 freemsg(ud->ud_resp);
 605                 ud->ud_resp = NULL;
 606         }
 607 
 608         /*
 609          * This is completely disgusting.  If public is set it is
 610          * a pointer to a structure whose first field is the address
 611          * of the function to free that structure and any related
 612          * stuff.  (see rrokfree in nfs_xdr.c).
 613          */
 614         if (xdrs->x_public) {
 615                 /* LINTED pointer alignment */
 616                 (**((int (**)())xdrs->x_public))(xdrs->x_public);
 617         }
 618 
 619         TRACE_1(TR_FAC_KRPC, TR_SVC_CLTS_KSEND_END,
 620             "svc_clts_ksend_end:(%S)", "done");
 621         return (stat);
 622 }
 623 
 624 /*
 625  * Deserialize arguments.
 626  */
 627 static bool_t
 628 svc_clts_kgetargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
 629     caddr_t args_ptr)
 630 {
 631 
 632         /* LINTED pointer alignment */
 633         return (SVCAUTH_UNWRAP(&clone_xprt->xp_auth, &clone_xprt->xp_xdrin,
 634             xdr_args, args_ptr));
 635 
 636 }
 637 
 638 static bool_t
 639 svc_clts_kfreeargs(SVCXPRT *clone_xprt, xdrproc_t xdr_args,
 640     caddr_t args_ptr)
 641 {
 642         /* LINTED pointer alignment */
 643         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 644         XDR *xdrs = &clone_xprt->xp_xdrin;
 645         bool_t retval;
 646 
 647         if (args_ptr) {
 648                 xdrs->x_op = XDR_FREE;
 649                 retval = (*xdr_args)(xdrs, args_ptr);
 650         } else
 651                 retval = TRUE;
 652 
 653         XDR_DESTROY(xdrs);
 654 
 655         if (ud->ud_inmp) {
 656                 freemsg(ud->ud_inmp);
 657                 ud->ud_inmp = NULL;
 658         }
 659 
 660         return (retval);
 661 }
 662 
 663 static int32_t *
 664 svc_clts_kgetres(SVCXPRT *clone_xprt, int size)
 665 {
 666         /* LINTED pointer alignment */
 667         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 668         XDR *xdrs = &clone_xprt->xp_xdrout;
 669         mblk_t *mp;
 670         int32_t *buf;
 671         struct rpc_msg rply;
 672 
 673         /*
 674          * Allocate an initial mblk for the response data.
 675          */
 676         while ((mp = allocb(UD_INITSIZE, BPRI_LO)) == NULL) {
 677                 if (strwaitbuf(UD_INITSIZE, BPRI_LO)) {
 678                         return (NULL);
 679                 }
 680         }
 681 
 682         mp->b_cont = NULL;
 683 
 684         /*
 685          * Initialize the XDR encode stream.  Additional mblks
 686          * will be allocated if necessary.  They will be UD_MAXSIZE
 687          * sized.
 688          */
 689         xdrmblk_init(xdrs, mp, XDR_ENCODE, UD_MAXSIZE);
 690 
 691         /*
 692          * Leave some space for protocol headers.
 693          */
 694         (void) XDR_SETPOS(xdrs, 512);
 695         mp->b_rptr += 512;
 696 
 697         /*
 698          * Assume a successful RPC since most of them are.
 699          */
 700         rply.rm_xid = clone_xprt->xp_xid;
 701         rply.rm_direction = REPLY;
 702         rply.rm_reply.rp_stat = MSG_ACCEPTED;
 703         rply.acpted_rply.ar_verf = clone_xprt->xp_verf;
 704         rply.acpted_rply.ar_stat = SUCCESS;
 705 
 706         if (!xdr_replymsg_hdr(xdrs, &rply)) {
 707                 XDR_DESTROY(xdrs);
 708                 freeb(mp);
 709                 return (NULL);
 710         }
 711 
 712         buf = XDR_INLINE(xdrs, size);
 713 
 714         if (buf == NULL) {
 715                 XDR_DESTROY(xdrs);
 716                 freeb(mp);
 717         } else {
 718                 ud->ud_resp->b_cont = mp;
 719         }
 720 
 721         return (buf);
 722 }
 723 
 724 static void
 725 svc_clts_kfreeres(SVCXPRT *clone_xprt)
 726 {
 727         /* LINTED pointer alignment */
 728         struct udp_data *ud = (struct udp_data *)clone_xprt->xp_p2buf;
 729 
 730         if (ud->ud_resp == NULL || ud->ud_resp->b_cont == NULL)
 731                 return;
 732 
 733         XDR_DESTROY(&clone_xprt->xp_xdrout);
 734 
 735         /*
 736          * SVC_FREERES() is called whenever the server decides not to
 737          * send normal reply. Thus, we expect only one mblk to be allocated,
 738          * because we have not attempted any XDR encoding.
 739          * If we do any XDR encoding and we get an error, then SVC_REPLY()
 740          * will freemsg(ud->ud_resp);
 741          */
 742         ASSERT(ud->ud_resp->b_cont->b_cont == NULL);
 743         freeb(ud->ud_resp->b_cont);
 744         ud->ud_resp->b_cont = NULL;
 745 }
 746 
 747 /*
 748  * the dup cacheing routines below provide a cache of non-failure
 749  * transaction id's.  rpc service routines can use this to detect
 750  * retransmissions and re-send a non-failure response.
 751  */
 752 
 753 /*
 754  * MAXDUPREQS is the number of cached items.  It should be adjusted
 755  * to the service load so that there is likely to be a response entry
 756  * when the first retransmission comes in.
 757  */
 758 #define MAXDUPREQS      8192
 759 
 760 /*
 761  * This should be appropriately scaled to MAXDUPREQS.  To produce as less as
 762  * possible collisions it is suggested to set this to a prime.
 763  */
 764 #define DRHASHSZ        2053
 765 
 766 #define XIDHASH(xid)    ((xid) % DRHASHSZ)
 767 #define DRHASH(dr)      XIDHASH((dr)->dr_xid)
 768 #define REQTOXID(req)   ((req)->rq_xprt->xp_xid)
 769 
 770 static int      ndupreqs = 0;
 771 volatile int    maxdupreqs = MAXDUPREQS;
 772 static kmutex_t dupreq_lock;
 773 static struct dupreq *drhashtbl[DRHASHSZ];
 774 static int      drhashstat[DRHASHSZ];
 775 
 776 static void unhash(struct dupreq *);
 777 
 778 /*
 779  * drmru points to the head of a circular linked list in lru order.
 780  * drmru->dr_next == drlru
 781  */
 782 struct dupreq *drmru;
 783 
 784 /*
 785  * PSARC 2003/523 Contract Private Interface
 786  * svc_clts_kdup
 787  * Changes must be reviewed by Solaris File Sharing
 788  * Changes must be communicated to contract-2003-523@sun.com
 789  *
 790  * svc_clts_kdup searches the request cache and returns 0 if the
 791  * request is not found in the cache.  If it is found, then it
 792  * returns the state of the request (in progress or done) and
 793  * the status or attributes that were part of the original reply.
 794  *
 795  * If DUP_DONE (there is a duplicate) svc_clts_kdup copies over the
 796  * value of the response. In that case, also return in *dupcachedp
 797  * whether the response free routine is cached in the dupreq - in which case
 798  * the caller should not be freeing it, because it will be done later
 799  * in the svc_clts_kdup code when the dupreq is reused.
 800  */
 801 static int
 802 svc_clts_kdup(struct svc_req *req, caddr_t res, int size, struct dupreq **drpp,
 803     bool_t *dupcachedp)
 804 {
 805         struct rpc_clts_server *stats = CLONE2STATS(req->rq_xprt);
 806         struct dupreq *dr;
 807         uint32_t xid;
 808         uint32_t drhash;
 809         int status;
 810 
 811         xid = REQTOXID(req);
 812         mutex_enter(&dupreq_lock);
 813         RSSTAT_INCR(stats, rsdupchecks);
 814         /*
 815          * Check to see whether an entry already exists in the cache.
 816          */
 817         dr = drhashtbl[XIDHASH(xid)];
 818         while (dr != NULL) {
 819                 if (dr->dr_xid == xid &&
 820                     dr->dr_proc == req->rq_proc &&
 821                     dr->dr_prog == req->rq_prog &&
 822                     dr->dr_vers == req->rq_vers &&
 823                     dr->dr_addr.len == req->rq_xprt->xp_rtaddr.len &&
 824                     bcmp(dr->dr_addr.buf, req->rq_xprt->xp_rtaddr.buf,
 825                     dr->dr_addr.len) == 0) {
 826                         status = dr->dr_status;
 827                         if (status == DUP_DONE) {
 828                                 bcopy(dr->dr_resp.buf, res, size);
 829                                 if (dupcachedp != NULL)
 830                                         *dupcachedp = (dr->dr_resfree != NULL);
 831                         } else {
 832                                 dr->dr_status = DUP_INPROGRESS;
 833                                 *drpp = dr;
 834                         }
 835                         RSSTAT_INCR(stats, rsdupreqs);
 836                         mutex_exit(&dupreq_lock);
 837                         return (status);
 838                 }
 839                 dr = dr->dr_chain;
 840         }
 841 
 842         /*
 843          * There wasn't an entry, either allocate a new one or recycle
 844          * an old one.
 845          */
 846         if (ndupreqs < maxdupreqs) {
 847                 dr = kmem_alloc(sizeof (*dr), KM_NOSLEEP);
 848                 if (dr == NULL) {
 849                         mutex_exit(&dupreq_lock);
 850                         return (DUP_ERROR);
 851                 }
 852                 dr->dr_resp.buf = NULL;
 853                 dr->dr_resp.maxlen = 0;
 854                 dr->dr_addr.buf = NULL;
 855                 dr->dr_addr.maxlen = 0;
 856                 if (drmru) {
 857                         dr->dr_next = drmru->dr_next;
 858                         drmru->dr_next = dr;
 859                 } else {
 860                         dr->dr_next = dr;
 861                 }
 862                 ndupreqs++;
 863         } else {
 864                 dr = drmru->dr_next;
 865                 while (dr->dr_status == DUP_INPROGRESS) {
 866                         dr = dr->dr_next;
 867                         if (dr == drmru->dr_next) {
 868                                 cmn_err(CE_WARN, "svc_clts_kdup no slots free");
 869                                 mutex_exit(&dupreq_lock);
 870                                 return (DUP_ERROR);
 871                         }
 872                 }
 873                 unhash(dr);
 874                 if (dr->dr_resfree) {
 875                         (*dr->dr_resfree)(dr->dr_resp.buf);
 876                 }
 877         }
 878         dr->dr_resfree = NULL;
 879         drmru = dr;
 880 
 881         dr->dr_xid = REQTOXID(req);
 882         dr->dr_prog = req->rq_prog;
 883         dr->dr_vers = req->rq_vers;
 884         dr->dr_proc = req->rq_proc;
 885         if (dr->dr_addr.maxlen < req->rq_xprt->xp_rtaddr.len) {
 886                 if (dr->dr_addr.buf != NULL)
 887                         kmem_free(dr->dr_addr.buf, dr->dr_addr.maxlen);
 888                 dr->dr_addr.maxlen = req->rq_xprt->xp_rtaddr.len;
 889                 dr->dr_addr.buf = kmem_alloc(dr->dr_addr.maxlen,
 890                     KM_NOSLEEP);
 891                 if (dr->dr_addr.buf == NULL) {
 892                         dr->dr_addr.maxlen = 0;
 893                         dr->dr_status = DUP_DROP;
 894                         mutex_exit(&dupreq_lock);
 895                         return (DUP_ERROR);
 896                 }
 897         }
 898         dr->dr_addr.len = req->rq_xprt->xp_rtaddr.len;
 899         bcopy(req->rq_xprt->xp_rtaddr.buf, dr->dr_addr.buf, dr->dr_addr.len);
 900         if (dr->dr_resp.maxlen < size) {
 901                 if (dr->dr_resp.buf != NULL)
 902                         kmem_free(dr->dr_resp.buf, dr->dr_resp.maxlen);
 903                 dr->dr_resp.maxlen = (unsigned int)size;
 904                 dr->dr_resp.buf = kmem_alloc(size, KM_NOSLEEP);
 905                 if (dr->dr_resp.buf == NULL) {
 906                         dr->dr_resp.maxlen = 0;
 907                         dr->dr_status = DUP_DROP;
 908                         mutex_exit(&dupreq_lock);
 909                         return (DUP_ERROR);
 910                 }
 911         }
 912         dr->dr_status = DUP_INPROGRESS;
 913 
 914         drhash = (uint32_t)DRHASH(dr);
 915         dr->dr_chain = drhashtbl[drhash];
 916         drhashtbl[drhash] = dr;
 917         drhashstat[drhash]++;
 918         mutex_exit(&dupreq_lock);
 919         *drpp = dr;
 920         return (DUP_NEW);
 921 }
 922 
 923 /*
 924  * PSARC 2003/523 Contract Private Interface
 925  * svc_clts_kdupdone
 926  * Changes must be reviewed by Solaris File Sharing
 927  * Changes must be communicated to contract-2003-523@sun.com
 928  *
 929  * svc_clts_kdupdone marks the request done (DUP_DONE or DUP_DROP)
 930  * and stores the response.
 931  */
 932 static void
 933 svc_clts_kdupdone(struct dupreq *dr, caddr_t res, void (*dis_resfree)(),
 934     int size, int status)
 935 {
 936 
 937         ASSERT(dr->dr_resfree == NULL);
 938         if (status == DUP_DONE) {
 939                 bcopy(res, dr->dr_resp.buf, size);
 940                 dr->dr_resfree = dis_resfree;
 941         }
 942         dr->dr_status = status;
 943 }
 944 
 945 /*
 946  * This routine expects that the mutex, dupreq_lock, is already held.
 947  */
 948 static void
 949 unhash(struct dupreq *dr)
 950 {
 951         struct dupreq *drt;
 952         struct dupreq *drtprev = NULL;
 953         uint32_t drhash;
 954 
 955         ASSERT(MUTEX_HELD(&dupreq_lock));
 956 
 957         drhash = (uint32_t)DRHASH(dr);
 958         drt = drhashtbl[drhash];
 959         while (drt != NULL) {
 960                 if (drt == dr) {
 961                         drhashstat[drhash]--;
 962                         if (drtprev == NULL) {
 963                                 drhashtbl[drhash] = drt->dr_chain;
 964                         } else {
 965                                 drtprev->dr_chain = drt->dr_chain;
 966                         }
 967                         return;
 968                 }
 969                 drtprev = drt;
 970                 drt = drt->dr_chain;
 971         }
 972 }
 973 
 974 void
 975 svc_clts_stats_init(zoneid_t zoneid, struct rpc_clts_server **statsp)
 976 {
 977         kstat_t *ksp;
 978         kstat_named_t *knp;
 979 
 980         knp = rpcstat_zone_init_common(zoneid, "unix", "rpc_clts_server",
 981             (const kstat_named_t *)&clts_rsstat_tmpl,
 982             sizeof (clts_rsstat_tmpl));
 983         /*
 984          * Backwards compatibility for old kstat clients
 985          */
 986         ksp = kstat_create_zone("unix", 0, "rpc_server", "rpc",
 987             KSTAT_TYPE_NAMED, clts_rsstat_ndata,
 988             KSTAT_FLAG_VIRTUAL | KSTAT_FLAG_WRITABLE, zoneid);
 989         if (ksp) {
 990                 ksp->ks_data = knp;
 991                 kstat_install(ksp);
 992         }
 993         *statsp = (struct rpc_clts_server *)knp;
 994 }
 995 
 996 void
 997 svc_clts_stats_fini(zoneid_t zoneid, struct rpc_clts_server **statsp)
 998 {
 999         rpcstat_zone_fini_common(zoneid, "unix", "rpc_clts_server");
1000         kstat_delete_byname_zone("unix", 0, "rpc_server", zoneid);
1001         kmem_free(*statsp, sizeof (clts_rsstat_tmpl));
1002 }
1003 
1004 void
1005 svc_clts_init()
1006 {
1007         /*
1008          * Check to make sure that the clts private data will fit into
1009          * the stack buffer allocated by svc_run.  The compiler should
1010          * remove this check, but it's a safety net if the udp_data
1011          * structure ever changes.
1012          */
1013         /*CONSTANTCONDITION*/
1014         ASSERT(sizeof (struct udp_data) <= SVC_P2LEN);
1015 
1016         mutex_init(&dupreq_lock, NULL, MUTEX_DEFAULT, NULL);
1017 }