1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
24 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
25 * Copyright 2018, Joyent, Inc.
26 */
27 /* Copyright (c) 1990 Mentat Inc. */
28
29 #include <sys/sysmacros.h>
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/stropts.h>
33 #include <sys/strlog.h>
34 #include <sys/strsun.h>
35 #define _SUN_TPI_VERSION 2
36 #include <sys/tihdr.h>
37 #include <sys/timod.h>
38 #include <sys/ddi.h>
39 #include <sys/sunddi.h>
40 #include <sys/strsubr.h>
41 #include <sys/suntpi.h>
42 #include <sys/xti_inet.h>
43 #include <sys/kmem.h>
44 #include <sys/cred_impl.h>
45 #include <sys/policy.h>
46 #include <sys/priv.h>
47 #include <sys/ucred.h>
48 #include <sys/zone.h>
49
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sockio.h>
53 #include <sys/vtrace.h>
54 #include <sys/sdt.h>
55 #include <sys/debug.h>
56 #include <sys/isa_defs.h>
57 #include <sys/random.h>
58 #include <netinet/in.h>
59 #include <netinet/ip6.h>
60 #include <netinet/icmp6.h>
61 #include <netinet/udp.h>
62
63 #include <inet/common.h>
64 #include <inet/ip.h>
65 #include <inet/ip_impl.h>
66 #include <inet/ipsec_impl.h>
67 #include <inet/ip6.h>
68 #include <inet/ip_ire.h>
69 #include <inet/ip_if.h>
70 #include <inet/ip_multi.h>
71 #include <inet/ip_ndp.h>
72 #include <inet/proto_set.h>
73 #include <inet/mib2.h>
74 #include <inet/optcom.h>
75 #include <inet/snmpcom.h>
76 #include <inet/kstatcom.h>
77 #include <inet/ipclassifier.h>
78 #include <sys/squeue_impl.h>
79 #include <inet/ipnet.h>
80 #include <sys/vxlan.h>
81 #include <inet/inet_hash.h>
82
83 #include <sys/tsol/label.h>
84 #include <sys/tsol/tnet.h>
85 #include <rpc/pmap_prot.h>
86
87 #include <inet/udp_impl.h>
88
89 /*
90 * Synchronization notes:
91 *
92 * UDP is MT and uses the usual kernel synchronization primitives. There are 2
93 * locks, the fanout lock (uf_lock) and conn_lock. conn_lock
94 * protects the contents of the udp_t. uf_lock protects the address and the
95 * fanout information.
96 * The lock order is conn_lock -> uf_lock.
97 *
98 * The fanout lock uf_lock:
99 * When a UDP endpoint is bound to a local port, it is inserted into
100 * a bind hash list. The list consists of an array of udp_fanout_t buckets.
101 * The size of the array is controlled by the udp_bind_fanout_size variable.
102 * This variable can be changed in /etc/system if the default value is
103 * not large enough. Each bind hash bucket is protected by a per bucket
104 * lock. It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
105 * structure and a few other fields in the udp_t. A UDP endpoint is removed
106 * from the bind hash list only when it is being unbound or being closed.
107 * The per bucket lock also protects a UDP endpoint's state changes.
108 *
109 * Plumbing notes:
110 * UDP is always a device driver. For compatibility with mibopen() code
111 * it is possible to I_PUSH "udp", but that results in pushing a passthrough
112 * dummy module.
113 *
114 * The above implies that we don't support any intermediate module to
115 * reside in between /dev/ip and udp -- in fact, we never supported such
116 * scenario in the past as the inter-layer communication semantics have
117 * always been private.
118 */
119
120 /* For /etc/system control */
121 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
122
123 static void udp_addr_req(queue_t *q, mblk_t *mp);
124 static void udp_tpi_bind(queue_t *q, mblk_t *mp);
125 static void udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
126 static void udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
127 static int udp_build_hdr_template(conn_t *, const in6_addr_t *,
128 const in6_addr_t *, in_port_t, uint32_t);
129 static void udp_capability_req(queue_t *q, mblk_t *mp);
130 static int udp_tpi_close(queue_t *q, int flags);
131 static void udp_close_free(conn_t *);
132 static void udp_tpi_connect(queue_t *q, mblk_t *mp);
133 static void udp_tpi_disconnect(queue_t *q, mblk_t *mp);
134 static void udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
135 int sys_error);
136 static void udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
137 t_scalar_t tlierr, int sys_error);
138 static int udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
139 cred_t *cr);
140 static int udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
141 char *value, caddr_t cp, cred_t *cr);
142 static int udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
143 char *value, caddr_t cp, cred_t *cr);
144 static void udp_icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
145 static void udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
146 ip_recv_attr_t *ira);
147 static void udp_info_req(queue_t *q, mblk_t *mp);
148 static void udp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
149 static void udp_lrput(queue_t *, mblk_t *);
150 static void udp_lwput(queue_t *, mblk_t *);
151 static int udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
152 cred_t *credp, boolean_t isv6);
153 static int udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
154 cred_t *credp);
155 static int udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
156 cred_t *credp);
157 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
158 int udp_opt_set(conn_t *connp, uint_t optset_context,
159 int level, int name, uint_t inlen,
160 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
161 void *thisdg_attrs, cred_t *cr);
162 int udp_opt_get(conn_t *connp, int level, int name,
163 uchar_t *ptr);
164 static int udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr,
165 pid_t pid);
166 static int udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr,
167 pid_t pid, ip_xmit_attr_t *ixa);
168 static int udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
169 sin6_t *sin6, ushort_t ipversion, cred_t *cr, pid_t,
170 ip_xmit_attr_t *ixa);
171 static mblk_t *udp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
172 const in6_addr_t *, const in6_addr_t *, in_port_t, uint32_t, mblk_t *,
173 int *);
174 static mblk_t *udp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
175 mblk_t *, const in6_addr_t *, in_port_t, uint32_t, int *);
176 static void udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
177 static void udp_ud_err_connected(conn_t *, t_scalar_t);
178 static void udp_tpi_unbind(queue_t *q, mblk_t *mp);
179 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
180 boolean_t random);
181 static void udp_wput_other(queue_t *q, mblk_t *mp);
182 static void udp_wput_iocdata(queue_t *q, mblk_t *mp);
183 static void udp_wput_fallback(queue_t *q, mblk_t *mp);
184 static size_t udp_set_rcv_hiwat(udp_t *udp, size_t size);
185
186 static void *udp_stack_init(netstackid_t stackid, netstack_t *ns);
187 static void udp_stack_fini(netstackid_t stackid, void *arg);
188
189 /* Common routines for TPI and socket module */
190 static void udp_ulp_recv(conn_t *, mblk_t *, uint_t, ip_recv_attr_t *);
191
192 /* Common routine for TPI and socket module */
193 static conn_t *udp_do_open(cred_t *, boolean_t, int, int *);
194 static void udp_do_close(conn_t *);
195 static int udp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *,
196 boolean_t);
197 static int udp_do_unbind(conn_t *);
198
199 int udp_getsockname(sock_lower_handle_t,
200 struct sockaddr *, socklen_t *, cred_t *);
201 int udp_getpeername(sock_lower_handle_t,
202 struct sockaddr *, socklen_t *, cred_t *);
203 static int udp_do_connect(conn_t *, const struct sockaddr *, socklen_t,
204 cred_t *, pid_t);
205
206 #pragma inline(udp_output_connected, udp_output_newdst, udp_output_lastdst)
207
208 /*
209 * Checks if the given destination addr/port is allowed out.
210 * If allowed, registers the (dest_addr/port, node_ID) mapping at Cluster.
211 * Called for each connect() and for sendto()/sendmsg() to a different
212 * destination.
213 * For connect(), called in udp_connect().
214 * For sendto()/sendmsg(), called in udp_output_newdst().
215 *
216 * This macro assumes that the cl_inet_connect2 hook is not NULL.
217 * Please check this before calling this macro.
218 *
219 * void
220 * CL_INET_UDP_CONNECT(conn_t cp, udp_t *udp, boolean_t is_outgoing,
221 * in6_addr_t *faddrp, in_port_t (or uint16_t) fport, int err);
222 */
223 #define CL_INET_UDP_CONNECT(cp, is_outgoing, faddrp, fport, err) { \
224 (err) = 0; \
225 /* \
226 * Running in cluster mode - check and register active \
227 * "connection" information \
228 */ \
229 if ((cp)->conn_ipversion == IPV4_VERSION) \
230 (err) = (*cl_inet_connect2)( \
231 (cp)->conn_netstack->netstack_stackid, \
232 IPPROTO_UDP, is_outgoing, AF_INET, \
233 (uint8_t *)&((cp)->conn_laddr_v4), \
234 (cp)->conn_lport, \
235 (uint8_t *)&(V4_PART_OF_V6(*faddrp)), \
236 (in_port_t)(fport), NULL); \
237 else \
238 (err) = (*cl_inet_connect2)( \
239 (cp)->conn_netstack->netstack_stackid, \
240 IPPROTO_UDP, is_outgoing, AF_INET6, \
241 (uint8_t *)&((cp)->conn_laddr_v6), \
242 (cp)->conn_lport, \
243 (uint8_t *)(faddrp), (in_port_t)(fport), NULL); \
244 }
245
246 static struct module_info udp_mod_info = {
247 UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
248 };
249
250 /*
251 * Entry points for UDP as a device.
252 * We have separate open functions for the /dev/udp and /dev/udp6 devices.
253 */
254 static struct qinit udp_rinitv4 = {
255 NULL, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info, NULL
256 };
257
258 static struct qinit udp_rinitv6 = {
259 NULL, NULL, udp_openv6, udp_tpi_close, NULL, &udp_mod_info, NULL
260 };
261
262 static struct qinit udp_winit = {
263 (pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &udp_mod_info
264 };
265
266 /* UDP entry point during fallback */
267 struct qinit udp_fallback_sock_winit = {
268 (pfi_t)udp_wput_fallback, NULL, NULL, NULL, NULL, &udp_mod_info
269 };
270
271 /*
272 * UDP needs to handle I_LINK and I_PLINK since ifconfig
273 * likes to use it as a place to hang the various streams.
274 */
275 static struct qinit udp_lrinit = {
276 (pfi_t)udp_lrput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
277 };
278
279 static struct qinit udp_lwinit = {
280 (pfi_t)udp_lwput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
281 };
282
283 /* For AF_INET aka /dev/udp */
284 struct streamtab udpinfov4 = {
285 &udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
286 };
287
288 /* For AF_INET6 aka /dev/udp6 */
289 struct streamtab udpinfov6 = {
290 &udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
291 };
292
293 #define UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
294
295 /* Default structure copied into T_INFO_ACK messages */
296 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
297 T_INFO_ACK,
298 UDP_MAXPACKET_IPV4, /* TSDU_size. Excl. headers */
299 T_INVALID, /* ETSU_size. udp does not support expedited data. */
300 T_INVALID, /* CDATA_size. udp does not support connect data. */
301 T_INVALID, /* DDATA_size. udp does not support disconnect data. */
302 sizeof (sin_t), /* ADDR_size. */
303 0, /* OPT_size - not initialized here */
304 UDP_MAXPACKET_IPV4, /* TIDU_size. Excl. headers */
305 T_CLTS, /* SERV_type. udp supports connection-less. */
306 TS_UNBND, /* CURRENT_state. This is set from udp_state. */
307 (XPG4_1|SENDZERO) /* PROVIDER_flag */
308 };
309
310 #define UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
311
312 static struct T_info_ack udp_g_t_info_ack_ipv6 = {
313 T_INFO_ACK,
314 UDP_MAXPACKET_IPV6, /* TSDU_size. Excl. headers */
315 T_INVALID, /* ETSU_size. udp does not support expedited data. */
316 T_INVALID, /* CDATA_size. udp does not support connect data. */
317 T_INVALID, /* DDATA_size. udp does not support disconnect data. */
318 sizeof (sin6_t), /* ADDR_size. */
319 0, /* OPT_size - not initialized here */
320 UDP_MAXPACKET_IPV6, /* TIDU_size. Excl. headers */
321 T_CLTS, /* SERV_type. udp supports connection-less. */
322 TS_UNBND, /* CURRENT_state. This is set from udp_state. */
323 (XPG4_1|SENDZERO) /* PROVIDER_flag */
324 };
325
326 /*
327 * UDP tunables related declarations. Definitions are in udp_tunables.c
328 */
329 extern mod_prop_info_t udp_propinfo_tbl[];
330 extern int udp_propinfo_count;
331
332 /* Setable in /etc/system */
333 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
334 uint32_t udp_random_anon_port = 1;
335
336 /*
337 * Hook functions to enable cluster networking.
338 * On non-clustered systems these vectors must always be NULL
339 */
340
341 void (*cl_inet_bind)(netstackid_t stack_id, uchar_t protocol,
342 sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
343 void *args) = NULL;
344 void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
345 sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
346 void *args) = NULL;
347
348 typedef union T_primitives *t_primp_t;
349
350 /*
351 * Various protocols that encapsulate UDP have no real use for the source port.
352 * Instead, they want to vary the source port to provide better equal-cost
353 * multipathing and other systems that use fanout. Consider something like
354 * VXLAN. If you're actually sending multiple different streams to a single
355 * host, if you don't vary the source port, then the tuple of ( SRC IP, DST IP,
356 * SRC Port, DST Port) will always be the same.
357 *
358 * Here, we return a port to hash this to, if we know how to hash it. If for
359 * some reason we can't perform an L4 hash, then we just return the default
360 * value, usually the default port. After we determine the hash we transform it
361 * so that it's in the range of [ min, max ].
362 *
363 * We'd like to avoid a pull up for the sake of performing the hash. If the
364 * first mblk_t doesn't have the full protocol header, then we just send it to
365 * the default. If for some reason we have an encapsulated packet that has its
366 * protocol header in different parts of an mblk_t, then we'll go with the
367 * default port. This means that that if a driver isn't consistent about how it
368 * generates the frames for a given flow, it will not always be consistently
369 * hashed. That should be an uncommon event.
370 */
371 uint16_t
372 udp_srcport_hash(mblk_t *mp, int type, uint16_t min, uint16_t max,
373 uint16_t def)
374 {
375 size_t szused = 0;
376 ip6_t *ip6h;
377 ipha_t *ipha;
378 uint16_t sap;
379 uint64_t hash;
380 uint32_t mod;
381
382 ASSERT(min <= max);
383
384 if (type != UDP_HASH_VXLAN)
385 return (def);
386
387 if (!IS_P2ALIGNED(mp->b_rptr, sizeof (uint16_t)))
388 return (def);
389
390 /*
391 * The following logic is VXLAN specific to get at the header, if we
392 * have formats, eg. GENEVE, then we should ignore this.
393 *
394 * The kernel overlay device often puts a first mblk_t for the data
395 * which is just the encap. If so, then we're going to use that and try
396 * to avoid a pull up.
397 */
398 if (MBLKL(mp) == VXLAN_HDR_LEN) {
399 if (mp->b_cont == NULL)
400 return (def);
401 mp = mp->b_cont;
402 } else if (MBLKL(mp) < VXLAN_HDR_LEN) {
403 return (def);
404 } else {
405 szused = VXLAN_HDR_LEN;
406 }
407
408 /* Can we hold a MAC header? */
409 if (MBLKL(mp) + szused < sizeof (struct ether_header))
410 return (def);
411
412 /*
413 * We need to lie about the starting offset into the message block for
414 * convenience. Undo it at the end. We know that inet_pkt_hash() won't
415 * modify the mblk_t.
416 */
417 mp->b_rptr += szused;
418 hash = inet_pkt_hash(DL_ETHER, mp, INET_PKT_HASH_L2 |
419 INET_PKT_HASH_L3 | INET_PKT_HASH_L4);
420 mp->b_rptr -= szused;
421
422 if (hash == 0)
423 return (def);
424
425 mod = max - min + 1;
426 return ((hash % mod) + min);
427 }
428
429 /*
430 * Return the next anonymous port in the privileged port range for
431 * bind checking.
432 *
433 * Trusted Extension (TX) notes: TX allows administrator to mark or
434 * reserve ports as Multilevel ports (MLP). MLP has special function
435 * on TX systems. Once a port is made MLP, it's not available as
436 * ordinary port. This creates "holes" in the port name space. It
437 * may be necessary to skip the "holes" find a suitable anon port.
438 */
439 static in_port_t
440 udp_get_next_priv_port(udp_t *udp)
441 {
442 static in_port_t next_priv_port = IPPORT_RESERVED - 1;
443 in_port_t nextport;
444 boolean_t restart = B_FALSE;
445 udp_stack_t *us = udp->udp_us;
446
447 retry:
448 if (next_priv_port < us->us_min_anonpriv_port ||
449 next_priv_port >= IPPORT_RESERVED) {
450 next_priv_port = IPPORT_RESERVED - 1;
451 if (restart)
452 return (0);
453 restart = B_TRUE;
454 }
455
456 if (is_system_labeled() &&
457 (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
458 next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
459 next_priv_port = nextport;
460 goto retry;
461 }
462
463 return (next_priv_port--);
464 }
465
466 /*
467 * Hash list removal routine for udp_t structures.
468 */
469 static void
470 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
471 {
472 udp_t *udpnext;
473 kmutex_t *lockp;
474 udp_stack_t *us = udp->udp_us;
475 conn_t *connp = udp->udp_connp;
476
477 if (udp->udp_ptpbhn == NULL)
478 return;
479
480 /*
481 * Extract the lock pointer in case there are concurrent
482 * hash_remove's for this instance.
483 */
484 ASSERT(connp->conn_lport != 0);
485 if (!caller_holds_lock) {
486 lockp = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
487 us->us_bind_fanout_size)].uf_lock;
488 ASSERT(lockp != NULL);
489 mutex_enter(lockp);
490 }
491 if (udp->udp_ptpbhn != NULL) {
492 udpnext = udp->udp_bind_hash;
493 if (udpnext != NULL) {
494 udpnext->udp_ptpbhn = udp->udp_ptpbhn;
495 udp->udp_bind_hash = NULL;
496 }
497 *udp->udp_ptpbhn = udpnext;
498 udp->udp_ptpbhn = NULL;
499 }
500 if (!caller_holds_lock) {
501 mutex_exit(lockp);
502 }
503 }
504
505 static void
506 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
507 {
508 conn_t *connp = udp->udp_connp;
509 udp_t **udpp;
510 udp_t *udpnext;
511 conn_t *connext;
512
513 ASSERT(MUTEX_HELD(&uf->uf_lock));
514 ASSERT(udp->udp_ptpbhn == NULL);
515 udpp = &uf->uf_udp;
516 udpnext = udpp[0];
517 if (udpnext != NULL) {
518 /*
519 * If the new udp bound to the INADDR_ANY address
520 * and the first one in the list is not bound to
521 * INADDR_ANY we skip all entries until we find the
522 * first one bound to INADDR_ANY.
523 * This makes sure that applications binding to a
524 * specific address get preference over those binding to
525 * INADDR_ANY.
526 */
527 connext = udpnext->udp_connp;
528 if (V6_OR_V4_INADDR_ANY(connp->conn_bound_addr_v6) &&
529 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
530 while ((udpnext = udpp[0]) != NULL &&
531 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
532 udpp = &(udpnext->udp_bind_hash);
533 }
534 if (udpnext != NULL)
535 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
536 } else {
537 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
538 }
539 }
540 udp->udp_bind_hash = udpnext;
541 udp->udp_ptpbhn = udpp;
542 udpp[0] = udp;
543 }
544
545 /*
546 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
547 * passed to udp_wput.
548 * It associates a port number and local address with the stream.
549 * It calls IP to verify the local IP address, and calls IP to insert
550 * the conn_t in the fanout table.
551 * If everything is ok it then sends the T_BIND_ACK back up.
552 *
553 * Note that UDP over IPv4 and IPv6 sockets can use the same port number
554 * without setting SO_REUSEADDR. This is needed so that they
555 * can be viewed as two independent transport protocols.
556 * However, anonymouns ports are allocated from the same range to avoid
557 * duplicating the us->us_next_port_to_try.
558 */
559 static void
560 udp_tpi_bind(queue_t *q, mblk_t *mp)
561 {
562 sin_t *sin;
563 sin6_t *sin6;
564 mblk_t *mp1;
565 struct T_bind_req *tbr;
566 conn_t *connp;
567 udp_t *udp;
568 int error;
569 struct sockaddr *sa;
570 cred_t *cr;
571
572 /*
573 * All Solaris components should pass a db_credp
574 * for this TPI message, hence we ASSERT.
575 * But in case there is some other M_PROTO that looks
576 * like a TPI message sent by some other kernel
577 * component, we check and return an error.
578 */
579 cr = msg_getcred(mp, NULL);
580 ASSERT(cr != NULL);
581 if (cr == NULL) {
582 udp_err_ack(q, mp, TSYSERR, EINVAL);
583 return;
584 }
585
586 connp = Q_TO_CONN(q);
587 udp = connp->conn_udp;
588 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
589 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
590 "udp_bind: bad req, len %u",
591 (uint_t)(mp->b_wptr - mp->b_rptr));
592 udp_err_ack(q, mp, TPROTO, 0);
593 return;
594 }
595 if (udp->udp_state != TS_UNBND) {
596 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
597 "udp_bind: bad state, %u", udp->udp_state);
598 udp_err_ack(q, mp, TOUTSTATE, 0);
599 return;
600 }
601 /*
602 * Reallocate the message to make sure we have enough room for an
603 * address.
604 */
605 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
606 if (mp1 == NULL) {
607 udp_err_ack(q, mp, TSYSERR, ENOMEM);
608 return;
609 }
610
611 mp = mp1;
612
613 /* Reset the message type in preparation for shipping it back. */
614 DB_TYPE(mp) = M_PCPROTO;
615
616 tbr = (struct T_bind_req *)mp->b_rptr;
617 switch (tbr->ADDR_length) {
618 case 0: /* Request for a generic port */
619 tbr->ADDR_offset = sizeof (struct T_bind_req);
620 if (connp->conn_family == AF_INET) {
621 tbr->ADDR_length = sizeof (sin_t);
622 sin = (sin_t *)&tbr[1];
623 *sin = sin_null;
624 sin->sin_family = AF_INET;
625 mp->b_wptr = (uchar_t *)&sin[1];
626 sa = (struct sockaddr *)sin;
627 } else {
628 ASSERT(connp->conn_family == AF_INET6);
629 tbr->ADDR_length = sizeof (sin6_t);
630 sin6 = (sin6_t *)&tbr[1];
631 *sin6 = sin6_null;
632 sin6->sin6_family = AF_INET6;
633 mp->b_wptr = (uchar_t *)&sin6[1];
634 sa = (struct sockaddr *)sin6;
635 }
636 break;
637
638 case sizeof (sin_t): /* Complete IPv4 address */
639 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
640 sizeof (sin_t));
641 if (sa == NULL || !OK_32PTR((char *)sa)) {
642 udp_err_ack(q, mp, TSYSERR, EINVAL);
643 return;
644 }
645 if (connp->conn_family != AF_INET ||
646 sa->sa_family != AF_INET) {
647 udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
648 return;
649 }
650 break;
651
652 case sizeof (sin6_t): /* complete IPv6 address */
653 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
654 sizeof (sin6_t));
655 if (sa == NULL || !OK_32PTR((char *)sa)) {
656 udp_err_ack(q, mp, TSYSERR, EINVAL);
657 return;
658 }
659 if (connp->conn_family != AF_INET6 ||
660 sa->sa_family != AF_INET6) {
661 udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
662 return;
663 }
664 break;
665
666 default: /* Invalid request */
667 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
668 "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
669 udp_err_ack(q, mp, TBADADDR, 0);
670 return;
671 }
672
673 error = udp_do_bind(connp, sa, tbr->ADDR_length, cr,
674 tbr->PRIM_type != O_T_BIND_REQ);
675
676 if (error != 0) {
677 if (error > 0) {
678 udp_err_ack(q, mp, TSYSERR, error);
679 } else {
680 udp_err_ack(q, mp, -error, 0);
681 }
682 } else {
683 tbr->PRIM_type = T_BIND_ACK;
684 qreply(q, mp);
685 }
686 }
687
688 /*
689 * This routine handles each T_CONN_REQ message passed to udp. It
690 * associates a default destination address with the stream.
691 *
692 * After various error checks are completed, udp_connect() lays
693 * the target address and port into the composite header template.
694 * Then we ask IP for information, including a source address if we didn't
695 * already have one. Finally we send up the T_OK_ACK reply message.
696 */
697 static void
698 udp_tpi_connect(queue_t *q, mblk_t *mp)
699 {
700 conn_t *connp = Q_TO_CONN(q);
701 int error;
702 socklen_t len;
703 struct sockaddr *sa;
704 struct T_conn_req *tcr;
705 cred_t *cr;
706 pid_t pid;
707 /*
708 * All Solaris components should pass a db_credp
709 * for this TPI message, hence we ASSERT.
710 * But in case there is some other M_PROTO that looks
711 * like a TPI message sent by some other kernel
712 * component, we check and return an error.
713 */
714 cr = msg_getcred(mp, &pid);
715 ASSERT(cr != NULL);
716 if (cr == NULL) {
717 udp_err_ack(q, mp, TSYSERR, EINVAL);
718 return;
719 }
720
721 tcr = (struct T_conn_req *)mp->b_rptr;
722
723 /* A bit of sanity checking */
724 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
725 udp_err_ack(q, mp, TPROTO, 0);
726 return;
727 }
728
729 if (tcr->OPT_length != 0) {
730 udp_err_ack(q, mp, TBADOPT, 0);
731 return;
732 }
733
734 /*
735 * Determine packet type based on type of address passed in
736 * the request should contain an IPv4 or IPv6 address.
737 * Make sure that address family matches the type of
738 * family of the address passed down.
739 */
740 len = tcr->DEST_length;
741 switch (tcr->DEST_length) {
742 default:
743 udp_err_ack(q, mp, TBADADDR, 0);
744 return;
745
746 case sizeof (sin_t):
747 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
748 sizeof (sin_t));
749 break;
750
751 case sizeof (sin6_t):
752 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
753 sizeof (sin6_t));
754 break;
755 }
756
757 error = proto_verify_ip_addr(connp->conn_family, sa, len);
758 if (error != 0) {
759 udp_err_ack(q, mp, TSYSERR, error);
760 return;
761 }
762
763 error = udp_do_connect(connp, sa, len, cr, pid);
764 if (error != 0) {
765 if (error < 0)
766 udp_err_ack(q, mp, -error, 0);
767 else
768 udp_err_ack(q, mp, TSYSERR, error);
769 } else {
770 mblk_t *mp1;
771 /*
772 * We have to send a connection confirmation to
773 * keep TLI happy.
774 */
775 if (connp->conn_family == AF_INET) {
776 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
777 sizeof (sin_t), NULL, 0);
778 } else {
779 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
780 sizeof (sin6_t), NULL, 0);
781 }
782 if (mp1 == NULL) {
783 udp_err_ack(q, mp, TSYSERR, ENOMEM);
784 return;
785 }
786
787 /*
788 * Send ok_ack for T_CONN_REQ
789 */
790 mp = mi_tpi_ok_ack_alloc(mp);
791 if (mp == NULL) {
792 /* Unable to reuse the T_CONN_REQ for the ack. */
793 udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
794 return;
795 }
796
797 putnext(connp->conn_rq, mp);
798 putnext(connp->conn_rq, mp1);
799 }
800 }
801
802 static int
803 udp_tpi_close(queue_t *q, int flags)
804 {
805 conn_t *connp;
806
807 if (flags & SO_FALLBACK) {
808 /*
809 * stream is being closed while in fallback
810 * simply free the resources that were allocated
811 */
812 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
813 qprocsoff(q);
814 goto done;
815 }
816
817 connp = Q_TO_CONN(q);
818 udp_do_close(connp);
819 done:
820 q->q_ptr = WR(q)->q_ptr = NULL;
821 return (0);
822 }
823
824 static void
825 udp_close_free(conn_t *connp)
826 {
827 udp_t *udp = connp->conn_udp;
828
829 /* If there are any options associated with the stream, free them. */
830 if (udp->udp_recv_ipp.ipp_fields != 0)
831 ip_pkt_free(&udp->udp_recv_ipp);
832
833 /*
834 * Clear any fields which the kmem_cache constructor clears.
835 * Only udp_connp needs to be preserved.
836 * TBD: We should make this more efficient to avoid clearing
837 * everything.
838 */
839 ASSERT(udp->udp_connp == connp);
840 bzero(udp, sizeof (udp_t));
841 udp->udp_connp = connp;
842 }
843
844 static int
845 udp_do_disconnect(conn_t *connp)
846 {
847 udp_t *udp;
848 udp_fanout_t *udpf;
849 udp_stack_t *us;
850 int error;
851
852 udp = connp->conn_udp;
853 us = udp->udp_us;
854 mutex_enter(&connp->conn_lock);
855 if (udp->udp_state != TS_DATA_XFER) {
856 mutex_exit(&connp->conn_lock);
857 return (-TOUTSTATE);
858 }
859 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
860 us->us_bind_fanout_size)];
861 mutex_enter(&udpf->uf_lock);
862 if (connp->conn_mcbc_bind)
863 connp->conn_saddr_v6 = ipv6_all_zeros;
864 else
865 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
866 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
867 connp->conn_faddr_v6 = ipv6_all_zeros;
868 connp->conn_fport = 0;
869 udp->udp_state = TS_IDLE;
870 mutex_exit(&udpf->uf_lock);
871
872 /* Remove any remnants of mapped address binding */
873 if (connp->conn_family == AF_INET6)
874 connp->conn_ipversion = IPV6_VERSION;
875
876 connp->conn_v6lastdst = ipv6_all_zeros;
877 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
878 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
879 mutex_exit(&connp->conn_lock);
880 if (error != 0)
881 return (error);
882
883 /*
884 * Tell IP to remove the full binding and revert
885 * to the local address binding.
886 */
887 return (ip_laddr_fanout_insert(connp));
888 }
889
890 static void
891 udp_tpi_disconnect(queue_t *q, mblk_t *mp)
892 {
893 conn_t *connp = Q_TO_CONN(q);
894 int error;
895
896 /*
897 * Allocate the largest primitive we need to send back
898 * T_error_ack is > than T_ok_ack
899 */
900 mp = reallocb(mp, sizeof (struct T_error_ack), 1);
901 if (mp == NULL) {
902 /* Unable to reuse the T_DISCON_REQ for the ack. */
903 udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
904 return;
905 }
906
907 error = udp_do_disconnect(connp);
908
909 if (error != 0) {
910 if (error < 0) {
911 udp_err_ack(q, mp, -error, 0);
912 } else {
913 udp_err_ack(q, mp, TSYSERR, error);
914 }
915 } else {
916 mp = mi_tpi_ok_ack_alloc(mp);
917 ASSERT(mp != NULL);
918 qreply(q, mp);
919 }
920 }
921
922 int
923 udp_disconnect(conn_t *connp)
924 {
925 int error;
926
927 connp->conn_dgram_errind = B_FALSE;
928 error = udp_do_disconnect(connp);
929 if (error < 0)
930 error = proto_tlitosyserr(-error);
931
932 return (error);
933 }
934
935 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
936 static void
937 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
938 {
939 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
940 qreply(q, mp);
941 }
942
943 /* Shorthand to generate and send TPI error acks to our client */
944 static void
945 udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
946 t_scalar_t t_error, int sys_error)
947 {
948 struct T_error_ack *teackp;
949
950 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
951 M_PCPROTO, T_ERROR_ACK)) != NULL) {
952 teackp = (struct T_error_ack *)mp->b_rptr;
953 teackp->ERROR_prim = primitive;
954 teackp->TLI_error = t_error;
955 teackp->UNIX_error = sys_error;
956 qreply(q, mp);
957 }
958 }
959
960 /* At minimum we need 4 bytes of UDP header */
961 #define ICMP_MIN_UDP_HDR 4
962
963 /*
964 * udp_icmp_input is called as conn_recvicmp to process ICMP messages.
965 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
966 * Assumes that IP has pulled up everything up to and including the ICMP header.
967 */
968 /* ARGSUSED2 */
969 static void
970 udp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
971 {
972 conn_t *connp = (conn_t *)arg1;
973 icmph_t *icmph;
974 ipha_t *ipha;
975 int iph_hdr_length;
976 udpha_t *udpha;
977 sin_t sin;
978 sin6_t sin6;
979 mblk_t *mp1;
980 int error = 0;
981 udp_t *udp = connp->conn_udp;
982
983 ipha = (ipha_t *)mp->b_rptr;
984
985 ASSERT(OK_32PTR(mp->b_rptr));
986
987 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
988 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
989 udp_icmp_error_ipv6(connp, mp, ira);
990 return;
991 }
992 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
993
994 /* Skip past the outer IP and ICMP headers */
995 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
996 iph_hdr_length = ira->ira_ip_hdr_length;
997 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
998 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
999
1000 /* Skip past the inner IP and find the ULP header */
1001 iph_hdr_length = IPH_HDR_LENGTH(ipha);
1002 udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
1003
1004 switch (icmph->icmph_type) {
1005 case ICMP_DEST_UNREACHABLE:
1006 switch (icmph->icmph_code) {
1007 case ICMP_FRAGMENTATION_NEEDED: {
1008 ipha_t *ipha;
1009 ip_xmit_attr_t *ixa;
1010 /*
1011 * IP has already adjusted the path MTU.
1012 * But we need to adjust DF for IPv4.
1013 */
1014 if (connp->conn_ipversion != IPV4_VERSION)
1015 break;
1016
1017 ixa = conn_get_ixa(connp, B_FALSE);
1018 if (ixa == NULL || ixa->ixa_ire == NULL) {
1019 /*
1020 * Some other thread holds conn_ixa. We will
1021 * redo this on the next ICMP too big.
1022 */
1023 if (ixa != NULL)
1024 ixa_refrele(ixa);
1025 break;
1026 }
1027 (void) ip_get_pmtu(ixa);
1028
1029 mutex_enter(&connp->conn_lock);
1030 ipha = (ipha_t *)connp->conn_ht_iphc;
1031 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
1032 ipha->ipha_fragment_offset_and_flags |=
1033 IPH_DF_HTONS;
1034 } else {
1035 ipha->ipha_fragment_offset_and_flags &=
1036 ~IPH_DF_HTONS;
1037 }
1038 mutex_exit(&connp->conn_lock);
1039 ixa_refrele(ixa);
1040 break;
1041 }
1042 case ICMP_PORT_UNREACHABLE:
1043 case ICMP_PROTOCOL_UNREACHABLE:
1044 error = ECONNREFUSED;
1045 break;
1046 default:
1047 /* Transient errors */
1048 break;
1049 }
1050 break;
1051 default:
1052 /* Transient errors */
1053 break;
1054 }
1055 if (error == 0) {
1056 freemsg(mp);
1057 return;
1058 }
1059
1060 /*
1061 * Deliver T_UDERROR_IND when the application has asked for it.
1062 * The socket layer enables this automatically when connected.
1063 */
1064 if (!connp->conn_dgram_errind) {
1065 freemsg(mp);
1066 return;
1067 }
1068
1069 switch (connp->conn_family) {
1070 case AF_INET:
1071 sin = sin_null;
1072 sin.sin_family = AF_INET;
1073 sin.sin_addr.s_addr = ipha->ipha_dst;
1074 sin.sin_port = udpha->uha_dst_port;
1075 if (IPCL_IS_NONSTR(connp)) {
1076 mutex_enter(&connp->conn_lock);
1077 if (udp->udp_state == TS_DATA_XFER) {
1078 if (sin.sin_port == connp->conn_fport &&
1079 sin.sin_addr.s_addr ==
1080 connp->conn_faddr_v4) {
1081 mutex_exit(&connp->conn_lock);
1082 (*connp->conn_upcalls->su_set_error)
1083 (connp->conn_upper_handle, error);
1084 goto done;
1085 }
1086 } else {
1087 udp->udp_delayed_error = error;
1088 *((sin_t *)&udp->udp_delayed_addr) = sin;
1089 }
1090 mutex_exit(&connp->conn_lock);
1091 } else {
1092 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t),
1093 NULL, 0, error);
1094 if (mp1 != NULL)
1095 putnext(connp->conn_rq, mp1);
1096 }
1097 break;
1098 case AF_INET6:
1099 sin6 = sin6_null;
1100 sin6.sin6_family = AF_INET6;
1101 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1102 sin6.sin6_port = udpha->uha_dst_port;
1103 if (IPCL_IS_NONSTR(connp)) {
1104 mutex_enter(&connp->conn_lock);
1105 if (udp->udp_state == TS_DATA_XFER) {
1106 if (sin6.sin6_port == connp->conn_fport &&
1107 IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1108 &connp->conn_faddr_v6)) {
1109 mutex_exit(&connp->conn_lock);
1110 (*connp->conn_upcalls->su_set_error)
1111 (connp->conn_upper_handle, error);
1112 goto done;
1113 }
1114 } else {
1115 udp->udp_delayed_error = error;
1116 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1117 }
1118 mutex_exit(&connp->conn_lock);
1119 } else {
1120 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1121 NULL, 0, error);
1122 if (mp1 != NULL)
1123 putnext(connp->conn_rq, mp1);
1124 }
1125 break;
1126 }
1127 done:
1128 freemsg(mp);
1129 }
1130
1131 /*
1132 * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1133 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1134 * Assumes that IP has pulled up all the extension headers as well as the
1135 * ICMPv6 header.
1136 */
1137 static void
1138 udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1139 {
1140 icmp6_t *icmp6;
1141 ip6_t *ip6h, *outer_ip6h;
1142 uint16_t iph_hdr_length;
1143 uint8_t *nexthdrp;
1144 udpha_t *udpha;
1145 sin6_t sin6;
1146 mblk_t *mp1;
1147 int error = 0;
1148 udp_t *udp = connp->conn_udp;
1149 udp_stack_t *us = udp->udp_us;
1150
1151 outer_ip6h = (ip6_t *)mp->b_rptr;
1152 #ifdef DEBUG
1153 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1154 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1155 else
1156 iph_hdr_length = IPV6_HDR_LEN;
1157 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1158 #endif
1159 /* Skip past the outer IP and ICMP headers */
1160 iph_hdr_length = ira->ira_ip_hdr_length;
1161 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1162
1163 /* Skip past the inner IP and find the ULP header */
1164 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */
1165 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1166 freemsg(mp);
1167 return;
1168 }
1169 udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1170
1171 switch (icmp6->icmp6_type) {
1172 case ICMP6_DST_UNREACH:
1173 switch (icmp6->icmp6_code) {
1174 case ICMP6_DST_UNREACH_NOPORT:
1175 error = ECONNREFUSED;
1176 break;
1177 case ICMP6_DST_UNREACH_ADMIN:
1178 case ICMP6_DST_UNREACH_NOROUTE:
1179 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1180 case ICMP6_DST_UNREACH_ADDR:
1181 /* Transient errors */
1182 break;
1183 default:
1184 break;
1185 }
1186 break;
1187 case ICMP6_PACKET_TOO_BIG: {
1188 struct T_unitdata_ind *tudi;
1189 struct T_opthdr *toh;
1190 size_t udi_size;
1191 mblk_t *newmp;
1192 t_scalar_t opt_length = sizeof (struct T_opthdr) +
1193 sizeof (struct ip6_mtuinfo);
1194 sin6_t *sin6;
1195 struct ip6_mtuinfo *mtuinfo;
1196
1197 /*
1198 * If the application has requested to receive path mtu
1199 * information, send up an empty message containing an
1200 * IPV6_PATHMTU ancillary data item.
1201 */
1202 if (!connp->conn_ipv6_recvpathmtu)
1203 break;
1204
1205 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1206 opt_length;
1207 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1208 UDPS_BUMP_MIB(us, udpInErrors);
1209 break;
1210 }
1211
1212 /*
1213 * newmp->b_cont is left to NULL on purpose. This is an
1214 * empty message containing only ancillary data.
1215 */
1216 newmp->b_datap->db_type = M_PROTO;
1217 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1218 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1219 tudi->PRIM_type = T_UNITDATA_IND;
1220 tudi->SRC_length = sizeof (sin6_t);
1221 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1222 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1223 tudi->OPT_length = opt_length;
1224
1225 sin6 = (sin6_t *)&tudi[1];
1226 bzero(sin6, sizeof (sin6_t));
1227 sin6->sin6_family = AF_INET6;
1228 sin6->sin6_addr = connp->conn_faddr_v6;
1229
1230 toh = (struct T_opthdr *)&sin6[1];
1231 toh->level = IPPROTO_IPV6;
1232 toh->name = IPV6_PATHMTU;
1233 toh->len = opt_length;
1234 toh->status = 0;
1235
1236 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1237 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1238 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1239 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1240 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1241 /*
1242 * We've consumed everything we need from the original
1243 * message. Free it, then send our empty message.
1244 */
1245 freemsg(mp);
1246 udp_ulp_recv(connp, newmp, msgdsize(newmp), ira);
1247 return;
1248 }
1249 case ICMP6_TIME_EXCEEDED:
1250 /* Transient errors */
1251 break;
1252 case ICMP6_PARAM_PROB:
1253 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1254 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1255 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1256 (uchar_t *)nexthdrp) {
1257 error = ECONNREFUSED;
1258 break;
1259 }
1260 break;
1261 }
1262 if (error == 0) {
1263 freemsg(mp);
1264 return;
1265 }
1266
1267 /*
1268 * Deliver T_UDERROR_IND when the application has asked for it.
1269 * The socket layer enables this automatically when connected.
1270 */
1271 if (!connp->conn_dgram_errind) {
1272 freemsg(mp);
1273 return;
1274 }
1275
1276 sin6 = sin6_null;
1277 sin6.sin6_family = AF_INET6;
1278 sin6.sin6_addr = ip6h->ip6_dst;
1279 sin6.sin6_port = udpha->uha_dst_port;
1280 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1281
1282 if (IPCL_IS_NONSTR(connp)) {
1283 mutex_enter(&connp->conn_lock);
1284 if (udp->udp_state == TS_DATA_XFER) {
1285 if (sin6.sin6_port == connp->conn_fport &&
1286 IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1287 &connp->conn_faddr_v6)) {
1288 mutex_exit(&connp->conn_lock);
1289 (*connp->conn_upcalls->su_set_error)
1290 (connp->conn_upper_handle, error);
1291 goto done;
1292 }
1293 } else {
1294 udp->udp_delayed_error = error;
1295 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1296 }
1297 mutex_exit(&connp->conn_lock);
1298 } else {
1299 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1300 NULL, 0, error);
1301 if (mp1 != NULL)
1302 putnext(connp->conn_rq, mp1);
1303 }
1304 done:
1305 freemsg(mp);
1306 }
1307
1308 /*
1309 * This routine responds to T_ADDR_REQ messages. It is called by udp_wput.
1310 * The local address is filled in if endpoint is bound. The remote address
1311 * is filled in if remote address has been precified ("connected endpoint")
1312 * (The concept of connected CLTS sockets is alien to published TPI
1313 * but we support it anyway).
1314 */
1315 static void
1316 udp_addr_req(queue_t *q, mblk_t *mp)
1317 {
1318 struct sockaddr *sa;
1319 mblk_t *ackmp;
1320 struct T_addr_ack *taa;
1321 udp_t *udp = Q_TO_UDP(q);
1322 conn_t *connp = udp->udp_connp;
1323 uint_t addrlen;
1324
1325 /* Make it large enough for worst case */
1326 ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1327 2 * sizeof (sin6_t), 1);
1328 if (ackmp == NULL) {
1329 udp_err_ack(q, mp, TSYSERR, ENOMEM);
1330 return;
1331 }
1332 taa = (struct T_addr_ack *)ackmp->b_rptr;
1333
1334 bzero(taa, sizeof (struct T_addr_ack));
1335 ackmp->b_wptr = (uchar_t *)&taa[1];
1336
1337 taa->PRIM_type = T_ADDR_ACK;
1338 ackmp->b_datap->db_type = M_PCPROTO;
1339
1340 if (connp->conn_family == AF_INET)
1341 addrlen = sizeof (sin_t);
1342 else
1343 addrlen = sizeof (sin6_t);
1344
1345 mutex_enter(&connp->conn_lock);
1346 /*
1347 * Note: Following code assumes 32 bit alignment of basic
1348 * data structures like sin_t and struct T_addr_ack.
1349 */
1350 if (udp->udp_state != TS_UNBND) {
1351 /*
1352 * Fill in local address first
1353 */
1354 taa->LOCADDR_offset = sizeof (*taa);
1355 taa->LOCADDR_length = addrlen;
1356 sa = (struct sockaddr *)&taa[1];
1357 (void) conn_getsockname(connp, sa, &addrlen);
1358 ackmp->b_wptr += addrlen;
1359 }
1360 if (udp->udp_state == TS_DATA_XFER) {
1361 /*
1362 * connected, fill remote address too
1363 */
1364 taa->REMADDR_length = addrlen;
1365 /* assumed 32-bit alignment */
1366 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1367 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1368 (void) conn_getpeername(connp, sa, &addrlen);
1369 ackmp->b_wptr += addrlen;
1370 }
1371 mutex_exit(&connp->conn_lock);
1372 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1373 qreply(q, ackmp);
1374 }
1375
1376 static void
1377 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
1378 {
1379 conn_t *connp = udp->udp_connp;
1380
1381 if (connp->conn_family == AF_INET) {
1382 *tap = udp_g_t_info_ack_ipv4;
1383 } else {
1384 *tap = udp_g_t_info_ack_ipv6;
1385 }
1386 tap->CURRENT_state = udp->udp_state;
1387 tap->OPT_size = udp_max_optsize;
1388 }
1389
1390 static void
1391 udp_do_capability_ack(udp_t *udp, struct T_capability_ack *tcap,
1392 t_uscalar_t cap_bits1)
1393 {
1394 tcap->CAP_bits1 = 0;
1395
1396 if (cap_bits1 & TC1_INFO) {
1397 udp_copy_info(&tcap->INFO_ack, udp);
1398 tcap->CAP_bits1 |= TC1_INFO;
1399 }
1400 }
1401
1402 /*
1403 * This routine responds to T_CAPABILITY_REQ messages. It is called by
1404 * udp_wput. Much of the T_CAPABILITY_ACK information is copied from
1405 * udp_g_t_info_ack. The current state of the stream is copied from
1406 * udp_state.
1407 */
1408 static void
1409 udp_capability_req(queue_t *q, mblk_t *mp)
1410 {
1411 t_uscalar_t cap_bits1;
1412 struct T_capability_ack *tcap;
1413 udp_t *udp = Q_TO_UDP(q);
1414
1415 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1416
1417 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1418 mp->b_datap->db_type, T_CAPABILITY_ACK);
1419 if (!mp)
1420 return;
1421
1422 tcap = (struct T_capability_ack *)mp->b_rptr;
1423 udp_do_capability_ack(udp, tcap, cap_bits1);
1424
1425 qreply(q, mp);
1426 }
1427
1428 /*
1429 * This routine responds to T_INFO_REQ messages. It is called by udp_wput.
1430 * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
1431 * The current state of the stream is copied from udp_state.
1432 */
1433 static void
1434 udp_info_req(queue_t *q, mblk_t *mp)
1435 {
1436 udp_t *udp = Q_TO_UDP(q);
1437
1438 /* Create a T_INFO_ACK message. */
1439 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1440 T_INFO_ACK);
1441 if (!mp)
1442 return;
1443 udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
1444 qreply(q, mp);
1445 }
1446
1447 /* For /dev/udp aka AF_INET open */
1448 static int
1449 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1450 {
1451 return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
1452 }
1453
1454 /* For /dev/udp6 aka AF_INET6 open */
1455 static int
1456 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1457 {
1458 return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
1459 }
1460
1461 /*
1462 * This is the open routine for udp. It allocates a udp_t structure for
1463 * the stream and, on the first open of the module, creates an ND table.
1464 */
1465 static int
1466 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1467 boolean_t isv6)
1468 {
1469 udp_t *udp;
1470 conn_t *connp;
1471 dev_t conn_dev;
1472 vmem_t *minor_arena;
1473 int err;
1474
1475 /* If the stream is already open, return immediately. */
1476 if (q->q_ptr != NULL)
1477 return (0);
1478
1479 if (sflag == MODOPEN)
1480 return (EINVAL);
1481
1482 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
1483 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
1484 minor_arena = ip_minor_arena_la;
1485 } else {
1486 /*
1487 * Either minor numbers in the large arena were exhausted
1488 * or a non socket application is doing the open.
1489 * Try to allocate from the small arena.
1490 */
1491 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0)
1492 return (EBUSY);
1493
1494 minor_arena = ip_minor_arena_sa;
1495 }
1496
1497 if (flag & SO_FALLBACK) {
1498 /*
1499 * Non streams socket needs a stream to fallback to
1500 */
1501 RD(q)->q_ptr = (void *)conn_dev;
1502 WR(q)->q_qinfo = &udp_fallback_sock_winit;
1503 WR(q)->q_ptr = (void *)minor_arena;
1504 qprocson(q);
1505 return (0);
1506 }
1507
1508 connp = udp_do_open(credp, isv6, KM_SLEEP, &err);
1509 if (connp == NULL) {
1510 inet_minor_free(minor_arena, conn_dev);
1511 return (err);
1512 }
1513 udp = connp->conn_udp;
1514
1515 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1516 connp->conn_dev = conn_dev;
1517 connp->conn_minor_arena = minor_arena;
1518
1519 /*
1520 * Initialize the udp_t structure for this stream.
1521 */
1522 q->q_ptr = connp;
1523 WR(q)->q_ptr = connp;
1524 connp->conn_rq = q;
1525 connp->conn_wq = WR(q);
1526
1527 /*
1528 * Since this conn_t/udp_t is not yet visible to anybody else we don't
1529 * need to lock anything.
1530 */
1531 ASSERT(connp->conn_proto == IPPROTO_UDP);
1532 ASSERT(connp->conn_udp == udp);
1533 ASSERT(udp->udp_connp == connp);
1534
1535 if (flag & SO_SOCKSTR) {
1536 udp->udp_issocket = B_TRUE;
1537 }
1538
1539 WR(q)->q_hiwat = connp->conn_sndbuf;
1540 WR(q)->q_lowat = connp->conn_sndlowat;
1541
1542 qprocson(q);
1543
1544 /* Set the Stream head write offset and high watermark. */
1545 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1546 (void) proto_set_rx_hiwat(q, connp,
1547 udp_set_rcv_hiwat(udp, connp->conn_rcvbuf));
1548
1549 mutex_enter(&connp->conn_lock);
1550 connp->conn_state_flags &= ~CONN_INCIPIENT;
1551 mutex_exit(&connp->conn_lock);
1552 return (0);
1553 }
1554
1555 /*
1556 * Which UDP options OK to set through T_UNITDATA_REQ...
1557 */
1558 /* ARGSUSED */
1559 static boolean_t
1560 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1561 {
1562 return (B_TRUE);
1563 }
1564
1565 /*
1566 * This routine gets default values of certain options whose default
1567 * values are maintained by protcol specific code
1568 */
1569 int
1570 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1571 {
1572 udp_t *udp = Q_TO_UDP(q);
1573 udp_stack_t *us = udp->udp_us;
1574 int *i1 = (int *)ptr;
1575
1576 switch (level) {
1577 case IPPROTO_IP:
1578 switch (name) {
1579 case IP_MULTICAST_TTL:
1580 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1581 return (sizeof (uchar_t));
1582 case IP_MULTICAST_LOOP:
1583 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1584 return (sizeof (uchar_t));
1585 }
1586 break;
1587 case IPPROTO_IPV6:
1588 switch (name) {
1589 case IPV6_MULTICAST_HOPS:
1590 *i1 = IP_DEFAULT_MULTICAST_TTL;
1591 return (sizeof (int));
1592 case IPV6_MULTICAST_LOOP:
1593 *i1 = IP_DEFAULT_MULTICAST_LOOP;
1594 return (sizeof (int));
1595 case IPV6_UNICAST_HOPS:
1596 *i1 = us->us_ipv6_hoplimit;
1597 return (sizeof (int));
1598 }
1599 break;
1600 }
1601 return (-1);
1602 }
1603
1604 /*
1605 * This routine retrieves the current status of socket options.
1606 * It returns the size of the option retrieved, or -1.
1607 */
1608 int
1609 udp_opt_get(conn_t *connp, t_scalar_t level, t_scalar_t name,
1610 uchar_t *ptr)
1611 {
1612 int *i1 = (int *)ptr;
1613 udp_t *udp = connp->conn_udp;
1614 int len;
1615 conn_opt_arg_t coas;
1616 int retval;
1617
1618 coas.coa_connp = connp;
1619 coas.coa_ixa = connp->conn_ixa;
1620 coas.coa_ipp = &connp->conn_xmit_ipp;
1621 coas.coa_ancillary = B_FALSE;
1622 coas.coa_changed = 0;
1623
1624 /*
1625 * We assume that the optcom framework has checked for the set
1626 * of levels and names that are supported, hence we don't worry
1627 * about rejecting based on that.
1628 * First check for UDP specific handling, then pass to common routine.
1629 */
1630 switch (level) {
1631 case IPPROTO_IP:
1632 /*
1633 * Only allow IPv4 option processing on IPv4 sockets.
1634 */
1635 if (connp->conn_family != AF_INET)
1636 return (-1);
1637
1638 switch (name) {
1639 case IP_OPTIONS:
1640 case T_IP_OPTIONS:
1641 mutex_enter(&connp->conn_lock);
1642 if (!(udp->udp_recv_ipp.ipp_fields &
1643 IPPF_IPV4_OPTIONS)) {
1644 mutex_exit(&connp->conn_lock);
1645 return (0);
1646 }
1647
1648 len = udp->udp_recv_ipp.ipp_ipv4_options_len;
1649 ASSERT(len != 0);
1650 bcopy(udp->udp_recv_ipp.ipp_ipv4_options, ptr, len);
1651 mutex_exit(&connp->conn_lock);
1652 return (len);
1653 }
1654 break;
1655 case IPPROTO_UDP:
1656 switch (name) {
1657 case UDP_NAT_T_ENDPOINT:
1658 mutex_enter(&connp->conn_lock);
1659 *i1 = udp->udp_nat_t_endpoint;
1660 mutex_exit(&connp->conn_lock);
1661 return (sizeof (int));
1662 case UDP_RCVHDR:
1663 mutex_enter(&connp->conn_lock);
1664 *i1 = udp->udp_rcvhdr ? 1 : 0;
1665 mutex_exit(&connp->conn_lock);
1666 return (sizeof (int));
1667 case UDP_SRCPORT_HASH:
1668 mutex_enter(&connp->conn_lock);
1669 *i1 = udp->udp_vxlanhash;
1670 mutex_exit(&connp->conn_lock);
1671 return (sizeof (int));
1672 case UDP_SND_TO_CONNECTED:
1673 mutex_enter(&connp->conn_lock);
1674 *i1 = udp->udp_snd_to_conn ? 1 : 0;
1675 mutex_exit(&connp->conn_lock);
1676 return (sizeof (int));
1677 }
1678 }
1679 mutex_enter(&connp->conn_lock);
1680 retval = conn_opt_get(&coas, level, name, ptr);
1681 mutex_exit(&connp->conn_lock);
1682 return (retval);
1683 }
1684
1685 /*
1686 * This routine retrieves the current status of socket options.
1687 * It returns the size of the option retrieved, or -1.
1688 */
1689 int
1690 udp_tpi_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1691 {
1692 conn_t *connp = Q_TO_CONN(q);
1693 int err;
1694
1695 err = udp_opt_get(connp, level, name, ptr);
1696 return (err);
1697 }
1698
1699 /*
1700 * This routine sets socket options.
1701 */
1702 int
1703 udp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1704 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1705 {
1706 conn_t *connp = coa->coa_connp;
1707 ip_xmit_attr_t *ixa = coa->coa_ixa;
1708 udp_t *udp = connp->conn_udp;
1709 udp_stack_t *us = udp->udp_us;
1710 int *i1 = (int *)invalp;
1711 boolean_t onoff = (*i1 == 0) ? 0 : 1;
1712 int error;
1713
1714 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1715 /*
1716 * First do UDP specific sanity checks and handle UDP specific
1717 * options. Note that some IPPROTO_UDP options are handled
1718 * by conn_opt_set.
1719 */
1720 switch (level) {
1721 case SOL_SOCKET:
1722 switch (name) {
1723 case SO_SNDBUF:
1724 if (*i1 > us->us_max_buf) {
1725 return (ENOBUFS);
1726 }
1727 break;
1728 case SO_RCVBUF:
1729 if (*i1 > us->us_max_buf) {
1730 return (ENOBUFS);
1731 }
1732 break;
1733
1734 case SCM_UCRED: {
1735 struct ucred_s *ucr;
1736 cred_t *newcr;
1737 ts_label_t *tsl;
1738
1739 /*
1740 * Only sockets that have proper privileges and are
1741 * bound to MLPs will have any other value here, so
1742 * this implicitly tests for privilege to set label.
1743 */
1744 if (connp->conn_mlp_type == mlptSingle)
1745 break;
1746
1747 ucr = (struct ucred_s *)invalp;
1748 if (inlen < sizeof (*ucr) + sizeof (bslabel_t) ||
1749 ucr->uc_labeloff < sizeof (*ucr) ||
1750 ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
1751 return (EINVAL);
1752 if (!checkonly) {
1753 /*
1754 * Set ixa_tsl to the new label.
1755 * We assume that crgetzoneid doesn't change
1756 * as part of the SCM_UCRED.
1757 */
1758 ASSERT(cr != NULL);
1759 if ((tsl = crgetlabel(cr)) == NULL)
1760 return (EINVAL);
1761 newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
1762 tsl->tsl_doi, KM_NOSLEEP);
1763 if (newcr == NULL)
1764 return (ENOSR);
1765 ASSERT(newcr->cr_label != NULL);
1766 /*
1767 * Move the hold on the cr_label to ixa_tsl by
1768 * setting cr_label to NULL. Then release newcr.
1769 */
1770 ip_xmit_attr_replace_tsl(ixa, newcr->cr_label);
1771 ixa->ixa_flags |= IXAF_UCRED_TSL;
1772 newcr->cr_label = NULL;
1773 crfree(newcr);
1774 coa->coa_changed |= COA_HEADER_CHANGED;
1775 coa->coa_changed |= COA_WROFF_CHANGED;
1776 }
1777 /* Fully handled this option. */
1778 return (0);
1779 }
1780 }
1781 break;
1782 case IPPROTO_UDP:
1783 switch (name) {
1784 case UDP_NAT_T_ENDPOINT:
1785 if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1786 return (error);
1787 }
1788
1789 /*
1790 * Use conn_family instead so we can avoid ambiguitites
1791 * with AF_INET6 sockets that may switch from IPv4
1792 * to IPv6.
1793 */
1794 if (connp->conn_family != AF_INET) {
1795 return (EAFNOSUPPORT);
1796 }
1797
1798 if (!checkonly) {
1799 mutex_enter(&connp->conn_lock);
1800 udp->udp_nat_t_endpoint = onoff;
1801 mutex_exit(&connp->conn_lock);
1802 coa->coa_changed |= COA_HEADER_CHANGED;
1803 coa->coa_changed |= COA_WROFF_CHANGED;
1804 }
1805 /* Fully handled this option. */
1806 return (0);
1807 case UDP_RCVHDR:
1808 mutex_enter(&connp->conn_lock);
1809 udp->udp_rcvhdr = onoff;
1810 mutex_exit(&connp->conn_lock);
1811 return (0);
1812 case UDP_SRCPORT_HASH:
1813 /*
1814 * This should have already been verified, but double
1815 * check.
1816 */
1817 if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1818 return (error);
1819 }
1820
1821 /* First see if the val is something we understand */
1822 if (*i1 != UDP_HASH_DISABLE && *i1 != UDP_HASH_VXLAN)
1823 return (EINVAL);
1824
1825 if (!checkonly) {
1826 mutex_enter(&connp->conn_lock);
1827 udp->udp_vxlanhash = *i1;
1828 mutex_exit(&connp->conn_lock);
1829 }
1830 /* Fully handled this option. */
1831 return (0);
1832 case UDP_SND_TO_CONNECTED:
1833 mutex_enter(&connp->conn_lock);
1834 udp->udp_snd_to_conn = onoff;
1835 mutex_exit(&connp->conn_lock);
1836 return (0);
1837 }
1838 break;
1839 }
1840 error = conn_opt_set(coa, level, name, inlen, invalp,
1841 checkonly, cr);
1842 return (error);
1843 }
1844
1845 /*
1846 * This routine sets socket options.
1847 */
1848 int
1849 udp_opt_set(conn_t *connp, uint_t optset_context, int level,
1850 int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
1851 uchar_t *outvalp, void *thisdg_attrs, cred_t *cr)
1852 {
1853 udp_t *udp = connp->conn_udp;
1854 int err;
1855 conn_opt_arg_t coas, *coa;
1856 boolean_t checkonly;
1857 udp_stack_t *us = udp->udp_us;
1858
1859 switch (optset_context) {
1860 case SETFN_OPTCOM_CHECKONLY:
1861 checkonly = B_TRUE;
1862 /*
1863 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
1864 * inlen != 0 implies value supplied and
1865 * we have to "pretend" to set it.
1866 * inlen == 0 implies that there is no
1867 * value part in T_CHECK request and just validation
1868 * done elsewhere should be enough, we just return here.
1869 */
1870 if (inlen == 0) {
1871 *outlenp = 0;
1872 return (0);
1873 }
1874 break;
1875 case SETFN_OPTCOM_NEGOTIATE:
1876 checkonly = B_FALSE;
1877 break;
1878 case SETFN_UD_NEGOTIATE:
1879 case SETFN_CONN_NEGOTIATE:
1880 checkonly = B_FALSE;
1881 /*
1882 * Negotiating local and "association-related" options
1883 * through T_UNITDATA_REQ.
1884 *
1885 * Following routine can filter out ones we do not
1886 * want to be "set" this way.
1887 */
1888 if (!udp_opt_allow_udr_set(level, name)) {
1889 *outlenp = 0;
1890 return (EINVAL);
1891 }
1892 break;
1893 default:
1894 /*
1895 * We should never get here
1896 */
1897 *outlenp = 0;
1898 return (EINVAL);
1899 }
1900
1901 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
1902 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
1903
1904 if (thisdg_attrs != NULL) {
1905 /* Options from T_UNITDATA_REQ */
1906 coa = (conn_opt_arg_t *)thisdg_attrs;
1907 ASSERT(coa->coa_connp == connp);
1908 ASSERT(coa->coa_ixa != NULL);
1909 ASSERT(coa->coa_ipp != NULL);
1910 ASSERT(coa->coa_ancillary);
1911 } else {
1912 coa = &coas;
1913 coas.coa_connp = connp;
1914 /* Get a reference on conn_ixa to prevent concurrent mods */
1915 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
1916 if (coas.coa_ixa == NULL) {
1917 *outlenp = 0;
1918 return (ENOMEM);
1919 }
1920 coas.coa_ipp = &connp->conn_xmit_ipp;
1921 coas.coa_ancillary = B_FALSE;
1922 coas.coa_changed = 0;
1923 }
1924
1925 err = udp_do_opt_set(coa, level, name, inlen, invalp,
1926 cr, checkonly);
1927 if (err != 0) {
1928 errout:
1929 if (!coa->coa_ancillary)
1930 ixa_refrele(coa->coa_ixa);
1931 *outlenp = 0;
1932 return (err);
1933 }
1934 /* Handle DHCPINIT here outside of lock */
1935 if (level == IPPROTO_IP && name == IP_DHCPINIT_IF) {
1936 uint_t ifindex;
1937 ill_t *ill;
1938
1939 ifindex = *(uint_t *)invalp;
1940 if (ifindex == 0) {
1941 ill = NULL;
1942 } else {
1943 ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1944 coa->coa_ixa->ixa_ipst);
1945 if (ill == NULL) {
1946 err = ENXIO;
1947 goto errout;
1948 }
1949
1950 mutex_enter(&ill->ill_lock);
1951 if (ill->ill_state_flags & ILL_CONDEMNED) {
1952 mutex_exit(&ill->ill_lock);
1953 ill_refrele(ill);
1954 err = ENXIO;
1955 goto errout;
1956 }
1957 if (IS_VNI(ill)) {
1958 mutex_exit(&ill->ill_lock);
1959 ill_refrele(ill);
1960 err = EINVAL;
1961 goto errout;
1962 }
1963 }
1964 mutex_enter(&connp->conn_lock);
1965
1966 if (connp->conn_dhcpinit_ill != NULL) {
1967 /*
1968 * We've locked the conn so conn_cleanup_ill()
1969 * cannot clear conn_dhcpinit_ill -- so it's
1970 * safe to access the ill.
1971 */
1972 ill_t *oill = connp->conn_dhcpinit_ill;
1973
1974 ASSERT(oill->ill_dhcpinit != 0);
1975 atomic_dec_32(&oill->ill_dhcpinit);
1976 ill_set_inputfn(connp->conn_dhcpinit_ill);
1977 connp->conn_dhcpinit_ill = NULL;
1978 }
1979
1980 if (ill != NULL) {
1981 connp->conn_dhcpinit_ill = ill;
1982 atomic_inc_32(&ill->ill_dhcpinit);
1983 ill_set_inputfn(ill);
1984 mutex_exit(&connp->conn_lock);
1985 mutex_exit(&ill->ill_lock);
1986 ill_refrele(ill);
1987 } else {
1988 mutex_exit(&connp->conn_lock);
1989 }
1990 }
1991
1992 /*
1993 * Common case of OK return with outval same as inval.
1994 */
1995 if (invalp != outvalp) {
1996 /* don't trust bcopy for identical src/dst */
1997 (void) bcopy(invalp, outvalp, inlen);
1998 }
1999 *outlenp = inlen;
2000
2001 /*
2002 * If this was not ancillary data, then we rebuild the headers,
2003 * update the IRE/NCE, and IPsec as needed.
2004 * Since the label depends on the destination we go through
2005 * ip_set_destination first.
2006 */
2007 if (coa->coa_ancillary) {
2008 return (0);
2009 }
2010
2011 if (coa->coa_changed & COA_ROUTE_CHANGED) {
2012 in6_addr_t saddr, faddr, nexthop;
2013 in_port_t fport;
2014
2015 /*
2016 * We clear lastdst to make sure we pick up the change
2017 * next time sending.
2018 * If we are connected we re-cache the information.
2019 * We ignore errors to preserve BSD behavior.
2020 * Note that we don't redo IPsec policy lookup here
2021 * since the final destination (or source) didn't change.
2022 */
2023 mutex_enter(&connp->conn_lock);
2024 connp->conn_v6lastdst = ipv6_all_zeros;
2025
2026 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
2027 &connp->conn_faddr_v6, &nexthop);
2028 saddr = connp->conn_saddr_v6;
2029 faddr = connp->conn_faddr_v6;
2030 fport = connp->conn_fport;
2031 mutex_exit(&connp->conn_lock);
2032
2033 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
2034 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
2035 (void) ip_attr_connect(connp, coa->coa_ixa,
2036 &saddr, &faddr, &nexthop, fport, NULL, NULL,
2037 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
2038 }
2039 }
2040
2041 ixa_refrele(coa->coa_ixa);
2042
2043 if (coa->coa_changed & COA_HEADER_CHANGED) {
2044 /*
2045 * Rebuild the header template if we are connected.
2046 * Otherwise clear conn_v6lastdst so we rebuild the header
2047 * in the data path.
2048 */
2049 mutex_enter(&connp->conn_lock);
2050 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
2051 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
2052 err = udp_build_hdr_template(connp,
2053 &connp->conn_saddr_v6, &connp->conn_faddr_v6,
2054 connp->conn_fport, connp->conn_flowinfo);
2055 if (err != 0) {
2056 mutex_exit(&connp->conn_lock);
2057 return (err);
2058 }
2059 } else {
2060 connp->conn_v6lastdst = ipv6_all_zeros;
2061 }
2062 mutex_exit(&connp->conn_lock);
2063 }
2064 if (coa->coa_changed & COA_RCVBUF_CHANGED) {
2065 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2066 connp->conn_rcvbuf);
2067 }
2068 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
2069 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
2070 }
2071 if (coa->coa_changed & COA_WROFF_CHANGED) {
2072 /* Increase wroff if needed */
2073 uint_t wroff;
2074
2075 mutex_enter(&connp->conn_lock);
2076 wroff = connp->conn_ht_iphc_allocated + us->us_wroff_extra;
2077 if (udp->udp_nat_t_endpoint)
2078 wroff += sizeof (uint32_t);
2079 if (wroff > connp->conn_wroff) {
2080 connp->conn_wroff = wroff;
2081 mutex_exit(&connp->conn_lock);
2082 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
2083 } else {
2084 mutex_exit(&connp->conn_lock);
2085 }
2086 }
2087 return (err);
2088 }
2089
2090 /* This routine sets socket options. */
2091 int
2092 udp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
2093 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
2094 void *thisdg_attrs, cred_t *cr)
2095 {
2096 conn_t *connp = Q_TO_CONN(q);
2097 int error;
2098
2099 error = udp_opt_set(connp, optset_context, level, name, inlen, invalp,
2100 outlenp, outvalp, thisdg_attrs, cr);
2101 return (error);
2102 }
2103
2104 /*
2105 * Setup IP and UDP headers.
2106 * Returns NULL on allocation failure, in which case data_mp is freed.
2107 */
2108 mblk_t *
2109 udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
2110 const in6_addr_t *v6src, const in6_addr_t *v6dst, in_port_t dstport,
2111 uint32_t flowinfo, mblk_t *data_mp, int *errorp)
2112 {
2113 mblk_t *mp;
2114 udpha_t *udpha;
2115 udp_stack_t *us = connp->conn_netstack->netstack_udp;
2116 uint_t data_len;
2117 uint32_t cksum;
2118 udp_t *udp = connp->conn_udp;
2119 boolean_t insert_spi = udp->udp_nat_t_endpoint;
2120 boolean_t hash_srcport = udp->udp_vxlanhash;
2121 uint_t ulp_hdr_len;
2122 uint16_t srcport;
2123
2124 data_len = msgdsize(data_mp);
2125 ulp_hdr_len = UDPH_SIZE;
2126 if (insert_spi)
2127 ulp_hdr_len += sizeof (uint32_t);
2128
2129 /*
2130 * If we have source port hashing going on, determine the hash before
2131 * we modify the mblk_t.
2132 */
2133 if (hash_srcport == B_TRUE) {
2134 srcport = udp_srcport_hash(mp, UDP_HASH_VXLAN,
2135 IPPORT_DYNAMIC_MIN, IPPORT_DYNAMIC_MAX,
2136 ntohs(connp->conn_lport));
2137 }
2138
2139 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, IPPROTO_UDP, flowinfo,
2140 ulp_hdr_len, data_mp, data_len, us->us_wroff_extra, &cksum, errorp);
2141 if (mp == NULL) {
2142 ASSERT(*errorp != 0);
2143 return (NULL);
2144 }
2145
2146 data_len += ulp_hdr_len;
2147 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2148
2149 udpha = (udpha_t *)(mp->b_rptr + ixa->ixa_ip_hdr_length);
2150 if (hash_srcport == B_TRUE) {
2151 udpha->uha_src_port = htons(srcport);
2152 } else {
2153 udpha->uha_src_port = connp->conn_lport;
2154 }
2155 udpha->uha_dst_port = dstport;
2156 udpha->uha_checksum = 0;
2157 udpha->uha_length = htons(data_len);
2158
2159 /*
2160 * If there was a routing option/header then conn_prepend_hdr
2161 * has massaged it and placed the pseudo-header checksum difference
2162 * in the cksum argument.
2163 *
2164 * Setup header length and prepare for ULP checksum done in IP.
2165 *
2166 * We make it easy for IP to include our pseudo header
2167 * by putting our length in uha_checksum.
2168 * The IP source, destination, and length have already been set by
2169 * conn_prepend_hdr.
2170 */
2171 cksum += data_len;
2172 cksum = (cksum >> 16) + (cksum & 0xFFFF);
2173 ASSERT(cksum < 0x10000);
2174
2175 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2176 ipha_t *ipha = (ipha_t *)mp->b_rptr;
2177
2178 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2179
2180 /* IP does the checksum if uha_checksum is non-zero */
2181 if (us->us_do_checksum) {
2182 if (cksum == 0)
2183 udpha->uha_checksum = 0xffff;
2184 else
2185 udpha->uha_checksum = htons(cksum);
2186 } else {
2187 udpha->uha_checksum = 0;
2188 }
2189 } else {
2190 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2191
2192 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2193 if (cksum == 0)
2194 udpha->uha_checksum = 0xffff;
2195 else
2196 udpha->uha_checksum = htons(cksum);
2197 }
2198
2199 /* Insert all-0s SPI now. */
2200 if (insert_spi)
2201 *((uint32_t *)(udpha + 1)) = 0;
2202
2203 return (mp);
2204 }
2205
2206 static int
2207 udp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2208 const in6_addr_t *v6dst, in_port_t dstport, uint32_t flowinfo)
2209 {
2210 udpha_t *udpha;
2211 int error;
2212
2213 ASSERT(MUTEX_HELD(&connp->conn_lock));
2214 /*
2215 * We clear lastdst to make sure we don't use the lastdst path
2216 * next time sending since we might not have set v6dst yet.
2217 */
2218 connp->conn_v6lastdst = ipv6_all_zeros;
2219
2220 error = conn_build_hdr_template(connp, UDPH_SIZE, 0, v6src, v6dst,
2221 flowinfo);
2222 if (error != 0)
2223 return (error);
2224
2225 /*
2226 * Any routing header/option has been massaged. The checksum difference
2227 * is stored in conn_sum.
2228 */
2229 udpha = (udpha_t *)connp->conn_ht_ulp;
2230 udpha->uha_src_port = connp->conn_lport;
2231 udpha->uha_dst_port = dstport;
2232 udpha->uha_checksum = 0;
2233 udpha->uha_length = htons(UDPH_SIZE); /* Filled in later */
2234 return (0);
2235 }
2236
2237 static mblk_t *
2238 udp_queue_fallback(udp_t *udp, mblk_t *mp)
2239 {
2240 ASSERT(MUTEX_HELD(&udp->udp_recv_lock));
2241 if (IPCL_IS_NONSTR(udp->udp_connp)) {
2242 /*
2243 * fallback has started but messages have not been moved yet
2244 */
2245 if (udp->udp_fallback_queue_head == NULL) {
2246 ASSERT(udp->udp_fallback_queue_tail == NULL);
2247 udp->udp_fallback_queue_head = mp;
2248 udp->udp_fallback_queue_tail = mp;
2249 } else {
2250 ASSERT(udp->udp_fallback_queue_tail != NULL);
2251 udp->udp_fallback_queue_tail->b_next = mp;
2252 udp->udp_fallback_queue_tail = mp;
2253 }
2254 return (NULL);
2255 } else {
2256 /*
2257 * Fallback completed, let the caller putnext() the mblk.
2258 */
2259 return (mp);
2260 }
2261 }
2262
2263 /*
2264 * Deliver data to ULP. In case we have a socket, and it's falling back to
2265 * TPI, then we'll queue the mp for later processing.
2266 */
2267 static void
2268 udp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len, ip_recv_attr_t *ira)
2269 {
2270 if (IPCL_IS_NONSTR(connp)) {
2271 udp_t *udp = connp->conn_udp;
2272 int error;
2273
2274 ASSERT(len == msgdsize(mp));
2275 if ((*connp->conn_upcalls->su_recv)
2276 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2277 mutex_enter(&udp->udp_recv_lock);
2278 if (error == ENOSPC) {
2279 /*
2280 * let's confirm while holding the lock
2281 */
2282 if ((*connp->conn_upcalls->su_recv)
2283 (connp->conn_upper_handle, NULL, 0, 0,
2284 &error, NULL) < 0) {
2285 ASSERT(error == ENOSPC);
2286 if (error == ENOSPC) {
2287 connp->conn_flow_cntrld =
2288 B_TRUE;
2289 }
2290 }
2291 mutex_exit(&udp->udp_recv_lock);
2292 } else {
2293 ASSERT(error == EOPNOTSUPP);
2294 mp = udp_queue_fallback(udp, mp);
2295 mutex_exit(&udp->udp_recv_lock);
2296 if (mp != NULL)
2297 putnext(connp->conn_rq, mp);
2298 }
2299 }
2300 ASSERT(MUTEX_NOT_HELD(&udp->udp_recv_lock));
2301 } else {
2302 if (is_system_labeled()) {
2303 ASSERT(ira->ira_cred != NULL);
2304 /*
2305 * Provide for protocols above UDP such as RPC
2306 * NOPID leaves db_cpid unchanged.
2307 */
2308 mblk_setcred(mp, ira->ira_cred, NOPID);
2309 }
2310
2311 putnext(connp->conn_rq, mp);
2312 }
2313 }
2314
2315 /*
2316 * This is the inbound data path.
2317 * IP has already pulled up the IP plus UDP headers and verified alignment
2318 * etc.
2319 */
2320 /* ARGSUSED2 */
2321 static void
2322 udp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2323 {
2324 conn_t *connp = (conn_t *)arg1;
2325 struct T_unitdata_ind *tudi;
2326 uchar_t *rptr; /* Pointer to IP header */
2327 int hdr_length; /* Length of IP+UDP headers */
2328 int udi_size; /* Size of T_unitdata_ind */
2329 int pkt_len;
2330 udp_t *udp;
2331 udpha_t *udpha;
2332 ip_pkt_t ipps;
2333 ip6_t *ip6h;
2334 mblk_t *mp1;
2335 uint32_t udp_ipv4_options_len;
2336 crb_t recv_ancillary;
2337 udp_stack_t *us;
2338
2339 ASSERT(connp->conn_flags & IPCL_UDPCONN);
2340
2341 udp = connp->conn_udp;
2342 us = udp->udp_us;
2343 rptr = mp->b_rptr;
2344
2345 ASSERT(DB_TYPE(mp) == M_DATA);
2346 ASSERT(OK_32PTR(rptr));
2347 ASSERT(ira->ira_pktlen == msgdsize(mp));
2348 pkt_len = ira->ira_pktlen;
2349
2350 /*
2351 * Get a snapshot of these and allow other threads to change
2352 * them after that. We need the same recv_ancillary when determining
2353 * the size as when adding the ancillary data items.
2354 */
2355 mutex_enter(&connp->conn_lock);
2356 udp_ipv4_options_len = udp->udp_recv_ipp.ipp_ipv4_options_len;
2357 recv_ancillary = connp->conn_recv_ancillary;
2358 mutex_exit(&connp->conn_lock);
2359
2360 hdr_length = ira->ira_ip_hdr_length;
2361
2362 /*
2363 * IP inspected the UDP header thus all of it must be in the mblk.
2364 * UDP length check is performed for IPv6 packets and IPv4 packets
2365 * to check if the size of the packet as specified
2366 * by the UDP header is the same as the length derived from the IP
2367 * header.
2368 */
2369 udpha = (udpha_t *)(rptr + hdr_length);
2370 if (pkt_len != ntohs(udpha->uha_length) + hdr_length)
2371 goto tossit;
2372
2373 hdr_length += UDPH_SIZE;
2374 ASSERT(MBLKL(mp) >= hdr_length); /* IP did a pullup */
2375
2376 /* Initialize regardless of IP version */
2377 ipps.ipp_fields = 0;
2378
2379 if (((ira->ira_flags & IRAF_IPV4_OPTIONS) ||
2380 udp_ipv4_options_len > 0) &&
2381 connp->conn_family == AF_INET) {
2382 int err;
2383
2384 /*
2385 * Record/update udp_recv_ipp with the lock
2386 * held. Not needed for AF_INET6 sockets
2387 * since they don't support a getsockopt of IP_OPTIONS.
2388 */
2389 mutex_enter(&connp->conn_lock);
2390 err = ip_find_hdr_v4((ipha_t *)rptr, &udp->udp_recv_ipp,
2391 B_TRUE);
2392 if (err != 0) {
2393 /* Allocation failed. Drop packet */
2394 mutex_exit(&connp->conn_lock);
2395 freemsg(mp);
2396 UDPS_BUMP_MIB(us, udpInErrors);
2397 return;
2398 }
2399 mutex_exit(&connp->conn_lock);
2400 }
2401
2402 if (recv_ancillary.crb_all != 0) {
2403 /*
2404 * Record packet information in the ip_pkt_t
2405 */
2406 if (ira->ira_flags & IRAF_IS_IPV4) {
2407 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2408 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2409 ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
2410 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2411
2412 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipps, B_FALSE);
2413 } else {
2414 uint8_t nexthdrp;
2415
2416 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2417 /*
2418 * IPv6 packets can only be received by applications
2419 * that are prepared to receive IPv6 addresses.
2420 * The IP fanout must ensure this.
2421 */
2422 ASSERT(connp->conn_family == AF_INET6);
2423
2424 ip6h = (ip6_t *)rptr;
2425
2426 /* We don't care about the length, but need the ipp */
2427 hdr_length = ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps,
2428 &nexthdrp);
2429 ASSERT(hdr_length == ira->ira_ip_hdr_length);
2430 /* Restore */
2431 hdr_length = ira->ira_ip_hdr_length + UDPH_SIZE;
2432 ASSERT(nexthdrp == IPPROTO_UDP);
2433 }
2434 }
2435
2436 /*
2437 * This is the inbound data path. Packets are passed upstream as
2438 * T_UNITDATA_IND messages.
2439 */
2440 if (connp->conn_family == AF_INET) {
2441 sin_t *sin;
2442
2443 ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
2444
2445 /*
2446 * Normally only send up the source address.
2447 * If any ancillary data items are wanted we add those.
2448 */
2449 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2450 if (recv_ancillary.crb_all != 0) {
2451 udi_size += conn_recvancillary_size(connp,
2452 recv_ancillary, ira, mp, &ipps);
2453 }
2454
2455 /* Allocate a message block for the T_UNITDATA_IND structure. */
2456 mp1 = allocb(udi_size, BPRI_MED);
2457 if (mp1 == NULL) {
2458 freemsg(mp);
2459 UDPS_BUMP_MIB(us, udpInErrors);
2460 return;
2461 }
2462 mp1->b_cont = mp;
2463 mp1->b_datap->db_type = M_PROTO;
2464 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2465 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2466 tudi->PRIM_type = T_UNITDATA_IND;
2467 tudi->SRC_length = sizeof (sin_t);
2468 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2469 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2470 sizeof (sin_t);
2471 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2472 tudi->OPT_length = udi_size;
2473 sin = (sin_t *)&tudi[1];
2474 sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
2475 sin->sin_port = udpha->uha_src_port;
2476 sin->sin_family = connp->conn_family;
2477 *(uint32_t *)&sin->sin_zero[0] = 0;
2478 *(uint32_t *)&sin->sin_zero[4] = 0;
2479
2480 /*
2481 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
2482 * IP_RECVTTL has been set.
2483 */
2484 if (udi_size != 0) {
2485 conn_recvancillary_add(connp, recv_ancillary, ira,
2486 &ipps, (uchar_t *)&sin[1], udi_size);
2487 }
2488 } else {
2489 sin6_t *sin6;
2490
2491 /*
2492 * Handle both IPv4 and IPv6 packets for IPv6 sockets.
2493 *
2494 * Normally we only send up the address. If receiving of any
2495 * optional receive side information is enabled, we also send
2496 * that up as options.
2497 */
2498 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2499
2500 if (recv_ancillary.crb_all != 0) {
2501 udi_size += conn_recvancillary_size(connp,
2502 recv_ancillary, ira, mp, &ipps);
2503 }
2504
2505 mp1 = allocb(udi_size, BPRI_MED);
2506 if (mp1 == NULL) {
2507 freemsg(mp);
2508 UDPS_BUMP_MIB(us, udpInErrors);
2509 return;
2510 }
2511 mp1->b_cont = mp;
2512 mp1->b_datap->db_type = M_PROTO;
2513 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2514 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2515 tudi->PRIM_type = T_UNITDATA_IND;
2516 tudi->SRC_length = sizeof (sin6_t);
2517 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2518 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2519 sizeof (sin6_t);
2520 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2521 tudi->OPT_length = udi_size;
2522 sin6 = (sin6_t *)&tudi[1];
2523 if (ira->ira_flags & IRAF_IS_IPV4) {
2524 in6_addr_t v6dst;
2525
2526 IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
2527 &sin6->sin6_addr);
2528 IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
2529 &v6dst);
2530 sin6->sin6_flowinfo = 0;
2531 sin6->sin6_scope_id = 0;
2532 sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
2533 IPCL_ZONEID(connp), us->us_netstack);
2534 } else {
2535 ip6h = (ip6_t *)rptr;
2536
2537 sin6->sin6_addr = ip6h->ip6_src;
2538 /* No sin6_flowinfo per API */
2539 sin6->sin6_flowinfo = 0;
2540 /* For link-scope pass up scope id */
2541 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2542 sin6->sin6_scope_id = ira->ira_ruifindex;
2543 else
2544 sin6->sin6_scope_id = 0;
2545 sin6->__sin6_src_id = ip_srcid_find_addr(
2546 &ip6h->ip6_dst, IPCL_ZONEID(connp),
2547 us->us_netstack);
2548 }
2549 sin6->sin6_port = udpha->uha_src_port;
2550 sin6->sin6_family = connp->conn_family;
2551
2552 if (udi_size != 0) {
2553 conn_recvancillary_add(connp, recv_ancillary, ira,
2554 &ipps, (uchar_t *)&sin6[1], udi_size);
2555 }
2556 }
2557
2558 /*
2559 * DTrace this UDP input as udp:::receive (this is for IPv4, IPv6 and
2560 * loopback traffic).
2561 */
2562 DTRACE_UDP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2563 void_ip_t *, rptr, udp_t *, udp, udpha_t *, udpha);
2564
2565 /* Walk past the headers unless IP_RECVHDR was set. */
2566 if (!udp->udp_rcvhdr) {
2567 mp->b_rptr = rptr + hdr_length;
2568 pkt_len -= hdr_length;
2569 }
2570
2571 UDPS_BUMP_MIB(us, udpHCInDatagrams);
2572 udp_ulp_recv(connp, mp1, pkt_len, ira);
2573 return;
2574
2575 tossit:
2576 freemsg(mp);
2577 UDPS_BUMP_MIB(us, udpInErrors);
2578 }
2579
2580 /*
2581 * This routine creates a T_UDERROR_IND message and passes it upstream.
2582 * The address and options are copied from the T_UNITDATA_REQ message
2583 * passed in mp. This message is freed.
2584 */
2585 static void
2586 udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2587 {
2588 struct T_unitdata_req *tudr;
2589 mblk_t *mp1;
2590 uchar_t *destaddr;
2591 t_scalar_t destlen;
2592 uchar_t *optaddr;
2593 t_scalar_t optlen;
2594
2595 if ((mp->b_wptr < mp->b_rptr) ||
2596 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2597 goto done;
2598 }
2599 tudr = (struct T_unitdata_req *)mp->b_rptr;
2600 destaddr = mp->b_rptr + tudr->DEST_offset;
2601 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2602 destaddr + tudr->DEST_length < mp->b_rptr ||
2603 destaddr + tudr->DEST_length > mp->b_wptr) {
2604 goto done;
2605 }
2606 optaddr = mp->b_rptr + tudr->OPT_offset;
2607 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2608 optaddr + tudr->OPT_length < mp->b_rptr ||
2609 optaddr + tudr->OPT_length > mp->b_wptr) {
2610 goto done;
2611 }
2612 destlen = tudr->DEST_length;
2613 optlen = tudr->OPT_length;
2614
2615 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2616 (char *)optaddr, optlen, err);
2617 if (mp1 != NULL)
2618 qreply(q, mp1);
2619
2620 done:
2621 freemsg(mp);
2622 }
2623
2624 /*
2625 * This routine removes a port number association from a stream. It
2626 * is called by udp_wput to handle T_UNBIND_REQ messages.
2627 */
2628 static void
2629 udp_tpi_unbind(queue_t *q, mblk_t *mp)
2630 {
2631 conn_t *connp = Q_TO_CONN(q);
2632 int error;
2633
2634 error = udp_do_unbind(connp);
2635 if (error) {
2636 if (error < 0)
2637 udp_err_ack(q, mp, -error, 0);
2638 else
2639 udp_err_ack(q, mp, TSYSERR, error);
2640 return;
2641 }
2642
2643 mp = mi_tpi_ok_ack_alloc(mp);
2644 ASSERT(mp != NULL);
2645 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
2646 qreply(q, mp);
2647 }
2648
2649 /*
2650 * Don't let port fall into the privileged range.
2651 * Since the extra privileged ports can be arbitrary we also
2652 * ensure that we exclude those from consideration.
2653 * us->us_epriv_ports is not sorted thus we loop over it until
2654 * there are no changes.
2655 */
2656 static in_port_t
2657 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
2658 {
2659 int i, bump;
2660 in_port_t nextport;
2661 boolean_t restart = B_FALSE;
2662 udp_stack_t *us = udp->udp_us;
2663
2664 if (random && udp_random_anon_port != 0) {
2665 (void) random_get_pseudo_bytes((uint8_t *)&port,
2666 sizeof (in_port_t));
2667 /*
2668 * Unless changed by a sys admin, the smallest anon port
2669 * is 32768 and the largest anon port is 65535. It is
2670 * very likely (50%) for the random port to be smaller
2671 * than the smallest anon port. When that happens,
2672 * add port % (anon port range) to the smallest anon
2673 * port to get the random port. It should fall into the
2674 * valid anon port range.
2675 */
2676 if ((port < us->us_smallest_anon_port) ||
2677 (port > us->us_largest_anon_port)) {
2678 if (us->us_smallest_anon_port ==
2679 us->us_largest_anon_port) {
2680 bump = 0;
2681 } else {
2682 bump = port % (us->us_largest_anon_port -
2683 us->us_smallest_anon_port);
2684 }
2685
2686 port = us->us_smallest_anon_port + bump;
2687 }
2688 }
2689
2690 retry:
2691 if (port < us->us_smallest_anon_port)
2692 port = us->us_smallest_anon_port;
2693
2694 if (port > us->us_largest_anon_port) {
2695 port = us->us_smallest_anon_port;
2696 if (restart)
2697 return (0);
2698 restart = B_TRUE;
2699 }
2700
2701 if (port < us->us_smallest_nonpriv_port)
2702 port = us->us_smallest_nonpriv_port;
2703
2704 for (i = 0; i < us->us_num_epriv_ports; i++) {
2705 if (port == us->us_epriv_ports[i]) {
2706 port++;
2707 /*
2708 * Make sure that the port is in the
2709 * valid range.
2710 */
2711 goto retry;
2712 }
2713 }
2714
2715 if (is_system_labeled() &&
2716 (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
2717 port, IPPROTO_UDP, B_TRUE)) != 0) {
2718 port = nextport;
2719 goto retry;
2720 }
2721
2722 return (port);
2723 }
2724
2725 /*
2726 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
2727 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
2728 * the TPI options, otherwise we take them from msg_control.
2729 * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
2730 * Always consumes mp; never consumes tudr_mp.
2731 */
2732 static int
2733 udp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
2734 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
2735 {
2736 udp_t *udp = connp->conn_udp;
2737 udp_stack_t *us = udp->udp_us;
2738 int error;
2739 ip_xmit_attr_t *ixa;
2740 ip_pkt_t *ipp;
2741 in6_addr_t v6src;
2742 in6_addr_t v6dst;
2743 in6_addr_t v6nexthop;
2744 in_port_t dstport;
2745 uint32_t flowinfo;
2746 uint_t srcid;
2747 int is_absreq_failure = 0;
2748 conn_opt_arg_t coas, *coa;
2749
2750 ASSERT(tudr_mp != NULL || msg != NULL);
2751
2752 /*
2753 * Get ixa before checking state to handle a disconnect race.
2754 *
2755 * We need an exclusive copy of conn_ixa since the ancillary data
2756 * options might modify it. That copy has no pointers hence we
2757 * need to set them up once we've parsed the ancillary data.
2758 */
2759 ixa = conn_get_ixa_exclusive(connp);
2760 if (ixa == NULL) {
2761 UDPS_BUMP_MIB(us, udpOutErrors);
2762 freemsg(mp);
2763 return (ENOMEM);
2764 }
2765 ASSERT(cr != NULL);
2766 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2767 ixa->ixa_cred = cr;
2768 ixa->ixa_cpid = pid;
2769 if (is_system_labeled()) {
2770 /* We need to restart with a label based on the cred */
2771 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
2772 }
2773
2774 /* In case previous destination was multicast or multirt */
2775 ip_attr_newdst(ixa);
2776
2777 /* Get a copy of conn_xmit_ipp since the options might change it */
2778 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
2779 if (ipp == NULL) {
2780 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2781 ixa->ixa_cred = connp->conn_cred; /* Restore */
2782 ixa->ixa_cpid = connp->conn_cpid;
2783 ixa_refrele(ixa);
2784 UDPS_BUMP_MIB(us, udpOutErrors);
2785 freemsg(mp);
2786 return (ENOMEM);
2787 }
2788 mutex_enter(&connp->conn_lock);
2789 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
2790 mutex_exit(&connp->conn_lock);
2791 if (error != 0) {
2792 UDPS_BUMP_MIB(us, udpOutErrors);
2793 freemsg(mp);
2794 goto done;
2795 }
2796
2797 /*
2798 * Parse the options and update ixa and ipp as a result.
2799 * Note that ixa_tsl can be updated if SCM_UCRED.
2800 * ixa_refrele/ixa_inactivate will release any reference on ixa_tsl.
2801 */
2802
2803 coa = &coas;
2804 coa->coa_connp = connp;
2805 coa->coa_ixa = ixa;
2806 coa->coa_ipp = ipp;
2807 coa->coa_ancillary = B_TRUE;
2808 coa->coa_changed = 0;
2809
2810 if (msg != NULL) {
2811 error = process_auxiliary_options(connp, msg->msg_control,
2812 msg->msg_controllen, coa, &udp_opt_obj, udp_opt_set, cr);
2813 } else {
2814 struct T_unitdata_req *tudr;
2815
2816 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
2817 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
2818 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
2819 &tudr->OPT_length, tudr->OPT_offset, cr, &udp_opt_obj,
2820 coa, &is_absreq_failure);
2821 }
2822 if (error != 0) {
2823 /*
2824 * Note: No special action needed in this
2825 * module for "is_absreq_failure"
2826 */
2827 freemsg(mp);
2828 UDPS_BUMP_MIB(us, udpOutErrors);
2829 goto done;
2830 }
2831 ASSERT(is_absreq_failure == 0);
2832
2833 mutex_enter(&connp->conn_lock);
2834 /*
2835 * If laddr is unspecified then we look at sin6_src_id.
2836 * We will give precedence to a source address set with IPV6_PKTINFO
2837 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
2838 * want ip_attr_connect to select a source (since it can fail) when
2839 * IPV6_PKTINFO is specified.
2840 * If this doesn't result in a source address then we get a source
2841 * from ip_attr_connect() below.
2842 */
2843 v6src = connp->conn_saddr_v6;
2844 if (sin != NULL) {
2845 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
2846 dstport = sin->sin_port;
2847 flowinfo = 0;
2848 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2849 ixa->ixa_flags |= IXAF_IS_IPV4;
2850 } else if (sin6 != NULL) {
2851 boolean_t v4mapped;
2852
2853 v6dst = sin6->sin6_addr;
2854 dstport = sin6->sin6_port;
2855 flowinfo = sin6->sin6_flowinfo;
2856 srcid = sin6->__sin6_src_id;
2857 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
2858 ixa->ixa_scopeid = sin6->sin6_scope_id;
2859 ixa->ixa_flags |= IXAF_SCOPEID_SET;
2860 } else {
2861 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2862 }
2863 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
2864 if (v4mapped)
2865 ixa->ixa_flags |= IXAF_IS_IPV4;
2866 else
2867 ixa->ixa_flags &= ~IXAF_IS_IPV4;
2868 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
2869 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
2870 v4mapped, connp->conn_netstack)) {
2871 /* Mismatch - v4mapped/v6 specified by srcid. */
2872 mutex_exit(&connp->conn_lock);
2873 error = EADDRNOTAVAIL;
2874 goto failed; /* Does freemsg() and mib. */
2875 }
2876 }
2877 } else {
2878 /* Connected case */
2879 v6dst = connp->conn_faddr_v6;
2880 dstport = connp->conn_fport;
2881 flowinfo = connp->conn_flowinfo;
2882 }
2883 mutex_exit(&connp->conn_lock);
2884
2885 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
2886 if (ipp->ipp_fields & IPPF_ADDR) {
2887 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2888 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2889 v6src = ipp->ipp_addr;
2890 } else {
2891 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2892 v6src = ipp->ipp_addr;
2893 }
2894 }
2895
2896 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
2897 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
2898 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
2899
2900 switch (error) {
2901 case 0:
2902 break;
2903 case EADDRNOTAVAIL:
2904 /*
2905 * IXAF_VERIFY_SOURCE tells us to pick a better source.
2906 * Don't have the application see that errno
2907 */
2908 error = ENETUNREACH;
2909 goto failed;
2910 case ENETDOWN:
2911 /*
2912 * Have !ipif_addr_ready address; drop packet silently
2913 * until we can get applications to not send until we
2914 * are ready.
2915 */
2916 error = 0;
2917 goto failed;
2918 case EHOSTUNREACH:
2919 case ENETUNREACH:
2920 if (ixa->ixa_ire != NULL) {
2921 /*
2922 * Let conn_ip_output/ire_send_noroute return
2923 * the error and send any local ICMP error.
2924 */
2925 error = 0;
2926 break;
2927 }
2928 /* FALLTHRU */
2929 default:
2930 failed:
2931 freemsg(mp);
2932 UDPS_BUMP_MIB(us, udpOutErrors);
2933 goto done;
2934 }
2935
2936 /*
2937 * We might be going to a different destination than last time,
2938 * thus check that TX allows the communication and compute any
2939 * needed label.
2940 *
2941 * TSOL Note: We have an exclusive ipp and ixa for this thread so we
2942 * don't have to worry about concurrent threads.
2943 */
2944 if (is_system_labeled()) {
2945 /* Using UDP MLP requires SCM_UCRED from user */
2946 if (connp->conn_mlp_type != mlptSingle &&
2947 !((ixa->ixa_flags & IXAF_UCRED_TSL))) {
2948 UDPS_BUMP_MIB(us, udpOutErrors);
2949 error = ECONNREFUSED;
2950 freemsg(mp);
2951 goto done;
2952 }
2953 /*
2954 * Check whether Trusted Solaris policy allows communication
2955 * with this host, and pretend that the destination is
2956 * unreachable if not.
2957 * Compute any needed label and place it in ipp_label_v4/v6.
2958 *
2959 * Later conn_build_hdr_template/conn_prepend_hdr takes
2960 * ipp_label_v4/v6 to form the packet.
2961 *
2962 * Tsol note: We have ipp structure local to this thread so
2963 * no locking is needed.
2964 */
2965 error = conn_update_label(connp, ixa, &v6dst, ipp);
2966 if (error != 0) {
2967 freemsg(mp);
2968 UDPS_BUMP_MIB(us, udpOutErrors);
2969 goto done;
2970 }
2971 }
2972 mp = udp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, dstport,
2973 flowinfo, mp, &error);
2974 if (mp == NULL) {
2975 ASSERT(error != 0);
2976 UDPS_BUMP_MIB(us, udpOutErrors);
2977 goto done;
2978 }
2979 if (ixa->ixa_pktlen > IP_MAXPACKET) {
2980 error = EMSGSIZE;
2981 UDPS_BUMP_MIB(us, udpOutErrors);
2982 freemsg(mp);
2983 goto done;
2984 }
2985 /* We're done. Pass the packet to ip. */
2986 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
2987
2988 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
2989 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
2990 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
2991
2992 error = conn_ip_output(mp, ixa);
2993 /* No udpOutErrors if an error since IP increases its error counter */
2994 switch (error) {
2995 case 0:
2996 break;
2997 case EWOULDBLOCK:
2998 (void) ixa_check_drain_insert(connp, ixa);
2999 error = 0;
3000 break;
3001 case EADDRNOTAVAIL:
3002 /*
3003 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3004 * Don't have the application see that errno
3005 */
3006 error = ENETUNREACH;
3007 /* FALLTHRU */
3008 default:
3009 mutex_enter(&connp->conn_lock);
3010 /*
3011 * Clear the source and v6lastdst so we call ip_attr_connect
3012 * for the next packet and try to pick a better source.
3013 */
3014 if (connp->conn_mcbc_bind)
3015 connp->conn_saddr_v6 = ipv6_all_zeros;
3016 else
3017 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3018 connp->conn_v6lastdst = ipv6_all_zeros;
3019 mutex_exit(&connp->conn_lock);
3020 break;
3021 }
3022 done:
3023 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3024 ixa->ixa_cred = connp->conn_cred; /* Restore */
3025 ixa->ixa_cpid = connp->conn_cpid;
3026 ixa_refrele(ixa);
3027 ip_pkt_free(ipp);
3028 kmem_free(ipp, sizeof (*ipp));
3029 return (error);
3030 }
3031
3032 /*
3033 * Handle sending an M_DATA for a connected socket.
3034 * Handles both IPv4 and IPv6.
3035 */
3036 static int
3037 udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
3038 {
3039 udp_t *udp = connp->conn_udp;
3040 udp_stack_t *us = udp->udp_us;
3041 int error;
3042 ip_xmit_attr_t *ixa;
3043
3044 /*
3045 * If no other thread is using conn_ixa this just gets a reference to
3046 * conn_ixa. Otherwise we get a safe copy of conn_ixa.
3047 */
3048 ixa = conn_get_ixa(connp, B_FALSE);
3049 if (ixa == NULL) {
3050 UDPS_BUMP_MIB(us, udpOutErrors);
3051 freemsg(mp);
3052 return (ENOMEM);
3053 }
3054
3055 ASSERT(cr != NULL);
3056 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3057 ixa->ixa_cred = cr;
3058 ixa->ixa_cpid = pid;
3059
3060 mutex_enter(&connp->conn_lock);
3061 mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_saddr_v6,
3062 connp->conn_fport, connp->conn_flowinfo, &error);
3063
3064 if (mp == NULL) {
3065 ASSERT(error != 0);
3066 mutex_exit(&connp->conn_lock);
3067 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3068 ixa->ixa_cred = connp->conn_cred; /* Restore */
3069 ixa->ixa_cpid = connp->conn_cpid;
3070 ixa_refrele(ixa);
3071 UDPS_BUMP_MIB(us, udpOutErrors);
3072 freemsg(mp);
3073 return (error);
3074 }
3075
3076 /*
3077 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3078 * safe copy, then we need to fill in any pointers in it.
3079 */
3080 if (ixa->ixa_ire == NULL) {
3081 in6_addr_t faddr, saddr;
3082 in6_addr_t nexthop;
3083 in_port_t fport;
3084
3085 saddr = connp->conn_saddr_v6;
3086 faddr = connp->conn_faddr_v6;
3087 fport = connp->conn_fport;
3088 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
3089 mutex_exit(&connp->conn_lock);
3090
3091 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
3092 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
3093 IPDF_IPSEC);
3094 switch (error) {
3095 case 0:
3096 break;
3097 case EADDRNOTAVAIL:
3098 /*
3099 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3100 * Don't have the application see that errno
3101 */
3102 error = ENETUNREACH;
3103 goto failed;
3104 case ENETDOWN:
3105 /*
3106 * Have !ipif_addr_ready address; drop packet silently
3107 * until we can get applications to not send until we
3108 * are ready.
3109 */
3110 error = 0;
3111 goto failed;
3112 case EHOSTUNREACH:
3113 case ENETUNREACH:
3114 if (ixa->ixa_ire != NULL) {
3115 /*
3116 * Let conn_ip_output/ire_send_noroute return
3117 * the error and send any local ICMP error.
3118 */
3119 error = 0;
3120 break;
3121 }
3122 /* FALLTHRU */
3123 default:
3124 failed:
3125 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3126 ixa->ixa_cred = connp->conn_cred; /* Restore */
3127 ixa->ixa_cpid = connp->conn_cpid;
3128 ixa_refrele(ixa);
3129 freemsg(mp);
3130 UDPS_BUMP_MIB(us, udpOutErrors);
3131 return (error);
3132 }
3133 } else {
3134 /* Done with conn_t */
3135 mutex_exit(&connp->conn_lock);
3136 }
3137 ASSERT(ixa->ixa_ire != NULL);
3138
3139 /* We're done. Pass the packet to ip. */
3140 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3141
3142 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3143 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3144 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3145
3146 error = conn_ip_output(mp, ixa);
3147 /* No udpOutErrors if an error since IP increases its error counter */
3148 switch (error) {
3149 case 0:
3150 break;
3151 case EWOULDBLOCK:
3152 (void) ixa_check_drain_insert(connp, ixa);
3153 error = 0;
3154 break;
3155 case EADDRNOTAVAIL:
3156 /*
3157 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3158 * Don't have the application see that errno
3159 */
3160 error = ENETUNREACH;
3161 break;
3162 }
3163 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3164 ixa->ixa_cred = connp->conn_cred; /* Restore */
3165 ixa->ixa_cpid = connp->conn_cpid;
3166 ixa_refrele(ixa);
3167 return (error);
3168 }
3169
3170 /*
3171 * Handle sending an M_DATA to the last destination.
3172 * Handles both IPv4 and IPv6.
3173 *
3174 * NOTE: The caller must hold conn_lock and we drop it here.
3175 */
3176 static int
3177 udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3178 ip_xmit_attr_t *ixa)
3179 {
3180 udp_t *udp = connp->conn_udp;
3181 udp_stack_t *us = udp->udp_us;
3182 int error;
3183
3184 ASSERT(MUTEX_HELD(&connp->conn_lock));
3185 ASSERT(ixa != NULL);
3186
3187 ASSERT(cr != NULL);
3188 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3189 ixa->ixa_cred = cr;
3190 ixa->ixa_cpid = pid;
3191
3192 mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_v6lastsrc,
3193 connp->conn_lastdstport, connp->conn_lastflowinfo, &error);
3194
3195 if (mp == NULL) {
3196 ASSERT(error != 0);
3197 mutex_exit(&connp->conn_lock);
3198 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3199 ixa->ixa_cred = connp->conn_cred; /* Restore */
3200 ixa->ixa_cpid = connp->conn_cpid;
3201 ixa_refrele(ixa);
3202 UDPS_BUMP_MIB(us, udpOutErrors);
3203 freemsg(mp);
3204 return (error);
3205 }
3206
3207 /*
3208 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3209 * safe copy, then we need to fill in any pointers in it.
3210 */
3211 if (ixa->ixa_ire == NULL) {
3212 in6_addr_t lastdst, lastsrc;
3213 in6_addr_t nexthop;
3214 in_port_t lastport;
3215
3216 lastsrc = connp->conn_v6lastsrc;
3217 lastdst = connp->conn_v6lastdst;
3218 lastport = connp->conn_lastdstport;
3219 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3220 mutex_exit(&connp->conn_lock);
3221
3222 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3223 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3224 IPDF_VERIFY_DST | IPDF_IPSEC);
3225 switch (error) {
3226 case 0:
3227 break;
3228 case EADDRNOTAVAIL:
3229 /*
3230 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3231 * Don't have the application see that errno
3232 */
3233 error = ENETUNREACH;
3234 goto failed;
3235 case ENETDOWN:
3236 /*
3237 * Have !ipif_addr_ready address; drop packet silently
3238 * until we can get applications to not send until we
3239 * are ready.
3240 */
3241 error = 0;
3242 goto failed;
3243 case EHOSTUNREACH:
3244 case ENETUNREACH:
3245 if (ixa->ixa_ire != NULL) {
3246 /*
3247 * Let conn_ip_output/ire_send_noroute return
3248 * the error and send any local ICMP error.
3249 */
3250 error = 0;
3251 break;
3252 }
3253 /* FALLTHRU */
3254 default:
3255 failed:
3256 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3257 ixa->ixa_cred = connp->conn_cred; /* Restore */
3258 ixa->ixa_cpid = connp->conn_cpid;
3259 ixa_refrele(ixa);
3260 freemsg(mp);
3261 UDPS_BUMP_MIB(us, udpOutErrors);
3262 return (error);
3263 }
3264 } else {
3265 /* Done with conn_t */
3266 mutex_exit(&connp->conn_lock);
3267 }
3268
3269 /* We're done. Pass the packet to ip. */
3270 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3271
3272 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3273 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3274 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3275
3276 error = conn_ip_output(mp, ixa);
3277 /* No udpOutErrors if an error since IP increases its error counter */
3278 switch (error) {
3279 case 0:
3280 break;
3281 case EWOULDBLOCK:
3282 (void) ixa_check_drain_insert(connp, ixa);
3283 error = 0;
3284 break;
3285 case EADDRNOTAVAIL:
3286 /*
3287 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3288 * Don't have the application see that errno
3289 */
3290 error = ENETUNREACH;
3291 /* FALLTHRU */
3292 default:
3293 mutex_enter(&connp->conn_lock);
3294 /*
3295 * Clear the source and v6lastdst so we call ip_attr_connect
3296 * for the next packet and try to pick a better source.
3297 */
3298 if (connp->conn_mcbc_bind)
3299 connp->conn_saddr_v6 = ipv6_all_zeros;
3300 else
3301 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3302 connp->conn_v6lastdst = ipv6_all_zeros;
3303 mutex_exit(&connp->conn_lock);
3304 break;
3305 }
3306 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3307 ixa->ixa_cred = connp->conn_cred; /* Restore */
3308 ixa->ixa_cpid = connp->conn_cpid;
3309 ixa_refrele(ixa);
3310 return (error);
3311 }
3312
3313
3314 /*
3315 * Prepend the header template and then fill in the source and
3316 * flowinfo. The caller needs to handle the destination address since
3317 * it's setting is different if rthdr or source route.
3318 *
3319 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3320 * When it returns NULL it sets errorp.
3321 */
3322 static mblk_t *
3323 udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3324 const in6_addr_t *v6src, in_port_t dstport, uint32_t flowinfo, int *errorp)
3325 {
3326 udp_t *udp = connp->conn_udp;
3327 udp_stack_t *us = udp->udp_us;
3328 boolean_t insert_spi = udp->udp_nat_t_endpoint;
3329 boolean_t hash_srcport = udp->udp_vxlanhash;
3330 uint_t pktlen;
3331 uint_t alloclen;
3332 uint_t copylen;
3333 uint8_t *iph;
3334 uint_t ip_hdr_length;
3335 udpha_t *udpha;
3336 uint32_t cksum;
3337 ip_pkt_t *ipp;
3338 uint16_t srcport;
3339
3340 ASSERT(MUTEX_HELD(&connp->conn_lock));
3341
3342 /*
3343 * If we have source port hashing going on, determine the hash before
3344 * we modify the mblk_t.
3345 */
3346 if (hash_srcport == B_TRUE) {
3347 srcport = udp_srcport_hash(mp, UDP_HASH_VXLAN,
3348 IPPORT_DYNAMIC_MIN, IPPORT_DYNAMIC_MAX,
3349 ntohs(connp->conn_lport));
3350 }
3351
3352 /*
3353 * Copy the header template and leave space for an SPI
3354 */
3355 copylen = connp->conn_ht_iphc_len;
3356 alloclen = copylen + (insert_spi ? sizeof (uint32_t) : 0);
3357 pktlen = alloclen + msgdsize(mp);
3358 if (pktlen > IP_MAXPACKET) {
3359 freemsg(mp);
3360 *errorp = EMSGSIZE;
3361 return (NULL);
3362 }
3363 ixa->ixa_pktlen = pktlen;
3364
3365 /* check/fix buffer config, setup pointers into it */
3366 iph = mp->b_rptr - alloclen;
3367 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
3368 mblk_t *mp1;
3369
3370 mp1 = allocb(alloclen + us->us_wroff_extra, BPRI_MED);
3371 if (mp1 == NULL) {
3372 freemsg(mp);
3373 *errorp = ENOMEM;
3374 return (NULL);
3375 }
3376 mp1->b_wptr = DB_LIM(mp1);
3377 mp1->b_cont = mp;
3378 mp = mp1;
3379 iph = (mp->b_wptr - alloclen);
3380 }
3381 mp->b_rptr = iph;
3382 bcopy(connp->conn_ht_iphc, iph, copylen);
3383 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
3384
3385 ixa->ixa_ip_hdr_length = ip_hdr_length;
3386 udpha = (udpha_t *)(iph + ip_hdr_length);
3387
3388 /*
3389 * Setup header length and prepare for ULP checksum done in IP.
3390 * udp_build_hdr_template has already massaged any routing header
3391 * and placed the result in conn_sum.
3392 *
3393 * We make it easy for IP to include our pseudo header
3394 * by putting our length in uha_checksum.
3395 */
3396 cksum = pktlen - ip_hdr_length;
3397 udpha->uha_length = htons(cksum);
3398
3399 cksum += connp->conn_sum;
3400 cksum = (cksum >> 16) + (cksum & 0xFFFF);
3401 ASSERT(cksum < 0x10000);
3402
3403 ipp = &connp->conn_xmit_ipp;
3404 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3405 ipha_t *ipha = (ipha_t *)iph;
3406
3407 ipha->ipha_length = htons((uint16_t)pktlen);
3408
3409 /* IP does the checksum if uha_checksum is non-zero */
3410 if (us->us_do_checksum)
3411 udpha->uha_checksum = htons(cksum);
3412
3413 /* if IP_PKTINFO specified an addres it wins over bind() */
3414 if ((ipp->ipp_fields & IPPF_ADDR) &&
3415 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3416 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
3417 ipha->ipha_src = ipp->ipp_addr_v4;
3418 } else {
3419 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
3420 }
3421 } else {
3422 ip6_t *ip6h = (ip6_t *)iph;
3423
3424 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN));
3425 udpha->uha_checksum = htons(cksum);
3426
3427 /* if IP_PKTINFO specified an addres it wins over bind() */
3428 if ((ipp->ipp_fields & IPPF_ADDR) &&
3429 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3430 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
3431 ip6h->ip6_src = ipp->ipp_addr;
3432 } else {
3433 ip6h->ip6_src = *v6src;
3434 }
3435 ip6h->ip6_vcf =
3436 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
3437 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
3438 if (ipp->ipp_fields & IPPF_TCLASS) {
3439 /* Overrides the class part of flowinfo */
3440 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
3441 ipp->ipp_tclass);
3442 }
3443 }
3444
3445 /* Insert all-0s SPI now. */
3446 if (insert_spi)
3447 *((uint32_t *)(udpha + 1)) = 0;
3448
3449 udpha->uha_dst_port = dstport;
3450 if (hash_srcport == B_TRUE)
3451 udpha->uha_src_port = htons(srcport);
3452
3453 return (mp);
3454 }
3455
3456 /*
3457 * Send a T_UDERR_IND in response to an M_DATA
3458 */
3459 static void
3460 udp_ud_err_connected(conn_t *connp, t_scalar_t error)
3461 {
3462 struct sockaddr_storage ss;
3463 sin_t *sin;
3464 sin6_t *sin6;
3465 struct sockaddr *addr;
3466 socklen_t addrlen;
3467 mblk_t *mp1;
3468
3469 mutex_enter(&connp->conn_lock);
3470 /* Initialize addr and addrlen as if they're passed in */
3471 if (connp->conn_family == AF_INET) {
3472 sin = (sin_t *)&ss;
3473 *sin = sin_null;
3474 sin->sin_family = AF_INET;
3475 sin->sin_port = connp->conn_fport;
3476 sin->sin_addr.s_addr = connp->conn_faddr_v4;
3477 addr = (struct sockaddr *)sin;
3478 addrlen = sizeof (*sin);
3479 } else {
3480 sin6 = (sin6_t *)&ss;
3481 *sin6 = sin6_null;
3482 sin6->sin6_family = AF_INET6;
3483 sin6->sin6_port = connp->conn_fport;
3484 sin6->sin6_flowinfo = connp->conn_flowinfo;
3485 sin6->sin6_addr = connp->conn_faddr_v6;
3486 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_faddr_v6) &&
3487 (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) {
3488 sin6->sin6_scope_id = connp->conn_ixa->ixa_scopeid;
3489 } else {
3490 sin6->sin6_scope_id = 0;
3491 }
3492 sin6->__sin6_src_id = 0;
3493 addr = (struct sockaddr *)sin6;
3494 addrlen = sizeof (*sin6);
3495 }
3496 mutex_exit(&connp->conn_lock);
3497
3498 mp1 = mi_tpi_uderror_ind((char *)addr, addrlen, NULL, 0, error);
3499 if (mp1 != NULL)
3500 putnext(connp->conn_rq, mp1);
3501 }
3502
3503 /*
3504 * This routine handles all messages passed downstream. It either
3505 * consumes the message or passes it downstream; it never queues a
3506 * a message.
3507 *
3508 * Also entry point for sockfs when udp is in "direct sockfs" mode. This mode
3509 * is valid when we are directly beneath the stream head, and thus sockfs
3510 * is able to bypass STREAMS and directly call us, passing along the sockaddr
3511 * structure without the cumbersome T_UNITDATA_REQ interface for the case of
3512 * connected endpoints.
3513 */
3514 void
3515 udp_wput(queue_t *q, mblk_t *mp)
3516 {
3517 sin6_t *sin6;
3518 sin_t *sin = NULL;
3519 uint_t srcid;
3520 conn_t *connp = Q_TO_CONN(q);
3521 udp_t *udp = connp->conn_udp;
3522 int error = 0;
3523 struct sockaddr *addr = NULL;
3524 socklen_t addrlen;
3525 udp_stack_t *us = udp->udp_us;
3526 struct T_unitdata_req *tudr;
3527 mblk_t *data_mp;
3528 ushort_t ipversion;
3529 cred_t *cr;
3530 pid_t pid;
3531
3532 /*
3533 * We directly handle several cases here: T_UNITDATA_REQ message
3534 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
3535 * socket.
3536 */
3537 switch (DB_TYPE(mp)) {
3538 case M_DATA:
3539 if (!udp->udp_issocket || udp->udp_state != TS_DATA_XFER) {
3540 /* Not connected; address is required */
3541 UDPS_BUMP_MIB(us, udpOutErrors);
3542 UDP_DBGSTAT(us, udp_data_notconn);
3543 UDP_STAT(us, udp_out_err_notconn);
3544 freemsg(mp);
3545 return;
3546 }
3547 /*
3548 * All Solaris components should pass a db_credp
3549 * for this message, hence we ASSERT.
3550 * On production kernels we return an error to be robust against
3551 * random streams modules sitting on top of us.
3552 */
3553 cr = msg_getcred(mp, &pid);
3554 ASSERT(cr != NULL);
3555 if (cr == NULL) {
3556 UDPS_BUMP_MIB(us, udpOutErrors);
3557 freemsg(mp);
3558 return;
3559 }
3560 ASSERT(udp->udp_issocket);
3561 UDP_DBGSTAT(us, udp_data_conn);
3562 error = udp_output_connected(connp, mp, cr, pid);
3563 if (error != 0) {
3564 UDP_STAT(us, udp_out_err_output);
3565 if (connp->conn_rq != NULL)
3566 udp_ud_err_connected(connp, (t_scalar_t)error);
3567 #ifdef DEBUG
3568 printf("udp_output_connected returned %d\n", error);
3569 #endif
3570 }
3571 return;
3572
3573 case M_PROTO:
3574 case M_PCPROTO:
3575 tudr = (struct T_unitdata_req *)mp->b_rptr;
3576 if (MBLKL(mp) < sizeof (*tudr) ||
3577 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
3578 udp_wput_other(q, mp);
3579 return;
3580 }
3581 break;
3582
3583 default:
3584 udp_wput_other(q, mp);
3585 return;
3586 }
3587
3588 /* Handle valid T_UNITDATA_REQ here */
3589 data_mp = mp->b_cont;
3590 if (data_mp == NULL) {
3591 error = EPROTO;
3592 goto ud_error2;
3593 }
3594 mp->b_cont = NULL;
3595
3596 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
3597 error = EADDRNOTAVAIL;
3598 goto ud_error2;
3599 }
3600
3601 /*
3602 * All Solaris components should pass a db_credp
3603 * for this TPI message, hence we should ASSERT.
3604 * However, RPC (svc_clts_ksend) does this odd thing where it
3605 * passes the options from a T_UNITDATA_IND unchanged in a
3606 * T_UNITDATA_REQ. While that is the right thing to do for
3607 * some options, SCM_UCRED being the key one, this also makes it
3608 * pass down IP_RECVDSTADDR. Hence we can't ASSERT here.
3609 */
3610 cr = msg_getcred(mp, &pid);
3611 if (cr == NULL) {
3612 cr = connp->conn_cred;
3613 pid = connp->conn_cpid;
3614 }
3615
3616 /*
3617 * If a port has not been bound to the stream, fail.
3618 * This is not a problem when sockfs is directly
3619 * above us, because it will ensure that the socket
3620 * is first bound before allowing data to be sent.
3621 */
3622 if (udp->udp_state == TS_UNBND) {
3623 error = EPROTO;
3624 goto ud_error2;
3625 }
3626 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
3627 addrlen = tudr->DEST_length;
3628
3629 switch (connp->conn_family) {
3630 case AF_INET6:
3631 sin6 = (sin6_t *)addr;
3632 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
3633 (sin6->sin6_family != AF_INET6)) {
3634 error = EADDRNOTAVAIL;
3635 goto ud_error2;
3636 }
3637
3638 srcid = sin6->__sin6_src_id;
3639 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
3640 /*
3641 * Destination is a non-IPv4-compatible IPv6 address.
3642 * Send out an IPv6 format packet.
3643 */
3644
3645 /*
3646 * If the local address is a mapped address return
3647 * an error.
3648 * It would be possible to send an IPv6 packet but the
3649 * response would never make it back to the application
3650 * since it is bound to a mapped address.
3651 */
3652 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
3653 error = EADDRNOTAVAIL;
3654 goto ud_error2;
3655 }
3656
3657 UDP_DBGSTAT(us, udp_out_ipv6);
3658
3659 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
3660 sin6->sin6_addr = ipv6_loopback;
3661 ipversion = IPV6_VERSION;
3662 } else {
3663 if (connp->conn_ipv6_v6only) {
3664 error = EADDRNOTAVAIL;
3665 goto ud_error2;
3666 }
3667
3668 /*
3669 * If the local address is not zero or a mapped address
3670 * return an error. It would be possible to send an
3671 * IPv4 packet but the response would never make it
3672 * back to the application since it is bound to a
3673 * non-mapped address.
3674 */
3675 if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
3676 !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
3677 error = EADDRNOTAVAIL;
3678 goto ud_error2;
3679 }
3680 UDP_DBGSTAT(us, udp_out_mapped);
3681
3682 if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
3683 V4_PART_OF_V6(sin6->sin6_addr) =
3684 htonl(INADDR_LOOPBACK);
3685 }
3686 ipversion = IPV4_VERSION;
3687 }
3688
3689 if (tudr->OPT_length != 0) {
3690 /*
3691 * If we are connected then the destination needs to be
3692 * the same as the connected one.
3693 */
3694 if (udp->udp_state == TS_DATA_XFER &&
3695 !conn_same_as_last_v6(connp, sin6)) {
3696 error = EISCONN;
3697 goto ud_error2;
3698 }
3699 UDP_STAT(us, udp_out_opt);
3700 error = udp_output_ancillary(connp, NULL, sin6,
3701 data_mp, mp, NULL, cr, pid);
3702 } else {
3703 ip_xmit_attr_t *ixa;
3704
3705 /*
3706 * We have to allocate an ip_xmit_attr_t before we grab
3707 * conn_lock and we need to hold conn_lock once we've
3708 * checked conn_same_as_last_v6 to handle concurrent
3709 * send* calls on a socket.
3710 */
3711 ixa = conn_get_ixa(connp, B_FALSE);
3712 if (ixa == NULL) {
3713 error = ENOMEM;
3714 goto ud_error2;
3715 }
3716 mutex_enter(&connp->conn_lock);
3717
3718 if (conn_same_as_last_v6(connp, sin6) &&
3719 connp->conn_lastsrcid == srcid &&
3720 ipsec_outbound_policy_current(ixa)) {
3721 UDP_DBGSTAT(us, udp_out_lastdst);
3722 /* udp_output_lastdst drops conn_lock */
3723 error = udp_output_lastdst(connp, data_mp, cr,
3724 pid, ixa);
3725 } else {
3726 UDP_DBGSTAT(us, udp_out_diffdst);
3727 /* udp_output_newdst drops conn_lock */
3728 error = udp_output_newdst(connp, data_mp, NULL,
3729 sin6, ipversion, cr, pid, ixa);
3730 }
3731 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3732 }
3733 if (error == 0) {
3734 freeb(mp);
3735 return;
3736 }
3737 break;
3738
3739 case AF_INET:
3740 sin = (sin_t *)addr;
3741 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
3742 (sin->sin_family != AF_INET)) {
3743 error = EADDRNOTAVAIL;
3744 goto ud_error2;
3745 }
3746 UDP_DBGSTAT(us, udp_out_ipv4);
3747 if (sin->sin_addr.s_addr == INADDR_ANY)
3748 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
3749 ipversion = IPV4_VERSION;
3750
3751 srcid = 0;
3752 if (tudr->OPT_length != 0) {
3753 /*
3754 * If we are connected then the destination needs to be
3755 * the same as the connected one.
3756 */
3757 if (udp->udp_state == TS_DATA_XFER &&
3758 !conn_same_as_last_v4(connp, sin)) {
3759 error = EISCONN;
3760 goto ud_error2;
3761 }
3762 UDP_STAT(us, udp_out_opt);
3763 error = udp_output_ancillary(connp, sin, NULL,
3764 data_mp, mp, NULL, cr, pid);
3765 } else {
3766 ip_xmit_attr_t *ixa;
3767
3768 /*
3769 * We have to allocate an ip_xmit_attr_t before we grab
3770 * conn_lock and we need to hold conn_lock once we've
3771 * checked conn_same_as_last_v4 to handle concurrent
3772 * send* calls on a socket.
3773 */
3774 ixa = conn_get_ixa(connp, B_FALSE);
3775 if (ixa == NULL) {
3776 error = ENOMEM;
3777 goto ud_error2;
3778 }
3779 mutex_enter(&connp->conn_lock);
3780
3781 if (conn_same_as_last_v4(connp, sin) &&
3782 ipsec_outbound_policy_current(ixa)) {
3783 UDP_DBGSTAT(us, udp_out_lastdst);
3784 /* udp_output_lastdst drops conn_lock */
3785 error = udp_output_lastdst(connp, data_mp, cr,
3786 pid, ixa);
3787 } else {
3788 UDP_DBGSTAT(us, udp_out_diffdst);
3789 /* udp_output_newdst drops conn_lock */
3790 error = udp_output_newdst(connp, data_mp, sin,
3791 NULL, ipversion, cr, pid, ixa);
3792 }
3793 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3794 }
3795 if (error == 0) {
3796 freeb(mp);
3797 return;
3798 }
3799 break;
3800 }
3801 UDP_STAT(us, udp_out_err_output);
3802 ASSERT(mp != NULL);
3803 /* mp is freed by the following routine */
3804 udp_ud_err(q, mp, (t_scalar_t)error);
3805 return;
3806
3807 ud_error2:
3808 UDPS_BUMP_MIB(us, udpOutErrors);
3809 freemsg(data_mp);
3810 UDP_STAT(us, udp_out_err_output);
3811 ASSERT(mp != NULL);
3812 /* mp is freed by the following routine */
3813 udp_ud_err(q, mp, (t_scalar_t)error);
3814 }
3815
3816 /*
3817 * Handle the case of the IP address, port, flow label being different
3818 * for both IPv4 and IPv6.
3819 *
3820 * NOTE: The caller must hold conn_lock and we drop it here.
3821 */
3822 static int
3823 udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
3824 ushort_t ipversion, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
3825 {
3826 uint_t srcid;
3827 uint32_t flowinfo;
3828 udp_t *udp = connp->conn_udp;
3829 int error = 0;
3830 ip_xmit_attr_t *oldixa;
3831 udp_stack_t *us = udp->udp_us;
3832 in6_addr_t v6src;
3833 in6_addr_t v6dst;
3834 in6_addr_t v6nexthop;
3835 in_port_t dstport;
3836
3837 ASSERT(MUTEX_HELD(&connp->conn_lock));
3838 ASSERT(ixa != NULL);
3839 /*
3840 * We hold conn_lock across all the use and modifications of
3841 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
3842 * stay consistent.
3843 */
3844
3845 ASSERT(cr != NULL);
3846 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3847 ixa->ixa_cred = cr;
3848 ixa->ixa_cpid = pid;
3849 if (is_system_labeled()) {
3850 /* We need to restart with a label based on the cred */
3851 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3852 }
3853
3854 /*
3855 * If we are connected then the destination needs to be the
3856 * same as the connected one, which is not the case here since we
3857 * checked for that above.
3858 */
3859 if (udp->udp_state == TS_DATA_XFER) {
3860 mutex_exit(&connp->conn_lock);
3861 error = EISCONN;
3862 goto ud_error;
3863 }
3864
3865 /* In case previous destination was multicast or multirt */
3866 ip_attr_newdst(ixa);
3867
3868 /*
3869 * If laddr is unspecified then we look at sin6_src_id.
3870 * We will give precedence to a source address set with IPV6_PKTINFO
3871 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3872 * want ip_attr_connect to select a source (since it can fail) when
3873 * IPV6_PKTINFO is specified.
3874 * If this doesn't result in a source address then we get a source
3875 * from ip_attr_connect() below.
3876 */
3877 v6src = connp->conn_saddr_v6;
3878 if (sin != NULL) {
3879 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3880 dstport = sin->sin_port;
3881 flowinfo = 0;
3882 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
3883 srcid = 0;
3884 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3885 ixa->ixa_flags |= IXAF_IS_IPV4;
3886 } else {
3887 boolean_t v4mapped;
3888
3889 v6dst = sin6->sin6_addr;
3890 dstport = sin6->sin6_port;
3891 flowinfo = sin6->sin6_flowinfo;
3892 srcid = sin6->__sin6_src_id;
3893 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3894 ixa->ixa_scopeid = sin6->sin6_scope_id;
3895 ixa->ixa_flags |= IXAF_SCOPEID_SET;
3896 } else {
3897 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3898 }
3899 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3900 if (v4mapped)
3901 ixa->ixa_flags |= IXAF_IS_IPV4;
3902 else
3903 ixa->ixa_flags &= ~IXAF_IS_IPV4;
3904 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3905 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3906 v4mapped, connp->conn_netstack)) {
3907 /* Mismatched v4mapped/v6 specified by srcid. */
3908 mutex_exit(&connp->conn_lock);
3909 error = EADDRNOTAVAIL;
3910 goto ud_error;
3911 }
3912 }
3913 }
3914 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3915 if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
3916 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
3917
3918 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3919 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3920 v6src = ipp->ipp_addr;
3921 } else {
3922 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3923 v6src = ipp->ipp_addr;
3924 }
3925 }
3926
3927 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
3928 mutex_exit(&connp->conn_lock);
3929
3930 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3931 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
3932 switch (error) {
3933 case 0:
3934 break;
3935 case EADDRNOTAVAIL:
3936 /*
3937 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3938 * Don't have the application see that errno
3939 */
3940 error = ENETUNREACH;
3941 goto failed;
3942 case ENETDOWN:
3943 /*
3944 * Have !ipif_addr_ready address; drop packet silently
3945 * until we can get applications to not send until we
3946 * are ready.
3947 */
3948 error = 0;
3949 goto failed;
3950 case EHOSTUNREACH:
3951 case ENETUNREACH:
3952 if (ixa->ixa_ire != NULL) {
3953 /*
3954 * Let conn_ip_output/ire_send_noroute return
3955 * the error and send any local ICMP error.
3956 */
3957 error = 0;
3958 break;
3959 }
3960 /* FALLTHRU */
3961 failed:
3962 default:
3963 goto ud_error;
3964 }
3965
3966
3967 /*
3968 * Cluster note: we let the cluster hook know that we are sending to a
3969 * new address and/or port.
3970 */
3971 if (cl_inet_connect2 != NULL) {
3972 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
3973 if (error != 0) {
3974 error = EHOSTUNREACH;
3975 goto ud_error;
3976 }
3977 }
3978
3979 mutex_enter(&connp->conn_lock);
3980 /*
3981 * While we dropped the lock some other thread might have connected
3982 * this socket. If so we bail out with EISCONN to ensure that the
3983 * connecting thread is the one that updates conn_ixa, conn_ht_*
3984 * and conn_*last*.
3985 */
3986 if (udp->udp_state == TS_DATA_XFER) {
3987 mutex_exit(&connp->conn_lock);
3988 error = EISCONN;
3989 goto ud_error;
3990 }
3991
3992 /*
3993 * We need to rebuild the headers if
3994 * - we are labeling packets (could be different for different
3995 * destinations)
3996 * - we have a source route (or routing header) since we need to
3997 * massage that to get the pseudo-header checksum
3998 * - the IP version is different than the last time
3999 * - a socket option with COA_HEADER_CHANGED has been set which
4000 * set conn_v6lastdst to zero.
4001 *
4002 * Otherwise the prepend function will just update the src, dst,
4003 * dstport, and flow label.
4004 */
4005 if (is_system_labeled()) {
4006 /* TX MLP requires SCM_UCRED and don't have that here */
4007 if (connp->conn_mlp_type != mlptSingle) {
4008 mutex_exit(&connp->conn_lock);
4009 error = ECONNREFUSED;
4010 goto ud_error;
4011 }
4012 /*
4013 * Check whether Trusted Solaris policy allows communication
4014 * with this host, and pretend that the destination is
4015 * unreachable if not.
4016 * Compute any needed label and place it in ipp_label_v4/v6.
4017 *
4018 * Later conn_build_hdr_template/conn_prepend_hdr takes
4019 * ipp_label_v4/v6 to form the packet.
4020 *
4021 * Tsol note: Since we hold conn_lock we know no other
4022 * thread manipulates conn_xmit_ipp.
4023 */
4024 error = conn_update_label(connp, ixa, &v6dst,
4025 &connp->conn_xmit_ipp);
4026 if (error != 0) {
4027 mutex_exit(&connp->conn_lock);
4028 goto ud_error;
4029 }
4030 /* Rebuild the header template */
4031 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
4032 flowinfo);
4033 if (error != 0) {
4034 mutex_exit(&connp->conn_lock);
4035 goto ud_error;
4036 }
4037 } else if ((connp->conn_xmit_ipp.ipp_fields &
4038 (IPPF_IPV4_OPTIONS|IPPF_RTHDR)) ||
4039 ipversion != connp->conn_lastipversion ||
4040 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
4041 /* Rebuild the header template */
4042 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
4043 flowinfo);
4044 if (error != 0) {
4045 mutex_exit(&connp->conn_lock);
4046 goto ud_error;
4047 }
4048 } else {
4049 /* Simply update the destination address if no source route */
4050 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4051 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc;
4052
4053 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
4054 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
4055 ipha->ipha_fragment_offset_and_flags |=
4056 IPH_DF_HTONS;
4057 } else {
4058 ipha->ipha_fragment_offset_and_flags &=
4059 ~IPH_DF_HTONS;
4060 }
4061 } else {
4062 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
4063 ip6h->ip6_dst = v6dst;
4064 }
4065 }
4066
4067 /*
4068 * Remember the dst/dstport etc which corresponds to the built header
4069 * template and conn_ixa.
4070 */
4071 oldixa = conn_replace_ixa(connp, ixa);
4072 connp->conn_v6lastdst = v6dst;
4073 connp->conn_lastipversion = ipversion;
4074 connp->conn_lastdstport = dstport;
4075 connp->conn_lastflowinfo = flowinfo;
4076 connp->conn_lastscopeid = ixa->ixa_scopeid;
4077 connp->conn_lastsrcid = srcid;
4078 /* Also remember a source to use together with lastdst */
4079 connp->conn_v6lastsrc = v6src;
4080
4081 data_mp = udp_prepend_header_template(connp, ixa, data_mp, &v6src,
4082 dstport, flowinfo, &error);
4083
4084 /* Done with conn_t */
4085 mutex_exit(&connp->conn_lock);
4086 ixa_refrele(oldixa);
4087
4088 if (data_mp == NULL) {
4089 ASSERT(error != 0);
4090 goto ud_error;
4091 }
4092
4093 /* We're done. Pass the packet to ip. */
4094 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
4095
4096 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
4097 void_ip_t *, data_mp->b_rptr, udp_t *, udp, udpha_t *,
4098 &data_mp->b_rptr[ixa->ixa_ip_hdr_length]);
4099
4100 error = conn_ip_output(data_mp, ixa);
4101 /* No udpOutErrors if an error since IP increases its error counter */
4102 switch (error) {
4103 case 0:
4104 break;
4105 case EWOULDBLOCK:
4106 (void) ixa_check_drain_insert(connp, ixa);
4107 error = 0;
4108 break;
4109 case EADDRNOTAVAIL:
4110 /*
4111 * IXAF_VERIFY_SOURCE tells us to pick a better source.
4112 * Don't have the application see that errno
4113 */
4114 error = ENETUNREACH;
4115 /* FALLTHRU */
4116 default:
4117 mutex_enter(&connp->conn_lock);
4118 /*
4119 * Clear the source and v6lastdst so we call ip_attr_connect
4120 * for the next packet and try to pick a better source.
4121 */
4122 if (connp->conn_mcbc_bind)
4123 connp->conn_saddr_v6 = ipv6_all_zeros;
4124 else
4125 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
4126 connp->conn_v6lastdst = ipv6_all_zeros;
4127 mutex_exit(&connp->conn_lock);
4128 break;
4129 }
4130 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4131 ixa->ixa_cred = connp->conn_cred; /* Restore */
4132 ixa->ixa_cpid = connp->conn_cpid;
4133 ixa_refrele(ixa);
4134 return (error);
4135
4136 ud_error:
4137 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4138 ixa->ixa_cred = connp->conn_cred; /* Restore */
4139 ixa->ixa_cpid = connp->conn_cpid;
4140 ixa_refrele(ixa);
4141
4142 freemsg(data_mp);
4143 UDPS_BUMP_MIB(us, udpOutErrors);
4144 UDP_STAT(us, udp_out_err_output);
4145 return (error);
4146 }
4147
4148 /* ARGSUSED */
4149 static void
4150 udp_wput_fallback(queue_t *wq, mblk_t *mp)
4151 {
4152 #ifdef DEBUG
4153 cmn_err(CE_CONT, "udp_wput_fallback: Message in fallback \n");
4154 #endif
4155 freemsg(mp);
4156 }
4157
4158
4159 /*
4160 * Handle special out-of-band ioctl requests (see PSARC/2008/265).
4161 */
4162 static void
4163 udp_wput_cmdblk(queue_t *q, mblk_t *mp)
4164 {
4165 void *data;
4166 mblk_t *datamp = mp->b_cont;
4167 conn_t *connp = Q_TO_CONN(q);
4168 udp_t *udp = connp->conn_udp;
4169 cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr;
4170
4171 if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) {
4172 cmdp->cb_error = EPROTO;
4173 qreply(q, mp);
4174 return;
4175 }
4176 data = datamp->b_rptr;
4177
4178 mutex_enter(&connp->conn_lock);
4179 switch (cmdp->cb_cmd) {
4180 case TI_GETPEERNAME:
4181 if (udp->udp_state != TS_DATA_XFER)
4182 cmdp->cb_error = ENOTCONN;
4183 else
4184 cmdp->cb_error = conn_getpeername(connp, data,
4185 &cmdp->cb_len);
4186 break;
4187 case TI_GETMYNAME:
4188 cmdp->cb_error = conn_getsockname(connp, data, &cmdp->cb_len);
4189 break;
4190 default:
4191 cmdp->cb_error = EINVAL;
4192 break;
4193 }
4194 mutex_exit(&connp->conn_lock);
4195
4196 qreply(q, mp);
4197 }
4198
4199 static void
4200 udp_use_pure_tpi(udp_t *udp)
4201 {
4202 conn_t *connp = udp->udp_connp;
4203
4204 mutex_enter(&connp->conn_lock);
4205 udp->udp_issocket = B_FALSE;
4206 mutex_exit(&connp->conn_lock);
4207 UDP_STAT(udp->udp_us, udp_sock_fallback);
4208 }
4209
4210 static void
4211 udp_wput_other(queue_t *q, mblk_t *mp)
4212 {
4213 uchar_t *rptr = mp->b_rptr;
4214 struct iocblk *iocp;
4215 conn_t *connp = Q_TO_CONN(q);
4216 udp_t *udp = connp->conn_udp;
4217 cred_t *cr;
4218
4219 switch (mp->b_datap->db_type) {
4220 case M_CMD:
4221 udp_wput_cmdblk(q, mp);
4222 return;
4223
4224 case M_PROTO:
4225 case M_PCPROTO:
4226 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4227 /*
4228 * If the message does not contain a PRIM_type,
4229 * throw it away.
4230 */
4231 freemsg(mp);
4232 return;
4233 }
4234 switch (((t_primp_t)rptr)->type) {
4235 case T_ADDR_REQ:
4236 udp_addr_req(q, mp);
4237 return;
4238 case O_T_BIND_REQ:
4239 case T_BIND_REQ:
4240 udp_tpi_bind(q, mp);
4241 return;
4242 case T_CONN_REQ:
4243 udp_tpi_connect(q, mp);
4244 return;
4245 case T_CAPABILITY_REQ:
4246 udp_capability_req(q, mp);
4247 return;
4248 case T_INFO_REQ:
4249 udp_info_req(q, mp);
4250 return;
4251 case T_UNITDATA_REQ:
4252 /*
4253 * If a T_UNITDATA_REQ gets here, the address must
4254 * be bad. Valid T_UNITDATA_REQs are handled
4255 * in udp_wput.
4256 */
4257 udp_ud_err(q, mp, EADDRNOTAVAIL);
4258 return;
4259 case T_UNBIND_REQ:
4260 udp_tpi_unbind(q, mp);
4261 return;
4262 case T_SVR4_OPTMGMT_REQ:
4263 /*
4264 * All Solaris components should pass a db_credp
4265 * for this TPI message, hence we ASSERT.
4266 * But in case there is some other M_PROTO that looks
4267 * like a TPI message sent by some other kernel
4268 * component, we check and return an error.
4269 */
4270 cr = msg_getcred(mp, NULL);
4271 ASSERT(cr != NULL);
4272 if (cr == NULL) {
4273 udp_err_ack(q, mp, TSYSERR, EINVAL);
4274 return;
4275 }
4276 if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
4277 cr)) {
4278 svr4_optcom_req(q, mp, cr, &udp_opt_obj);
4279 }
4280 return;
4281
4282 case T_OPTMGMT_REQ:
4283 /*
4284 * All Solaris components should pass a db_credp
4285 * for this TPI message, hence we ASSERT.
4286 * But in case there is some other M_PROTO that looks
4287 * like a TPI message sent by some other kernel
4288 * component, we check and return an error.
4289 */
4290 cr = msg_getcred(mp, NULL);
4291 ASSERT(cr != NULL);
4292 if (cr == NULL) {
4293 udp_err_ack(q, mp, TSYSERR, EINVAL);
4294 return;
4295 }
4296 tpi_optcom_req(q, mp, cr, &udp_opt_obj);
4297 return;
4298
4299 case T_DISCON_REQ:
4300 udp_tpi_disconnect(q, mp);
4301 return;
4302
4303 /* The following TPI message is not supported by udp. */
4304 case O_T_CONN_RES:
4305 case T_CONN_RES:
4306 udp_err_ack(q, mp, TNOTSUPPORT, 0);
4307 return;
4308
4309 /* The following 3 TPI requests are illegal for udp. */
4310 case T_DATA_REQ:
4311 case T_EXDATA_REQ:
4312 case T_ORDREL_REQ:
4313 udp_err_ack(q, mp, TNOTSUPPORT, 0);
4314 return;
4315 default:
4316 break;
4317 }
4318 break;
4319 case M_FLUSH:
4320 if (*rptr & FLUSHW)
4321 flushq(q, FLUSHDATA);
4322 break;
4323 case M_IOCTL:
4324 iocp = (struct iocblk *)mp->b_rptr;
4325 switch (iocp->ioc_cmd) {
4326 case TI_GETPEERNAME:
4327 if (udp->udp_state != TS_DATA_XFER) {
4328 /*
4329 * If a default destination address has not
4330 * been associated with the stream, then we
4331 * don't know the peer's name.
4332 */
4333 iocp->ioc_error = ENOTCONN;
4334 iocp->ioc_count = 0;
4335 mp->b_datap->db_type = M_IOCACK;
4336 qreply(q, mp);
4337 return;
4338 }
4339 /* FALLTHRU */
4340 case TI_GETMYNAME:
4341 /*
4342 * For TI_GETPEERNAME and TI_GETMYNAME, we first
4343 * need to copyin the user's strbuf structure.
4344 * Processing will continue in the M_IOCDATA case
4345 * below.
4346 */
4347 mi_copyin(q, mp, NULL,
4348 SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4349 return;
4350 case _SIOCSOCKFALLBACK:
4351 /*
4352 * Either sockmod is about to be popped and the
4353 * socket would now be treated as a plain stream,
4354 * or a module is about to be pushed so we have
4355 * to follow pure TPI semantics.
4356 */
4357 if (!udp->udp_issocket) {
4358 DB_TYPE(mp) = M_IOCNAK;
4359 iocp->ioc_error = EINVAL;
4360 } else {
4361 udp_use_pure_tpi(udp);
4362
4363 DB_TYPE(mp) = M_IOCACK;
4364 iocp->ioc_error = 0;
4365 }
4366 iocp->ioc_count = 0;
4367 iocp->ioc_rval = 0;
4368 qreply(q, mp);
4369 return;
4370 default:
4371 break;
4372 }
4373 break;
4374 case M_IOCDATA:
4375 udp_wput_iocdata(q, mp);
4376 return;
4377 default:
4378 /* Unrecognized messages are passed through without change. */
4379 break;
4380 }
4381 ip_wput_nondata(q, mp);
4382 }
4383
4384 /*
4385 * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
4386 * messages.
4387 */
4388 static void
4389 udp_wput_iocdata(queue_t *q, mblk_t *mp)
4390 {
4391 mblk_t *mp1;
4392 struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
4393 STRUCT_HANDLE(strbuf, sb);
4394 uint_t addrlen;
4395 conn_t *connp = Q_TO_CONN(q);
4396 udp_t *udp = connp->conn_udp;
4397
4398 /* Make sure it is one of ours. */
4399 switch (iocp->ioc_cmd) {
4400 case TI_GETMYNAME:
4401 case TI_GETPEERNAME:
4402 break;
4403 default:
4404 ip_wput_nondata(q, mp);
4405 return;
4406 }
4407
4408 switch (mi_copy_state(q, mp, &mp1)) {
4409 case -1:
4410 return;
4411 case MI_COPY_CASE(MI_COPY_IN, 1):
4412 break;
4413 case MI_COPY_CASE(MI_COPY_OUT, 1):
4414 /*
4415 * The address has been copied out, so now
4416 * copyout the strbuf.
4417 */
4418 mi_copyout(q, mp);
4419 return;
4420 case MI_COPY_CASE(MI_COPY_OUT, 2):
4421 /*
4422 * The address and strbuf have been copied out.
4423 * We're done, so just acknowledge the original
4424 * M_IOCTL.
4425 */
4426 mi_copy_done(q, mp, 0);
4427 return;
4428 default:
4429 /*
4430 * Something strange has happened, so acknowledge
4431 * the original M_IOCTL with an EPROTO error.
4432 */
4433 mi_copy_done(q, mp, EPROTO);
4434 return;
4435 }
4436
4437 /*
4438 * Now we have the strbuf structure for TI_GETMYNAME
4439 * and TI_GETPEERNAME. Next we copyout the requested
4440 * address and then we'll copyout the strbuf.
4441 */
4442 STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr);
4443
4444 if (connp->conn_family == AF_INET)
4445 addrlen = sizeof (sin_t);
4446 else
4447 addrlen = sizeof (sin6_t);
4448
4449 if (STRUCT_FGET(sb, maxlen) < addrlen) {
4450 mi_copy_done(q, mp, EINVAL);
4451 return;
4452 }
4453
4454 switch (iocp->ioc_cmd) {
4455 case TI_GETMYNAME:
4456 break;
4457 case TI_GETPEERNAME:
4458 if (udp->udp_state != TS_DATA_XFER) {
4459 mi_copy_done(q, mp, ENOTCONN);
4460 return;
4461 }
4462 break;
4463 }
4464 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4465 if (!mp1)
4466 return;
4467
4468 STRUCT_FSET(sb, len, addrlen);
4469 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4470 case TI_GETMYNAME:
4471 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4472 &addrlen);
4473 break;
4474 case TI_GETPEERNAME:
4475 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4476 &addrlen);
4477 break;
4478 }
4479 mp1->b_wptr += addrlen;
4480 /* Copy out the address */
4481 mi_copyout(q, mp);
4482 }
4483
4484 void
4485 udp_ddi_g_init(void)
4486 {
4487 udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
4488 udp_opt_obj.odb_opt_arr_cnt);
4489
4490 /*
4491 * We want to be informed each time a stack is created or
4492 * destroyed in the kernel, so we can maintain the
4493 * set of udp_stack_t's.
4494 */
4495 netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
4496 }
4497
4498 void
4499 udp_ddi_g_destroy(void)
4500 {
4501 netstack_unregister(NS_UDP);
4502 }
4503
4504 #define INET_NAME "ip"
4505
4506 /*
4507 * Initialize the UDP stack instance.
4508 */
4509 static void *
4510 udp_stack_init(netstackid_t stackid, netstack_t *ns)
4511 {
4512 udp_stack_t *us;
4513 int i;
4514 int error = 0;
4515 major_t major;
4516 size_t arrsz;
4517
4518 us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
4519 us->us_netstack = ns;
4520
4521 mutex_init(&us->us_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
4522 us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
4523 us->us_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
4524 us->us_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
4525
4526 /*
4527 * The smallest anonymous port in the priviledged port range which UDP
4528 * looks for free port. Use in the option UDP_ANONPRIVBIND.
4529 */
4530 us->us_min_anonpriv_port = 512;
4531
4532 us->us_bind_fanout_size = udp_bind_fanout_size;
4533
4534 /* Roundup variable that might have been modified in /etc/system */
4535 if (!ISP2(us->us_bind_fanout_size)) {
4536 /* Not a power of two. Round up to nearest power of two */
4537 for (i = 0; i < 31; i++) {
4538 if (us->us_bind_fanout_size < (1 << i))
4539 break;
4540 }
4541 us->us_bind_fanout_size = 1 << i;
4542 }
4543 us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
4544 sizeof (udp_fanout_t), KM_SLEEP);
4545 for (i = 0; i < us->us_bind_fanout_size; i++) {
4546 mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
4547 NULL);
4548 }
4549
4550 arrsz = udp_propinfo_count * sizeof (mod_prop_info_t);
4551 us->us_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
4552 KM_SLEEP);
4553 bcopy(udp_propinfo_tbl, us->us_propinfo_tbl, arrsz);
4554
4555 /* Allocate the per netstack stats */
4556 mutex_enter(&cpu_lock);
4557 us->us_sc_cnt = MAX(ncpus, boot_ncpus);
4558 mutex_exit(&cpu_lock);
4559 us->us_sc = kmem_zalloc(max_ncpus * sizeof (udp_stats_cpu_t *),
4560 KM_SLEEP);
4561 for (i = 0; i < us->us_sc_cnt; i++) {
4562 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4563 KM_SLEEP);
4564 }
4565
4566 us->us_kstat = udp_kstat2_init(stackid);
4567 us->us_mibkp = udp_kstat_init(stackid);
4568
4569 major = mod_name_to_major(INET_NAME);
4570 error = ldi_ident_from_major(major, &us->us_ldi_ident);
4571 ASSERT(error == 0);
4572 return (us);
4573 }
4574
4575 /*
4576 * Free the UDP stack instance.
4577 */
4578 static void
4579 udp_stack_fini(netstackid_t stackid, void *arg)
4580 {
4581 udp_stack_t *us = (udp_stack_t *)arg;
4582 int i;
4583
4584 for (i = 0; i < us->us_bind_fanout_size; i++) {
4585 mutex_destroy(&us->us_bind_fanout[i].uf_lock);
4586 }
4587
4588 kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
4589 sizeof (udp_fanout_t));
4590
4591 us->us_bind_fanout = NULL;
4592
4593 for (i = 0; i < us->us_sc_cnt; i++)
4594 kmem_free(us->us_sc[i], sizeof (udp_stats_cpu_t));
4595 kmem_free(us->us_sc, max_ncpus * sizeof (udp_stats_cpu_t *));
4596
4597 kmem_free(us->us_propinfo_tbl,
4598 udp_propinfo_count * sizeof (mod_prop_info_t));
4599 us->us_propinfo_tbl = NULL;
4600
4601 udp_kstat_fini(stackid, us->us_mibkp);
4602 us->us_mibkp = NULL;
4603
4604 udp_kstat2_fini(stackid, us->us_kstat);
4605 us->us_kstat = NULL;
4606
4607 mutex_destroy(&us->us_epriv_port_lock);
4608 ldi_ident_release(us->us_ldi_ident);
4609 kmem_free(us, sizeof (*us));
4610 }
4611
4612 static size_t
4613 udp_set_rcv_hiwat(udp_t *udp, size_t size)
4614 {
4615 udp_stack_t *us = udp->udp_us;
4616
4617 /* We add a bit of extra buffering */
4618 size += size >> 1;
4619 if (size > us->us_max_buf)
4620 size = us->us_max_buf;
4621
4622 udp->udp_rcv_hiwat = size;
4623 return (size);
4624 }
4625
4626 /*
4627 * For the lower queue so that UDP can be a dummy mux.
4628 * Nobody should be sending
4629 * packets up this stream
4630 */
4631 static void
4632 udp_lrput(queue_t *q, mblk_t *mp)
4633 {
4634 switch (mp->b_datap->db_type) {
4635 case M_FLUSH:
4636 /* Turn around */
4637 if (*mp->b_rptr & FLUSHW) {
4638 *mp->b_rptr &= ~FLUSHR;
4639 qreply(q, mp);
4640 return;
4641 }
4642 break;
4643 }
4644 freemsg(mp);
4645 }
4646
4647 /*
4648 * For the lower queue so that UDP can be a dummy mux.
4649 * Nobody should be sending packets down this stream.
4650 */
4651 /* ARGSUSED */
4652 void
4653 udp_lwput(queue_t *q, mblk_t *mp)
4654 {
4655 freemsg(mp);
4656 }
4657
4658 /*
4659 * When a CPU is added, we need to allocate the per CPU stats struct.
4660 */
4661 void
4662 udp_stack_cpu_add(udp_stack_t *us, processorid_t cpu_seqid)
4663 {
4664 int i;
4665
4666 if (cpu_seqid < us->us_sc_cnt)
4667 return;
4668 for (i = us->us_sc_cnt; i <= cpu_seqid; i++) {
4669 ASSERT(us->us_sc[i] == NULL);
4670 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4671 KM_SLEEP);
4672 }
4673 membar_producer();
4674 us->us_sc_cnt = cpu_seqid + 1;
4675 }
4676
4677 /*
4678 * Below routines for UDP socket module.
4679 */
4680
4681 static conn_t *
4682 udp_do_open(cred_t *credp, boolean_t isv6, int flags, int *errorp)
4683 {
4684 udp_t *udp;
4685 conn_t *connp;
4686 zoneid_t zoneid;
4687 netstack_t *ns;
4688 udp_stack_t *us;
4689 int len;
4690
4691 ASSERT(errorp != NULL);
4692
4693 if ((*errorp = secpolicy_basic_net_access(credp)) != 0)
4694 return (NULL);
4695
4696 ns = netstack_find_by_cred(credp);
4697 ASSERT(ns != NULL);
4698 us = ns->netstack_udp;
4699 ASSERT(us != NULL);
4700
4701 /*
4702 * For exclusive stacks we set the zoneid to zero
4703 * to make UDP operate as if in the global zone.
4704 */
4705 if (ns->netstack_stackid != GLOBAL_NETSTACKID)
4706 zoneid = GLOBAL_ZONEID;
4707 else
4708 zoneid = crgetzoneid(credp);
4709
4710 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
4711
4712 connp = ipcl_conn_create(IPCL_UDPCONN, flags, ns);
4713 if (connp == NULL) {
4714 netstack_rele(ns);
4715 *errorp = ENOMEM;
4716 return (NULL);
4717 }
4718 udp = connp->conn_udp;
4719
4720 /*
4721 * ipcl_conn_create did a netstack_hold. Undo the hold that was
4722 * done by netstack_find_by_cred()
4723 */
4724 netstack_rele(ns);
4725
4726 /*
4727 * Since this conn_t/udp_t is not yet visible to anybody else we don't
4728 * need to lock anything.
4729 */
4730 ASSERT(connp->conn_proto == IPPROTO_UDP);
4731 ASSERT(connp->conn_udp == udp);
4732 ASSERT(udp->udp_connp == connp);
4733
4734 /* Set the initial state of the stream and the privilege status. */
4735 udp->udp_state = TS_UNBND;
4736 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
4737 if (isv6) {
4738 connp->conn_family = AF_INET6;
4739 connp->conn_ipversion = IPV6_VERSION;
4740 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4741 connp->conn_default_ttl = us->us_ipv6_hoplimit;
4742 len = sizeof (ip6_t) + UDPH_SIZE;
4743 } else {
4744 connp->conn_family = AF_INET;
4745 connp->conn_ipversion = IPV4_VERSION;
4746 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4747 connp->conn_default_ttl = us->us_ipv4_ttl;
4748 len = sizeof (ipha_t) + UDPH_SIZE;
4749 }
4750
4751 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
4752 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
4753
4754 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
4755 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
4756 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
4757 connp->conn_ixa->ixa_zoneid = zoneid;
4758
4759 connp->conn_zoneid = zoneid;
4760
4761 /*
4762 * If the caller has the process-wide flag set, then default to MAC
4763 * exempt mode. This allows read-down to unlabeled hosts.
4764 */
4765 if (getpflags(NET_MAC_AWARE, credp) != 0)
4766 connp->conn_mac_mode = CONN_MAC_AWARE;
4767
4768 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
4769
4770 udp->udp_us = us;
4771
4772 connp->conn_rcvbuf = us->us_recv_hiwat;
4773 connp->conn_sndbuf = us->us_xmit_hiwat;
4774 connp->conn_sndlowat = us->us_xmit_lowat;
4775 connp->conn_rcvlowat = udp_mod_info.mi_lowat;
4776
4777 connp->conn_wroff = len + us->us_wroff_extra;
4778 connp->conn_so_type = SOCK_DGRAM;
4779
4780 connp->conn_recv = udp_input;
4781 connp->conn_recvicmp = udp_icmp_input;
4782 crhold(credp);
4783 connp->conn_cred = credp;
4784 connp->conn_cpid = curproc->p_pid;
4785 connp->conn_open_time = ddi_get_lbolt64();
4786 /* Cache things in ixa without an extra refhold */
4787 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
4788 connp->conn_ixa->ixa_cred = connp->conn_cred;
4789 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
4790 if (is_system_labeled())
4791 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
4792
4793 *((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
4794
4795 if (us->us_pmtu_discovery)
4796 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
4797
4798 return (connp);
4799 }
4800
4801 sock_lower_handle_t
4802 udp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
4803 uint_t *smodep, int *errorp, int flags, cred_t *credp)
4804 {
4805 udp_t *udp = NULL;
4806 udp_stack_t *us;
4807 conn_t *connp;
4808 boolean_t isv6;
4809
4810 if (type != SOCK_DGRAM || (family != AF_INET && family != AF_INET6) ||
4811 (proto != 0 && proto != IPPROTO_UDP)) {
4812 *errorp = EPROTONOSUPPORT;
4813 return (NULL);
4814 }
4815
4816 if (family == AF_INET6)
4817 isv6 = B_TRUE;
4818 else
4819 isv6 = B_FALSE;
4820
4821 connp = udp_do_open(credp, isv6, flags, errorp);
4822 if (connp == NULL)
4823 return (NULL);
4824
4825 udp = connp->conn_udp;
4826 ASSERT(udp != NULL);
4827 us = udp->udp_us;
4828 ASSERT(us != NULL);
4829
4830 udp->udp_issocket = B_TRUE;
4831 connp->conn_flags |= IPCL_NONSTR;
4832
4833 /*
4834 * Set flow control
4835 * Since this conn_t/udp_t is not yet visible to anybody else we don't
4836 * need to lock anything.
4837 */
4838 (void) udp_set_rcv_hiwat(udp, connp->conn_rcvbuf);
4839 udp->udp_rcv_disply_hiwat = connp->conn_rcvbuf;
4840
4841 connp->conn_flow_cntrld = B_FALSE;
4842
4843 mutex_enter(&connp->conn_lock);
4844 connp->conn_state_flags &= ~CONN_INCIPIENT;
4845 mutex_exit(&connp->conn_lock);
4846
4847 *errorp = 0;
4848 *smodep = SM_ATOMIC;
4849 *sock_downcalls = &sock_udp_downcalls;
4850 return ((sock_lower_handle_t)connp);
4851 }
4852
4853 /* ARGSUSED3 */
4854 void
4855 udp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle,
4856 sock_upcalls_t *sock_upcalls, int flags, cred_t *cr)
4857 {
4858 conn_t *connp = (conn_t *)proto_handle;
4859 struct sock_proto_props sopp;
4860
4861 /* All Solaris components should pass a cred for this operation. */
4862 ASSERT(cr != NULL);
4863
4864 connp->conn_upcalls = sock_upcalls;
4865 connp->conn_upper_handle = sock_handle;
4866
4867 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
4868 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
4869 sopp.sopp_wroff = connp->conn_wroff;
4870 sopp.sopp_maxblk = INFPSZ;
4871 sopp.sopp_rxhiwat = connp->conn_rcvbuf;
4872 sopp.sopp_rxlowat = connp->conn_rcvlowat;
4873 sopp.sopp_maxaddrlen = sizeof (sin6_t);
4874 sopp.sopp_maxpsz =
4875 (connp->conn_family == AF_INET) ? UDP_MAXPACKET_IPV4 :
4876 UDP_MAXPACKET_IPV6;
4877 sopp.sopp_minpsz = (udp_mod_info.mi_minpsz == 1) ? 0 :
4878 udp_mod_info.mi_minpsz;
4879
4880 (*connp->conn_upcalls->su_set_proto_props)(connp->conn_upper_handle,
4881 &sopp);
4882 }
4883
4884 static void
4885 udp_do_close(conn_t *connp)
4886 {
4887 udp_t *udp;
4888
4889 ASSERT(connp != NULL && IPCL_IS_UDP(connp));
4890 udp = connp->conn_udp;
4891
4892 if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
4893 /*
4894 * Running in cluster mode - register unbind information
4895 */
4896 if (connp->conn_ipversion == IPV4_VERSION) {
4897 (*cl_inet_unbind)(
4898 connp->conn_netstack->netstack_stackid,
4899 IPPROTO_UDP, AF_INET,
4900 (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
4901 (in_port_t)connp->conn_lport, NULL);
4902 } else {
4903 (*cl_inet_unbind)(
4904 connp->conn_netstack->netstack_stackid,
4905 IPPROTO_UDP, AF_INET6,
4906 (uint8_t *)&(connp->conn_laddr_v6),
4907 (in_port_t)connp->conn_lport, NULL);
4908 }
4909 }
4910
4911 udp_bind_hash_remove(udp, B_FALSE);
4912
4913 ip_quiesce_conn(connp);
4914
4915 if (!IPCL_IS_NONSTR(connp)) {
4916 ASSERT(connp->conn_wq != NULL);
4917 ASSERT(connp->conn_rq != NULL);
4918 qprocsoff(connp->conn_rq);
4919 }
4920
4921 udp_close_free(connp);
4922
4923 /*
4924 * Now we are truly single threaded on this stream, and can
4925 * delete the things hanging off the connp, and finally the connp.
4926 * We removed this connp from the fanout list, it cannot be
4927 * accessed thru the fanouts, and we already waited for the
4928 * conn_ref to drop to 0. We are already in close, so
4929 * there cannot be any other thread from the top. qprocsoff
4930 * has completed, and service has completed or won't run in
4931 * future.
4932 */
4933 ASSERT(connp->conn_ref == 1);
4934
4935 if (!IPCL_IS_NONSTR(connp)) {
4936 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4937 } else {
4938 ip_free_helper_stream(connp);
4939 }
4940
4941 connp->conn_ref--;
4942 ipcl_conn_destroy(connp);
4943 }
4944
4945 /* ARGSUSED1 */
4946 int
4947 udp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
4948 {
4949 conn_t *connp = (conn_t *)proto_handle;
4950
4951 /* All Solaris components should pass a cred for this operation. */
4952 ASSERT(cr != NULL);
4953
4954 udp_do_close(connp);
4955 return (0);
4956 }
4957
4958 static int
4959 udp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4960 boolean_t bind_to_req_port_only)
4961 {
4962 sin_t *sin;
4963 sin6_t *sin6;
4964 udp_t *udp = connp->conn_udp;
4965 int error = 0;
4966 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */
4967 in_port_t port; /* Host byte order */
4968 in_port_t requested_port; /* Host byte order */
4969 int count;
4970 ipaddr_t v4src; /* Set if AF_INET */
4971 in6_addr_t v6src;
4972 int loopmax;
4973 udp_fanout_t *udpf;
4974 in_port_t lport; /* Network byte order */
4975 uint_t scopeid = 0;
4976 zoneid_t zoneid = IPCL_ZONEID(connp);
4977 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
4978 boolean_t is_inaddr_any;
4979 mlp_type_t addrtype, mlptype;
4980 udp_stack_t *us = udp->udp_us;
4981
4982 switch (len) {
4983 case sizeof (sin_t): /* Complete IPv4 address */
4984 sin = (sin_t *)sa;
4985
4986 if (sin == NULL || !OK_32PTR((char *)sin))
4987 return (EINVAL);
4988
4989 if (connp->conn_family != AF_INET ||
4990 sin->sin_family != AF_INET) {
4991 return (EAFNOSUPPORT);
4992 }
4993 v4src = sin->sin_addr.s_addr;
4994 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
4995 if (v4src != INADDR_ANY) {
4996 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
4997 B_TRUE);
4998 }
4999 port = ntohs(sin->sin_port);
5000 break;
5001
5002 case sizeof (sin6_t): /* complete IPv6 address */
5003 sin6 = (sin6_t *)sa;
5004
5005 if (sin6 == NULL || !OK_32PTR((char *)sin6))
5006 return (EINVAL);
5007
5008 if (connp->conn_family != AF_INET6 ||
5009 sin6->sin6_family != AF_INET6) {
5010 return (EAFNOSUPPORT);
5011 }
5012 v6src = sin6->sin6_addr;
5013 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
5014 if (connp->conn_ipv6_v6only)
5015 return (EADDRNOTAVAIL);
5016
5017 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
5018 if (v4src != INADDR_ANY) {
5019 laddr_type = ip_laddr_verify_v4(v4src,
5020 zoneid, ipst, B_FALSE);
5021 }
5022 } else {
5023 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5024 if (IN6_IS_ADDR_LINKSCOPE(&v6src))
5025 scopeid = sin6->sin6_scope_id;
5026 laddr_type = ip_laddr_verify_v6(&v6src,
5027 zoneid, ipst, B_TRUE, scopeid);
5028 }
5029 }
5030 port = ntohs(sin6->sin6_port);
5031 break;
5032
5033 default: /* Invalid request */
5034 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5035 "udp_bind: bad ADDR_length length %u", len);
5036 return (-TBADADDR);
5037 }
5038
5039 /* Is the local address a valid unicast, multicast, or broadcast? */
5040 if (laddr_type == IPVL_BAD)
5041 return (EADDRNOTAVAIL);
5042
5043 requested_port = port;
5044
5045 if (requested_port == 0 || !bind_to_req_port_only)
5046 bind_to_req_port_only = B_FALSE;
5047 else /* T_BIND_REQ and requested_port != 0 */
5048 bind_to_req_port_only = B_TRUE;
5049
5050 if (requested_port == 0) {
5051 /*
5052 * If the application passed in zero for the port number, it
5053 * doesn't care which port number we bind to. Get one in the
5054 * valid range.
5055 */
5056 if (connp->conn_anon_priv_bind) {
5057 port = udp_get_next_priv_port(udp);
5058 } else {
5059 port = udp_update_next_port(udp,
5060 us->us_next_port_to_try, B_TRUE);
5061 }
5062 } else {
5063 /*
5064 * If the port is in the well-known privileged range,
5065 * make sure the caller was privileged.
5066 */
5067 int i;
5068 boolean_t priv = B_FALSE;
5069
5070 if (port < us->us_smallest_nonpriv_port) {
5071 priv = B_TRUE;
5072 } else {
5073 for (i = 0; i < us->us_num_epriv_ports; i++) {
5074 if (port == us->us_epriv_ports[i]) {
5075 priv = B_TRUE;
5076 break;
5077 }
5078 }
5079 }
5080
5081 if (priv) {
5082 if (secpolicy_net_privaddr(cr, port, IPPROTO_UDP) != 0)
5083 return (-TACCES);
5084 }
5085 }
5086
5087 if (port == 0)
5088 return (-TNOADDR);
5089
5090 /*
5091 * The state must be TS_UNBND. TPI mandates that users must send
5092 * TPI primitives only 1 at a time and wait for the response before
5093 * sending the next primitive.
5094 */
5095 mutex_enter(&connp->conn_lock);
5096 if (udp->udp_state != TS_UNBND) {
5097 mutex_exit(&connp->conn_lock);
5098 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5099 "udp_bind: bad state, %u", udp->udp_state);
5100 return (-TOUTSTATE);
5101 }
5102 /*
5103 * Copy the source address into our udp structure. This address
5104 * may still be zero; if so, IP will fill in the correct address
5105 * each time an outbound packet is passed to it. Since the udp is
5106 * not yet in the bind hash list, we don't grab the uf_lock to
5107 * change conn_ipversion
5108 */
5109 if (connp->conn_family == AF_INET) {
5110 ASSERT(sin != NULL);
5111 ASSERT(connp->conn_ixa->ixa_flags & IXAF_IS_IPV4);
5112 } else {
5113 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
5114 /*
5115 * no need to hold the uf_lock to set the conn_ipversion
5116 * since we are not yet in the fanout list
5117 */
5118 connp->conn_ipversion = IPV4_VERSION;
5119 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
5120 } else {
5121 connp->conn_ipversion = IPV6_VERSION;
5122 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
5123 }
5124 }
5125
5126 /*
5127 * If conn_reuseaddr is not set, then we have to make sure that
5128 * the IP address and port number the application requested
5129 * (or we selected for the application) is not being used by
5130 * another stream. If another stream is already using the
5131 * requested IP address and port, the behavior depends on
5132 * "bind_to_req_port_only". If set the bind fails; otherwise we
5133 * search for any an unused port to bind to the stream.
5134 *
5135 * As per the BSD semantics, as modified by the Deering multicast
5136 * changes, if udp_reuseaddr is set, then we allow multiple binds
5137 * to the same port independent of the local IP address.
5138 *
5139 * This is slightly different than in SunOS 4.X which did not
5140 * support IP multicast. Note that the change implemented by the
5141 * Deering multicast code effects all binds - not only binding
5142 * to IP multicast addresses.
5143 *
5144 * Note that when binding to port zero we ignore SO_REUSEADDR in
5145 * order to guarantee a unique port.
5146 */
5147
5148 count = 0;
5149 if (connp->conn_anon_priv_bind) {
5150 /*
5151 * loopmax = (IPPORT_RESERVED-1) -
5152 * us->us_min_anonpriv_port + 1
5153 */
5154 loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
5155 } else {
5156 loopmax = us->us_largest_anon_port -
5157 us->us_smallest_anon_port + 1;
5158 }
5159
5160 is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
5161
5162 for (;;) {
5163 udp_t *udp1;
5164 boolean_t found_exclbind = B_FALSE;
5165 conn_t *connp1;
5166
5167 /*
5168 * Walk through the list of udp streams bound to
5169 * requested port with the same IP address.
5170 */
5171 lport = htons(port);
5172 udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
5173 us->us_bind_fanout_size)];
5174 mutex_enter(&udpf->uf_lock);
5175 for (udp1 = udpf->uf_udp; udp1 != NULL;
5176 udp1 = udp1->udp_bind_hash) {
5177 connp1 = udp1->udp_connp;
5178
5179 if (lport != connp1->conn_lport)
5180 continue;
5181
5182 /*
5183 * On a labeled system, we must treat bindings to ports
5184 * on shared IP addresses by sockets with MAC exemption
5185 * privilege as being in all zones, as there's
5186 * otherwise no way to identify the right receiver.
5187 */
5188 if (!IPCL_BIND_ZONE_MATCH(connp1, connp))
5189 continue;
5190
5191 /*
5192 * If UDP_EXCLBIND is set for either the bound or
5193 * binding endpoint, the semantics of bind
5194 * is changed according to the following chart.
5195 *
5196 * spec = specified address (v4 or v6)
5197 * unspec = unspecified address (v4 or v6)
5198 * A = specified addresses are different for endpoints
5199 *
5200 * bound bind to allowed?
5201 * -------------------------------------
5202 * unspec unspec no
5203 * unspec spec no
5204 * spec unspec no
5205 * spec spec yes if A
5206 *
5207 * For labeled systems, SO_MAC_EXEMPT behaves the same
5208 * as UDP_EXCLBIND, except that zoneid is ignored.
5209 */
5210 if (connp1->conn_exclbind || connp->conn_exclbind ||
5211 IPCL_CONNS_MAC(udp1->udp_connp, connp)) {
5212 if (V6_OR_V4_INADDR_ANY(
5213 connp1->conn_bound_addr_v6) ||
5214 is_inaddr_any ||
5215 IN6_ARE_ADDR_EQUAL(
5216 &connp1->conn_bound_addr_v6,
5217 &v6src)) {
5218 found_exclbind = B_TRUE;
5219 break;
5220 }
5221 continue;
5222 }
5223
5224 /*
5225 * Check ipversion to allow IPv4 and IPv6 sockets to
5226 * have disjoint port number spaces.
5227 */
5228 if (connp->conn_ipversion != connp1->conn_ipversion) {
5229
5230 /*
5231 * On the first time through the loop, if the
5232 * the user intentionally specified a
5233 * particular port number, then ignore any
5234 * bindings of the other protocol that may
5235 * conflict. This allows the user to bind IPv6
5236 * alone and get both v4 and v6, or bind both
5237 * both and get each seperately. On subsequent
5238 * times through the loop, we're checking a
5239 * port that we chose (not the user) and thus
5240 * we do not allow casual duplicate bindings.
5241 */
5242 if (count == 0 && requested_port != 0)
5243 continue;
5244 }
5245
5246 /*
5247 * No difference depending on SO_REUSEADDR.
5248 *
5249 * If existing port is bound to a
5250 * non-wildcard IP address and
5251 * the requesting stream is bound to
5252 * a distinct different IP addresses
5253 * (non-wildcard, also), keep going.
5254 */
5255 if (!is_inaddr_any &&
5256 !V6_OR_V4_INADDR_ANY(connp1->conn_bound_addr_v6) &&
5257 !IN6_ARE_ADDR_EQUAL(&connp1->conn_laddr_v6,
5258 &v6src)) {
5259 continue;
5260 }
5261 break;
5262 }
5263
5264 if (!found_exclbind &&
5265 (connp->conn_reuseaddr && requested_port != 0)) {
5266 break;
5267 }
5268
5269 if (udp1 == NULL) {
5270 /*
5271 * No other stream has this IP address
5272 * and port number. We can use it.
5273 */
5274 break;
5275 }
5276 mutex_exit(&udpf->uf_lock);
5277 if (bind_to_req_port_only) {
5278 /*
5279 * We get here only when requested port
5280 * is bound (and only first of the for()
5281 * loop iteration).
5282 *
5283 * The semantics of this bind request
5284 * require it to fail so we return from
5285 * the routine (and exit the loop).
5286 *
5287 */
5288 mutex_exit(&connp->conn_lock);
5289 return (-TADDRBUSY);
5290 }
5291
5292 if (connp->conn_anon_priv_bind) {
5293 port = udp_get_next_priv_port(udp);
5294 } else {
5295 if ((count == 0) && (requested_port != 0)) {
5296 /*
5297 * If the application wants us to find
5298 * a port, get one to start with. Set
5299 * requested_port to 0, so that we will
5300 * update us->us_next_port_to_try below.
5301 */
5302 port = udp_update_next_port(udp,
5303 us->us_next_port_to_try, B_TRUE);
5304 requested_port = 0;
5305 } else {
5306 port = udp_update_next_port(udp, port + 1,
5307 B_FALSE);
5308 }
5309 }
5310
5311 if (port == 0 || ++count >= loopmax) {
5312 /*
5313 * We've tried every possible port number and
5314 * there are none available, so send an error
5315 * to the user.
5316 */
5317 mutex_exit(&connp->conn_lock);
5318 return (-TNOADDR);
5319 }
5320 }
5321
5322 /*
5323 * Copy the source address into our udp structure. This address
5324 * may still be zero; if so, ip_attr_connect will fill in the correct
5325 * address when a packet is about to be sent.
5326 * If we are binding to a broadcast or multicast address then
5327 * we just set the conn_bound_addr since we don't want to use
5328 * that as the source address when sending.
5329 */
5330 connp->conn_bound_addr_v6 = v6src;
5331 connp->conn_laddr_v6 = v6src;
5332 if (scopeid != 0) {
5333 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
5334 connp->conn_ixa->ixa_scopeid = scopeid;
5335 connp->conn_incoming_ifindex = scopeid;
5336 } else {
5337 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5338 connp->conn_incoming_ifindex = connp->conn_bound_if;
5339 }
5340
5341 switch (laddr_type) {
5342 case IPVL_UNICAST_UP:
5343 case IPVL_UNICAST_DOWN:
5344 connp->conn_saddr_v6 = v6src;
5345 connp->conn_mcbc_bind = B_FALSE;
5346 break;
5347 case IPVL_MCAST:
5348 case IPVL_BCAST:
5349 /* ip_set_destination will pick a source address later */
5350 connp->conn_saddr_v6 = ipv6_all_zeros;
5351 connp->conn_mcbc_bind = B_TRUE;
5352 break;
5353 }
5354
5355 /* Any errors after this point should use late_error */
5356 connp->conn_lport = lport;
5357
5358 /*
5359 * Now reset the next anonymous port if the application requested
5360 * an anonymous port, or we handed out the next anonymous port.
5361 */
5362 if ((requested_port == 0) && (!connp->conn_anon_priv_bind)) {
5363 us->us_next_port_to_try = port + 1;
5364 }
5365
5366 /* Initialize the T_BIND_ACK. */
5367 if (connp->conn_family == AF_INET) {
5368 sin->sin_port = connp->conn_lport;
5369 } else {
5370 sin6->sin6_port = connp->conn_lport;
5371 }
5372 udp->udp_state = TS_IDLE;
5373 udp_bind_hash_insert(udpf, udp);
5374 mutex_exit(&udpf->uf_lock);
5375 mutex_exit(&connp->conn_lock);
5376
5377 if (cl_inet_bind) {
5378 /*
5379 * Running in cluster mode - register bind information
5380 */
5381 if (connp->conn_ipversion == IPV4_VERSION) {
5382 (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5383 IPPROTO_UDP, AF_INET, (uint8_t *)&v4src,
5384 (in_port_t)connp->conn_lport, NULL);
5385 } else {
5386 (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5387 IPPROTO_UDP, AF_INET6, (uint8_t *)&v6src,
5388 (in_port_t)connp->conn_lport, NULL);
5389 }
5390 }
5391
5392 mutex_enter(&connp->conn_lock);
5393 connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
5394 if (is_system_labeled() && (!connp->conn_anon_port ||
5395 connp->conn_anon_mlp)) {
5396 uint16_t mlpport;
5397 zone_t *zone;
5398
5399 zone = crgetzone(cr);
5400 connp->conn_mlp_type =
5401 connp->conn_recv_ancillary.crb_recvucred ? mlptBoth :
5402 mlptSingle;
5403 addrtype = tsol_mlp_addr_type(
5404 connp->conn_allzones ? ALL_ZONES : zone->zone_id,
5405 IPV6_VERSION, &v6src, us->us_netstack->netstack_ip);
5406 if (addrtype == mlptSingle) {
5407 error = -TNOADDR;
5408 mutex_exit(&connp->conn_lock);
5409 goto late_error;
5410 }
5411 mlpport = connp->conn_anon_port ? PMAPPORT : port;
5412 mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
5413 addrtype);
5414
5415 /*
5416 * It is a coding error to attempt to bind an MLP port
5417 * without first setting SOL_SOCKET/SCM_UCRED.
5418 */
5419 if (mlptype != mlptSingle &&
5420 connp->conn_mlp_type == mlptSingle) {
5421 error = EINVAL;
5422 mutex_exit(&connp->conn_lock);
5423 goto late_error;
5424 }
5425
5426 /*
5427 * It is an access violation to attempt to bind an MLP port
5428 * without NET_BINDMLP privilege.
5429 */
5430 if (mlptype != mlptSingle &&
5431 secpolicy_net_bindmlp(cr) != 0) {
5432 if (connp->conn_debug) {
5433 (void) strlog(UDP_MOD_ID, 0, 1,
5434 SL_ERROR|SL_TRACE,
5435 "udp_bind: no priv for multilevel port %d",
5436 mlpport);
5437 }
5438 error = -TACCES;
5439 mutex_exit(&connp->conn_lock);
5440 goto late_error;
5441 }
5442
5443 /*
5444 * If we're specifically binding a shared IP address and the
5445 * port is MLP on shared addresses, then check to see if this
5446 * zone actually owns the MLP. Reject if not.
5447 */
5448 if (mlptype == mlptShared && addrtype == mlptShared) {
5449 /*
5450 * No need to handle exclusive-stack zones since
5451 * ALL_ZONES only applies to the shared stack.
5452 */
5453 zoneid_t mlpzone;
5454
5455 mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
5456 htons(mlpport));
5457 if (connp->conn_zoneid != mlpzone) {
5458 if (connp->conn_debug) {
5459 (void) strlog(UDP_MOD_ID, 0, 1,
5460 SL_ERROR|SL_TRACE,
5461 "udp_bind: attempt to bind port "
5462 "%d on shared addr in zone %d "
5463 "(should be %d)",
5464 mlpport, connp->conn_zoneid,
5465 mlpzone);
5466 }
5467 error = -TACCES;
5468 mutex_exit(&connp->conn_lock);
5469 goto late_error;
5470 }
5471 }
5472 if (connp->conn_anon_port) {
5473 error = tsol_mlp_anon(zone, mlptype, connp->conn_proto,
5474 port, B_TRUE);
5475 if (error != 0) {
5476 if (connp->conn_debug) {
5477 (void) strlog(UDP_MOD_ID, 0, 1,
5478 SL_ERROR|SL_TRACE,
5479 "udp_bind: cannot establish anon "
5480 "MLP for port %d", port);
5481 }
5482 error = -TACCES;
5483 mutex_exit(&connp->conn_lock);
5484 goto late_error;
5485 }
5486 }
5487 connp->conn_mlp_type = mlptype;
5488 }
5489
5490 /*
5491 * We create an initial header template here to make a subsequent
5492 * sendto have a starting point. Since conn_last_dst is zero the
5493 * first sendto will always follow the 'dst changed' code path.
5494 * Note that we defer massaging options and the related checksum
5495 * adjustment until we have a destination address.
5496 */
5497 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5498 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5499 if (error != 0) {
5500 mutex_exit(&connp->conn_lock);
5501 goto late_error;
5502 }
5503 /* Just in case */
5504 connp->conn_faddr_v6 = ipv6_all_zeros;
5505 connp->conn_fport = 0;
5506 connp->conn_v6lastdst = ipv6_all_zeros;
5507 mutex_exit(&connp->conn_lock);
5508
5509 error = ip_laddr_fanout_insert(connp);
5510 if (error != 0)
5511 goto late_error;
5512
5513 /* Bind succeeded */
5514 return (0);
5515
5516 late_error:
5517 /* We had already picked the port number, and then the bind failed */
5518 mutex_enter(&connp->conn_lock);
5519 udpf = &us->us_bind_fanout[
5520 UDP_BIND_HASH(connp->conn_lport,
5521 us->us_bind_fanout_size)];
5522 mutex_enter(&udpf->uf_lock);
5523 connp->conn_saddr_v6 = ipv6_all_zeros;
5524 connp->conn_bound_addr_v6 = ipv6_all_zeros;
5525 connp->conn_laddr_v6 = ipv6_all_zeros;
5526 if (scopeid != 0) {
5527 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5528 connp->conn_incoming_ifindex = connp->conn_bound_if;
5529 }
5530 udp->udp_state = TS_UNBND;
5531 udp_bind_hash_remove(udp, B_TRUE);
5532 connp->conn_lport = 0;
5533 mutex_exit(&udpf->uf_lock);
5534 connp->conn_anon_port = B_FALSE;
5535 connp->conn_mlp_type = mlptSingle;
5536
5537 connp->conn_v6lastdst = ipv6_all_zeros;
5538
5539 /* Restore the header that was built above - different source address */
5540 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5541 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5542 mutex_exit(&connp->conn_lock);
5543 return (error);
5544 }
5545
5546 int
5547 udp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5548 socklen_t len, cred_t *cr)
5549 {
5550 int error;
5551 conn_t *connp;
5552
5553 /* All Solaris components should pass a cred for this operation. */
5554 ASSERT(cr != NULL);
5555
5556 connp = (conn_t *)proto_handle;
5557
5558 if (sa == NULL)
5559 error = udp_do_unbind(connp);
5560 else
5561 error = udp_do_bind(connp, sa, len, cr, B_TRUE);
5562
5563 if (error < 0) {
5564 if (error == -TOUTSTATE)
5565 error = EINVAL;
5566 else
5567 error = proto_tlitosyserr(-error);
5568 }
5569
5570 return (error);
5571 }
5572
5573 static int
5574 udp_implicit_bind(conn_t *connp, cred_t *cr)
5575 {
5576 sin6_t sin6addr;
5577 sin_t *sin;
5578 sin6_t *sin6;
5579 socklen_t len;
5580 int error;
5581
5582 /* All Solaris components should pass a cred for this operation. */
5583 ASSERT(cr != NULL);
5584
5585 if (connp->conn_family == AF_INET) {
5586 len = sizeof (struct sockaddr_in);
5587 sin = (sin_t *)&sin6addr;
5588 *sin = sin_null;
5589 sin->sin_family = AF_INET;
5590 sin->sin_addr.s_addr = INADDR_ANY;
5591 } else {
5592 ASSERT(connp->conn_family == AF_INET6);
5593 len = sizeof (sin6_t);
5594 sin6 = (sin6_t *)&sin6addr;
5595 *sin6 = sin6_null;
5596 sin6->sin6_family = AF_INET6;
5597 V6_SET_ZERO(sin6->sin6_addr);
5598 }
5599
5600 error = udp_do_bind(connp, (struct sockaddr *)&sin6addr, len,
5601 cr, B_FALSE);
5602 return ((error < 0) ? proto_tlitosyserr(-error) : error);
5603 }
5604
5605 /*
5606 * This routine removes a port number association from a stream. It
5607 * is called by udp_unbind and udp_tpi_unbind.
5608 */
5609 static int
5610 udp_do_unbind(conn_t *connp)
5611 {
5612 udp_t *udp = connp->conn_udp;
5613 udp_fanout_t *udpf;
5614 udp_stack_t *us = udp->udp_us;
5615
5616 if (cl_inet_unbind != NULL) {
5617 /*
5618 * Running in cluster mode - register unbind information
5619 */
5620 if (connp->conn_ipversion == IPV4_VERSION) {
5621 (*cl_inet_unbind)(
5622 connp->conn_netstack->netstack_stackid,
5623 IPPROTO_UDP, AF_INET,
5624 (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
5625 (in_port_t)connp->conn_lport, NULL);
5626 } else {
5627 (*cl_inet_unbind)(
5628 connp->conn_netstack->netstack_stackid,
5629 IPPROTO_UDP, AF_INET6,
5630 (uint8_t *)&(connp->conn_laddr_v6),
5631 (in_port_t)connp->conn_lport, NULL);
5632 }
5633 }
5634
5635 mutex_enter(&connp->conn_lock);
5636 /* If a bind has not been done, we can't unbind. */
5637 if (udp->udp_state == TS_UNBND) {
5638 mutex_exit(&connp->conn_lock);
5639 return (-TOUTSTATE);
5640 }
5641 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5642 us->us_bind_fanout_size)];
5643 mutex_enter(&udpf->uf_lock);
5644 udp_bind_hash_remove(udp, B_TRUE);
5645 connp->conn_saddr_v6 = ipv6_all_zeros;
5646 connp->conn_bound_addr_v6 = ipv6_all_zeros;
5647 connp->conn_laddr_v6 = ipv6_all_zeros;
5648 connp->conn_mcbc_bind = B_FALSE;
5649 connp->conn_lport = 0;
5650 /* In case we were also connected */
5651 connp->conn_faddr_v6 = ipv6_all_zeros;
5652 connp->conn_fport = 0;
5653 mutex_exit(&udpf->uf_lock);
5654
5655 connp->conn_v6lastdst = ipv6_all_zeros;
5656 udp->udp_state = TS_UNBND;
5657
5658 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5659 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5660 mutex_exit(&connp->conn_lock);
5661
5662 ip_unbind(connp);
5663
5664 return (0);
5665 }
5666
5667 /*
5668 * It associates a default destination address with the stream.
5669 */
5670 static int
5671 udp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
5672 cred_t *cr, pid_t pid)
5673 {
5674 sin6_t *sin6;
5675 sin_t *sin;
5676 in6_addr_t v6dst;
5677 ipaddr_t v4dst;
5678 uint16_t dstport;
5679 uint32_t flowinfo;
5680 udp_fanout_t *udpf;
5681 udp_t *udp, *udp1;
5682 ushort_t ipversion;
5683 udp_stack_t *us;
5684 int error;
5685 conn_t *connp1;
5686 ip_xmit_attr_t *ixa;
5687 ip_xmit_attr_t *oldixa;
5688 uint_t scopeid = 0;
5689 uint_t srcid = 0;
5690 in6_addr_t v6src = connp->conn_saddr_v6;
5691 boolean_t v4mapped;
5692
5693 udp = connp->conn_udp;
5694 us = udp->udp_us;
5695
5696 /*
5697 * Address has been verified by the caller
5698 */
5699 switch (len) {
5700 default:
5701 /*
5702 * Should never happen
5703 */
5704 return (EINVAL);
5705
5706 case sizeof (sin_t):
5707 sin = (sin_t *)sa;
5708 v4dst = sin->sin_addr.s_addr;
5709 dstport = sin->sin_port;
5710 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5711 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5712 ipversion = IPV4_VERSION;
5713 break;
5714
5715 case sizeof (sin6_t):
5716 sin6 = (sin6_t *)sa;
5717 v6dst = sin6->sin6_addr;
5718 dstport = sin6->sin6_port;
5719 srcid = sin6->__sin6_src_id;
5720 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
5721 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5722 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
5723 v4mapped, connp->conn_netstack)) {
5724 /* Mismatch v4mapped/v6 specified by srcid. */
5725 return (EADDRNOTAVAIL);
5726 }
5727 }
5728 if (v4mapped) {
5729 if (connp->conn_ipv6_v6only)
5730 return (EADDRNOTAVAIL);
5731
5732 /*
5733 * Destination adress is mapped IPv6 address.
5734 * Source bound address should be unspecified or
5735 * IPv6 mapped address as well.
5736 */
5737 if (!IN6_IS_ADDR_UNSPECIFIED(
5738 &connp->conn_bound_addr_v6) &&
5739 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
5740 return (EADDRNOTAVAIL);
5741 }
5742 IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
5743 ipversion = IPV4_VERSION;
5744 flowinfo = 0;
5745 } else {
5746 ipversion = IPV6_VERSION;
5747 flowinfo = sin6->sin6_flowinfo;
5748 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
5749 scopeid = sin6->sin6_scope_id;
5750 }
5751 break;
5752 }
5753
5754 if (dstport == 0)
5755 return (-TBADADDR);
5756
5757 /*
5758 * If there is a different thread using conn_ixa then we get a new
5759 * copy and cut the old one loose from conn_ixa. Otherwise we use
5760 * conn_ixa and prevent any other thread from using/changing it.
5761 * Once connect() is done other threads can use conn_ixa since the
5762 * refcnt will be back at one.
5763 * We defer updating conn_ixa until later to handle any concurrent
5764 * conn_ixa_cleanup thread.
5765 */
5766 ixa = conn_get_ixa(connp, B_FALSE);
5767 if (ixa == NULL)
5768 return (ENOMEM);
5769
5770 mutex_enter(&connp->conn_lock);
5771 /*
5772 * This udp_t must have bound to a port already before doing a connect.
5773 * Reject if a connect is in progress (we drop conn_lock during
5774 * udp_do_connect).
5775 */
5776 if (udp->udp_state == TS_UNBND || udp->udp_state == TS_WCON_CREQ) {
5777 mutex_exit(&connp->conn_lock);
5778 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5779 "udp_connect: bad state, %u", udp->udp_state);
5780 ixa_refrele(ixa);
5781 return (-TOUTSTATE);
5782 }
5783 ASSERT(connp->conn_lport != 0 && udp->udp_ptpbhn != NULL);
5784
5785 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5786 us->us_bind_fanout_size)];
5787
5788 mutex_enter(&udpf->uf_lock);
5789 if (udp->udp_state == TS_DATA_XFER) {
5790 /* Already connected - clear out state */
5791 if (connp->conn_mcbc_bind)
5792 connp->conn_saddr_v6 = ipv6_all_zeros;
5793 else
5794 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5795 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5796 connp->conn_faddr_v6 = ipv6_all_zeros;
5797 connp->conn_fport = 0;
5798 udp->udp_state = TS_IDLE;
5799 }
5800
5801 connp->conn_fport = dstport;
5802 connp->conn_ipversion = ipversion;
5803 if (ipversion == IPV4_VERSION) {
5804 /*
5805 * Interpret a zero destination to mean loopback.
5806 * Update the T_CONN_REQ (sin/sin6) since it is used to
5807 * generate the T_CONN_CON.
5808 */
5809 if (v4dst == INADDR_ANY) {
5810 v4dst = htonl(INADDR_LOOPBACK);
5811 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5812 if (connp->conn_family == AF_INET) {
5813 sin->sin_addr.s_addr = v4dst;
5814 } else {
5815 sin6->sin6_addr = v6dst;
5816 }
5817 }
5818 connp->conn_faddr_v6 = v6dst;
5819 connp->conn_flowinfo = 0;
5820 } else {
5821 ASSERT(connp->conn_ipversion == IPV6_VERSION);
5822 /*
5823 * Interpret a zero destination to mean loopback.
5824 * Update the T_CONN_REQ (sin/sin6) since it is used to
5825 * generate the T_CONN_CON.
5826 */
5827 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
5828 v6dst = ipv6_loopback;
5829 sin6->sin6_addr = v6dst;
5830 }
5831 connp->conn_faddr_v6 = v6dst;
5832 connp->conn_flowinfo = flowinfo;
5833 }
5834 mutex_exit(&udpf->uf_lock);
5835
5836 /*
5837 * We update our cred/cpid based on the caller of connect
5838 */
5839 if (connp->conn_cred != cr) {
5840 crhold(cr);
5841 crfree(connp->conn_cred);
5842 connp->conn_cred = cr;
5843 }
5844 connp->conn_cpid = pid;
5845 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
5846 ixa->ixa_cred = cr;
5847 ixa->ixa_cpid = pid;
5848 if (is_system_labeled()) {
5849 /* We need to restart with a label based on the cred */
5850 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
5851 }
5852
5853 if (scopeid != 0) {
5854 ixa->ixa_flags |= IXAF_SCOPEID_SET;
5855 ixa->ixa_scopeid = scopeid;
5856 connp->conn_incoming_ifindex = scopeid;
5857 } else {
5858 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5859 connp->conn_incoming_ifindex = connp->conn_bound_if;
5860 }
5861 /*
5862 * conn_connect will drop conn_lock and reacquire it.
5863 * To prevent a send* from messing with this udp_t while the lock
5864 * is dropped we set udp_state and clear conn_v6lastdst.
5865 * That will make all send* fail with EISCONN.
5866 */
5867 connp->conn_v6lastdst = ipv6_all_zeros;
5868 udp->udp_state = TS_WCON_CREQ;
5869
5870 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
5871 mutex_exit(&connp->conn_lock);
5872 if (error != 0)
5873 goto connect_failed;
5874
5875 /*
5876 * The addresses have been verified. Time to insert in
5877 * the correct fanout list.
5878 */
5879 error = ipcl_conn_insert(connp);
5880 if (error != 0)
5881 goto connect_failed;
5882
5883 mutex_enter(&connp->conn_lock);
5884 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5885 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5886 if (error != 0) {
5887 mutex_exit(&connp->conn_lock);
5888 goto connect_failed;
5889 }
5890
5891 udp->udp_state = TS_DATA_XFER;
5892 /* Record this as the "last" send even though we haven't sent any */
5893 connp->conn_v6lastdst = connp->conn_faddr_v6;
5894 connp->conn_lastipversion = connp->conn_ipversion;
5895 connp->conn_lastdstport = connp->conn_fport;
5896 connp->conn_lastflowinfo = connp->conn_flowinfo;
5897 connp->conn_lastscopeid = scopeid;
5898 connp->conn_lastsrcid = srcid;
5899 /* Also remember a source to use together with lastdst */
5900 connp->conn_v6lastsrc = v6src;
5901
5902 oldixa = conn_replace_ixa(connp, ixa);
5903 mutex_exit(&connp->conn_lock);
5904 ixa_refrele(oldixa);
5905
5906 /*
5907 * We've picked a source address above. Now we can
5908 * verify that the src/port/dst/port is unique for all
5909 * connections in TS_DATA_XFER, skipping ourselves.
5910 */
5911 mutex_enter(&udpf->uf_lock);
5912 for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
5913 if (udp1->udp_state != TS_DATA_XFER)
5914 continue;
5915
5916 if (udp1 == udp)
5917 continue;
5918
5919 connp1 = udp1->udp_connp;
5920 if (connp->conn_lport != connp1->conn_lport ||
5921 connp->conn_ipversion != connp1->conn_ipversion ||
5922 dstport != connp1->conn_fport ||
5923 !IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6,
5924 &connp1->conn_laddr_v6) ||
5925 !IN6_ARE_ADDR_EQUAL(&v6dst, &connp1->conn_faddr_v6) ||
5926 !(IPCL_ZONE_MATCH(connp, connp1->conn_zoneid) ||
5927 IPCL_ZONE_MATCH(connp1, connp->conn_zoneid)))
5928 continue;
5929 mutex_exit(&udpf->uf_lock);
5930 error = -TBADADDR;
5931 goto connect_failed;
5932 }
5933 if (cl_inet_connect2 != NULL) {
5934 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
5935 if (error != 0) {
5936 mutex_exit(&udpf->uf_lock);
5937 error = -TBADADDR;
5938 goto connect_failed;
5939 }
5940 }
5941 mutex_exit(&udpf->uf_lock);
5942
5943 ixa_refrele(ixa);
5944 return (0);
5945
5946 connect_failed:
5947 if (ixa != NULL)
5948 ixa_refrele(ixa);
5949 mutex_enter(&connp->conn_lock);
5950 mutex_enter(&udpf->uf_lock);
5951 udp->udp_state = TS_IDLE;
5952 connp->conn_faddr_v6 = ipv6_all_zeros;
5953 connp->conn_fport = 0;
5954 /* In case the source address was set above */
5955 if (connp->conn_mcbc_bind)
5956 connp->conn_saddr_v6 = ipv6_all_zeros;
5957 else
5958 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5959 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5960 mutex_exit(&udpf->uf_lock);
5961
5962 connp->conn_v6lastdst = ipv6_all_zeros;
5963 connp->conn_flowinfo = 0;
5964
5965 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5966 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5967 mutex_exit(&connp->conn_lock);
5968 return (error);
5969 }
5970
5971 static int
5972 udp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5973 socklen_t len, sock_connid_t *id, cred_t *cr)
5974 {
5975 conn_t *connp = (conn_t *)proto_handle;
5976 udp_t *udp = connp->conn_udp;
5977 int error;
5978 boolean_t did_bind = B_FALSE;
5979 pid_t pid = curproc->p_pid;
5980
5981 /* All Solaris components should pass a cred for this operation. */
5982 ASSERT(cr != NULL);
5983
5984 if (sa == NULL) {
5985 /*
5986 * Disconnect
5987 * Make sure we are connected
5988 */
5989 if (udp->udp_state != TS_DATA_XFER)
5990 return (EINVAL);
5991
5992 error = udp_disconnect(connp);
5993 return (error);
5994 }
5995
5996 error = proto_verify_ip_addr(connp->conn_family, sa, len);
5997 if (error != 0)
5998 goto done;
5999
6000 /* do an implicit bind if necessary */
6001 if (udp->udp_state == TS_UNBND) {
6002 error = udp_implicit_bind(connp, cr);
6003 /*
6004 * We could be racing with an actual bind, in which case
6005 * we would see EPROTO. We cross our fingers and try
6006 * to connect.
6007 */
6008 if (!(error == 0 || error == EPROTO))
6009 goto done;
6010 did_bind = B_TRUE;
6011 }
6012 /*
6013 * set SO_DGRAM_ERRIND
6014 */
6015 connp->conn_dgram_errind = B_TRUE;
6016
6017 error = udp_do_connect(connp, sa, len, cr, pid);
6018
6019 if (error != 0 && did_bind) {
6020 int unbind_err;
6021
6022 unbind_err = udp_do_unbind(connp);
6023 ASSERT(unbind_err == 0);
6024 }
6025
6026 if (error == 0) {
6027 *id = 0;
6028 (*connp->conn_upcalls->su_connected)
6029 (connp->conn_upper_handle, 0, NULL, -1);
6030 } else if (error < 0) {
6031 error = proto_tlitosyserr(-error);
6032 }
6033
6034 done:
6035 if (error != 0 && udp->udp_state == TS_DATA_XFER) {
6036 /*
6037 * No need to hold locks to set state
6038 * after connect failure socket state is undefined
6039 * We set the state only to imitate old sockfs behavior
6040 */
6041 udp->udp_state = TS_IDLE;
6042 }
6043 return (error);
6044 }
6045
6046 int
6047 udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
6048 cred_t *cr)
6049 {
6050 sin6_t *sin6;
6051 sin_t *sin = NULL;
6052 uint_t srcid;
6053 conn_t *connp = (conn_t *)proto_handle;
6054 udp_t *udp = connp->conn_udp;
6055 int error = 0;
6056 udp_stack_t *us = udp->udp_us;
6057 ushort_t ipversion;
6058 pid_t pid = curproc->p_pid;
6059 ip_xmit_attr_t *ixa;
6060
6061 ASSERT(DB_TYPE(mp) == M_DATA);
6062
6063 /* All Solaris components should pass a cred for this operation. */
6064 ASSERT(cr != NULL);
6065
6066 /* do an implicit bind if necessary */
6067 if (udp->udp_state == TS_UNBND) {
6068 error = udp_implicit_bind(connp, cr);
6069 /*
6070 * We could be racing with an actual bind, in which case
6071 * we would see EPROTO. We cross our fingers and try
6072 * to connect.
6073 */
6074 if (!(error == 0 || error == EPROTO)) {
6075 freemsg(mp);
6076 return (error);
6077 }
6078 }
6079
6080 /* Connected? */
6081 if (msg->msg_name == NULL) {
6082 if (udp->udp_state != TS_DATA_XFER) {
6083 UDPS_BUMP_MIB(us, udpOutErrors);
6084 return (EDESTADDRREQ);
6085 }
6086 if (msg->msg_controllen != 0) {
6087 error = udp_output_ancillary(connp, NULL, NULL, mp,
6088 NULL, msg, cr, pid);
6089 } else {
6090 error = udp_output_connected(connp, mp, cr, pid);
6091 }
6092 if (us->us_sendto_ignerr)
6093 return (0);
6094 else
6095 return (error);
6096 }
6097
6098 /*
6099 * Check if we're allowed to send to a connection on which we've
6100 * already called 'connect'. The posix spec. allows both behaviors but
6101 * historically we've returned an error if already connected. The
6102 * client can allow this via a sockopt.
6103 */
6104 if (udp->udp_state == TS_DATA_XFER && !udp->udp_snd_to_conn) {
6105 UDPS_BUMP_MIB(us, udpOutErrors);
6106 return (EISCONN);
6107 }
6108
6109 error = proto_verify_ip_addr(connp->conn_family,
6110 (struct sockaddr *)msg->msg_name, msg->msg_namelen);
6111 if (error != 0) {
6112 UDPS_BUMP_MIB(us, udpOutErrors);
6113 return (error);
6114 }
6115 switch (connp->conn_family) {
6116 case AF_INET6:
6117 sin6 = (sin6_t *)msg->msg_name;
6118
6119 srcid = sin6->__sin6_src_id;
6120
6121 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6122 /*
6123 * Destination is a non-IPv4-compatible IPv6 address.
6124 * Send out an IPv6 format packet.
6125 */
6126
6127 /*
6128 * If the local address is a mapped address return
6129 * an error.
6130 * It would be possible to send an IPv6 packet but the
6131 * response would never make it back to the application
6132 * since it is bound to a mapped address.
6133 */
6134 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
6135 UDPS_BUMP_MIB(us, udpOutErrors);
6136 return (EADDRNOTAVAIL);
6137 }
6138 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
6139 sin6->sin6_addr = ipv6_loopback;
6140 ipversion = IPV6_VERSION;
6141 } else {
6142 if (connp->conn_ipv6_v6only) {
6143 UDPS_BUMP_MIB(us, udpOutErrors);
6144 return (EADDRNOTAVAIL);
6145 }
6146
6147 /*
6148 * If the local address is not zero or a mapped address
6149 * return an error. It would be possible to send an
6150 * IPv4 packet but the response would never make it
6151 * back to the application since it is bound to a
6152 * non-mapped address.
6153 */
6154 if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
6155 !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
6156 UDPS_BUMP_MIB(us, udpOutErrors);
6157 return (EADDRNOTAVAIL);
6158 }
6159
6160 if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
6161 V4_PART_OF_V6(sin6->sin6_addr) =
6162 htonl(INADDR_LOOPBACK);
6163 }
6164 ipversion = IPV4_VERSION;
6165 }
6166
6167 /*
6168 * We have to allocate an ip_xmit_attr_t before we grab
6169 * conn_lock and we need to hold conn_lock once we've check
6170 * conn_same_as_last_v6 to handle concurrent send* calls on a
6171 * socket.
6172 */
6173 if (msg->msg_controllen == 0) {
6174 ixa = conn_get_ixa(connp, B_FALSE);
6175 if (ixa == NULL) {
6176 UDPS_BUMP_MIB(us, udpOutErrors);
6177 return (ENOMEM);
6178 }
6179 } else {
6180 ixa = NULL;
6181 }
6182 mutex_enter(&connp->conn_lock);
6183 if (udp->udp_delayed_error != 0) {
6184 sin6_t *sin2 = (sin6_t *)&udp->udp_delayed_addr;
6185
6186 error = udp->udp_delayed_error;
6187 udp->udp_delayed_error = 0;
6188
6189 /* Compare IP address, port, and family */
6190
6191 if (sin6->sin6_port == sin2->sin6_port &&
6192 IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
6193 &sin2->sin6_addr) &&
6194 sin6->sin6_family == sin2->sin6_family) {
6195 mutex_exit(&connp->conn_lock);
6196 UDPS_BUMP_MIB(us, udpOutErrors);
6197 if (ixa != NULL)
6198 ixa_refrele(ixa);
6199 return (error);
6200 }
6201 }
6202
6203 if (msg->msg_controllen != 0) {
6204 mutex_exit(&connp->conn_lock);
6205 ASSERT(ixa == NULL);
6206 error = udp_output_ancillary(connp, NULL, sin6, mp,
6207 NULL, msg, cr, pid);
6208 } else if (conn_same_as_last_v6(connp, sin6) &&
6209 connp->conn_lastsrcid == srcid &&
6210 ipsec_outbound_policy_current(ixa)) {
6211 /* udp_output_lastdst drops conn_lock */
6212 error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6213 } else {
6214 /* udp_output_newdst drops conn_lock */
6215 error = udp_output_newdst(connp, mp, NULL, sin6,
6216 ipversion, cr, pid, ixa);
6217 }
6218 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6219 if (us->us_sendto_ignerr)
6220 return (0);
6221 else
6222 return (error);
6223 case AF_INET:
6224 sin = (sin_t *)msg->msg_name;
6225
6226 ipversion = IPV4_VERSION;
6227
6228 if (sin->sin_addr.s_addr == INADDR_ANY)
6229 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
6230
6231 /*
6232 * We have to allocate an ip_xmit_attr_t before we grab
6233 * conn_lock and we need to hold conn_lock once we've check
6234 * conn_same_as_last_v6 to handle concurrent send* on a socket.
6235 */
6236 if (msg->msg_controllen == 0) {
6237 ixa = conn_get_ixa(connp, B_FALSE);
6238 if (ixa == NULL) {
6239 UDPS_BUMP_MIB(us, udpOutErrors);
6240 return (ENOMEM);
6241 }
6242 } else {
6243 ixa = NULL;
6244 }
6245 mutex_enter(&connp->conn_lock);
6246 if (udp->udp_delayed_error != 0) {
6247 sin_t *sin2 = (sin_t *)&udp->udp_delayed_addr;
6248
6249 error = udp->udp_delayed_error;
6250 udp->udp_delayed_error = 0;
6251
6252 /* Compare IP address and port */
6253
6254 if (sin->sin_port == sin2->sin_port &&
6255 sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
6256 mutex_exit(&connp->conn_lock);
6257 UDPS_BUMP_MIB(us, udpOutErrors);
6258 if (ixa != NULL)
6259 ixa_refrele(ixa);
6260 return (error);
6261 }
6262 }
6263 if (msg->msg_controllen != 0) {
6264 mutex_exit(&connp->conn_lock);
6265 ASSERT(ixa == NULL);
6266 error = udp_output_ancillary(connp, sin, NULL, mp,
6267 NULL, msg, cr, pid);
6268 } else if (conn_same_as_last_v4(connp, sin) &&
6269 ipsec_outbound_policy_current(ixa)) {
6270 /* udp_output_lastdst drops conn_lock */
6271 error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6272 } else {
6273 /* udp_output_newdst drops conn_lock */
6274 error = udp_output_newdst(connp, mp, sin, NULL,
6275 ipversion, cr, pid, ixa);
6276 }
6277 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6278 if (us->us_sendto_ignerr)
6279 return (0);
6280 else
6281 return (error);
6282 default:
6283 return (EINVAL);
6284 }
6285 }
6286
6287 int
6288 udp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
6289 boolean_t issocket, so_proto_quiesced_cb_t quiesced_cb,
6290 sock_quiesce_arg_t *arg)
6291 {
6292 conn_t *connp = (conn_t *)proto_handle;
6293 udp_t *udp;
6294 struct T_capability_ack tca;
6295 struct sockaddr_in6 laddr, faddr;
6296 socklen_t laddrlen, faddrlen;
6297 short opts;
6298 struct stroptions *stropt;
6299 mblk_t *mp, *stropt_mp;
6300 int error;
6301
6302 udp = connp->conn_udp;
6303
6304 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
6305
6306 /*
6307 * setup the fallback stream that was allocated
6308 */
6309 connp->conn_dev = (dev_t)RD(q)->q_ptr;
6310 connp->conn_minor_arena = WR(q)->q_ptr;
6311
6312 RD(q)->q_ptr = WR(q)->q_ptr = connp;
6313
6314 WR(q)->q_qinfo = &udp_winit;
6315
6316 connp->conn_rq = RD(q);
6317 connp->conn_wq = WR(q);
6318
6319 /* Notify stream head about options before sending up data */
6320 stropt_mp->b_datap->db_type = M_SETOPTS;
6321 stropt_mp->b_wptr += sizeof (*stropt);
6322 stropt = (struct stroptions *)stropt_mp->b_rptr;
6323 stropt->so_flags = SO_WROFF | SO_HIWAT;
6324 stropt->so_wroff = connp->conn_wroff;
6325 stropt->so_hiwat = udp->udp_rcv_disply_hiwat;
6326 putnext(RD(q), stropt_mp);
6327
6328 /*
6329 * Free the helper stream
6330 */
6331 ip_free_helper_stream(connp);
6332
6333 if (!issocket)
6334 udp_use_pure_tpi(udp);
6335
6336 /*
6337 * Collect the information needed to sync with the sonode
6338 */
6339 udp_do_capability_ack(udp, &tca, TC1_INFO);
6340
6341 laddrlen = faddrlen = sizeof (sin6_t);
6342 (void) udp_getsockname((sock_lower_handle_t)connp,
6343 (struct sockaddr *)&laddr, &laddrlen, CRED());
6344 error = udp_getpeername((sock_lower_handle_t)connp,
6345 (struct sockaddr *)&faddr, &faddrlen, CRED());
6346 if (error != 0)
6347 faddrlen = 0;
6348
6349 opts = 0;
6350 if (connp->conn_dgram_errind)
6351 opts |= SO_DGRAM_ERRIND;
6352 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
6353 opts |= SO_DONTROUTE;
6354
6355 mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
6356 (struct sockaddr *)&laddr, laddrlen,
6357 (struct sockaddr *)&faddr, faddrlen, opts);
6358
6359 mutex_enter(&udp->udp_recv_lock);
6360 /*
6361 * Attempts to send data up during fallback will result in it being
6362 * queued in udp_t. First push up the datagrams obtained from the
6363 * socket, then any packets queued in udp_t.
6364 */
6365 if (mp != NULL) {
6366 mp->b_next = udp->udp_fallback_queue_head;
6367 udp->udp_fallback_queue_head = mp;
6368 }
6369 while (udp->udp_fallback_queue_head != NULL) {
6370 mp = udp->udp_fallback_queue_head;
6371 udp->udp_fallback_queue_head = mp->b_next;
6372 mutex_exit(&udp->udp_recv_lock);
6373 mp->b_next = NULL;
6374 putnext(RD(q), mp);
6375 mutex_enter(&udp->udp_recv_lock);
6376 }
6377 udp->udp_fallback_queue_tail = udp->udp_fallback_queue_head;
6378 /*
6379 * No longer a streams less socket
6380 */
6381 mutex_enter(&connp->conn_lock);
6382 connp->conn_flags &= ~IPCL_NONSTR;
6383 mutex_exit(&connp->conn_lock);
6384
6385 mutex_exit(&udp->udp_recv_lock);
6386
6387 ASSERT(connp->conn_ref >= 1);
6388
6389 return (0);
6390 }
6391
6392 /* ARGSUSED3 */
6393 int
6394 udp_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6395 socklen_t *salenp, cred_t *cr)
6396 {
6397 conn_t *connp = (conn_t *)proto_handle;
6398 udp_t *udp = connp->conn_udp;
6399 int error;
6400
6401 /* All Solaris components should pass a cred for this operation. */
6402 ASSERT(cr != NULL);
6403
6404 mutex_enter(&connp->conn_lock);
6405 if (udp->udp_state != TS_DATA_XFER)
6406 error = ENOTCONN;
6407 else
6408 error = conn_getpeername(connp, sa, salenp);
6409 mutex_exit(&connp->conn_lock);
6410 return (error);
6411 }
6412
6413 /* ARGSUSED3 */
6414 int
6415 udp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6416 socklen_t *salenp, cred_t *cr)
6417 {
6418 conn_t *connp = (conn_t *)proto_handle;
6419 int error;
6420
6421 /* All Solaris components should pass a cred for this operation. */
6422 ASSERT(cr != NULL);
6423
6424 mutex_enter(&connp->conn_lock);
6425 error = conn_getsockname(connp, sa, salenp);
6426 mutex_exit(&connp->conn_lock);
6427 return (error);
6428 }
6429
6430 int
6431 udp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6432 void *optvalp, socklen_t *optlen, cred_t *cr)
6433 {
6434 conn_t *connp = (conn_t *)proto_handle;
6435 int error;
6436 t_uscalar_t max_optbuf_len;
6437 void *optvalp_buf;
6438 int len;
6439
6440 /* All Solaris components should pass a cred for this operation. */
6441 ASSERT(cr != NULL);
6442
6443 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
6444 udp_opt_obj.odb_opt_des_arr,
6445 udp_opt_obj.odb_opt_arr_cnt,
6446 B_FALSE, B_TRUE, cr);
6447 if (error != 0) {
6448 if (error < 0)
6449 error = proto_tlitosyserr(-error);
6450 return (error);
6451 }
6452
6453 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
6454 len = udp_opt_get(connp, level, option_name, optvalp_buf);
6455 if (len == -1) {
6456 kmem_free(optvalp_buf, max_optbuf_len);
6457 return (EINVAL);
6458 }
6459
6460 /*
6461 * update optlen and copy option value
6462 */
6463 t_uscalar_t size = MIN(len, *optlen);
6464
6465 bcopy(optvalp_buf, optvalp, size);
6466 bcopy(&size, optlen, sizeof (size));
6467
6468 kmem_free(optvalp_buf, max_optbuf_len);
6469 return (0);
6470 }
6471
6472 int
6473 udp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6474 const void *optvalp, socklen_t optlen, cred_t *cr)
6475 {
6476 conn_t *connp = (conn_t *)proto_handle;
6477 int error;
6478
6479 /* All Solaris components should pass a cred for this operation. */
6480 ASSERT(cr != NULL);
6481
6482 error = proto_opt_check(level, option_name, optlen, NULL,
6483 udp_opt_obj.odb_opt_des_arr,
6484 udp_opt_obj.odb_opt_arr_cnt,
6485 B_TRUE, B_FALSE, cr);
6486
6487 if (error != 0) {
6488 if (error < 0)
6489 error = proto_tlitosyserr(-error);
6490 return (error);
6491 }
6492
6493 error = udp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
6494 optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
6495 NULL, cr);
6496
6497 ASSERT(error >= 0);
6498
6499 return (error);
6500 }
6501
6502 void
6503 udp_clr_flowctrl(sock_lower_handle_t proto_handle)
6504 {
6505 conn_t *connp = (conn_t *)proto_handle;
6506 udp_t *udp = connp->conn_udp;
6507
6508 mutex_enter(&udp->udp_recv_lock);
6509 connp->conn_flow_cntrld = B_FALSE;
6510 mutex_exit(&udp->udp_recv_lock);
6511 }
6512
6513 /* ARGSUSED2 */
6514 int
6515 udp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
6516 {
6517 conn_t *connp = (conn_t *)proto_handle;
6518
6519 /* All Solaris components should pass a cred for this operation. */
6520 ASSERT(cr != NULL);
6521
6522 /* shut down the send side */
6523 if (how != SHUT_RD)
6524 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6525 SOCK_OPCTL_SHUT_SEND, 0);
6526 /* shut down the recv side */
6527 if (how != SHUT_WR)
6528 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6529 SOCK_OPCTL_SHUT_RECV, 0);
6530 return (0);
6531 }
6532
6533 int
6534 udp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
6535 int mode, int32_t *rvalp, cred_t *cr)
6536 {
6537 conn_t *connp = (conn_t *)proto_handle;
6538 int error;
6539
6540 /* All Solaris components should pass a cred for this operation. */
6541 ASSERT(cr != NULL);
6542
6543 /*
6544 * If we don't have a helper stream then create one.
6545 * ip_create_helper_stream takes care of locking the conn_t,
6546 * so this check for NULL is just a performance optimization.
6547 */
6548 if (connp->conn_helper_info == NULL) {
6549 udp_stack_t *us = connp->conn_udp->udp_us;
6550
6551 ASSERT(us->us_ldi_ident != NULL);
6552
6553 /*
6554 * Create a helper stream for non-STREAMS socket.
6555 */
6556 error = ip_create_helper_stream(connp, us->us_ldi_ident);
6557 if (error != 0) {
6558 ip0dbg(("tcp_ioctl: create of IP helper stream "
6559 "failed %d\n", error));
6560 return (error);
6561 }
6562 }
6563
6564 switch (cmd) {
6565 case _SIOCSOCKFALLBACK:
6566 case TI_GETPEERNAME:
6567 case TI_GETMYNAME:
6568 ip1dbg(("udp_ioctl: cmd 0x%x on non streams socket",
6569 cmd));
6570 error = EINVAL;
6571 break;
6572 default:
6573 /*
6574 * Pass on to IP using helper stream
6575 */
6576 error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
6577 cmd, arg, mode, cr, rvalp);
6578 break;
6579 }
6580 return (error);
6581 }
6582
6583 /* ARGSUSED */
6584 int
6585 udp_accept(sock_lower_handle_t lproto_handle,
6586 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
6587 cred_t *cr)
6588 {
6589 return (EOPNOTSUPP);
6590 }
6591
6592 /* ARGSUSED */
6593 int
6594 udp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
6595 {
6596 return (EOPNOTSUPP);
6597 }
6598
6599 sock_downcalls_t sock_udp_downcalls = {
6600 udp_activate, /* sd_activate */
6601 udp_accept, /* sd_accept */
6602 udp_bind, /* sd_bind */
6603 udp_listen, /* sd_listen */
6604 udp_connect, /* sd_connect */
6605 udp_getpeername, /* sd_getpeername */
6606 udp_getsockname, /* sd_getsockname */
6607 udp_getsockopt, /* sd_getsockopt */
6608 udp_setsockopt, /* sd_setsockopt */
6609 udp_send, /* sd_send */
6610 NULL, /* sd_send_uio */
6611 NULL, /* sd_recv_uio */
6612 NULL, /* sd_poll */
6613 udp_shutdown, /* sd_shutdown */
6614 udp_clr_flowctrl, /* sd_setflowctrl */
6615 udp_ioctl, /* sd_ioctl */
6616 udp_close /* sd_close */
6617 };