1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
24 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
25 * Copyright 2018, Joyent, Inc.
26 */
27 /* Copyright (c) 1990 Mentat Inc. */
28
29 #include <sys/sysmacros.h>
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/stropts.h>
33 #include <sys/strlog.h>
34 #include <sys/strsun.h>
35 #define _SUN_TPI_VERSION 2
36 #include <sys/tihdr.h>
37 #include <sys/timod.h>
38 #include <sys/ddi.h>
39 #include <sys/sunddi.h>
40 #include <sys/strsubr.h>
41 #include <sys/suntpi.h>
42 #include <sys/xti_inet.h>
43 #include <sys/kmem.h>
44 #include <sys/cred_impl.h>
45 #include <sys/policy.h>
46 #include <sys/priv.h>
47 #include <sys/ucred.h>
48 #include <sys/zone.h>
49
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sockio.h>
53 #include <sys/vtrace.h>
54 #include <sys/sdt.h>
55 #include <sys/debug.h>
56 #include <sys/isa_defs.h>
57 #include <sys/random.h>
58 #include <netinet/in.h>
59 #include <netinet/ip6.h>
60 #include <netinet/icmp6.h>
61 #include <netinet/udp.h>
62
63 #include <inet/common.h>
64 #include <inet/ip.h>
65 #include <inet/ip_impl.h>
66 #include <inet/ipsec_impl.h>
67 #include <inet/ip6.h>
68 #include <inet/ip_ire.h>
69 #include <inet/ip_if.h>
70 #include <inet/ip_multi.h>
71 #include <inet/ip_ndp.h>
72 #include <inet/proto_set.h>
73 #include <inet/mib2.h>
74 #include <inet/optcom.h>
75 #include <inet/snmpcom.h>
76 #include <inet/kstatcom.h>
77 #include <inet/ipclassifier.h>
78 #include <sys/squeue_impl.h>
79 #include <inet/ipnet.h>
80 #include <sys/vxlan.h>
81 #include <inet/inet_hash.h>
82
83 #include <sys/tsol/label.h>
84 #include <sys/tsol/tnet.h>
85 #include <rpc/pmap_prot.h>
86
87 #include <inet/udp_impl.h>
88
89 /*
90 * Synchronization notes:
91 *
92 * UDP is MT and uses the usual kernel synchronization primitives. There are 2
93 * locks, the fanout lock (uf_lock) and conn_lock. conn_lock
94 * protects the contents of the udp_t. uf_lock protects the address and the
95 * fanout information.
96 * The lock order is conn_lock -> uf_lock.
97 *
98 * The fanout lock uf_lock:
99 * When a UDP endpoint is bound to a local port, it is inserted into
100 * a bind hash list. The list consists of an array of udp_fanout_t buckets.
101 * The size of the array is controlled by the udp_bind_fanout_size variable.
102 * This variable can be changed in /etc/system if the default value is
103 * not large enough. Each bind hash bucket is protected by a per bucket
104 * lock. It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
105 * structure and a few other fields in the udp_t. A UDP endpoint is removed
106 * from the bind hash list only when it is being unbound or being closed.
107 * The per bucket lock also protects a UDP endpoint's state changes.
108 *
109 * Plumbing notes:
110 * UDP is always a device driver. For compatibility with mibopen() code
111 * it is possible to I_PUSH "udp", but that results in pushing a passthrough
112 * dummy module.
113 *
114 * The above implies that we don't support any intermediate module to
115 * reside in between /dev/ip and udp -- in fact, we never supported such
116 * scenario in the past as the inter-layer communication semantics have
117 * always been private.
118 */
119
120 /* For /etc/system control */
121 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
122
123 static void udp_addr_req(queue_t *q, mblk_t *mp);
124 static void udp_tpi_bind(queue_t *q, mblk_t *mp);
125 static void udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
126 static void udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
127 static int udp_build_hdr_template(conn_t *, const in6_addr_t *,
128 const in6_addr_t *, in_port_t, uint32_t);
129 static void udp_capability_req(queue_t *q, mblk_t *mp);
130 static int udp_tpi_close(queue_t *q, int flags);
131 static void udp_close_free(conn_t *);
132 static void udp_tpi_connect(queue_t *q, mblk_t *mp);
133 static void udp_tpi_disconnect(queue_t *q, mblk_t *mp);
134 static void udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
135 int sys_error);
136 static void udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
137 t_scalar_t tlierr, int sys_error);
138 static int udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
139 cred_t *cr);
140 static int udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
141 char *value, caddr_t cp, cred_t *cr);
142 static int udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
143 char *value, caddr_t cp, cred_t *cr);
144 static void udp_icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
145 static void udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
146 ip_recv_attr_t *ira);
147 static void udp_info_req(queue_t *q, mblk_t *mp);
148 static void udp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
149 static void udp_lrput(queue_t *, mblk_t *);
150 static void udp_lwput(queue_t *, mblk_t *);
151 static int udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
152 cred_t *credp, boolean_t isv6);
153 static int udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
154 cred_t *credp);
155 static int udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
156 cred_t *credp);
157 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
158 int udp_opt_set(conn_t *connp, uint_t optset_context,
159 int level, int name, uint_t inlen,
160 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
161 void *thisdg_attrs, cred_t *cr);
162 int udp_opt_get(conn_t *connp, int level, int name,
163 uchar_t *ptr);
164 static int udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr,
165 pid_t pid);
166 static int udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr,
167 pid_t pid, ip_xmit_attr_t *ixa);
168 static int udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
169 sin6_t *sin6, ushort_t ipversion, cred_t *cr, pid_t,
170 ip_xmit_attr_t *ixa);
171 static mblk_t *udp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
172 const in6_addr_t *, const in6_addr_t *, in_port_t, uint32_t, mblk_t *,
173 int *);
174 static mblk_t *udp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
175 mblk_t *, const in6_addr_t *, in_port_t, uint32_t, int *);
176 static void udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
177 static void udp_ud_err_connected(conn_t *, t_scalar_t);
178 static void udp_tpi_unbind(queue_t *q, mblk_t *mp);
179 static void udp_wput_other(queue_t *q, mblk_t *mp);
180 static void udp_wput_iocdata(queue_t *q, mblk_t *mp);
181 static void udp_wput_fallback(queue_t *q, mblk_t *mp);
182 static size_t udp_set_rcv_hiwat(udp_t *udp, size_t size);
183
184 static void *udp_stack_init(netstackid_t stackid, netstack_t *ns);
185 static void udp_stack_fini(netstackid_t stackid, void *arg);
186
187 /* Common routines for TPI and socket module */
188 static void udp_ulp_recv(conn_t *, mblk_t *, uint_t, ip_recv_attr_t *);
189
190 /* Common routine for TPI and socket module */
191 static conn_t *udp_do_open(cred_t *, boolean_t, int, int *);
192 static void udp_do_close(conn_t *);
193 static int udp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *,
194 boolean_t);
195 static int udp_do_unbind(conn_t *);
196
197 int udp_getsockname(sock_lower_handle_t,
198 struct sockaddr *, socklen_t *, cred_t *);
199 int udp_getpeername(sock_lower_handle_t,
200 struct sockaddr *, socklen_t *, cred_t *);
201 static int udp_do_connect(conn_t *, const struct sockaddr *, socklen_t,
202 cred_t *, pid_t);
203
204 #pragma inline(udp_output_connected, udp_output_newdst, udp_output_lastdst)
205
206 /*
207 * Checks if the given destination addr/port is allowed out.
208 * If allowed, registers the (dest_addr/port, node_ID) mapping at Cluster.
209 * Called for each connect() and for sendto()/sendmsg() to a different
210 * destination.
211 * For connect(), called in udp_connect().
212 * For sendto()/sendmsg(), called in udp_output_newdst().
213 *
214 * This macro assumes that the cl_inet_connect2 hook is not NULL.
215 * Please check this before calling this macro.
216 *
217 * void
218 * CL_INET_UDP_CONNECT(conn_t cp, udp_t *udp, boolean_t is_outgoing,
219 * in6_addr_t *faddrp, in_port_t (or uint16_t) fport, int err);
220 */
221 #define CL_INET_UDP_CONNECT(cp, is_outgoing, faddrp, fport, err) { \
222 (err) = 0; \
223 /* \
224 * Running in cluster mode - check and register active \
225 * "connection" information \
226 */ \
227 if ((cp)->conn_ipversion == IPV4_VERSION) \
228 (err) = (*cl_inet_connect2)( \
229 (cp)->conn_netstack->netstack_stackid, \
230 IPPROTO_UDP, is_outgoing, AF_INET, \
231 (uint8_t *)&((cp)->conn_laddr_v4), \
232 (cp)->conn_lport, \
233 (uint8_t *)&(V4_PART_OF_V6(*faddrp)), \
234 (in_port_t)(fport), NULL); \
235 else \
236 (err) = (*cl_inet_connect2)( \
237 (cp)->conn_netstack->netstack_stackid, \
238 IPPROTO_UDP, is_outgoing, AF_INET6, \
239 (uint8_t *)&((cp)->conn_laddr_v6), \
240 (cp)->conn_lport, \
241 (uint8_t *)(faddrp), (in_port_t)(fport), NULL); \
242 }
243
244 static struct module_info udp_mod_info = {
245 UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
246 };
247
248 /*
249 * Entry points for UDP as a device.
250 * We have separate open functions for the /dev/udp and /dev/udp6 devices.
251 */
252 static struct qinit udp_rinitv4 = {
253 NULL, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info, NULL
254 };
255
256 static struct qinit udp_rinitv6 = {
257 NULL, NULL, udp_openv6, udp_tpi_close, NULL, &udp_mod_info, NULL
258 };
259
260 static struct qinit udp_winit = {
261 (pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &udp_mod_info
262 };
263
264 /* UDP entry point during fallback */
265 struct qinit udp_fallback_sock_winit = {
266 (pfi_t)udp_wput_fallback, NULL, NULL, NULL, NULL, &udp_mod_info
267 };
268
269 /*
270 * UDP needs to handle I_LINK and I_PLINK since ifconfig
271 * likes to use it as a place to hang the various streams.
272 */
273 static struct qinit udp_lrinit = {
274 (pfi_t)udp_lrput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
275 };
276
277 static struct qinit udp_lwinit = {
278 (pfi_t)udp_lwput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
279 };
280
281 /* For AF_INET aka /dev/udp */
282 struct streamtab udpinfov4 = {
283 &udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
284 };
285
286 /* For AF_INET6 aka /dev/udp6 */
287 struct streamtab udpinfov6 = {
288 &udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
289 };
290
291 #define UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
292
293 /* Default structure copied into T_INFO_ACK messages */
294 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
295 T_INFO_ACK,
296 UDP_MAXPACKET_IPV4, /* TSDU_size. Excl. headers */
297 T_INVALID, /* ETSU_size. udp does not support expedited data. */
298 T_INVALID, /* CDATA_size. udp does not support connect data. */
299 T_INVALID, /* DDATA_size. udp does not support disconnect data. */
300 sizeof (sin_t), /* ADDR_size. */
301 0, /* OPT_size - not initialized here */
302 UDP_MAXPACKET_IPV4, /* TIDU_size. Excl. headers */
303 T_CLTS, /* SERV_type. udp supports connection-less. */
304 TS_UNBND, /* CURRENT_state. This is set from udp_state. */
305 (XPG4_1|SENDZERO) /* PROVIDER_flag */
306 };
307
308 #define UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
309
310 static struct T_info_ack udp_g_t_info_ack_ipv6 = {
311 T_INFO_ACK,
312 UDP_MAXPACKET_IPV6, /* TSDU_size. Excl. headers */
313 T_INVALID, /* ETSU_size. udp does not support expedited data. */
314 T_INVALID, /* CDATA_size. udp does not support connect data. */
315 T_INVALID, /* DDATA_size. udp does not support disconnect data. */
316 sizeof (sin6_t), /* ADDR_size. */
317 0, /* OPT_size - not initialized here */
318 UDP_MAXPACKET_IPV6, /* TIDU_size. Excl. headers */
319 T_CLTS, /* SERV_type. udp supports connection-less. */
320 TS_UNBND, /* CURRENT_state. This is set from udp_state. */
321 (XPG4_1|SENDZERO) /* PROVIDER_flag */
322 };
323
324 /*
325 * UDP tunables related declarations. Definitions are in udp_tunables.c
326 */
327 extern mod_prop_info_t udp_propinfo_tbl[];
328 extern int udp_propinfo_count;
329
330 /* Setable in /etc/system */
331 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
332 uint32_t udp_random_anon_port = 1;
333
334 /*
335 * Hook functions to enable cluster networking.
336 * On non-clustered systems these vectors must always be NULL
337 */
338
339 void (*cl_inet_bind)(netstackid_t stack_id, uchar_t protocol,
340 sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
341 void *args) = NULL;
342 void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
343 sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
344 void *args) = NULL;
345
346 typedef union T_primitives *t_primp_t;
347
348 /*
349 * Various protocols that encapsulate UDP have no real use for the source port.
350 * Instead, they want to vary the source port to provide better equal-cost
351 * multipathing and other systems that use fanout. Consider something like
352 * VXLAN. If you're actually sending multiple different streams to a single
353 * host, if you don't vary the source port, then the tuple of ( SRC IP, DST IP,
354 * SRC Port, DST Port) will always be the same.
355 *
356 * Here, we return a port to hash this to, if we know how to hash it. If for
357 * some reason we can't perform an L4 hash, then we just return the default
358 * value, usually the default port. After we determine the hash we transform it
359 * so that it's in the range of [ min, max ].
360 *
361 * We'd like to avoid a pull up for the sake of performing the hash. If the
362 * first mblk_t doesn't have the full protocol header, then we just send it to
363 * the default. If for some reason we have an encapsulated packet that has its
364 * protocol header in different parts of an mblk_t, then we'll go with the
365 * default port. This means that that if a driver isn't consistent about how it
366 * generates the frames for a given flow, it will not always be consistently
367 * hashed. That should be an uncommon event.
368 */
369 uint16_t
370 udp_srcport_hash(mblk_t *mp, int type, uint16_t min, uint16_t max,
371 uint16_t def)
372 {
373 size_t szused = 0;
374 ip6_t *ip6h;
375 ipha_t *ipha;
376 uint16_t sap;
377 uint64_t hash;
378 uint32_t mod;
379
380 ASSERT(min <= max);
381
382 if (type != UDP_HASH_VXLAN)
383 return (def);
384
385 if (!IS_P2ALIGNED(mp->b_rptr, sizeof (uint16_t)))
386 return (def);
387
388 /*
389 * The following logic is VXLAN specific to get at the header, if we
390 * have formats, eg. GENEVE, then we should ignore this.
391 *
392 * The kernel overlay device often puts a first mblk_t for the data
393 * which is just the encap. If so, then we're going to use that and try
394 * to avoid a pull up.
395 */
396 if (MBLKL(mp) == VXLAN_HDR_LEN) {
397 if (mp->b_cont == NULL)
398 return (def);
399 mp = mp->b_cont;
400 } else if (MBLKL(mp) < VXLAN_HDR_LEN) {
401 return (def);
402 } else {
403 szused = VXLAN_HDR_LEN;
404 }
405
406 /* Can we hold a MAC header? */
407 if (MBLKL(mp) + szused < sizeof (struct ether_header))
408 return (def);
409
410 /*
411 * We need to lie about the starting offset into the message block for
412 * convenience. Undo it at the end. We know that inet_pkt_hash() won't
413 * modify the mblk_t.
414 */
415 mp->b_rptr += szused;
416 hash = inet_pkt_hash(DL_ETHER, mp, INET_PKT_HASH_L2 |
417 INET_PKT_HASH_L3 | INET_PKT_HASH_L4);
418 mp->b_rptr -= szused;
419
420 if (hash == 0)
421 return (def);
422
423 mod = max - min + 1;
424 return ((hash % mod) + min);
425 }
426
427 /*
428 * Return the next anonymous port in the privileged port range for
429 * bind checking.
430 *
431 * Trusted Extension (TX) notes: TX allows administrator to mark or
432 * reserve ports as Multilevel ports (MLP). MLP has special function
433 * on TX systems. Once a port is made MLP, it's not available as
434 * ordinary port. This creates "holes" in the port name space. It
435 * may be necessary to skip the "holes" find a suitable anon port.
436 */
437 static in_port_t
438 udp_get_next_priv_port(udp_t *udp)
439 {
440 static in_port_t next_priv_port = IPPORT_RESERVED - 1;
441 in_port_t nextport;
442 boolean_t restart = B_FALSE;
443 udp_stack_t *us = udp->udp_us;
444
445 retry:
446 if (next_priv_port < us->us_min_anonpriv_port ||
447 next_priv_port >= IPPORT_RESERVED) {
448 next_priv_port = IPPORT_RESERVED - 1;
449 if (restart)
450 return (0);
451 restart = B_TRUE;
452 }
453
454 if (is_system_labeled() &&
455 (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
456 next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
457 next_priv_port = nextport;
458 goto retry;
459 }
460
461 return (next_priv_port--);
462 }
463
464 /*
465 * Hash list removal routine for udp_t structures.
466 */
467 static void
468 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
469 {
470 udp_t *udpnext;
471 kmutex_t *lockp;
472 udp_stack_t *us = udp->udp_us;
473 conn_t *connp = udp->udp_connp;
474
475 if (udp->udp_ptpbhn == NULL)
476 return;
477
478 /*
479 * Extract the lock pointer in case there are concurrent
480 * hash_remove's for this instance.
481 */
482 ASSERT(connp->conn_lport != 0);
483 if (!caller_holds_lock) {
484 lockp = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
485 us->us_bind_fanout_size)].uf_lock;
486 ASSERT(lockp != NULL);
487 mutex_enter(lockp);
488 }
489 if (udp->udp_ptpbhn != NULL) {
490 udpnext = udp->udp_bind_hash;
491 if (udpnext != NULL) {
492 udpnext->udp_ptpbhn = udp->udp_ptpbhn;
493 udp->udp_bind_hash = NULL;
494 }
495 *udp->udp_ptpbhn = udpnext;
496 udp->udp_ptpbhn = NULL;
497 }
498 if (!caller_holds_lock) {
499 mutex_exit(lockp);
500 }
501 }
502
503 static void
504 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
505 {
506 conn_t *connp = udp->udp_connp;
507 udp_t **udpp;
508 udp_t *udpnext;
509 conn_t *connext;
510
511 ASSERT(MUTEX_HELD(&uf->uf_lock));
512 ASSERT(udp->udp_ptpbhn == NULL);
513 udpp = &uf->uf_udp;
514 udpnext = udpp[0];
515 if (udpnext != NULL) {
516 /*
517 * If the new udp bound to the INADDR_ANY address
518 * and the first one in the list is not bound to
519 * INADDR_ANY we skip all entries until we find the
520 * first one bound to INADDR_ANY.
521 * This makes sure that applications binding to a
522 * specific address get preference over those binding to
523 * INADDR_ANY.
524 */
525 connext = udpnext->udp_connp;
526 if (V6_OR_V4_INADDR_ANY(connp->conn_bound_addr_v6) &&
527 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
528 while ((udpnext = udpp[0]) != NULL &&
529 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
530 udpp = &(udpnext->udp_bind_hash);
531 }
532 if (udpnext != NULL)
533 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
534 } else {
535 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
536 }
537 }
538 udp->udp_bind_hash = udpnext;
539 udp->udp_ptpbhn = udpp;
540 udpp[0] = udp;
541 }
542
543 /*
544 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
545 * passed to udp_wput.
546 * It associates a port number and local address with the stream.
547 * It calls IP to verify the local IP address, and calls IP to insert
548 * the conn_t in the fanout table.
549 * If everything is ok it then sends the T_BIND_ACK back up.
550 *
551 * Note that UDP over IPv4 and IPv6 sockets can use the same port number
552 * without setting SO_REUSEADDR. This is needed so that they
553 * can be viewed as two independent transport protocols.
554 * However, anonymouns ports are allocated from the same range to avoid
555 * duplicating the us->us_next_port_to_try.
556 */
557 static void
558 udp_tpi_bind(queue_t *q, mblk_t *mp)
559 {
560 sin_t *sin;
561 sin6_t *sin6;
562 mblk_t *mp1;
563 struct T_bind_req *tbr;
564 conn_t *connp;
565 udp_t *udp;
566 int error;
567 struct sockaddr *sa;
568 cred_t *cr;
569
570 /*
571 * All Solaris components should pass a db_credp
572 * for this TPI message, hence we ASSERT.
573 * But in case there is some other M_PROTO that looks
574 * like a TPI message sent by some other kernel
575 * component, we check and return an error.
576 */
577 cr = msg_getcred(mp, NULL);
578 ASSERT(cr != NULL);
579 if (cr == NULL) {
580 udp_err_ack(q, mp, TSYSERR, EINVAL);
581 return;
582 }
583
584 connp = Q_TO_CONN(q);
585 udp = connp->conn_udp;
586 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
587 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
588 "udp_bind: bad req, len %u",
589 (uint_t)(mp->b_wptr - mp->b_rptr));
590 udp_err_ack(q, mp, TPROTO, 0);
591 return;
592 }
593 if (udp->udp_state != TS_UNBND) {
594 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
595 "udp_bind: bad state, %u", udp->udp_state);
596 udp_err_ack(q, mp, TOUTSTATE, 0);
597 return;
598 }
599 /*
600 * Reallocate the message to make sure we have enough room for an
601 * address.
602 */
603 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
604 if (mp1 == NULL) {
605 udp_err_ack(q, mp, TSYSERR, ENOMEM);
606 return;
607 }
608
609 mp = mp1;
610
611 /* Reset the message type in preparation for shipping it back. */
612 DB_TYPE(mp) = M_PCPROTO;
613
614 tbr = (struct T_bind_req *)mp->b_rptr;
615 switch (tbr->ADDR_length) {
616 case 0: /* Request for a generic port */
617 tbr->ADDR_offset = sizeof (struct T_bind_req);
618 if (connp->conn_family == AF_INET) {
619 tbr->ADDR_length = sizeof (sin_t);
620 sin = (sin_t *)&tbr[1];
621 *sin = sin_null;
622 sin->sin_family = AF_INET;
623 mp->b_wptr = (uchar_t *)&sin[1];
624 sa = (struct sockaddr *)sin;
625 } else {
626 ASSERT(connp->conn_family == AF_INET6);
627 tbr->ADDR_length = sizeof (sin6_t);
628 sin6 = (sin6_t *)&tbr[1];
629 *sin6 = sin6_null;
630 sin6->sin6_family = AF_INET6;
631 mp->b_wptr = (uchar_t *)&sin6[1];
632 sa = (struct sockaddr *)sin6;
633 }
634 break;
635
636 case sizeof (sin_t): /* Complete IPv4 address */
637 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
638 sizeof (sin_t));
639 if (sa == NULL || !OK_32PTR((char *)sa)) {
640 udp_err_ack(q, mp, TSYSERR, EINVAL);
641 return;
642 }
643 if (connp->conn_family != AF_INET ||
644 sa->sa_family != AF_INET) {
645 udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
646 return;
647 }
648 break;
649
650 case sizeof (sin6_t): /* complete IPv6 address */
651 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
652 sizeof (sin6_t));
653 if (sa == NULL || !OK_32PTR((char *)sa)) {
654 udp_err_ack(q, mp, TSYSERR, EINVAL);
655 return;
656 }
657 if (connp->conn_family != AF_INET6 ||
658 sa->sa_family != AF_INET6) {
659 udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
660 return;
661 }
662 break;
663
664 default: /* Invalid request */
665 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
666 "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
667 udp_err_ack(q, mp, TBADADDR, 0);
668 return;
669 }
670
671 error = udp_do_bind(connp, sa, tbr->ADDR_length, cr,
672 tbr->PRIM_type != O_T_BIND_REQ);
673
674 if (error != 0) {
675 if (error > 0) {
676 udp_err_ack(q, mp, TSYSERR, error);
677 } else {
678 udp_err_ack(q, mp, -error, 0);
679 }
680 } else {
681 tbr->PRIM_type = T_BIND_ACK;
682 qreply(q, mp);
683 }
684 }
685
686 /*
687 * This routine handles each T_CONN_REQ message passed to udp. It
688 * associates a default destination address with the stream.
689 *
690 * After various error checks are completed, udp_connect() lays
691 * the target address and port into the composite header template.
692 * Then we ask IP for information, including a source address if we didn't
693 * already have one. Finally we send up the T_OK_ACK reply message.
694 */
695 static void
696 udp_tpi_connect(queue_t *q, mblk_t *mp)
697 {
698 conn_t *connp = Q_TO_CONN(q);
699 int error;
700 socklen_t len;
701 struct sockaddr *sa;
702 struct T_conn_req *tcr;
703 cred_t *cr;
704 pid_t pid;
705 /*
706 * All Solaris components should pass a db_credp
707 * for this TPI message, hence we ASSERT.
708 * But in case there is some other M_PROTO that looks
709 * like a TPI message sent by some other kernel
710 * component, we check and return an error.
711 */
712 cr = msg_getcred(mp, &pid);
713 ASSERT(cr != NULL);
714 if (cr == NULL) {
715 udp_err_ack(q, mp, TSYSERR, EINVAL);
716 return;
717 }
718
719 tcr = (struct T_conn_req *)mp->b_rptr;
720
721 /* A bit of sanity checking */
722 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
723 udp_err_ack(q, mp, TPROTO, 0);
724 return;
725 }
726
727 if (tcr->OPT_length != 0) {
728 udp_err_ack(q, mp, TBADOPT, 0);
729 return;
730 }
731
732 /*
733 * Determine packet type based on type of address passed in
734 * the request should contain an IPv4 or IPv6 address.
735 * Make sure that address family matches the type of
736 * family of the address passed down.
737 */
738 len = tcr->DEST_length;
739 switch (tcr->DEST_length) {
740 default:
741 udp_err_ack(q, mp, TBADADDR, 0);
742 return;
743
744 case sizeof (sin_t):
745 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
746 sizeof (sin_t));
747 break;
748
749 case sizeof (sin6_t):
750 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
751 sizeof (sin6_t));
752 break;
753 }
754
755 error = proto_verify_ip_addr(connp->conn_family, sa, len);
756 if (error != 0) {
757 udp_err_ack(q, mp, TSYSERR, error);
758 return;
759 }
760
761 error = udp_do_connect(connp, sa, len, cr, pid);
762 if (error != 0) {
763 if (error < 0)
764 udp_err_ack(q, mp, -error, 0);
765 else
766 udp_err_ack(q, mp, TSYSERR, error);
767 } else {
768 mblk_t *mp1;
769 /*
770 * We have to send a connection confirmation to
771 * keep TLI happy.
772 */
773 if (connp->conn_family == AF_INET) {
774 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
775 sizeof (sin_t), NULL, 0);
776 } else {
777 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
778 sizeof (sin6_t), NULL, 0);
779 }
780 if (mp1 == NULL) {
781 udp_err_ack(q, mp, TSYSERR, ENOMEM);
782 return;
783 }
784
785 /*
786 * Send ok_ack for T_CONN_REQ
787 */
788 mp = mi_tpi_ok_ack_alloc(mp);
789 if (mp == NULL) {
790 /* Unable to reuse the T_CONN_REQ for the ack. */
791 udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
792 return;
793 }
794
795 putnext(connp->conn_rq, mp);
796 putnext(connp->conn_rq, mp1);
797 }
798 }
799
800 static int
801 udp_tpi_close(queue_t *q, int flags)
802 {
803 conn_t *connp;
804
805 if (flags & SO_FALLBACK) {
806 /*
807 * stream is being closed while in fallback
808 * simply free the resources that were allocated
809 */
810 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
811 qprocsoff(q);
812 goto done;
813 }
814
815 connp = Q_TO_CONN(q);
816 udp_do_close(connp);
817 done:
818 q->q_ptr = WR(q)->q_ptr = NULL;
819 return (0);
820 }
821
822 static void
823 udp_close_free(conn_t *connp)
824 {
825 udp_t *udp = connp->conn_udp;
826
827 /* If there are any options associated with the stream, free them. */
828 if (udp->udp_recv_ipp.ipp_fields != 0)
829 ip_pkt_free(&udp->udp_recv_ipp);
830
831 /*
832 * Clear any fields which the kmem_cache constructor clears.
833 * Only udp_connp needs to be preserved.
834 * TBD: We should make this more efficient to avoid clearing
835 * everything.
836 */
837 ASSERT(udp->udp_connp == connp);
838 bzero(udp, sizeof (udp_t));
839 udp->udp_connp = connp;
840 }
841
842 static int
843 udp_do_disconnect(conn_t *connp)
844 {
845 udp_t *udp;
846 udp_fanout_t *udpf;
847 udp_stack_t *us;
848 int error;
849
850 udp = connp->conn_udp;
851 us = udp->udp_us;
852 mutex_enter(&connp->conn_lock);
853 if (udp->udp_state != TS_DATA_XFER) {
854 mutex_exit(&connp->conn_lock);
855 return (-TOUTSTATE);
856 }
857 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
858 us->us_bind_fanout_size)];
859 mutex_enter(&udpf->uf_lock);
860 if (connp->conn_mcbc_bind)
861 connp->conn_saddr_v6 = ipv6_all_zeros;
862 else
863 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
864 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
865 connp->conn_faddr_v6 = ipv6_all_zeros;
866 connp->conn_fport = 0;
867 udp->udp_state = TS_IDLE;
868 mutex_exit(&udpf->uf_lock);
869
870 /* Remove any remnants of mapped address binding */
871 if (connp->conn_family == AF_INET6)
872 connp->conn_ipversion = IPV6_VERSION;
873
874 connp->conn_v6lastdst = ipv6_all_zeros;
875 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
876 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
877 mutex_exit(&connp->conn_lock);
878 if (error != 0)
879 return (error);
880
881 /*
882 * Tell IP to remove the full binding and revert
883 * to the local address binding.
884 */
885 return (ip_laddr_fanout_insert(connp));
886 }
887
888 static void
889 udp_tpi_disconnect(queue_t *q, mblk_t *mp)
890 {
891 conn_t *connp = Q_TO_CONN(q);
892 int error;
893
894 /*
895 * Allocate the largest primitive we need to send back
896 * T_error_ack is > than T_ok_ack
897 */
898 mp = reallocb(mp, sizeof (struct T_error_ack), 1);
899 if (mp == NULL) {
900 /* Unable to reuse the T_DISCON_REQ for the ack. */
901 udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
902 return;
903 }
904
905 error = udp_do_disconnect(connp);
906
907 if (error != 0) {
908 if (error < 0) {
909 udp_err_ack(q, mp, -error, 0);
910 } else {
911 udp_err_ack(q, mp, TSYSERR, error);
912 }
913 } else {
914 mp = mi_tpi_ok_ack_alloc(mp);
915 ASSERT(mp != NULL);
916 qreply(q, mp);
917 }
918 }
919
920 int
921 udp_disconnect(conn_t *connp)
922 {
923 int error;
924
925 connp->conn_dgram_errind = B_FALSE;
926 error = udp_do_disconnect(connp);
927 if (error < 0)
928 error = proto_tlitosyserr(-error);
929
930 return (error);
931 }
932
933 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
934 static void
935 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
936 {
937 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
938 qreply(q, mp);
939 }
940
941 /* Shorthand to generate and send TPI error acks to our client */
942 static void
943 udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
944 t_scalar_t t_error, int sys_error)
945 {
946 struct T_error_ack *teackp;
947
948 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
949 M_PCPROTO, T_ERROR_ACK)) != NULL) {
950 teackp = (struct T_error_ack *)mp->b_rptr;
951 teackp->ERROR_prim = primitive;
952 teackp->TLI_error = t_error;
953 teackp->UNIX_error = sys_error;
954 qreply(q, mp);
955 }
956 }
957
958 /* At minimum we need 4 bytes of UDP header */
959 #define ICMP_MIN_UDP_HDR 4
960
961 /*
962 * udp_icmp_input is called as conn_recvicmp to process ICMP messages.
963 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
964 * Assumes that IP has pulled up everything up to and including the ICMP header.
965 */
966 /* ARGSUSED2 */
967 static void
968 udp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
969 {
970 conn_t *connp = (conn_t *)arg1;
971 icmph_t *icmph;
972 ipha_t *ipha;
973 int iph_hdr_length;
974 udpha_t *udpha;
975 sin_t sin;
976 sin6_t sin6;
977 mblk_t *mp1;
978 int error = 0;
979 udp_t *udp = connp->conn_udp;
980
981 ipha = (ipha_t *)mp->b_rptr;
982
983 ASSERT(OK_32PTR(mp->b_rptr));
984
985 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
986 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
987 udp_icmp_error_ipv6(connp, mp, ira);
988 return;
989 }
990 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
991
992 /* Skip past the outer IP and ICMP headers */
993 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
994 iph_hdr_length = ira->ira_ip_hdr_length;
995 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
996 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
997
998 /* Skip past the inner IP and find the ULP header */
999 iph_hdr_length = IPH_HDR_LENGTH(ipha);
1000 udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
1001
1002 switch (icmph->icmph_type) {
1003 case ICMP_DEST_UNREACHABLE:
1004 switch (icmph->icmph_code) {
1005 case ICMP_FRAGMENTATION_NEEDED: {
1006 ipha_t *ipha;
1007 ip_xmit_attr_t *ixa;
1008 /*
1009 * IP has already adjusted the path MTU.
1010 * But we need to adjust DF for IPv4.
1011 */
1012 if (connp->conn_ipversion != IPV4_VERSION)
1013 break;
1014
1015 ixa = conn_get_ixa(connp, B_FALSE);
1016 if (ixa == NULL || ixa->ixa_ire == NULL) {
1017 /*
1018 * Some other thread holds conn_ixa. We will
1019 * redo this on the next ICMP too big.
1020 */
1021 if (ixa != NULL)
1022 ixa_refrele(ixa);
1023 break;
1024 }
1025 (void) ip_get_pmtu(ixa);
1026
1027 mutex_enter(&connp->conn_lock);
1028 ipha = (ipha_t *)connp->conn_ht_iphc;
1029 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
1030 ipha->ipha_fragment_offset_and_flags |=
1031 IPH_DF_HTONS;
1032 } else {
1033 ipha->ipha_fragment_offset_and_flags &=
1034 ~IPH_DF_HTONS;
1035 }
1036 mutex_exit(&connp->conn_lock);
1037 ixa_refrele(ixa);
1038 break;
1039 }
1040 case ICMP_PORT_UNREACHABLE:
1041 case ICMP_PROTOCOL_UNREACHABLE:
1042 error = ECONNREFUSED;
1043 break;
1044 default:
1045 /* Transient errors */
1046 break;
1047 }
1048 break;
1049 default:
1050 /* Transient errors */
1051 break;
1052 }
1053 if (error == 0) {
1054 freemsg(mp);
1055 return;
1056 }
1057
1058 /*
1059 * Deliver T_UDERROR_IND when the application has asked for it.
1060 * The socket layer enables this automatically when connected.
1061 */
1062 if (!connp->conn_dgram_errind) {
1063 freemsg(mp);
1064 return;
1065 }
1066
1067 switch (connp->conn_family) {
1068 case AF_INET:
1069 sin = sin_null;
1070 sin.sin_family = AF_INET;
1071 sin.sin_addr.s_addr = ipha->ipha_dst;
1072 sin.sin_port = udpha->uha_dst_port;
1073 if (IPCL_IS_NONSTR(connp)) {
1074 mutex_enter(&connp->conn_lock);
1075 if (udp->udp_state == TS_DATA_XFER) {
1076 if (sin.sin_port == connp->conn_fport &&
1077 sin.sin_addr.s_addr ==
1078 connp->conn_faddr_v4) {
1079 mutex_exit(&connp->conn_lock);
1080 (*connp->conn_upcalls->su_set_error)
1081 (connp->conn_upper_handle, error);
1082 goto done;
1083 }
1084 } else {
1085 udp->udp_delayed_error = error;
1086 *((sin_t *)&udp->udp_delayed_addr) = sin;
1087 }
1088 mutex_exit(&connp->conn_lock);
1089 } else {
1090 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t),
1091 NULL, 0, error);
1092 if (mp1 != NULL)
1093 putnext(connp->conn_rq, mp1);
1094 }
1095 break;
1096 case AF_INET6:
1097 sin6 = sin6_null;
1098 sin6.sin6_family = AF_INET6;
1099 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1100 sin6.sin6_port = udpha->uha_dst_port;
1101 if (IPCL_IS_NONSTR(connp)) {
1102 mutex_enter(&connp->conn_lock);
1103 if (udp->udp_state == TS_DATA_XFER) {
1104 if (sin6.sin6_port == connp->conn_fport &&
1105 IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1106 &connp->conn_faddr_v6)) {
1107 mutex_exit(&connp->conn_lock);
1108 (*connp->conn_upcalls->su_set_error)
1109 (connp->conn_upper_handle, error);
1110 goto done;
1111 }
1112 } else {
1113 udp->udp_delayed_error = error;
1114 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1115 }
1116 mutex_exit(&connp->conn_lock);
1117 } else {
1118 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1119 NULL, 0, error);
1120 if (mp1 != NULL)
1121 putnext(connp->conn_rq, mp1);
1122 }
1123 break;
1124 }
1125 done:
1126 freemsg(mp);
1127 }
1128
1129 /*
1130 * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1131 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1132 * Assumes that IP has pulled up all the extension headers as well as the
1133 * ICMPv6 header.
1134 */
1135 static void
1136 udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1137 {
1138 icmp6_t *icmp6;
1139 ip6_t *ip6h, *outer_ip6h;
1140 uint16_t iph_hdr_length;
1141 uint8_t *nexthdrp;
1142 udpha_t *udpha;
1143 sin6_t sin6;
1144 mblk_t *mp1;
1145 int error = 0;
1146 udp_t *udp = connp->conn_udp;
1147 udp_stack_t *us = udp->udp_us;
1148
1149 outer_ip6h = (ip6_t *)mp->b_rptr;
1150 #ifdef DEBUG
1151 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1152 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1153 else
1154 iph_hdr_length = IPV6_HDR_LEN;
1155 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1156 #endif
1157 /* Skip past the outer IP and ICMP headers */
1158 iph_hdr_length = ira->ira_ip_hdr_length;
1159 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1160
1161 /* Skip past the inner IP and find the ULP header */
1162 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */
1163 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1164 freemsg(mp);
1165 return;
1166 }
1167 udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1168
1169 switch (icmp6->icmp6_type) {
1170 case ICMP6_DST_UNREACH:
1171 switch (icmp6->icmp6_code) {
1172 case ICMP6_DST_UNREACH_NOPORT:
1173 error = ECONNREFUSED;
1174 break;
1175 case ICMP6_DST_UNREACH_ADMIN:
1176 case ICMP6_DST_UNREACH_NOROUTE:
1177 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1178 case ICMP6_DST_UNREACH_ADDR:
1179 /* Transient errors */
1180 break;
1181 default:
1182 break;
1183 }
1184 break;
1185 case ICMP6_PACKET_TOO_BIG: {
1186 struct T_unitdata_ind *tudi;
1187 struct T_opthdr *toh;
1188 size_t udi_size;
1189 mblk_t *newmp;
1190 t_scalar_t opt_length = sizeof (struct T_opthdr) +
1191 sizeof (struct ip6_mtuinfo);
1192 sin6_t *sin6;
1193 struct ip6_mtuinfo *mtuinfo;
1194
1195 /*
1196 * If the application has requested to receive path mtu
1197 * information, send up an empty message containing an
1198 * IPV6_PATHMTU ancillary data item.
1199 */
1200 if (!connp->conn_ipv6_recvpathmtu)
1201 break;
1202
1203 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1204 opt_length;
1205 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1206 UDPS_BUMP_MIB(us, udpInErrors);
1207 break;
1208 }
1209
1210 /*
1211 * newmp->b_cont is left to NULL on purpose. This is an
1212 * empty message containing only ancillary data.
1213 */
1214 newmp->b_datap->db_type = M_PROTO;
1215 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1216 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1217 tudi->PRIM_type = T_UNITDATA_IND;
1218 tudi->SRC_length = sizeof (sin6_t);
1219 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1220 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1221 tudi->OPT_length = opt_length;
1222
1223 sin6 = (sin6_t *)&tudi[1];
1224 bzero(sin6, sizeof (sin6_t));
1225 sin6->sin6_family = AF_INET6;
1226 sin6->sin6_addr = connp->conn_faddr_v6;
1227
1228 toh = (struct T_opthdr *)&sin6[1];
1229 toh->level = IPPROTO_IPV6;
1230 toh->name = IPV6_PATHMTU;
1231 toh->len = opt_length;
1232 toh->status = 0;
1233
1234 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1235 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1236 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1237 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1238 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1239 /*
1240 * We've consumed everything we need from the original
1241 * message. Free it, then send our empty message.
1242 */
1243 freemsg(mp);
1244 udp_ulp_recv(connp, newmp, msgdsize(newmp), ira);
1245 return;
1246 }
1247 case ICMP6_TIME_EXCEEDED:
1248 /* Transient errors */
1249 break;
1250 case ICMP6_PARAM_PROB:
1251 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1252 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1253 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1254 (uchar_t *)nexthdrp) {
1255 error = ECONNREFUSED;
1256 break;
1257 }
1258 break;
1259 }
1260 if (error == 0) {
1261 freemsg(mp);
1262 return;
1263 }
1264
1265 /*
1266 * Deliver T_UDERROR_IND when the application has asked for it.
1267 * The socket layer enables this automatically when connected.
1268 */
1269 if (!connp->conn_dgram_errind) {
1270 freemsg(mp);
1271 return;
1272 }
1273
1274 sin6 = sin6_null;
1275 sin6.sin6_family = AF_INET6;
1276 sin6.sin6_addr = ip6h->ip6_dst;
1277 sin6.sin6_port = udpha->uha_dst_port;
1278 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1279
1280 if (IPCL_IS_NONSTR(connp)) {
1281 mutex_enter(&connp->conn_lock);
1282 if (udp->udp_state == TS_DATA_XFER) {
1283 if (sin6.sin6_port == connp->conn_fport &&
1284 IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1285 &connp->conn_faddr_v6)) {
1286 mutex_exit(&connp->conn_lock);
1287 (*connp->conn_upcalls->su_set_error)
1288 (connp->conn_upper_handle, error);
1289 goto done;
1290 }
1291 } else {
1292 udp->udp_delayed_error = error;
1293 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1294 }
1295 mutex_exit(&connp->conn_lock);
1296 } else {
1297 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1298 NULL, 0, error);
1299 if (mp1 != NULL)
1300 putnext(connp->conn_rq, mp1);
1301 }
1302 done:
1303 freemsg(mp);
1304 }
1305
1306 /*
1307 * This routine responds to T_ADDR_REQ messages. It is called by udp_wput.
1308 * The local address is filled in if endpoint is bound. The remote address
1309 * is filled in if remote address has been precified ("connected endpoint")
1310 * (The concept of connected CLTS sockets is alien to published TPI
1311 * but we support it anyway).
1312 */
1313 static void
1314 udp_addr_req(queue_t *q, mblk_t *mp)
1315 {
1316 struct sockaddr *sa;
1317 mblk_t *ackmp;
1318 struct T_addr_ack *taa;
1319 udp_t *udp = Q_TO_UDP(q);
1320 conn_t *connp = udp->udp_connp;
1321 uint_t addrlen;
1322
1323 /* Make it large enough for worst case */
1324 ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1325 2 * sizeof (sin6_t), 1);
1326 if (ackmp == NULL) {
1327 udp_err_ack(q, mp, TSYSERR, ENOMEM);
1328 return;
1329 }
1330 taa = (struct T_addr_ack *)ackmp->b_rptr;
1331
1332 bzero(taa, sizeof (struct T_addr_ack));
1333 ackmp->b_wptr = (uchar_t *)&taa[1];
1334
1335 taa->PRIM_type = T_ADDR_ACK;
1336 ackmp->b_datap->db_type = M_PCPROTO;
1337
1338 if (connp->conn_family == AF_INET)
1339 addrlen = sizeof (sin_t);
1340 else
1341 addrlen = sizeof (sin6_t);
1342
1343 mutex_enter(&connp->conn_lock);
1344 /*
1345 * Note: Following code assumes 32 bit alignment of basic
1346 * data structures like sin_t and struct T_addr_ack.
1347 */
1348 if (udp->udp_state != TS_UNBND) {
1349 /*
1350 * Fill in local address first
1351 */
1352 taa->LOCADDR_offset = sizeof (*taa);
1353 taa->LOCADDR_length = addrlen;
1354 sa = (struct sockaddr *)&taa[1];
1355 (void) conn_getsockname(connp, sa, &addrlen);
1356 ackmp->b_wptr += addrlen;
1357 }
1358 if (udp->udp_state == TS_DATA_XFER) {
1359 /*
1360 * connected, fill remote address too
1361 */
1362 taa->REMADDR_length = addrlen;
1363 /* assumed 32-bit alignment */
1364 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1365 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1366 (void) conn_getpeername(connp, sa, &addrlen);
1367 ackmp->b_wptr += addrlen;
1368 }
1369 mutex_exit(&connp->conn_lock);
1370 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1371 qreply(q, ackmp);
1372 }
1373
1374 static void
1375 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
1376 {
1377 conn_t *connp = udp->udp_connp;
1378
1379 if (connp->conn_family == AF_INET) {
1380 *tap = udp_g_t_info_ack_ipv4;
1381 } else {
1382 *tap = udp_g_t_info_ack_ipv6;
1383 }
1384 tap->CURRENT_state = udp->udp_state;
1385 tap->OPT_size = udp_max_optsize;
1386 }
1387
1388 static void
1389 udp_do_capability_ack(udp_t *udp, struct T_capability_ack *tcap,
1390 t_uscalar_t cap_bits1)
1391 {
1392 tcap->CAP_bits1 = 0;
1393
1394 if (cap_bits1 & TC1_INFO) {
1395 udp_copy_info(&tcap->INFO_ack, udp);
1396 tcap->CAP_bits1 |= TC1_INFO;
1397 }
1398 }
1399
1400 /*
1401 * This routine responds to T_CAPABILITY_REQ messages. It is called by
1402 * udp_wput. Much of the T_CAPABILITY_ACK information is copied from
1403 * udp_g_t_info_ack. The current state of the stream is copied from
1404 * udp_state.
1405 */
1406 static void
1407 udp_capability_req(queue_t *q, mblk_t *mp)
1408 {
1409 t_uscalar_t cap_bits1;
1410 struct T_capability_ack *tcap;
1411 udp_t *udp = Q_TO_UDP(q);
1412
1413 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1414
1415 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1416 mp->b_datap->db_type, T_CAPABILITY_ACK);
1417 if (!mp)
1418 return;
1419
1420 tcap = (struct T_capability_ack *)mp->b_rptr;
1421 udp_do_capability_ack(udp, tcap, cap_bits1);
1422
1423 qreply(q, mp);
1424 }
1425
1426 /*
1427 * This routine responds to T_INFO_REQ messages. It is called by udp_wput.
1428 * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
1429 * The current state of the stream is copied from udp_state.
1430 */
1431 static void
1432 udp_info_req(queue_t *q, mblk_t *mp)
1433 {
1434 udp_t *udp = Q_TO_UDP(q);
1435
1436 /* Create a T_INFO_ACK message. */
1437 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1438 T_INFO_ACK);
1439 if (!mp)
1440 return;
1441 udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
1442 qreply(q, mp);
1443 }
1444
1445 /* For /dev/udp aka AF_INET open */
1446 static int
1447 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1448 {
1449 return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
1450 }
1451
1452 /* For /dev/udp6 aka AF_INET6 open */
1453 static int
1454 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1455 {
1456 return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
1457 }
1458
1459 /*
1460 * This is the open routine for udp. It allocates a udp_t structure for
1461 * the stream and, on the first open of the module, creates an ND table.
1462 */
1463 static int
1464 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1465 boolean_t isv6)
1466 {
1467 udp_t *udp;
1468 conn_t *connp;
1469 dev_t conn_dev;
1470 vmem_t *minor_arena;
1471 int err;
1472
1473 /* If the stream is already open, return immediately. */
1474 if (q->q_ptr != NULL)
1475 return (0);
1476
1477 if (sflag == MODOPEN)
1478 return (EINVAL);
1479
1480 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
1481 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
1482 minor_arena = ip_minor_arena_la;
1483 } else {
1484 /*
1485 * Either minor numbers in the large arena were exhausted
1486 * or a non socket application is doing the open.
1487 * Try to allocate from the small arena.
1488 */
1489 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0)
1490 return (EBUSY);
1491
1492 minor_arena = ip_minor_arena_sa;
1493 }
1494
1495 if (flag & SO_FALLBACK) {
1496 /*
1497 * Non streams socket needs a stream to fallback to
1498 */
1499 RD(q)->q_ptr = (void *)conn_dev;
1500 WR(q)->q_qinfo = &udp_fallback_sock_winit;
1501 WR(q)->q_ptr = (void *)minor_arena;
1502 qprocson(q);
1503 return (0);
1504 }
1505
1506 connp = udp_do_open(credp, isv6, KM_SLEEP, &err);
1507 if (connp == NULL) {
1508 inet_minor_free(minor_arena, conn_dev);
1509 return (err);
1510 }
1511 udp = connp->conn_udp;
1512
1513 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1514 connp->conn_dev = conn_dev;
1515 connp->conn_minor_arena = minor_arena;
1516
1517 /*
1518 * Initialize the udp_t structure for this stream.
1519 */
1520 q->q_ptr = connp;
1521 WR(q)->q_ptr = connp;
1522 connp->conn_rq = q;
1523 connp->conn_wq = WR(q);
1524
1525 /*
1526 * Since this conn_t/udp_t is not yet visible to anybody else we don't
1527 * need to lock anything.
1528 */
1529 ASSERT(connp->conn_proto == IPPROTO_UDP);
1530 ASSERT(connp->conn_udp == udp);
1531 ASSERT(udp->udp_connp == connp);
1532
1533 if (flag & SO_SOCKSTR) {
1534 udp->udp_issocket = B_TRUE;
1535 }
1536
1537 WR(q)->q_hiwat = connp->conn_sndbuf;
1538 WR(q)->q_lowat = connp->conn_sndlowat;
1539
1540 qprocson(q);
1541
1542 /* Set the Stream head write offset and high watermark. */
1543 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1544 (void) proto_set_rx_hiwat(q, connp,
1545 udp_set_rcv_hiwat(udp, connp->conn_rcvbuf));
1546
1547 mutex_enter(&connp->conn_lock);
1548 connp->conn_state_flags &= ~CONN_INCIPIENT;
1549 mutex_exit(&connp->conn_lock);
1550 return (0);
1551 }
1552
1553 /*
1554 * Which UDP options OK to set through T_UNITDATA_REQ...
1555 */
1556 /* ARGSUSED */
1557 static boolean_t
1558 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1559 {
1560 return (B_TRUE);
1561 }
1562
1563 /*
1564 * This routine gets default values of certain options whose default
1565 * values are maintained by protcol specific code
1566 */
1567 int
1568 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1569 {
1570 udp_t *udp = Q_TO_UDP(q);
1571 udp_stack_t *us = udp->udp_us;
1572 int *i1 = (int *)ptr;
1573
1574 switch (level) {
1575 case IPPROTO_IP:
1576 switch (name) {
1577 case IP_MULTICAST_TTL:
1578 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1579 return (sizeof (uchar_t));
1580 case IP_MULTICAST_LOOP:
1581 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1582 return (sizeof (uchar_t));
1583 }
1584 break;
1585 case IPPROTO_IPV6:
1586 switch (name) {
1587 case IPV6_MULTICAST_HOPS:
1588 *i1 = IP_DEFAULT_MULTICAST_TTL;
1589 return (sizeof (int));
1590 case IPV6_MULTICAST_LOOP:
1591 *i1 = IP_DEFAULT_MULTICAST_LOOP;
1592 return (sizeof (int));
1593 case IPV6_UNICAST_HOPS:
1594 *i1 = us->us_ipv6_hoplimit;
1595 return (sizeof (int));
1596 }
1597 break;
1598 }
1599 return (-1);
1600 }
1601
1602 /*
1603 * This routine retrieves the current status of socket options.
1604 * It returns the size of the option retrieved, or -1.
1605 */
1606 int
1607 udp_opt_get(conn_t *connp, t_scalar_t level, t_scalar_t name,
1608 uchar_t *ptr)
1609 {
1610 int *i1 = (int *)ptr;
1611 udp_t *udp = connp->conn_udp;
1612 int len;
1613 conn_opt_arg_t coas;
1614 int retval;
1615
1616 coas.coa_connp = connp;
1617 coas.coa_ixa = connp->conn_ixa;
1618 coas.coa_ipp = &connp->conn_xmit_ipp;
1619 coas.coa_ancillary = B_FALSE;
1620 coas.coa_changed = 0;
1621
1622 /*
1623 * We assume that the optcom framework has checked for the set
1624 * of levels and names that are supported, hence we don't worry
1625 * about rejecting based on that.
1626 * First check for UDP specific handling, then pass to common routine.
1627 */
1628 switch (level) {
1629 case IPPROTO_IP:
1630 /*
1631 * Only allow IPv4 option processing on IPv4 sockets.
1632 */
1633 if (connp->conn_family != AF_INET)
1634 return (-1);
1635
1636 switch (name) {
1637 case IP_OPTIONS:
1638 case T_IP_OPTIONS:
1639 mutex_enter(&connp->conn_lock);
1640 if (!(udp->udp_recv_ipp.ipp_fields &
1641 IPPF_IPV4_OPTIONS)) {
1642 mutex_exit(&connp->conn_lock);
1643 return (0);
1644 }
1645
1646 len = udp->udp_recv_ipp.ipp_ipv4_options_len;
1647 ASSERT(len != 0);
1648 bcopy(udp->udp_recv_ipp.ipp_ipv4_options, ptr, len);
1649 mutex_exit(&connp->conn_lock);
1650 return (len);
1651 }
1652 break;
1653 case IPPROTO_UDP:
1654 switch (name) {
1655 case UDP_NAT_T_ENDPOINT:
1656 mutex_enter(&connp->conn_lock);
1657 *i1 = udp->udp_nat_t_endpoint;
1658 mutex_exit(&connp->conn_lock);
1659 return (sizeof (int));
1660 case UDP_RCVHDR:
1661 mutex_enter(&connp->conn_lock);
1662 *i1 = udp->udp_rcvhdr ? 1 : 0;
1663 mutex_exit(&connp->conn_lock);
1664 return (sizeof (int));
1665 case UDP_SRCPORT_HASH:
1666 mutex_enter(&connp->conn_lock);
1667 *i1 = udp->udp_vxlanhash;
1668 mutex_exit(&connp->conn_lock);
1669 return (sizeof (int));
1670 case UDP_SND_TO_CONNECTED:
1671 mutex_enter(&connp->conn_lock);
1672 *i1 = udp->udp_snd_to_conn ? 1 : 0;
1673 mutex_exit(&connp->conn_lock);
1674 return (sizeof (int));
1675 }
1676 }
1677 mutex_enter(&connp->conn_lock);
1678 retval = conn_opt_get(&coas, level, name, ptr);
1679 mutex_exit(&connp->conn_lock);
1680 return (retval);
1681 }
1682
1683 /*
1684 * This routine retrieves the current status of socket options.
1685 * It returns the size of the option retrieved, or -1.
1686 */
1687 int
1688 udp_tpi_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1689 {
1690 conn_t *connp = Q_TO_CONN(q);
1691 int err;
1692
1693 err = udp_opt_get(connp, level, name, ptr);
1694 return (err);
1695 }
1696
1697 /*
1698 * This routine sets socket options.
1699 */
1700 int
1701 udp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1702 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1703 {
1704 conn_t *connp = coa->coa_connp;
1705 ip_xmit_attr_t *ixa = coa->coa_ixa;
1706 udp_t *udp = connp->conn_udp;
1707 udp_stack_t *us = udp->udp_us;
1708 int *i1 = (int *)invalp;
1709 boolean_t onoff = (*i1 == 0) ? 0 : 1;
1710 int error;
1711
1712 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1713 /*
1714 * First do UDP specific sanity checks and handle UDP specific
1715 * options. Note that some IPPROTO_UDP options are handled
1716 * by conn_opt_set.
1717 */
1718 switch (level) {
1719 case SOL_SOCKET:
1720 switch (name) {
1721 case SO_SNDBUF:
1722 if (*i1 > us->us_max_buf) {
1723 return (ENOBUFS);
1724 }
1725 break;
1726 case SO_RCVBUF:
1727 if (*i1 > us->us_max_buf) {
1728 return (ENOBUFS);
1729 }
1730 break;
1731
1732 case SCM_UCRED: {
1733 struct ucred_s *ucr;
1734 cred_t *newcr;
1735 ts_label_t *tsl;
1736
1737 /*
1738 * Only sockets that have proper privileges and are
1739 * bound to MLPs will have any other value here, so
1740 * this implicitly tests for privilege to set label.
1741 */
1742 if (connp->conn_mlp_type == mlptSingle)
1743 break;
1744
1745 ucr = (struct ucred_s *)invalp;
1746 if (inlen < sizeof (*ucr) + sizeof (bslabel_t) ||
1747 ucr->uc_labeloff < sizeof (*ucr) ||
1748 ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
1749 return (EINVAL);
1750 if (!checkonly) {
1751 /*
1752 * Set ixa_tsl to the new label.
1753 * We assume that crgetzoneid doesn't change
1754 * as part of the SCM_UCRED.
1755 */
1756 ASSERT(cr != NULL);
1757 if ((tsl = crgetlabel(cr)) == NULL)
1758 return (EINVAL);
1759 newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
1760 tsl->tsl_doi, KM_NOSLEEP);
1761 if (newcr == NULL)
1762 return (ENOSR);
1763 ASSERT(newcr->cr_label != NULL);
1764 /*
1765 * Move the hold on the cr_label to ixa_tsl by
1766 * setting cr_label to NULL. Then release newcr.
1767 */
1768 ip_xmit_attr_replace_tsl(ixa, newcr->cr_label);
1769 ixa->ixa_flags |= IXAF_UCRED_TSL;
1770 newcr->cr_label = NULL;
1771 crfree(newcr);
1772 coa->coa_changed |= COA_HEADER_CHANGED;
1773 coa->coa_changed |= COA_WROFF_CHANGED;
1774 }
1775 /* Fully handled this option. */
1776 return (0);
1777 }
1778 }
1779 break;
1780 case IPPROTO_UDP:
1781 switch (name) {
1782 case UDP_NAT_T_ENDPOINT:
1783 if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1784 return (error);
1785 }
1786
1787 /*
1788 * Use conn_family instead so we can avoid ambiguitites
1789 * with AF_INET6 sockets that may switch from IPv4
1790 * to IPv6.
1791 */
1792 if (connp->conn_family != AF_INET) {
1793 return (EAFNOSUPPORT);
1794 }
1795
1796 if (!checkonly) {
1797 mutex_enter(&connp->conn_lock);
1798 udp->udp_nat_t_endpoint = onoff;
1799 mutex_exit(&connp->conn_lock);
1800 coa->coa_changed |= COA_HEADER_CHANGED;
1801 coa->coa_changed |= COA_WROFF_CHANGED;
1802 }
1803 /* Fully handled this option. */
1804 return (0);
1805 case UDP_RCVHDR:
1806 mutex_enter(&connp->conn_lock);
1807 udp->udp_rcvhdr = onoff;
1808 mutex_exit(&connp->conn_lock);
1809 return (0);
1810 case UDP_SRCPORT_HASH:
1811 /*
1812 * This should have already been verified, but double
1813 * check.
1814 */
1815 if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1816 return (error);
1817 }
1818
1819 /* First see if the val is something we understand */
1820 if (*i1 != UDP_HASH_DISABLE && *i1 != UDP_HASH_VXLAN)
1821 return (EINVAL);
1822
1823 if (!checkonly) {
1824 mutex_enter(&connp->conn_lock);
1825 udp->udp_vxlanhash = *i1;
1826 mutex_exit(&connp->conn_lock);
1827 }
1828 /* Fully handled this option. */
1829 return (0);
1830 case UDP_SND_TO_CONNECTED:
1831 mutex_enter(&connp->conn_lock);
1832 udp->udp_snd_to_conn = onoff;
1833 mutex_exit(&connp->conn_lock);
1834 return (0);
1835 }
1836 break;
1837 }
1838 error = conn_opt_set(coa, level, name, inlen, invalp,
1839 checkonly, cr);
1840 return (error);
1841 }
1842
1843 /*
1844 * This routine sets socket options.
1845 */
1846 int
1847 udp_opt_set(conn_t *connp, uint_t optset_context, int level,
1848 int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
1849 uchar_t *outvalp, void *thisdg_attrs, cred_t *cr)
1850 {
1851 udp_t *udp = connp->conn_udp;
1852 int err;
1853 conn_opt_arg_t coas, *coa;
1854 boolean_t checkonly;
1855 udp_stack_t *us = udp->udp_us;
1856
1857 switch (optset_context) {
1858 case SETFN_OPTCOM_CHECKONLY:
1859 checkonly = B_TRUE;
1860 /*
1861 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
1862 * inlen != 0 implies value supplied and
1863 * we have to "pretend" to set it.
1864 * inlen == 0 implies that there is no
1865 * value part in T_CHECK request and just validation
1866 * done elsewhere should be enough, we just return here.
1867 */
1868 if (inlen == 0) {
1869 *outlenp = 0;
1870 return (0);
1871 }
1872 break;
1873 case SETFN_OPTCOM_NEGOTIATE:
1874 checkonly = B_FALSE;
1875 break;
1876 case SETFN_UD_NEGOTIATE:
1877 case SETFN_CONN_NEGOTIATE:
1878 checkonly = B_FALSE;
1879 /*
1880 * Negotiating local and "association-related" options
1881 * through T_UNITDATA_REQ.
1882 *
1883 * Following routine can filter out ones we do not
1884 * want to be "set" this way.
1885 */
1886 if (!udp_opt_allow_udr_set(level, name)) {
1887 *outlenp = 0;
1888 return (EINVAL);
1889 }
1890 break;
1891 default:
1892 /*
1893 * We should never get here
1894 */
1895 *outlenp = 0;
1896 return (EINVAL);
1897 }
1898
1899 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
1900 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
1901
1902 if (thisdg_attrs != NULL) {
1903 /* Options from T_UNITDATA_REQ */
1904 coa = (conn_opt_arg_t *)thisdg_attrs;
1905 ASSERT(coa->coa_connp == connp);
1906 ASSERT(coa->coa_ixa != NULL);
1907 ASSERT(coa->coa_ipp != NULL);
1908 ASSERT(coa->coa_ancillary);
1909 } else {
1910 coa = &coas;
1911 coas.coa_connp = connp;
1912 /* Get a reference on conn_ixa to prevent concurrent mods */
1913 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
1914 if (coas.coa_ixa == NULL) {
1915 *outlenp = 0;
1916 return (ENOMEM);
1917 }
1918 coas.coa_ipp = &connp->conn_xmit_ipp;
1919 coas.coa_ancillary = B_FALSE;
1920 coas.coa_changed = 0;
1921 }
1922
1923 err = udp_do_opt_set(coa, level, name, inlen, invalp,
1924 cr, checkonly);
1925 if (err != 0) {
1926 errout:
1927 if (!coa->coa_ancillary)
1928 ixa_refrele(coa->coa_ixa);
1929 *outlenp = 0;
1930 return (err);
1931 }
1932 /* Handle DHCPINIT here outside of lock */
1933 if (level == IPPROTO_IP && name == IP_DHCPINIT_IF) {
1934 uint_t ifindex;
1935 ill_t *ill;
1936
1937 ifindex = *(uint_t *)invalp;
1938 if (ifindex == 0) {
1939 ill = NULL;
1940 } else {
1941 ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1942 coa->coa_ixa->ixa_ipst);
1943 if (ill == NULL) {
1944 err = ENXIO;
1945 goto errout;
1946 }
1947
1948 mutex_enter(&ill->ill_lock);
1949 if (ill->ill_state_flags & ILL_CONDEMNED) {
1950 mutex_exit(&ill->ill_lock);
1951 ill_refrele(ill);
1952 err = ENXIO;
1953 goto errout;
1954 }
1955 if (IS_VNI(ill)) {
1956 mutex_exit(&ill->ill_lock);
1957 ill_refrele(ill);
1958 err = EINVAL;
1959 goto errout;
1960 }
1961 }
1962 mutex_enter(&connp->conn_lock);
1963
1964 if (connp->conn_dhcpinit_ill != NULL) {
1965 /*
1966 * We've locked the conn so conn_cleanup_ill()
1967 * cannot clear conn_dhcpinit_ill -- so it's
1968 * safe to access the ill.
1969 */
1970 ill_t *oill = connp->conn_dhcpinit_ill;
1971
1972 ASSERT(oill->ill_dhcpinit != 0);
1973 atomic_dec_32(&oill->ill_dhcpinit);
1974 ill_set_inputfn(connp->conn_dhcpinit_ill);
1975 connp->conn_dhcpinit_ill = NULL;
1976 }
1977
1978 if (ill != NULL) {
1979 connp->conn_dhcpinit_ill = ill;
1980 atomic_inc_32(&ill->ill_dhcpinit);
1981 ill_set_inputfn(ill);
1982 mutex_exit(&connp->conn_lock);
1983 mutex_exit(&ill->ill_lock);
1984 ill_refrele(ill);
1985 } else {
1986 mutex_exit(&connp->conn_lock);
1987 }
1988 }
1989
1990 /*
1991 * Common case of OK return with outval same as inval.
1992 */
1993 if (invalp != outvalp) {
1994 /* don't trust bcopy for identical src/dst */
1995 (void) bcopy(invalp, outvalp, inlen);
1996 }
1997 *outlenp = inlen;
1998
1999 /*
2000 * If this was not ancillary data, then we rebuild the headers,
2001 * update the IRE/NCE, and IPsec as needed.
2002 * Since the label depends on the destination we go through
2003 * ip_set_destination first.
2004 */
2005 if (coa->coa_ancillary) {
2006 return (0);
2007 }
2008
2009 if (coa->coa_changed & COA_ROUTE_CHANGED) {
2010 in6_addr_t saddr, faddr, nexthop;
2011 in_port_t fport;
2012
2013 /*
2014 * We clear lastdst to make sure we pick up the change
2015 * next time sending.
2016 * If we are connected we re-cache the information.
2017 * We ignore errors to preserve BSD behavior.
2018 * Note that we don't redo IPsec policy lookup here
2019 * since the final destination (or source) didn't change.
2020 */
2021 mutex_enter(&connp->conn_lock);
2022 connp->conn_v6lastdst = ipv6_all_zeros;
2023
2024 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
2025 &connp->conn_faddr_v6, &nexthop);
2026 saddr = connp->conn_saddr_v6;
2027 faddr = connp->conn_faddr_v6;
2028 fport = connp->conn_fport;
2029 mutex_exit(&connp->conn_lock);
2030
2031 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
2032 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
2033 (void) ip_attr_connect(connp, coa->coa_ixa,
2034 &saddr, &faddr, &nexthop, fport, NULL, NULL,
2035 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
2036 }
2037 }
2038
2039 ixa_refrele(coa->coa_ixa);
2040
2041 if (coa->coa_changed & COA_HEADER_CHANGED) {
2042 /*
2043 * Rebuild the header template if we are connected.
2044 * Otherwise clear conn_v6lastdst so we rebuild the header
2045 * in the data path.
2046 */
2047 mutex_enter(&connp->conn_lock);
2048 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
2049 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
2050 err = udp_build_hdr_template(connp,
2051 &connp->conn_saddr_v6, &connp->conn_faddr_v6,
2052 connp->conn_fport, connp->conn_flowinfo);
2053 if (err != 0) {
2054 mutex_exit(&connp->conn_lock);
2055 return (err);
2056 }
2057 } else {
2058 connp->conn_v6lastdst = ipv6_all_zeros;
2059 }
2060 mutex_exit(&connp->conn_lock);
2061 }
2062 if (coa->coa_changed & COA_RCVBUF_CHANGED) {
2063 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2064 connp->conn_rcvbuf);
2065 }
2066 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
2067 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
2068 }
2069 if (coa->coa_changed & COA_WROFF_CHANGED) {
2070 /* Increase wroff if needed */
2071 uint_t wroff;
2072
2073 mutex_enter(&connp->conn_lock);
2074 wroff = connp->conn_ht_iphc_allocated + us->us_wroff_extra;
2075 if (udp->udp_nat_t_endpoint)
2076 wroff += sizeof (uint32_t);
2077 if (wroff > connp->conn_wroff) {
2078 connp->conn_wroff = wroff;
2079 mutex_exit(&connp->conn_lock);
2080 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
2081 } else {
2082 mutex_exit(&connp->conn_lock);
2083 }
2084 }
2085 return (err);
2086 }
2087
2088 /* This routine sets socket options. */
2089 int
2090 udp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
2091 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
2092 void *thisdg_attrs, cred_t *cr)
2093 {
2094 conn_t *connp = Q_TO_CONN(q);
2095 int error;
2096
2097 error = udp_opt_set(connp, optset_context, level, name, inlen, invalp,
2098 outlenp, outvalp, thisdg_attrs, cr);
2099 return (error);
2100 }
2101
2102 /*
2103 * Setup IP and UDP headers.
2104 * Returns NULL on allocation failure, in which case data_mp is freed.
2105 */
2106 mblk_t *
2107 udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
2108 const in6_addr_t *v6src, const in6_addr_t *v6dst, in_port_t dstport,
2109 uint32_t flowinfo, mblk_t *data_mp, int *errorp)
2110 {
2111 mblk_t *mp;
2112 udpha_t *udpha;
2113 udp_stack_t *us = connp->conn_netstack->netstack_udp;
2114 uint_t data_len;
2115 uint32_t cksum;
2116 udp_t *udp = connp->conn_udp;
2117 boolean_t insert_spi = udp->udp_nat_t_endpoint;
2118 boolean_t hash_srcport = udp->udp_vxlanhash;
2119 uint_t ulp_hdr_len;
2120 uint16_t srcport;
2121
2122 data_len = msgdsize(data_mp);
2123 ulp_hdr_len = UDPH_SIZE;
2124 if (insert_spi)
2125 ulp_hdr_len += sizeof (uint32_t);
2126
2127 /*
2128 * If we have source port hashing going on, determine the hash before
2129 * we modify the mblk_t.
2130 */
2131 if (hash_srcport == B_TRUE) {
2132 srcport = udp_srcport_hash(mp, UDP_HASH_VXLAN,
2133 IPPORT_DYNAMIC_MIN, IPPORT_DYNAMIC_MAX,
2134 ntohs(connp->conn_lport));
2135 }
2136
2137 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, IPPROTO_UDP, flowinfo,
2138 ulp_hdr_len, data_mp, data_len, us->us_wroff_extra, &cksum, errorp);
2139 if (mp == NULL) {
2140 ASSERT(*errorp != 0);
2141 return (NULL);
2142 }
2143
2144 data_len += ulp_hdr_len;
2145 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2146
2147 udpha = (udpha_t *)(mp->b_rptr + ixa->ixa_ip_hdr_length);
2148 if (hash_srcport == B_TRUE) {
2149 udpha->uha_src_port = htons(srcport);
2150 } else {
2151 udpha->uha_src_port = connp->conn_lport;
2152 }
2153 udpha->uha_dst_port = dstport;
2154 udpha->uha_checksum = 0;
2155 udpha->uha_length = htons(data_len);
2156
2157 /*
2158 * If there was a routing option/header then conn_prepend_hdr
2159 * has massaged it and placed the pseudo-header checksum difference
2160 * in the cksum argument.
2161 *
2162 * Setup header length and prepare for ULP checksum done in IP.
2163 *
2164 * We make it easy for IP to include our pseudo header
2165 * by putting our length in uha_checksum.
2166 * The IP source, destination, and length have already been set by
2167 * conn_prepend_hdr.
2168 */
2169 cksum += data_len;
2170 cksum = (cksum >> 16) + (cksum & 0xFFFF);
2171 ASSERT(cksum < 0x10000);
2172
2173 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2174 ipha_t *ipha = (ipha_t *)mp->b_rptr;
2175
2176 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2177
2178 /* IP does the checksum if uha_checksum is non-zero */
2179 if (us->us_do_checksum) {
2180 if (cksum == 0)
2181 udpha->uha_checksum = 0xffff;
2182 else
2183 udpha->uha_checksum = htons(cksum);
2184 } else {
2185 udpha->uha_checksum = 0;
2186 }
2187 } else {
2188 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2189
2190 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2191 if (cksum == 0)
2192 udpha->uha_checksum = 0xffff;
2193 else
2194 udpha->uha_checksum = htons(cksum);
2195 }
2196
2197 /* Insert all-0s SPI now. */
2198 if (insert_spi)
2199 *((uint32_t *)(udpha + 1)) = 0;
2200
2201 return (mp);
2202 }
2203
2204 static int
2205 udp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2206 const in6_addr_t *v6dst, in_port_t dstport, uint32_t flowinfo)
2207 {
2208 udpha_t *udpha;
2209 int error;
2210
2211 ASSERT(MUTEX_HELD(&connp->conn_lock));
2212 /*
2213 * We clear lastdst to make sure we don't use the lastdst path
2214 * next time sending since we might not have set v6dst yet.
2215 */
2216 connp->conn_v6lastdst = ipv6_all_zeros;
2217
2218 error = conn_build_hdr_template(connp, UDPH_SIZE, 0, v6src, v6dst,
2219 flowinfo);
2220 if (error != 0)
2221 return (error);
2222
2223 /*
2224 * Any routing header/option has been massaged. The checksum difference
2225 * is stored in conn_sum.
2226 */
2227 udpha = (udpha_t *)connp->conn_ht_ulp;
2228 udpha->uha_src_port = connp->conn_lport;
2229 udpha->uha_dst_port = dstport;
2230 udpha->uha_checksum = 0;
2231 udpha->uha_length = htons(UDPH_SIZE); /* Filled in later */
2232 return (0);
2233 }
2234
2235 static mblk_t *
2236 udp_queue_fallback(udp_t *udp, mblk_t *mp)
2237 {
2238 ASSERT(MUTEX_HELD(&udp->udp_recv_lock));
2239 if (IPCL_IS_NONSTR(udp->udp_connp)) {
2240 /*
2241 * fallback has started but messages have not been moved yet
2242 */
2243 if (udp->udp_fallback_queue_head == NULL) {
2244 ASSERT(udp->udp_fallback_queue_tail == NULL);
2245 udp->udp_fallback_queue_head = mp;
2246 udp->udp_fallback_queue_tail = mp;
2247 } else {
2248 ASSERT(udp->udp_fallback_queue_tail != NULL);
2249 udp->udp_fallback_queue_tail->b_next = mp;
2250 udp->udp_fallback_queue_tail = mp;
2251 }
2252 return (NULL);
2253 } else {
2254 /*
2255 * Fallback completed, let the caller putnext() the mblk.
2256 */
2257 return (mp);
2258 }
2259 }
2260
2261 /*
2262 * Deliver data to ULP. In case we have a socket, and it's falling back to
2263 * TPI, then we'll queue the mp for later processing.
2264 */
2265 static void
2266 udp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len, ip_recv_attr_t *ira)
2267 {
2268 if (IPCL_IS_NONSTR(connp)) {
2269 udp_t *udp = connp->conn_udp;
2270 int error;
2271
2272 ASSERT(len == msgdsize(mp));
2273 if ((*connp->conn_upcalls->su_recv)
2274 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2275 mutex_enter(&udp->udp_recv_lock);
2276 if (error == ENOSPC) {
2277 /*
2278 * let's confirm while holding the lock
2279 */
2280 if ((*connp->conn_upcalls->su_recv)
2281 (connp->conn_upper_handle, NULL, 0, 0,
2282 &error, NULL) < 0) {
2283 ASSERT(error == ENOSPC);
2284 if (error == ENOSPC) {
2285 connp->conn_flow_cntrld =
2286 B_TRUE;
2287 }
2288 }
2289 mutex_exit(&udp->udp_recv_lock);
2290 } else {
2291 ASSERT(error == EOPNOTSUPP);
2292 mp = udp_queue_fallback(udp, mp);
2293 mutex_exit(&udp->udp_recv_lock);
2294 if (mp != NULL)
2295 putnext(connp->conn_rq, mp);
2296 }
2297 }
2298 ASSERT(MUTEX_NOT_HELD(&udp->udp_recv_lock));
2299 } else {
2300 if (is_system_labeled()) {
2301 ASSERT(ira->ira_cred != NULL);
2302 /*
2303 * Provide for protocols above UDP such as RPC
2304 * NOPID leaves db_cpid unchanged.
2305 */
2306 mblk_setcred(mp, ira->ira_cred, NOPID);
2307 }
2308
2309 putnext(connp->conn_rq, mp);
2310 }
2311 }
2312
2313 /*
2314 * This is the inbound data path.
2315 * IP has already pulled up the IP plus UDP headers and verified alignment
2316 * etc.
2317 */
2318 /* ARGSUSED2 */
2319 static void
2320 udp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2321 {
2322 conn_t *connp = (conn_t *)arg1;
2323 struct T_unitdata_ind *tudi;
2324 uchar_t *rptr; /* Pointer to IP header */
2325 int hdr_length; /* Length of IP+UDP headers */
2326 int udi_size; /* Size of T_unitdata_ind */
2327 int pkt_len;
2328 udp_t *udp;
2329 udpha_t *udpha;
2330 ip_pkt_t ipps;
2331 ip6_t *ip6h;
2332 mblk_t *mp1;
2333 uint32_t udp_ipv4_options_len;
2334 crb_t recv_ancillary;
2335 udp_stack_t *us;
2336
2337 ASSERT(connp->conn_flags & IPCL_UDPCONN);
2338
2339 udp = connp->conn_udp;
2340 us = udp->udp_us;
2341 rptr = mp->b_rptr;
2342
2343 ASSERT(DB_TYPE(mp) == M_DATA);
2344 ASSERT(OK_32PTR(rptr));
2345 ASSERT(ira->ira_pktlen == msgdsize(mp));
2346 pkt_len = ira->ira_pktlen;
2347
2348 /*
2349 * Get a snapshot of these and allow other threads to change
2350 * them after that. We need the same recv_ancillary when determining
2351 * the size as when adding the ancillary data items.
2352 */
2353 mutex_enter(&connp->conn_lock);
2354 udp_ipv4_options_len = udp->udp_recv_ipp.ipp_ipv4_options_len;
2355 recv_ancillary = connp->conn_recv_ancillary;
2356 mutex_exit(&connp->conn_lock);
2357
2358 hdr_length = ira->ira_ip_hdr_length;
2359
2360 /*
2361 * IP inspected the UDP header thus all of it must be in the mblk.
2362 * UDP length check is performed for IPv6 packets and IPv4 packets
2363 * to check if the size of the packet as specified
2364 * by the UDP header is the same as the length derived from the IP
2365 * header.
2366 */
2367 udpha = (udpha_t *)(rptr + hdr_length);
2368 if (pkt_len != ntohs(udpha->uha_length) + hdr_length)
2369 goto tossit;
2370
2371 hdr_length += UDPH_SIZE;
2372 ASSERT(MBLKL(mp) >= hdr_length); /* IP did a pullup */
2373
2374 /* Initialize regardless of IP version */
2375 ipps.ipp_fields = 0;
2376
2377 if (((ira->ira_flags & IRAF_IPV4_OPTIONS) ||
2378 udp_ipv4_options_len > 0) &&
2379 connp->conn_family == AF_INET) {
2380 int err;
2381
2382 /*
2383 * Record/update udp_recv_ipp with the lock
2384 * held. Not needed for AF_INET6 sockets
2385 * since they don't support a getsockopt of IP_OPTIONS.
2386 */
2387 mutex_enter(&connp->conn_lock);
2388 err = ip_find_hdr_v4((ipha_t *)rptr, &udp->udp_recv_ipp,
2389 B_TRUE);
2390 if (err != 0) {
2391 /* Allocation failed. Drop packet */
2392 mutex_exit(&connp->conn_lock);
2393 freemsg(mp);
2394 UDPS_BUMP_MIB(us, udpInErrors);
2395 return;
2396 }
2397 mutex_exit(&connp->conn_lock);
2398 }
2399
2400 if (recv_ancillary.crb_all != 0) {
2401 /*
2402 * Record packet information in the ip_pkt_t
2403 */
2404 if (ira->ira_flags & IRAF_IS_IPV4) {
2405 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2406 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2407 ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
2408 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2409
2410 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipps, B_FALSE);
2411 } else {
2412 uint8_t nexthdrp;
2413
2414 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2415 /*
2416 * IPv6 packets can only be received by applications
2417 * that are prepared to receive IPv6 addresses.
2418 * The IP fanout must ensure this.
2419 */
2420 ASSERT(connp->conn_family == AF_INET6);
2421
2422 ip6h = (ip6_t *)rptr;
2423
2424 /* We don't care about the length, but need the ipp */
2425 hdr_length = ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps,
2426 &nexthdrp);
2427 ASSERT(hdr_length == ira->ira_ip_hdr_length);
2428 /* Restore */
2429 hdr_length = ira->ira_ip_hdr_length + UDPH_SIZE;
2430 ASSERT(nexthdrp == IPPROTO_UDP);
2431 }
2432 }
2433
2434 /*
2435 * This is the inbound data path. Packets are passed upstream as
2436 * T_UNITDATA_IND messages.
2437 */
2438 if (connp->conn_family == AF_INET) {
2439 sin_t *sin;
2440
2441 ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
2442
2443 /*
2444 * Normally only send up the source address.
2445 * If any ancillary data items are wanted we add those.
2446 */
2447 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2448 if (recv_ancillary.crb_all != 0) {
2449 udi_size += conn_recvancillary_size(connp,
2450 recv_ancillary, ira, mp, &ipps);
2451 }
2452
2453 /* Allocate a message block for the T_UNITDATA_IND structure. */
2454 mp1 = allocb(udi_size, BPRI_MED);
2455 if (mp1 == NULL) {
2456 freemsg(mp);
2457 UDPS_BUMP_MIB(us, udpInErrors);
2458 return;
2459 }
2460 mp1->b_cont = mp;
2461 mp1->b_datap->db_type = M_PROTO;
2462 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2463 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2464 tudi->PRIM_type = T_UNITDATA_IND;
2465 tudi->SRC_length = sizeof (sin_t);
2466 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2467 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2468 sizeof (sin_t);
2469 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2470 tudi->OPT_length = udi_size;
2471 sin = (sin_t *)&tudi[1];
2472 sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
2473 sin->sin_port = udpha->uha_src_port;
2474 sin->sin_family = connp->conn_family;
2475 *(uint32_t *)&sin->sin_zero[0] = 0;
2476 *(uint32_t *)&sin->sin_zero[4] = 0;
2477
2478 /*
2479 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
2480 * IP_RECVTTL has been set.
2481 */
2482 if (udi_size != 0) {
2483 conn_recvancillary_add(connp, recv_ancillary, ira,
2484 &ipps, (uchar_t *)&sin[1], udi_size);
2485 }
2486 } else {
2487 sin6_t *sin6;
2488
2489 /*
2490 * Handle both IPv4 and IPv6 packets for IPv6 sockets.
2491 *
2492 * Normally we only send up the address. If receiving of any
2493 * optional receive side information is enabled, we also send
2494 * that up as options.
2495 */
2496 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2497
2498 if (recv_ancillary.crb_all != 0) {
2499 udi_size += conn_recvancillary_size(connp,
2500 recv_ancillary, ira, mp, &ipps);
2501 }
2502
2503 mp1 = allocb(udi_size, BPRI_MED);
2504 if (mp1 == NULL) {
2505 freemsg(mp);
2506 UDPS_BUMP_MIB(us, udpInErrors);
2507 return;
2508 }
2509 mp1->b_cont = mp;
2510 mp1->b_datap->db_type = M_PROTO;
2511 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2512 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2513 tudi->PRIM_type = T_UNITDATA_IND;
2514 tudi->SRC_length = sizeof (sin6_t);
2515 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2516 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2517 sizeof (sin6_t);
2518 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2519 tudi->OPT_length = udi_size;
2520 sin6 = (sin6_t *)&tudi[1];
2521 if (ira->ira_flags & IRAF_IS_IPV4) {
2522 in6_addr_t v6dst;
2523
2524 IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
2525 &sin6->sin6_addr);
2526 IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
2527 &v6dst);
2528 sin6->sin6_flowinfo = 0;
2529 sin6->sin6_scope_id = 0;
2530 sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
2531 IPCL_ZONEID(connp), us->us_netstack);
2532 } else {
2533 ip6h = (ip6_t *)rptr;
2534
2535 sin6->sin6_addr = ip6h->ip6_src;
2536 /* No sin6_flowinfo per API */
2537 sin6->sin6_flowinfo = 0;
2538 /* For link-scope pass up scope id */
2539 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2540 sin6->sin6_scope_id = ira->ira_ruifindex;
2541 else
2542 sin6->sin6_scope_id = 0;
2543 sin6->__sin6_src_id = ip_srcid_find_addr(
2544 &ip6h->ip6_dst, IPCL_ZONEID(connp),
2545 us->us_netstack);
2546 }
2547 sin6->sin6_port = udpha->uha_src_port;
2548 sin6->sin6_family = connp->conn_family;
2549
2550 if (udi_size != 0) {
2551 conn_recvancillary_add(connp, recv_ancillary, ira,
2552 &ipps, (uchar_t *)&sin6[1], udi_size);
2553 }
2554 }
2555
2556 /*
2557 * DTrace this UDP input as udp:::receive (this is for IPv4, IPv6 and
2558 * loopback traffic).
2559 */
2560 DTRACE_UDP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2561 void_ip_t *, rptr, udp_t *, udp, udpha_t *, udpha);
2562
2563 /* Walk past the headers unless IP_RECVHDR was set. */
2564 if (!udp->udp_rcvhdr) {
2565 mp->b_rptr = rptr + hdr_length;
2566 pkt_len -= hdr_length;
2567 }
2568
2569 UDPS_BUMP_MIB(us, udpHCInDatagrams);
2570 udp_ulp_recv(connp, mp1, pkt_len, ira);
2571 return;
2572
2573 tossit:
2574 freemsg(mp);
2575 UDPS_BUMP_MIB(us, udpInErrors);
2576 }
2577
2578 /*
2579 * This routine creates a T_UDERROR_IND message and passes it upstream.
2580 * The address and options are copied from the T_UNITDATA_REQ message
2581 * passed in mp. This message is freed.
2582 */
2583 static void
2584 udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2585 {
2586 struct T_unitdata_req *tudr;
2587 mblk_t *mp1;
2588 uchar_t *destaddr;
2589 t_scalar_t destlen;
2590 uchar_t *optaddr;
2591 t_scalar_t optlen;
2592
2593 if ((mp->b_wptr < mp->b_rptr) ||
2594 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2595 goto done;
2596 }
2597 tudr = (struct T_unitdata_req *)mp->b_rptr;
2598 destaddr = mp->b_rptr + tudr->DEST_offset;
2599 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2600 destaddr + tudr->DEST_length < mp->b_rptr ||
2601 destaddr + tudr->DEST_length > mp->b_wptr) {
2602 goto done;
2603 }
2604 optaddr = mp->b_rptr + tudr->OPT_offset;
2605 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2606 optaddr + tudr->OPT_length < mp->b_rptr ||
2607 optaddr + tudr->OPT_length > mp->b_wptr) {
2608 goto done;
2609 }
2610 destlen = tudr->DEST_length;
2611 optlen = tudr->OPT_length;
2612
2613 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2614 (char *)optaddr, optlen, err);
2615 if (mp1 != NULL)
2616 qreply(q, mp1);
2617
2618 done:
2619 freemsg(mp);
2620 }
2621
2622 /*
2623 * This routine removes a port number association from a stream. It
2624 * is called by udp_wput to handle T_UNBIND_REQ messages.
2625 */
2626 static void
2627 udp_tpi_unbind(queue_t *q, mblk_t *mp)
2628 {
2629 conn_t *connp = Q_TO_CONN(q);
2630 int error;
2631
2632 error = udp_do_unbind(connp);
2633 if (error) {
2634 if (error < 0)
2635 udp_err_ack(q, mp, -error, 0);
2636 else
2637 udp_err_ack(q, mp, TSYSERR, error);
2638 return;
2639 }
2640
2641 mp = mi_tpi_ok_ack_alloc(mp);
2642 ASSERT(mp != NULL);
2643 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
2644 qreply(q, mp);
2645 }
2646
2647 /*
2648 * Don't let port fall into the privileged range.
2649 * Since the extra privileged ports can be arbitrary we also
2650 * ensure that we exclude those from consideration.
2651 * us->us_epriv_ports is not sorted thus we loop over it until
2652 * there are no changes.
2653 */
2654 in_port_t
2655 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
2656 {
2657 int i, bump;
2658 in_port_t nextport;
2659 boolean_t restart = B_FALSE;
2660 udp_stack_t *us = udp->udp_us;
2661
2662 if (random && udp_random_anon_port != 0) {
2663 (void) random_get_pseudo_bytes((uint8_t *)&port,
2664 sizeof (in_port_t));
2665 /*
2666 * Unless changed by a sys admin, the smallest anon port
2667 * is 32768 and the largest anon port is 65535. It is
2668 * very likely (50%) for the random port to be smaller
2669 * than the smallest anon port. When that happens,
2670 * add port % (anon port range) to the smallest anon
2671 * port to get the random port. It should fall into the
2672 * valid anon port range.
2673 */
2674 if ((port < us->us_smallest_anon_port) ||
2675 (port > us->us_largest_anon_port)) {
2676 if (us->us_smallest_anon_port ==
2677 us->us_largest_anon_port) {
2678 bump = 0;
2679 } else {
2680 bump = port % (us->us_largest_anon_port -
2681 us->us_smallest_anon_port);
2682 }
2683
2684 port = us->us_smallest_anon_port + bump;
2685 }
2686 }
2687
2688 retry:
2689 if (port < us->us_smallest_anon_port)
2690 port = us->us_smallest_anon_port;
2691
2692 if (port > us->us_largest_anon_port) {
2693 port = us->us_smallest_anon_port;
2694 if (restart)
2695 return (0);
2696 restart = B_TRUE;
2697 }
2698
2699 if (port < us->us_smallest_nonpriv_port)
2700 port = us->us_smallest_nonpriv_port;
2701
2702 for (i = 0; i < us->us_num_epriv_ports; i++) {
2703 if (port == us->us_epriv_ports[i]) {
2704 port++;
2705 /*
2706 * Make sure that the port is in the
2707 * valid range.
2708 */
2709 goto retry;
2710 }
2711 }
2712
2713 if (is_system_labeled() &&
2714 (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
2715 port, IPPROTO_UDP, B_TRUE)) != 0) {
2716 port = nextport;
2717 goto retry;
2718 }
2719
2720 return (port);
2721 }
2722
2723 /*
2724 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
2725 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
2726 * the TPI options, otherwise we take them from msg_control.
2727 * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
2728 * Always consumes mp; never consumes tudr_mp.
2729 */
2730 static int
2731 udp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
2732 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
2733 {
2734 udp_t *udp = connp->conn_udp;
2735 udp_stack_t *us = udp->udp_us;
2736 int error;
2737 ip_xmit_attr_t *ixa;
2738 ip_pkt_t *ipp;
2739 in6_addr_t v6src;
2740 in6_addr_t v6dst;
2741 in6_addr_t v6nexthop;
2742 in_port_t dstport;
2743 uint32_t flowinfo;
2744 uint_t srcid;
2745 int is_absreq_failure = 0;
2746 conn_opt_arg_t coas, *coa;
2747
2748 ASSERT(tudr_mp != NULL || msg != NULL);
2749
2750 /*
2751 * Get ixa before checking state to handle a disconnect race.
2752 *
2753 * We need an exclusive copy of conn_ixa since the ancillary data
2754 * options might modify it. That copy has no pointers hence we
2755 * need to set them up once we've parsed the ancillary data.
2756 */
2757 ixa = conn_get_ixa_exclusive(connp);
2758 if (ixa == NULL) {
2759 UDPS_BUMP_MIB(us, udpOutErrors);
2760 freemsg(mp);
2761 return (ENOMEM);
2762 }
2763 ASSERT(cr != NULL);
2764 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2765 ixa->ixa_cred = cr;
2766 ixa->ixa_cpid = pid;
2767 if (is_system_labeled()) {
2768 /* We need to restart with a label based on the cred */
2769 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
2770 }
2771
2772 /* In case previous destination was multicast or multirt */
2773 ip_attr_newdst(ixa);
2774
2775 /* Get a copy of conn_xmit_ipp since the options might change it */
2776 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
2777 if (ipp == NULL) {
2778 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2779 ixa->ixa_cred = connp->conn_cred; /* Restore */
2780 ixa->ixa_cpid = connp->conn_cpid;
2781 ixa_refrele(ixa);
2782 UDPS_BUMP_MIB(us, udpOutErrors);
2783 freemsg(mp);
2784 return (ENOMEM);
2785 }
2786 mutex_enter(&connp->conn_lock);
2787 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
2788 mutex_exit(&connp->conn_lock);
2789 if (error != 0) {
2790 UDPS_BUMP_MIB(us, udpOutErrors);
2791 freemsg(mp);
2792 goto done;
2793 }
2794
2795 /*
2796 * Parse the options and update ixa and ipp as a result.
2797 * Note that ixa_tsl can be updated if SCM_UCRED.
2798 * ixa_refrele/ixa_inactivate will release any reference on ixa_tsl.
2799 */
2800
2801 coa = &coas;
2802 coa->coa_connp = connp;
2803 coa->coa_ixa = ixa;
2804 coa->coa_ipp = ipp;
2805 coa->coa_ancillary = B_TRUE;
2806 coa->coa_changed = 0;
2807
2808 if (msg != NULL) {
2809 error = process_auxiliary_options(connp, msg->msg_control,
2810 msg->msg_controllen, coa, &udp_opt_obj, udp_opt_set, cr);
2811 } else {
2812 struct T_unitdata_req *tudr;
2813
2814 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
2815 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
2816 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
2817 &tudr->OPT_length, tudr->OPT_offset, cr, &udp_opt_obj,
2818 coa, &is_absreq_failure);
2819 }
2820 if (error != 0) {
2821 /*
2822 * Note: No special action needed in this
2823 * module for "is_absreq_failure"
2824 */
2825 freemsg(mp);
2826 UDPS_BUMP_MIB(us, udpOutErrors);
2827 goto done;
2828 }
2829 ASSERT(is_absreq_failure == 0);
2830
2831 mutex_enter(&connp->conn_lock);
2832 /*
2833 * If laddr is unspecified then we look at sin6_src_id.
2834 * We will give precedence to a source address set with IPV6_PKTINFO
2835 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
2836 * want ip_attr_connect to select a source (since it can fail) when
2837 * IPV6_PKTINFO is specified.
2838 * If this doesn't result in a source address then we get a source
2839 * from ip_attr_connect() below.
2840 */
2841 v6src = connp->conn_saddr_v6;
2842 if (sin != NULL) {
2843 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
2844 dstport = sin->sin_port;
2845 flowinfo = 0;
2846 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2847 ixa->ixa_flags |= IXAF_IS_IPV4;
2848 } else if (sin6 != NULL) {
2849 boolean_t v4mapped;
2850
2851 v6dst = sin6->sin6_addr;
2852 dstport = sin6->sin6_port;
2853 flowinfo = sin6->sin6_flowinfo;
2854 srcid = sin6->__sin6_src_id;
2855 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
2856 ixa->ixa_scopeid = sin6->sin6_scope_id;
2857 ixa->ixa_flags |= IXAF_SCOPEID_SET;
2858 } else {
2859 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2860 }
2861 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
2862 if (v4mapped)
2863 ixa->ixa_flags |= IXAF_IS_IPV4;
2864 else
2865 ixa->ixa_flags &= ~IXAF_IS_IPV4;
2866 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
2867 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
2868 v4mapped, connp->conn_netstack)) {
2869 /* Mismatch - v4mapped/v6 specified by srcid. */
2870 mutex_exit(&connp->conn_lock);
2871 error = EADDRNOTAVAIL;
2872 goto failed; /* Does freemsg() and mib. */
2873 }
2874 }
2875 } else {
2876 /* Connected case */
2877 v6dst = connp->conn_faddr_v6;
2878 dstport = connp->conn_fport;
2879 flowinfo = connp->conn_flowinfo;
2880 }
2881 mutex_exit(&connp->conn_lock);
2882
2883 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
2884 if (ipp->ipp_fields & IPPF_ADDR) {
2885 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2886 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2887 v6src = ipp->ipp_addr;
2888 } else {
2889 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2890 v6src = ipp->ipp_addr;
2891 }
2892 }
2893
2894 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
2895 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
2896 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
2897
2898 switch (error) {
2899 case 0:
2900 break;
2901 case EADDRNOTAVAIL:
2902 /*
2903 * IXAF_VERIFY_SOURCE tells us to pick a better source.
2904 * Don't have the application see that errno
2905 */
2906 error = ENETUNREACH;
2907 goto failed;
2908 case ENETDOWN:
2909 /*
2910 * Have !ipif_addr_ready address; drop packet silently
2911 * until we can get applications to not send until we
2912 * are ready.
2913 */
2914 error = 0;
2915 goto failed;
2916 case EHOSTUNREACH:
2917 case ENETUNREACH:
2918 if (ixa->ixa_ire != NULL) {
2919 /*
2920 * Let conn_ip_output/ire_send_noroute return
2921 * the error and send any local ICMP error.
2922 */
2923 error = 0;
2924 break;
2925 }
2926 /* FALLTHRU */
2927 default:
2928 failed:
2929 freemsg(mp);
2930 UDPS_BUMP_MIB(us, udpOutErrors);
2931 goto done;
2932 }
2933
2934 /*
2935 * We might be going to a different destination than last time,
2936 * thus check that TX allows the communication and compute any
2937 * needed label.
2938 *
2939 * TSOL Note: We have an exclusive ipp and ixa for this thread so we
2940 * don't have to worry about concurrent threads.
2941 */
2942 if (is_system_labeled()) {
2943 /* Using UDP MLP requires SCM_UCRED from user */
2944 if (connp->conn_mlp_type != mlptSingle &&
2945 !((ixa->ixa_flags & IXAF_UCRED_TSL))) {
2946 UDPS_BUMP_MIB(us, udpOutErrors);
2947 error = ECONNREFUSED;
2948 freemsg(mp);
2949 goto done;
2950 }
2951 /*
2952 * Check whether Trusted Solaris policy allows communication
2953 * with this host, and pretend that the destination is
2954 * unreachable if not.
2955 * Compute any needed label and place it in ipp_label_v4/v6.
2956 *
2957 * Later conn_build_hdr_template/conn_prepend_hdr takes
2958 * ipp_label_v4/v6 to form the packet.
2959 *
2960 * Tsol note: We have ipp structure local to this thread so
2961 * no locking is needed.
2962 */
2963 error = conn_update_label(connp, ixa, &v6dst, ipp);
2964 if (error != 0) {
2965 freemsg(mp);
2966 UDPS_BUMP_MIB(us, udpOutErrors);
2967 goto done;
2968 }
2969 }
2970 mp = udp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, dstport,
2971 flowinfo, mp, &error);
2972 if (mp == NULL) {
2973 ASSERT(error != 0);
2974 UDPS_BUMP_MIB(us, udpOutErrors);
2975 goto done;
2976 }
2977 if (ixa->ixa_pktlen > IP_MAXPACKET) {
2978 error = EMSGSIZE;
2979 UDPS_BUMP_MIB(us, udpOutErrors);
2980 freemsg(mp);
2981 goto done;
2982 }
2983 /* We're done. Pass the packet to ip. */
2984 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
2985
2986 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
2987 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
2988 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
2989
2990 error = conn_ip_output(mp, ixa);
2991 /* No udpOutErrors if an error since IP increases its error counter */
2992 switch (error) {
2993 case 0:
2994 break;
2995 case EWOULDBLOCK:
2996 (void) ixa_check_drain_insert(connp, ixa);
2997 error = 0;
2998 break;
2999 case EADDRNOTAVAIL:
3000 /*
3001 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3002 * Don't have the application see that errno
3003 */
3004 error = ENETUNREACH;
3005 /* FALLTHRU */
3006 default:
3007 mutex_enter(&connp->conn_lock);
3008 /*
3009 * Clear the source and v6lastdst so we call ip_attr_connect
3010 * for the next packet and try to pick a better source.
3011 */
3012 if (connp->conn_mcbc_bind)
3013 connp->conn_saddr_v6 = ipv6_all_zeros;
3014 else
3015 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3016 connp->conn_v6lastdst = ipv6_all_zeros;
3017 mutex_exit(&connp->conn_lock);
3018 break;
3019 }
3020 done:
3021 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3022 ixa->ixa_cred = connp->conn_cred; /* Restore */
3023 ixa->ixa_cpid = connp->conn_cpid;
3024 ixa_refrele(ixa);
3025 ip_pkt_free(ipp);
3026 kmem_free(ipp, sizeof (*ipp));
3027 return (error);
3028 }
3029
3030 /*
3031 * Handle sending an M_DATA for a connected socket.
3032 * Handles both IPv4 and IPv6.
3033 */
3034 static int
3035 udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
3036 {
3037 udp_t *udp = connp->conn_udp;
3038 udp_stack_t *us = udp->udp_us;
3039 int error;
3040 ip_xmit_attr_t *ixa;
3041
3042 /*
3043 * If no other thread is using conn_ixa this just gets a reference to
3044 * conn_ixa. Otherwise we get a safe copy of conn_ixa.
3045 */
3046 ixa = conn_get_ixa(connp, B_FALSE);
3047 if (ixa == NULL) {
3048 UDPS_BUMP_MIB(us, udpOutErrors);
3049 freemsg(mp);
3050 return (ENOMEM);
3051 }
3052
3053 ASSERT(cr != NULL);
3054 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3055 ixa->ixa_cred = cr;
3056 ixa->ixa_cpid = pid;
3057
3058 mutex_enter(&connp->conn_lock);
3059 mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_saddr_v6,
3060 connp->conn_fport, connp->conn_flowinfo, &error);
3061
3062 if (mp == NULL) {
3063 ASSERT(error != 0);
3064 mutex_exit(&connp->conn_lock);
3065 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3066 ixa->ixa_cred = connp->conn_cred; /* Restore */
3067 ixa->ixa_cpid = connp->conn_cpid;
3068 ixa_refrele(ixa);
3069 UDPS_BUMP_MIB(us, udpOutErrors);
3070 freemsg(mp);
3071 return (error);
3072 }
3073
3074 /*
3075 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3076 * safe copy, then we need to fill in any pointers in it.
3077 */
3078 if (ixa->ixa_ire == NULL) {
3079 in6_addr_t faddr, saddr;
3080 in6_addr_t nexthop;
3081 in_port_t fport;
3082
3083 saddr = connp->conn_saddr_v6;
3084 faddr = connp->conn_faddr_v6;
3085 fport = connp->conn_fport;
3086 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
3087 mutex_exit(&connp->conn_lock);
3088
3089 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
3090 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
3091 IPDF_IPSEC);
3092 switch (error) {
3093 case 0:
3094 break;
3095 case EADDRNOTAVAIL:
3096 /*
3097 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3098 * Don't have the application see that errno
3099 */
3100 error = ENETUNREACH;
3101 goto failed;
3102 case ENETDOWN:
3103 /*
3104 * Have !ipif_addr_ready address; drop packet silently
3105 * until we can get applications to not send until we
3106 * are ready.
3107 */
3108 error = 0;
3109 goto failed;
3110 case EHOSTUNREACH:
3111 case ENETUNREACH:
3112 if (ixa->ixa_ire != NULL) {
3113 /*
3114 * Let conn_ip_output/ire_send_noroute return
3115 * the error and send any local ICMP error.
3116 */
3117 error = 0;
3118 break;
3119 }
3120 /* FALLTHRU */
3121 default:
3122 failed:
3123 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3124 ixa->ixa_cred = connp->conn_cred; /* Restore */
3125 ixa->ixa_cpid = connp->conn_cpid;
3126 ixa_refrele(ixa);
3127 freemsg(mp);
3128 UDPS_BUMP_MIB(us, udpOutErrors);
3129 return (error);
3130 }
3131 } else {
3132 /* Done with conn_t */
3133 mutex_exit(&connp->conn_lock);
3134 }
3135 ASSERT(ixa->ixa_ire != NULL);
3136
3137 /* We're done. Pass the packet to ip. */
3138 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3139
3140 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3141 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3142 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3143
3144 error = conn_ip_output(mp, ixa);
3145 /* No udpOutErrors if an error since IP increases its error counter */
3146 switch (error) {
3147 case 0:
3148 break;
3149 case EWOULDBLOCK:
3150 (void) ixa_check_drain_insert(connp, ixa);
3151 error = 0;
3152 break;
3153 case EADDRNOTAVAIL:
3154 /*
3155 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3156 * Don't have the application see that errno
3157 */
3158 error = ENETUNREACH;
3159 break;
3160 }
3161 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3162 ixa->ixa_cred = connp->conn_cred; /* Restore */
3163 ixa->ixa_cpid = connp->conn_cpid;
3164 ixa_refrele(ixa);
3165 return (error);
3166 }
3167
3168 /*
3169 * Handle sending an M_DATA to the last destination.
3170 * Handles both IPv4 and IPv6.
3171 *
3172 * NOTE: The caller must hold conn_lock and we drop it here.
3173 */
3174 static int
3175 udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3176 ip_xmit_attr_t *ixa)
3177 {
3178 udp_t *udp = connp->conn_udp;
3179 udp_stack_t *us = udp->udp_us;
3180 int error;
3181
3182 ASSERT(MUTEX_HELD(&connp->conn_lock));
3183 ASSERT(ixa != NULL);
3184
3185 ASSERT(cr != NULL);
3186 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3187 ixa->ixa_cred = cr;
3188 ixa->ixa_cpid = pid;
3189
3190 mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_v6lastsrc,
3191 connp->conn_lastdstport, connp->conn_lastflowinfo, &error);
3192
3193 if (mp == NULL) {
3194 ASSERT(error != 0);
3195 mutex_exit(&connp->conn_lock);
3196 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3197 ixa->ixa_cred = connp->conn_cred; /* Restore */
3198 ixa->ixa_cpid = connp->conn_cpid;
3199 ixa_refrele(ixa);
3200 UDPS_BUMP_MIB(us, udpOutErrors);
3201 freemsg(mp);
3202 return (error);
3203 }
3204
3205 /*
3206 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3207 * safe copy, then we need to fill in any pointers in it.
3208 */
3209 if (ixa->ixa_ire == NULL) {
3210 in6_addr_t lastdst, lastsrc;
3211 in6_addr_t nexthop;
3212 in_port_t lastport;
3213
3214 lastsrc = connp->conn_v6lastsrc;
3215 lastdst = connp->conn_v6lastdst;
3216 lastport = connp->conn_lastdstport;
3217 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3218 mutex_exit(&connp->conn_lock);
3219
3220 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3221 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3222 IPDF_VERIFY_DST | IPDF_IPSEC);
3223 switch (error) {
3224 case 0:
3225 break;
3226 case EADDRNOTAVAIL:
3227 /*
3228 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3229 * Don't have the application see that errno
3230 */
3231 error = ENETUNREACH;
3232 goto failed;
3233 case ENETDOWN:
3234 /*
3235 * Have !ipif_addr_ready address; drop packet silently
3236 * until we can get applications to not send until we
3237 * are ready.
3238 */
3239 error = 0;
3240 goto failed;
3241 case EHOSTUNREACH:
3242 case ENETUNREACH:
3243 if (ixa->ixa_ire != NULL) {
3244 /*
3245 * Let conn_ip_output/ire_send_noroute return
3246 * the error and send any local ICMP error.
3247 */
3248 error = 0;
3249 break;
3250 }
3251 /* FALLTHRU */
3252 default:
3253 failed:
3254 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3255 ixa->ixa_cred = connp->conn_cred; /* Restore */
3256 ixa->ixa_cpid = connp->conn_cpid;
3257 ixa_refrele(ixa);
3258 freemsg(mp);
3259 UDPS_BUMP_MIB(us, udpOutErrors);
3260 return (error);
3261 }
3262 } else {
3263 /* Done with conn_t */
3264 mutex_exit(&connp->conn_lock);
3265 }
3266
3267 /* We're done. Pass the packet to ip. */
3268 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3269
3270 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3271 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3272 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3273
3274 error = conn_ip_output(mp, ixa);
3275 /* No udpOutErrors if an error since IP increases its error counter */
3276 switch (error) {
3277 case 0:
3278 break;
3279 case EWOULDBLOCK:
3280 (void) ixa_check_drain_insert(connp, ixa);
3281 error = 0;
3282 break;
3283 case EADDRNOTAVAIL:
3284 /*
3285 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3286 * Don't have the application see that errno
3287 */
3288 error = ENETUNREACH;
3289 /* FALLTHRU */
3290 default:
3291 mutex_enter(&connp->conn_lock);
3292 /*
3293 * Clear the source and v6lastdst so we call ip_attr_connect
3294 * for the next packet and try to pick a better source.
3295 */
3296 if (connp->conn_mcbc_bind)
3297 connp->conn_saddr_v6 = ipv6_all_zeros;
3298 else
3299 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3300 connp->conn_v6lastdst = ipv6_all_zeros;
3301 mutex_exit(&connp->conn_lock);
3302 break;
3303 }
3304 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3305 ixa->ixa_cred = connp->conn_cred; /* Restore */
3306 ixa->ixa_cpid = connp->conn_cpid;
3307 ixa_refrele(ixa);
3308 return (error);
3309 }
3310
3311
3312 /*
3313 * Prepend the header template and then fill in the source and
3314 * flowinfo. The caller needs to handle the destination address since
3315 * it's setting is different if rthdr or source route.
3316 *
3317 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3318 * When it returns NULL it sets errorp.
3319 */
3320 static mblk_t *
3321 udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3322 const in6_addr_t *v6src, in_port_t dstport, uint32_t flowinfo, int *errorp)
3323 {
3324 udp_t *udp = connp->conn_udp;
3325 udp_stack_t *us = udp->udp_us;
3326 boolean_t insert_spi = udp->udp_nat_t_endpoint;
3327 boolean_t hash_srcport = udp->udp_vxlanhash;
3328 uint_t pktlen;
3329 uint_t alloclen;
3330 uint_t copylen;
3331 uint8_t *iph;
3332 uint_t ip_hdr_length;
3333 udpha_t *udpha;
3334 uint32_t cksum;
3335 ip_pkt_t *ipp;
3336 uint16_t srcport;
3337
3338 ASSERT(MUTEX_HELD(&connp->conn_lock));
3339
3340 /*
3341 * If we have source port hashing going on, determine the hash before
3342 * we modify the mblk_t.
3343 */
3344 if (hash_srcport == B_TRUE) {
3345 srcport = udp_srcport_hash(mp, UDP_HASH_VXLAN,
3346 IPPORT_DYNAMIC_MIN, IPPORT_DYNAMIC_MAX,
3347 ntohs(connp->conn_lport));
3348 }
3349
3350 /*
3351 * Copy the header template and leave space for an SPI
3352 */
3353 copylen = connp->conn_ht_iphc_len;
3354 alloclen = copylen + (insert_spi ? sizeof (uint32_t) : 0);
3355 pktlen = alloclen + msgdsize(mp);
3356 if (pktlen > IP_MAXPACKET) {
3357 freemsg(mp);
3358 *errorp = EMSGSIZE;
3359 return (NULL);
3360 }
3361 ixa->ixa_pktlen = pktlen;
3362
3363 /* check/fix buffer config, setup pointers into it */
3364 iph = mp->b_rptr - alloclen;
3365 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
3366 mblk_t *mp1;
3367
3368 mp1 = allocb(alloclen + us->us_wroff_extra, BPRI_MED);
3369 if (mp1 == NULL) {
3370 freemsg(mp);
3371 *errorp = ENOMEM;
3372 return (NULL);
3373 }
3374 mp1->b_wptr = DB_LIM(mp1);
3375 mp1->b_cont = mp;
3376 mp = mp1;
3377 iph = (mp->b_wptr - alloclen);
3378 }
3379 mp->b_rptr = iph;
3380 bcopy(connp->conn_ht_iphc, iph, copylen);
3381 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
3382
3383 ixa->ixa_ip_hdr_length = ip_hdr_length;
3384 udpha = (udpha_t *)(iph + ip_hdr_length);
3385
3386 /*
3387 * Setup header length and prepare for ULP checksum done in IP.
3388 * udp_build_hdr_template has already massaged any routing header
3389 * and placed the result in conn_sum.
3390 *
3391 * We make it easy for IP to include our pseudo header
3392 * by putting our length in uha_checksum.
3393 */
3394 cksum = pktlen - ip_hdr_length;
3395 udpha->uha_length = htons(cksum);
3396
3397 cksum += connp->conn_sum;
3398 cksum = (cksum >> 16) + (cksum & 0xFFFF);
3399 ASSERT(cksum < 0x10000);
3400
3401 ipp = &connp->conn_xmit_ipp;
3402 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3403 ipha_t *ipha = (ipha_t *)iph;
3404
3405 ipha->ipha_length = htons((uint16_t)pktlen);
3406
3407 /* IP does the checksum if uha_checksum is non-zero */
3408 if (us->us_do_checksum)
3409 udpha->uha_checksum = htons(cksum);
3410
3411 /* if IP_PKTINFO specified an addres it wins over bind() */
3412 if ((ipp->ipp_fields & IPPF_ADDR) &&
3413 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3414 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
3415 ipha->ipha_src = ipp->ipp_addr_v4;
3416 } else {
3417 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
3418 }
3419 } else {
3420 ip6_t *ip6h = (ip6_t *)iph;
3421
3422 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN));
3423 udpha->uha_checksum = htons(cksum);
3424
3425 /* if IP_PKTINFO specified an addres it wins over bind() */
3426 if ((ipp->ipp_fields & IPPF_ADDR) &&
3427 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3428 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
3429 ip6h->ip6_src = ipp->ipp_addr;
3430 } else {
3431 ip6h->ip6_src = *v6src;
3432 }
3433 ip6h->ip6_vcf =
3434 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
3435 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
3436 if (ipp->ipp_fields & IPPF_TCLASS) {
3437 /* Overrides the class part of flowinfo */
3438 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
3439 ipp->ipp_tclass);
3440 }
3441 }
3442
3443 /* Insert all-0s SPI now. */
3444 if (insert_spi)
3445 *((uint32_t *)(udpha + 1)) = 0;
3446
3447 udpha->uha_dst_port = dstport;
3448 if (hash_srcport == B_TRUE)
3449 udpha->uha_src_port = htons(srcport);
3450
3451 return (mp);
3452 }
3453
3454 /*
3455 * Send a T_UDERR_IND in response to an M_DATA
3456 */
3457 static void
3458 udp_ud_err_connected(conn_t *connp, t_scalar_t error)
3459 {
3460 struct sockaddr_storage ss;
3461 sin_t *sin;
3462 sin6_t *sin6;
3463 struct sockaddr *addr;
3464 socklen_t addrlen;
3465 mblk_t *mp1;
3466
3467 mutex_enter(&connp->conn_lock);
3468 /* Initialize addr and addrlen as if they're passed in */
3469 if (connp->conn_family == AF_INET) {
3470 sin = (sin_t *)&ss;
3471 *sin = sin_null;
3472 sin->sin_family = AF_INET;
3473 sin->sin_port = connp->conn_fport;
3474 sin->sin_addr.s_addr = connp->conn_faddr_v4;
3475 addr = (struct sockaddr *)sin;
3476 addrlen = sizeof (*sin);
3477 } else {
3478 sin6 = (sin6_t *)&ss;
3479 *sin6 = sin6_null;
3480 sin6->sin6_family = AF_INET6;
3481 sin6->sin6_port = connp->conn_fport;
3482 sin6->sin6_flowinfo = connp->conn_flowinfo;
3483 sin6->sin6_addr = connp->conn_faddr_v6;
3484 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_faddr_v6) &&
3485 (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) {
3486 sin6->sin6_scope_id = connp->conn_ixa->ixa_scopeid;
3487 } else {
3488 sin6->sin6_scope_id = 0;
3489 }
3490 sin6->__sin6_src_id = 0;
3491 addr = (struct sockaddr *)sin6;
3492 addrlen = sizeof (*sin6);
3493 }
3494 mutex_exit(&connp->conn_lock);
3495
3496 mp1 = mi_tpi_uderror_ind((char *)addr, addrlen, NULL, 0, error);
3497 if (mp1 != NULL)
3498 putnext(connp->conn_rq, mp1);
3499 }
3500
3501 /*
3502 * This routine handles all messages passed downstream. It either
3503 * consumes the message or passes it downstream; it never queues a
3504 * a message.
3505 *
3506 * Also entry point for sockfs when udp is in "direct sockfs" mode. This mode
3507 * is valid when we are directly beneath the stream head, and thus sockfs
3508 * is able to bypass STREAMS and directly call us, passing along the sockaddr
3509 * structure without the cumbersome T_UNITDATA_REQ interface for the case of
3510 * connected endpoints.
3511 */
3512 void
3513 udp_wput(queue_t *q, mblk_t *mp)
3514 {
3515 sin6_t *sin6;
3516 sin_t *sin = NULL;
3517 uint_t srcid;
3518 conn_t *connp = Q_TO_CONN(q);
3519 udp_t *udp = connp->conn_udp;
3520 int error = 0;
3521 struct sockaddr *addr = NULL;
3522 socklen_t addrlen;
3523 udp_stack_t *us = udp->udp_us;
3524 struct T_unitdata_req *tudr;
3525 mblk_t *data_mp;
3526 ushort_t ipversion;
3527 cred_t *cr;
3528 pid_t pid;
3529
3530 /*
3531 * We directly handle several cases here: T_UNITDATA_REQ message
3532 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
3533 * socket.
3534 */
3535 switch (DB_TYPE(mp)) {
3536 case M_DATA:
3537 if (!udp->udp_issocket || udp->udp_state != TS_DATA_XFER) {
3538 /* Not connected; address is required */
3539 UDPS_BUMP_MIB(us, udpOutErrors);
3540 UDP_DBGSTAT(us, udp_data_notconn);
3541 UDP_STAT(us, udp_out_err_notconn);
3542 freemsg(mp);
3543 return;
3544 }
3545 /*
3546 * All Solaris components should pass a db_credp
3547 * for this message, hence we ASSERT.
3548 * On production kernels we return an error to be robust against
3549 * random streams modules sitting on top of us.
3550 */
3551 cr = msg_getcred(mp, &pid);
3552 ASSERT(cr != NULL);
3553 if (cr == NULL) {
3554 UDPS_BUMP_MIB(us, udpOutErrors);
3555 freemsg(mp);
3556 return;
3557 }
3558 ASSERT(udp->udp_issocket);
3559 UDP_DBGSTAT(us, udp_data_conn);
3560 error = udp_output_connected(connp, mp, cr, pid);
3561 if (error != 0) {
3562 UDP_STAT(us, udp_out_err_output);
3563 if (connp->conn_rq != NULL)
3564 udp_ud_err_connected(connp, (t_scalar_t)error);
3565 #ifdef DEBUG
3566 printf("udp_output_connected returned %d\n", error);
3567 #endif
3568 }
3569 return;
3570
3571 case M_PROTO:
3572 case M_PCPROTO:
3573 tudr = (struct T_unitdata_req *)mp->b_rptr;
3574 if (MBLKL(mp) < sizeof (*tudr) ||
3575 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
3576 udp_wput_other(q, mp);
3577 return;
3578 }
3579 break;
3580
3581 default:
3582 udp_wput_other(q, mp);
3583 return;
3584 }
3585
3586 /* Handle valid T_UNITDATA_REQ here */
3587 data_mp = mp->b_cont;
3588 if (data_mp == NULL) {
3589 error = EPROTO;
3590 goto ud_error2;
3591 }
3592 mp->b_cont = NULL;
3593
3594 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
3595 error = EADDRNOTAVAIL;
3596 goto ud_error2;
3597 }
3598
3599 /*
3600 * All Solaris components should pass a db_credp
3601 * for this TPI message, hence we should ASSERT.
3602 * However, RPC (svc_clts_ksend) does this odd thing where it
3603 * passes the options from a T_UNITDATA_IND unchanged in a
3604 * T_UNITDATA_REQ. While that is the right thing to do for
3605 * some options, SCM_UCRED being the key one, this also makes it
3606 * pass down IP_RECVDSTADDR. Hence we can't ASSERT here.
3607 */
3608 cr = msg_getcred(mp, &pid);
3609 if (cr == NULL) {
3610 cr = connp->conn_cred;
3611 pid = connp->conn_cpid;
3612 }
3613
3614 /*
3615 * If a port has not been bound to the stream, fail.
3616 * This is not a problem when sockfs is directly
3617 * above us, because it will ensure that the socket
3618 * is first bound before allowing data to be sent.
3619 */
3620 if (udp->udp_state == TS_UNBND) {
3621 error = EPROTO;
3622 goto ud_error2;
3623 }
3624 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
3625 addrlen = tudr->DEST_length;
3626
3627 switch (connp->conn_family) {
3628 case AF_INET6:
3629 sin6 = (sin6_t *)addr;
3630 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
3631 (sin6->sin6_family != AF_INET6)) {
3632 error = EADDRNOTAVAIL;
3633 goto ud_error2;
3634 }
3635
3636 srcid = sin6->__sin6_src_id;
3637 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
3638 /*
3639 * Destination is a non-IPv4-compatible IPv6 address.
3640 * Send out an IPv6 format packet.
3641 */
3642
3643 /*
3644 * If the local address is a mapped address return
3645 * an error.
3646 * It would be possible to send an IPv6 packet but the
3647 * response would never make it back to the application
3648 * since it is bound to a mapped address.
3649 */
3650 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
3651 error = EADDRNOTAVAIL;
3652 goto ud_error2;
3653 }
3654
3655 UDP_DBGSTAT(us, udp_out_ipv6);
3656
3657 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
3658 sin6->sin6_addr = ipv6_loopback;
3659 ipversion = IPV6_VERSION;
3660 } else {
3661 if (connp->conn_ipv6_v6only) {
3662 error = EADDRNOTAVAIL;
3663 goto ud_error2;
3664 }
3665
3666 /*
3667 * If the local address is not zero or a mapped address
3668 * return an error. It would be possible to send an
3669 * IPv4 packet but the response would never make it
3670 * back to the application since it is bound to a
3671 * non-mapped address.
3672 */
3673 if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
3674 !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
3675 error = EADDRNOTAVAIL;
3676 goto ud_error2;
3677 }
3678 UDP_DBGSTAT(us, udp_out_mapped);
3679
3680 if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
3681 V4_PART_OF_V6(sin6->sin6_addr) =
3682 htonl(INADDR_LOOPBACK);
3683 }
3684 ipversion = IPV4_VERSION;
3685 }
3686
3687 if (tudr->OPT_length != 0) {
3688 /*
3689 * If we are connected then the destination needs to be
3690 * the same as the connected one.
3691 */
3692 if (udp->udp_state == TS_DATA_XFER &&
3693 !conn_same_as_last_v6(connp, sin6)) {
3694 error = EISCONN;
3695 goto ud_error2;
3696 }
3697 UDP_STAT(us, udp_out_opt);
3698 error = udp_output_ancillary(connp, NULL, sin6,
3699 data_mp, mp, NULL, cr, pid);
3700 } else {
3701 ip_xmit_attr_t *ixa;
3702
3703 /*
3704 * We have to allocate an ip_xmit_attr_t before we grab
3705 * conn_lock and we need to hold conn_lock once we've
3706 * checked conn_same_as_last_v6 to handle concurrent
3707 * send* calls on a socket.
3708 */
3709 ixa = conn_get_ixa(connp, B_FALSE);
3710 if (ixa == NULL) {
3711 error = ENOMEM;
3712 goto ud_error2;
3713 }
3714 mutex_enter(&connp->conn_lock);
3715
3716 if (conn_same_as_last_v6(connp, sin6) &&
3717 connp->conn_lastsrcid == srcid &&
3718 ipsec_outbound_policy_current(ixa)) {
3719 UDP_DBGSTAT(us, udp_out_lastdst);
3720 /* udp_output_lastdst drops conn_lock */
3721 error = udp_output_lastdst(connp, data_mp, cr,
3722 pid, ixa);
3723 } else {
3724 UDP_DBGSTAT(us, udp_out_diffdst);
3725 /* udp_output_newdst drops conn_lock */
3726 error = udp_output_newdst(connp, data_mp, NULL,
3727 sin6, ipversion, cr, pid, ixa);
3728 }
3729 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3730 }
3731 if (error == 0) {
3732 freeb(mp);
3733 return;
3734 }
3735 break;
3736
3737 case AF_INET:
3738 sin = (sin_t *)addr;
3739 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
3740 (sin->sin_family != AF_INET)) {
3741 error = EADDRNOTAVAIL;
3742 goto ud_error2;
3743 }
3744 UDP_DBGSTAT(us, udp_out_ipv4);
3745 if (sin->sin_addr.s_addr == INADDR_ANY)
3746 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
3747 ipversion = IPV4_VERSION;
3748
3749 srcid = 0;
3750 if (tudr->OPT_length != 0) {
3751 /*
3752 * If we are connected then the destination needs to be
3753 * the same as the connected one.
3754 */
3755 if (udp->udp_state == TS_DATA_XFER &&
3756 !conn_same_as_last_v4(connp, sin)) {
3757 error = EISCONN;
3758 goto ud_error2;
3759 }
3760 UDP_STAT(us, udp_out_opt);
3761 error = udp_output_ancillary(connp, sin, NULL,
3762 data_mp, mp, NULL, cr, pid);
3763 } else {
3764 ip_xmit_attr_t *ixa;
3765
3766 /*
3767 * We have to allocate an ip_xmit_attr_t before we grab
3768 * conn_lock and we need to hold conn_lock once we've
3769 * checked conn_same_as_last_v4 to handle concurrent
3770 * send* calls on a socket.
3771 */
3772 ixa = conn_get_ixa(connp, B_FALSE);
3773 if (ixa == NULL) {
3774 error = ENOMEM;
3775 goto ud_error2;
3776 }
3777 mutex_enter(&connp->conn_lock);
3778
3779 if (conn_same_as_last_v4(connp, sin) &&
3780 ipsec_outbound_policy_current(ixa)) {
3781 UDP_DBGSTAT(us, udp_out_lastdst);
3782 /* udp_output_lastdst drops conn_lock */
3783 error = udp_output_lastdst(connp, data_mp, cr,
3784 pid, ixa);
3785 } else {
3786 UDP_DBGSTAT(us, udp_out_diffdst);
3787 /* udp_output_newdst drops conn_lock */
3788 error = udp_output_newdst(connp, data_mp, sin,
3789 NULL, ipversion, cr, pid, ixa);
3790 }
3791 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3792 }
3793 if (error == 0) {
3794 freeb(mp);
3795 return;
3796 }
3797 break;
3798 }
3799 UDP_STAT(us, udp_out_err_output);
3800 ASSERT(mp != NULL);
3801 /* mp is freed by the following routine */
3802 udp_ud_err(q, mp, (t_scalar_t)error);
3803 return;
3804
3805 ud_error2:
3806 UDPS_BUMP_MIB(us, udpOutErrors);
3807 freemsg(data_mp);
3808 UDP_STAT(us, udp_out_err_output);
3809 ASSERT(mp != NULL);
3810 /* mp is freed by the following routine */
3811 udp_ud_err(q, mp, (t_scalar_t)error);
3812 }
3813
3814 /*
3815 * Handle the case of the IP address, port, flow label being different
3816 * for both IPv4 and IPv6.
3817 *
3818 * NOTE: The caller must hold conn_lock and we drop it here.
3819 */
3820 static int
3821 udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
3822 ushort_t ipversion, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
3823 {
3824 uint_t srcid;
3825 uint32_t flowinfo;
3826 udp_t *udp = connp->conn_udp;
3827 int error = 0;
3828 ip_xmit_attr_t *oldixa;
3829 udp_stack_t *us = udp->udp_us;
3830 in6_addr_t v6src;
3831 in6_addr_t v6dst;
3832 in6_addr_t v6nexthop;
3833 in_port_t dstport;
3834
3835 ASSERT(MUTEX_HELD(&connp->conn_lock));
3836 ASSERT(ixa != NULL);
3837 /*
3838 * We hold conn_lock across all the use and modifications of
3839 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
3840 * stay consistent.
3841 */
3842
3843 ASSERT(cr != NULL);
3844 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3845 ixa->ixa_cred = cr;
3846 ixa->ixa_cpid = pid;
3847 if (is_system_labeled()) {
3848 /* We need to restart with a label based on the cred */
3849 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3850 }
3851
3852 /*
3853 * If we are connected then the destination needs to be the
3854 * same as the connected one, which is not the case here since we
3855 * checked for that above.
3856 */
3857 if (udp->udp_state == TS_DATA_XFER) {
3858 mutex_exit(&connp->conn_lock);
3859 error = EISCONN;
3860 goto ud_error;
3861 }
3862
3863 /* In case previous destination was multicast or multirt */
3864 ip_attr_newdst(ixa);
3865
3866 /*
3867 * If laddr is unspecified then we look at sin6_src_id.
3868 * We will give precedence to a source address set with IPV6_PKTINFO
3869 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3870 * want ip_attr_connect to select a source (since it can fail) when
3871 * IPV6_PKTINFO is specified.
3872 * If this doesn't result in a source address then we get a source
3873 * from ip_attr_connect() below.
3874 */
3875 v6src = connp->conn_saddr_v6;
3876 if (sin != NULL) {
3877 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3878 dstport = sin->sin_port;
3879 flowinfo = 0;
3880 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
3881 srcid = 0;
3882 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3883 ixa->ixa_flags |= IXAF_IS_IPV4;
3884 } else {
3885 boolean_t v4mapped;
3886
3887 v6dst = sin6->sin6_addr;
3888 dstport = sin6->sin6_port;
3889 flowinfo = sin6->sin6_flowinfo;
3890 srcid = sin6->__sin6_src_id;
3891 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3892 ixa->ixa_scopeid = sin6->sin6_scope_id;
3893 ixa->ixa_flags |= IXAF_SCOPEID_SET;
3894 } else {
3895 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3896 }
3897 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3898 if (v4mapped)
3899 ixa->ixa_flags |= IXAF_IS_IPV4;
3900 else
3901 ixa->ixa_flags &= ~IXAF_IS_IPV4;
3902 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3903 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3904 v4mapped, connp->conn_netstack)) {
3905 /* Mismatched v4mapped/v6 specified by srcid. */
3906 mutex_exit(&connp->conn_lock);
3907 error = EADDRNOTAVAIL;
3908 goto ud_error;
3909 }
3910 }
3911 }
3912 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3913 if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
3914 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
3915
3916 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3917 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3918 v6src = ipp->ipp_addr;
3919 } else {
3920 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3921 v6src = ipp->ipp_addr;
3922 }
3923 }
3924
3925 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
3926 mutex_exit(&connp->conn_lock);
3927
3928 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3929 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
3930 switch (error) {
3931 case 0:
3932 break;
3933 case EADDRNOTAVAIL:
3934 /*
3935 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3936 * Don't have the application see that errno
3937 */
3938 error = ENETUNREACH;
3939 goto failed;
3940 case ENETDOWN:
3941 /*
3942 * Have !ipif_addr_ready address; drop packet silently
3943 * until we can get applications to not send until we
3944 * are ready.
3945 */
3946 error = 0;
3947 goto failed;
3948 case EHOSTUNREACH:
3949 case ENETUNREACH:
3950 if (ixa->ixa_ire != NULL) {
3951 /*
3952 * Let conn_ip_output/ire_send_noroute return
3953 * the error and send any local ICMP error.
3954 */
3955 error = 0;
3956 break;
3957 }
3958 /* FALLTHRU */
3959 failed:
3960 default:
3961 goto ud_error;
3962 }
3963
3964
3965 /*
3966 * Cluster note: we let the cluster hook know that we are sending to a
3967 * new address and/or port.
3968 */
3969 if (cl_inet_connect2 != NULL) {
3970 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
3971 if (error != 0) {
3972 error = EHOSTUNREACH;
3973 goto ud_error;
3974 }
3975 }
3976
3977 mutex_enter(&connp->conn_lock);
3978 /*
3979 * While we dropped the lock some other thread might have connected
3980 * this socket. If so we bail out with EISCONN to ensure that the
3981 * connecting thread is the one that updates conn_ixa, conn_ht_*
3982 * and conn_*last*.
3983 */
3984 if (udp->udp_state == TS_DATA_XFER) {
3985 mutex_exit(&connp->conn_lock);
3986 error = EISCONN;
3987 goto ud_error;
3988 }
3989
3990 /*
3991 * We need to rebuild the headers if
3992 * - we are labeling packets (could be different for different
3993 * destinations)
3994 * - we have a source route (or routing header) since we need to
3995 * massage that to get the pseudo-header checksum
3996 * - the IP version is different than the last time
3997 * - a socket option with COA_HEADER_CHANGED has been set which
3998 * set conn_v6lastdst to zero.
3999 *
4000 * Otherwise the prepend function will just update the src, dst,
4001 * dstport, and flow label.
4002 */
4003 if (is_system_labeled()) {
4004 /* TX MLP requires SCM_UCRED and don't have that here */
4005 if (connp->conn_mlp_type != mlptSingle) {
4006 mutex_exit(&connp->conn_lock);
4007 error = ECONNREFUSED;
4008 goto ud_error;
4009 }
4010 /*
4011 * Check whether Trusted Solaris policy allows communication
4012 * with this host, and pretend that the destination is
4013 * unreachable if not.
4014 * Compute any needed label and place it in ipp_label_v4/v6.
4015 *
4016 * Later conn_build_hdr_template/conn_prepend_hdr takes
4017 * ipp_label_v4/v6 to form the packet.
4018 *
4019 * Tsol note: Since we hold conn_lock we know no other
4020 * thread manipulates conn_xmit_ipp.
4021 */
4022 error = conn_update_label(connp, ixa, &v6dst,
4023 &connp->conn_xmit_ipp);
4024 if (error != 0) {
4025 mutex_exit(&connp->conn_lock);
4026 goto ud_error;
4027 }
4028 /* Rebuild the header template */
4029 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
4030 flowinfo);
4031 if (error != 0) {
4032 mutex_exit(&connp->conn_lock);
4033 goto ud_error;
4034 }
4035 } else if ((connp->conn_xmit_ipp.ipp_fields &
4036 (IPPF_IPV4_OPTIONS|IPPF_RTHDR)) ||
4037 ipversion != connp->conn_lastipversion ||
4038 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
4039 /* Rebuild the header template */
4040 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
4041 flowinfo);
4042 if (error != 0) {
4043 mutex_exit(&connp->conn_lock);
4044 goto ud_error;
4045 }
4046 } else {
4047 /* Simply update the destination address if no source route */
4048 if (ixa->ixa_flags & IXAF_IS_IPV4) {
4049 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc;
4050
4051 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
4052 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
4053 ipha->ipha_fragment_offset_and_flags |=
4054 IPH_DF_HTONS;
4055 } else {
4056 ipha->ipha_fragment_offset_and_flags &=
4057 ~IPH_DF_HTONS;
4058 }
4059 } else {
4060 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
4061 ip6h->ip6_dst = v6dst;
4062 }
4063 }
4064
4065 /*
4066 * Remember the dst/dstport etc which corresponds to the built header
4067 * template and conn_ixa.
4068 */
4069 oldixa = conn_replace_ixa(connp, ixa);
4070 connp->conn_v6lastdst = v6dst;
4071 connp->conn_lastipversion = ipversion;
4072 connp->conn_lastdstport = dstport;
4073 connp->conn_lastflowinfo = flowinfo;
4074 connp->conn_lastscopeid = ixa->ixa_scopeid;
4075 connp->conn_lastsrcid = srcid;
4076 /* Also remember a source to use together with lastdst */
4077 connp->conn_v6lastsrc = v6src;
4078
4079 data_mp = udp_prepend_header_template(connp, ixa, data_mp, &v6src,
4080 dstport, flowinfo, &error);
4081
4082 /* Done with conn_t */
4083 mutex_exit(&connp->conn_lock);
4084 ixa_refrele(oldixa);
4085
4086 if (data_mp == NULL) {
4087 ASSERT(error != 0);
4088 goto ud_error;
4089 }
4090
4091 /* We're done. Pass the packet to ip. */
4092 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
4093
4094 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
4095 void_ip_t *, data_mp->b_rptr, udp_t *, udp, udpha_t *,
4096 &data_mp->b_rptr[ixa->ixa_ip_hdr_length]);
4097
4098 error = conn_ip_output(data_mp, ixa);
4099 /* No udpOutErrors if an error since IP increases its error counter */
4100 switch (error) {
4101 case 0:
4102 break;
4103 case EWOULDBLOCK:
4104 (void) ixa_check_drain_insert(connp, ixa);
4105 error = 0;
4106 break;
4107 case EADDRNOTAVAIL:
4108 /*
4109 * IXAF_VERIFY_SOURCE tells us to pick a better source.
4110 * Don't have the application see that errno
4111 */
4112 error = ENETUNREACH;
4113 /* FALLTHRU */
4114 default:
4115 mutex_enter(&connp->conn_lock);
4116 /*
4117 * Clear the source and v6lastdst so we call ip_attr_connect
4118 * for the next packet and try to pick a better source.
4119 */
4120 if (connp->conn_mcbc_bind)
4121 connp->conn_saddr_v6 = ipv6_all_zeros;
4122 else
4123 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
4124 connp->conn_v6lastdst = ipv6_all_zeros;
4125 mutex_exit(&connp->conn_lock);
4126 break;
4127 }
4128 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4129 ixa->ixa_cred = connp->conn_cred; /* Restore */
4130 ixa->ixa_cpid = connp->conn_cpid;
4131 ixa_refrele(ixa);
4132 return (error);
4133
4134 ud_error:
4135 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4136 ixa->ixa_cred = connp->conn_cred; /* Restore */
4137 ixa->ixa_cpid = connp->conn_cpid;
4138 ixa_refrele(ixa);
4139
4140 freemsg(data_mp);
4141 UDPS_BUMP_MIB(us, udpOutErrors);
4142 UDP_STAT(us, udp_out_err_output);
4143 return (error);
4144 }
4145
4146 /* ARGSUSED */
4147 static void
4148 udp_wput_fallback(queue_t *wq, mblk_t *mp)
4149 {
4150 #ifdef DEBUG
4151 cmn_err(CE_CONT, "udp_wput_fallback: Message in fallback \n");
4152 #endif
4153 freemsg(mp);
4154 }
4155
4156
4157 /*
4158 * Handle special out-of-band ioctl requests (see PSARC/2008/265).
4159 */
4160 static void
4161 udp_wput_cmdblk(queue_t *q, mblk_t *mp)
4162 {
4163 void *data;
4164 mblk_t *datamp = mp->b_cont;
4165 conn_t *connp = Q_TO_CONN(q);
4166 udp_t *udp = connp->conn_udp;
4167 cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr;
4168
4169 if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) {
4170 cmdp->cb_error = EPROTO;
4171 qreply(q, mp);
4172 return;
4173 }
4174 data = datamp->b_rptr;
4175
4176 mutex_enter(&connp->conn_lock);
4177 switch (cmdp->cb_cmd) {
4178 case TI_GETPEERNAME:
4179 if (udp->udp_state != TS_DATA_XFER)
4180 cmdp->cb_error = ENOTCONN;
4181 else
4182 cmdp->cb_error = conn_getpeername(connp, data,
4183 &cmdp->cb_len);
4184 break;
4185 case TI_GETMYNAME:
4186 cmdp->cb_error = conn_getsockname(connp, data, &cmdp->cb_len);
4187 break;
4188 default:
4189 cmdp->cb_error = EINVAL;
4190 break;
4191 }
4192 mutex_exit(&connp->conn_lock);
4193
4194 qreply(q, mp);
4195 }
4196
4197 static void
4198 udp_use_pure_tpi(udp_t *udp)
4199 {
4200 conn_t *connp = udp->udp_connp;
4201
4202 mutex_enter(&connp->conn_lock);
4203 udp->udp_issocket = B_FALSE;
4204 mutex_exit(&connp->conn_lock);
4205 UDP_STAT(udp->udp_us, udp_sock_fallback);
4206 }
4207
4208 static void
4209 udp_wput_other(queue_t *q, mblk_t *mp)
4210 {
4211 uchar_t *rptr = mp->b_rptr;
4212 struct iocblk *iocp;
4213 conn_t *connp = Q_TO_CONN(q);
4214 udp_t *udp = connp->conn_udp;
4215 cred_t *cr;
4216
4217 switch (mp->b_datap->db_type) {
4218 case M_CMD:
4219 udp_wput_cmdblk(q, mp);
4220 return;
4221
4222 case M_PROTO:
4223 case M_PCPROTO:
4224 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4225 /*
4226 * If the message does not contain a PRIM_type,
4227 * throw it away.
4228 */
4229 freemsg(mp);
4230 return;
4231 }
4232 switch (((t_primp_t)rptr)->type) {
4233 case T_ADDR_REQ:
4234 udp_addr_req(q, mp);
4235 return;
4236 case O_T_BIND_REQ:
4237 case T_BIND_REQ:
4238 udp_tpi_bind(q, mp);
4239 return;
4240 case T_CONN_REQ:
4241 udp_tpi_connect(q, mp);
4242 return;
4243 case T_CAPABILITY_REQ:
4244 udp_capability_req(q, mp);
4245 return;
4246 case T_INFO_REQ:
4247 udp_info_req(q, mp);
4248 return;
4249 case T_UNITDATA_REQ:
4250 /*
4251 * If a T_UNITDATA_REQ gets here, the address must
4252 * be bad. Valid T_UNITDATA_REQs are handled
4253 * in udp_wput.
4254 */
4255 udp_ud_err(q, mp, EADDRNOTAVAIL);
4256 return;
4257 case T_UNBIND_REQ:
4258 udp_tpi_unbind(q, mp);
4259 return;
4260 case T_SVR4_OPTMGMT_REQ:
4261 /*
4262 * All Solaris components should pass a db_credp
4263 * for this TPI message, hence we ASSERT.
4264 * But in case there is some other M_PROTO that looks
4265 * like a TPI message sent by some other kernel
4266 * component, we check and return an error.
4267 */
4268 cr = msg_getcred(mp, NULL);
4269 ASSERT(cr != NULL);
4270 if (cr == NULL) {
4271 udp_err_ack(q, mp, TSYSERR, EINVAL);
4272 return;
4273 }
4274 if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
4275 cr)) {
4276 svr4_optcom_req(q, mp, cr, &udp_opt_obj);
4277 }
4278 return;
4279
4280 case T_OPTMGMT_REQ:
4281 /*
4282 * All Solaris components should pass a db_credp
4283 * for this TPI message, hence we ASSERT.
4284 * But in case there is some other M_PROTO that looks
4285 * like a TPI message sent by some other kernel
4286 * component, we check and return an error.
4287 */
4288 cr = msg_getcred(mp, NULL);
4289 ASSERT(cr != NULL);
4290 if (cr == NULL) {
4291 udp_err_ack(q, mp, TSYSERR, EINVAL);
4292 return;
4293 }
4294 tpi_optcom_req(q, mp, cr, &udp_opt_obj);
4295 return;
4296
4297 case T_DISCON_REQ:
4298 udp_tpi_disconnect(q, mp);
4299 return;
4300
4301 /* The following TPI message is not supported by udp. */
4302 case O_T_CONN_RES:
4303 case T_CONN_RES:
4304 udp_err_ack(q, mp, TNOTSUPPORT, 0);
4305 return;
4306
4307 /* The following 3 TPI requests are illegal for udp. */
4308 case T_DATA_REQ:
4309 case T_EXDATA_REQ:
4310 case T_ORDREL_REQ:
4311 udp_err_ack(q, mp, TNOTSUPPORT, 0);
4312 return;
4313 default:
4314 break;
4315 }
4316 break;
4317 case M_FLUSH:
4318 if (*rptr & FLUSHW)
4319 flushq(q, FLUSHDATA);
4320 break;
4321 case M_IOCTL:
4322 iocp = (struct iocblk *)mp->b_rptr;
4323 switch (iocp->ioc_cmd) {
4324 case TI_GETPEERNAME:
4325 if (udp->udp_state != TS_DATA_XFER) {
4326 /*
4327 * If a default destination address has not
4328 * been associated with the stream, then we
4329 * don't know the peer's name.
4330 */
4331 iocp->ioc_error = ENOTCONN;
4332 iocp->ioc_count = 0;
4333 mp->b_datap->db_type = M_IOCACK;
4334 qreply(q, mp);
4335 return;
4336 }
4337 /* FALLTHRU */
4338 case TI_GETMYNAME:
4339 /*
4340 * For TI_GETPEERNAME and TI_GETMYNAME, we first
4341 * need to copyin the user's strbuf structure.
4342 * Processing will continue in the M_IOCDATA case
4343 * below.
4344 */
4345 mi_copyin(q, mp, NULL,
4346 SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4347 return;
4348 case _SIOCSOCKFALLBACK:
4349 /*
4350 * Either sockmod is about to be popped and the
4351 * socket would now be treated as a plain stream,
4352 * or a module is about to be pushed so we have
4353 * to follow pure TPI semantics.
4354 */
4355 if (!udp->udp_issocket) {
4356 DB_TYPE(mp) = M_IOCNAK;
4357 iocp->ioc_error = EINVAL;
4358 } else {
4359 udp_use_pure_tpi(udp);
4360
4361 DB_TYPE(mp) = M_IOCACK;
4362 iocp->ioc_error = 0;
4363 }
4364 iocp->ioc_count = 0;
4365 iocp->ioc_rval = 0;
4366 qreply(q, mp);
4367 return;
4368 default:
4369 break;
4370 }
4371 break;
4372 case M_IOCDATA:
4373 udp_wput_iocdata(q, mp);
4374 return;
4375 default:
4376 /* Unrecognized messages are passed through without change. */
4377 break;
4378 }
4379 ip_wput_nondata(q, mp);
4380 }
4381
4382 /*
4383 * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
4384 * messages.
4385 */
4386 static void
4387 udp_wput_iocdata(queue_t *q, mblk_t *mp)
4388 {
4389 mblk_t *mp1;
4390 struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
4391 STRUCT_HANDLE(strbuf, sb);
4392 uint_t addrlen;
4393 conn_t *connp = Q_TO_CONN(q);
4394 udp_t *udp = connp->conn_udp;
4395
4396 /* Make sure it is one of ours. */
4397 switch (iocp->ioc_cmd) {
4398 case TI_GETMYNAME:
4399 case TI_GETPEERNAME:
4400 break;
4401 default:
4402 ip_wput_nondata(q, mp);
4403 return;
4404 }
4405
4406 switch (mi_copy_state(q, mp, &mp1)) {
4407 case -1:
4408 return;
4409 case MI_COPY_CASE(MI_COPY_IN, 1):
4410 break;
4411 case MI_COPY_CASE(MI_COPY_OUT, 1):
4412 /*
4413 * The address has been copied out, so now
4414 * copyout the strbuf.
4415 */
4416 mi_copyout(q, mp);
4417 return;
4418 case MI_COPY_CASE(MI_COPY_OUT, 2):
4419 /*
4420 * The address and strbuf have been copied out.
4421 * We're done, so just acknowledge the original
4422 * M_IOCTL.
4423 */
4424 mi_copy_done(q, mp, 0);
4425 return;
4426 default:
4427 /*
4428 * Something strange has happened, so acknowledge
4429 * the original M_IOCTL with an EPROTO error.
4430 */
4431 mi_copy_done(q, mp, EPROTO);
4432 return;
4433 }
4434
4435 /*
4436 * Now we have the strbuf structure for TI_GETMYNAME
4437 * and TI_GETPEERNAME. Next we copyout the requested
4438 * address and then we'll copyout the strbuf.
4439 */
4440 STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr);
4441
4442 if (connp->conn_family == AF_INET)
4443 addrlen = sizeof (sin_t);
4444 else
4445 addrlen = sizeof (sin6_t);
4446
4447 if (STRUCT_FGET(sb, maxlen) < addrlen) {
4448 mi_copy_done(q, mp, EINVAL);
4449 return;
4450 }
4451
4452 switch (iocp->ioc_cmd) {
4453 case TI_GETMYNAME:
4454 break;
4455 case TI_GETPEERNAME:
4456 if (udp->udp_state != TS_DATA_XFER) {
4457 mi_copy_done(q, mp, ENOTCONN);
4458 return;
4459 }
4460 break;
4461 }
4462 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4463 if (!mp1)
4464 return;
4465
4466 STRUCT_FSET(sb, len, addrlen);
4467 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4468 case TI_GETMYNAME:
4469 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4470 &addrlen);
4471 break;
4472 case TI_GETPEERNAME:
4473 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4474 &addrlen);
4475 break;
4476 }
4477 mp1->b_wptr += addrlen;
4478 /* Copy out the address */
4479 mi_copyout(q, mp);
4480 }
4481
4482 void
4483 udp_ddi_g_init(void)
4484 {
4485 udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
4486 udp_opt_obj.odb_opt_arr_cnt);
4487
4488 /*
4489 * We want to be informed each time a stack is created or
4490 * destroyed in the kernel, so we can maintain the
4491 * set of udp_stack_t's.
4492 */
4493 netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
4494 }
4495
4496 void
4497 udp_ddi_g_destroy(void)
4498 {
4499 netstack_unregister(NS_UDP);
4500 }
4501
4502 #define INET_NAME "ip"
4503
4504 /*
4505 * Initialize the UDP stack instance.
4506 */
4507 static void *
4508 udp_stack_init(netstackid_t stackid, netstack_t *ns)
4509 {
4510 udp_stack_t *us;
4511 int i;
4512 int error = 0;
4513 major_t major;
4514 size_t arrsz;
4515
4516 us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
4517 us->us_netstack = ns;
4518
4519 mutex_init(&us->us_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
4520 us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
4521 us->us_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
4522 us->us_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
4523
4524 /*
4525 * The smallest anonymous port in the priviledged port range which UDP
4526 * looks for free port. Use in the option UDP_ANONPRIVBIND.
4527 */
4528 us->us_min_anonpriv_port = 512;
4529
4530 us->us_bind_fanout_size = udp_bind_fanout_size;
4531
4532 /* Roundup variable that might have been modified in /etc/system */
4533 if (!ISP2(us->us_bind_fanout_size)) {
4534 /* Not a power of two. Round up to nearest power of two */
4535 for (i = 0; i < 31; i++) {
4536 if (us->us_bind_fanout_size < (1 << i))
4537 break;
4538 }
4539 us->us_bind_fanout_size = 1 << i;
4540 }
4541 us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
4542 sizeof (udp_fanout_t), KM_SLEEP);
4543 for (i = 0; i < us->us_bind_fanout_size; i++) {
4544 mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
4545 NULL);
4546 }
4547
4548 arrsz = udp_propinfo_count * sizeof (mod_prop_info_t);
4549 us->us_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
4550 KM_SLEEP);
4551 bcopy(udp_propinfo_tbl, us->us_propinfo_tbl, arrsz);
4552
4553 /* Allocate the per netstack stats */
4554 mutex_enter(&cpu_lock);
4555 us->us_sc_cnt = MAX(ncpus, boot_ncpus);
4556 mutex_exit(&cpu_lock);
4557 us->us_sc = kmem_zalloc(max_ncpus * sizeof (udp_stats_cpu_t *),
4558 KM_SLEEP);
4559 for (i = 0; i < us->us_sc_cnt; i++) {
4560 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4561 KM_SLEEP);
4562 }
4563
4564 us->us_kstat = udp_kstat2_init(stackid);
4565 us->us_mibkp = udp_kstat_init(stackid);
4566
4567 major = mod_name_to_major(INET_NAME);
4568 error = ldi_ident_from_major(major, &us->us_ldi_ident);
4569 ASSERT(error == 0);
4570 return (us);
4571 }
4572
4573 /*
4574 * Free the UDP stack instance.
4575 */
4576 static void
4577 udp_stack_fini(netstackid_t stackid, void *arg)
4578 {
4579 udp_stack_t *us = (udp_stack_t *)arg;
4580 int i;
4581
4582 for (i = 0; i < us->us_bind_fanout_size; i++) {
4583 mutex_destroy(&us->us_bind_fanout[i].uf_lock);
4584 }
4585
4586 kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
4587 sizeof (udp_fanout_t));
4588
4589 us->us_bind_fanout = NULL;
4590
4591 for (i = 0; i < us->us_sc_cnt; i++)
4592 kmem_free(us->us_sc[i], sizeof (udp_stats_cpu_t));
4593 kmem_free(us->us_sc, max_ncpus * sizeof (udp_stats_cpu_t *));
4594
4595 kmem_free(us->us_propinfo_tbl,
4596 udp_propinfo_count * sizeof (mod_prop_info_t));
4597 us->us_propinfo_tbl = NULL;
4598
4599 udp_kstat_fini(stackid, us->us_mibkp);
4600 us->us_mibkp = NULL;
4601
4602 udp_kstat2_fini(stackid, us->us_kstat);
4603 us->us_kstat = NULL;
4604
4605 mutex_destroy(&us->us_epriv_port_lock);
4606 ldi_ident_release(us->us_ldi_ident);
4607 kmem_free(us, sizeof (*us));
4608 }
4609
4610 static size_t
4611 udp_set_rcv_hiwat(udp_t *udp, size_t size)
4612 {
4613 udp_stack_t *us = udp->udp_us;
4614
4615 /* We add a bit of extra buffering */
4616 size += size >> 1;
4617 if (size > us->us_max_buf)
4618 size = us->us_max_buf;
4619
4620 udp->udp_rcv_hiwat = size;
4621 return (size);
4622 }
4623
4624 /*
4625 * For the lower queue so that UDP can be a dummy mux.
4626 * Nobody should be sending
4627 * packets up this stream
4628 */
4629 static void
4630 udp_lrput(queue_t *q, mblk_t *mp)
4631 {
4632 switch (mp->b_datap->db_type) {
4633 case M_FLUSH:
4634 /* Turn around */
4635 if (*mp->b_rptr & FLUSHW) {
4636 *mp->b_rptr &= ~FLUSHR;
4637 qreply(q, mp);
4638 return;
4639 }
4640 break;
4641 }
4642 freemsg(mp);
4643 }
4644
4645 /*
4646 * For the lower queue so that UDP can be a dummy mux.
4647 * Nobody should be sending packets down this stream.
4648 */
4649 /* ARGSUSED */
4650 void
4651 udp_lwput(queue_t *q, mblk_t *mp)
4652 {
4653 freemsg(mp);
4654 }
4655
4656 /*
4657 * When a CPU is added, we need to allocate the per CPU stats struct.
4658 */
4659 void
4660 udp_stack_cpu_add(udp_stack_t *us, processorid_t cpu_seqid)
4661 {
4662 int i;
4663
4664 if (cpu_seqid < us->us_sc_cnt)
4665 return;
4666 for (i = us->us_sc_cnt; i <= cpu_seqid; i++) {
4667 ASSERT(us->us_sc[i] == NULL);
4668 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4669 KM_SLEEP);
4670 }
4671 membar_producer();
4672 us->us_sc_cnt = cpu_seqid + 1;
4673 }
4674
4675 /*
4676 * Below routines for UDP socket module.
4677 */
4678
4679 static conn_t *
4680 udp_do_open(cred_t *credp, boolean_t isv6, int flags, int *errorp)
4681 {
4682 udp_t *udp;
4683 conn_t *connp;
4684 zoneid_t zoneid;
4685 netstack_t *ns;
4686 udp_stack_t *us;
4687 int len;
4688
4689 ASSERT(errorp != NULL);
4690
4691 if ((*errorp = secpolicy_basic_net_access(credp)) != 0)
4692 return (NULL);
4693
4694 ns = netstack_find_by_cred(credp);
4695 ASSERT(ns != NULL);
4696 us = ns->netstack_udp;
4697 ASSERT(us != NULL);
4698
4699 /*
4700 * For exclusive stacks we set the zoneid to zero
4701 * to make UDP operate as if in the global zone.
4702 */
4703 if (ns->netstack_stackid != GLOBAL_NETSTACKID)
4704 zoneid = GLOBAL_ZONEID;
4705 else
4706 zoneid = crgetzoneid(credp);
4707
4708 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
4709
4710 connp = ipcl_conn_create(IPCL_UDPCONN, flags, ns);
4711 if (connp == NULL) {
4712 netstack_rele(ns);
4713 *errorp = ENOMEM;
4714 return (NULL);
4715 }
4716 udp = connp->conn_udp;
4717
4718 /*
4719 * ipcl_conn_create did a netstack_hold. Undo the hold that was
4720 * done by netstack_find_by_cred()
4721 */
4722 netstack_rele(ns);
4723
4724 /*
4725 * Since this conn_t/udp_t is not yet visible to anybody else we don't
4726 * need to lock anything.
4727 */
4728 ASSERT(connp->conn_proto == IPPROTO_UDP);
4729 ASSERT(connp->conn_udp == udp);
4730 ASSERT(udp->udp_connp == connp);
4731
4732 /* Set the initial state of the stream and the privilege status. */
4733 udp->udp_state = TS_UNBND;
4734 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
4735 if (isv6) {
4736 connp->conn_family = AF_INET6;
4737 connp->conn_ipversion = IPV6_VERSION;
4738 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4739 connp->conn_default_ttl = us->us_ipv6_hoplimit;
4740 len = sizeof (ip6_t) + UDPH_SIZE;
4741 } else {
4742 connp->conn_family = AF_INET;
4743 connp->conn_ipversion = IPV4_VERSION;
4744 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4745 connp->conn_default_ttl = us->us_ipv4_ttl;
4746 len = sizeof (ipha_t) + UDPH_SIZE;
4747 }
4748
4749 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
4750 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
4751
4752 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
4753 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
4754 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
4755 connp->conn_ixa->ixa_zoneid = zoneid;
4756
4757 connp->conn_zoneid = zoneid;
4758
4759 /*
4760 * If the caller has the process-wide flag set, then default to MAC
4761 * exempt mode. This allows read-down to unlabeled hosts.
4762 */
4763 if (getpflags(NET_MAC_AWARE, credp) != 0)
4764 connp->conn_mac_mode = CONN_MAC_AWARE;
4765
4766 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
4767
4768 udp->udp_us = us;
4769
4770 connp->conn_rcvbuf = us->us_recv_hiwat;
4771 connp->conn_sndbuf = us->us_xmit_hiwat;
4772 connp->conn_sndlowat = us->us_xmit_lowat;
4773 connp->conn_rcvlowat = udp_mod_info.mi_lowat;
4774
4775 connp->conn_wroff = len + us->us_wroff_extra;
4776 connp->conn_so_type = SOCK_DGRAM;
4777
4778 connp->conn_recv = udp_input;
4779 connp->conn_recvicmp = udp_icmp_input;
4780 crhold(credp);
4781 connp->conn_cred = credp;
4782 connp->conn_cpid = curproc->p_pid;
4783 connp->conn_open_time = ddi_get_lbolt64();
4784 /* Cache things in ixa without an extra refhold */
4785 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
4786 connp->conn_ixa->ixa_cred = connp->conn_cred;
4787 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
4788 if (is_system_labeled())
4789 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
4790
4791 *((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
4792
4793 if (us->us_pmtu_discovery)
4794 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
4795
4796 return (connp);
4797 }
4798
4799 sock_lower_handle_t
4800 udp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
4801 uint_t *smodep, int *errorp, int flags, cred_t *credp)
4802 {
4803 udp_t *udp = NULL;
4804 udp_stack_t *us;
4805 conn_t *connp;
4806 boolean_t isv6;
4807
4808 if (type != SOCK_DGRAM || (family != AF_INET && family != AF_INET6) ||
4809 (proto != 0 && proto != IPPROTO_UDP)) {
4810 *errorp = EPROTONOSUPPORT;
4811 return (NULL);
4812 }
4813
4814 if (family == AF_INET6)
4815 isv6 = B_TRUE;
4816 else
4817 isv6 = B_FALSE;
4818
4819 connp = udp_do_open(credp, isv6, flags, errorp);
4820 if (connp == NULL)
4821 return (NULL);
4822
4823 udp = connp->conn_udp;
4824 ASSERT(udp != NULL);
4825 us = udp->udp_us;
4826 ASSERT(us != NULL);
4827
4828 udp->udp_issocket = B_TRUE;
4829 connp->conn_flags |= IPCL_NONSTR;
4830
4831 /*
4832 * Set flow control
4833 * Since this conn_t/udp_t is not yet visible to anybody else we don't
4834 * need to lock anything.
4835 */
4836 (void) udp_set_rcv_hiwat(udp, connp->conn_rcvbuf);
4837 udp->udp_rcv_disply_hiwat = connp->conn_rcvbuf;
4838
4839 connp->conn_flow_cntrld = B_FALSE;
4840
4841 mutex_enter(&connp->conn_lock);
4842 connp->conn_state_flags &= ~CONN_INCIPIENT;
4843 mutex_exit(&connp->conn_lock);
4844
4845 *errorp = 0;
4846 *smodep = SM_ATOMIC;
4847 *sock_downcalls = &sock_udp_downcalls;
4848 return ((sock_lower_handle_t)connp);
4849 }
4850
4851 /* ARGSUSED3 */
4852 void
4853 udp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle,
4854 sock_upcalls_t *sock_upcalls, int flags, cred_t *cr)
4855 {
4856 conn_t *connp = (conn_t *)proto_handle;
4857 struct sock_proto_props sopp;
4858
4859 /* All Solaris components should pass a cred for this operation. */
4860 ASSERT(cr != NULL);
4861
4862 connp->conn_upcalls = sock_upcalls;
4863 connp->conn_upper_handle = sock_handle;
4864
4865 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
4866 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
4867 sopp.sopp_wroff = connp->conn_wroff;
4868 sopp.sopp_maxblk = INFPSZ;
4869 sopp.sopp_rxhiwat = connp->conn_rcvbuf;
4870 sopp.sopp_rxlowat = connp->conn_rcvlowat;
4871 sopp.sopp_maxaddrlen = sizeof (sin6_t);
4872 sopp.sopp_maxpsz =
4873 (connp->conn_family == AF_INET) ? UDP_MAXPACKET_IPV4 :
4874 UDP_MAXPACKET_IPV6;
4875 sopp.sopp_minpsz = (udp_mod_info.mi_minpsz == 1) ? 0 :
4876 udp_mod_info.mi_minpsz;
4877
4878 (*connp->conn_upcalls->su_set_proto_props)(connp->conn_upper_handle,
4879 &sopp);
4880 }
4881
4882 static void
4883 udp_do_close(conn_t *connp)
4884 {
4885 udp_t *udp;
4886
4887 ASSERT(connp != NULL && IPCL_IS_UDP(connp));
4888 udp = connp->conn_udp;
4889
4890 if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
4891 /*
4892 * Running in cluster mode - register unbind information
4893 */
4894 if (connp->conn_ipversion == IPV4_VERSION) {
4895 (*cl_inet_unbind)(
4896 connp->conn_netstack->netstack_stackid,
4897 IPPROTO_UDP, AF_INET,
4898 (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
4899 (in_port_t)connp->conn_lport, NULL);
4900 } else {
4901 (*cl_inet_unbind)(
4902 connp->conn_netstack->netstack_stackid,
4903 IPPROTO_UDP, AF_INET6,
4904 (uint8_t *)&(connp->conn_laddr_v6),
4905 (in_port_t)connp->conn_lport, NULL);
4906 }
4907 }
4908
4909 udp_bind_hash_remove(udp, B_FALSE);
4910
4911 ip_quiesce_conn(connp);
4912
4913 if (!IPCL_IS_NONSTR(connp)) {
4914 ASSERT(connp->conn_wq != NULL);
4915 ASSERT(connp->conn_rq != NULL);
4916 qprocsoff(connp->conn_rq);
4917 }
4918
4919 udp_close_free(connp);
4920
4921 /*
4922 * Now we are truly single threaded on this stream, and can
4923 * delete the things hanging off the connp, and finally the connp.
4924 * We removed this connp from the fanout list, it cannot be
4925 * accessed thru the fanouts, and we already waited for the
4926 * conn_ref to drop to 0. We are already in close, so
4927 * there cannot be any other thread from the top. qprocsoff
4928 * has completed, and service has completed or won't run in
4929 * future.
4930 */
4931 ASSERT(connp->conn_ref == 1);
4932
4933 if (!IPCL_IS_NONSTR(connp)) {
4934 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4935 } else {
4936 ip_free_helper_stream(connp);
4937 }
4938
4939 connp->conn_ref--;
4940 ipcl_conn_destroy(connp);
4941 }
4942
4943 /* ARGSUSED1 */
4944 int
4945 udp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
4946 {
4947 conn_t *connp = (conn_t *)proto_handle;
4948
4949 /* All Solaris components should pass a cred for this operation. */
4950 ASSERT(cr != NULL);
4951
4952 udp_do_close(connp);
4953 return (0);
4954 }
4955
4956 static int
4957 udp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4958 boolean_t bind_to_req_port_only)
4959 {
4960 sin_t *sin;
4961 sin6_t *sin6;
4962 udp_t *udp = connp->conn_udp;
4963 int error = 0;
4964 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */
4965 in_port_t port; /* Host byte order */
4966 in_port_t requested_port; /* Host byte order */
4967 int count;
4968 ipaddr_t v4src; /* Set if AF_INET */
4969 in6_addr_t v6src;
4970 int loopmax;
4971 udp_fanout_t *udpf;
4972 in_port_t lport; /* Network byte order */
4973 uint_t scopeid = 0;
4974 zoneid_t zoneid = IPCL_ZONEID(connp);
4975 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
4976 boolean_t is_inaddr_any;
4977 mlp_type_t addrtype, mlptype;
4978 udp_stack_t *us = udp->udp_us;
4979
4980 switch (len) {
4981 case sizeof (sin_t): /* Complete IPv4 address */
4982 sin = (sin_t *)sa;
4983
4984 if (sin == NULL || !OK_32PTR((char *)sin))
4985 return (EINVAL);
4986
4987 if (connp->conn_family != AF_INET ||
4988 sin->sin_family != AF_INET) {
4989 return (EAFNOSUPPORT);
4990 }
4991 v4src = sin->sin_addr.s_addr;
4992 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
4993 if (v4src != INADDR_ANY) {
4994 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
4995 B_TRUE);
4996 }
4997 port = ntohs(sin->sin_port);
4998 break;
4999
5000 case sizeof (sin6_t): /* complete IPv6 address */
5001 sin6 = (sin6_t *)sa;
5002
5003 if (sin6 == NULL || !OK_32PTR((char *)sin6))
5004 return (EINVAL);
5005
5006 if (connp->conn_family != AF_INET6 ||
5007 sin6->sin6_family != AF_INET6) {
5008 return (EAFNOSUPPORT);
5009 }
5010 v6src = sin6->sin6_addr;
5011 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
5012 if (connp->conn_ipv6_v6only)
5013 return (EADDRNOTAVAIL);
5014
5015 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
5016 if (v4src != INADDR_ANY) {
5017 laddr_type = ip_laddr_verify_v4(v4src,
5018 zoneid, ipst, B_FALSE);
5019 }
5020 } else {
5021 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5022 if (IN6_IS_ADDR_LINKSCOPE(&v6src))
5023 scopeid = sin6->sin6_scope_id;
5024 laddr_type = ip_laddr_verify_v6(&v6src,
5025 zoneid, ipst, B_TRUE, scopeid);
5026 }
5027 }
5028 port = ntohs(sin6->sin6_port);
5029 break;
5030
5031 default: /* Invalid request */
5032 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5033 "udp_bind: bad ADDR_length length %u", len);
5034 return (-TBADADDR);
5035 }
5036
5037 /* Is the local address a valid unicast, multicast, or broadcast? */
5038 if (laddr_type == IPVL_BAD)
5039 return (EADDRNOTAVAIL);
5040
5041 requested_port = port;
5042
5043 if (requested_port == 0 || !bind_to_req_port_only)
5044 bind_to_req_port_only = B_FALSE;
5045 else /* T_BIND_REQ and requested_port != 0 */
5046 bind_to_req_port_only = B_TRUE;
5047
5048 if (requested_port == 0) {
5049 /*
5050 * If the application passed in zero for the port number, it
5051 * doesn't care which port number we bind to. Get one in the
5052 * valid range.
5053 */
5054 if (connp->conn_anon_priv_bind) {
5055 port = udp_get_next_priv_port(udp);
5056 } else {
5057 port = udp_update_next_port(udp,
5058 us->us_next_port_to_try, B_TRUE);
5059 }
5060 } else {
5061 /*
5062 * If the port is in the well-known privileged range,
5063 * make sure the caller was privileged.
5064 */
5065 int i;
5066 boolean_t priv = B_FALSE;
5067
5068 if (port < us->us_smallest_nonpriv_port) {
5069 priv = B_TRUE;
5070 } else {
5071 for (i = 0; i < us->us_num_epriv_ports; i++) {
5072 if (port == us->us_epriv_ports[i]) {
5073 priv = B_TRUE;
5074 break;
5075 }
5076 }
5077 }
5078
5079 if (priv) {
5080 if (secpolicy_net_privaddr(cr, port, IPPROTO_UDP) != 0)
5081 return (-TACCES);
5082 }
5083 }
5084
5085 if (port == 0)
5086 return (-TNOADDR);
5087
5088 /*
5089 * The state must be TS_UNBND. TPI mandates that users must send
5090 * TPI primitives only 1 at a time and wait for the response before
5091 * sending the next primitive.
5092 */
5093 mutex_enter(&connp->conn_lock);
5094 if (udp->udp_state != TS_UNBND) {
5095 mutex_exit(&connp->conn_lock);
5096 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5097 "udp_bind: bad state, %u", udp->udp_state);
5098 return (-TOUTSTATE);
5099 }
5100 /*
5101 * Copy the source address into our udp structure. This address
5102 * may still be zero; if so, IP will fill in the correct address
5103 * each time an outbound packet is passed to it. Since the udp is
5104 * not yet in the bind hash list, we don't grab the uf_lock to
5105 * change conn_ipversion
5106 */
5107 if (connp->conn_family == AF_INET) {
5108 ASSERT(sin != NULL);
5109 ASSERT(connp->conn_ixa->ixa_flags & IXAF_IS_IPV4);
5110 } else {
5111 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
5112 /*
5113 * no need to hold the uf_lock to set the conn_ipversion
5114 * since we are not yet in the fanout list
5115 */
5116 connp->conn_ipversion = IPV4_VERSION;
5117 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
5118 } else {
5119 connp->conn_ipversion = IPV6_VERSION;
5120 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
5121 }
5122 }
5123
5124 /*
5125 * If conn_reuseaddr is not set, then we have to make sure that
5126 * the IP address and port number the application requested
5127 * (or we selected for the application) is not being used by
5128 * another stream. If another stream is already using the
5129 * requested IP address and port, the behavior depends on
5130 * "bind_to_req_port_only". If set the bind fails; otherwise we
5131 * search for any an unused port to bind to the stream.
5132 *
5133 * As per the BSD semantics, as modified by the Deering multicast
5134 * changes, if udp_reuseaddr is set, then we allow multiple binds
5135 * to the same port independent of the local IP address.
5136 *
5137 * This is slightly different than in SunOS 4.X which did not
5138 * support IP multicast. Note that the change implemented by the
5139 * Deering multicast code effects all binds - not only binding
5140 * to IP multicast addresses.
5141 *
5142 * Note that when binding to port zero we ignore SO_REUSEADDR in
5143 * order to guarantee a unique port.
5144 */
5145
5146 count = 0;
5147 if (connp->conn_anon_priv_bind) {
5148 /*
5149 * loopmax = (IPPORT_RESERVED-1) -
5150 * us->us_min_anonpriv_port + 1
5151 */
5152 loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
5153 } else {
5154 loopmax = us->us_largest_anon_port -
5155 us->us_smallest_anon_port + 1;
5156 }
5157
5158 is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
5159
5160 for (;;) {
5161 udp_t *udp1;
5162 boolean_t found_exclbind = B_FALSE;
5163 conn_t *connp1;
5164
5165 /*
5166 * Walk through the list of udp streams bound to
5167 * requested port with the same IP address.
5168 */
5169 lport = htons(port);
5170 udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
5171 us->us_bind_fanout_size)];
5172 mutex_enter(&udpf->uf_lock);
5173 for (udp1 = udpf->uf_udp; udp1 != NULL;
5174 udp1 = udp1->udp_bind_hash) {
5175 connp1 = udp1->udp_connp;
5176
5177 if (lport != connp1->conn_lport)
5178 continue;
5179
5180 /*
5181 * On a labeled system, we must treat bindings to ports
5182 * on shared IP addresses by sockets with MAC exemption
5183 * privilege as being in all zones, as there's
5184 * otherwise no way to identify the right receiver.
5185 */
5186 if (!IPCL_BIND_ZONE_MATCH(connp1, connp))
5187 continue;
5188
5189 /*
5190 * If UDP_EXCLBIND is set for either the bound or
5191 * binding endpoint, the semantics of bind
5192 * is changed according to the following chart.
5193 *
5194 * spec = specified address (v4 or v6)
5195 * unspec = unspecified address (v4 or v6)
5196 * A = specified addresses are different for endpoints
5197 *
5198 * bound bind to allowed?
5199 * -------------------------------------
5200 * unspec unspec no
5201 * unspec spec no
5202 * spec unspec no
5203 * spec spec yes if A
5204 *
5205 * For labeled systems, SO_MAC_EXEMPT behaves the same
5206 * as UDP_EXCLBIND, except that zoneid is ignored.
5207 */
5208 if (connp1->conn_exclbind || connp->conn_exclbind ||
5209 IPCL_CONNS_MAC(udp1->udp_connp, connp)) {
5210 if (V6_OR_V4_INADDR_ANY(
5211 connp1->conn_bound_addr_v6) ||
5212 is_inaddr_any ||
5213 IN6_ARE_ADDR_EQUAL(
5214 &connp1->conn_bound_addr_v6,
5215 &v6src)) {
5216 found_exclbind = B_TRUE;
5217 break;
5218 }
5219 continue;
5220 }
5221
5222 /*
5223 * Check ipversion to allow IPv4 and IPv6 sockets to
5224 * have disjoint port number spaces.
5225 */
5226 if (connp->conn_ipversion != connp1->conn_ipversion) {
5227
5228 /*
5229 * On the first time through the loop, if the
5230 * the user intentionally specified a
5231 * particular port number, then ignore any
5232 * bindings of the other protocol that may
5233 * conflict. This allows the user to bind IPv6
5234 * alone and get both v4 and v6, or bind both
5235 * both and get each seperately. On subsequent
5236 * times through the loop, we're checking a
5237 * port that we chose (not the user) and thus
5238 * we do not allow casual duplicate bindings.
5239 */
5240 if (count == 0 && requested_port != 0)
5241 continue;
5242 }
5243
5244 /*
5245 * No difference depending on SO_REUSEADDR.
5246 *
5247 * If existing port is bound to a
5248 * non-wildcard IP address and
5249 * the requesting stream is bound to
5250 * a distinct different IP addresses
5251 * (non-wildcard, also), keep going.
5252 */
5253 if (!is_inaddr_any &&
5254 !V6_OR_V4_INADDR_ANY(connp1->conn_bound_addr_v6) &&
5255 !IN6_ARE_ADDR_EQUAL(&connp1->conn_laddr_v6,
5256 &v6src)) {
5257 continue;
5258 }
5259 break;
5260 }
5261
5262 if (!found_exclbind &&
5263 (connp->conn_reuseaddr && requested_port != 0)) {
5264 break;
5265 }
5266
5267 if (udp1 == NULL) {
5268 /*
5269 * No other stream has this IP address
5270 * and port number. We can use it.
5271 */
5272 break;
5273 }
5274 mutex_exit(&udpf->uf_lock);
5275 if (bind_to_req_port_only) {
5276 /*
5277 * We get here only when requested port
5278 * is bound (and only first of the for()
5279 * loop iteration).
5280 *
5281 * The semantics of this bind request
5282 * require it to fail so we return from
5283 * the routine (and exit the loop).
5284 *
5285 */
5286 mutex_exit(&connp->conn_lock);
5287 return (-TADDRBUSY);
5288 }
5289
5290 if (connp->conn_anon_priv_bind) {
5291 port = udp_get_next_priv_port(udp);
5292 } else {
5293 if ((count == 0) && (requested_port != 0)) {
5294 /*
5295 * If the application wants us to find
5296 * a port, get one to start with. Set
5297 * requested_port to 0, so that we will
5298 * update us->us_next_port_to_try below.
5299 */
5300 port = udp_update_next_port(udp,
5301 us->us_next_port_to_try, B_TRUE);
5302 requested_port = 0;
5303 } else {
5304 port = udp_update_next_port(udp, port + 1,
5305 B_FALSE);
5306 }
5307 }
5308
5309 if (port == 0 || ++count >= loopmax) {
5310 /*
5311 * We've tried every possible port number and
5312 * there are none available, so send an error
5313 * to the user.
5314 */
5315 mutex_exit(&connp->conn_lock);
5316 return (-TNOADDR);
5317 }
5318 }
5319
5320 /*
5321 * Copy the source address into our udp structure. This address
5322 * may still be zero; if so, ip_attr_connect will fill in the correct
5323 * address when a packet is about to be sent.
5324 * If we are binding to a broadcast or multicast address then
5325 * we just set the conn_bound_addr since we don't want to use
5326 * that as the source address when sending.
5327 */
5328 connp->conn_bound_addr_v6 = v6src;
5329 connp->conn_laddr_v6 = v6src;
5330 if (scopeid != 0) {
5331 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
5332 connp->conn_ixa->ixa_scopeid = scopeid;
5333 connp->conn_incoming_ifindex = scopeid;
5334 } else {
5335 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5336 connp->conn_incoming_ifindex = connp->conn_bound_if;
5337 }
5338
5339 switch (laddr_type) {
5340 case IPVL_UNICAST_UP:
5341 case IPVL_UNICAST_DOWN:
5342 connp->conn_saddr_v6 = v6src;
5343 connp->conn_mcbc_bind = B_FALSE;
5344 break;
5345 case IPVL_MCAST:
5346 case IPVL_BCAST:
5347 /* ip_set_destination will pick a source address later */
5348 connp->conn_saddr_v6 = ipv6_all_zeros;
5349 connp->conn_mcbc_bind = B_TRUE;
5350 break;
5351 }
5352
5353 /* Any errors after this point should use late_error */
5354 connp->conn_lport = lport;
5355
5356 /*
5357 * Now reset the next anonymous port if the application requested
5358 * an anonymous port, or we handed out the next anonymous port.
5359 */
5360 if ((requested_port == 0) && (!connp->conn_anon_priv_bind)) {
5361 us->us_next_port_to_try = port + 1;
5362 }
5363
5364 /* Initialize the T_BIND_ACK. */
5365 if (connp->conn_family == AF_INET) {
5366 sin->sin_port = connp->conn_lport;
5367 } else {
5368 sin6->sin6_port = connp->conn_lport;
5369 }
5370 udp->udp_state = TS_IDLE;
5371 udp_bind_hash_insert(udpf, udp);
5372 mutex_exit(&udpf->uf_lock);
5373 mutex_exit(&connp->conn_lock);
5374
5375 if (cl_inet_bind) {
5376 /*
5377 * Running in cluster mode - register bind information
5378 */
5379 if (connp->conn_ipversion == IPV4_VERSION) {
5380 (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5381 IPPROTO_UDP, AF_INET, (uint8_t *)&v4src,
5382 (in_port_t)connp->conn_lport, NULL);
5383 } else {
5384 (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5385 IPPROTO_UDP, AF_INET6, (uint8_t *)&v6src,
5386 (in_port_t)connp->conn_lport, NULL);
5387 }
5388 }
5389
5390 mutex_enter(&connp->conn_lock);
5391 connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
5392 if (is_system_labeled() && (!connp->conn_anon_port ||
5393 connp->conn_anon_mlp)) {
5394 uint16_t mlpport;
5395 zone_t *zone;
5396
5397 zone = crgetzone(cr);
5398 connp->conn_mlp_type =
5399 connp->conn_recv_ancillary.crb_recvucred ? mlptBoth :
5400 mlptSingle;
5401 addrtype = tsol_mlp_addr_type(
5402 connp->conn_allzones ? ALL_ZONES : zone->zone_id,
5403 IPV6_VERSION, &v6src, us->us_netstack->netstack_ip);
5404 if (addrtype == mlptSingle) {
5405 error = -TNOADDR;
5406 mutex_exit(&connp->conn_lock);
5407 goto late_error;
5408 }
5409 mlpport = connp->conn_anon_port ? PMAPPORT : port;
5410 mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
5411 addrtype);
5412
5413 /*
5414 * It is a coding error to attempt to bind an MLP port
5415 * without first setting SOL_SOCKET/SCM_UCRED.
5416 */
5417 if (mlptype != mlptSingle &&
5418 connp->conn_mlp_type == mlptSingle) {
5419 error = EINVAL;
5420 mutex_exit(&connp->conn_lock);
5421 goto late_error;
5422 }
5423
5424 /*
5425 * It is an access violation to attempt to bind an MLP port
5426 * without NET_BINDMLP privilege.
5427 */
5428 if (mlptype != mlptSingle &&
5429 secpolicy_net_bindmlp(cr) != 0) {
5430 if (connp->conn_debug) {
5431 (void) strlog(UDP_MOD_ID, 0, 1,
5432 SL_ERROR|SL_TRACE,
5433 "udp_bind: no priv for multilevel port %d",
5434 mlpport);
5435 }
5436 error = -TACCES;
5437 mutex_exit(&connp->conn_lock);
5438 goto late_error;
5439 }
5440
5441 /*
5442 * If we're specifically binding a shared IP address and the
5443 * port is MLP on shared addresses, then check to see if this
5444 * zone actually owns the MLP. Reject if not.
5445 */
5446 if (mlptype == mlptShared && addrtype == mlptShared) {
5447 /*
5448 * No need to handle exclusive-stack zones since
5449 * ALL_ZONES only applies to the shared stack.
5450 */
5451 zoneid_t mlpzone;
5452
5453 mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
5454 htons(mlpport));
5455 if (connp->conn_zoneid != mlpzone) {
5456 if (connp->conn_debug) {
5457 (void) strlog(UDP_MOD_ID, 0, 1,
5458 SL_ERROR|SL_TRACE,
5459 "udp_bind: attempt to bind port "
5460 "%d on shared addr in zone %d "
5461 "(should be %d)",
5462 mlpport, connp->conn_zoneid,
5463 mlpzone);
5464 }
5465 error = -TACCES;
5466 mutex_exit(&connp->conn_lock);
5467 goto late_error;
5468 }
5469 }
5470 if (connp->conn_anon_port) {
5471 error = tsol_mlp_anon(zone, mlptype, connp->conn_proto,
5472 port, B_TRUE);
5473 if (error != 0) {
5474 if (connp->conn_debug) {
5475 (void) strlog(UDP_MOD_ID, 0, 1,
5476 SL_ERROR|SL_TRACE,
5477 "udp_bind: cannot establish anon "
5478 "MLP for port %d", port);
5479 }
5480 error = -TACCES;
5481 mutex_exit(&connp->conn_lock);
5482 goto late_error;
5483 }
5484 }
5485 connp->conn_mlp_type = mlptype;
5486 }
5487
5488 /*
5489 * We create an initial header template here to make a subsequent
5490 * sendto have a starting point. Since conn_last_dst is zero the
5491 * first sendto will always follow the 'dst changed' code path.
5492 * Note that we defer massaging options and the related checksum
5493 * adjustment until we have a destination address.
5494 */
5495 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5496 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5497 if (error != 0) {
5498 mutex_exit(&connp->conn_lock);
5499 goto late_error;
5500 }
5501 /* Just in case */
5502 connp->conn_faddr_v6 = ipv6_all_zeros;
5503 connp->conn_fport = 0;
5504 connp->conn_v6lastdst = ipv6_all_zeros;
5505 mutex_exit(&connp->conn_lock);
5506
5507 error = ip_laddr_fanout_insert(connp);
5508 if (error != 0)
5509 goto late_error;
5510
5511 /* Bind succeeded */
5512 return (0);
5513
5514 late_error:
5515 /* We had already picked the port number, and then the bind failed */
5516 mutex_enter(&connp->conn_lock);
5517 udpf = &us->us_bind_fanout[
5518 UDP_BIND_HASH(connp->conn_lport,
5519 us->us_bind_fanout_size)];
5520 mutex_enter(&udpf->uf_lock);
5521 connp->conn_saddr_v6 = ipv6_all_zeros;
5522 connp->conn_bound_addr_v6 = ipv6_all_zeros;
5523 connp->conn_laddr_v6 = ipv6_all_zeros;
5524 if (scopeid != 0) {
5525 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5526 connp->conn_incoming_ifindex = connp->conn_bound_if;
5527 }
5528 udp->udp_state = TS_UNBND;
5529 udp_bind_hash_remove(udp, B_TRUE);
5530 connp->conn_lport = 0;
5531 mutex_exit(&udpf->uf_lock);
5532 connp->conn_anon_port = B_FALSE;
5533 connp->conn_mlp_type = mlptSingle;
5534
5535 connp->conn_v6lastdst = ipv6_all_zeros;
5536
5537 /* Restore the header that was built above - different source address */
5538 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5539 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5540 mutex_exit(&connp->conn_lock);
5541 return (error);
5542 }
5543
5544 int
5545 udp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5546 socklen_t len, cred_t *cr)
5547 {
5548 int error;
5549 conn_t *connp;
5550
5551 /* All Solaris components should pass a cred for this operation. */
5552 ASSERT(cr != NULL);
5553
5554 connp = (conn_t *)proto_handle;
5555
5556 if (sa == NULL)
5557 error = udp_do_unbind(connp);
5558 else
5559 error = udp_do_bind(connp, sa, len, cr, B_TRUE);
5560
5561 if (error < 0) {
5562 if (error == -TOUTSTATE)
5563 error = EINVAL;
5564 else
5565 error = proto_tlitosyserr(-error);
5566 }
5567
5568 return (error);
5569 }
5570
5571 static int
5572 udp_implicit_bind(conn_t *connp, cred_t *cr)
5573 {
5574 sin6_t sin6addr;
5575 sin_t *sin;
5576 sin6_t *sin6;
5577 socklen_t len;
5578 int error;
5579
5580 /* All Solaris components should pass a cred for this operation. */
5581 ASSERT(cr != NULL);
5582
5583 if (connp->conn_family == AF_INET) {
5584 len = sizeof (struct sockaddr_in);
5585 sin = (sin_t *)&sin6addr;
5586 *sin = sin_null;
5587 sin->sin_family = AF_INET;
5588 sin->sin_addr.s_addr = INADDR_ANY;
5589 } else {
5590 ASSERT(connp->conn_family == AF_INET6);
5591 len = sizeof (sin6_t);
5592 sin6 = (sin6_t *)&sin6addr;
5593 *sin6 = sin6_null;
5594 sin6->sin6_family = AF_INET6;
5595 V6_SET_ZERO(sin6->sin6_addr);
5596 }
5597
5598 error = udp_do_bind(connp, (struct sockaddr *)&sin6addr, len,
5599 cr, B_FALSE);
5600 return ((error < 0) ? proto_tlitosyserr(-error) : error);
5601 }
5602
5603 /*
5604 * This routine removes a port number association from a stream. It
5605 * is called by udp_unbind and udp_tpi_unbind.
5606 */
5607 static int
5608 udp_do_unbind(conn_t *connp)
5609 {
5610 udp_t *udp = connp->conn_udp;
5611 udp_fanout_t *udpf;
5612 udp_stack_t *us = udp->udp_us;
5613
5614 if (cl_inet_unbind != NULL) {
5615 /*
5616 * Running in cluster mode - register unbind information
5617 */
5618 if (connp->conn_ipversion == IPV4_VERSION) {
5619 (*cl_inet_unbind)(
5620 connp->conn_netstack->netstack_stackid,
5621 IPPROTO_UDP, AF_INET,
5622 (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
5623 (in_port_t)connp->conn_lport, NULL);
5624 } else {
5625 (*cl_inet_unbind)(
5626 connp->conn_netstack->netstack_stackid,
5627 IPPROTO_UDP, AF_INET6,
5628 (uint8_t *)&(connp->conn_laddr_v6),
5629 (in_port_t)connp->conn_lport, NULL);
5630 }
5631 }
5632
5633 mutex_enter(&connp->conn_lock);
5634 /* If a bind has not been done, we can't unbind. */
5635 if (udp->udp_state == TS_UNBND) {
5636 mutex_exit(&connp->conn_lock);
5637 return (-TOUTSTATE);
5638 }
5639 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5640 us->us_bind_fanout_size)];
5641 mutex_enter(&udpf->uf_lock);
5642 udp_bind_hash_remove(udp, B_TRUE);
5643 connp->conn_saddr_v6 = ipv6_all_zeros;
5644 connp->conn_bound_addr_v6 = ipv6_all_zeros;
5645 connp->conn_laddr_v6 = ipv6_all_zeros;
5646 connp->conn_mcbc_bind = B_FALSE;
5647 connp->conn_lport = 0;
5648 /* In case we were also connected */
5649 connp->conn_faddr_v6 = ipv6_all_zeros;
5650 connp->conn_fport = 0;
5651 mutex_exit(&udpf->uf_lock);
5652
5653 connp->conn_v6lastdst = ipv6_all_zeros;
5654 udp->udp_state = TS_UNBND;
5655
5656 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5657 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5658 mutex_exit(&connp->conn_lock);
5659
5660 ip_unbind(connp);
5661
5662 return (0);
5663 }
5664
5665 /*
5666 * It associates a default destination address with the stream.
5667 */
5668 static int
5669 udp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
5670 cred_t *cr, pid_t pid)
5671 {
5672 sin6_t *sin6;
5673 sin_t *sin;
5674 in6_addr_t v6dst;
5675 ipaddr_t v4dst;
5676 uint16_t dstport;
5677 uint32_t flowinfo;
5678 udp_fanout_t *udpf;
5679 udp_t *udp, *udp1;
5680 ushort_t ipversion;
5681 udp_stack_t *us;
5682 int error;
5683 conn_t *connp1;
5684 ip_xmit_attr_t *ixa;
5685 ip_xmit_attr_t *oldixa;
5686 uint_t scopeid = 0;
5687 uint_t srcid = 0;
5688 in6_addr_t v6src = connp->conn_saddr_v6;
5689 boolean_t v4mapped;
5690
5691 udp = connp->conn_udp;
5692 us = udp->udp_us;
5693
5694 /*
5695 * Address has been verified by the caller
5696 */
5697 switch (len) {
5698 default:
5699 /*
5700 * Should never happen
5701 */
5702 return (EINVAL);
5703
5704 case sizeof (sin_t):
5705 sin = (sin_t *)sa;
5706 v4dst = sin->sin_addr.s_addr;
5707 dstport = sin->sin_port;
5708 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5709 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5710 ipversion = IPV4_VERSION;
5711 break;
5712
5713 case sizeof (sin6_t):
5714 sin6 = (sin6_t *)sa;
5715 v6dst = sin6->sin6_addr;
5716 dstport = sin6->sin6_port;
5717 srcid = sin6->__sin6_src_id;
5718 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
5719 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5720 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
5721 v4mapped, connp->conn_netstack)) {
5722 /* Mismatch v4mapped/v6 specified by srcid. */
5723 return (EADDRNOTAVAIL);
5724 }
5725 }
5726 if (v4mapped) {
5727 if (connp->conn_ipv6_v6only)
5728 return (EADDRNOTAVAIL);
5729
5730 /*
5731 * Destination adress is mapped IPv6 address.
5732 * Source bound address should be unspecified or
5733 * IPv6 mapped address as well.
5734 */
5735 if (!IN6_IS_ADDR_UNSPECIFIED(
5736 &connp->conn_bound_addr_v6) &&
5737 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
5738 return (EADDRNOTAVAIL);
5739 }
5740 IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
5741 ipversion = IPV4_VERSION;
5742 flowinfo = 0;
5743 } else {
5744 ipversion = IPV6_VERSION;
5745 flowinfo = sin6->sin6_flowinfo;
5746 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
5747 scopeid = sin6->sin6_scope_id;
5748 }
5749 break;
5750 }
5751
5752 if (dstport == 0)
5753 return (-TBADADDR);
5754
5755 /*
5756 * If there is a different thread using conn_ixa then we get a new
5757 * copy and cut the old one loose from conn_ixa. Otherwise we use
5758 * conn_ixa and prevent any other thread from using/changing it.
5759 * Once connect() is done other threads can use conn_ixa since the
5760 * refcnt will be back at one.
5761 * We defer updating conn_ixa until later to handle any concurrent
5762 * conn_ixa_cleanup thread.
5763 */
5764 ixa = conn_get_ixa(connp, B_FALSE);
5765 if (ixa == NULL)
5766 return (ENOMEM);
5767
5768 mutex_enter(&connp->conn_lock);
5769 /*
5770 * This udp_t must have bound to a port already before doing a connect.
5771 * Reject if a connect is in progress (we drop conn_lock during
5772 * udp_do_connect).
5773 */
5774 if (udp->udp_state == TS_UNBND || udp->udp_state == TS_WCON_CREQ) {
5775 mutex_exit(&connp->conn_lock);
5776 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5777 "udp_connect: bad state, %u", udp->udp_state);
5778 ixa_refrele(ixa);
5779 return (-TOUTSTATE);
5780 }
5781 ASSERT(connp->conn_lport != 0 && udp->udp_ptpbhn != NULL);
5782
5783 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5784 us->us_bind_fanout_size)];
5785
5786 mutex_enter(&udpf->uf_lock);
5787 if (udp->udp_state == TS_DATA_XFER) {
5788 /* Already connected - clear out state */
5789 if (connp->conn_mcbc_bind)
5790 connp->conn_saddr_v6 = ipv6_all_zeros;
5791 else
5792 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5793 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5794 connp->conn_faddr_v6 = ipv6_all_zeros;
5795 connp->conn_fport = 0;
5796 udp->udp_state = TS_IDLE;
5797 }
5798
5799 connp->conn_fport = dstport;
5800 connp->conn_ipversion = ipversion;
5801 if (ipversion == IPV4_VERSION) {
5802 /*
5803 * Interpret a zero destination to mean loopback.
5804 * Update the T_CONN_REQ (sin/sin6) since it is used to
5805 * generate the T_CONN_CON.
5806 */
5807 if (v4dst == INADDR_ANY) {
5808 v4dst = htonl(INADDR_LOOPBACK);
5809 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5810 if (connp->conn_family == AF_INET) {
5811 sin->sin_addr.s_addr = v4dst;
5812 } else {
5813 sin6->sin6_addr = v6dst;
5814 }
5815 }
5816 connp->conn_faddr_v6 = v6dst;
5817 connp->conn_flowinfo = 0;
5818 } else {
5819 ASSERT(connp->conn_ipversion == IPV6_VERSION);
5820 /*
5821 * Interpret a zero destination to mean loopback.
5822 * Update the T_CONN_REQ (sin/sin6) since it is used to
5823 * generate the T_CONN_CON.
5824 */
5825 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
5826 v6dst = ipv6_loopback;
5827 sin6->sin6_addr = v6dst;
5828 }
5829 connp->conn_faddr_v6 = v6dst;
5830 connp->conn_flowinfo = flowinfo;
5831 }
5832 mutex_exit(&udpf->uf_lock);
5833
5834 /*
5835 * We update our cred/cpid based on the caller of connect
5836 */
5837 if (connp->conn_cred != cr) {
5838 crhold(cr);
5839 crfree(connp->conn_cred);
5840 connp->conn_cred = cr;
5841 }
5842 connp->conn_cpid = pid;
5843 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
5844 ixa->ixa_cred = cr;
5845 ixa->ixa_cpid = pid;
5846 if (is_system_labeled()) {
5847 /* We need to restart with a label based on the cred */
5848 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
5849 }
5850
5851 if (scopeid != 0) {
5852 ixa->ixa_flags |= IXAF_SCOPEID_SET;
5853 ixa->ixa_scopeid = scopeid;
5854 connp->conn_incoming_ifindex = scopeid;
5855 } else {
5856 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5857 connp->conn_incoming_ifindex = connp->conn_bound_if;
5858 }
5859 /*
5860 * conn_connect will drop conn_lock and reacquire it.
5861 * To prevent a send* from messing with this udp_t while the lock
5862 * is dropped we set udp_state and clear conn_v6lastdst.
5863 * That will make all send* fail with EISCONN.
5864 */
5865 connp->conn_v6lastdst = ipv6_all_zeros;
5866 udp->udp_state = TS_WCON_CREQ;
5867
5868 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
5869 mutex_exit(&connp->conn_lock);
5870 if (error != 0)
5871 goto connect_failed;
5872
5873 /*
5874 * The addresses have been verified. Time to insert in
5875 * the correct fanout list.
5876 */
5877 error = ipcl_conn_insert(connp);
5878 if (error != 0)
5879 goto connect_failed;
5880
5881 mutex_enter(&connp->conn_lock);
5882 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5883 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5884 if (error != 0) {
5885 mutex_exit(&connp->conn_lock);
5886 goto connect_failed;
5887 }
5888
5889 udp->udp_state = TS_DATA_XFER;
5890 /* Record this as the "last" send even though we haven't sent any */
5891 connp->conn_v6lastdst = connp->conn_faddr_v6;
5892 connp->conn_lastipversion = connp->conn_ipversion;
5893 connp->conn_lastdstport = connp->conn_fport;
5894 connp->conn_lastflowinfo = connp->conn_flowinfo;
5895 connp->conn_lastscopeid = scopeid;
5896 connp->conn_lastsrcid = srcid;
5897 /* Also remember a source to use together with lastdst */
5898 connp->conn_v6lastsrc = v6src;
5899
5900 oldixa = conn_replace_ixa(connp, ixa);
5901 mutex_exit(&connp->conn_lock);
5902 ixa_refrele(oldixa);
5903
5904 /*
5905 * We've picked a source address above. Now we can
5906 * verify that the src/port/dst/port is unique for all
5907 * connections in TS_DATA_XFER, skipping ourselves.
5908 */
5909 mutex_enter(&udpf->uf_lock);
5910 for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
5911 if (udp1->udp_state != TS_DATA_XFER)
5912 continue;
5913
5914 if (udp1 == udp)
5915 continue;
5916
5917 connp1 = udp1->udp_connp;
5918 if (connp->conn_lport != connp1->conn_lport ||
5919 connp->conn_ipversion != connp1->conn_ipversion ||
5920 dstport != connp1->conn_fport ||
5921 !IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6,
5922 &connp1->conn_laddr_v6) ||
5923 !IN6_ARE_ADDR_EQUAL(&v6dst, &connp1->conn_faddr_v6) ||
5924 !(IPCL_ZONE_MATCH(connp, connp1->conn_zoneid) ||
5925 IPCL_ZONE_MATCH(connp1, connp->conn_zoneid)))
5926 continue;
5927 mutex_exit(&udpf->uf_lock);
5928 error = -TBADADDR;
5929 goto connect_failed;
5930 }
5931 if (cl_inet_connect2 != NULL) {
5932 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
5933 if (error != 0) {
5934 mutex_exit(&udpf->uf_lock);
5935 error = -TBADADDR;
5936 goto connect_failed;
5937 }
5938 }
5939 mutex_exit(&udpf->uf_lock);
5940
5941 ixa_refrele(ixa);
5942 return (0);
5943
5944 connect_failed:
5945 if (ixa != NULL)
5946 ixa_refrele(ixa);
5947 mutex_enter(&connp->conn_lock);
5948 mutex_enter(&udpf->uf_lock);
5949 udp->udp_state = TS_IDLE;
5950 connp->conn_faddr_v6 = ipv6_all_zeros;
5951 connp->conn_fport = 0;
5952 /* In case the source address was set above */
5953 if (connp->conn_mcbc_bind)
5954 connp->conn_saddr_v6 = ipv6_all_zeros;
5955 else
5956 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5957 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5958 mutex_exit(&udpf->uf_lock);
5959
5960 connp->conn_v6lastdst = ipv6_all_zeros;
5961 connp->conn_flowinfo = 0;
5962
5963 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5964 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5965 mutex_exit(&connp->conn_lock);
5966 return (error);
5967 }
5968
5969 static int
5970 udp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5971 socklen_t len, sock_connid_t *id, cred_t *cr)
5972 {
5973 conn_t *connp = (conn_t *)proto_handle;
5974 udp_t *udp = connp->conn_udp;
5975 int error;
5976 boolean_t did_bind = B_FALSE;
5977 pid_t pid = curproc->p_pid;
5978
5979 /* All Solaris components should pass a cred for this operation. */
5980 ASSERT(cr != NULL);
5981
5982 if (sa == NULL) {
5983 /*
5984 * Disconnect
5985 * Make sure we are connected
5986 */
5987 if (udp->udp_state != TS_DATA_XFER)
5988 return (EINVAL);
5989
5990 error = udp_disconnect(connp);
5991 return (error);
5992 }
5993
5994 error = proto_verify_ip_addr(connp->conn_family, sa, len);
5995 if (error != 0)
5996 goto done;
5997
5998 /* do an implicit bind if necessary */
5999 if (udp->udp_state == TS_UNBND) {
6000 error = udp_implicit_bind(connp, cr);
6001 /*
6002 * We could be racing with an actual bind, in which case
6003 * we would see EPROTO. We cross our fingers and try
6004 * to connect.
6005 */
6006 if (!(error == 0 || error == EPROTO))
6007 goto done;
6008 did_bind = B_TRUE;
6009 }
6010 /*
6011 * set SO_DGRAM_ERRIND
6012 */
6013 connp->conn_dgram_errind = B_TRUE;
6014
6015 error = udp_do_connect(connp, sa, len, cr, pid);
6016
6017 if (error != 0 && did_bind) {
6018 int unbind_err;
6019
6020 unbind_err = udp_do_unbind(connp);
6021 ASSERT(unbind_err == 0);
6022 }
6023
6024 if (error == 0) {
6025 *id = 0;
6026 (*connp->conn_upcalls->su_connected)
6027 (connp->conn_upper_handle, 0, NULL, -1);
6028 } else if (error < 0) {
6029 error = proto_tlitosyserr(-error);
6030 }
6031
6032 done:
6033 if (error != 0 && udp->udp_state == TS_DATA_XFER) {
6034 /*
6035 * No need to hold locks to set state
6036 * after connect failure socket state is undefined
6037 * We set the state only to imitate old sockfs behavior
6038 */
6039 udp->udp_state = TS_IDLE;
6040 }
6041 return (error);
6042 }
6043
6044 int
6045 udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
6046 cred_t *cr)
6047 {
6048 sin6_t *sin6;
6049 sin_t *sin = NULL;
6050 uint_t srcid;
6051 conn_t *connp = (conn_t *)proto_handle;
6052 udp_t *udp = connp->conn_udp;
6053 int error = 0;
6054 udp_stack_t *us = udp->udp_us;
6055 ushort_t ipversion;
6056 pid_t pid = curproc->p_pid;
6057 ip_xmit_attr_t *ixa;
6058
6059 ASSERT(DB_TYPE(mp) == M_DATA);
6060
6061 /* All Solaris components should pass a cred for this operation. */
6062 ASSERT(cr != NULL);
6063
6064 /* do an implicit bind if necessary */
6065 if (udp->udp_state == TS_UNBND) {
6066 error = udp_implicit_bind(connp, cr);
6067 /*
6068 * We could be racing with an actual bind, in which case
6069 * we would see EPROTO. We cross our fingers and try
6070 * to connect.
6071 */
6072 if (!(error == 0 || error == EPROTO)) {
6073 freemsg(mp);
6074 return (error);
6075 }
6076 }
6077
6078 /* Connected? */
6079 if (msg->msg_name == NULL) {
6080 if (udp->udp_state != TS_DATA_XFER) {
6081 UDPS_BUMP_MIB(us, udpOutErrors);
6082 return (EDESTADDRREQ);
6083 }
6084 if (msg->msg_controllen != 0) {
6085 error = udp_output_ancillary(connp, NULL, NULL, mp,
6086 NULL, msg, cr, pid);
6087 } else {
6088 error = udp_output_connected(connp, mp, cr, pid);
6089 }
6090 if (us->us_sendto_ignerr)
6091 return (0);
6092 else
6093 return (error);
6094 }
6095
6096 /*
6097 * Check if we're allowed to send to a connection on which we've
6098 * already called 'connect'. The posix spec. allows both behaviors but
6099 * historically we've returned an error if already connected. The
6100 * client can allow this via a sockopt.
6101 */
6102 if (udp->udp_state == TS_DATA_XFER && !udp->udp_snd_to_conn) {
6103 UDPS_BUMP_MIB(us, udpOutErrors);
6104 return (EISCONN);
6105 }
6106
6107 error = proto_verify_ip_addr(connp->conn_family,
6108 (struct sockaddr *)msg->msg_name, msg->msg_namelen);
6109 if (error != 0) {
6110 UDPS_BUMP_MIB(us, udpOutErrors);
6111 return (error);
6112 }
6113 switch (connp->conn_family) {
6114 case AF_INET6:
6115 sin6 = (sin6_t *)msg->msg_name;
6116
6117 srcid = sin6->__sin6_src_id;
6118
6119 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6120 /*
6121 * Destination is a non-IPv4-compatible IPv6 address.
6122 * Send out an IPv6 format packet.
6123 */
6124
6125 /*
6126 * If the local address is a mapped address return
6127 * an error.
6128 * It would be possible to send an IPv6 packet but the
6129 * response would never make it back to the application
6130 * since it is bound to a mapped address.
6131 */
6132 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
6133 UDPS_BUMP_MIB(us, udpOutErrors);
6134 return (EADDRNOTAVAIL);
6135 }
6136 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
6137 sin6->sin6_addr = ipv6_loopback;
6138 ipversion = IPV6_VERSION;
6139 } else {
6140 if (connp->conn_ipv6_v6only) {
6141 UDPS_BUMP_MIB(us, udpOutErrors);
6142 return (EADDRNOTAVAIL);
6143 }
6144
6145 /*
6146 * If the local address is not zero or a mapped address
6147 * return an error. It would be possible to send an
6148 * IPv4 packet but the response would never make it
6149 * back to the application since it is bound to a
6150 * non-mapped address.
6151 */
6152 if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
6153 !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
6154 UDPS_BUMP_MIB(us, udpOutErrors);
6155 return (EADDRNOTAVAIL);
6156 }
6157
6158 if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
6159 V4_PART_OF_V6(sin6->sin6_addr) =
6160 htonl(INADDR_LOOPBACK);
6161 }
6162 ipversion = IPV4_VERSION;
6163 }
6164
6165 /*
6166 * We have to allocate an ip_xmit_attr_t before we grab
6167 * conn_lock and we need to hold conn_lock once we've check
6168 * conn_same_as_last_v6 to handle concurrent send* calls on a
6169 * socket.
6170 */
6171 if (msg->msg_controllen == 0) {
6172 ixa = conn_get_ixa(connp, B_FALSE);
6173 if (ixa == NULL) {
6174 UDPS_BUMP_MIB(us, udpOutErrors);
6175 return (ENOMEM);
6176 }
6177 } else {
6178 ixa = NULL;
6179 }
6180 mutex_enter(&connp->conn_lock);
6181 if (udp->udp_delayed_error != 0) {
6182 sin6_t *sin2 = (sin6_t *)&udp->udp_delayed_addr;
6183
6184 error = udp->udp_delayed_error;
6185 udp->udp_delayed_error = 0;
6186
6187 /* Compare IP address, port, and family */
6188
6189 if (sin6->sin6_port == sin2->sin6_port &&
6190 IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
6191 &sin2->sin6_addr) &&
6192 sin6->sin6_family == sin2->sin6_family) {
6193 mutex_exit(&connp->conn_lock);
6194 UDPS_BUMP_MIB(us, udpOutErrors);
6195 if (ixa != NULL)
6196 ixa_refrele(ixa);
6197 return (error);
6198 }
6199 }
6200
6201 if (msg->msg_controllen != 0) {
6202 mutex_exit(&connp->conn_lock);
6203 ASSERT(ixa == NULL);
6204 error = udp_output_ancillary(connp, NULL, sin6, mp,
6205 NULL, msg, cr, pid);
6206 } else if (conn_same_as_last_v6(connp, sin6) &&
6207 connp->conn_lastsrcid == srcid &&
6208 ipsec_outbound_policy_current(ixa)) {
6209 /* udp_output_lastdst drops conn_lock */
6210 error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6211 } else {
6212 /* udp_output_newdst drops conn_lock */
6213 error = udp_output_newdst(connp, mp, NULL, sin6,
6214 ipversion, cr, pid, ixa);
6215 }
6216 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6217 if (us->us_sendto_ignerr)
6218 return (0);
6219 else
6220 return (error);
6221 case AF_INET:
6222 sin = (sin_t *)msg->msg_name;
6223
6224 ipversion = IPV4_VERSION;
6225
6226 if (sin->sin_addr.s_addr == INADDR_ANY)
6227 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
6228
6229 /*
6230 * We have to allocate an ip_xmit_attr_t before we grab
6231 * conn_lock and we need to hold conn_lock once we've check
6232 * conn_same_as_last_v6 to handle concurrent send* on a socket.
6233 */
6234 if (msg->msg_controllen == 0) {
6235 ixa = conn_get_ixa(connp, B_FALSE);
6236 if (ixa == NULL) {
6237 UDPS_BUMP_MIB(us, udpOutErrors);
6238 return (ENOMEM);
6239 }
6240 } else {
6241 ixa = NULL;
6242 }
6243 mutex_enter(&connp->conn_lock);
6244 if (udp->udp_delayed_error != 0) {
6245 sin_t *sin2 = (sin_t *)&udp->udp_delayed_addr;
6246
6247 error = udp->udp_delayed_error;
6248 udp->udp_delayed_error = 0;
6249
6250 /* Compare IP address and port */
6251
6252 if (sin->sin_port == sin2->sin_port &&
6253 sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
6254 mutex_exit(&connp->conn_lock);
6255 UDPS_BUMP_MIB(us, udpOutErrors);
6256 if (ixa != NULL)
6257 ixa_refrele(ixa);
6258 return (error);
6259 }
6260 }
6261 if (msg->msg_controllen != 0) {
6262 mutex_exit(&connp->conn_lock);
6263 ASSERT(ixa == NULL);
6264 error = udp_output_ancillary(connp, sin, NULL, mp,
6265 NULL, msg, cr, pid);
6266 } else if (conn_same_as_last_v4(connp, sin) &&
6267 ipsec_outbound_policy_current(ixa)) {
6268 /* udp_output_lastdst drops conn_lock */
6269 error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6270 } else {
6271 /* udp_output_newdst drops conn_lock */
6272 error = udp_output_newdst(connp, mp, sin, NULL,
6273 ipversion, cr, pid, ixa);
6274 }
6275 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6276 if (us->us_sendto_ignerr)
6277 return (0);
6278 else
6279 return (error);
6280 default:
6281 return (EINVAL);
6282 }
6283 }
6284
6285 int
6286 udp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
6287 boolean_t issocket, so_proto_quiesced_cb_t quiesced_cb,
6288 sock_quiesce_arg_t *arg)
6289 {
6290 conn_t *connp = (conn_t *)proto_handle;
6291 udp_t *udp;
6292 struct T_capability_ack tca;
6293 struct sockaddr_in6 laddr, faddr;
6294 socklen_t laddrlen, faddrlen;
6295 short opts;
6296 struct stroptions *stropt;
6297 mblk_t *mp, *stropt_mp;
6298 int error;
6299
6300 udp = connp->conn_udp;
6301
6302 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
6303
6304 /*
6305 * setup the fallback stream that was allocated
6306 */
6307 connp->conn_dev = (dev_t)RD(q)->q_ptr;
6308 connp->conn_minor_arena = WR(q)->q_ptr;
6309
6310 RD(q)->q_ptr = WR(q)->q_ptr = connp;
6311
6312 WR(q)->q_qinfo = &udp_winit;
6313
6314 connp->conn_rq = RD(q);
6315 connp->conn_wq = WR(q);
6316
6317 /* Notify stream head about options before sending up data */
6318 stropt_mp->b_datap->db_type = M_SETOPTS;
6319 stropt_mp->b_wptr += sizeof (*stropt);
6320 stropt = (struct stroptions *)stropt_mp->b_rptr;
6321 stropt->so_flags = SO_WROFF | SO_HIWAT;
6322 stropt->so_wroff = connp->conn_wroff;
6323 stropt->so_hiwat = udp->udp_rcv_disply_hiwat;
6324 putnext(RD(q), stropt_mp);
6325
6326 /*
6327 * Free the helper stream
6328 */
6329 ip_free_helper_stream(connp);
6330
6331 if (!issocket)
6332 udp_use_pure_tpi(udp);
6333
6334 /*
6335 * Collect the information needed to sync with the sonode
6336 */
6337 udp_do_capability_ack(udp, &tca, TC1_INFO);
6338
6339 laddrlen = faddrlen = sizeof (sin6_t);
6340 (void) udp_getsockname((sock_lower_handle_t)connp,
6341 (struct sockaddr *)&laddr, &laddrlen, CRED());
6342 error = udp_getpeername((sock_lower_handle_t)connp,
6343 (struct sockaddr *)&faddr, &faddrlen, CRED());
6344 if (error != 0)
6345 faddrlen = 0;
6346
6347 opts = 0;
6348 if (connp->conn_dgram_errind)
6349 opts |= SO_DGRAM_ERRIND;
6350 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
6351 opts |= SO_DONTROUTE;
6352
6353 mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
6354 (struct sockaddr *)&laddr, laddrlen,
6355 (struct sockaddr *)&faddr, faddrlen, opts);
6356
6357 mutex_enter(&udp->udp_recv_lock);
6358 /*
6359 * Attempts to send data up during fallback will result in it being
6360 * queued in udp_t. First push up the datagrams obtained from the
6361 * socket, then any packets queued in udp_t.
6362 */
6363 if (mp != NULL) {
6364 mp->b_next = udp->udp_fallback_queue_head;
6365 udp->udp_fallback_queue_head = mp;
6366 }
6367 while (udp->udp_fallback_queue_head != NULL) {
6368 mp = udp->udp_fallback_queue_head;
6369 udp->udp_fallback_queue_head = mp->b_next;
6370 mutex_exit(&udp->udp_recv_lock);
6371 mp->b_next = NULL;
6372 putnext(RD(q), mp);
6373 mutex_enter(&udp->udp_recv_lock);
6374 }
6375 udp->udp_fallback_queue_tail = udp->udp_fallback_queue_head;
6376 /*
6377 * No longer a streams less socket
6378 */
6379 mutex_enter(&connp->conn_lock);
6380 connp->conn_flags &= ~IPCL_NONSTR;
6381 mutex_exit(&connp->conn_lock);
6382
6383 mutex_exit(&udp->udp_recv_lock);
6384
6385 ASSERT(connp->conn_ref >= 1);
6386
6387 return (0);
6388 }
6389
6390 /* ARGSUSED3 */
6391 int
6392 udp_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6393 socklen_t *salenp, cred_t *cr)
6394 {
6395 conn_t *connp = (conn_t *)proto_handle;
6396 udp_t *udp = connp->conn_udp;
6397 int error;
6398
6399 /* All Solaris components should pass a cred for this operation. */
6400 ASSERT(cr != NULL);
6401
6402 mutex_enter(&connp->conn_lock);
6403 if (udp->udp_state != TS_DATA_XFER)
6404 error = ENOTCONN;
6405 else
6406 error = conn_getpeername(connp, sa, salenp);
6407 mutex_exit(&connp->conn_lock);
6408 return (error);
6409 }
6410
6411 /* ARGSUSED3 */
6412 int
6413 udp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6414 socklen_t *salenp, cred_t *cr)
6415 {
6416 conn_t *connp = (conn_t *)proto_handle;
6417 int error;
6418
6419 /* All Solaris components should pass a cred for this operation. */
6420 ASSERT(cr != NULL);
6421
6422 mutex_enter(&connp->conn_lock);
6423 error = conn_getsockname(connp, sa, salenp);
6424 mutex_exit(&connp->conn_lock);
6425 return (error);
6426 }
6427
6428 int
6429 udp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6430 void *optvalp, socklen_t *optlen, cred_t *cr)
6431 {
6432 conn_t *connp = (conn_t *)proto_handle;
6433 int error;
6434 t_uscalar_t max_optbuf_len;
6435 void *optvalp_buf;
6436 int len;
6437
6438 /* All Solaris components should pass a cred for this operation. */
6439 ASSERT(cr != NULL);
6440
6441 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
6442 udp_opt_obj.odb_opt_des_arr,
6443 udp_opt_obj.odb_opt_arr_cnt,
6444 B_FALSE, B_TRUE, cr);
6445 if (error != 0) {
6446 if (error < 0)
6447 error = proto_tlitosyserr(-error);
6448 return (error);
6449 }
6450
6451 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
6452 len = udp_opt_get(connp, level, option_name, optvalp_buf);
6453 if (len == -1) {
6454 kmem_free(optvalp_buf, max_optbuf_len);
6455 return (EINVAL);
6456 }
6457
6458 /*
6459 * update optlen and copy option value
6460 */
6461 t_uscalar_t size = MIN(len, *optlen);
6462
6463 bcopy(optvalp_buf, optvalp, size);
6464 bcopy(&size, optlen, sizeof (size));
6465
6466 kmem_free(optvalp_buf, max_optbuf_len);
6467 return (0);
6468 }
6469
6470 int
6471 udp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6472 const void *optvalp, socklen_t optlen, cred_t *cr)
6473 {
6474 conn_t *connp = (conn_t *)proto_handle;
6475 int error;
6476
6477 /* All Solaris components should pass a cred for this operation. */
6478 ASSERT(cr != NULL);
6479
6480 error = proto_opt_check(level, option_name, optlen, NULL,
6481 udp_opt_obj.odb_opt_des_arr,
6482 udp_opt_obj.odb_opt_arr_cnt,
6483 B_TRUE, B_FALSE, cr);
6484
6485 if (error != 0) {
6486 if (error < 0)
6487 error = proto_tlitosyserr(-error);
6488 return (error);
6489 }
6490
6491 error = udp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
6492 optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
6493 NULL, cr);
6494
6495 ASSERT(error >= 0);
6496
6497 return (error);
6498 }
6499
6500 void
6501 udp_clr_flowctrl(sock_lower_handle_t proto_handle)
6502 {
6503 conn_t *connp = (conn_t *)proto_handle;
6504 udp_t *udp = connp->conn_udp;
6505
6506 mutex_enter(&udp->udp_recv_lock);
6507 connp->conn_flow_cntrld = B_FALSE;
6508 mutex_exit(&udp->udp_recv_lock);
6509 }
6510
6511 /* ARGSUSED2 */
6512 int
6513 udp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
6514 {
6515 conn_t *connp = (conn_t *)proto_handle;
6516
6517 /* All Solaris components should pass a cred for this operation. */
6518 ASSERT(cr != NULL);
6519
6520 /* shut down the send side */
6521 if (how != SHUT_RD)
6522 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6523 SOCK_OPCTL_SHUT_SEND, 0);
6524 /* shut down the recv side */
6525 if (how != SHUT_WR)
6526 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6527 SOCK_OPCTL_SHUT_RECV, 0);
6528 return (0);
6529 }
6530
6531 int
6532 udp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
6533 int mode, int32_t *rvalp, cred_t *cr)
6534 {
6535 conn_t *connp = (conn_t *)proto_handle;
6536 int error;
6537
6538 /* All Solaris components should pass a cred for this operation. */
6539 ASSERT(cr != NULL);
6540
6541 /*
6542 * If we don't have a helper stream then create one.
6543 * ip_create_helper_stream takes care of locking the conn_t,
6544 * so this check for NULL is just a performance optimization.
6545 */
6546 if (connp->conn_helper_info == NULL) {
6547 udp_stack_t *us = connp->conn_udp->udp_us;
6548
6549 ASSERT(us->us_ldi_ident != NULL);
6550
6551 /*
6552 * Create a helper stream for non-STREAMS socket.
6553 */
6554 error = ip_create_helper_stream(connp, us->us_ldi_ident);
6555 if (error != 0) {
6556 ip0dbg(("tcp_ioctl: create of IP helper stream "
6557 "failed %d\n", error));
6558 return (error);
6559 }
6560 }
6561
6562 switch (cmd) {
6563 case _SIOCSOCKFALLBACK:
6564 case TI_GETPEERNAME:
6565 case TI_GETMYNAME:
6566 ip1dbg(("udp_ioctl: cmd 0x%x on non streams socket",
6567 cmd));
6568 error = EINVAL;
6569 break;
6570 default:
6571 /*
6572 * Pass on to IP using helper stream
6573 */
6574 error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
6575 cmd, arg, mode, cr, rvalp);
6576 break;
6577 }
6578 return (error);
6579 }
6580
6581 /* ARGSUSED */
6582 int
6583 udp_accept(sock_lower_handle_t lproto_handle,
6584 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
6585 cred_t *cr)
6586 {
6587 return (EOPNOTSUPP);
6588 }
6589
6590 /* ARGSUSED */
6591 int
6592 udp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
6593 {
6594 return (EOPNOTSUPP);
6595 }
6596
6597 sock_downcalls_t sock_udp_downcalls = {
6598 udp_activate, /* sd_activate */
6599 udp_accept, /* sd_accept */
6600 udp_bind, /* sd_bind */
6601 udp_listen, /* sd_listen */
6602 udp_connect, /* sd_connect */
6603 udp_getpeername, /* sd_getpeername */
6604 udp_getsockname, /* sd_getsockname */
6605 udp_getsockopt, /* sd_getsockopt */
6606 udp_setsockopt, /* sd_setsockopt */
6607 udp_send, /* sd_send */
6608 NULL, /* sd_send_uio */
6609 NULL, /* sd_recv_uio */
6610 NULL, /* sd_poll */
6611 udp_shutdown, /* sd_shutdown */
6612 udp_clr_flowctrl, /* sd_setflowctrl */
6613 udp_ioctl, /* sd_ioctl */
6614 udp_close /* sd_close */
6615 };