1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
24 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
25 */
26 /* Copyright (c) 1990 Mentat Inc. */
27
28 #include <sys/sysmacros.h>
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/stropts.h>
32 #include <sys/strlog.h>
33 #include <sys/strsun.h>
34 #define _SUN_TPI_VERSION 2
35 #include <sys/tihdr.h>
36 #include <sys/timod.h>
37 #include <sys/ddi.h>
38 #include <sys/sunddi.h>
39 #include <sys/strsubr.h>
40 #include <sys/suntpi.h>
41 #include <sys/xti_inet.h>
42 #include <sys/kmem.h>
43 #include <sys/cred_impl.h>
44 #include <sys/policy.h>
45 #include <sys/priv.h>
46 #include <sys/ucred.h>
47 #include <sys/zone.h>
48
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sockio.h>
52 #include <sys/vtrace.h>
53 #include <sys/sdt.h>
54 #include <sys/debug.h>
55 #include <sys/isa_defs.h>
56 #include <sys/random.h>
57 #include <netinet/in.h>
58 #include <netinet/ip6.h>
59 #include <netinet/icmp6.h>
60 #include <netinet/udp.h>
61
62 #include <inet/common.h>
63 #include <inet/ip.h>
64 #include <inet/ip_impl.h>
65 #include <inet/ipsec_impl.h>
66 #include <inet/ip6.h>
67 #include <inet/ip_ire.h>
68 #include <inet/ip_if.h>
69 #include <inet/ip_multi.h>
70 #include <inet/ip_ndp.h>
71 #include <inet/proto_set.h>
72 #include <inet/mib2.h>
73 #include <inet/optcom.h>
74 #include <inet/snmpcom.h>
75 #include <inet/kstatcom.h>
76 #include <inet/ipclassifier.h>
77 #include <sys/squeue_impl.h>
78 #include <inet/ipnet.h>
79 #include <sys/ethernet.h>
80
81 #include <sys/tsol/label.h>
82 #include <sys/tsol/tnet.h>
83 #include <rpc/pmap_prot.h>
84
85 #include <inet/udp_impl.h>
86
87 /*
88 * Synchronization notes:
89 *
90 * UDP is MT and uses the usual kernel synchronization primitives. There are 2
91 * locks, the fanout lock (uf_lock) and conn_lock. conn_lock
92 * protects the contents of the udp_t. uf_lock protects the address and the
93 * fanout information.
94 * The lock order is conn_lock -> uf_lock.
95 *
96 * The fanout lock uf_lock:
97 * When a UDP endpoint is bound to a local port, it is inserted into
98 * a bind hash list. The list consists of an array of udp_fanout_t buckets.
99 * The size of the array is controlled by the udp_bind_fanout_size variable.
100 * This variable can be changed in /etc/system if the default value is
101 * not large enough. Each bind hash bucket is protected by a per bucket
102 * lock. It protects the udp_bind_hash and udp_ptpbhn fields in the udp_t
103 * structure and a few other fields in the udp_t. A UDP endpoint is removed
104 * from the bind hash list only when it is being unbound or being closed.
105 * The per bucket lock also protects a UDP endpoint's state changes.
106 *
107 * Plumbing notes:
108 * UDP is always a device driver. For compatibility with mibopen() code
109 * it is possible to I_PUSH "udp", but that results in pushing a passthrough
110 * dummy module.
111 *
112 * The above implies that we don't support any intermediate module to
113 * reside in between /dev/ip and udp -- in fact, we never supported such
114 * scenario in the past as the inter-layer communication semantics have
115 * always been private.
116 */
117
118 /* For /etc/system control */
119 uint_t udp_bind_fanout_size = UDP_BIND_FANOUT_SIZE;
120
121 static void udp_addr_req(queue_t *q, mblk_t *mp);
122 static void udp_tpi_bind(queue_t *q, mblk_t *mp);
123 static void udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp);
124 static void udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock);
125 static int udp_build_hdr_template(conn_t *, const in6_addr_t *,
126 const in6_addr_t *, in_port_t, uint32_t);
127 static void udp_capability_req(queue_t *q, mblk_t *mp);
128 static int udp_tpi_close(queue_t *q, int flags);
129 static void udp_close_free(conn_t *);
130 static void udp_tpi_connect(queue_t *q, mblk_t *mp);
131 static void udp_tpi_disconnect(queue_t *q, mblk_t *mp);
132 static void udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error,
133 int sys_error);
134 static void udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
135 t_scalar_t tlierr, int sys_error);
136 static int udp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
137 cred_t *cr);
138 static int udp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
139 char *value, caddr_t cp, cred_t *cr);
140 static int udp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
141 char *value, caddr_t cp, cred_t *cr);
142 static void udp_icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
143 static void udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp,
144 ip_recv_attr_t *ira);
145 static void udp_info_req(queue_t *q, mblk_t *mp);
146 static void udp_input(void *, mblk_t *, void *, ip_recv_attr_t *);
147 static void udp_lrput(queue_t *, mblk_t *);
148 static void udp_lwput(queue_t *, mblk_t *);
149 static int udp_open(queue_t *q, dev_t *devp, int flag, int sflag,
150 cred_t *credp, boolean_t isv6);
151 static int udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag,
152 cred_t *credp);
153 static int udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag,
154 cred_t *credp);
155 static boolean_t udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name);
156 int udp_opt_set(conn_t *connp, uint_t optset_context,
157 int level, int name, uint_t inlen,
158 uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
159 void *thisdg_attrs, cred_t *cr);
160 int udp_opt_get(conn_t *connp, int level, int name,
161 uchar_t *ptr);
162 static int udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr,
163 pid_t pid);
164 static int udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr,
165 pid_t pid, ip_xmit_attr_t *ixa);
166 static int udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin,
167 sin6_t *sin6, ushort_t ipversion, cred_t *cr, pid_t,
168 ip_xmit_attr_t *ixa);
169 static mblk_t *udp_prepend_hdr(conn_t *, ip_xmit_attr_t *, const ip_pkt_t *,
170 const in6_addr_t *, const in6_addr_t *, in_port_t, uint32_t, mblk_t *,
171 int *);
172 static mblk_t *udp_prepend_header_template(conn_t *, ip_xmit_attr_t *,
173 mblk_t *, const in6_addr_t *, in_port_t, uint32_t, int *);
174 static void udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err);
175 static void udp_ud_err_connected(conn_t *, t_scalar_t);
176 static void udp_tpi_unbind(queue_t *q, mblk_t *mp);
177 static in_port_t udp_update_next_port(udp_t *udp, in_port_t port,
178 boolean_t random);
179 static void udp_wput_other(queue_t *q, mblk_t *mp);
180 static void udp_wput_iocdata(queue_t *q, mblk_t *mp);
181 static void udp_wput_fallback(queue_t *q, mblk_t *mp);
182 static size_t udp_set_rcv_hiwat(udp_t *udp, size_t size);
183
184 static void *udp_stack_init(netstackid_t stackid, netstack_t *ns);
185 static void udp_stack_fini(netstackid_t stackid, void *arg);
186
187 /* Common routines for TPI and socket module */
188 static void udp_ulp_recv(conn_t *, mblk_t *, uint_t, ip_recv_attr_t *);
189
190 /* Common routine for TPI and socket module */
191 static conn_t *udp_do_open(cred_t *, boolean_t, int, int *);
192 static void udp_do_close(conn_t *);
193 static int udp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *,
194 boolean_t);
195 static int udp_do_unbind(conn_t *);
196
197 int udp_getsockname(sock_lower_handle_t,
198 struct sockaddr *, socklen_t *, cred_t *);
199 int udp_getpeername(sock_lower_handle_t,
200 struct sockaddr *, socklen_t *, cred_t *);
201 static int udp_do_connect(conn_t *, const struct sockaddr *, socklen_t,
202 cred_t *, pid_t);
203
204 #pragma inline(udp_output_connected, udp_output_newdst, udp_output_lastdst)
205
206 /*
207 * Checks if the given destination addr/port is allowed out.
208 * If allowed, registers the (dest_addr/port, node_ID) mapping at Cluster.
209 * Called for each connect() and for sendto()/sendmsg() to a different
210 * destination.
211 * For connect(), called in udp_connect().
212 * For sendto()/sendmsg(), called in udp_output_newdst().
213 *
214 * This macro assumes that the cl_inet_connect2 hook is not NULL.
215 * Please check this before calling this macro.
216 *
217 * void
218 * CL_INET_UDP_CONNECT(conn_t cp, udp_t *udp, boolean_t is_outgoing,
219 * in6_addr_t *faddrp, in_port_t (or uint16_t) fport, int err);
220 */
221 #define CL_INET_UDP_CONNECT(cp, is_outgoing, faddrp, fport, err) { \
222 (err) = 0; \
223 /* \
224 * Running in cluster mode - check and register active \
225 * "connection" information \
226 */ \
227 if ((cp)->conn_ipversion == IPV4_VERSION) \
228 (err) = (*cl_inet_connect2)( \
229 (cp)->conn_netstack->netstack_stackid, \
230 IPPROTO_UDP, is_outgoing, AF_INET, \
231 (uint8_t *)&((cp)->conn_laddr_v4), \
232 (cp)->conn_lport, \
233 (uint8_t *)&(V4_PART_OF_V6(*faddrp)), \
234 (in_port_t)(fport), NULL); \
235 else \
236 (err) = (*cl_inet_connect2)( \
237 (cp)->conn_netstack->netstack_stackid, \
238 IPPROTO_UDP, is_outgoing, AF_INET6, \
239 (uint8_t *)&((cp)->conn_laddr_v6), \
240 (cp)->conn_lport, \
241 (uint8_t *)(faddrp), (in_port_t)(fport), NULL); \
242 }
243
244 static struct module_info udp_mod_info = {
245 UDP_MOD_ID, UDP_MOD_NAME, 1, INFPSZ, UDP_RECV_HIWATER, UDP_RECV_LOWATER
246 };
247
248 /*
249 * Entry points for UDP as a device.
250 * We have separate open functions for the /dev/udp and /dev/udp6 devices.
251 */
252 static struct qinit udp_rinitv4 = {
253 NULL, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info, NULL
254 };
255
256 static struct qinit udp_rinitv6 = {
257 NULL, NULL, udp_openv6, udp_tpi_close, NULL, &udp_mod_info, NULL
258 };
259
260 static struct qinit udp_winit = {
261 (pfi_t)udp_wput, (pfi_t)ip_wsrv, NULL, NULL, NULL, &udp_mod_info
262 };
263
264 /* UDP entry point during fallback */
265 struct qinit udp_fallback_sock_winit = {
266 (pfi_t)udp_wput_fallback, NULL, NULL, NULL, NULL, &udp_mod_info
267 };
268
269 /*
270 * UDP needs to handle I_LINK and I_PLINK since ifconfig
271 * likes to use it as a place to hang the various streams.
272 */
273 static struct qinit udp_lrinit = {
274 (pfi_t)udp_lrput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
275 };
276
277 static struct qinit udp_lwinit = {
278 (pfi_t)udp_lwput, NULL, udp_openv4, udp_tpi_close, NULL, &udp_mod_info
279 };
280
281 /* For AF_INET aka /dev/udp */
282 struct streamtab udpinfov4 = {
283 &udp_rinitv4, &udp_winit, &udp_lrinit, &udp_lwinit
284 };
285
286 /* For AF_INET6 aka /dev/udp6 */
287 struct streamtab udpinfov6 = {
288 &udp_rinitv6, &udp_winit, &udp_lrinit, &udp_lwinit
289 };
290
291 #define UDP_MAXPACKET_IPV4 (IP_MAXPACKET - UDPH_SIZE - IP_SIMPLE_HDR_LENGTH)
292
293 /* Default structure copied into T_INFO_ACK messages */
294 static struct T_info_ack udp_g_t_info_ack_ipv4 = {
295 T_INFO_ACK,
296 UDP_MAXPACKET_IPV4, /* TSDU_size. Excl. headers */
297 T_INVALID, /* ETSU_size. udp does not support expedited data. */
298 T_INVALID, /* CDATA_size. udp does not support connect data. */
299 T_INVALID, /* DDATA_size. udp does not support disconnect data. */
300 sizeof (sin_t), /* ADDR_size. */
301 0, /* OPT_size - not initialized here */
302 UDP_MAXPACKET_IPV4, /* TIDU_size. Excl. headers */
303 T_CLTS, /* SERV_type. udp supports connection-less. */
304 TS_UNBND, /* CURRENT_state. This is set from udp_state. */
305 (XPG4_1|SENDZERO) /* PROVIDER_flag */
306 };
307
308 #define UDP_MAXPACKET_IPV6 (IP_MAXPACKET - UDPH_SIZE - IPV6_HDR_LEN)
309
310 static struct T_info_ack udp_g_t_info_ack_ipv6 = {
311 T_INFO_ACK,
312 UDP_MAXPACKET_IPV6, /* TSDU_size. Excl. headers */
313 T_INVALID, /* ETSU_size. udp does not support expedited data. */
314 T_INVALID, /* CDATA_size. udp does not support connect data. */
315 T_INVALID, /* DDATA_size. udp does not support disconnect data. */
316 sizeof (sin6_t), /* ADDR_size. */
317 0, /* OPT_size - not initialized here */
318 UDP_MAXPACKET_IPV6, /* TIDU_size. Excl. headers */
319 T_CLTS, /* SERV_type. udp supports connection-less. */
320 TS_UNBND, /* CURRENT_state. This is set from udp_state. */
321 (XPG4_1|SENDZERO) /* PROVIDER_flag */
322 };
323
324 /*
325 * UDP tunables related declarations. Definitions are in udp_tunables.c
326 */
327 extern mod_prop_info_t udp_propinfo_tbl[];
328 extern int udp_propinfo_count;
329
330 /* Setable in /etc/system */
331 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
332 uint32_t udp_random_anon_port = 1;
333
334 /*
335 * Hook functions to enable cluster networking.
336 * On non-clustered systems these vectors must always be NULL
337 */
338
339 void (*cl_inet_bind)(netstackid_t stack_id, uchar_t protocol,
340 sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
341 void *args) = NULL;
342 void (*cl_inet_unbind)(netstackid_t stack_id, uint8_t protocol,
343 sa_family_t addr_family, uint8_t *laddrp, in_port_t lport,
344 void *args) = NULL;
345
346 typedef union T_primitives *t_primp_t;
347
348 /*
349 * Return the next anonymous port in the privileged port range for
350 * bind checking.
351 *
352 * Trusted Extension (TX) notes: TX allows administrator to mark or
353 * reserve ports as Multilevel ports (MLP). MLP has special function
354 * on TX systems. Once a port is made MLP, it's not available as
355 * ordinary port. This creates "holes" in the port name space. It
356 * may be necessary to skip the "holes" find a suitable anon port.
357 */
358 static in_port_t
359 udp_get_next_priv_port(udp_t *udp)
360 {
361 static in_port_t next_priv_port = IPPORT_RESERVED - 1;
362 in_port_t nextport;
363 boolean_t restart = B_FALSE;
364 udp_stack_t *us = udp->udp_us;
365
366 retry:
367 if (next_priv_port < us->us_min_anonpriv_port ||
368 next_priv_port >= IPPORT_RESERVED) {
369 next_priv_port = IPPORT_RESERVED - 1;
370 if (restart)
371 return (0);
372 restart = B_TRUE;
373 }
374
375 if (is_system_labeled() &&
376 (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
377 next_priv_port, IPPROTO_UDP, B_FALSE)) != 0) {
378 next_priv_port = nextport;
379 goto retry;
380 }
381
382 return (next_priv_port--);
383 }
384
385 /*
386 * Hash list removal routine for udp_t structures.
387 */
388 static void
389 udp_bind_hash_remove(udp_t *udp, boolean_t caller_holds_lock)
390 {
391 udp_t *udpnext;
392 kmutex_t *lockp;
393 udp_stack_t *us = udp->udp_us;
394 conn_t *connp = udp->udp_connp;
395
396 if (udp->udp_ptpbhn == NULL)
397 return;
398
399 /*
400 * Extract the lock pointer in case there are concurrent
401 * hash_remove's for this instance.
402 */
403 ASSERT(connp->conn_lport != 0);
404 if (!caller_holds_lock) {
405 lockp = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
406 us->us_bind_fanout_size)].uf_lock;
407 ASSERT(lockp != NULL);
408 mutex_enter(lockp);
409 }
410 if (udp->udp_ptpbhn != NULL) {
411 udpnext = udp->udp_bind_hash;
412 if (udpnext != NULL) {
413 udpnext->udp_ptpbhn = udp->udp_ptpbhn;
414 udp->udp_bind_hash = NULL;
415 }
416 *udp->udp_ptpbhn = udpnext;
417 udp->udp_ptpbhn = NULL;
418 }
419 if (!caller_holds_lock) {
420 mutex_exit(lockp);
421 }
422 }
423
424 static void
425 udp_bind_hash_insert(udp_fanout_t *uf, udp_t *udp)
426 {
427 conn_t *connp = udp->udp_connp;
428 udp_t **udpp;
429 udp_t *udpnext;
430 conn_t *connext;
431
432 ASSERT(MUTEX_HELD(&uf->uf_lock));
433 ASSERT(udp->udp_ptpbhn == NULL);
434 udpp = &uf->uf_udp;
435 udpnext = udpp[0];
436 if (udpnext != NULL) {
437 /*
438 * If the new udp bound to the INADDR_ANY address
439 * and the first one in the list is not bound to
440 * INADDR_ANY we skip all entries until we find the
441 * first one bound to INADDR_ANY.
442 * This makes sure that applications binding to a
443 * specific address get preference over those binding to
444 * INADDR_ANY.
445 */
446 connext = udpnext->udp_connp;
447 if (V6_OR_V4_INADDR_ANY(connp->conn_bound_addr_v6) &&
448 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
449 while ((udpnext = udpp[0]) != NULL &&
450 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) {
451 udpp = &(udpnext->udp_bind_hash);
452 }
453 if (udpnext != NULL)
454 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
455 } else {
456 udpnext->udp_ptpbhn = &udp->udp_bind_hash;
457 }
458 }
459 udp->udp_bind_hash = udpnext;
460 udp->udp_ptpbhn = udpp;
461 udpp[0] = udp;
462 }
463
464 /*
465 * This routine is called to handle each O_T_BIND_REQ/T_BIND_REQ message
466 * passed to udp_wput.
467 * It associates a port number and local address with the stream.
468 * It calls IP to verify the local IP address, and calls IP to insert
469 * the conn_t in the fanout table.
470 * If everything is ok it then sends the T_BIND_ACK back up.
471 *
472 * Note that UDP over IPv4 and IPv6 sockets can use the same port number
473 * without setting SO_REUSEADDR. This is needed so that they
474 * can be viewed as two independent transport protocols.
475 * However, anonymouns ports are allocated from the same range to avoid
476 * duplicating the us->us_next_port_to_try.
477 */
478 static void
479 udp_tpi_bind(queue_t *q, mblk_t *mp)
480 {
481 sin_t *sin;
482 sin6_t *sin6;
483 mblk_t *mp1;
484 struct T_bind_req *tbr;
485 conn_t *connp;
486 udp_t *udp;
487 int error;
488 struct sockaddr *sa;
489 cred_t *cr;
490
491 /*
492 * All Solaris components should pass a db_credp
493 * for this TPI message, hence we ASSERT.
494 * But in case there is some other M_PROTO that looks
495 * like a TPI message sent by some other kernel
496 * component, we check and return an error.
497 */
498 cr = msg_getcred(mp, NULL);
499 ASSERT(cr != NULL);
500 if (cr == NULL) {
501 udp_err_ack(q, mp, TSYSERR, EINVAL);
502 return;
503 }
504
505 connp = Q_TO_CONN(q);
506 udp = connp->conn_udp;
507 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
508 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
509 "udp_bind: bad req, len %u",
510 (uint_t)(mp->b_wptr - mp->b_rptr));
511 udp_err_ack(q, mp, TPROTO, 0);
512 return;
513 }
514 if (udp->udp_state != TS_UNBND) {
515 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
516 "udp_bind: bad state, %u", udp->udp_state);
517 udp_err_ack(q, mp, TOUTSTATE, 0);
518 return;
519 }
520 /*
521 * Reallocate the message to make sure we have enough room for an
522 * address.
523 */
524 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1);
525 if (mp1 == NULL) {
526 udp_err_ack(q, mp, TSYSERR, ENOMEM);
527 return;
528 }
529
530 mp = mp1;
531
532 /* Reset the message type in preparation for shipping it back. */
533 DB_TYPE(mp) = M_PCPROTO;
534
535 tbr = (struct T_bind_req *)mp->b_rptr;
536 switch (tbr->ADDR_length) {
537 case 0: /* Request for a generic port */
538 tbr->ADDR_offset = sizeof (struct T_bind_req);
539 if (connp->conn_family == AF_INET) {
540 tbr->ADDR_length = sizeof (sin_t);
541 sin = (sin_t *)&tbr[1];
542 *sin = sin_null;
543 sin->sin_family = AF_INET;
544 mp->b_wptr = (uchar_t *)&sin[1];
545 sa = (struct sockaddr *)sin;
546 } else {
547 ASSERT(connp->conn_family == AF_INET6);
548 tbr->ADDR_length = sizeof (sin6_t);
549 sin6 = (sin6_t *)&tbr[1];
550 *sin6 = sin6_null;
551 sin6->sin6_family = AF_INET6;
552 mp->b_wptr = (uchar_t *)&sin6[1];
553 sa = (struct sockaddr *)sin6;
554 }
555 break;
556
557 case sizeof (sin_t): /* Complete IPv4 address */
558 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
559 sizeof (sin_t));
560 if (sa == NULL || !OK_32PTR((char *)sa)) {
561 udp_err_ack(q, mp, TSYSERR, EINVAL);
562 return;
563 }
564 if (connp->conn_family != AF_INET ||
565 sa->sa_family != AF_INET) {
566 udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
567 return;
568 }
569 break;
570
571 case sizeof (sin6_t): /* complete IPv6 address */
572 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset,
573 sizeof (sin6_t));
574 if (sa == NULL || !OK_32PTR((char *)sa)) {
575 udp_err_ack(q, mp, TSYSERR, EINVAL);
576 return;
577 }
578 if (connp->conn_family != AF_INET6 ||
579 sa->sa_family != AF_INET6) {
580 udp_err_ack(q, mp, TSYSERR, EAFNOSUPPORT);
581 return;
582 }
583 break;
584
585 default: /* Invalid request */
586 (void) mi_strlog(q, 1, SL_ERROR|SL_TRACE,
587 "udp_bind: bad ADDR_length length %u", tbr->ADDR_length);
588 udp_err_ack(q, mp, TBADADDR, 0);
589 return;
590 }
591
592 error = udp_do_bind(connp, sa, tbr->ADDR_length, cr,
593 tbr->PRIM_type != O_T_BIND_REQ);
594
595 if (error != 0) {
596 if (error > 0) {
597 udp_err_ack(q, mp, TSYSERR, error);
598 } else {
599 udp_err_ack(q, mp, -error, 0);
600 }
601 } else {
602 tbr->PRIM_type = T_BIND_ACK;
603 qreply(q, mp);
604 }
605 }
606
607 /*
608 * This routine handles each T_CONN_REQ message passed to udp. It
609 * associates a default destination address with the stream.
610 *
611 * After various error checks are completed, udp_connect() lays
612 * the target address and port into the composite header template.
613 * Then we ask IP for information, including a source address if we didn't
614 * already have one. Finally we send up the T_OK_ACK reply message.
615 */
616 static void
617 udp_tpi_connect(queue_t *q, mblk_t *mp)
618 {
619 conn_t *connp = Q_TO_CONN(q);
620 int error;
621 socklen_t len;
622 struct sockaddr *sa;
623 struct T_conn_req *tcr;
624 cred_t *cr;
625 pid_t pid;
626 /*
627 * All Solaris components should pass a db_credp
628 * for this TPI message, hence we ASSERT.
629 * But in case there is some other M_PROTO that looks
630 * like a TPI message sent by some other kernel
631 * component, we check and return an error.
632 */
633 cr = msg_getcred(mp, &pid);
634 ASSERT(cr != NULL);
635 if (cr == NULL) {
636 udp_err_ack(q, mp, TSYSERR, EINVAL);
637 return;
638 }
639
640 tcr = (struct T_conn_req *)mp->b_rptr;
641
642 /* A bit of sanity checking */
643 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_req)) {
644 udp_err_ack(q, mp, TPROTO, 0);
645 return;
646 }
647
648 if (tcr->OPT_length != 0) {
649 udp_err_ack(q, mp, TBADOPT, 0);
650 return;
651 }
652
653 /*
654 * Determine packet type based on type of address passed in
655 * the request should contain an IPv4 or IPv6 address.
656 * Make sure that address family matches the type of
657 * family of the address passed down.
658 */
659 len = tcr->DEST_length;
660 switch (tcr->DEST_length) {
661 default:
662 udp_err_ack(q, mp, TBADADDR, 0);
663 return;
664
665 case sizeof (sin_t):
666 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
667 sizeof (sin_t));
668 break;
669
670 case sizeof (sin6_t):
671 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset,
672 sizeof (sin6_t));
673 break;
674 }
675
676 error = proto_verify_ip_addr(connp->conn_family, sa, len);
677 if (error != 0) {
678 udp_err_ack(q, mp, TSYSERR, error);
679 return;
680 }
681
682 error = udp_do_connect(connp, sa, len, cr, pid);
683 if (error != 0) {
684 if (error < 0)
685 udp_err_ack(q, mp, -error, 0);
686 else
687 udp_err_ack(q, mp, TSYSERR, error);
688 } else {
689 mblk_t *mp1;
690 /*
691 * We have to send a connection confirmation to
692 * keep TLI happy.
693 */
694 if (connp->conn_family == AF_INET) {
695 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
696 sizeof (sin_t), NULL, 0);
697 } else {
698 mp1 = mi_tpi_conn_con(NULL, (char *)sa,
699 sizeof (sin6_t), NULL, 0);
700 }
701 if (mp1 == NULL) {
702 udp_err_ack(q, mp, TSYSERR, ENOMEM);
703 return;
704 }
705
706 /*
707 * Send ok_ack for T_CONN_REQ
708 */
709 mp = mi_tpi_ok_ack_alloc(mp);
710 if (mp == NULL) {
711 /* Unable to reuse the T_CONN_REQ for the ack. */
712 udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
713 return;
714 }
715
716 putnext(connp->conn_rq, mp);
717 putnext(connp->conn_rq, mp1);
718 }
719 }
720
721 static int
722 udp_tpi_close(queue_t *q, int flags)
723 {
724 conn_t *connp;
725
726 if (flags & SO_FALLBACK) {
727 /*
728 * stream is being closed while in fallback
729 * simply free the resources that were allocated
730 */
731 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr));
732 qprocsoff(q);
733 goto done;
734 }
735
736 connp = Q_TO_CONN(q);
737 udp_do_close(connp);
738 done:
739 q->q_ptr = WR(q)->q_ptr = NULL;
740 return (0);
741 }
742
743 static void
744 udp_close_free(conn_t *connp)
745 {
746 udp_t *udp = connp->conn_udp;
747
748 /* If there are any options associated with the stream, free them. */
749 if (udp->udp_recv_ipp.ipp_fields != 0)
750 ip_pkt_free(&udp->udp_recv_ipp);
751
752 /*
753 * Clear any fields which the kmem_cache constructor clears.
754 * Only udp_connp needs to be preserved.
755 * TBD: We should make this more efficient to avoid clearing
756 * everything.
757 */
758 ASSERT(udp->udp_connp == connp);
759 bzero(udp, sizeof (udp_t));
760 udp->udp_connp = connp;
761 }
762
763 static int
764 udp_do_disconnect(conn_t *connp)
765 {
766 udp_t *udp;
767 udp_fanout_t *udpf;
768 udp_stack_t *us;
769 int error;
770
771 udp = connp->conn_udp;
772 us = udp->udp_us;
773 mutex_enter(&connp->conn_lock);
774 if (udp->udp_state != TS_DATA_XFER) {
775 mutex_exit(&connp->conn_lock);
776 return (-TOUTSTATE);
777 }
778 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
779 us->us_bind_fanout_size)];
780 mutex_enter(&udpf->uf_lock);
781 if (connp->conn_mcbc_bind)
782 connp->conn_saddr_v6 = ipv6_all_zeros;
783 else
784 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
785 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
786 connp->conn_faddr_v6 = ipv6_all_zeros;
787 connp->conn_fport = 0;
788 udp->udp_state = TS_IDLE;
789 mutex_exit(&udpf->uf_lock);
790
791 /* Remove any remnants of mapped address binding */
792 if (connp->conn_family == AF_INET6)
793 connp->conn_ipversion = IPV6_VERSION;
794
795 connp->conn_v6lastdst = ipv6_all_zeros;
796 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
797 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
798 mutex_exit(&connp->conn_lock);
799 if (error != 0)
800 return (error);
801
802 /*
803 * Tell IP to remove the full binding and revert
804 * to the local address binding.
805 */
806 return (ip_laddr_fanout_insert(connp));
807 }
808
809 static void
810 udp_tpi_disconnect(queue_t *q, mblk_t *mp)
811 {
812 conn_t *connp = Q_TO_CONN(q);
813 int error;
814
815 /*
816 * Allocate the largest primitive we need to send back
817 * T_error_ack is > than T_ok_ack
818 */
819 mp = reallocb(mp, sizeof (struct T_error_ack), 1);
820 if (mp == NULL) {
821 /* Unable to reuse the T_DISCON_REQ for the ack. */
822 udp_err_ack_prim(q, mp, T_DISCON_REQ, TSYSERR, ENOMEM);
823 return;
824 }
825
826 error = udp_do_disconnect(connp);
827
828 if (error != 0) {
829 if (error < 0) {
830 udp_err_ack(q, mp, -error, 0);
831 } else {
832 udp_err_ack(q, mp, TSYSERR, error);
833 }
834 } else {
835 mp = mi_tpi_ok_ack_alloc(mp);
836 ASSERT(mp != NULL);
837 qreply(q, mp);
838 }
839 }
840
841 int
842 udp_disconnect(conn_t *connp)
843 {
844 int error;
845
846 connp->conn_dgram_errind = B_FALSE;
847 error = udp_do_disconnect(connp);
848 if (error < 0)
849 error = proto_tlitosyserr(-error);
850
851 return (error);
852 }
853
854 /* This routine creates a T_ERROR_ACK message and passes it upstream. */
855 static void
856 udp_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
857 {
858 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
859 qreply(q, mp);
860 }
861
862 /* Shorthand to generate and send TPI error acks to our client */
863 static void
864 udp_err_ack_prim(queue_t *q, mblk_t *mp, t_scalar_t primitive,
865 t_scalar_t t_error, int sys_error)
866 {
867 struct T_error_ack *teackp;
868
869 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
870 M_PCPROTO, T_ERROR_ACK)) != NULL) {
871 teackp = (struct T_error_ack *)mp->b_rptr;
872 teackp->ERROR_prim = primitive;
873 teackp->TLI_error = t_error;
874 teackp->UNIX_error = sys_error;
875 qreply(q, mp);
876 }
877 }
878
879 /* At minimum we need 4 bytes of UDP header */
880 #define ICMP_MIN_UDP_HDR 4
881
882 /*
883 * udp_icmp_input is called as conn_recvicmp to process ICMP messages.
884 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
885 * Assumes that IP has pulled up everything up to and including the ICMP header.
886 */
887 /* ARGSUSED2 */
888 static void
889 udp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
890 {
891 conn_t *connp = (conn_t *)arg1;
892 icmph_t *icmph;
893 ipha_t *ipha;
894 int iph_hdr_length;
895 udpha_t *udpha;
896 sin_t sin;
897 sin6_t sin6;
898 mblk_t *mp1;
899 int error = 0;
900 udp_t *udp = connp->conn_udp;
901
902 ipha = (ipha_t *)mp->b_rptr;
903
904 ASSERT(OK_32PTR(mp->b_rptr));
905
906 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
907 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
908 udp_icmp_error_ipv6(connp, mp, ira);
909 return;
910 }
911 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
912
913 /* Skip past the outer IP and ICMP headers */
914 ASSERT(IPH_HDR_LENGTH(ipha) == ira->ira_ip_hdr_length);
915 iph_hdr_length = ira->ira_ip_hdr_length;
916 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
917 ipha = (ipha_t *)&icmph[1]; /* Inner IP header */
918
919 /* Skip past the inner IP and find the ULP header */
920 iph_hdr_length = IPH_HDR_LENGTH(ipha);
921 udpha = (udpha_t *)((char *)ipha + iph_hdr_length);
922
923 switch (icmph->icmph_type) {
924 case ICMP_DEST_UNREACHABLE:
925 switch (icmph->icmph_code) {
926 case ICMP_FRAGMENTATION_NEEDED: {
927 ipha_t *ipha;
928 ip_xmit_attr_t *ixa;
929 /*
930 * IP has already adjusted the path MTU.
931 * But we need to adjust DF for IPv4.
932 */
933 if (connp->conn_ipversion != IPV4_VERSION)
934 break;
935
936 ixa = conn_get_ixa(connp, B_FALSE);
937 if (ixa == NULL || ixa->ixa_ire == NULL) {
938 /*
939 * Some other thread holds conn_ixa. We will
940 * redo this on the next ICMP too big.
941 */
942 if (ixa != NULL)
943 ixa_refrele(ixa);
944 break;
945 }
946 (void) ip_get_pmtu(ixa);
947
948 mutex_enter(&connp->conn_lock);
949 ipha = (ipha_t *)connp->conn_ht_iphc;
950 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
951 ipha->ipha_fragment_offset_and_flags |=
952 IPH_DF_HTONS;
953 } else {
954 ipha->ipha_fragment_offset_and_flags &=
955 ~IPH_DF_HTONS;
956 }
957 mutex_exit(&connp->conn_lock);
958 ixa_refrele(ixa);
959 break;
960 }
961 case ICMP_PORT_UNREACHABLE:
962 case ICMP_PROTOCOL_UNREACHABLE:
963 error = ECONNREFUSED;
964 break;
965 default:
966 /* Transient errors */
967 break;
968 }
969 break;
970 default:
971 /* Transient errors */
972 break;
973 }
974 if (error == 0) {
975 freemsg(mp);
976 return;
977 }
978
979 /*
980 * Deliver T_UDERROR_IND when the application has asked for it.
981 * The socket layer enables this automatically when connected.
982 */
983 if (!connp->conn_dgram_errind) {
984 freemsg(mp);
985 return;
986 }
987
988 switch (connp->conn_family) {
989 case AF_INET:
990 sin = sin_null;
991 sin.sin_family = AF_INET;
992 sin.sin_addr.s_addr = ipha->ipha_dst;
993 sin.sin_port = udpha->uha_dst_port;
994 if (IPCL_IS_NONSTR(connp)) {
995 mutex_enter(&connp->conn_lock);
996 if (udp->udp_state == TS_DATA_XFER) {
997 if (sin.sin_port == connp->conn_fport &&
998 sin.sin_addr.s_addr ==
999 connp->conn_faddr_v4) {
1000 mutex_exit(&connp->conn_lock);
1001 (*connp->conn_upcalls->su_set_error)
1002 (connp->conn_upper_handle, error);
1003 goto done;
1004 }
1005 } else {
1006 udp->udp_delayed_error = error;
1007 *((sin_t *)&udp->udp_delayed_addr) = sin;
1008 }
1009 mutex_exit(&connp->conn_lock);
1010 } else {
1011 mp1 = mi_tpi_uderror_ind((char *)&sin, sizeof (sin_t),
1012 NULL, 0, error);
1013 if (mp1 != NULL)
1014 putnext(connp->conn_rq, mp1);
1015 }
1016 break;
1017 case AF_INET6:
1018 sin6 = sin6_null;
1019 sin6.sin6_family = AF_INET6;
1020 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6.sin6_addr);
1021 sin6.sin6_port = udpha->uha_dst_port;
1022 if (IPCL_IS_NONSTR(connp)) {
1023 mutex_enter(&connp->conn_lock);
1024 if (udp->udp_state == TS_DATA_XFER) {
1025 if (sin6.sin6_port == connp->conn_fport &&
1026 IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1027 &connp->conn_faddr_v6)) {
1028 mutex_exit(&connp->conn_lock);
1029 (*connp->conn_upcalls->su_set_error)
1030 (connp->conn_upper_handle, error);
1031 goto done;
1032 }
1033 } else {
1034 udp->udp_delayed_error = error;
1035 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1036 }
1037 mutex_exit(&connp->conn_lock);
1038 } else {
1039 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1040 NULL, 0, error);
1041 if (mp1 != NULL)
1042 putnext(connp->conn_rq, mp1);
1043 }
1044 break;
1045 }
1046 done:
1047 freemsg(mp);
1048 }
1049
1050 /*
1051 * udp_icmp_error_ipv6 is called by udp_icmp_error to process ICMP for IPv6.
1052 * Generates the appropriate T_UDERROR_IND for permanent (non-transient) errors.
1053 * Assumes that IP has pulled up all the extension headers as well as the
1054 * ICMPv6 header.
1055 */
1056 static void
1057 udp_icmp_error_ipv6(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira)
1058 {
1059 icmp6_t *icmp6;
1060 ip6_t *ip6h, *outer_ip6h;
1061 uint16_t iph_hdr_length;
1062 uint8_t *nexthdrp;
1063 udpha_t *udpha;
1064 sin6_t sin6;
1065 mblk_t *mp1;
1066 int error = 0;
1067 udp_t *udp = connp->conn_udp;
1068 udp_stack_t *us = udp->udp_us;
1069
1070 outer_ip6h = (ip6_t *)mp->b_rptr;
1071 #ifdef DEBUG
1072 if (outer_ip6h->ip6_nxt != IPPROTO_ICMPV6)
1073 iph_hdr_length = ip_hdr_length_v6(mp, outer_ip6h);
1074 else
1075 iph_hdr_length = IPV6_HDR_LEN;
1076 ASSERT(iph_hdr_length == ira->ira_ip_hdr_length);
1077 #endif
1078 /* Skip past the outer IP and ICMP headers */
1079 iph_hdr_length = ira->ira_ip_hdr_length;
1080 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1081
1082 /* Skip past the inner IP and find the ULP header */
1083 ip6h = (ip6_t *)&icmp6[1]; /* Inner IP header */
1084 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1085 freemsg(mp);
1086 return;
1087 }
1088 udpha = (udpha_t *)((char *)ip6h + iph_hdr_length);
1089
1090 switch (icmp6->icmp6_type) {
1091 case ICMP6_DST_UNREACH:
1092 switch (icmp6->icmp6_code) {
1093 case ICMP6_DST_UNREACH_NOPORT:
1094 error = ECONNREFUSED;
1095 break;
1096 case ICMP6_DST_UNREACH_ADMIN:
1097 case ICMP6_DST_UNREACH_NOROUTE:
1098 case ICMP6_DST_UNREACH_BEYONDSCOPE:
1099 case ICMP6_DST_UNREACH_ADDR:
1100 /* Transient errors */
1101 break;
1102 default:
1103 break;
1104 }
1105 break;
1106 case ICMP6_PACKET_TOO_BIG: {
1107 struct T_unitdata_ind *tudi;
1108 struct T_opthdr *toh;
1109 size_t udi_size;
1110 mblk_t *newmp;
1111 t_scalar_t opt_length = sizeof (struct T_opthdr) +
1112 sizeof (struct ip6_mtuinfo);
1113 sin6_t *sin6;
1114 struct ip6_mtuinfo *mtuinfo;
1115
1116 /*
1117 * If the application has requested to receive path mtu
1118 * information, send up an empty message containing an
1119 * IPV6_PATHMTU ancillary data item.
1120 */
1121 if (!connp->conn_ipv6_recvpathmtu)
1122 break;
1123
1124 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t) +
1125 opt_length;
1126 if ((newmp = allocb(udi_size, BPRI_MED)) == NULL) {
1127 UDPS_BUMP_MIB(us, udpInErrors);
1128 break;
1129 }
1130
1131 /*
1132 * newmp->b_cont is left to NULL on purpose. This is an
1133 * empty message containing only ancillary data.
1134 */
1135 newmp->b_datap->db_type = M_PROTO;
1136 tudi = (struct T_unitdata_ind *)newmp->b_rptr;
1137 newmp->b_wptr = (uchar_t *)tudi + udi_size;
1138 tudi->PRIM_type = T_UNITDATA_IND;
1139 tudi->SRC_length = sizeof (sin6_t);
1140 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
1141 tudi->OPT_offset = tudi->SRC_offset + sizeof (sin6_t);
1142 tudi->OPT_length = opt_length;
1143
1144 sin6 = (sin6_t *)&tudi[1];
1145 bzero(sin6, sizeof (sin6_t));
1146 sin6->sin6_family = AF_INET6;
1147 sin6->sin6_addr = connp->conn_faddr_v6;
1148
1149 toh = (struct T_opthdr *)&sin6[1];
1150 toh->level = IPPROTO_IPV6;
1151 toh->name = IPV6_PATHMTU;
1152 toh->len = opt_length;
1153 toh->status = 0;
1154
1155 mtuinfo = (struct ip6_mtuinfo *)&toh[1];
1156 bzero(mtuinfo, sizeof (struct ip6_mtuinfo));
1157 mtuinfo->ip6m_addr.sin6_family = AF_INET6;
1158 mtuinfo->ip6m_addr.sin6_addr = ip6h->ip6_dst;
1159 mtuinfo->ip6m_mtu = icmp6->icmp6_mtu;
1160 /*
1161 * We've consumed everything we need from the original
1162 * message. Free it, then send our empty message.
1163 */
1164 freemsg(mp);
1165 udp_ulp_recv(connp, newmp, msgdsize(newmp), ira);
1166 return;
1167 }
1168 case ICMP6_TIME_EXCEEDED:
1169 /* Transient errors */
1170 break;
1171 case ICMP6_PARAM_PROB:
1172 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1173 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1174 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1175 (uchar_t *)nexthdrp) {
1176 error = ECONNREFUSED;
1177 break;
1178 }
1179 break;
1180 }
1181 if (error == 0) {
1182 freemsg(mp);
1183 return;
1184 }
1185
1186 /*
1187 * Deliver T_UDERROR_IND when the application has asked for it.
1188 * The socket layer enables this automatically when connected.
1189 */
1190 if (!connp->conn_dgram_errind) {
1191 freemsg(mp);
1192 return;
1193 }
1194
1195 sin6 = sin6_null;
1196 sin6.sin6_family = AF_INET6;
1197 sin6.sin6_addr = ip6h->ip6_dst;
1198 sin6.sin6_port = udpha->uha_dst_port;
1199 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1200
1201 if (IPCL_IS_NONSTR(connp)) {
1202 mutex_enter(&connp->conn_lock);
1203 if (udp->udp_state == TS_DATA_XFER) {
1204 if (sin6.sin6_port == connp->conn_fport &&
1205 IN6_ARE_ADDR_EQUAL(&sin6.sin6_addr,
1206 &connp->conn_faddr_v6)) {
1207 mutex_exit(&connp->conn_lock);
1208 (*connp->conn_upcalls->su_set_error)
1209 (connp->conn_upper_handle, error);
1210 goto done;
1211 }
1212 } else {
1213 udp->udp_delayed_error = error;
1214 *((sin6_t *)&udp->udp_delayed_addr) = sin6;
1215 }
1216 mutex_exit(&connp->conn_lock);
1217 } else {
1218 mp1 = mi_tpi_uderror_ind((char *)&sin6, sizeof (sin6_t),
1219 NULL, 0, error);
1220 if (mp1 != NULL)
1221 putnext(connp->conn_rq, mp1);
1222 }
1223 done:
1224 freemsg(mp);
1225 }
1226
1227 /*
1228 * This routine responds to T_ADDR_REQ messages. It is called by udp_wput.
1229 * The local address is filled in if endpoint is bound. The remote address
1230 * is filled in if remote address has been precified ("connected endpoint")
1231 * (The concept of connected CLTS sockets is alien to published TPI
1232 * but we support it anyway).
1233 */
1234 static void
1235 udp_addr_req(queue_t *q, mblk_t *mp)
1236 {
1237 struct sockaddr *sa;
1238 mblk_t *ackmp;
1239 struct T_addr_ack *taa;
1240 udp_t *udp = Q_TO_UDP(q);
1241 conn_t *connp = udp->udp_connp;
1242 uint_t addrlen;
1243
1244 /* Make it large enough for worst case */
1245 ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
1246 2 * sizeof (sin6_t), 1);
1247 if (ackmp == NULL) {
1248 udp_err_ack(q, mp, TSYSERR, ENOMEM);
1249 return;
1250 }
1251 taa = (struct T_addr_ack *)ackmp->b_rptr;
1252
1253 bzero(taa, sizeof (struct T_addr_ack));
1254 ackmp->b_wptr = (uchar_t *)&taa[1];
1255
1256 taa->PRIM_type = T_ADDR_ACK;
1257 ackmp->b_datap->db_type = M_PCPROTO;
1258
1259 if (connp->conn_family == AF_INET)
1260 addrlen = sizeof (sin_t);
1261 else
1262 addrlen = sizeof (sin6_t);
1263
1264 mutex_enter(&connp->conn_lock);
1265 /*
1266 * Note: Following code assumes 32 bit alignment of basic
1267 * data structures like sin_t and struct T_addr_ack.
1268 */
1269 if (udp->udp_state != TS_UNBND) {
1270 /*
1271 * Fill in local address first
1272 */
1273 taa->LOCADDR_offset = sizeof (*taa);
1274 taa->LOCADDR_length = addrlen;
1275 sa = (struct sockaddr *)&taa[1];
1276 (void) conn_getsockname(connp, sa, &addrlen);
1277 ackmp->b_wptr += addrlen;
1278 }
1279 if (udp->udp_state == TS_DATA_XFER) {
1280 /*
1281 * connected, fill remote address too
1282 */
1283 taa->REMADDR_length = addrlen;
1284 /* assumed 32-bit alignment */
1285 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length;
1286 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset);
1287 (void) conn_getpeername(connp, sa, &addrlen);
1288 ackmp->b_wptr += addrlen;
1289 }
1290 mutex_exit(&connp->conn_lock);
1291 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
1292 qreply(q, ackmp);
1293 }
1294
1295 static void
1296 udp_copy_info(struct T_info_ack *tap, udp_t *udp)
1297 {
1298 conn_t *connp = udp->udp_connp;
1299
1300 if (connp->conn_family == AF_INET) {
1301 *tap = udp_g_t_info_ack_ipv4;
1302 } else {
1303 *tap = udp_g_t_info_ack_ipv6;
1304 }
1305 tap->CURRENT_state = udp->udp_state;
1306 tap->OPT_size = udp_max_optsize;
1307 }
1308
1309 static void
1310 udp_do_capability_ack(udp_t *udp, struct T_capability_ack *tcap,
1311 t_uscalar_t cap_bits1)
1312 {
1313 tcap->CAP_bits1 = 0;
1314
1315 if (cap_bits1 & TC1_INFO) {
1316 udp_copy_info(&tcap->INFO_ack, udp);
1317 tcap->CAP_bits1 |= TC1_INFO;
1318 }
1319 }
1320
1321 /*
1322 * This routine responds to T_CAPABILITY_REQ messages. It is called by
1323 * udp_wput. Much of the T_CAPABILITY_ACK information is copied from
1324 * udp_g_t_info_ack. The current state of the stream is copied from
1325 * udp_state.
1326 */
1327 static void
1328 udp_capability_req(queue_t *q, mblk_t *mp)
1329 {
1330 t_uscalar_t cap_bits1;
1331 struct T_capability_ack *tcap;
1332 udp_t *udp = Q_TO_UDP(q);
1333
1334 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
1335
1336 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
1337 mp->b_datap->db_type, T_CAPABILITY_ACK);
1338 if (!mp)
1339 return;
1340
1341 tcap = (struct T_capability_ack *)mp->b_rptr;
1342 udp_do_capability_ack(udp, tcap, cap_bits1);
1343
1344 qreply(q, mp);
1345 }
1346
1347 /*
1348 * This routine responds to T_INFO_REQ messages. It is called by udp_wput.
1349 * Most of the T_INFO_ACK information is copied from udp_g_t_info_ack.
1350 * The current state of the stream is copied from udp_state.
1351 */
1352 static void
1353 udp_info_req(queue_t *q, mblk_t *mp)
1354 {
1355 udp_t *udp = Q_TO_UDP(q);
1356
1357 /* Create a T_INFO_ACK message. */
1358 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
1359 T_INFO_ACK);
1360 if (!mp)
1361 return;
1362 udp_copy_info((struct T_info_ack *)mp->b_rptr, udp);
1363 qreply(q, mp);
1364 }
1365
1366 /* For /dev/udp aka AF_INET open */
1367 static int
1368 udp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1369 {
1370 return (udp_open(q, devp, flag, sflag, credp, B_FALSE));
1371 }
1372
1373 /* For /dev/udp6 aka AF_INET6 open */
1374 static int
1375 udp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
1376 {
1377 return (udp_open(q, devp, flag, sflag, credp, B_TRUE));
1378 }
1379
1380 /*
1381 * This is the open routine for udp. It allocates a udp_t structure for
1382 * the stream and, on the first open of the module, creates an ND table.
1383 */
1384 static int
1385 udp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
1386 boolean_t isv6)
1387 {
1388 udp_t *udp;
1389 conn_t *connp;
1390 dev_t conn_dev;
1391 vmem_t *minor_arena;
1392 int err;
1393
1394 /* If the stream is already open, return immediately. */
1395 if (q->q_ptr != NULL)
1396 return (0);
1397
1398 if (sflag == MODOPEN)
1399 return (EINVAL);
1400
1401 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
1402 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
1403 minor_arena = ip_minor_arena_la;
1404 } else {
1405 /*
1406 * Either minor numbers in the large arena were exhausted
1407 * or a non socket application is doing the open.
1408 * Try to allocate from the small arena.
1409 */
1410 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0)
1411 return (EBUSY);
1412
1413 minor_arena = ip_minor_arena_sa;
1414 }
1415
1416 if (flag & SO_FALLBACK) {
1417 /*
1418 * Non streams socket needs a stream to fallback to
1419 */
1420 RD(q)->q_ptr = (void *)conn_dev;
1421 WR(q)->q_qinfo = &udp_fallback_sock_winit;
1422 WR(q)->q_ptr = (void *)minor_arena;
1423 qprocson(q);
1424 return (0);
1425 }
1426
1427 connp = udp_do_open(credp, isv6, KM_SLEEP, &err);
1428 if (connp == NULL) {
1429 inet_minor_free(minor_arena, conn_dev);
1430 return (err);
1431 }
1432 udp = connp->conn_udp;
1433
1434 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
1435 connp->conn_dev = conn_dev;
1436 connp->conn_minor_arena = minor_arena;
1437
1438 /*
1439 * Initialize the udp_t structure for this stream.
1440 */
1441 q->q_ptr = connp;
1442 WR(q)->q_ptr = connp;
1443 connp->conn_rq = q;
1444 connp->conn_wq = WR(q);
1445
1446 /*
1447 * Since this conn_t/udp_t is not yet visible to anybody else we don't
1448 * need to lock anything.
1449 */
1450 ASSERT(connp->conn_proto == IPPROTO_UDP);
1451 ASSERT(connp->conn_udp == udp);
1452 ASSERT(udp->udp_connp == connp);
1453
1454 if (flag & SO_SOCKSTR) {
1455 udp->udp_issocket = B_TRUE;
1456 }
1457
1458 WR(q)->q_hiwat = connp->conn_sndbuf;
1459 WR(q)->q_lowat = connp->conn_sndlowat;
1460
1461 qprocson(q);
1462
1463 /* Set the Stream head write offset and high watermark. */
1464 (void) proto_set_tx_wroff(q, connp, connp->conn_wroff);
1465 (void) proto_set_rx_hiwat(q, connp,
1466 udp_set_rcv_hiwat(udp, connp->conn_rcvbuf));
1467
1468 mutex_enter(&connp->conn_lock);
1469 connp->conn_state_flags &= ~CONN_INCIPIENT;
1470 mutex_exit(&connp->conn_lock);
1471 return (0);
1472 }
1473
1474 /*
1475 * Which UDP options OK to set through T_UNITDATA_REQ...
1476 */
1477 /* ARGSUSED */
1478 static boolean_t
1479 udp_opt_allow_udr_set(t_scalar_t level, t_scalar_t name)
1480 {
1481 return (B_TRUE);
1482 }
1483
1484 /*
1485 * This routine gets default values of certain options whose default
1486 * values are maintained by protcol specific code
1487 */
1488 int
1489 udp_opt_default(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1490 {
1491 udp_t *udp = Q_TO_UDP(q);
1492 udp_stack_t *us = udp->udp_us;
1493 int *i1 = (int *)ptr;
1494
1495 switch (level) {
1496 case IPPROTO_IP:
1497 switch (name) {
1498 case IP_MULTICAST_TTL:
1499 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_TTL;
1500 return (sizeof (uchar_t));
1501 case IP_MULTICAST_LOOP:
1502 *ptr = (uchar_t)IP_DEFAULT_MULTICAST_LOOP;
1503 return (sizeof (uchar_t));
1504 }
1505 break;
1506 case IPPROTO_IPV6:
1507 switch (name) {
1508 case IPV6_MULTICAST_HOPS:
1509 *i1 = IP_DEFAULT_MULTICAST_TTL;
1510 return (sizeof (int));
1511 case IPV6_MULTICAST_LOOP:
1512 *i1 = IP_DEFAULT_MULTICAST_LOOP;
1513 return (sizeof (int));
1514 case IPV6_UNICAST_HOPS:
1515 *i1 = us->us_ipv6_hoplimit;
1516 return (sizeof (int));
1517 }
1518 break;
1519 }
1520 return (-1);
1521 }
1522
1523 /*
1524 * This routine retrieves the current status of socket options.
1525 * It returns the size of the option retrieved, or -1.
1526 */
1527 int
1528 udp_opt_get(conn_t *connp, t_scalar_t level, t_scalar_t name,
1529 uchar_t *ptr)
1530 {
1531 int *i1 = (int *)ptr;
1532 udp_t *udp = connp->conn_udp;
1533 int len;
1534 conn_opt_arg_t coas;
1535 int retval;
1536
1537 coas.coa_connp = connp;
1538 coas.coa_ixa = connp->conn_ixa;
1539 coas.coa_ipp = &connp->conn_xmit_ipp;
1540 coas.coa_ancillary = B_FALSE;
1541 coas.coa_changed = 0;
1542
1543 /*
1544 * We assume that the optcom framework has checked for the set
1545 * of levels and names that are supported, hence we don't worry
1546 * about rejecting based on that.
1547 * First check for UDP specific handling, then pass to common routine.
1548 */
1549 switch (level) {
1550 case IPPROTO_IP:
1551 /*
1552 * Only allow IPv4 option processing on IPv4 sockets.
1553 */
1554 if (connp->conn_family != AF_INET)
1555 return (-1);
1556
1557 switch (name) {
1558 case IP_OPTIONS:
1559 case T_IP_OPTIONS:
1560 mutex_enter(&connp->conn_lock);
1561 if (!(udp->udp_recv_ipp.ipp_fields &
1562 IPPF_IPV4_OPTIONS)) {
1563 mutex_exit(&connp->conn_lock);
1564 return (0);
1565 }
1566
1567 len = udp->udp_recv_ipp.ipp_ipv4_options_len;
1568 ASSERT(len != 0);
1569 bcopy(udp->udp_recv_ipp.ipp_ipv4_options, ptr, len);
1570 mutex_exit(&connp->conn_lock);
1571 return (len);
1572 }
1573 break;
1574 case IPPROTO_UDP:
1575 switch (name) {
1576 case UDP_NAT_T_ENDPOINT:
1577 mutex_enter(&connp->conn_lock);
1578 *i1 = udp->udp_nat_t_endpoint;
1579 mutex_exit(&connp->conn_lock);
1580 return (sizeof (int));
1581 case UDP_RCVHDR:
1582 mutex_enter(&connp->conn_lock);
1583 *i1 = udp->udp_rcvhdr ? 1 : 0;
1584 mutex_exit(&connp->conn_lock);
1585 return (sizeof (int));
1586 case UDP_SND_TO_CONNECTED:
1587 mutex_enter(&connp->conn_lock);
1588 *i1 = udp->udp_snd_to_conn ? 1 : 0;
1589 mutex_exit(&connp->conn_lock);
1590 return (sizeof (int));
1591 }
1592 }
1593 mutex_enter(&connp->conn_lock);
1594 retval = conn_opt_get(&coas, level, name, ptr);
1595 mutex_exit(&connp->conn_lock);
1596 return (retval);
1597 }
1598
1599 /*
1600 * This routine retrieves the current status of socket options.
1601 * It returns the size of the option retrieved, or -1.
1602 */
1603 int
1604 udp_tpi_opt_get(queue_t *q, t_scalar_t level, t_scalar_t name, uchar_t *ptr)
1605 {
1606 conn_t *connp = Q_TO_CONN(q);
1607 int err;
1608
1609 err = udp_opt_get(connp, level, name, ptr);
1610 return (err);
1611 }
1612
1613 /*
1614 * This routine sets socket options.
1615 */
1616 int
1617 udp_do_opt_set(conn_opt_arg_t *coa, int level, int name,
1618 uint_t inlen, uchar_t *invalp, cred_t *cr, boolean_t checkonly)
1619 {
1620 conn_t *connp = coa->coa_connp;
1621 ip_xmit_attr_t *ixa = coa->coa_ixa;
1622 udp_t *udp = connp->conn_udp;
1623 udp_stack_t *us = udp->udp_us;
1624 int *i1 = (int *)invalp;
1625 boolean_t onoff = (*i1 == 0) ? 0 : 1;
1626 int error;
1627
1628 ASSERT(MUTEX_NOT_HELD(&coa->coa_connp->conn_lock));
1629 /*
1630 * First do UDP specific sanity checks and handle UDP specific
1631 * options. Note that some IPPROTO_UDP options are handled
1632 * by conn_opt_set.
1633 */
1634 switch (level) {
1635 case SOL_SOCKET:
1636 switch (name) {
1637 case SO_SNDBUF:
1638 if (*i1 > us->us_max_buf) {
1639 return (ENOBUFS);
1640 }
1641 break;
1642 case SO_RCVBUF:
1643 if (*i1 > us->us_max_buf) {
1644 return (ENOBUFS);
1645 }
1646 break;
1647
1648 case SCM_UCRED: {
1649 struct ucred_s *ucr;
1650 cred_t *newcr;
1651 ts_label_t *tsl;
1652
1653 /*
1654 * Only sockets that have proper privileges and are
1655 * bound to MLPs will have any other value here, so
1656 * this implicitly tests for privilege to set label.
1657 */
1658 if (connp->conn_mlp_type == mlptSingle)
1659 break;
1660
1661 ucr = (struct ucred_s *)invalp;
1662 if (inlen < sizeof (*ucr) + sizeof (bslabel_t) ||
1663 ucr->uc_labeloff < sizeof (*ucr) ||
1664 ucr->uc_labeloff + sizeof (bslabel_t) > inlen)
1665 return (EINVAL);
1666 if (!checkonly) {
1667 /*
1668 * Set ixa_tsl to the new label.
1669 * We assume that crgetzoneid doesn't change
1670 * as part of the SCM_UCRED.
1671 */
1672 ASSERT(cr != NULL);
1673 if ((tsl = crgetlabel(cr)) == NULL)
1674 return (EINVAL);
1675 newcr = copycred_from_bslabel(cr, UCLABEL(ucr),
1676 tsl->tsl_doi, KM_NOSLEEP);
1677 if (newcr == NULL)
1678 return (ENOSR);
1679 ASSERT(newcr->cr_label != NULL);
1680 /*
1681 * Move the hold on the cr_label to ixa_tsl by
1682 * setting cr_label to NULL. Then release newcr.
1683 */
1684 ip_xmit_attr_replace_tsl(ixa, newcr->cr_label);
1685 ixa->ixa_flags |= IXAF_UCRED_TSL;
1686 newcr->cr_label = NULL;
1687 crfree(newcr);
1688 coa->coa_changed |= COA_HEADER_CHANGED;
1689 coa->coa_changed |= COA_WROFF_CHANGED;
1690 }
1691 /* Fully handled this option. */
1692 return (0);
1693 }
1694 }
1695 break;
1696 case IPPROTO_UDP:
1697 switch (name) {
1698 case UDP_NAT_T_ENDPOINT:
1699 if ((error = secpolicy_ip_config(cr, B_FALSE)) != 0) {
1700 return (error);
1701 }
1702
1703 /*
1704 * Use conn_family instead so we can avoid ambiguitites
1705 * with AF_INET6 sockets that may switch from IPv4
1706 * to IPv6.
1707 */
1708 if (connp->conn_family != AF_INET) {
1709 return (EAFNOSUPPORT);
1710 }
1711
1712 if (!checkonly) {
1713 mutex_enter(&connp->conn_lock);
1714 udp->udp_nat_t_endpoint = onoff;
1715 mutex_exit(&connp->conn_lock);
1716 coa->coa_changed |= COA_HEADER_CHANGED;
1717 coa->coa_changed |= COA_WROFF_CHANGED;
1718 }
1719 /* Fully handled this option. */
1720 return (0);
1721 case UDP_RCVHDR:
1722 mutex_enter(&connp->conn_lock);
1723 udp->udp_rcvhdr = onoff;
1724 mutex_exit(&connp->conn_lock);
1725 return (0);
1726 case UDP_SND_TO_CONNECTED:
1727 mutex_enter(&connp->conn_lock);
1728 udp->udp_snd_to_conn = onoff;
1729 mutex_exit(&connp->conn_lock);
1730 return (0);
1731 }
1732 break;
1733 }
1734 error = conn_opt_set(coa, level, name, inlen, invalp,
1735 checkonly, cr);
1736 return (error);
1737 }
1738
1739 /*
1740 * This routine sets socket options.
1741 */
1742 int
1743 udp_opt_set(conn_t *connp, uint_t optset_context, int level,
1744 int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
1745 uchar_t *outvalp, void *thisdg_attrs, cred_t *cr)
1746 {
1747 udp_t *udp = connp->conn_udp;
1748 int err;
1749 conn_opt_arg_t coas, *coa;
1750 boolean_t checkonly;
1751 udp_stack_t *us = udp->udp_us;
1752
1753 switch (optset_context) {
1754 case SETFN_OPTCOM_CHECKONLY:
1755 checkonly = B_TRUE;
1756 /*
1757 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
1758 * inlen != 0 implies value supplied and
1759 * we have to "pretend" to set it.
1760 * inlen == 0 implies that there is no
1761 * value part in T_CHECK request and just validation
1762 * done elsewhere should be enough, we just return here.
1763 */
1764 if (inlen == 0) {
1765 *outlenp = 0;
1766 return (0);
1767 }
1768 break;
1769 case SETFN_OPTCOM_NEGOTIATE:
1770 checkonly = B_FALSE;
1771 break;
1772 case SETFN_UD_NEGOTIATE:
1773 case SETFN_CONN_NEGOTIATE:
1774 checkonly = B_FALSE;
1775 /*
1776 * Negotiating local and "association-related" options
1777 * through T_UNITDATA_REQ.
1778 *
1779 * Following routine can filter out ones we do not
1780 * want to be "set" this way.
1781 */
1782 if (!udp_opt_allow_udr_set(level, name)) {
1783 *outlenp = 0;
1784 return (EINVAL);
1785 }
1786 break;
1787 default:
1788 /*
1789 * We should never get here
1790 */
1791 *outlenp = 0;
1792 return (EINVAL);
1793 }
1794
1795 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
1796 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
1797
1798 if (thisdg_attrs != NULL) {
1799 /* Options from T_UNITDATA_REQ */
1800 coa = (conn_opt_arg_t *)thisdg_attrs;
1801 ASSERT(coa->coa_connp == connp);
1802 ASSERT(coa->coa_ixa != NULL);
1803 ASSERT(coa->coa_ipp != NULL);
1804 ASSERT(coa->coa_ancillary);
1805 } else {
1806 coa = &coas;
1807 coas.coa_connp = connp;
1808 /* Get a reference on conn_ixa to prevent concurrent mods */
1809 coas.coa_ixa = conn_get_ixa(connp, B_TRUE);
1810 if (coas.coa_ixa == NULL) {
1811 *outlenp = 0;
1812 return (ENOMEM);
1813 }
1814 coas.coa_ipp = &connp->conn_xmit_ipp;
1815 coas.coa_ancillary = B_FALSE;
1816 coas.coa_changed = 0;
1817 }
1818
1819 err = udp_do_opt_set(coa, level, name, inlen, invalp,
1820 cr, checkonly);
1821 if (err != 0) {
1822 errout:
1823 if (!coa->coa_ancillary)
1824 ixa_refrele(coa->coa_ixa);
1825 *outlenp = 0;
1826 return (err);
1827 }
1828 /* Handle DHCPINIT here outside of lock */
1829 if (level == IPPROTO_IP && name == IP_DHCPINIT_IF) {
1830 uint_t ifindex;
1831 ill_t *ill;
1832
1833 ifindex = *(uint_t *)invalp;
1834 if (ifindex == 0) {
1835 ill = NULL;
1836 } else {
1837 ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1838 coa->coa_ixa->ixa_ipst);
1839 if (ill == NULL) {
1840 err = ENXIO;
1841 goto errout;
1842 }
1843
1844 mutex_enter(&ill->ill_lock);
1845 if (ill->ill_state_flags & ILL_CONDEMNED) {
1846 mutex_exit(&ill->ill_lock);
1847 ill_refrele(ill);
1848 err = ENXIO;
1849 goto errout;
1850 }
1851 if (IS_VNI(ill)) {
1852 mutex_exit(&ill->ill_lock);
1853 ill_refrele(ill);
1854 err = EINVAL;
1855 goto errout;
1856 }
1857 }
1858 mutex_enter(&connp->conn_lock);
1859
1860 if (connp->conn_dhcpinit_ill != NULL) {
1861 /*
1862 * We've locked the conn so conn_cleanup_ill()
1863 * cannot clear conn_dhcpinit_ill -- so it's
1864 * safe to access the ill.
1865 */
1866 ill_t *oill = connp->conn_dhcpinit_ill;
1867
1868 ASSERT(oill->ill_dhcpinit != 0);
1869 atomic_dec_32(&oill->ill_dhcpinit);
1870 ill_set_inputfn(connp->conn_dhcpinit_ill);
1871 connp->conn_dhcpinit_ill = NULL;
1872 }
1873
1874 if (ill != NULL) {
1875 connp->conn_dhcpinit_ill = ill;
1876 atomic_inc_32(&ill->ill_dhcpinit);
1877 ill_set_inputfn(ill);
1878 mutex_exit(&connp->conn_lock);
1879 mutex_exit(&ill->ill_lock);
1880 ill_refrele(ill);
1881 } else {
1882 mutex_exit(&connp->conn_lock);
1883 }
1884 }
1885
1886 /*
1887 * Common case of OK return with outval same as inval.
1888 */
1889 if (invalp != outvalp) {
1890 /* don't trust bcopy for identical src/dst */
1891 (void) bcopy(invalp, outvalp, inlen);
1892 }
1893 *outlenp = inlen;
1894
1895 /*
1896 * If this was not ancillary data, then we rebuild the headers,
1897 * update the IRE/NCE, and IPsec as needed.
1898 * Since the label depends on the destination we go through
1899 * ip_set_destination first.
1900 */
1901 if (coa->coa_ancillary) {
1902 return (0);
1903 }
1904
1905 if (coa->coa_changed & COA_ROUTE_CHANGED) {
1906 in6_addr_t saddr, faddr, nexthop;
1907 in_port_t fport;
1908
1909 /*
1910 * We clear lastdst to make sure we pick up the change
1911 * next time sending.
1912 * If we are connected we re-cache the information.
1913 * We ignore errors to preserve BSD behavior.
1914 * Note that we don't redo IPsec policy lookup here
1915 * since the final destination (or source) didn't change.
1916 */
1917 mutex_enter(&connp->conn_lock);
1918 connp->conn_v6lastdst = ipv6_all_zeros;
1919
1920 ip_attr_nexthop(coa->coa_ipp, coa->coa_ixa,
1921 &connp->conn_faddr_v6, &nexthop);
1922 saddr = connp->conn_saddr_v6;
1923 faddr = connp->conn_faddr_v6;
1924 fport = connp->conn_fport;
1925 mutex_exit(&connp->conn_lock);
1926
1927 if (!IN6_IS_ADDR_UNSPECIFIED(&faddr) &&
1928 !IN6_IS_ADDR_V4MAPPED_ANY(&faddr)) {
1929 (void) ip_attr_connect(connp, coa->coa_ixa,
1930 &saddr, &faddr, &nexthop, fport, NULL, NULL,
1931 IPDF_ALLOW_MCBC | IPDF_VERIFY_DST);
1932 }
1933 }
1934
1935 ixa_refrele(coa->coa_ixa);
1936
1937 if (coa->coa_changed & COA_HEADER_CHANGED) {
1938 /*
1939 * Rebuild the header template if we are connected.
1940 * Otherwise clear conn_v6lastdst so we rebuild the header
1941 * in the data path.
1942 */
1943 mutex_enter(&connp->conn_lock);
1944 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) &&
1945 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) {
1946 err = udp_build_hdr_template(connp,
1947 &connp->conn_saddr_v6, &connp->conn_faddr_v6,
1948 connp->conn_fport, connp->conn_flowinfo);
1949 if (err != 0) {
1950 mutex_exit(&connp->conn_lock);
1951 return (err);
1952 }
1953 } else {
1954 connp->conn_v6lastdst = ipv6_all_zeros;
1955 }
1956 mutex_exit(&connp->conn_lock);
1957 }
1958 if (coa->coa_changed & COA_RCVBUF_CHANGED) {
1959 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
1960 connp->conn_rcvbuf);
1961 }
1962 if ((coa->coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) {
1963 connp->conn_wq->q_hiwat = connp->conn_sndbuf;
1964 }
1965 if (coa->coa_changed & COA_WROFF_CHANGED) {
1966 /* Increase wroff if needed */
1967 uint_t wroff;
1968
1969 mutex_enter(&connp->conn_lock);
1970 wroff = connp->conn_ht_iphc_allocated + us->us_wroff_extra;
1971 if (udp->udp_nat_t_endpoint)
1972 wroff += sizeof (uint32_t);
1973 if (wroff > connp->conn_wroff) {
1974 connp->conn_wroff = wroff;
1975 mutex_exit(&connp->conn_lock);
1976 (void) proto_set_tx_wroff(connp->conn_rq, connp, wroff);
1977 } else {
1978 mutex_exit(&connp->conn_lock);
1979 }
1980 }
1981 return (err);
1982 }
1983
1984 /* This routine sets socket options. */
1985 int
1986 udp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name,
1987 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
1988 void *thisdg_attrs, cred_t *cr)
1989 {
1990 conn_t *connp = Q_TO_CONN(q);
1991 int error;
1992
1993 error = udp_opt_set(connp, optset_context, level, name, inlen, invalp,
1994 outlenp, outvalp, thisdg_attrs, cr);
1995 return (error);
1996 }
1997
1998 /*
1999 * Setup IP and UDP headers.
2000 * Returns NULL on allocation failure, in which case data_mp is freed.
2001 */
2002 mblk_t *
2003 udp_prepend_hdr(conn_t *connp, ip_xmit_attr_t *ixa, const ip_pkt_t *ipp,
2004 const in6_addr_t *v6src, const in6_addr_t *v6dst, in_port_t dstport,
2005 uint32_t flowinfo, mblk_t *data_mp, int *errorp)
2006 {
2007 mblk_t *mp;
2008 udpha_t *udpha;
2009 udp_stack_t *us = connp->conn_netstack->netstack_udp;
2010 uint_t data_len;
2011 uint32_t cksum;
2012 udp_t *udp = connp->conn_udp;
2013 boolean_t insert_spi = udp->udp_nat_t_endpoint;
2014 uint_t ulp_hdr_len;
2015
2016 data_len = msgdsize(data_mp);
2017 ulp_hdr_len = UDPH_SIZE;
2018 if (insert_spi)
2019 ulp_hdr_len += sizeof (uint32_t);
2020
2021 mp = conn_prepend_hdr(ixa, ipp, v6src, v6dst, IPPROTO_UDP, flowinfo,
2022 ulp_hdr_len, data_mp, data_len, us->us_wroff_extra, &cksum, errorp);
2023 if (mp == NULL) {
2024 ASSERT(*errorp != 0);
2025 return (NULL);
2026 }
2027
2028 data_len += ulp_hdr_len;
2029 ixa->ixa_pktlen = data_len + ixa->ixa_ip_hdr_length;
2030
2031 udpha = (udpha_t *)(mp->b_rptr + ixa->ixa_ip_hdr_length);
2032 udpha->uha_src_port = connp->conn_lport;
2033 udpha->uha_dst_port = dstport;
2034 udpha->uha_checksum = 0;
2035 udpha->uha_length = htons(data_len);
2036
2037 /*
2038 * If there was a routing option/header then conn_prepend_hdr
2039 * has massaged it and placed the pseudo-header checksum difference
2040 * in the cksum argument.
2041 *
2042 * Setup header length and prepare for ULP checksum done in IP.
2043 *
2044 * We make it easy for IP to include our pseudo header
2045 * by putting our length in uha_checksum.
2046 * The IP source, destination, and length have already been set by
2047 * conn_prepend_hdr.
2048 */
2049 cksum += data_len;
2050 cksum = (cksum >> 16) + (cksum & 0xFFFF);
2051 ASSERT(cksum < 0x10000);
2052
2053 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2054 ipha_t *ipha = (ipha_t *)mp->b_rptr;
2055
2056 ASSERT(ntohs(ipha->ipha_length) == ixa->ixa_pktlen);
2057
2058 /* IP does the checksum if uha_checksum is non-zero */
2059 if (us->us_do_checksum) {
2060 if (cksum == 0)
2061 udpha->uha_checksum = 0xffff;
2062 else
2063 udpha->uha_checksum = htons(cksum);
2064 } else {
2065 udpha->uha_checksum = 0;
2066 }
2067 } else {
2068 ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2069
2070 ASSERT(ntohs(ip6h->ip6_plen) + IPV6_HDR_LEN == ixa->ixa_pktlen);
2071 if (cksum == 0)
2072 udpha->uha_checksum = 0xffff;
2073 else
2074 udpha->uha_checksum = htons(cksum);
2075 }
2076
2077 /* Insert all-0s SPI now. */
2078 if (insert_spi)
2079 *((uint32_t *)(udpha + 1)) = 0;
2080
2081 return (mp);
2082 }
2083
2084 static int
2085 udp_build_hdr_template(conn_t *connp, const in6_addr_t *v6src,
2086 const in6_addr_t *v6dst, in_port_t dstport, uint32_t flowinfo)
2087 {
2088 udpha_t *udpha;
2089 int error;
2090
2091 ASSERT(MUTEX_HELD(&connp->conn_lock));
2092 /*
2093 * We clear lastdst to make sure we don't use the lastdst path
2094 * next time sending since we might not have set v6dst yet.
2095 */
2096 connp->conn_v6lastdst = ipv6_all_zeros;
2097
2098 error = conn_build_hdr_template(connp, UDPH_SIZE, 0, v6src, v6dst,
2099 flowinfo);
2100 if (error != 0)
2101 return (error);
2102
2103 /*
2104 * Any routing header/option has been massaged. The checksum difference
2105 * is stored in conn_sum.
2106 */
2107 udpha = (udpha_t *)connp->conn_ht_ulp;
2108 udpha->uha_src_port = connp->conn_lport;
2109 udpha->uha_dst_port = dstport;
2110 udpha->uha_checksum = 0;
2111 udpha->uha_length = htons(UDPH_SIZE); /* Filled in later */
2112 return (0);
2113 }
2114
2115 static mblk_t *
2116 udp_queue_fallback(udp_t *udp, mblk_t *mp)
2117 {
2118 ASSERT(MUTEX_HELD(&udp->udp_recv_lock));
2119 if (IPCL_IS_NONSTR(udp->udp_connp)) {
2120 /*
2121 * fallback has started but messages have not been moved yet
2122 */
2123 if (udp->udp_fallback_queue_head == NULL) {
2124 ASSERT(udp->udp_fallback_queue_tail == NULL);
2125 udp->udp_fallback_queue_head = mp;
2126 udp->udp_fallback_queue_tail = mp;
2127 } else {
2128 ASSERT(udp->udp_fallback_queue_tail != NULL);
2129 udp->udp_fallback_queue_tail->b_next = mp;
2130 udp->udp_fallback_queue_tail = mp;
2131 }
2132 return (NULL);
2133 } else {
2134 /*
2135 * Fallback completed, let the caller putnext() the mblk.
2136 */
2137 return (mp);
2138 }
2139 }
2140
2141 /*
2142 * Deliver data to ULP. In case we have a socket, and it's falling back to
2143 * TPI, then we'll queue the mp for later processing.
2144 */
2145 static void
2146 udp_ulp_recv(conn_t *connp, mblk_t *mp, uint_t len, ip_recv_attr_t *ira)
2147 {
2148 if (IPCL_IS_NONSTR(connp)) {
2149 udp_t *udp = connp->conn_udp;
2150 int error;
2151
2152 ASSERT(len == msgdsize(mp));
2153 if ((*connp->conn_upcalls->su_recv)
2154 (connp->conn_upper_handle, mp, len, 0, &error, NULL) < 0) {
2155 mutex_enter(&udp->udp_recv_lock);
2156 if (error == ENOSPC) {
2157 /*
2158 * let's confirm while holding the lock
2159 */
2160 if ((*connp->conn_upcalls->su_recv)
2161 (connp->conn_upper_handle, NULL, 0, 0,
2162 &error, NULL) < 0) {
2163 ASSERT(error == ENOSPC);
2164 if (error == ENOSPC) {
2165 connp->conn_flow_cntrld =
2166 B_TRUE;
2167 }
2168 }
2169 mutex_exit(&udp->udp_recv_lock);
2170 } else {
2171 ASSERT(error == EOPNOTSUPP);
2172 mp = udp_queue_fallback(udp, mp);
2173 mutex_exit(&udp->udp_recv_lock);
2174 if (mp != NULL)
2175 putnext(connp->conn_rq, mp);
2176 }
2177 }
2178 ASSERT(MUTEX_NOT_HELD(&udp->udp_recv_lock));
2179 } else {
2180 if (is_system_labeled()) {
2181 ASSERT(ira->ira_cred != NULL);
2182 /*
2183 * Provide for protocols above UDP such as RPC
2184 * NOPID leaves db_cpid unchanged.
2185 */
2186 mblk_setcred(mp, ira->ira_cred, NOPID);
2187 }
2188
2189 putnext(connp->conn_rq, mp);
2190 }
2191 }
2192
2193 /*
2194 * This is the inbound data path.
2195 * IP has already pulled up the IP plus UDP headers and verified alignment
2196 * etc.
2197 */
2198 /* ARGSUSED2 */
2199 static void
2200 udp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2201 {
2202 conn_t *connp = (conn_t *)arg1;
2203 struct T_unitdata_ind *tudi;
2204 uchar_t *rptr; /* Pointer to IP header */
2205 int hdr_length; /* Length of IP+UDP headers */
2206 int udi_size; /* Size of T_unitdata_ind */
2207 int pkt_len;
2208 udp_t *udp;
2209 udpha_t *udpha;
2210 ip_pkt_t ipps;
2211 ip6_t *ip6h;
2212 mblk_t *mp1;
2213 uint32_t udp_ipv4_options_len;
2214 crb_t recv_ancillary;
2215 udp_stack_t *us;
2216
2217 ASSERT(connp->conn_flags & IPCL_UDPCONN);
2218
2219 udp = connp->conn_udp;
2220 us = udp->udp_us;
2221 rptr = mp->b_rptr;
2222
2223 ASSERT(DB_TYPE(mp) == M_DATA);
2224 ASSERT(OK_32PTR(rptr));
2225 ASSERT(ira->ira_pktlen == msgdsize(mp));
2226 pkt_len = ira->ira_pktlen;
2227
2228 /*
2229 * Get a snapshot of these and allow other threads to change
2230 * them after that. We need the same recv_ancillary when determining
2231 * the size as when adding the ancillary data items.
2232 */
2233 mutex_enter(&connp->conn_lock);
2234 udp_ipv4_options_len = udp->udp_recv_ipp.ipp_ipv4_options_len;
2235 recv_ancillary = connp->conn_recv_ancillary;
2236 mutex_exit(&connp->conn_lock);
2237
2238 hdr_length = ira->ira_ip_hdr_length;
2239
2240 /*
2241 * IP inspected the UDP header thus all of it must be in the mblk.
2242 * UDP length check is performed for IPv6 packets and IPv4 packets
2243 * to check if the size of the packet as specified
2244 * by the UDP header is the same as the length derived from the IP
2245 * header.
2246 */
2247 udpha = (udpha_t *)(rptr + hdr_length);
2248 if (pkt_len != ntohs(udpha->uha_length) + hdr_length)
2249 goto tossit;
2250
2251 hdr_length += UDPH_SIZE;
2252 ASSERT(MBLKL(mp) >= hdr_length); /* IP did a pullup */
2253
2254 /* Initialize regardless of IP version */
2255 ipps.ipp_fields = 0;
2256
2257 if (((ira->ira_flags & IRAF_IPV4_OPTIONS) ||
2258 udp_ipv4_options_len > 0) &&
2259 connp->conn_family == AF_INET) {
2260 int err;
2261
2262 /*
2263 * Record/update udp_recv_ipp with the lock
2264 * held. Not needed for AF_INET6 sockets
2265 * since they don't support a getsockopt of IP_OPTIONS.
2266 */
2267 mutex_enter(&connp->conn_lock);
2268 err = ip_find_hdr_v4((ipha_t *)rptr, &udp->udp_recv_ipp,
2269 B_TRUE);
2270 if (err != 0) {
2271 /* Allocation failed. Drop packet */
2272 mutex_exit(&connp->conn_lock);
2273 freemsg(mp);
2274 UDPS_BUMP_MIB(us, udpInErrors);
2275 return;
2276 }
2277 mutex_exit(&connp->conn_lock);
2278 }
2279
2280 if (recv_ancillary.crb_all != 0) {
2281 /*
2282 * Record packet information in the ip_pkt_t
2283 */
2284 if (ira->ira_flags & IRAF_IS_IPV4) {
2285 ASSERT(IPH_HDR_VERSION(rptr) == IPV4_VERSION);
2286 ASSERT(MBLKL(mp) >= sizeof (ipha_t));
2287 ASSERT(((ipha_t *)rptr)->ipha_protocol == IPPROTO_UDP);
2288 ASSERT(ira->ira_ip_hdr_length == IPH_HDR_LENGTH(rptr));
2289
2290 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipps, B_FALSE);
2291 } else {
2292 uint8_t nexthdrp;
2293
2294 ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
2295 /*
2296 * IPv6 packets can only be received by applications
2297 * that are prepared to receive IPv6 addresses.
2298 * The IP fanout must ensure this.
2299 */
2300 ASSERT(connp->conn_family == AF_INET6);
2301
2302 ip6h = (ip6_t *)rptr;
2303
2304 /* We don't care about the length, but need the ipp */
2305 hdr_length = ip_find_hdr_v6(mp, ip6h, B_TRUE, &ipps,
2306 &nexthdrp);
2307 ASSERT(hdr_length == ira->ira_ip_hdr_length);
2308 /* Restore */
2309 hdr_length = ira->ira_ip_hdr_length + UDPH_SIZE;
2310 ASSERT(nexthdrp == IPPROTO_UDP);
2311 }
2312 }
2313
2314 /*
2315 * This is the inbound data path. Packets are passed upstream as
2316 * T_UNITDATA_IND messages.
2317 */
2318 if (connp->conn_family == AF_INET) {
2319 sin_t *sin;
2320
2321 ASSERT(IPH_HDR_VERSION((ipha_t *)rptr) == IPV4_VERSION);
2322
2323 /*
2324 * Normally only send up the source address.
2325 * If any ancillary data items are wanted we add those.
2326 */
2327 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin_t);
2328 if (recv_ancillary.crb_all != 0) {
2329 udi_size += conn_recvancillary_size(connp,
2330 recv_ancillary, ira, mp, &ipps);
2331 }
2332
2333 /* Allocate a message block for the T_UNITDATA_IND structure. */
2334 mp1 = allocb(udi_size, BPRI_MED);
2335 if (mp1 == NULL) {
2336 freemsg(mp);
2337 UDPS_BUMP_MIB(us, udpInErrors);
2338 return;
2339 }
2340 mp1->b_cont = mp;
2341 mp1->b_datap->db_type = M_PROTO;
2342 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2343 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2344 tudi->PRIM_type = T_UNITDATA_IND;
2345 tudi->SRC_length = sizeof (sin_t);
2346 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2347 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2348 sizeof (sin_t);
2349 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin_t));
2350 tudi->OPT_length = udi_size;
2351 sin = (sin_t *)&tudi[1];
2352 sin->sin_addr.s_addr = ((ipha_t *)rptr)->ipha_src;
2353 sin->sin_port = udpha->uha_src_port;
2354 sin->sin_family = connp->conn_family;
2355 *(uint32_t *)&sin->sin_zero[0] = 0;
2356 *(uint32_t *)&sin->sin_zero[4] = 0;
2357
2358 /*
2359 * Add options if IP_RECVDSTADDR, IP_RECVIF, IP_RECVSLLA or
2360 * IP_RECVTTL has been set.
2361 */
2362 if (udi_size != 0) {
2363 conn_recvancillary_add(connp, recv_ancillary, ira,
2364 &ipps, (uchar_t *)&sin[1], udi_size);
2365 }
2366 } else {
2367 sin6_t *sin6;
2368
2369 /*
2370 * Handle both IPv4 and IPv6 packets for IPv6 sockets.
2371 *
2372 * Normally we only send up the address. If receiving of any
2373 * optional receive side information is enabled, we also send
2374 * that up as options.
2375 */
2376 udi_size = sizeof (struct T_unitdata_ind) + sizeof (sin6_t);
2377
2378 if (recv_ancillary.crb_all != 0) {
2379 udi_size += conn_recvancillary_size(connp,
2380 recv_ancillary, ira, mp, &ipps);
2381 }
2382
2383 mp1 = allocb(udi_size, BPRI_MED);
2384 if (mp1 == NULL) {
2385 freemsg(mp);
2386 UDPS_BUMP_MIB(us, udpInErrors);
2387 return;
2388 }
2389 mp1->b_cont = mp;
2390 mp1->b_datap->db_type = M_PROTO;
2391 tudi = (struct T_unitdata_ind *)mp1->b_rptr;
2392 mp1->b_wptr = (uchar_t *)tudi + udi_size;
2393 tudi->PRIM_type = T_UNITDATA_IND;
2394 tudi->SRC_length = sizeof (sin6_t);
2395 tudi->SRC_offset = sizeof (struct T_unitdata_ind);
2396 tudi->OPT_offset = sizeof (struct T_unitdata_ind) +
2397 sizeof (sin6_t);
2398 udi_size -= (sizeof (struct T_unitdata_ind) + sizeof (sin6_t));
2399 tudi->OPT_length = udi_size;
2400 sin6 = (sin6_t *)&tudi[1];
2401 if (ira->ira_flags & IRAF_IS_IPV4) {
2402 in6_addr_t v6dst;
2403
2404 IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_src,
2405 &sin6->sin6_addr);
2406 IN6_IPADDR_TO_V4MAPPED(((ipha_t *)rptr)->ipha_dst,
2407 &v6dst);
2408 sin6->sin6_flowinfo = 0;
2409 sin6->sin6_scope_id = 0;
2410 sin6->__sin6_src_id = ip_srcid_find_addr(&v6dst,
2411 IPCL_ZONEID(connp), us->us_netstack);
2412 } else {
2413 ip6h = (ip6_t *)rptr;
2414
2415 sin6->sin6_addr = ip6h->ip6_src;
2416 /* No sin6_flowinfo per API */
2417 sin6->sin6_flowinfo = 0;
2418 /* For link-scope pass up scope id */
2419 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src))
2420 sin6->sin6_scope_id = ira->ira_ruifindex;
2421 else
2422 sin6->sin6_scope_id = 0;
2423 sin6->__sin6_src_id = ip_srcid_find_addr(
2424 &ip6h->ip6_dst, IPCL_ZONEID(connp),
2425 us->us_netstack);
2426 }
2427 sin6->sin6_port = udpha->uha_src_port;
2428 sin6->sin6_family = connp->conn_family;
2429
2430 if (udi_size != 0) {
2431 conn_recvancillary_add(connp, recv_ancillary, ira,
2432 &ipps, (uchar_t *)&sin6[1], udi_size);
2433 }
2434 }
2435
2436 /*
2437 * DTrace this UDP input as udp:::receive (this is for IPv4, IPv6 and
2438 * loopback traffic).
2439 */
2440 DTRACE_UDP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2441 void_ip_t *, rptr, udp_t *, udp, udpha_t *, udpha);
2442
2443 /* Walk past the headers unless IP_RECVHDR was set. */
2444 if (!udp->udp_rcvhdr) {
2445 mp->b_rptr = rptr + hdr_length;
2446 pkt_len -= hdr_length;
2447 }
2448
2449 UDPS_BUMP_MIB(us, udpHCInDatagrams);
2450 udp_ulp_recv(connp, mp1, pkt_len, ira);
2451 return;
2452
2453 tossit:
2454 freemsg(mp);
2455 UDPS_BUMP_MIB(us, udpInErrors);
2456 }
2457
2458 /*
2459 * This routine creates a T_UDERROR_IND message and passes it upstream.
2460 * The address and options are copied from the T_UNITDATA_REQ message
2461 * passed in mp. This message is freed.
2462 */
2463 static void
2464 udp_ud_err(queue_t *q, mblk_t *mp, t_scalar_t err)
2465 {
2466 struct T_unitdata_req *tudr;
2467 mblk_t *mp1;
2468 uchar_t *destaddr;
2469 t_scalar_t destlen;
2470 uchar_t *optaddr;
2471 t_scalar_t optlen;
2472
2473 if ((mp->b_wptr < mp->b_rptr) ||
2474 (MBLKL(mp)) < sizeof (struct T_unitdata_req)) {
2475 goto done;
2476 }
2477 tudr = (struct T_unitdata_req *)mp->b_rptr;
2478 destaddr = mp->b_rptr + tudr->DEST_offset;
2479 if (destaddr < mp->b_rptr || destaddr >= mp->b_wptr ||
2480 destaddr + tudr->DEST_length < mp->b_rptr ||
2481 destaddr + tudr->DEST_length > mp->b_wptr) {
2482 goto done;
2483 }
2484 optaddr = mp->b_rptr + tudr->OPT_offset;
2485 if (optaddr < mp->b_rptr || optaddr >= mp->b_wptr ||
2486 optaddr + tudr->OPT_length < mp->b_rptr ||
2487 optaddr + tudr->OPT_length > mp->b_wptr) {
2488 goto done;
2489 }
2490 destlen = tudr->DEST_length;
2491 optlen = tudr->OPT_length;
2492
2493 mp1 = mi_tpi_uderror_ind((char *)destaddr, destlen,
2494 (char *)optaddr, optlen, err);
2495 if (mp1 != NULL)
2496 qreply(q, mp1);
2497
2498 done:
2499 freemsg(mp);
2500 }
2501
2502 /*
2503 * This routine removes a port number association from a stream. It
2504 * is called by udp_wput to handle T_UNBIND_REQ messages.
2505 */
2506 static void
2507 udp_tpi_unbind(queue_t *q, mblk_t *mp)
2508 {
2509 conn_t *connp = Q_TO_CONN(q);
2510 int error;
2511
2512 error = udp_do_unbind(connp);
2513 if (error) {
2514 if (error < 0)
2515 udp_err_ack(q, mp, -error, 0);
2516 else
2517 udp_err_ack(q, mp, TSYSERR, error);
2518 return;
2519 }
2520
2521 mp = mi_tpi_ok_ack_alloc(mp);
2522 ASSERT(mp != NULL);
2523 ASSERT(((struct T_ok_ack *)mp->b_rptr)->PRIM_type == T_OK_ACK);
2524 qreply(q, mp);
2525 }
2526
2527 /*
2528 * Don't let port fall into the privileged range.
2529 * Since the extra privileged ports can be arbitrary we also
2530 * ensure that we exclude those from consideration.
2531 * us->us_epriv_ports is not sorted thus we loop over it until
2532 * there are no changes.
2533 */
2534 static in_port_t
2535 udp_update_next_port(udp_t *udp, in_port_t port, boolean_t random)
2536 {
2537 int i, bump;
2538 in_port_t nextport;
2539 boolean_t restart = B_FALSE;
2540 udp_stack_t *us = udp->udp_us;
2541
2542 if (random && udp_random_anon_port != 0) {
2543 (void) random_get_pseudo_bytes((uint8_t *)&port,
2544 sizeof (in_port_t));
2545 /*
2546 * Unless changed by a sys admin, the smallest anon port
2547 * is 32768 and the largest anon port is 65535. It is
2548 * very likely (50%) for the random port to be smaller
2549 * than the smallest anon port. When that happens,
2550 * add port % (anon port range) to the smallest anon
2551 * port to get the random port. It should fall into the
2552 * valid anon port range.
2553 */
2554 if ((port < us->us_smallest_anon_port) ||
2555 (port > us->us_largest_anon_port)) {
2556 if (us->us_smallest_anon_port ==
2557 us->us_largest_anon_port) {
2558 bump = 0;
2559 } else {
2560 bump = port % (us->us_largest_anon_port -
2561 us->us_smallest_anon_port);
2562 }
2563
2564 port = us->us_smallest_anon_port + bump;
2565 }
2566 }
2567
2568 retry:
2569 if (port < us->us_smallest_anon_port)
2570 port = us->us_smallest_anon_port;
2571
2572 if (port > us->us_largest_anon_port) {
2573 port = us->us_smallest_anon_port;
2574 if (restart)
2575 return (0);
2576 restart = B_TRUE;
2577 }
2578
2579 if (port < us->us_smallest_nonpriv_port)
2580 port = us->us_smallest_nonpriv_port;
2581
2582 for (i = 0; i < us->us_num_epriv_ports; i++) {
2583 if (port == us->us_epriv_ports[i]) {
2584 port++;
2585 /*
2586 * Make sure that the port is in the
2587 * valid range.
2588 */
2589 goto retry;
2590 }
2591 }
2592
2593 if (is_system_labeled() &&
2594 (nextport = tsol_next_port(crgetzone(udp->udp_connp->conn_cred),
2595 port, IPPROTO_UDP, B_TRUE)) != 0) {
2596 port = nextport;
2597 goto retry;
2598 }
2599
2600 return (port);
2601 }
2602
2603 /*
2604 * Handle T_UNITDATA_REQ with options. Both IPv4 and IPv6
2605 * Either tudr_mp or msg is set. If tudr_mp we take ancillary data from
2606 * the TPI options, otherwise we take them from msg_control.
2607 * If both sin and sin6 is set it is a connected socket and we use conn_faddr.
2608 * Always consumes mp; never consumes tudr_mp.
2609 */
2610 static int
2611 udp_output_ancillary(conn_t *connp, sin_t *sin, sin6_t *sin6, mblk_t *mp,
2612 mblk_t *tudr_mp, struct nmsghdr *msg, cred_t *cr, pid_t pid)
2613 {
2614 udp_t *udp = connp->conn_udp;
2615 udp_stack_t *us = udp->udp_us;
2616 int error;
2617 ip_xmit_attr_t *ixa;
2618 ip_pkt_t *ipp;
2619 in6_addr_t v6src;
2620 in6_addr_t v6dst;
2621 in6_addr_t v6nexthop;
2622 in_port_t dstport;
2623 uint32_t flowinfo;
2624 uint_t srcid;
2625 int is_absreq_failure = 0;
2626 conn_opt_arg_t coas, *coa;
2627
2628 ASSERT(tudr_mp != NULL || msg != NULL);
2629
2630 /*
2631 * Get ixa before checking state to handle a disconnect race.
2632 *
2633 * We need an exclusive copy of conn_ixa since the ancillary data
2634 * options might modify it. That copy has no pointers hence we
2635 * need to set them up once we've parsed the ancillary data.
2636 */
2637 ixa = conn_get_ixa_exclusive(connp);
2638 if (ixa == NULL) {
2639 UDPS_BUMP_MIB(us, udpOutErrors);
2640 freemsg(mp);
2641 return (ENOMEM);
2642 }
2643 ASSERT(cr != NULL);
2644 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2645 ixa->ixa_cred = cr;
2646 ixa->ixa_cpid = pid;
2647 if (is_system_labeled()) {
2648 /* We need to restart with a label based on the cred */
2649 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
2650 }
2651
2652 /* In case previous destination was multicast or multirt */
2653 ip_attr_newdst(ixa);
2654
2655 /* Get a copy of conn_xmit_ipp since the options might change it */
2656 ipp = kmem_zalloc(sizeof (*ipp), KM_NOSLEEP);
2657 if (ipp == NULL) {
2658 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2659 ixa->ixa_cred = connp->conn_cred; /* Restore */
2660 ixa->ixa_cpid = connp->conn_cpid;
2661 ixa_refrele(ixa);
2662 UDPS_BUMP_MIB(us, udpOutErrors);
2663 freemsg(mp);
2664 return (ENOMEM);
2665 }
2666 mutex_enter(&connp->conn_lock);
2667 error = ip_pkt_copy(&connp->conn_xmit_ipp, ipp, KM_NOSLEEP);
2668 mutex_exit(&connp->conn_lock);
2669 if (error != 0) {
2670 UDPS_BUMP_MIB(us, udpOutErrors);
2671 freemsg(mp);
2672 goto done;
2673 }
2674
2675 /*
2676 * Parse the options and update ixa and ipp as a result.
2677 * Note that ixa_tsl can be updated if SCM_UCRED.
2678 * ixa_refrele/ixa_inactivate will release any reference on ixa_tsl.
2679 */
2680
2681 coa = &coas;
2682 coa->coa_connp = connp;
2683 coa->coa_ixa = ixa;
2684 coa->coa_ipp = ipp;
2685 coa->coa_ancillary = B_TRUE;
2686 coa->coa_changed = 0;
2687
2688 if (msg != NULL) {
2689 error = process_auxiliary_options(connp, msg->msg_control,
2690 msg->msg_controllen, coa, &udp_opt_obj, udp_opt_set, cr);
2691 } else {
2692 struct T_unitdata_req *tudr;
2693
2694 tudr = (struct T_unitdata_req *)tudr_mp->b_rptr;
2695 ASSERT(tudr->PRIM_type == T_UNITDATA_REQ);
2696 error = tpi_optcom_buf(connp->conn_wq, tudr_mp,
2697 &tudr->OPT_length, tudr->OPT_offset, cr, &udp_opt_obj,
2698 coa, &is_absreq_failure);
2699 }
2700 if (error != 0) {
2701 /*
2702 * Note: No special action needed in this
2703 * module for "is_absreq_failure"
2704 */
2705 freemsg(mp);
2706 UDPS_BUMP_MIB(us, udpOutErrors);
2707 goto done;
2708 }
2709 ASSERT(is_absreq_failure == 0);
2710
2711 mutex_enter(&connp->conn_lock);
2712 /*
2713 * If laddr is unspecified then we look at sin6_src_id.
2714 * We will give precedence to a source address set with IPV6_PKTINFO
2715 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
2716 * want ip_attr_connect to select a source (since it can fail) when
2717 * IPV6_PKTINFO is specified.
2718 * If this doesn't result in a source address then we get a source
2719 * from ip_attr_connect() below.
2720 */
2721 v6src = connp->conn_saddr_v6;
2722 if (sin != NULL) {
2723 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
2724 dstport = sin->sin_port;
2725 flowinfo = 0;
2726 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2727 ixa->ixa_flags |= IXAF_IS_IPV4;
2728 } else if (sin6 != NULL) {
2729 boolean_t v4mapped;
2730
2731 v6dst = sin6->sin6_addr;
2732 dstport = sin6->sin6_port;
2733 flowinfo = sin6->sin6_flowinfo;
2734 srcid = sin6->__sin6_src_id;
2735 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
2736 ixa->ixa_scopeid = sin6->sin6_scope_id;
2737 ixa->ixa_flags |= IXAF_SCOPEID_SET;
2738 } else {
2739 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
2740 }
2741 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
2742 if (v4mapped)
2743 ixa->ixa_flags |= IXAF_IS_IPV4;
2744 else
2745 ixa->ixa_flags &= ~IXAF_IS_IPV4;
2746 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
2747 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
2748 v4mapped, connp->conn_netstack)) {
2749 /* Mismatch - v4mapped/v6 specified by srcid. */
2750 mutex_exit(&connp->conn_lock);
2751 error = EADDRNOTAVAIL;
2752 goto failed; /* Does freemsg() and mib. */
2753 }
2754 }
2755 } else {
2756 /* Connected case */
2757 v6dst = connp->conn_faddr_v6;
2758 dstport = connp->conn_fport;
2759 flowinfo = connp->conn_flowinfo;
2760 }
2761 mutex_exit(&connp->conn_lock);
2762
2763 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
2764 if (ipp->ipp_fields & IPPF_ADDR) {
2765 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2766 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2767 v6src = ipp->ipp_addr;
2768 } else {
2769 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
2770 v6src = ipp->ipp_addr;
2771 }
2772 }
2773
2774 ip_attr_nexthop(ipp, ixa, &v6dst, &v6nexthop);
2775 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
2776 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
2777
2778 switch (error) {
2779 case 0:
2780 break;
2781 case EADDRNOTAVAIL:
2782 /*
2783 * IXAF_VERIFY_SOURCE tells us to pick a better source.
2784 * Don't have the application see that errno
2785 */
2786 error = ENETUNREACH;
2787 goto failed;
2788 case ENETDOWN:
2789 /*
2790 * Have !ipif_addr_ready address; drop packet silently
2791 * until we can get applications to not send until we
2792 * are ready.
2793 */
2794 error = 0;
2795 goto failed;
2796 case EHOSTUNREACH:
2797 case ENETUNREACH:
2798 if (ixa->ixa_ire != NULL) {
2799 /*
2800 * Let conn_ip_output/ire_send_noroute return
2801 * the error and send any local ICMP error.
2802 */
2803 error = 0;
2804 break;
2805 }
2806 /* FALLTHRU */
2807 default:
2808 failed:
2809 freemsg(mp);
2810 UDPS_BUMP_MIB(us, udpOutErrors);
2811 goto done;
2812 }
2813
2814 /*
2815 * We might be going to a different destination than last time,
2816 * thus check that TX allows the communication and compute any
2817 * needed label.
2818 *
2819 * TSOL Note: We have an exclusive ipp and ixa for this thread so we
2820 * don't have to worry about concurrent threads.
2821 */
2822 if (is_system_labeled()) {
2823 /* Using UDP MLP requires SCM_UCRED from user */
2824 if (connp->conn_mlp_type != mlptSingle &&
2825 !((ixa->ixa_flags & IXAF_UCRED_TSL))) {
2826 UDPS_BUMP_MIB(us, udpOutErrors);
2827 error = ECONNREFUSED;
2828 freemsg(mp);
2829 goto done;
2830 }
2831 /*
2832 * Check whether Trusted Solaris policy allows communication
2833 * with this host, and pretend that the destination is
2834 * unreachable if not.
2835 * Compute any needed label and place it in ipp_label_v4/v6.
2836 *
2837 * Later conn_build_hdr_template/conn_prepend_hdr takes
2838 * ipp_label_v4/v6 to form the packet.
2839 *
2840 * Tsol note: We have ipp structure local to this thread so
2841 * no locking is needed.
2842 */
2843 error = conn_update_label(connp, ixa, &v6dst, ipp);
2844 if (error != 0) {
2845 freemsg(mp);
2846 UDPS_BUMP_MIB(us, udpOutErrors);
2847 goto done;
2848 }
2849 }
2850 mp = udp_prepend_hdr(connp, ixa, ipp, &v6src, &v6dst, dstport,
2851 flowinfo, mp, &error);
2852 if (mp == NULL) {
2853 ASSERT(error != 0);
2854 UDPS_BUMP_MIB(us, udpOutErrors);
2855 goto done;
2856 }
2857 if (ixa->ixa_pktlen > IP_MAXPACKET) {
2858 error = EMSGSIZE;
2859 UDPS_BUMP_MIB(us, udpOutErrors);
2860 freemsg(mp);
2861 goto done;
2862 }
2863 /* We're done. Pass the packet to ip. */
2864 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
2865
2866 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
2867 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
2868 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
2869
2870 error = conn_ip_output(mp, ixa);
2871 /* No udpOutErrors if an error since IP increases its error counter */
2872 switch (error) {
2873 case 0:
2874 break;
2875 case EWOULDBLOCK:
2876 (void) ixa_check_drain_insert(connp, ixa);
2877 error = 0;
2878 break;
2879 case EADDRNOTAVAIL:
2880 /*
2881 * IXAF_VERIFY_SOURCE tells us to pick a better source.
2882 * Don't have the application see that errno
2883 */
2884 error = ENETUNREACH;
2885 /* FALLTHRU */
2886 default:
2887 mutex_enter(&connp->conn_lock);
2888 /*
2889 * Clear the source and v6lastdst so we call ip_attr_connect
2890 * for the next packet and try to pick a better source.
2891 */
2892 if (connp->conn_mcbc_bind)
2893 connp->conn_saddr_v6 = ipv6_all_zeros;
2894 else
2895 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
2896 connp->conn_v6lastdst = ipv6_all_zeros;
2897 mutex_exit(&connp->conn_lock);
2898 break;
2899 }
2900 done:
2901 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2902 ixa->ixa_cred = connp->conn_cred; /* Restore */
2903 ixa->ixa_cpid = connp->conn_cpid;
2904 ixa_refrele(ixa);
2905 ip_pkt_free(ipp);
2906 kmem_free(ipp, sizeof (*ipp));
2907 return (error);
2908 }
2909
2910 /*
2911 * Handle sending an M_DATA for a connected socket.
2912 * Handles both IPv4 and IPv6.
2913 */
2914 static int
2915 udp_output_connected(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid)
2916 {
2917 udp_t *udp = connp->conn_udp;
2918 udp_stack_t *us = udp->udp_us;
2919 int error;
2920 ip_xmit_attr_t *ixa;
2921
2922 /*
2923 * If no other thread is using conn_ixa this just gets a reference to
2924 * conn_ixa. Otherwise we get a safe copy of conn_ixa.
2925 */
2926 ixa = conn_get_ixa(connp, B_FALSE);
2927 if (ixa == NULL) {
2928 UDPS_BUMP_MIB(us, udpOutErrors);
2929 freemsg(mp);
2930 return (ENOMEM);
2931 }
2932
2933 ASSERT(cr != NULL);
2934 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2935 ixa->ixa_cred = cr;
2936 ixa->ixa_cpid = pid;
2937
2938 mutex_enter(&connp->conn_lock);
2939 mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_saddr_v6,
2940 connp->conn_fport, connp->conn_flowinfo, &error);
2941
2942 if (mp == NULL) {
2943 ASSERT(error != 0);
2944 mutex_exit(&connp->conn_lock);
2945 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
2946 ixa->ixa_cred = connp->conn_cred; /* Restore */
2947 ixa->ixa_cpid = connp->conn_cpid;
2948 ixa_refrele(ixa);
2949 UDPS_BUMP_MIB(us, udpOutErrors);
2950 freemsg(mp);
2951 return (error);
2952 }
2953
2954 /*
2955 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
2956 * safe copy, then we need to fill in any pointers in it.
2957 */
2958 if (ixa->ixa_ire == NULL) {
2959 in6_addr_t faddr, saddr;
2960 in6_addr_t nexthop;
2961 in_port_t fport;
2962
2963 saddr = connp->conn_saddr_v6;
2964 faddr = connp->conn_faddr_v6;
2965 fport = connp->conn_fport;
2966 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &faddr, &nexthop);
2967 mutex_exit(&connp->conn_lock);
2968
2969 error = ip_attr_connect(connp, ixa, &saddr, &faddr, &nexthop,
2970 fport, NULL, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST |
2971 IPDF_IPSEC);
2972 switch (error) {
2973 case 0:
2974 break;
2975 case EADDRNOTAVAIL:
2976 /*
2977 * IXAF_VERIFY_SOURCE tells us to pick a better source.
2978 * Don't have the application see that errno
2979 */
2980 error = ENETUNREACH;
2981 goto failed;
2982 case ENETDOWN:
2983 /*
2984 * Have !ipif_addr_ready address; drop packet silently
2985 * until we can get applications to not send until we
2986 * are ready.
2987 */
2988 error = 0;
2989 goto failed;
2990 case EHOSTUNREACH:
2991 case ENETUNREACH:
2992 if (ixa->ixa_ire != NULL) {
2993 /*
2994 * Let conn_ip_output/ire_send_noroute return
2995 * the error and send any local ICMP error.
2996 */
2997 error = 0;
2998 break;
2999 }
3000 /* FALLTHRU */
3001 default:
3002 failed:
3003 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3004 ixa->ixa_cred = connp->conn_cred; /* Restore */
3005 ixa->ixa_cpid = connp->conn_cpid;
3006 ixa_refrele(ixa);
3007 freemsg(mp);
3008 UDPS_BUMP_MIB(us, udpOutErrors);
3009 return (error);
3010 }
3011 } else {
3012 /* Done with conn_t */
3013 mutex_exit(&connp->conn_lock);
3014 }
3015 ASSERT(ixa->ixa_ire != NULL);
3016
3017 /* We're done. Pass the packet to ip. */
3018 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3019
3020 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3021 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3022 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3023
3024 error = conn_ip_output(mp, ixa);
3025 /* No udpOutErrors if an error since IP increases its error counter */
3026 switch (error) {
3027 case 0:
3028 break;
3029 case EWOULDBLOCK:
3030 (void) ixa_check_drain_insert(connp, ixa);
3031 error = 0;
3032 break;
3033 case EADDRNOTAVAIL:
3034 /*
3035 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3036 * Don't have the application see that errno
3037 */
3038 error = ENETUNREACH;
3039 break;
3040 }
3041 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3042 ixa->ixa_cred = connp->conn_cred; /* Restore */
3043 ixa->ixa_cpid = connp->conn_cpid;
3044 ixa_refrele(ixa);
3045 return (error);
3046 }
3047
3048 /*
3049 * Handle sending an M_DATA to the last destination.
3050 * Handles both IPv4 and IPv6.
3051 *
3052 * NOTE: The caller must hold conn_lock and we drop it here.
3053 */
3054 static int
3055 udp_output_lastdst(conn_t *connp, mblk_t *mp, cred_t *cr, pid_t pid,
3056 ip_xmit_attr_t *ixa)
3057 {
3058 udp_t *udp = connp->conn_udp;
3059 udp_stack_t *us = udp->udp_us;
3060 int error;
3061
3062 ASSERT(MUTEX_HELD(&connp->conn_lock));
3063 ASSERT(ixa != NULL);
3064
3065 ASSERT(cr != NULL);
3066 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3067 ixa->ixa_cred = cr;
3068 ixa->ixa_cpid = pid;
3069
3070 mp = udp_prepend_header_template(connp, ixa, mp, &connp->conn_v6lastsrc,
3071 connp->conn_lastdstport, connp->conn_lastflowinfo, &error);
3072
3073 if (mp == NULL) {
3074 ASSERT(error != 0);
3075 mutex_exit(&connp->conn_lock);
3076 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3077 ixa->ixa_cred = connp->conn_cred; /* Restore */
3078 ixa->ixa_cpid = connp->conn_cpid;
3079 ixa_refrele(ixa);
3080 UDPS_BUMP_MIB(us, udpOutErrors);
3081 freemsg(mp);
3082 return (error);
3083 }
3084
3085 /*
3086 * In case we got a safe copy of conn_ixa, or if opt_set made us a new
3087 * safe copy, then we need to fill in any pointers in it.
3088 */
3089 if (ixa->ixa_ire == NULL) {
3090 in6_addr_t lastdst, lastsrc;
3091 in6_addr_t nexthop;
3092 in_port_t lastport;
3093
3094 lastsrc = connp->conn_v6lastsrc;
3095 lastdst = connp->conn_v6lastdst;
3096 lastport = connp->conn_lastdstport;
3097 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &lastdst, &nexthop);
3098 mutex_exit(&connp->conn_lock);
3099
3100 error = ip_attr_connect(connp, ixa, &lastsrc, &lastdst,
3101 &nexthop, lastport, NULL, NULL, IPDF_ALLOW_MCBC |
3102 IPDF_VERIFY_DST | IPDF_IPSEC);
3103 switch (error) {
3104 case 0:
3105 break;
3106 case EADDRNOTAVAIL:
3107 /*
3108 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3109 * Don't have the application see that errno
3110 */
3111 error = ENETUNREACH;
3112 goto failed;
3113 case ENETDOWN:
3114 /*
3115 * Have !ipif_addr_ready address; drop packet silently
3116 * until we can get applications to not send until we
3117 * are ready.
3118 */
3119 error = 0;
3120 goto failed;
3121 case EHOSTUNREACH:
3122 case ENETUNREACH:
3123 if (ixa->ixa_ire != NULL) {
3124 /*
3125 * Let conn_ip_output/ire_send_noroute return
3126 * the error and send any local ICMP error.
3127 */
3128 error = 0;
3129 break;
3130 }
3131 /* FALLTHRU */
3132 default:
3133 failed:
3134 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3135 ixa->ixa_cred = connp->conn_cred; /* Restore */
3136 ixa->ixa_cpid = connp->conn_cpid;
3137 ixa_refrele(ixa);
3138 freemsg(mp);
3139 UDPS_BUMP_MIB(us, udpOutErrors);
3140 return (error);
3141 }
3142 } else {
3143 /* Done with conn_t */
3144 mutex_exit(&connp->conn_lock);
3145 }
3146
3147 /* We're done. Pass the packet to ip. */
3148 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3149
3150 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3151 void_ip_t *, mp->b_rptr, udp_t *, udp, udpha_t *,
3152 &mp->b_rptr[ixa->ixa_ip_hdr_length]);
3153
3154 error = conn_ip_output(mp, ixa);
3155 /* No udpOutErrors if an error since IP increases its error counter */
3156 switch (error) {
3157 case 0:
3158 break;
3159 case EWOULDBLOCK:
3160 (void) ixa_check_drain_insert(connp, ixa);
3161 error = 0;
3162 break;
3163 case EADDRNOTAVAIL:
3164 /*
3165 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3166 * Don't have the application see that errno
3167 */
3168 error = ENETUNREACH;
3169 /* FALLTHRU */
3170 default:
3171 mutex_enter(&connp->conn_lock);
3172 /*
3173 * Clear the source and v6lastdst so we call ip_attr_connect
3174 * for the next packet and try to pick a better source.
3175 */
3176 if (connp->conn_mcbc_bind)
3177 connp->conn_saddr_v6 = ipv6_all_zeros;
3178 else
3179 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3180 connp->conn_v6lastdst = ipv6_all_zeros;
3181 mutex_exit(&connp->conn_lock);
3182 break;
3183 }
3184 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3185 ixa->ixa_cred = connp->conn_cred; /* Restore */
3186 ixa->ixa_cpid = connp->conn_cpid;
3187 ixa_refrele(ixa);
3188 return (error);
3189 }
3190
3191
3192 /*
3193 * Prepend the header template and then fill in the source and
3194 * flowinfo. The caller needs to handle the destination address since
3195 * it's setting is different if rthdr or source route.
3196 *
3197 * Returns NULL is allocation failed or if the packet would exceed IP_MAXPACKET.
3198 * When it returns NULL it sets errorp.
3199 */
3200 static mblk_t *
3201 udp_prepend_header_template(conn_t *connp, ip_xmit_attr_t *ixa, mblk_t *mp,
3202 const in6_addr_t *v6src, in_port_t dstport, uint32_t flowinfo, int *errorp)
3203 {
3204 udp_t *udp = connp->conn_udp;
3205 udp_stack_t *us = udp->udp_us;
3206 boolean_t insert_spi = udp->udp_nat_t_endpoint;
3207 uint_t pktlen;
3208 uint_t alloclen;
3209 uint_t copylen;
3210 uint8_t *iph;
3211 uint_t ip_hdr_length;
3212 udpha_t *udpha;
3213 uint32_t cksum;
3214 ip_pkt_t *ipp;
3215
3216 ASSERT(MUTEX_HELD(&connp->conn_lock));
3217
3218 /*
3219 * Copy the header template and leave space for an SPI
3220 */
3221 copylen = connp->conn_ht_iphc_len;
3222 alloclen = copylen + (insert_spi ? sizeof (uint32_t) : 0);
3223 pktlen = alloclen + msgdsize(mp);
3224 if (pktlen > IP_MAXPACKET) {
3225 freemsg(mp);
3226 *errorp = EMSGSIZE;
3227 return (NULL);
3228 }
3229 ixa->ixa_pktlen = pktlen;
3230
3231 /* check/fix buffer config, setup pointers into it */
3232 iph = mp->b_rptr - alloclen;
3233 if (DB_REF(mp) != 1 || iph < DB_BASE(mp) || !OK_32PTR(iph)) {
3234 mblk_t *mp1;
3235
3236 mp1 = allocb(alloclen + us->us_wroff_extra, BPRI_MED);
3237 if (mp1 == NULL) {
3238 freemsg(mp);
3239 *errorp = ENOMEM;
3240 return (NULL);
3241 }
3242 mp1->b_wptr = DB_LIM(mp1);
3243 mp1->b_cont = mp;
3244 mp = mp1;
3245 iph = (mp->b_wptr - alloclen);
3246 }
3247 mp->b_rptr = iph;
3248 bcopy(connp->conn_ht_iphc, iph, copylen);
3249 ip_hdr_length = (uint_t)(connp->conn_ht_ulp - connp->conn_ht_iphc);
3250
3251 ixa->ixa_ip_hdr_length = ip_hdr_length;
3252 udpha = (udpha_t *)(iph + ip_hdr_length);
3253
3254 /*
3255 * Setup header length and prepare for ULP checksum done in IP.
3256 * udp_build_hdr_template has already massaged any routing header
3257 * and placed the result in conn_sum.
3258 *
3259 * We make it easy for IP to include our pseudo header
3260 * by putting our length in uha_checksum.
3261 */
3262 cksum = pktlen - ip_hdr_length;
3263 udpha->uha_length = htons(cksum);
3264
3265 cksum += connp->conn_sum;
3266 cksum = (cksum >> 16) + (cksum & 0xFFFF);
3267 ASSERT(cksum < 0x10000);
3268
3269 ipp = &connp->conn_xmit_ipp;
3270 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3271 ipha_t *ipha = (ipha_t *)iph;
3272
3273 ipha->ipha_length = htons((uint16_t)pktlen);
3274
3275 /* IP does the checksum if uha_checksum is non-zero */
3276 if (us->us_do_checksum)
3277 udpha->uha_checksum = htons(cksum);
3278
3279 /* if IP_PKTINFO specified an addres it wins over bind() */
3280 if ((ipp->ipp_fields & IPPF_ADDR) &&
3281 IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3282 ASSERT(ipp->ipp_addr_v4 != INADDR_ANY);
3283 ipha->ipha_src = ipp->ipp_addr_v4;
3284 } else {
3285 IN6_V4MAPPED_TO_IPADDR(v6src, ipha->ipha_src);
3286 }
3287 } else {
3288 ip6_t *ip6h = (ip6_t *)iph;
3289
3290 ip6h->ip6_plen = htons((uint16_t)(pktlen - IPV6_HDR_LEN));
3291 udpha->uha_checksum = htons(cksum);
3292
3293 /* if IP_PKTINFO specified an addres it wins over bind() */
3294 if ((ipp->ipp_fields & IPPF_ADDR) &&
3295 !IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr)) {
3296 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr));
3297 ip6h->ip6_src = ipp->ipp_addr;
3298 } else {
3299 ip6h->ip6_src = *v6src;
3300 }
3301 ip6h->ip6_vcf =
3302 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
3303 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
3304 if (ipp->ipp_fields & IPPF_TCLASS) {
3305 /* Overrides the class part of flowinfo */
3306 ip6h->ip6_vcf = IPV6_TCLASS_FLOW(ip6h->ip6_vcf,
3307 ipp->ipp_tclass);
3308 }
3309 }
3310
3311 /* Insert all-0s SPI now. */
3312 if (insert_spi)
3313 *((uint32_t *)(udpha + 1)) = 0;
3314
3315 udpha->uha_dst_port = dstport;
3316 return (mp);
3317 }
3318
3319 /*
3320 * Send a T_UDERR_IND in response to an M_DATA
3321 */
3322 static void
3323 udp_ud_err_connected(conn_t *connp, t_scalar_t error)
3324 {
3325 struct sockaddr_storage ss;
3326 sin_t *sin;
3327 sin6_t *sin6;
3328 struct sockaddr *addr;
3329 socklen_t addrlen;
3330 mblk_t *mp1;
3331
3332 mutex_enter(&connp->conn_lock);
3333 /* Initialize addr and addrlen as if they're passed in */
3334 if (connp->conn_family == AF_INET) {
3335 sin = (sin_t *)&ss;
3336 *sin = sin_null;
3337 sin->sin_family = AF_INET;
3338 sin->sin_port = connp->conn_fport;
3339 sin->sin_addr.s_addr = connp->conn_faddr_v4;
3340 addr = (struct sockaddr *)sin;
3341 addrlen = sizeof (*sin);
3342 } else {
3343 sin6 = (sin6_t *)&ss;
3344 *sin6 = sin6_null;
3345 sin6->sin6_family = AF_INET6;
3346 sin6->sin6_port = connp->conn_fport;
3347 sin6->sin6_flowinfo = connp->conn_flowinfo;
3348 sin6->sin6_addr = connp->conn_faddr_v6;
3349 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_faddr_v6) &&
3350 (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) {
3351 sin6->sin6_scope_id = connp->conn_ixa->ixa_scopeid;
3352 } else {
3353 sin6->sin6_scope_id = 0;
3354 }
3355 sin6->__sin6_src_id = 0;
3356 addr = (struct sockaddr *)sin6;
3357 addrlen = sizeof (*sin6);
3358 }
3359 mutex_exit(&connp->conn_lock);
3360
3361 mp1 = mi_tpi_uderror_ind((char *)addr, addrlen, NULL, 0, error);
3362 if (mp1 != NULL)
3363 putnext(connp->conn_rq, mp1);
3364 }
3365
3366 /*
3367 * This routine handles all messages passed downstream. It either
3368 * consumes the message or passes it downstream; it never queues a
3369 * a message.
3370 *
3371 * Also entry point for sockfs when udp is in "direct sockfs" mode. This mode
3372 * is valid when we are directly beneath the stream head, and thus sockfs
3373 * is able to bypass STREAMS and directly call us, passing along the sockaddr
3374 * structure without the cumbersome T_UNITDATA_REQ interface for the case of
3375 * connected endpoints.
3376 */
3377 void
3378 udp_wput(queue_t *q, mblk_t *mp)
3379 {
3380 sin6_t *sin6;
3381 sin_t *sin = NULL;
3382 uint_t srcid;
3383 conn_t *connp = Q_TO_CONN(q);
3384 udp_t *udp = connp->conn_udp;
3385 int error = 0;
3386 struct sockaddr *addr = NULL;
3387 socklen_t addrlen;
3388 udp_stack_t *us = udp->udp_us;
3389 struct T_unitdata_req *tudr;
3390 mblk_t *data_mp;
3391 ushort_t ipversion;
3392 cred_t *cr;
3393 pid_t pid;
3394
3395 /*
3396 * We directly handle several cases here: T_UNITDATA_REQ message
3397 * coming down as M_PROTO/M_PCPROTO and M_DATA messages for connected
3398 * socket.
3399 */
3400 switch (DB_TYPE(mp)) {
3401 case M_DATA:
3402 if (!udp->udp_issocket || udp->udp_state != TS_DATA_XFER) {
3403 /* Not connected; address is required */
3404 UDPS_BUMP_MIB(us, udpOutErrors);
3405 UDP_DBGSTAT(us, udp_data_notconn);
3406 UDP_STAT(us, udp_out_err_notconn);
3407 freemsg(mp);
3408 return;
3409 }
3410 /*
3411 * All Solaris components should pass a db_credp
3412 * for this message, hence we ASSERT.
3413 * On production kernels we return an error to be robust against
3414 * random streams modules sitting on top of us.
3415 */
3416 cr = msg_getcred(mp, &pid);
3417 ASSERT(cr != NULL);
3418 if (cr == NULL) {
3419 UDPS_BUMP_MIB(us, udpOutErrors);
3420 freemsg(mp);
3421 return;
3422 }
3423 ASSERT(udp->udp_issocket);
3424 UDP_DBGSTAT(us, udp_data_conn);
3425 error = udp_output_connected(connp, mp, cr, pid);
3426 if (error != 0) {
3427 UDP_STAT(us, udp_out_err_output);
3428 if (connp->conn_rq != NULL)
3429 udp_ud_err_connected(connp, (t_scalar_t)error);
3430 #ifdef DEBUG
3431 printf("udp_output_connected returned %d\n", error);
3432 #endif
3433 }
3434 return;
3435
3436 case M_PROTO:
3437 case M_PCPROTO:
3438 tudr = (struct T_unitdata_req *)mp->b_rptr;
3439 if (MBLKL(mp) < sizeof (*tudr) ||
3440 ((t_primp_t)mp->b_rptr)->type != T_UNITDATA_REQ) {
3441 udp_wput_other(q, mp);
3442 return;
3443 }
3444 break;
3445
3446 default:
3447 udp_wput_other(q, mp);
3448 return;
3449 }
3450
3451 /* Handle valid T_UNITDATA_REQ here */
3452 data_mp = mp->b_cont;
3453 if (data_mp == NULL) {
3454 error = EPROTO;
3455 goto ud_error2;
3456 }
3457 mp->b_cont = NULL;
3458
3459 if (!MBLKIN(mp, 0, tudr->DEST_offset + tudr->DEST_length)) {
3460 error = EADDRNOTAVAIL;
3461 goto ud_error2;
3462 }
3463
3464 /*
3465 * All Solaris components should pass a db_credp
3466 * for this TPI message, hence we should ASSERT.
3467 * However, RPC (svc_clts_ksend) does this odd thing where it
3468 * passes the options from a T_UNITDATA_IND unchanged in a
3469 * T_UNITDATA_REQ. While that is the right thing to do for
3470 * some options, SCM_UCRED being the key one, this also makes it
3471 * pass down IP_RECVDSTADDR. Hence we can't ASSERT here.
3472 */
3473 cr = msg_getcred(mp, &pid);
3474 if (cr == NULL) {
3475 cr = connp->conn_cred;
3476 pid = connp->conn_cpid;
3477 }
3478
3479 /*
3480 * If a port has not been bound to the stream, fail.
3481 * This is not a problem when sockfs is directly
3482 * above us, because it will ensure that the socket
3483 * is first bound before allowing data to be sent.
3484 */
3485 if (udp->udp_state == TS_UNBND) {
3486 error = EPROTO;
3487 goto ud_error2;
3488 }
3489 addr = (struct sockaddr *)&mp->b_rptr[tudr->DEST_offset];
3490 addrlen = tudr->DEST_length;
3491
3492 switch (connp->conn_family) {
3493 case AF_INET6:
3494 sin6 = (sin6_t *)addr;
3495 if (!OK_32PTR((char *)sin6) || (addrlen != sizeof (sin6_t)) ||
3496 (sin6->sin6_family != AF_INET6)) {
3497 error = EADDRNOTAVAIL;
3498 goto ud_error2;
3499 }
3500
3501 srcid = sin6->__sin6_src_id;
3502 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
3503 /*
3504 * Destination is a non-IPv4-compatible IPv6 address.
3505 * Send out an IPv6 format packet.
3506 */
3507
3508 /*
3509 * If the local address is a mapped address return
3510 * an error.
3511 * It would be possible to send an IPv6 packet but the
3512 * response would never make it back to the application
3513 * since it is bound to a mapped address.
3514 */
3515 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
3516 error = EADDRNOTAVAIL;
3517 goto ud_error2;
3518 }
3519
3520 UDP_DBGSTAT(us, udp_out_ipv6);
3521
3522 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
3523 sin6->sin6_addr = ipv6_loopback;
3524 ipversion = IPV6_VERSION;
3525 } else {
3526 if (connp->conn_ipv6_v6only) {
3527 error = EADDRNOTAVAIL;
3528 goto ud_error2;
3529 }
3530
3531 /*
3532 * If the local address is not zero or a mapped address
3533 * return an error. It would be possible to send an
3534 * IPv4 packet but the response would never make it
3535 * back to the application since it is bound to a
3536 * non-mapped address.
3537 */
3538 if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
3539 !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
3540 error = EADDRNOTAVAIL;
3541 goto ud_error2;
3542 }
3543 UDP_DBGSTAT(us, udp_out_mapped);
3544
3545 if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
3546 V4_PART_OF_V6(sin6->sin6_addr) =
3547 htonl(INADDR_LOOPBACK);
3548 }
3549 ipversion = IPV4_VERSION;
3550 }
3551
3552 if (tudr->OPT_length != 0) {
3553 /*
3554 * If we are connected then the destination needs to be
3555 * the same as the connected one.
3556 */
3557 if (udp->udp_state == TS_DATA_XFER &&
3558 !conn_same_as_last_v6(connp, sin6)) {
3559 error = EISCONN;
3560 goto ud_error2;
3561 }
3562 UDP_STAT(us, udp_out_opt);
3563 error = udp_output_ancillary(connp, NULL, sin6,
3564 data_mp, mp, NULL, cr, pid);
3565 } else {
3566 ip_xmit_attr_t *ixa;
3567
3568 /*
3569 * We have to allocate an ip_xmit_attr_t before we grab
3570 * conn_lock and we need to hold conn_lock once we've
3571 * checked conn_same_as_last_v6 to handle concurrent
3572 * send* calls on a socket.
3573 */
3574 ixa = conn_get_ixa(connp, B_FALSE);
3575 if (ixa == NULL) {
3576 error = ENOMEM;
3577 goto ud_error2;
3578 }
3579 mutex_enter(&connp->conn_lock);
3580
3581 if (conn_same_as_last_v6(connp, sin6) &&
3582 connp->conn_lastsrcid == srcid &&
3583 ipsec_outbound_policy_current(ixa)) {
3584 UDP_DBGSTAT(us, udp_out_lastdst);
3585 /* udp_output_lastdst drops conn_lock */
3586 error = udp_output_lastdst(connp, data_mp, cr,
3587 pid, ixa);
3588 } else {
3589 UDP_DBGSTAT(us, udp_out_diffdst);
3590 /* udp_output_newdst drops conn_lock */
3591 error = udp_output_newdst(connp, data_mp, NULL,
3592 sin6, ipversion, cr, pid, ixa);
3593 }
3594 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3595 }
3596 if (error == 0) {
3597 freeb(mp);
3598 return;
3599 }
3600 break;
3601
3602 case AF_INET:
3603 sin = (sin_t *)addr;
3604 if ((!OK_32PTR((char *)sin) || addrlen != sizeof (sin_t)) ||
3605 (sin->sin_family != AF_INET)) {
3606 error = EADDRNOTAVAIL;
3607 goto ud_error2;
3608 }
3609 UDP_DBGSTAT(us, udp_out_ipv4);
3610 if (sin->sin_addr.s_addr == INADDR_ANY)
3611 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
3612 ipversion = IPV4_VERSION;
3613
3614 srcid = 0;
3615 if (tudr->OPT_length != 0) {
3616 /*
3617 * If we are connected then the destination needs to be
3618 * the same as the connected one.
3619 */
3620 if (udp->udp_state == TS_DATA_XFER &&
3621 !conn_same_as_last_v4(connp, sin)) {
3622 error = EISCONN;
3623 goto ud_error2;
3624 }
3625 UDP_STAT(us, udp_out_opt);
3626 error = udp_output_ancillary(connp, sin, NULL,
3627 data_mp, mp, NULL, cr, pid);
3628 } else {
3629 ip_xmit_attr_t *ixa;
3630
3631 /*
3632 * We have to allocate an ip_xmit_attr_t before we grab
3633 * conn_lock and we need to hold conn_lock once we've
3634 * checked conn_same_as_last_v4 to handle concurrent
3635 * send* calls on a socket.
3636 */
3637 ixa = conn_get_ixa(connp, B_FALSE);
3638 if (ixa == NULL) {
3639 error = ENOMEM;
3640 goto ud_error2;
3641 }
3642 mutex_enter(&connp->conn_lock);
3643
3644 if (conn_same_as_last_v4(connp, sin) &&
3645 ipsec_outbound_policy_current(ixa)) {
3646 UDP_DBGSTAT(us, udp_out_lastdst);
3647 /* udp_output_lastdst drops conn_lock */
3648 error = udp_output_lastdst(connp, data_mp, cr,
3649 pid, ixa);
3650 } else {
3651 UDP_DBGSTAT(us, udp_out_diffdst);
3652 /* udp_output_newdst drops conn_lock */
3653 error = udp_output_newdst(connp, data_mp, sin,
3654 NULL, ipversion, cr, pid, ixa);
3655 }
3656 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
3657 }
3658 if (error == 0) {
3659 freeb(mp);
3660 return;
3661 }
3662 break;
3663 }
3664 UDP_STAT(us, udp_out_err_output);
3665 ASSERT(mp != NULL);
3666 /* mp is freed by the following routine */
3667 udp_ud_err(q, mp, (t_scalar_t)error);
3668 return;
3669
3670 ud_error2:
3671 UDPS_BUMP_MIB(us, udpOutErrors);
3672 freemsg(data_mp);
3673 UDP_STAT(us, udp_out_err_output);
3674 ASSERT(mp != NULL);
3675 /* mp is freed by the following routine */
3676 udp_ud_err(q, mp, (t_scalar_t)error);
3677 }
3678
3679 /*
3680 * Handle the case of the IP address, port, flow label being different
3681 * for both IPv4 and IPv6.
3682 *
3683 * NOTE: The caller must hold conn_lock and we drop it here.
3684 */
3685 static int
3686 udp_output_newdst(conn_t *connp, mblk_t *data_mp, sin_t *sin, sin6_t *sin6,
3687 ushort_t ipversion, cred_t *cr, pid_t pid, ip_xmit_attr_t *ixa)
3688 {
3689 uint_t srcid;
3690 uint32_t flowinfo;
3691 udp_t *udp = connp->conn_udp;
3692 int error = 0;
3693 ip_xmit_attr_t *oldixa;
3694 udp_stack_t *us = udp->udp_us;
3695 in6_addr_t v6src;
3696 in6_addr_t v6dst;
3697 in6_addr_t v6nexthop;
3698 in_port_t dstport;
3699
3700 ASSERT(MUTEX_HELD(&connp->conn_lock));
3701 ASSERT(ixa != NULL);
3702 /*
3703 * We hold conn_lock across all the use and modifications of
3704 * the conn_lastdst, conn_ixa, and conn_xmit_ipp to ensure that they
3705 * stay consistent.
3706 */
3707
3708 ASSERT(cr != NULL);
3709 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3710 ixa->ixa_cred = cr;
3711 ixa->ixa_cpid = pid;
3712 if (is_system_labeled()) {
3713 /* We need to restart with a label based on the cred */
3714 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
3715 }
3716
3717 /*
3718 * If we are connected then the destination needs to be the
3719 * same as the connected one, which is not the case here since we
3720 * checked for that above.
3721 */
3722 if (udp->udp_state == TS_DATA_XFER) {
3723 mutex_exit(&connp->conn_lock);
3724 error = EISCONN;
3725 goto ud_error;
3726 }
3727
3728 /* In case previous destination was multicast or multirt */
3729 ip_attr_newdst(ixa);
3730
3731 /*
3732 * If laddr is unspecified then we look at sin6_src_id.
3733 * We will give precedence to a source address set with IPV6_PKTINFO
3734 * (aka IPPF_ADDR) but that is handled in build_hdrs. However, we don't
3735 * want ip_attr_connect to select a source (since it can fail) when
3736 * IPV6_PKTINFO is specified.
3737 * If this doesn't result in a source address then we get a source
3738 * from ip_attr_connect() below.
3739 */
3740 v6src = connp->conn_saddr_v6;
3741 if (sin != NULL) {
3742 IN6_IPADDR_TO_V4MAPPED(sin->sin_addr.s_addr, &v6dst);
3743 dstport = sin->sin_port;
3744 flowinfo = 0;
3745 /* Don't bother with ip_srcid_find_id(), but indicate anyway. */
3746 srcid = 0;
3747 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3748 ixa->ixa_flags |= IXAF_IS_IPV4;
3749 } else {
3750 boolean_t v4mapped;
3751
3752 v6dst = sin6->sin6_addr;
3753 dstport = sin6->sin6_port;
3754 flowinfo = sin6->sin6_flowinfo;
3755 srcid = sin6->__sin6_src_id;
3756 if (IN6_IS_ADDR_LINKSCOPE(&v6dst) && sin6->sin6_scope_id != 0) {
3757 ixa->ixa_scopeid = sin6->sin6_scope_id;
3758 ixa->ixa_flags |= IXAF_SCOPEID_SET;
3759 } else {
3760 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
3761 }
3762 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
3763 if (v4mapped)
3764 ixa->ixa_flags |= IXAF_IS_IPV4;
3765 else
3766 ixa->ixa_flags &= ~IXAF_IS_IPV4;
3767 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
3768 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
3769 v4mapped, connp->conn_netstack)) {
3770 /* Mismatched v4mapped/v6 specified by srcid. */
3771 mutex_exit(&connp->conn_lock);
3772 error = EADDRNOTAVAIL;
3773 goto ud_error;
3774 }
3775 }
3776 }
3777 /* Handle IP_PKTINFO/IPV6_PKTINFO setting source address. */
3778 if (connp->conn_xmit_ipp.ipp_fields & IPPF_ADDR) {
3779 ip_pkt_t *ipp = &connp->conn_xmit_ipp;
3780
3781 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3782 if (IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3783 v6src = ipp->ipp_addr;
3784 } else {
3785 if (!IN6_IS_ADDR_V4MAPPED(&ipp->ipp_addr))
3786 v6src = ipp->ipp_addr;
3787 }
3788 }
3789
3790 ip_attr_nexthop(&connp->conn_xmit_ipp, ixa, &v6dst, &v6nexthop);
3791 mutex_exit(&connp->conn_lock);
3792
3793 error = ip_attr_connect(connp, ixa, &v6src, &v6dst, &v6nexthop, dstport,
3794 &v6src, NULL, IPDF_ALLOW_MCBC | IPDF_VERIFY_DST | IPDF_IPSEC);
3795 switch (error) {
3796 case 0:
3797 break;
3798 case EADDRNOTAVAIL:
3799 /*
3800 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3801 * Don't have the application see that errno
3802 */
3803 error = ENETUNREACH;
3804 goto failed;
3805 case ENETDOWN:
3806 /*
3807 * Have !ipif_addr_ready address; drop packet silently
3808 * until we can get applications to not send until we
3809 * are ready.
3810 */
3811 error = 0;
3812 goto failed;
3813 case EHOSTUNREACH:
3814 case ENETUNREACH:
3815 if (ixa->ixa_ire != NULL) {
3816 /*
3817 * Let conn_ip_output/ire_send_noroute return
3818 * the error and send any local ICMP error.
3819 */
3820 error = 0;
3821 break;
3822 }
3823 /* FALLTHRU */
3824 failed:
3825 default:
3826 goto ud_error;
3827 }
3828
3829
3830 /*
3831 * Cluster note: we let the cluster hook know that we are sending to a
3832 * new address and/or port.
3833 */
3834 if (cl_inet_connect2 != NULL) {
3835 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
3836 if (error != 0) {
3837 error = EHOSTUNREACH;
3838 goto ud_error;
3839 }
3840 }
3841
3842 mutex_enter(&connp->conn_lock);
3843 /*
3844 * While we dropped the lock some other thread might have connected
3845 * this socket. If so we bail out with EISCONN to ensure that the
3846 * connecting thread is the one that updates conn_ixa, conn_ht_*
3847 * and conn_*last*.
3848 */
3849 if (udp->udp_state == TS_DATA_XFER) {
3850 mutex_exit(&connp->conn_lock);
3851 error = EISCONN;
3852 goto ud_error;
3853 }
3854
3855 /*
3856 * We need to rebuild the headers if
3857 * - we are labeling packets (could be different for different
3858 * destinations)
3859 * - we have a source route (or routing header) since we need to
3860 * massage that to get the pseudo-header checksum
3861 * - the IP version is different than the last time
3862 * - a socket option with COA_HEADER_CHANGED has been set which
3863 * set conn_v6lastdst to zero.
3864 *
3865 * Otherwise the prepend function will just update the src, dst,
3866 * dstport, and flow label.
3867 */
3868 if (is_system_labeled()) {
3869 /* TX MLP requires SCM_UCRED and don't have that here */
3870 if (connp->conn_mlp_type != mlptSingle) {
3871 mutex_exit(&connp->conn_lock);
3872 error = ECONNREFUSED;
3873 goto ud_error;
3874 }
3875 /*
3876 * Check whether Trusted Solaris policy allows communication
3877 * with this host, and pretend that the destination is
3878 * unreachable if not.
3879 * Compute any needed label and place it in ipp_label_v4/v6.
3880 *
3881 * Later conn_build_hdr_template/conn_prepend_hdr takes
3882 * ipp_label_v4/v6 to form the packet.
3883 *
3884 * Tsol note: Since we hold conn_lock we know no other
3885 * thread manipulates conn_xmit_ipp.
3886 */
3887 error = conn_update_label(connp, ixa, &v6dst,
3888 &connp->conn_xmit_ipp);
3889 if (error != 0) {
3890 mutex_exit(&connp->conn_lock);
3891 goto ud_error;
3892 }
3893 /* Rebuild the header template */
3894 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
3895 flowinfo);
3896 if (error != 0) {
3897 mutex_exit(&connp->conn_lock);
3898 goto ud_error;
3899 }
3900 } else if ((connp->conn_xmit_ipp.ipp_fields &
3901 (IPPF_IPV4_OPTIONS|IPPF_RTHDR)) ||
3902 ipversion != connp->conn_lastipversion ||
3903 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_v6lastdst)) {
3904 /* Rebuild the header template */
3905 error = udp_build_hdr_template(connp, &v6src, &v6dst, dstport,
3906 flowinfo);
3907 if (error != 0) {
3908 mutex_exit(&connp->conn_lock);
3909 goto ud_error;
3910 }
3911 } else {
3912 /* Simply update the destination address if no source route */
3913 if (ixa->ixa_flags & IXAF_IS_IPV4) {
3914 ipha_t *ipha = (ipha_t *)connp->conn_ht_iphc;
3915
3916 IN6_V4MAPPED_TO_IPADDR(&v6dst, ipha->ipha_dst);
3917 if (ixa->ixa_flags & IXAF_PMTU_IPV4_DF) {
3918 ipha->ipha_fragment_offset_and_flags |=
3919 IPH_DF_HTONS;
3920 } else {
3921 ipha->ipha_fragment_offset_and_flags &=
3922 ~IPH_DF_HTONS;
3923 }
3924 } else {
3925 ip6_t *ip6h = (ip6_t *)connp->conn_ht_iphc;
3926 ip6h->ip6_dst = v6dst;
3927 }
3928 }
3929
3930 /*
3931 * Remember the dst/dstport etc which corresponds to the built header
3932 * template and conn_ixa.
3933 */
3934 oldixa = conn_replace_ixa(connp, ixa);
3935 connp->conn_v6lastdst = v6dst;
3936 connp->conn_lastipversion = ipversion;
3937 connp->conn_lastdstport = dstport;
3938 connp->conn_lastflowinfo = flowinfo;
3939 connp->conn_lastscopeid = ixa->ixa_scopeid;
3940 connp->conn_lastsrcid = srcid;
3941 /* Also remember a source to use together with lastdst */
3942 connp->conn_v6lastsrc = v6src;
3943
3944 data_mp = udp_prepend_header_template(connp, ixa, data_mp, &v6src,
3945 dstport, flowinfo, &error);
3946
3947 /* Done with conn_t */
3948 mutex_exit(&connp->conn_lock);
3949 ixa_refrele(oldixa);
3950
3951 if (data_mp == NULL) {
3952 ASSERT(error != 0);
3953 goto ud_error;
3954 }
3955
3956 /* We're done. Pass the packet to ip. */
3957 UDPS_BUMP_MIB(us, udpHCOutDatagrams);
3958
3959 DTRACE_UDP5(send, mblk_t *, NULL, ip_xmit_attr_t *, ixa,
3960 void_ip_t *, data_mp->b_rptr, udp_t *, udp, udpha_t *,
3961 &data_mp->b_rptr[ixa->ixa_ip_hdr_length]);
3962
3963 error = conn_ip_output(data_mp, ixa);
3964 /* No udpOutErrors if an error since IP increases its error counter */
3965 switch (error) {
3966 case 0:
3967 break;
3968 case EWOULDBLOCK:
3969 (void) ixa_check_drain_insert(connp, ixa);
3970 error = 0;
3971 break;
3972 case EADDRNOTAVAIL:
3973 /*
3974 * IXAF_VERIFY_SOURCE tells us to pick a better source.
3975 * Don't have the application see that errno
3976 */
3977 error = ENETUNREACH;
3978 /* FALLTHRU */
3979 default:
3980 mutex_enter(&connp->conn_lock);
3981 /*
3982 * Clear the source and v6lastdst so we call ip_attr_connect
3983 * for the next packet and try to pick a better source.
3984 */
3985 if (connp->conn_mcbc_bind)
3986 connp->conn_saddr_v6 = ipv6_all_zeros;
3987 else
3988 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
3989 connp->conn_v6lastdst = ipv6_all_zeros;
3990 mutex_exit(&connp->conn_lock);
3991 break;
3992 }
3993 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
3994 ixa->ixa_cred = connp->conn_cred; /* Restore */
3995 ixa->ixa_cpid = connp->conn_cpid;
3996 ixa_refrele(ixa);
3997 return (error);
3998
3999 ud_error:
4000 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4001 ixa->ixa_cred = connp->conn_cred; /* Restore */
4002 ixa->ixa_cpid = connp->conn_cpid;
4003 ixa_refrele(ixa);
4004
4005 freemsg(data_mp);
4006 UDPS_BUMP_MIB(us, udpOutErrors);
4007 UDP_STAT(us, udp_out_err_output);
4008 return (error);
4009 }
4010
4011 /* ARGSUSED */
4012 static void
4013 udp_wput_fallback(queue_t *wq, mblk_t *mp)
4014 {
4015 #ifdef DEBUG
4016 cmn_err(CE_CONT, "udp_wput_fallback: Message in fallback \n");
4017 #endif
4018 freemsg(mp);
4019 }
4020
4021
4022 /*
4023 * Handle special out-of-band ioctl requests (see PSARC/2008/265).
4024 */
4025 static void
4026 udp_wput_cmdblk(queue_t *q, mblk_t *mp)
4027 {
4028 void *data;
4029 mblk_t *datamp = mp->b_cont;
4030 conn_t *connp = Q_TO_CONN(q);
4031 udp_t *udp = connp->conn_udp;
4032 cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr;
4033
4034 if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) {
4035 cmdp->cb_error = EPROTO;
4036 qreply(q, mp);
4037 return;
4038 }
4039 data = datamp->b_rptr;
4040
4041 mutex_enter(&connp->conn_lock);
4042 switch (cmdp->cb_cmd) {
4043 case TI_GETPEERNAME:
4044 if (udp->udp_state != TS_DATA_XFER)
4045 cmdp->cb_error = ENOTCONN;
4046 else
4047 cmdp->cb_error = conn_getpeername(connp, data,
4048 &cmdp->cb_len);
4049 break;
4050 case TI_GETMYNAME:
4051 cmdp->cb_error = conn_getsockname(connp, data, &cmdp->cb_len);
4052 break;
4053 default:
4054 cmdp->cb_error = EINVAL;
4055 break;
4056 }
4057 mutex_exit(&connp->conn_lock);
4058
4059 qreply(q, mp);
4060 }
4061
4062 static void
4063 udp_use_pure_tpi(udp_t *udp)
4064 {
4065 conn_t *connp = udp->udp_connp;
4066
4067 mutex_enter(&connp->conn_lock);
4068 udp->udp_issocket = B_FALSE;
4069 mutex_exit(&connp->conn_lock);
4070 UDP_STAT(udp->udp_us, udp_sock_fallback);
4071 }
4072
4073 static void
4074 udp_wput_other(queue_t *q, mblk_t *mp)
4075 {
4076 uchar_t *rptr = mp->b_rptr;
4077 struct iocblk *iocp;
4078 conn_t *connp = Q_TO_CONN(q);
4079 udp_t *udp = connp->conn_udp;
4080 cred_t *cr;
4081
4082 switch (mp->b_datap->db_type) {
4083 case M_CMD:
4084 udp_wput_cmdblk(q, mp);
4085 return;
4086
4087 case M_PROTO:
4088 case M_PCPROTO:
4089 if (mp->b_wptr - rptr < sizeof (t_scalar_t)) {
4090 /*
4091 * If the message does not contain a PRIM_type,
4092 * throw it away.
4093 */
4094 freemsg(mp);
4095 return;
4096 }
4097 switch (((t_primp_t)rptr)->type) {
4098 case T_ADDR_REQ:
4099 udp_addr_req(q, mp);
4100 return;
4101 case O_T_BIND_REQ:
4102 case T_BIND_REQ:
4103 udp_tpi_bind(q, mp);
4104 return;
4105 case T_CONN_REQ:
4106 udp_tpi_connect(q, mp);
4107 return;
4108 case T_CAPABILITY_REQ:
4109 udp_capability_req(q, mp);
4110 return;
4111 case T_INFO_REQ:
4112 udp_info_req(q, mp);
4113 return;
4114 case T_UNITDATA_REQ:
4115 /*
4116 * If a T_UNITDATA_REQ gets here, the address must
4117 * be bad. Valid T_UNITDATA_REQs are handled
4118 * in udp_wput.
4119 */
4120 udp_ud_err(q, mp, EADDRNOTAVAIL);
4121 return;
4122 case T_UNBIND_REQ:
4123 udp_tpi_unbind(q, mp);
4124 return;
4125 case T_SVR4_OPTMGMT_REQ:
4126 /*
4127 * All Solaris components should pass a db_credp
4128 * for this TPI message, hence we ASSERT.
4129 * But in case there is some other M_PROTO that looks
4130 * like a TPI message sent by some other kernel
4131 * component, we check and return an error.
4132 */
4133 cr = msg_getcred(mp, NULL);
4134 ASSERT(cr != NULL);
4135 if (cr == NULL) {
4136 udp_err_ack(q, mp, TSYSERR, EINVAL);
4137 return;
4138 }
4139 if (!snmpcom_req(q, mp, udp_snmp_set, ip_snmp_get,
4140 cr)) {
4141 svr4_optcom_req(q, mp, cr, &udp_opt_obj);
4142 }
4143 return;
4144
4145 case T_OPTMGMT_REQ:
4146 /*
4147 * All Solaris components should pass a db_credp
4148 * for this TPI message, hence we ASSERT.
4149 * But in case there is some other M_PROTO that looks
4150 * like a TPI message sent by some other kernel
4151 * component, we check and return an error.
4152 */
4153 cr = msg_getcred(mp, NULL);
4154 ASSERT(cr != NULL);
4155 if (cr == NULL) {
4156 udp_err_ack(q, mp, TSYSERR, EINVAL);
4157 return;
4158 }
4159 tpi_optcom_req(q, mp, cr, &udp_opt_obj);
4160 return;
4161
4162 case T_DISCON_REQ:
4163 udp_tpi_disconnect(q, mp);
4164 return;
4165
4166 /* The following TPI message is not supported by udp. */
4167 case O_T_CONN_RES:
4168 case T_CONN_RES:
4169 udp_err_ack(q, mp, TNOTSUPPORT, 0);
4170 return;
4171
4172 /* The following 3 TPI requests are illegal for udp. */
4173 case T_DATA_REQ:
4174 case T_EXDATA_REQ:
4175 case T_ORDREL_REQ:
4176 udp_err_ack(q, mp, TNOTSUPPORT, 0);
4177 return;
4178 default:
4179 break;
4180 }
4181 break;
4182 case M_FLUSH:
4183 if (*rptr & FLUSHW)
4184 flushq(q, FLUSHDATA);
4185 break;
4186 case M_IOCTL:
4187 iocp = (struct iocblk *)mp->b_rptr;
4188 switch (iocp->ioc_cmd) {
4189 case TI_GETPEERNAME:
4190 if (udp->udp_state != TS_DATA_XFER) {
4191 /*
4192 * If a default destination address has not
4193 * been associated with the stream, then we
4194 * don't know the peer's name.
4195 */
4196 iocp->ioc_error = ENOTCONN;
4197 iocp->ioc_count = 0;
4198 mp->b_datap->db_type = M_IOCACK;
4199 qreply(q, mp);
4200 return;
4201 }
4202 /* FALLTHRU */
4203 case TI_GETMYNAME:
4204 /*
4205 * For TI_GETPEERNAME and TI_GETMYNAME, we first
4206 * need to copyin the user's strbuf structure.
4207 * Processing will continue in the M_IOCDATA case
4208 * below.
4209 */
4210 mi_copyin(q, mp, NULL,
4211 SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
4212 return;
4213 case _SIOCSOCKFALLBACK:
4214 /*
4215 * Either sockmod is about to be popped and the
4216 * socket would now be treated as a plain stream,
4217 * or a module is about to be pushed so we have
4218 * to follow pure TPI semantics.
4219 */
4220 if (!udp->udp_issocket) {
4221 DB_TYPE(mp) = M_IOCNAK;
4222 iocp->ioc_error = EINVAL;
4223 } else {
4224 udp_use_pure_tpi(udp);
4225
4226 DB_TYPE(mp) = M_IOCACK;
4227 iocp->ioc_error = 0;
4228 }
4229 iocp->ioc_count = 0;
4230 iocp->ioc_rval = 0;
4231 qreply(q, mp);
4232 return;
4233 default:
4234 break;
4235 }
4236 break;
4237 case M_IOCDATA:
4238 udp_wput_iocdata(q, mp);
4239 return;
4240 default:
4241 /* Unrecognized messages are passed through without change. */
4242 break;
4243 }
4244 ip_wput_nondata(q, mp);
4245 }
4246
4247 /*
4248 * udp_wput_iocdata is called by udp_wput_other to handle all M_IOCDATA
4249 * messages.
4250 */
4251 static void
4252 udp_wput_iocdata(queue_t *q, mblk_t *mp)
4253 {
4254 mblk_t *mp1;
4255 struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
4256 STRUCT_HANDLE(strbuf, sb);
4257 uint_t addrlen;
4258 conn_t *connp = Q_TO_CONN(q);
4259 udp_t *udp = connp->conn_udp;
4260
4261 /* Make sure it is one of ours. */
4262 switch (iocp->ioc_cmd) {
4263 case TI_GETMYNAME:
4264 case TI_GETPEERNAME:
4265 break;
4266 default:
4267 ip_wput_nondata(q, mp);
4268 return;
4269 }
4270
4271 switch (mi_copy_state(q, mp, &mp1)) {
4272 case -1:
4273 return;
4274 case MI_COPY_CASE(MI_COPY_IN, 1):
4275 break;
4276 case MI_COPY_CASE(MI_COPY_OUT, 1):
4277 /*
4278 * The address has been copied out, so now
4279 * copyout the strbuf.
4280 */
4281 mi_copyout(q, mp);
4282 return;
4283 case MI_COPY_CASE(MI_COPY_OUT, 2):
4284 /*
4285 * The address and strbuf have been copied out.
4286 * We're done, so just acknowledge the original
4287 * M_IOCTL.
4288 */
4289 mi_copy_done(q, mp, 0);
4290 return;
4291 default:
4292 /*
4293 * Something strange has happened, so acknowledge
4294 * the original M_IOCTL with an EPROTO error.
4295 */
4296 mi_copy_done(q, mp, EPROTO);
4297 return;
4298 }
4299
4300 /*
4301 * Now we have the strbuf structure for TI_GETMYNAME
4302 * and TI_GETPEERNAME. Next we copyout the requested
4303 * address and then we'll copyout the strbuf.
4304 */
4305 STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr);
4306
4307 if (connp->conn_family == AF_INET)
4308 addrlen = sizeof (sin_t);
4309 else
4310 addrlen = sizeof (sin6_t);
4311
4312 if (STRUCT_FGET(sb, maxlen) < addrlen) {
4313 mi_copy_done(q, mp, EINVAL);
4314 return;
4315 }
4316
4317 switch (iocp->ioc_cmd) {
4318 case TI_GETMYNAME:
4319 break;
4320 case TI_GETPEERNAME:
4321 if (udp->udp_state != TS_DATA_XFER) {
4322 mi_copy_done(q, mp, ENOTCONN);
4323 return;
4324 }
4325 break;
4326 }
4327 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
4328 if (!mp1)
4329 return;
4330
4331 STRUCT_FSET(sb, len, addrlen);
4332 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
4333 case TI_GETMYNAME:
4334 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr,
4335 &addrlen);
4336 break;
4337 case TI_GETPEERNAME:
4338 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr,
4339 &addrlen);
4340 break;
4341 }
4342 mp1->b_wptr += addrlen;
4343 /* Copy out the address */
4344 mi_copyout(q, mp);
4345 }
4346
4347 void
4348 udp_ddi_g_init(void)
4349 {
4350 udp_max_optsize = optcom_max_optsize(udp_opt_obj.odb_opt_des_arr,
4351 udp_opt_obj.odb_opt_arr_cnt);
4352
4353 /*
4354 * We want to be informed each time a stack is created or
4355 * destroyed in the kernel, so we can maintain the
4356 * set of udp_stack_t's.
4357 */
4358 netstack_register(NS_UDP, udp_stack_init, NULL, udp_stack_fini);
4359 }
4360
4361 void
4362 udp_ddi_g_destroy(void)
4363 {
4364 netstack_unregister(NS_UDP);
4365 }
4366
4367 #define INET_NAME "ip"
4368
4369 /*
4370 * Initialize the UDP stack instance.
4371 */
4372 static void *
4373 udp_stack_init(netstackid_t stackid, netstack_t *ns)
4374 {
4375 udp_stack_t *us;
4376 int i;
4377 int error = 0;
4378 major_t major;
4379 size_t arrsz;
4380
4381 us = (udp_stack_t *)kmem_zalloc(sizeof (*us), KM_SLEEP);
4382 us->us_netstack = ns;
4383
4384 mutex_init(&us->us_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
4385 us->us_num_epriv_ports = UDP_NUM_EPRIV_PORTS;
4386 us->us_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
4387 us->us_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
4388
4389 /*
4390 * The smallest anonymous port in the priviledged port range which UDP
4391 * looks for free port. Use in the option UDP_ANONPRIVBIND.
4392 */
4393 us->us_min_anonpriv_port = 512;
4394
4395 us->us_bind_fanout_size = udp_bind_fanout_size;
4396
4397 /* Roundup variable that might have been modified in /etc/system */
4398 if (!ISP2(us->us_bind_fanout_size)) {
4399 /* Not a power of two. Round up to nearest power of two */
4400 for (i = 0; i < 31; i++) {
4401 if (us->us_bind_fanout_size < (1 << i))
4402 break;
4403 }
4404 us->us_bind_fanout_size = 1 << i;
4405 }
4406 us->us_bind_fanout = kmem_zalloc(us->us_bind_fanout_size *
4407 sizeof (udp_fanout_t), KM_SLEEP);
4408 for (i = 0; i < us->us_bind_fanout_size; i++) {
4409 mutex_init(&us->us_bind_fanout[i].uf_lock, NULL, MUTEX_DEFAULT,
4410 NULL);
4411 }
4412
4413 arrsz = udp_propinfo_count * sizeof (mod_prop_info_t);
4414 us->us_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
4415 KM_SLEEP);
4416 bcopy(udp_propinfo_tbl, us->us_propinfo_tbl, arrsz);
4417
4418 /* Allocate the per netstack stats */
4419 mutex_enter(&cpu_lock);
4420 us->us_sc_cnt = MAX(ncpus, boot_ncpus);
4421 mutex_exit(&cpu_lock);
4422 us->us_sc = kmem_zalloc(max_ncpus * sizeof (udp_stats_cpu_t *),
4423 KM_SLEEP);
4424 for (i = 0; i < us->us_sc_cnt; i++) {
4425 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4426 KM_SLEEP);
4427 }
4428
4429 us->us_kstat = udp_kstat2_init(stackid);
4430 us->us_mibkp = udp_kstat_init(stackid);
4431
4432 major = mod_name_to_major(INET_NAME);
4433 error = ldi_ident_from_major(major, &us->us_ldi_ident);
4434 ASSERT(error == 0);
4435 return (us);
4436 }
4437
4438 /*
4439 * Free the UDP stack instance.
4440 */
4441 static void
4442 udp_stack_fini(netstackid_t stackid, void *arg)
4443 {
4444 udp_stack_t *us = (udp_stack_t *)arg;
4445 int i;
4446
4447 for (i = 0; i < us->us_bind_fanout_size; i++) {
4448 mutex_destroy(&us->us_bind_fanout[i].uf_lock);
4449 }
4450
4451 kmem_free(us->us_bind_fanout, us->us_bind_fanout_size *
4452 sizeof (udp_fanout_t));
4453
4454 us->us_bind_fanout = NULL;
4455
4456 for (i = 0; i < us->us_sc_cnt; i++)
4457 kmem_free(us->us_sc[i], sizeof (udp_stats_cpu_t));
4458 kmem_free(us->us_sc, max_ncpus * sizeof (udp_stats_cpu_t *));
4459
4460 kmem_free(us->us_propinfo_tbl,
4461 udp_propinfo_count * sizeof (mod_prop_info_t));
4462 us->us_propinfo_tbl = NULL;
4463
4464 udp_kstat_fini(stackid, us->us_mibkp);
4465 us->us_mibkp = NULL;
4466
4467 udp_kstat2_fini(stackid, us->us_kstat);
4468 us->us_kstat = NULL;
4469
4470 mutex_destroy(&us->us_epriv_port_lock);
4471 ldi_ident_release(us->us_ldi_ident);
4472 kmem_free(us, sizeof (*us));
4473 }
4474
4475 static size_t
4476 udp_set_rcv_hiwat(udp_t *udp, size_t size)
4477 {
4478 udp_stack_t *us = udp->udp_us;
4479
4480 /* We add a bit of extra buffering */
4481 size += size >> 1;
4482 if (size > us->us_max_buf)
4483 size = us->us_max_buf;
4484
4485 udp->udp_rcv_hiwat = size;
4486 return (size);
4487 }
4488
4489 /*
4490 * For the lower queue so that UDP can be a dummy mux.
4491 * Nobody should be sending
4492 * packets up this stream
4493 */
4494 static void
4495 udp_lrput(queue_t *q, mblk_t *mp)
4496 {
4497 switch (mp->b_datap->db_type) {
4498 case M_FLUSH:
4499 /* Turn around */
4500 if (*mp->b_rptr & FLUSHW) {
4501 *mp->b_rptr &= ~FLUSHR;
4502 qreply(q, mp);
4503 return;
4504 }
4505 break;
4506 }
4507 freemsg(mp);
4508 }
4509
4510 /*
4511 * For the lower queue so that UDP can be a dummy mux.
4512 * Nobody should be sending packets down this stream.
4513 */
4514 /* ARGSUSED */
4515 void
4516 udp_lwput(queue_t *q, mblk_t *mp)
4517 {
4518 freemsg(mp);
4519 }
4520
4521 /*
4522 * When a CPU is added, we need to allocate the per CPU stats struct.
4523 */
4524 void
4525 udp_stack_cpu_add(udp_stack_t *us, processorid_t cpu_seqid)
4526 {
4527 int i;
4528
4529 if (cpu_seqid < us->us_sc_cnt)
4530 return;
4531 for (i = us->us_sc_cnt; i <= cpu_seqid; i++) {
4532 ASSERT(us->us_sc[i] == NULL);
4533 us->us_sc[i] = kmem_zalloc(sizeof (udp_stats_cpu_t),
4534 KM_SLEEP);
4535 }
4536 membar_producer();
4537 us->us_sc_cnt = cpu_seqid + 1;
4538 }
4539
4540 /*
4541 * Below routines for UDP socket module.
4542 */
4543
4544 static conn_t *
4545 udp_do_open(cred_t *credp, boolean_t isv6, int flags, int *errorp)
4546 {
4547 udp_t *udp;
4548 conn_t *connp;
4549 zoneid_t zoneid;
4550 netstack_t *ns;
4551 udp_stack_t *us;
4552 int len;
4553
4554 ASSERT(errorp != NULL);
4555
4556 if ((*errorp = secpolicy_basic_net_access(credp)) != 0)
4557 return (NULL);
4558
4559 ns = netstack_find_by_cred(credp);
4560 ASSERT(ns != NULL);
4561 us = ns->netstack_udp;
4562 ASSERT(us != NULL);
4563
4564 /*
4565 * For exclusive stacks we set the zoneid to zero
4566 * to make UDP operate as if in the global zone.
4567 */
4568 if (ns->netstack_stackid != GLOBAL_NETSTACKID)
4569 zoneid = GLOBAL_ZONEID;
4570 else
4571 zoneid = crgetzoneid(credp);
4572
4573 ASSERT(flags == KM_SLEEP || flags == KM_NOSLEEP);
4574
4575 connp = ipcl_conn_create(IPCL_UDPCONN, flags, ns);
4576 if (connp == NULL) {
4577 netstack_rele(ns);
4578 *errorp = ENOMEM;
4579 return (NULL);
4580 }
4581 udp = connp->conn_udp;
4582
4583 /*
4584 * ipcl_conn_create did a netstack_hold. Undo the hold that was
4585 * done by netstack_find_by_cred()
4586 */
4587 netstack_rele(ns);
4588
4589 /*
4590 * Since this conn_t/udp_t is not yet visible to anybody else we don't
4591 * need to lock anything.
4592 */
4593 ASSERT(connp->conn_proto == IPPROTO_UDP);
4594 ASSERT(connp->conn_udp == udp);
4595 ASSERT(udp->udp_connp == connp);
4596
4597 /* Set the initial state of the stream and the privilege status. */
4598 udp->udp_state = TS_UNBND;
4599 connp->conn_ixa->ixa_flags |= IXAF_VERIFY_SOURCE;
4600 if (isv6) {
4601 connp->conn_family = AF_INET6;
4602 connp->conn_ipversion = IPV6_VERSION;
4603 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4604 connp->conn_default_ttl = us->us_ipv6_hoplimit;
4605 len = sizeof (ip6_t) + UDPH_SIZE;
4606 } else {
4607 connp->conn_family = AF_INET;
4608 connp->conn_ipversion = IPV4_VERSION;
4609 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4610 connp->conn_default_ttl = us->us_ipv4_ttl;
4611 len = sizeof (ipha_t) + UDPH_SIZE;
4612 }
4613
4614 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
4615 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
4616
4617 connp->conn_ixa->ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
4618 connp->conn_ixa->ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_ULP_CKSUM;
4619 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
4620 connp->conn_ixa->ixa_zoneid = zoneid;
4621
4622 connp->conn_zoneid = zoneid;
4623
4624 /*
4625 * If the caller has the process-wide flag set, then default to MAC
4626 * exempt mode. This allows read-down to unlabeled hosts.
4627 */
4628 if (getpflags(NET_MAC_AWARE, credp) != 0)
4629 connp->conn_mac_mode = CONN_MAC_AWARE;
4630
4631 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
4632
4633 udp->udp_us = us;
4634
4635 connp->conn_rcvbuf = us->us_recv_hiwat;
4636 connp->conn_sndbuf = us->us_xmit_hiwat;
4637 connp->conn_sndlowat = us->us_xmit_lowat;
4638 connp->conn_rcvlowat = udp_mod_info.mi_lowat;
4639
4640 connp->conn_wroff = len + us->us_wroff_extra;
4641 connp->conn_so_type = SOCK_DGRAM;
4642
4643 connp->conn_recv = udp_input;
4644 connp->conn_recvicmp = udp_icmp_input;
4645 crhold(credp);
4646 connp->conn_cred = credp;
4647 connp->conn_cpid = curproc->p_pid;
4648 connp->conn_open_time = ddi_get_lbolt64();
4649 /* Cache things in ixa without an extra refhold */
4650 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
4651 connp->conn_ixa->ixa_cred = connp->conn_cred;
4652 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
4653 if (is_system_labeled())
4654 connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
4655
4656 *((sin6_t *)&udp->udp_delayed_addr) = sin6_null;
4657
4658 if (us->us_pmtu_discovery)
4659 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
4660
4661 return (connp);
4662 }
4663
4664 sock_lower_handle_t
4665 udp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls,
4666 uint_t *smodep, int *errorp, int flags, cred_t *credp)
4667 {
4668 udp_t *udp = NULL;
4669 udp_stack_t *us;
4670 conn_t *connp;
4671 boolean_t isv6;
4672
4673 if (type != SOCK_DGRAM || (family != AF_INET && family != AF_INET6) ||
4674 (proto != 0 && proto != IPPROTO_UDP)) {
4675 *errorp = EPROTONOSUPPORT;
4676 return (NULL);
4677 }
4678
4679 if (family == AF_INET6)
4680 isv6 = B_TRUE;
4681 else
4682 isv6 = B_FALSE;
4683
4684 connp = udp_do_open(credp, isv6, flags, errorp);
4685 if (connp == NULL)
4686 return (NULL);
4687
4688 udp = connp->conn_udp;
4689 ASSERT(udp != NULL);
4690 us = udp->udp_us;
4691 ASSERT(us != NULL);
4692
4693 udp->udp_issocket = B_TRUE;
4694 connp->conn_flags |= IPCL_NONSTR;
4695
4696 /*
4697 * Set flow control
4698 * Since this conn_t/udp_t is not yet visible to anybody else we don't
4699 * need to lock anything.
4700 */
4701 (void) udp_set_rcv_hiwat(udp, connp->conn_rcvbuf);
4702 udp->udp_rcv_disply_hiwat = connp->conn_rcvbuf;
4703
4704 connp->conn_flow_cntrld = B_FALSE;
4705
4706 mutex_enter(&connp->conn_lock);
4707 connp->conn_state_flags &= ~CONN_INCIPIENT;
4708 mutex_exit(&connp->conn_lock);
4709
4710 *errorp = 0;
4711 *smodep = SM_ATOMIC;
4712 *sock_downcalls = &sock_udp_downcalls;
4713 return ((sock_lower_handle_t)connp);
4714 }
4715
4716 /* ARGSUSED3 */
4717 void
4718 udp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle,
4719 sock_upcalls_t *sock_upcalls, int flags, cred_t *cr)
4720 {
4721 conn_t *connp = (conn_t *)proto_handle;
4722 struct sock_proto_props sopp;
4723
4724 /* All Solaris components should pass a cred for this operation. */
4725 ASSERT(cr != NULL);
4726
4727 connp->conn_upcalls = sock_upcalls;
4728 connp->conn_upper_handle = sock_handle;
4729
4730 sopp.sopp_flags = SOCKOPT_WROFF | SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT |
4731 SOCKOPT_MAXBLK | SOCKOPT_MAXPSZ | SOCKOPT_MINPSZ;
4732 sopp.sopp_wroff = connp->conn_wroff;
4733 sopp.sopp_maxblk = INFPSZ;
4734 sopp.sopp_rxhiwat = connp->conn_rcvbuf;
4735 sopp.sopp_rxlowat = connp->conn_rcvlowat;
4736 sopp.sopp_maxaddrlen = sizeof (sin6_t);
4737 sopp.sopp_maxpsz =
4738 (connp->conn_family == AF_INET) ? UDP_MAXPACKET_IPV4 :
4739 UDP_MAXPACKET_IPV6;
4740 sopp.sopp_minpsz = (udp_mod_info.mi_minpsz == 1) ? 0 :
4741 udp_mod_info.mi_minpsz;
4742
4743 (*connp->conn_upcalls->su_set_proto_props)(connp->conn_upper_handle,
4744 &sopp);
4745 }
4746
4747 static void
4748 udp_do_close(conn_t *connp)
4749 {
4750 udp_t *udp;
4751
4752 ASSERT(connp != NULL && IPCL_IS_UDP(connp));
4753 udp = connp->conn_udp;
4754
4755 if (cl_inet_unbind != NULL && udp->udp_state == TS_IDLE) {
4756 /*
4757 * Running in cluster mode - register unbind information
4758 */
4759 if (connp->conn_ipversion == IPV4_VERSION) {
4760 (*cl_inet_unbind)(
4761 connp->conn_netstack->netstack_stackid,
4762 IPPROTO_UDP, AF_INET,
4763 (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
4764 (in_port_t)connp->conn_lport, NULL);
4765 } else {
4766 (*cl_inet_unbind)(
4767 connp->conn_netstack->netstack_stackid,
4768 IPPROTO_UDP, AF_INET6,
4769 (uint8_t *)&(connp->conn_laddr_v6),
4770 (in_port_t)connp->conn_lport, NULL);
4771 }
4772 }
4773
4774 udp_bind_hash_remove(udp, B_FALSE);
4775
4776 ip_quiesce_conn(connp);
4777
4778 if (!IPCL_IS_NONSTR(connp)) {
4779 ASSERT(connp->conn_wq != NULL);
4780 ASSERT(connp->conn_rq != NULL);
4781 qprocsoff(connp->conn_rq);
4782 }
4783
4784 udp_close_free(connp);
4785
4786 /*
4787 * Now we are truly single threaded on this stream, and can
4788 * delete the things hanging off the connp, and finally the connp.
4789 * We removed this connp from the fanout list, it cannot be
4790 * accessed thru the fanouts, and we already waited for the
4791 * conn_ref to drop to 0. We are already in close, so
4792 * there cannot be any other thread from the top. qprocsoff
4793 * has completed, and service has completed or won't run in
4794 * future.
4795 */
4796 ASSERT(connp->conn_ref == 1);
4797
4798 if (!IPCL_IS_NONSTR(connp)) {
4799 inet_minor_free(connp->conn_minor_arena, connp->conn_dev);
4800 } else {
4801 ip_free_helper_stream(connp);
4802 }
4803
4804 connp->conn_ref--;
4805 ipcl_conn_destroy(connp);
4806 }
4807
4808 /* ARGSUSED1 */
4809 int
4810 udp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr)
4811 {
4812 conn_t *connp = (conn_t *)proto_handle;
4813
4814 /* All Solaris components should pass a cred for this operation. */
4815 ASSERT(cr != NULL);
4816
4817 udp_do_close(connp);
4818 return (0);
4819 }
4820
4821 static int
4822 udp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4823 boolean_t bind_to_req_port_only)
4824 {
4825 sin_t *sin;
4826 sin6_t *sin6;
4827 udp_t *udp = connp->conn_udp;
4828 int error = 0;
4829 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */
4830 in_port_t port; /* Host byte order */
4831 in_port_t requested_port; /* Host byte order */
4832 int count;
4833 ipaddr_t v4src; /* Set if AF_INET */
4834 in6_addr_t v6src;
4835 int loopmax;
4836 udp_fanout_t *udpf;
4837 in_port_t lport; /* Network byte order */
4838 uint_t scopeid = 0;
4839 zoneid_t zoneid = IPCL_ZONEID(connp);
4840 ip_stack_t *ipst = connp->conn_netstack->netstack_ip;
4841 boolean_t is_inaddr_any;
4842 mlp_type_t addrtype, mlptype;
4843 udp_stack_t *us = udp->udp_us;
4844
4845 switch (len) {
4846 case sizeof (sin_t): /* Complete IPv4 address */
4847 sin = (sin_t *)sa;
4848
4849 if (sin == NULL || !OK_32PTR((char *)sin))
4850 return (EINVAL);
4851
4852 if (connp->conn_family != AF_INET ||
4853 sin->sin_family != AF_INET) {
4854 return (EAFNOSUPPORT);
4855 }
4856 v4src = sin->sin_addr.s_addr;
4857 IN6_IPADDR_TO_V4MAPPED(v4src, &v6src);
4858 if (v4src != INADDR_ANY) {
4859 laddr_type = ip_laddr_verify_v4(v4src, zoneid, ipst,
4860 B_TRUE);
4861 }
4862 port = ntohs(sin->sin_port);
4863 break;
4864
4865 case sizeof (sin6_t): /* complete IPv6 address */
4866 sin6 = (sin6_t *)sa;
4867
4868 if (sin6 == NULL || !OK_32PTR((char *)sin6))
4869 return (EINVAL);
4870
4871 if (connp->conn_family != AF_INET6 ||
4872 sin6->sin6_family != AF_INET6) {
4873 return (EAFNOSUPPORT);
4874 }
4875 v6src = sin6->sin6_addr;
4876 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
4877 if (connp->conn_ipv6_v6only)
4878 return (EADDRNOTAVAIL);
4879
4880 IN6_V4MAPPED_TO_IPADDR(&v6src, v4src);
4881 if (v4src != INADDR_ANY) {
4882 laddr_type = ip_laddr_verify_v4(v4src,
4883 zoneid, ipst, B_FALSE);
4884 }
4885 } else {
4886 if (!IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
4887 if (IN6_IS_ADDR_LINKSCOPE(&v6src))
4888 scopeid = sin6->sin6_scope_id;
4889 laddr_type = ip_laddr_verify_v6(&v6src,
4890 zoneid, ipst, B_TRUE, scopeid);
4891 }
4892 }
4893 port = ntohs(sin6->sin6_port);
4894 break;
4895
4896 default: /* Invalid request */
4897 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4898 "udp_bind: bad ADDR_length length %u", len);
4899 return (-TBADADDR);
4900 }
4901
4902 /* Is the local address a valid unicast, multicast, or broadcast? */
4903 if (laddr_type == IPVL_BAD)
4904 return (EADDRNOTAVAIL);
4905
4906 requested_port = port;
4907
4908 if (requested_port == 0 || !bind_to_req_port_only)
4909 bind_to_req_port_only = B_FALSE;
4910 else /* T_BIND_REQ and requested_port != 0 */
4911 bind_to_req_port_only = B_TRUE;
4912
4913 if (requested_port == 0) {
4914 /*
4915 * If the application passed in zero for the port number, it
4916 * doesn't care which port number we bind to. Get one in the
4917 * valid range.
4918 */
4919 if (connp->conn_anon_priv_bind) {
4920 port = udp_get_next_priv_port(udp);
4921 } else {
4922 port = udp_update_next_port(udp,
4923 us->us_next_port_to_try, B_TRUE);
4924 }
4925 } else {
4926 /*
4927 * If the port is in the well-known privileged range,
4928 * make sure the caller was privileged.
4929 */
4930 int i;
4931 boolean_t priv = B_FALSE;
4932
4933 if (port < us->us_smallest_nonpriv_port) {
4934 priv = B_TRUE;
4935 } else {
4936 for (i = 0; i < us->us_num_epriv_ports; i++) {
4937 if (port == us->us_epriv_ports[i]) {
4938 priv = B_TRUE;
4939 break;
4940 }
4941 }
4942 }
4943
4944 if (priv) {
4945 if (secpolicy_net_privaddr(cr, port, IPPROTO_UDP) != 0)
4946 return (-TACCES);
4947 }
4948 }
4949
4950 if (port == 0)
4951 return (-TNOADDR);
4952
4953 /*
4954 * The state must be TS_UNBND. TPI mandates that users must send
4955 * TPI primitives only 1 at a time and wait for the response before
4956 * sending the next primitive.
4957 */
4958 mutex_enter(&connp->conn_lock);
4959 if (udp->udp_state != TS_UNBND) {
4960 mutex_exit(&connp->conn_lock);
4961 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4962 "udp_bind: bad state, %u", udp->udp_state);
4963 return (-TOUTSTATE);
4964 }
4965 /*
4966 * Copy the source address into our udp structure. This address
4967 * may still be zero; if so, IP will fill in the correct address
4968 * each time an outbound packet is passed to it. Since the udp is
4969 * not yet in the bind hash list, we don't grab the uf_lock to
4970 * change conn_ipversion
4971 */
4972 if (connp->conn_family == AF_INET) {
4973 ASSERT(sin != NULL);
4974 ASSERT(connp->conn_ixa->ixa_flags & IXAF_IS_IPV4);
4975 } else {
4976 if (IN6_IS_ADDR_V4MAPPED(&v6src)) {
4977 /*
4978 * no need to hold the uf_lock to set the conn_ipversion
4979 * since we are not yet in the fanout list
4980 */
4981 connp->conn_ipversion = IPV4_VERSION;
4982 connp->conn_ixa->ixa_flags |= IXAF_IS_IPV4;
4983 } else {
4984 connp->conn_ipversion = IPV6_VERSION;
4985 connp->conn_ixa->ixa_flags &= ~IXAF_IS_IPV4;
4986 }
4987 }
4988
4989 /*
4990 * If conn_reuseaddr is not set, then we have to make sure that
4991 * the IP address and port number the application requested
4992 * (or we selected for the application) is not being used by
4993 * another stream. If another stream is already using the
4994 * requested IP address and port, the behavior depends on
4995 * "bind_to_req_port_only". If set the bind fails; otherwise we
4996 * search for any an unused port to bind to the stream.
4997 *
4998 * As per the BSD semantics, as modified by the Deering multicast
4999 * changes, if udp_reuseaddr is set, then we allow multiple binds
5000 * to the same port independent of the local IP address.
5001 *
5002 * This is slightly different than in SunOS 4.X which did not
5003 * support IP multicast. Note that the change implemented by the
5004 * Deering multicast code effects all binds - not only binding
5005 * to IP multicast addresses.
5006 *
5007 * Note that when binding to port zero we ignore SO_REUSEADDR in
5008 * order to guarantee a unique port.
5009 */
5010
5011 count = 0;
5012 if (connp->conn_anon_priv_bind) {
5013 /*
5014 * loopmax = (IPPORT_RESERVED-1) -
5015 * us->us_min_anonpriv_port + 1
5016 */
5017 loopmax = IPPORT_RESERVED - us->us_min_anonpriv_port;
5018 } else {
5019 loopmax = us->us_largest_anon_port -
5020 us->us_smallest_anon_port + 1;
5021 }
5022
5023 is_inaddr_any = V6_OR_V4_INADDR_ANY(v6src);
5024
5025 for (;;) {
5026 udp_t *udp1;
5027 boolean_t found_exclbind = B_FALSE;
5028 conn_t *connp1;
5029
5030 /*
5031 * Walk through the list of udp streams bound to
5032 * requested port with the same IP address.
5033 */
5034 lport = htons(port);
5035 udpf = &us->us_bind_fanout[UDP_BIND_HASH(lport,
5036 us->us_bind_fanout_size)];
5037 mutex_enter(&udpf->uf_lock);
5038 for (udp1 = udpf->uf_udp; udp1 != NULL;
5039 udp1 = udp1->udp_bind_hash) {
5040 connp1 = udp1->udp_connp;
5041
5042 if (lport != connp1->conn_lport)
5043 continue;
5044
5045 /*
5046 * On a labeled system, we must treat bindings to ports
5047 * on shared IP addresses by sockets with MAC exemption
5048 * privilege as being in all zones, as there's
5049 * otherwise no way to identify the right receiver.
5050 */
5051 if (!IPCL_BIND_ZONE_MATCH(connp1, connp))
5052 continue;
5053
5054 /*
5055 * If UDP_EXCLBIND is set for either the bound or
5056 * binding endpoint, the semantics of bind
5057 * is changed according to the following chart.
5058 *
5059 * spec = specified address (v4 or v6)
5060 * unspec = unspecified address (v4 or v6)
5061 * A = specified addresses are different for endpoints
5062 *
5063 * bound bind to allowed?
5064 * -------------------------------------
5065 * unspec unspec no
5066 * unspec spec no
5067 * spec unspec no
5068 * spec spec yes if A
5069 *
5070 * For labeled systems, SO_MAC_EXEMPT behaves the same
5071 * as UDP_EXCLBIND, except that zoneid is ignored.
5072 */
5073 if (connp1->conn_exclbind || connp->conn_exclbind ||
5074 IPCL_CONNS_MAC(udp1->udp_connp, connp)) {
5075 if (V6_OR_V4_INADDR_ANY(
5076 connp1->conn_bound_addr_v6) ||
5077 is_inaddr_any ||
5078 IN6_ARE_ADDR_EQUAL(
5079 &connp1->conn_bound_addr_v6,
5080 &v6src)) {
5081 found_exclbind = B_TRUE;
5082 break;
5083 }
5084 continue;
5085 }
5086
5087 /*
5088 * Check ipversion to allow IPv4 and IPv6 sockets to
5089 * have disjoint port number spaces.
5090 */
5091 if (connp->conn_ipversion != connp1->conn_ipversion) {
5092
5093 /*
5094 * On the first time through the loop, if the
5095 * the user intentionally specified a
5096 * particular port number, then ignore any
5097 * bindings of the other protocol that may
5098 * conflict. This allows the user to bind IPv6
5099 * alone and get both v4 and v6, or bind both
5100 * both and get each seperately. On subsequent
5101 * times through the loop, we're checking a
5102 * port that we chose (not the user) and thus
5103 * we do not allow casual duplicate bindings.
5104 */
5105 if (count == 0 && requested_port != 0)
5106 continue;
5107 }
5108
5109 /*
5110 * No difference depending on SO_REUSEADDR.
5111 *
5112 * If existing port is bound to a
5113 * non-wildcard IP address and
5114 * the requesting stream is bound to
5115 * a distinct different IP addresses
5116 * (non-wildcard, also), keep going.
5117 */
5118 if (!is_inaddr_any &&
5119 !V6_OR_V4_INADDR_ANY(connp1->conn_bound_addr_v6) &&
5120 !IN6_ARE_ADDR_EQUAL(&connp1->conn_laddr_v6,
5121 &v6src)) {
5122 continue;
5123 }
5124 break;
5125 }
5126
5127 if (!found_exclbind &&
5128 (connp->conn_reuseaddr && requested_port != 0)) {
5129 break;
5130 }
5131
5132 if (udp1 == NULL) {
5133 /*
5134 * No other stream has this IP address
5135 * and port number. We can use it.
5136 */
5137 break;
5138 }
5139 mutex_exit(&udpf->uf_lock);
5140 if (bind_to_req_port_only) {
5141 /*
5142 * We get here only when requested port
5143 * is bound (and only first of the for()
5144 * loop iteration).
5145 *
5146 * The semantics of this bind request
5147 * require it to fail so we return from
5148 * the routine (and exit the loop).
5149 *
5150 */
5151 mutex_exit(&connp->conn_lock);
5152 return (-TADDRBUSY);
5153 }
5154
5155 if (connp->conn_anon_priv_bind) {
5156 port = udp_get_next_priv_port(udp);
5157 } else {
5158 if ((count == 0) && (requested_port != 0)) {
5159 /*
5160 * If the application wants us to find
5161 * a port, get one to start with. Set
5162 * requested_port to 0, so that we will
5163 * update us->us_next_port_to_try below.
5164 */
5165 port = udp_update_next_port(udp,
5166 us->us_next_port_to_try, B_TRUE);
5167 requested_port = 0;
5168 } else {
5169 port = udp_update_next_port(udp, port + 1,
5170 B_FALSE);
5171 }
5172 }
5173
5174 if (port == 0 || ++count >= loopmax) {
5175 /*
5176 * We've tried every possible port number and
5177 * there are none available, so send an error
5178 * to the user.
5179 */
5180 mutex_exit(&connp->conn_lock);
5181 return (-TNOADDR);
5182 }
5183 }
5184
5185 /*
5186 * Copy the source address into our udp structure. This address
5187 * may still be zero; if so, ip_attr_connect will fill in the correct
5188 * address when a packet is about to be sent.
5189 * If we are binding to a broadcast or multicast address then
5190 * we just set the conn_bound_addr since we don't want to use
5191 * that as the source address when sending.
5192 */
5193 connp->conn_bound_addr_v6 = v6src;
5194 connp->conn_laddr_v6 = v6src;
5195 if (scopeid != 0) {
5196 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
5197 connp->conn_ixa->ixa_scopeid = scopeid;
5198 connp->conn_incoming_ifindex = scopeid;
5199 } else {
5200 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5201 connp->conn_incoming_ifindex = connp->conn_bound_if;
5202 }
5203
5204 switch (laddr_type) {
5205 case IPVL_UNICAST_UP:
5206 case IPVL_UNICAST_DOWN:
5207 connp->conn_saddr_v6 = v6src;
5208 connp->conn_mcbc_bind = B_FALSE;
5209 break;
5210 case IPVL_MCAST:
5211 case IPVL_BCAST:
5212 /* ip_set_destination will pick a source address later */
5213 connp->conn_saddr_v6 = ipv6_all_zeros;
5214 connp->conn_mcbc_bind = B_TRUE;
5215 break;
5216 }
5217
5218 /* Any errors after this point should use late_error */
5219 connp->conn_lport = lport;
5220
5221 /*
5222 * Now reset the next anonymous port if the application requested
5223 * an anonymous port, or we handed out the next anonymous port.
5224 */
5225 if ((requested_port == 0) && (!connp->conn_anon_priv_bind)) {
5226 us->us_next_port_to_try = port + 1;
5227 }
5228
5229 /* Initialize the T_BIND_ACK. */
5230 if (connp->conn_family == AF_INET) {
5231 sin->sin_port = connp->conn_lport;
5232 } else {
5233 sin6->sin6_port = connp->conn_lport;
5234 }
5235 udp->udp_state = TS_IDLE;
5236 udp_bind_hash_insert(udpf, udp);
5237 mutex_exit(&udpf->uf_lock);
5238 mutex_exit(&connp->conn_lock);
5239
5240 if (cl_inet_bind) {
5241 /*
5242 * Running in cluster mode - register bind information
5243 */
5244 if (connp->conn_ipversion == IPV4_VERSION) {
5245 (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5246 IPPROTO_UDP, AF_INET, (uint8_t *)&v4src,
5247 (in_port_t)connp->conn_lport, NULL);
5248 } else {
5249 (*cl_inet_bind)(connp->conn_netstack->netstack_stackid,
5250 IPPROTO_UDP, AF_INET6, (uint8_t *)&v6src,
5251 (in_port_t)connp->conn_lport, NULL);
5252 }
5253 }
5254
5255 mutex_enter(&connp->conn_lock);
5256 connp->conn_anon_port = (is_system_labeled() && requested_port == 0);
5257 if (is_system_labeled() && (!connp->conn_anon_port ||
5258 connp->conn_anon_mlp)) {
5259 uint16_t mlpport;
5260 zone_t *zone;
5261
5262 zone = crgetzone(cr);
5263 connp->conn_mlp_type =
5264 connp->conn_recv_ancillary.crb_recvucred ? mlptBoth :
5265 mlptSingle;
5266 addrtype = tsol_mlp_addr_type(
5267 connp->conn_allzones ? ALL_ZONES : zone->zone_id,
5268 IPV6_VERSION, &v6src, us->us_netstack->netstack_ip);
5269 if (addrtype == mlptSingle) {
5270 error = -TNOADDR;
5271 mutex_exit(&connp->conn_lock);
5272 goto late_error;
5273 }
5274 mlpport = connp->conn_anon_port ? PMAPPORT : port;
5275 mlptype = tsol_mlp_port_type(zone, IPPROTO_UDP, mlpport,
5276 addrtype);
5277
5278 /*
5279 * It is a coding error to attempt to bind an MLP port
5280 * without first setting SOL_SOCKET/SCM_UCRED.
5281 */
5282 if (mlptype != mlptSingle &&
5283 connp->conn_mlp_type == mlptSingle) {
5284 error = EINVAL;
5285 mutex_exit(&connp->conn_lock);
5286 goto late_error;
5287 }
5288
5289 /*
5290 * It is an access violation to attempt to bind an MLP port
5291 * without NET_BINDMLP privilege.
5292 */
5293 if (mlptype != mlptSingle &&
5294 secpolicy_net_bindmlp(cr) != 0) {
5295 if (connp->conn_debug) {
5296 (void) strlog(UDP_MOD_ID, 0, 1,
5297 SL_ERROR|SL_TRACE,
5298 "udp_bind: no priv for multilevel port %d",
5299 mlpport);
5300 }
5301 error = -TACCES;
5302 mutex_exit(&connp->conn_lock);
5303 goto late_error;
5304 }
5305
5306 /*
5307 * If we're specifically binding a shared IP address and the
5308 * port is MLP on shared addresses, then check to see if this
5309 * zone actually owns the MLP. Reject if not.
5310 */
5311 if (mlptype == mlptShared && addrtype == mlptShared) {
5312 /*
5313 * No need to handle exclusive-stack zones since
5314 * ALL_ZONES only applies to the shared stack.
5315 */
5316 zoneid_t mlpzone;
5317
5318 mlpzone = tsol_mlp_findzone(IPPROTO_UDP,
5319 htons(mlpport));
5320 if (connp->conn_zoneid != mlpzone) {
5321 if (connp->conn_debug) {
5322 (void) strlog(UDP_MOD_ID, 0, 1,
5323 SL_ERROR|SL_TRACE,
5324 "udp_bind: attempt to bind port "
5325 "%d on shared addr in zone %d "
5326 "(should be %d)",
5327 mlpport, connp->conn_zoneid,
5328 mlpzone);
5329 }
5330 error = -TACCES;
5331 mutex_exit(&connp->conn_lock);
5332 goto late_error;
5333 }
5334 }
5335 if (connp->conn_anon_port) {
5336 error = tsol_mlp_anon(zone, mlptype, connp->conn_proto,
5337 port, B_TRUE);
5338 if (error != 0) {
5339 if (connp->conn_debug) {
5340 (void) strlog(UDP_MOD_ID, 0, 1,
5341 SL_ERROR|SL_TRACE,
5342 "udp_bind: cannot establish anon "
5343 "MLP for port %d", port);
5344 }
5345 error = -TACCES;
5346 mutex_exit(&connp->conn_lock);
5347 goto late_error;
5348 }
5349 }
5350 connp->conn_mlp_type = mlptype;
5351 }
5352
5353 /*
5354 * We create an initial header template here to make a subsequent
5355 * sendto have a starting point. Since conn_last_dst is zero the
5356 * first sendto will always follow the 'dst changed' code path.
5357 * Note that we defer massaging options and the related checksum
5358 * adjustment until we have a destination address.
5359 */
5360 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5361 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5362 if (error != 0) {
5363 mutex_exit(&connp->conn_lock);
5364 goto late_error;
5365 }
5366 /* Just in case */
5367 connp->conn_faddr_v6 = ipv6_all_zeros;
5368 connp->conn_fport = 0;
5369 connp->conn_v6lastdst = ipv6_all_zeros;
5370 mutex_exit(&connp->conn_lock);
5371
5372 error = ip_laddr_fanout_insert(connp);
5373 if (error != 0)
5374 goto late_error;
5375
5376 /* Bind succeeded */
5377 return (0);
5378
5379 late_error:
5380 /* We had already picked the port number, and then the bind failed */
5381 mutex_enter(&connp->conn_lock);
5382 udpf = &us->us_bind_fanout[
5383 UDP_BIND_HASH(connp->conn_lport,
5384 us->us_bind_fanout_size)];
5385 mutex_enter(&udpf->uf_lock);
5386 connp->conn_saddr_v6 = ipv6_all_zeros;
5387 connp->conn_bound_addr_v6 = ipv6_all_zeros;
5388 connp->conn_laddr_v6 = ipv6_all_zeros;
5389 if (scopeid != 0) {
5390 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5391 connp->conn_incoming_ifindex = connp->conn_bound_if;
5392 }
5393 udp->udp_state = TS_UNBND;
5394 udp_bind_hash_remove(udp, B_TRUE);
5395 connp->conn_lport = 0;
5396 mutex_exit(&udpf->uf_lock);
5397 connp->conn_anon_port = B_FALSE;
5398 connp->conn_mlp_type = mlptSingle;
5399
5400 connp->conn_v6lastdst = ipv6_all_zeros;
5401
5402 /* Restore the header that was built above - different source address */
5403 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5404 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5405 mutex_exit(&connp->conn_lock);
5406 return (error);
5407 }
5408
5409 int
5410 udp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa,
5411 socklen_t len, cred_t *cr)
5412 {
5413 int error;
5414 conn_t *connp;
5415
5416 /* All Solaris components should pass a cred for this operation. */
5417 ASSERT(cr != NULL);
5418
5419 connp = (conn_t *)proto_handle;
5420
5421 if (sa == NULL)
5422 error = udp_do_unbind(connp);
5423 else
5424 error = udp_do_bind(connp, sa, len, cr, B_TRUE);
5425
5426 if (error < 0) {
5427 if (error == -TOUTSTATE)
5428 error = EINVAL;
5429 else
5430 error = proto_tlitosyserr(-error);
5431 }
5432
5433 return (error);
5434 }
5435
5436 static int
5437 udp_implicit_bind(conn_t *connp, cred_t *cr)
5438 {
5439 sin6_t sin6addr;
5440 sin_t *sin;
5441 sin6_t *sin6;
5442 socklen_t len;
5443 int error;
5444
5445 /* All Solaris components should pass a cred for this operation. */
5446 ASSERT(cr != NULL);
5447
5448 if (connp->conn_family == AF_INET) {
5449 len = sizeof (struct sockaddr_in);
5450 sin = (sin_t *)&sin6addr;
5451 *sin = sin_null;
5452 sin->sin_family = AF_INET;
5453 sin->sin_addr.s_addr = INADDR_ANY;
5454 } else {
5455 ASSERT(connp->conn_family == AF_INET6);
5456 len = sizeof (sin6_t);
5457 sin6 = (sin6_t *)&sin6addr;
5458 *sin6 = sin6_null;
5459 sin6->sin6_family = AF_INET6;
5460 V6_SET_ZERO(sin6->sin6_addr);
5461 }
5462
5463 error = udp_do_bind(connp, (struct sockaddr *)&sin6addr, len,
5464 cr, B_FALSE);
5465 return ((error < 0) ? proto_tlitosyserr(-error) : error);
5466 }
5467
5468 /*
5469 * This routine removes a port number association from a stream. It
5470 * is called by udp_unbind and udp_tpi_unbind.
5471 */
5472 static int
5473 udp_do_unbind(conn_t *connp)
5474 {
5475 udp_t *udp = connp->conn_udp;
5476 udp_fanout_t *udpf;
5477 udp_stack_t *us = udp->udp_us;
5478
5479 if (cl_inet_unbind != NULL) {
5480 /*
5481 * Running in cluster mode - register unbind information
5482 */
5483 if (connp->conn_ipversion == IPV4_VERSION) {
5484 (*cl_inet_unbind)(
5485 connp->conn_netstack->netstack_stackid,
5486 IPPROTO_UDP, AF_INET,
5487 (uint8_t *)(&V4_PART_OF_V6(connp->conn_laddr_v6)),
5488 (in_port_t)connp->conn_lport, NULL);
5489 } else {
5490 (*cl_inet_unbind)(
5491 connp->conn_netstack->netstack_stackid,
5492 IPPROTO_UDP, AF_INET6,
5493 (uint8_t *)&(connp->conn_laddr_v6),
5494 (in_port_t)connp->conn_lport, NULL);
5495 }
5496 }
5497
5498 mutex_enter(&connp->conn_lock);
5499 /* If a bind has not been done, we can't unbind. */
5500 if (udp->udp_state == TS_UNBND) {
5501 mutex_exit(&connp->conn_lock);
5502 return (-TOUTSTATE);
5503 }
5504 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5505 us->us_bind_fanout_size)];
5506 mutex_enter(&udpf->uf_lock);
5507 udp_bind_hash_remove(udp, B_TRUE);
5508 connp->conn_saddr_v6 = ipv6_all_zeros;
5509 connp->conn_bound_addr_v6 = ipv6_all_zeros;
5510 connp->conn_laddr_v6 = ipv6_all_zeros;
5511 connp->conn_mcbc_bind = B_FALSE;
5512 connp->conn_lport = 0;
5513 /* In case we were also connected */
5514 connp->conn_faddr_v6 = ipv6_all_zeros;
5515 connp->conn_fport = 0;
5516 mutex_exit(&udpf->uf_lock);
5517
5518 connp->conn_v6lastdst = ipv6_all_zeros;
5519 udp->udp_state = TS_UNBND;
5520
5521 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5522 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5523 mutex_exit(&connp->conn_lock);
5524
5525 ip_unbind(connp);
5526
5527 return (0);
5528 }
5529
5530 /*
5531 * It associates a default destination address with the stream.
5532 */
5533 static int
5534 udp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
5535 cred_t *cr, pid_t pid)
5536 {
5537 sin6_t *sin6;
5538 sin_t *sin;
5539 in6_addr_t v6dst;
5540 ipaddr_t v4dst;
5541 uint16_t dstport;
5542 uint32_t flowinfo;
5543 udp_fanout_t *udpf;
5544 udp_t *udp, *udp1;
5545 ushort_t ipversion;
5546 udp_stack_t *us;
5547 int error;
5548 conn_t *connp1;
5549 ip_xmit_attr_t *ixa;
5550 ip_xmit_attr_t *oldixa;
5551 uint_t scopeid = 0;
5552 uint_t srcid = 0;
5553 in6_addr_t v6src = connp->conn_saddr_v6;
5554 boolean_t v4mapped;
5555
5556 udp = connp->conn_udp;
5557 us = udp->udp_us;
5558
5559 /*
5560 * Address has been verified by the caller
5561 */
5562 switch (len) {
5563 default:
5564 /*
5565 * Should never happen
5566 */
5567 return (EINVAL);
5568
5569 case sizeof (sin_t):
5570 sin = (sin_t *)sa;
5571 v4dst = sin->sin_addr.s_addr;
5572 dstport = sin->sin_port;
5573 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5574 ASSERT(connp->conn_ipversion == IPV4_VERSION);
5575 ipversion = IPV4_VERSION;
5576 break;
5577
5578 case sizeof (sin6_t):
5579 sin6 = (sin6_t *)sa;
5580 v6dst = sin6->sin6_addr;
5581 dstport = sin6->sin6_port;
5582 srcid = sin6->__sin6_src_id;
5583 v4mapped = IN6_IS_ADDR_V4MAPPED(&v6dst);
5584 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&v6src)) {
5585 if (!ip_srcid_find_id(srcid, &v6src, IPCL_ZONEID(connp),
5586 v4mapped, connp->conn_netstack)) {
5587 /* Mismatch v4mapped/v6 specified by srcid. */
5588 return (EADDRNOTAVAIL);
5589 }
5590 }
5591 if (v4mapped) {
5592 if (connp->conn_ipv6_v6only)
5593 return (EADDRNOTAVAIL);
5594
5595 /*
5596 * Destination adress is mapped IPv6 address.
5597 * Source bound address should be unspecified or
5598 * IPv6 mapped address as well.
5599 */
5600 if (!IN6_IS_ADDR_UNSPECIFIED(
5601 &connp->conn_bound_addr_v6) &&
5602 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
5603 return (EADDRNOTAVAIL);
5604 }
5605 IN6_V4MAPPED_TO_IPADDR(&v6dst, v4dst);
5606 ipversion = IPV4_VERSION;
5607 flowinfo = 0;
5608 } else {
5609 ipversion = IPV6_VERSION;
5610 flowinfo = sin6->sin6_flowinfo;
5611 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
5612 scopeid = sin6->sin6_scope_id;
5613 }
5614 break;
5615 }
5616
5617 if (dstport == 0)
5618 return (-TBADADDR);
5619
5620 /*
5621 * If there is a different thread using conn_ixa then we get a new
5622 * copy and cut the old one loose from conn_ixa. Otherwise we use
5623 * conn_ixa and prevent any other thread from using/changing it.
5624 * Once connect() is done other threads can use conn_ixa since the
5625 * refcnt will be back at one.
5626 * We defer updating conn_ixa until later to handle any concurrent
5627 * conn_ixa_cleanup thread.
5628 */
5629 ixa = conn_get_ixa(connp, B_FALSE);
5630 if (ixa == NULL)
5631 return (ENOMEM);
5632
5633 mutex_enter(&connp->conn_lock);
5634 /*
5635 * This udp_t must have bound to a port already before doing a connect.
5636 * Reject if a connect is in progress (we drop conn_lock during
5637 * udp_do_connect).
5638 */
5639 if (udp->udp_state == TS_UNBND || udp->udp_state == TS_WCON_CREQ) {
5640 mutex_exit(&connp->conn_lock);
5641 (void) strlog(UDP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
5642 "udp_connect: bad state, %u", udp->udp_state);
5643 ixa_refrele(ixa);
5644 return (-TOUTSTATE);
5645 }
5646 ASSERT(connp->conn_lport != 0 && udp->udp_ptpbhn != NULL);
5647
5648 udpf = &us->us_bind_fanout[UDP_BIND_HASH(connp->conn_lport,
5649 us->us_bind_fanout_size)];
5650
5651 mutex_enter(&udpf->uf_lock);
5652 if (udp->udp_state == TS_DATA_XFER) {
5653 /* Already connected - clear out state */
5654 if (connp->conn_mcbc_bind)
5655 connp->conn_saddr_v6 = ipv6_all_zeros;
5656 else
5657 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5658 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5659 connp->conn_faddr_v6 = ipv6_all_zeros;
5660 connp->conn_fport = 0;
5661 udp->udp_state = TS_IDLE;
5662 }
5663
5664 connp->conn_fport = dstport;
5665 connp->conn_ipversion = ipversion;
5666 if (ipversion == IPV4_VERSION) {
5667 /*
5668 * Interpret a zero destination to mean loopback.
5669 * Update the T_CONN_REQ (sin/sin6) since it is used to
5670 * generate the T_CONN_CON.
5671 */
5672 if (v4dst == INADDR_ANY) {
5673 v4dst = htonl(INADDR_LOOPBACK);
5674 IN6_IPADDR_TO_V4MAPPED(v4dst, &v6dst);
5675 if (connp->conn_family == AF_INET) {
5676 sin->sin_addr.s_addr = v4dst;
5677 } else {
5678 sin6->sin6_addr = v6dst;
5679 }
5680 }
5681 connp->conn_faddr_v6 = v6dst;
5682 connp->conn_flowinfo = 0;
5683 } else {
5684 ASSERT(connp->conn_ipversion == IPV6_VERSION);
5685 /*
5686 * Interpret a zero destination to mean loopback.
5687 * Update the T_CONN_REQ (sin/sin6) since it is used to
5688 * generate the T_CONN_CON.
5689 */
5690 if (IN6_IS_ADDR_UNSPECIFIED(&v6dst)) {
5691 v6dst = ipv6_loopback;
5692 sin6->sin6_addr = v6dst;
5693 }
5694 connp->conn_faddr_v6 = v6dst;
5695 connp->conn_flowinfo = flowinfo;
5696 }
5697 mutex_exit(&udpf->uf_lock);
5698
5699 /*
5700 * We update our cred/cpid based on the caller of connect
5701 */
5702 if (connp->conn_cred != cr) {
5703 crhold(cr);
5704 crfree(connp->conn_cred);
5705 connp->conn_cred = cr;
5706 }
5707 connp->conn_cpid = pid;
5708 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
5709 ixa->ixa_cred = cr;
5710 ixa->ixa_cpid = pid;
5711 if (is_system_labeled()) {
5712 /* We need to restart with a label based on the cred */
5713 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
5714 }
5715
5716 if (scopeid != 0) {
5717 ixa->ixa_flags |= IXAF_SCOPEID_SET;
5718 ixa->ixa_scopeid = scopeid;
5719 connp->conn_incoming_ifindex = scopeid;
5720 } else {
5721 ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
5722 connp->conn_incoming_ifindex = connp->conn_bound_if;
5723 }
5724 /*
5725 * conn_connect will drop conn_lock and reacquire it.
5726 * To prevent a send* from messing with this udp_t while the lock
5727 * is dropped we set udp_state and clear conn_v6lastdst.
5728 * That will make all send* fail with EISCONN.
5729 */
5730 connp->conn_v6lastdst = ipv6_all_zeros;
5731 udp->udp_state = TS_WCON_CREQ;
5732
5733 error = conn_connect(connp, NULL, IPDF_ALLOW_MCBC);
5734 mutex_exit(&connp->conn_lock);
5735 if (error != 0)
5736 goto connect_failed;
5737
5738 /*
5739 * The addresses have been verified. Time to insert in
5740 * the correct fanout list.
5741 */
5742 error = ipcl_conn_insert(connp);
5743 if (error != 0)
5744 goto connect_failed;
5745
5746 mutex_enter(&connp->conn_lock);
5747 error = udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5748 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5749 if (error != 0) {
5750 mutex_exit(&connp->conn_lock);
5751 goto connect_failed;
5752 }
5753
5754 udp->udp_state = TS_DATA_XFER;
5755 /* Record this as the "last" send even though we haven't sent any */
5756 connp->conn_v6lastdst = connp->conn_faddr_v6;
5757 connp->conn_lastipversion = connp->conn_ipversion;
5758 connp->conn_lastdstport = connp->conn_fport;
5759 connp->conn_lastflowinfo = connp->conn_flowinfo;
5760 connp->conn_lastscopeid = scopeid;
5761 connp->conn_lastsrcid = srcid;
5762 /* Also remember a source to use together with lastdst */
5763 connp->conn_v6lastsrc = v6src;
5764
5765 oldixa = conn_replace_ixa(connp, ixa);
5766 mutex_exit(&connp->conn_lock);
5767 ixa_refrele(oldixa);
5768
5769 /*
5770 * We've picked a source address above. Now we can
5771 * verify that the src/port/dst/port is unique for all
5772 * connections in TS_DATA_XFER, skipping ourselves.
5773 */
5774 mutex_enter(&udpf->uf_lock);
5775 for (udp1 = udpf->uf_udp; udp1 != NULL; udp1 = udp1->udp_bind_hash) {
5776 if (udp1->udp_state != TS_DATA_XFER)
5777 continue;
5778
5779 if (udp1 == udp)
5780 continue;
5781
5782 connp1 = udp1->udp_connp;
5783 if (connp->conn_lport != connp1->conn_lport ||
5784 connp->conn_ipversion != connp1->conn_ipversion ||
5785 dstport != connp1->conn_fport ||
5786 !IN6_ARE_ADDR_EQUAL(&connp->conn_laddr_v6,
5787 &connp1->conn_laddr_v6) ||
5788 !IN6_ARE_ADDR_EQUAL(&v6dst, &connp1->conn_faddr_v6) ||
5789 !(IPCL_ZONE_MATCH(connp, connp1->conn_zoneid) ||
5790 IPCL_ZONE_MATCH(connp1, connp->conn_zoneid)))
5791 continue;
5792 mutex_exit(&udpf->uf_lock);
5793 error = -TBADADDR;
5794 goto connect_failed;
5795 }
5796 if (cl_inet_connect2 != NULL) {
5797 CL_INET_UDP_CONNECT(connp, B_TRUE, &v6dst, dstport, error);
5798 if (error != 0) {
5799 mutex_exit(&udpf->uf_lock);
5800 error = -TBADADDR;
5801 goto connect_failed;
5802 }
5803 }
5804 mutex_exit(&udpf->uf_lock);
5805
5806 ixa_refrele(ixa);
5807 return (0);
5808
5809 connect_failed:
5810 if (ixa != NULL)
5811 ixa_refrele(ixa);
5812 mutex_enter(&connp->conn_lock);
5813 mutex_enter(&udpf->uf_lock);
5814 udp->udp_state = TS_IDLE;
5815 connp->conn_faddr_v6 = ipv6_all_zeros;
5816 connp->conn_fport = 0;
5817 /* In case the source address was set above */
5818 if (connp->conn_mcbc_bind)
5819 connp->conn_saddr_v6 = ipv6_all_zeros;
5820 else
5821 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
5822 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
5823 mutex_exit(&udpf->uf_lock);
5824
5825 connp->conn_v6lastdst = ipv6_all_zeros;
5826 connp->conn_flowinfo = 0;
5827
5828 (void) udp_build_hdr_template(connp, &connp->conn_saddr_v6,
5829 &connp->conn_faddr_v6, connp->conn_fport, connp->conn_flowinfo);
5830 mutex_exit(&connp->conn_lock);
5831 return (error);
5832 }
5833
5834 static int
5835 udp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa,
5836 socklen_t len, sock_connid_t *id, cred_t *cr)
5837 {
5838 conn_t *connp = (conn_t *)proto_handle;
5839 udp_t *udp = connp->conn_udp;
5840 int error;
5841 boolean_t did_bind = B_FALSE;
5842 pid_t pid = curproc->p_pid;
5843
5844 /* All Solaris components should pass a cred for this operation. */
5845 ASSERT(cr != NULL);
5846
5847 if (sa == NULL) {
5848 /*
5849 * Disconnect
5850 * Make sure we are connected
5851 */
5852 if (udp->udp_state != TS_DATA_XFER)
5853 return (EINVAL);
5854
5855 error = udp_disconnect(connp);
5856 return (error);
5857 }
5858
5859 error = proto_verify_ip_addr(connp->conn_family, sa, len);
5860 if (error != 0)
5861 goto done;
5862
5863 /* do an implicit bind if necessary */
5864 if (udp->udp_state == TS_UNBND) {
5865 error = udp_implicit_bind(connp, cr);
5866 /*
5867 * We could be racing with an actual bind, in which case
5868 * we would see EPROTO. We cross our fingers and try
5869 * to connect.
5870 */
5871 if (!(error == 0 || error == EPROTO))
5872 goto done;
5873 did_bind = B_TRUE;
5874 }
5875 /*
5876 * set SO_DGRAM_ERRIND
5877 */
5878 connp->conn_dgram_errind = B_TRUE;
5879
5880 error = udp_do_connect(connp, sa, len, cr, pid);
5881
5882 if (error != 0 && did_bind) {
5883 int unbind_err;
5884
5885 unbind_err = udp_do_unbind(connp);
5886 ASSERT(unbind_err == 0);
5887 }
5888
5889 if (error == 0) {
5890 *id = 0;
5891 (*connp->conn_upcalls->su_connected)
5892 (connp->conn_upper_handle, 0, NULL, -1);
5893 } else if (error < 0) {
5894 error = proto_tlitosyserr(-error);
5895 }
5896
5897 done:
5898 if (error != 0 && udp->udp_state == TS_DATA_XFER) {
5899 /*
5900 * No need to hold locks to set state
5901 * after connect failure socket state is undefined
5902 * We set the state only to imitate old sockfs behavior
5903 */
5904 udp->udp_state = TS_IDLE;
5905 }
5906 return (error);
5907 }
5908
5909 int
5910 udp_send(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg,
5911 cred_t *cr)
5912 {
5913 sin6_t *sin6;
5914 sin_t *sin = NULL;
5915 uint_t srcid;
5916 conn_t *connp = (conn_t *)proto_handle;
5917 udp_t *udp = connp->conn_udp;
5918 int error = 0;
5919 udp_stack_t *us = udp->udp_us;
5920 ushort_t ipversion;
5921 pid_t pid = curproc->p_pid;
5922 ip_xmit_attr_t *ixa;
5923 boolean_t snd_to_conn;
5924
5925 ASSERT(DB_TYPE(mp) == M_DATA);
5926
5927 /* All Solaris components should pass a cred for this operation. */
5928 ASSERT(cr != NULL);
5929
5930 /* do an implicit bind if necessary */
5931 if (udp->udp_state == TS_UNBND) {
5932 error = udp_implicit_bind(connp, cr);
5933 /*
5934 * We could be racing with an actual bind, in which case
5935 * we would see EPROTO. We cross our fingers and try
5936 * to connect.
5937 */
5938 if (!(error == 0 || error == EPROTO)) {
5939 freemsg(mp);
5940 return (error);
5941 }
5942 }
5943
5944 /* Connected? */
5945 if (msg->msg_name == NULL) {
5946 if (udp->udp_state != TS_DATA_XFER) {
5947 UDPS_BUMP_MIB(us, udpOutErrors);
5948 return (EDESTADDRREQ);
5949 }
5950 if (msg->msg_controllen != 0) {
5951 error = udp_output_ancillary(connp, NULL, NULL, mp,
5952 NULL, msg, cr, pid);
5953 } else {
5954 error = udp_output_connected(connp, mp, cr, pid);
5955 }
5956 if (us->us_sendto_ignerr)
5957 return (0);
5958 else
5959 return (error);
5960 }
5961
5962 /*
5963 * Check if we're allowed to send to a connection on which we've
5964 * already called 'connect'. The posix spec. allows both behaviors but
5965 * historically we've returned an error if already connected. The
5966 * client can allow this via a sockopt.
5967 */
5968 mutex_enter(&connp->conn_lock);
5969 snd_to_conn = (udp->udp_snd_to_conn != 0);
5970 mutex_exit(&connp->conn_lock);
5971 if (udp->udp_state == TS_DATA_XFER && !snd_to_conn) {
5972 UDPS_BUMP_MIB(us, udpOutErrors);
5973 return (EISCONN);
5974 }
5975
5976 error = proto_verify_ip_addr(connp->conn_family,
5977 (struct sockaddr *)msg->msg_name, msg->msg_namelen);
5978 if (error != 0) {
5979 UDPS_BUMP_MIB(us, udpOutErrors);
5980 return (error);
5981 }
5982 switch (connp->conn_family) {
5983 case AF_INET6:
5984 sin6 = (sin6_t *)msg->msg_name;
5985
5986 srcid = sin6->__sin6_src_id;
5987
5988 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
5989 /*
5990 * Destination is a non-IPv4-compatible IPv6 address.
5991 * Send out an IPv6 format packet.
5992 */
5993
5994 /*
5995 * If the local address is a mapped address return
5996 * an error.
5997 * It would be possible to send an IPv6 packet but the
5998 * response would never make it back to the application
5999 * since it is bound to a mapped address.
6000 */
6001 if (IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6)) {
6002 UDPS_BUMP_MIB(us, udpOutErrors);
6003 return (EADDRNOTAVAIL);
6004 }
6005 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
6006 sin6->sin6_addr = ipv6_loopback;
6007 ipversion = IPV6_VERSION;
6008 } else {
6009 if (connp->conn_ipv6_v6only) {
6010 UDPS_BUMP_MIB(us, udpOutErrors);
6011 return (EADDRNOTAVAIL);
6012 }
6013
6014 /*
6015 * If the local address is not zero or a mapped address
6016 * return an error. It would be possible to send an
6017 * IPv4 packet but the response would never make it
6018 * back to the application since it is bound to a
6019 * non-mapped address.
6020 */
6021 if (!IN6_IS_ADDR_V4MAPPED(&connp->conn_saddr_v6) &&
6022 !IN6_IS_ADDR_UNSPECIFIED(&connp->conn_saddr_v6)) {
6023 UDPS_BUMP_MIB(us, udpOutErrors);
6024 return (EADDRNOTAVAIL);
6025 }
6026
6027 if (V4_PART_OF_V6(sin6->sin6_addr) == INADDR_ANY) {
6028 V4_PART_OF_V6(sin6->sin6_addr) =
6029 htonl(INADDR_LOOPBACK);
6030 }
6031 ipversion = IPV4_VERSION;
6032 }
6033
6034 /*
6035 * We have to allocate an ip_xmit_attr_t before we grab
6036 * conn_lock and we need to hold conn_lock once we've check
6037 * conn_same_as_last_v6 to handle concurrent send* calls on a
6038 * socket.
6039 */
6040 if (msg->msg_controllen == 0) {
6041 ixa = conn_get_ixa(connp, B_FALSE);
6042 if (ixa == NULL) {
6043 UDPS_BUMP_MIB(us, udpOutErrors);
6044 return (ENOMEM);
6045 }
6046 } else {
6047 ixa = NULL;
6048 }
6049 mutex_enter(&connp->conn_lock);
6050 if (udp->udp_delayed_error != 0) {
6051 sin6_t *sin2 = (sin6_t *)&udp->udp_delayed_addr;
6052
6053 error = udp->udp_delayed_error;
6054 udp->udp_delayed_error = 0;
6055
6056 /* Compare IP address, port, and family */
6057
6058 if (sin6->sin6_port == sin2->sin6_port &&
6059 IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
6060 &sin2->sin6_addr) &&
6061 sin6->sin6_family == sin2->sin6_family) {
6062 mutex_exit(&connp->conn_lock);
6063 UDPS_BUMP_MIB(us, udpOutErrors);
6064 if (ixa != NULL)
6065 ixa_refrele(ixa);
6066 return (error);
6067 }
6068 }
6069
6070 if (msg->msg_controllen != 0) {
6071 mutex_exit(&connp->conn_lock);
6072 ASSERT(ixa == NULL);
6073 error = udp_output_ancillary(connp, NULL, sin6, mp,
6074 NULL, msg, cr, pid);
6075 } else if (conn_same_as_last_v6(connp, sin6) &&
6076 connp->conn_lastsrcid == srcid &&
6077 ipsec_outbound_policy_current(ixa)) {
6078 /* udp_output_lastdst drops conn_lock */
6079 error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6080 } else {
6081 /* udp_output_newdst drops conn_lock */
6082 error = udp_output_newdst(connp, mp, NULL, sin6,
6083 ipversion, cr, pid, ixa);
6084 }
6085 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6086 if (us->us_sendto_ignerr)
6087 return (0);
6088 else
6089 return (error);
6090 case AF_INET:
6091 sin = (sin_t *)msg->msg_name;
6092
6093 ipversion = IPV4_VERSION;
6094
6095 if (sin->sin_addr.s_addr == INADDR_ANY)
6096 sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
6097
6098 /*
6099 * We have to allocate an ip_xmit_attr_t before we grab
6100 * conn_lock and we need to hold conn_lock once we've check
6101 * conn_same_as_last_v6 to handle concurrent send* on a socket.
6102 */
6103 if (msg->msg_controllen == 0) {
6104 ixa = conn_get_ixa(connp, B_FALSE);
6105 if (ixa == NULL) {
6106 UDPS_BUMP_MIB(us, udpOutErrors);
6107 return (ENOMEM);
6108 }
6109 } else {
6110 ixa = NULL;
6111 }
6112 mutex_enter(&connp->conn_lock);
6113 if (udp->udp_delayed_error != 0) {
6114 sin_t *sin2 = (sin_t *)&udp->udp_delayed_addr;
6115
6116 error = udp->udp_delayed_error;
6117 udp->udp_delayed_error = 0;
6118
6119 /* Compare IP address and port */
6120
6121 if (sin->sin_port == sin2->sin_port &&
6122 sin->sin_addr.s_addr == sin2->sin_addr.s_addr) {
6123 mutex_exit(&connp->conn_lock);
6124 UDPS_BUMP_MIB(us, udpOutErrors);
6125 if (ixa != NULL)
6126 ixa_refrele(ixa);
6127 return (error);
6128 }
6129 }
6130 if (msg->msg_controllen != 0) {
6131 mutex_exit(&connp->conn_lock);
6132 ASSERT(ixa == NULL);
6133 error = udp_output_ancillary(connp, sin, NULL, mp,
6134 NULL, msg, cr, pid);
6135 } else if (conn_same_as_last_v4(connp, sin) &&
6136 ipsec_outbound_policy_current(ixa)) {
6137 /* udp_output_lastdst drops conn_lock */
6138 error = udp_output_lastdst(connp, mp, cr, pid, ixa);
6139 } else {
6140 /* udp_output_newdst drops conn_lock */
6141 error = udp_output_newdst(connp, mp, sin, NULL,
6142 ipversion, cr, pid, ixa);
6143 }
6144 ASSERT(MUTEX_NOT_HELD(&connp->conn_lock));
6145 if (us->us_sendto_ignerr)
6146 return (0);
6147 else
6148 return (error);
6149 default:
6150 return (EINVAL);
6151 }
6152 }
6153
6154 int
6155 udp_fallback(sock_lower_handle_t proto_handle, queue_t *q,
6156 boolean_t issocket, so_proto_quiesced_cb_t quiesced_cb,
6157 sock_quiesce_arg_t *arg)
6158 {
6159 conn_t *connp = (conn_t *)proto_handle;
6160 udp_t *udp;
6161 struct T_capability_ack tca;
6162 struct sockaddr_in6 laddr, faddr;
6163 socklen_t laddrlen, faddrlen;
6164 short opts;
6165 struct stroptions *stropt;
6166 mblk_t *mp, *stropt_mp;
6167 int error;
6168
6169 udp = connp->conn_udp;
6170
6171 stropt_mp = allocb_wait(sizeof (*stropt), BPRI_HI, STR_NOSIG, NULL);
6172
6173 /*
6174 * setup the fallback stream that was allocated
6175 */
6176 connp->conn_dev = (dev_t)RD(q)->q_ptr;
6177 connp->conn_minor_arena = WR(q)->q_ptr;
6178
6179 RD(q)->q_ptr = WR(q)->q_ptr = connp;
6180
6181 WR(q)->q_qinfo = &udp_winit;
6182
6183 connp->conn_rq = RD(q);
6184 connp->conn_wq = WR(q);
6185
6186 /* Notify stream head about options before sending up data */
6187 stropt_mp->b_datap->db_type = M_SETOPTS;
6188 stropt_mp->b_wptr += sizeof (*stropt);
6189 stropt = (struct stroptions *)stropt_mp->b_rptr;
6190 stropt->so_flags = SO_WROFF | SO_HIWAT;
6191 stropt->so_wroff = connp->conn_wroff;
6192 stropt->so_hiwat = udp->udp_rcv_disply_hiwat;
6193 putnext(RD(q), stropt_mp);
6194
6195 /*
6196 * Free the helper stream
6197 */
6198 ip_free_helper_stream(connp);
6199
6200 if (!issocket)
6201 udp_use_pure_tpi(udp);
6202
6203 /*
6204 * Collect the information needed to sync with the sonode
6205 */
6206 udp_do_capability_ack(udp, &tca, TC1_INFO);
6207
6208 laddrlen = faddrlen = sizeof (sin6_t);
6209 (void) udp_getsockname((sock_lower_handle_t)connp,
6210 (struct sockaddr *)&laddr, &laddrlen, CRED());
6211 error = udp_getpeername((sock_lower_handle_t)connp,
6212 (struct sockaddr *)&faddr, &faddrlen, CRED());
6213 if (error != 0)
6214 faddrlen = 0;
6215
6216 opts = 0;
6217 if (connp->conn_dgram_errind)
6218 opts |= SO_DGRAM_ERRIND;
6219 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE)
6220 opts |= SO_DONTROUTE;
6221
6222 mp = (*quiesced_cb)(connp->conn_upper_handle, arg, &tca,
6223 (struct sockaddr *)&laddr, laddrlen,
6224 (struct sockaddr *)&faddr, faddrlen, opts);
6225
6226 mutex_enter(&udp->udp_recv_lock);
6227 /*
6228 * Attempts to send data up during fallback will result in it being
6229 * queued in udp_t. First push up the datagrams obtained from the
6230 * socket, then any packets queued in udp_t.
6231 */
6232 if (mp != NULL) {
6233 mp->b_next = udp->udp_fallback_queue_head;
6234 udp->udp_fallback_queue_head = mp;
6235 }
6236 while (udp->udp_fallback_queue_head != NULL) {
6237 mp = udp->udp_fallback_queue_head;
6238 udp->udp_fallback_queue_head = mp->b_next;
6239 mutex_exit(&udp->udp_recv_lock);
6240 mp->b_next = NULL;
6241 putnext(RD(q), mp);
6242 mutex_enter(&udp->udp_recv_lock);
6243 }
6244 udp->udp_fallback_queue_tail = udp->udp_fallback_queue_head;
6245 /*
6246 * No longer a streams less socket
6247 */
6248 mutex_enter(&connp->conn_lock);
6249 connp->conn_flags &= ~IPCL_NONSTR;
6250 mutex_exit(&connp->conn_lock);
6251
6252 mutex_exit(&udp->udp_recv_lock);
6253
6254 ASSERT(connp->conn_ref >= 1);
6255
6256 return (0);
6257 }
6258
6259 /* ARGSUSED3 */
6260 int
6261 udp_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6262 socklen_t *salenp, cred_t *cr)
6263 {
6264 conn_t *connp = (conn_t *)proto_handle;
6265 udp_t *udp = connp->conn_udp;
6266 int error;
6267
6268 /* All Solaris components should pass a cred for this operation. */
6269 ASSERT(cr != NULL);
6270
6271 mutex_enter(&connp->conn_lock);
6272 if (udp->udp_state != TS_DATA_XFER)
6273 error = ENOTCONN;
6274 else
6275 error = conn_getpeername(connp, sa, salenp);
6276 mutex_exit(&connp->conn_lock);
6277 return (error);
6278 }
6279
6280 /* ARGSUSED3 */
6281 int
6282 udp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *sa,
6283 socklen_t *salenp, cred_t *cr)
6284 {
6285 conn_t *connp = (conn_t *)proto_handle;
6286 int error;
6287
6288 /* All Solaris components should pass a cred for this operation. */
6289 ASSERT(cr != NULL);
6290
6291 mutex_enter(&connp->conn_lock);
6292 error = conn_getsockname(connp, sa, salenp);
6293 mutex_exit(&connp->conn_lock);
6294 return (error);
6295 }
6296
6297 int
6298 udp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6299 void *optvalp, socklen_t *optlen, cred_t *cr)
6300 {
6301 conn_t *connp = (conn_t *)proto_handle;
6302 int error;
6303 t_uscalar_t max_optbuf_len;
6304 void *optvalp_buf;
6305 int len;
6306
6307 /* All Solaris components should pass a cred for this operation. */
6308 ASSERT(cr != NULL);
6309
6310 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len,
6311 udp_opt_obj.odb_opt_des_arr,
6312 udp_opt_obj.odb_opt_arr_cnt,
6313 B_FALSE, B_TRUE, cr);
6314 if (error != 0) {
6315 if (error < 0)
6316 error = proto_tlitosyserr(-error);
6317 return (error);
6318 }
6319
6320 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP);
6321 len = udp_opt_get(connp, level, option_name, optvalp_buf);
6322 if (len == -1) {
6323 kmem_free(optvalp_buf, max_optbuf_len);
6324 return (EINVAL);
6325 }
6326
6327 /*
6328 * update optlen and copy option value
6329 */
6330 t_uscalar_t size = MIN(len, *optlen);
6331
6332 bcopy(optvalp_buf, optvalp, size);
6333 bcopy(&size, optlen, sizeof (size));
6334
6335 kmem_free(optvalp_buf, max_optbuf_len);
6336 return (0);
6337 }
6338
6339 int
6340 udp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name,
6341 const void *optvalp, socklen_t optlen, cred_t *cr)
6342 {
6343 conn_t *connp = (conn_t *)proto_handle;
6344 int error;
6345
6346 /* All Solaris components should pass a cred for this operation. */
6347 ASSERT(cr != NULL);
6348
6349 error = proto_opt_check(level, option_name, optlen, NULL,
6350 udp_opt_obj.odb_opt_des_arr,
6351 udp_opt_obj.odb_opt_arr_cnt,
6352 B_TRUE, B_FALSE, cr);
6353
6354 if (error != 0) {
6355 if (error < 0)
6356 error = proto_tlitosyserr(-error);
6357 return (error);
6358 }
6359
6360 error = udp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name,
6361 optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp,
6362 NULL, cr);
6363
6364 ASSERT(error >= 0);
6365
6366 return (error);
6367 }
6368
6369 void
6370 udp_clr_flowctrl(sock_lower_handle_t proto_handle)
6371 {
6372 conn_t *connp = (conn_t *)proto_handle;
6373 udp_t *udp = connp->conn_udp;
6374
6375 mutex_enter(&udp->udp_recv_lock);
6376 connp->conn_flow_cntrld = B_FALSE;
6377 mutex_exit(&udp->udp_recv_lock);
6378 }
6379
6380 /* ARGSUSED2 */
6381 int
6382 udp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr)
6383 {
6384 conn_t *connp = (conn_t *)proto_handle;
6385
6386 /* All Solaris components should pass a cred for this operation. */
6387 ASSERT(cr != NULL);
6388
6389 /* shut down the send side */
6390 if (how != SHUT_RD)
6391 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6392 SOCK_OPCTL_SHUT_SEND, 0);
6393 /* shut down the recv side */
6394 if (how != SHUT_WR)
6395 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle,
6396 SOCK_OPCTL_SHUT_RECV, 0);
6397 return (0);
6398 }
6399
6400 int
6401 udp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg,
6402 int mode, int32_t *rvalp, cred_t *cr)
6403 {
6404 conn_t *connp = (conn_t *)proto_handle;
6405 int error;
6406
6407 /* All Solaris components should pass a cred for this operation. */
6408 ASSERT(cr != NULL);
6409
6410 /*
6411 * If we don't have a helper stream then create one.
6412 * ip_create_helper_stream takes care of locking the conn_t,
6413 * so this check for NULL is just a performance optimization.
6414 */
6415 if (connp->conn_helper_info == NULL) {
6416 udp_stack_t *us = connp->conn_udp->udp_us;
6417
6418 ASSERT(us->us_ldi_ident != NULL);
6419
6420 /*
6421 * Create a helper stream for non-STREAMS socket.
6422 */
6423 error = ip_create_helper_stream(connp, us->us_ldi_ident);
6424 if (error != 0) {
6425 ip0dbg(("tcp_ioctl: create of IP helper stream "
6426 "failed %d\n", error));
6427 return (error);
6428 }
6429 }
6430
6431 switch (cmd) {
6432 case _SIOCSOCKFALLBACK:
6433 case TI_GETPEERNAME:
6434 case TI_GETMYNAME:
6435 ip1dbg(("udp_ioctl: cmd 0x%x on non streams socket",
6436 cmd));
6437 error = EINVAL;
6438 break;
6439 default:
6440 /*
6441 * Pass on to IP using helper stream
6442 */
6443 error = ldi_ioctl(connp->conn_helper_info->iphs_handle,
6444 cmd, arg, mode, cr, rvalp);
6445 break;
6446 }
6447 return (error);
6448 }
6449
6450 /* ARGSUSED */
6451 int
6452 udp_accept(sock_lower_handle_t lproto_handle,
6453 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle,
6454 cred_t *cr)
6455 {
6456 return (EOPNOTSUPP);
6457 }
6458
6459 /* ARGSUSED */
6460 int
6461 udp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr)
6462 {
6463 return (EOPNOTSUPP);
6464 }
6465
6466 sock_downcalls_t sock_udp_downcalls = {
6467 udp_activate, /* sd_activate */
6468 udp_accept, /* sd_accept */
6469 udp_bind, /* sd_bind */
6470 udp_listen, /* sd_listen */
6471 udp_connect, /* sd_connect */
6472 udp_getpeername, /* sd_getpeername */
6473 udp_getsockname, /* sd_getsockname */
6474 udp_getsockopt, /* sd_getsockopt */
6475 udp_setsockopt, /* sd_setsockopt */
6476 udp_send, /* sd_send */
6477 NULL, /* sd_send_uio */
6478 NULL, /* sd_recv_uio */
6479 NULL, /* sd_poll */
6480 udp_shutdown, /* sd_shutdown */
6481 udp_clr_flowctrl, /* sd_setflowctrl */
6482 udp_ioctl, /* sd_ioctl */
6483 udp_close /* sd_close */
6484 };