/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Use is subject to license terms.

 */

/* Copyright (c) 1990 Mentat Inc. */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*

 * This file contains common code for handling Options Management requests.

 */

#include <sys/types.h>

#include <sys/stream.h>

#include <sys/stropts.h>

#include <sys/strlog.h>

#include <sys/strsubr.h>

#include <sys/errno.h>

#define	_SUN_TPI_VERSION 2

#include <sys/tihdr.h>

#include <sys/timod.h>

#include <sys/socket.h>

#include <sys/ddi.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>		/* for ASSERT */

#include <sys/policy.h>

#include <inet/common.h>

#include <inet/mi.h>

#include <inet/nd.h>

#include <netinet/ip6.h>

#include <inet/ip.h>

#include <inet/mib2.h>

#include <netinet/in.h>

#include <netinet/tcp.h>

#include <netinet/ip_mroute.h>

#include "optcom.h"

#include <inet/optcom.h>

/*

 * Function prototypes

 */

static t_scalar_t process_topthdrs_first_pass(mblk_t *, cred_t *, optdb_obj_t *,

    boolean_t *, size_t *);

static t_scalar_t do_options_second_pass(queue_t *q, mblk_t *reqmp,

    mblk_t *ack_mp, cred_t *, optdb_obj_t *dbobjp,

    mblk_t *first_mp, boolean_t is_restart, boolean_t *queued_statusp);

static t_uscalar_t get_worst_status(t_uscalar_t, t_uscalar_t);

static int do_opt_default(queue_t *, struct T_opthdr *, uchar_t **,

    t_uscalar_t *, cred_t *, optdb_obj_t *);

static void do_opt_current(queue_t *, struct T_opthdr *, uchar_t **,

    t_uscalar_t *, cred_t *cr, optdb_obj_t *);

static int do_opt_check_or_negotiate(queue_t *q, struct T_opthdr *reqopt,

    uint_t optset_context, uchar_t **resptrp, t_uscalar_t *worst_statusp,

    cred_t *, optdb_obj_t *dbobjp, mblk_t *first_mp);

static opdes_t *opt_chk_lookup(t_uscalar_t, t_uscalar_t, opdes_t *, uint_t);

static boolean_t opt_level_valid(t_uscalar_t, optlevel_t *, uint_t);

static size_t opt_level_allopts_lengths(t_uscalar_t, opdes_t *, uint_t);

static boolean_t opt_length_ok(opdes_t *, struct T_opthdr *);

static t_uscalar_t optcom_max_optbuf_len(opdes_t *, uint_t);

static boolean_t opt_bloated_maxsize(opdes_t *);

/* Common code for sending back a T_ERROR_ACK. */

void

optcom_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)

{

	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)

		qreply(q, mp);

}

/*

 * The option management routines svr4_optcom_req() and tpi_optcom_req() use

 * callback functions as arguments. Here is the expected interfaces

 * assumed from the callback functions

 *

 *

 * (1) deffn(q, optlevel, optname, optvalp)

 *

 *	- Function only called when default value comes from protocol

 *	 specific code and not the option database table (indicated by

 *	  OP_DEF_FN property in option database.)

 *	- Error return is -1. Valid returns are >=0.

 *	- When valid, the return value represents the length used for storing

 *		the default value of the option.

 *      - Error return implies the called routine did not recognize this

 *              option. Something downstream could so input is left unchanged

 *              in request buffer.

 *

 * (2) getfn(q, optlevel, optname, optvalp)

 *

 *	- Error return is -1. Valid returns are >=0.

 *	- When valid, the return value represents the length used for storing

 *		the actual value of the option.

 *      - Error return implies the called routine did not recognize this

 *              option. Something downstream could so input is left unchanged

 *              in request buffer.

 *

 * (3) setfn(q, optset_context, optlevel, optname, inlen, invalp,

 *	outlenp, outvalp, attrp, cr);

 *

 *	- OK return is 0, Error code is returned as a non-zero argument.

 *      - If negative it is ignored by svr4_optcom_req(). If positive, error

 *        is returned. A negative return implies that option, while handled on

 *	  this stack is not handled at this level and will be handled further

 *	  downstream.

 *	- Both negative and positive errors are treats as errors in an

 *	  identical manner by tpi_optcom_req(). The errors affect "status"

 *	  field of each option's T_opthdr. If sucessfull, an appropriate sucess

 *	  result is carried. If error, it instantiated to "failure" at the

 *	  topmost level and left unchanged at other levels. (This "failure" can

 *	  turn to a success at another level).

 *	- optset_context passed for tpi_optcom_req(). It is interpreted as:

 *        - SETFN_OPTCOM_CHECKONLY

 *		semantics are to pretend to set the value and report

 *		back if it would be successful.

 *		This is used with T_CHECK semantics in XTI

 *        - SETFN_OPTCOM_NEGOTIATE

 *		set the value. Call from option management primitive

 *		T_OPTMGMT_REQ when T_NEGOTIATE flags is used.

 *	  - SETFN_UD_NEGOTIATE

 *		option request came riding on UNITDATA primitive most often

 *		has  "this datagram" semantics to influence prpoerties

 *		affecting an outgoig datagram or associated with recived

 *		datagram

 *		[ Note: XTI permits this use outside of "this datagram"

 *		semantics also and permits setting "management related"

 *		options in this	context and its test suite enforces it ]

 *	  - SETFN_CONN_NEGOTATE

 *		option request came riding on CONN_REQ/RES primitive and

 *		most often has "this connection" (negotiation during

 *		"connection estblishment") semantics.

 *		[ Note: XTI permits use of these outside of "this connection"

 *		semantics and permits "management related" options in this

 *		context and its test suite enforces it. ]

 *

 *	- inlen, invalp is the option length,value requested to be set.

 *	- outlenp, outvalp represent return parameters which contain the

 *	  value set and it might be different from one passed on input.

 *	- attrp points to a data structure that's used by v6 modules to

 *	  store ancillary data options or sticky options.

 *	- cr points to the caller's credentials

 *	- the caller might pass same buffers for input and output and the

 *	  routine should protect against this case by not updating output

 *	  buffers until it is done referencing input buffers and any other

 *	  issues (e.g. not use bcopy() if we do not trust what it does).

 *      - If option is not known, it returns error. We randomly pick EINVAL.

 *        It can however get called with options that are handled downstream

 *        opr upstream so for svr4_optcom_req(), it does not return error for

 *        negative return values.

 *

 */

/*

 * Upper Level Protocols call this routine when they receive

 * a T_SVR4_OPTMGMT_REQ message.  They supply callback functions

 * for setting a new value for a single options, getting the

 * current value for a single option, and checking for support

 * of a single option.  svr4_optcom_req validates the option management

 * buffer passed in, and calls the appropriate routines to do the

 * job requested.

 * XXX Code below needs some restructuring after we have some more

 * macros to support 'struct opthdr' in the headers.

 *

 * IP-MT notes: The option management framework functions svr4_optcom_req() and

 * tpi_optcom_req() allocate and prepend an M_CTL mblk to the actual

 * T_optmgmt_req mblk and pass the chain as an additional parameter to the

 * protocol set functions. If a protocol set function (such as ip_opt_set)

 * cannot process the option immediately it can return EINPROGRESS. ip_opt_set

 * enqueues the message in the appropriate sq and returns EINPROGRESS. Later

 * the sq framework arranges to restart this operation and passes control to

 * the restart function ip_restart_optmgmt() which in turn calls

 * svr4_optcom_req() or tpi_optcom_req() to restart the option processing.

 */

int

svr4_optcom_req(queue_t *q, mblk_t *mp, cred_t *cr, optdb_obj_t *dbobjp)

{

	pfi_t	deffn = dbobjp->odb_deffn;

	pfi_t	getfn = dbobjp->odb_getfn;

	opt_set_fn setfn = dbobjp->odb_setfn;

	opdes_t	*opt_arr = dbobjp->odb_opt_des_arr;

	uint_t opt_arr_cnt = dbobjp->odb_opt_arr_cnt;

	boolean_t topmost_tpiprovider = dbobjp->odb_topmost_tpiprovider;

	opt_restart_t *or;

	struct opthdr *restart_opt;

	boolean_t is_restart = B_FALSE;

	mblk_t	*first_mp;

	t_uscalar_t max_optbuf_len;

	int len;

	mblk_t	*mp1 = NULL;

	struct opthdr *next_opt;

	struct opthdr *opt;

	struct opthdr *opt1;

	struct opthdr *opt_end;

	struct opthdr *opt_start;

	opdes_t	*optd;

	boolean_t	pass_to_next = B_FALSE;

	boolean_t	pass_to_ip = B_FALSE;

	struct T_optmgmt_ack *toa;

	struct T_optmgmt_req *tor;

	/*

	 * Allocate M_CTL and prepend to the packet for restarting this

	 * option if needed. IP may need to queue and restart the option

	 * if it cannot obtain exclusive conditions immediately. Please see

	 * IP-MT notes before the start of svr4_optcom_req

	 */

	if (mp->b_datap->db_type == M_CTL) {

		is_restart = B_TRUE;

		first_mp = mp;

		mp = mp->b_cont;

		ASSERT(mp->b_wptr - mp->b_rptr >=

		    sizeof (struct T_optmgmt_req));

		tor = (struct T_optmgmt_req *)mp->b_rptr;

		ASSERT(tor->MGMT_flags == T_NEGOTIATE);

		or = (opt_restart_t *)first_mp->b_rptr;

		opt_start = or->or_start;

		opt_end = or->or_end;

		restart_opt = or->or_ropt;

		goto restart;

	}

	tor = (struct T_optmgmt_req *)mp->b_rptr;

	/* Verify message integrity. */

	if (mp->b_wptr - mp->b_rptr < sizeof (struct T_optmgmt_req))

		goto bad_opt;

	/* Verify MGMT_flags legal */

	switch (tor->MGMT_flags) {

	case T_DEFAULT:

	case T_NEGOTIATE:

	case T_CURRENT:

	case T_CHECK:

		/* OK - legal request flags */

		break;

	default:

		optcom_err_ack(q, mp, TBADFLAG, 0);

		return (0);

	}

	if (tor->MGMT_flags == T_DEFAULT) {

		/* Is it a request for default option settings? */

		/*

		 * Note: XXX TLI and TPI specification was unclear about

		 * semantics of T_DEFAULT and the following historical note

		 * and its interpretation is incorrect (it implies a request

		 * for default values of only the identified options not all.

		 * The semantics have been explained better in XTI spec.)

		 * However, we do not modify (comment or code) here to keep

		 * compatibility.

		 * We can rethink this if it ever becomes an issue.

		 * ----historical comment start------

		 * As we understand it, the input buffer is meaningless

		 * so we ditch the message.  A T_DEFAULT request is a

		 * request to obtain a buffer containing defaults for

		 * all supported options, so we allocate a maximum length

		 * reply.

		 * ----historical comment end -------

		 */

		/* T_DEFAULT not passed down */

		ASSERT(topmost_tpiprovider == B_TRUE);

		freemsg(mp);

		max_optbuf_len = optcom_max_optbuf_len(opt_arr,

		    opt_arr_cnt);

		mp = allocb(max_optbuf_len, BPRI_MED);

		if (!mp) {

no_mem:;

			optcom_err_ack(q, mp, TSYSERR, ENOMEM);

			return (0);

		}

		/* Initialize the T_optmgmt_ack header. */

		toa = (struct T_optmgmt_ack *)mp->b_rptr;

		bzero((char *)toa, max_optbuf_len);

		toa->PRIM_type = T_OPTMGMT_ACK;

		toa->OPT_offset = (t_scalar_t)sizeof (struct T_optmgmt_ack);

		/* TODO: Is T_DEFAULT the right thing to put in MGMT_flags? */

		toa->MGMT_flags = T_DEFAULT;

		/* Now walk the table of options passed in */

		opt = (struct opthdr *)&toa[1];

		for (optd = opt_arr; optd < &opt_arr[opt_arr_cnt]; optd++) {

			/*

			 * All the options in the table of options passed

			 * in are by definition supported by the protocol

			 * calling this function.

			 */

			if (!OA_READ_PERMISSION(optd, cr))

				continue;

			opt->level = optd->opdes_level;

			opt->name = optd->opdes_name;

			if (!(optd->opdes_props & OP_DEF_FN) ||

			    ((len = (*deffn)(q, opt->level,

				opt->name, (uchar_t *)&opt[1])) < 0)) {

				/*

				 * Fill length and value from table.

				 *

				 * Default value not instantiated from function

				 * (or the protocol specific function failed it;

				 * In this interpretation of T_DEFAULT, this is

				 * the best we can do)

				 */

				switch (optd->opdes_size) {

				/*

				 * Since options are guaranteed aligned only

				 * on a 4 byte boundary (t_scalar_t) any

				 * option that is greater in size will default

				 * to the bcopy below

				 */

				case sizeof (int32_t):

					*(int32_t *)&opt[1] =

					    (int32_t)optd->opdes_default;

					break;

				case sizeof (int16_t):

					*(int16_t *)&opt[1] =

					    (int16_t)optd->opdes_default;

					break;

				case sizeof (int8_t):

					*(int8_t *)&opt[1] =

					    (int8_t)optd->opdes_default;

					break;

				default:

					/*

					 * other length but still assume

					 * fixed - use bcopy

					 */

					bcopy(optd->opdes_defbuf,

					    &opt[1], optd->opdes_size);

					break;

				}

				opt->len = optd->opdes_size;

			}

			else

				opt->len = (t_uscalar_t)len;

			opt = (struct opthdr *)((char *)&opt[1] +

			    _TPI_ALIGN_OPT(opt->len));

		}

		/* Now record the final length. */

		toa->OPT_length = (t_scalar_t)((char *)opt - (char *)&toa[1]);

		mp->b_wptr = (uchar_t *)opt;

		mp->b_datap->db_type = M_PCPROTO;

		/* Ship it back. */

		qreply(q, mp);

		return (0);

	}

	/* T_DEFAULT processing complete - no more T_DEFAULT */

	/*

	 * For T_NEGOTIATE, T_CURRENT, and T_CHECK requests, we make a

	 * pass through the input buffer validating the details and

	 * making sure each option is supported by the protocol.

	 */

	if ((opt_start = (struct opthdr *)mi_offset_param(mp,

	    tor->OPT_offset, tor->OPT_length)) == NULL)

		goto bad_opt;

	if (!__TPI_OPT_ISALIGNED(opt_start))

		goto bad_opt;

	opt_end = (struct opthdr *)((uchar_t *)opt_start +

	    tor->OPT_length);

	for (opt = opt_start; opt < opt_end; opt = next_opt) {

		/*

		 * Verify we have room to reference the option header

		 * fields in the option buffer.

		 */

		if ((uchar_t *)opt + sizeof (struct opthdr) >

		    (uchar_t *)opt_end)

			goto bad_opt;

		/*

		 * We now compute pointer to next option in buffer 'next_opt'

		 * The next_opt computation above below 'opt->len' initialized

		 * by application which cannot be trusted. The usual value

		 * too large will be captured by the loop termination condition

		 * above. We check for the following which it will miss.

		 * 	-pointer space wraparound arithmetic overflow

		 *	-last option in buffer with 'opt->len' being too large

		 *	 (only reason 'next_opt' should equal or exceed

		 *	 'opt_end' for last option is roundup unless length is

		 *	 too-large/invalid)

		 */

		next_opt = (struct opthdr *)((uchar_t *)&opt[1] +

		    _TPI_ALIGN_OPT(opt->len));

		if ((uchar_t *)next_opt < (uchar_t *)&opt[1] ||

		    ((next_opt >= opt_end) &&

			(((uchar_t *)next_opt - (uchar_t *)opt_end) >=

			    __TPI_ALIGN_SIZE)))

			goto bad_opt;

		/* sanity check */

		if (opt->name == T_ALLOPT)

			goto bad_opt;

		/* Find the option in the opt_arr. */

		if ((optd = opt_chk_lookup(opt->level, opt->name,

		    opt_arr, opt_arr_cnt)) == NULL) {

			/*

			 * Not found, that is a bad thing if

			 * the caller is a tpi provider

			 */

			if (topmost_tpiprovider)

				goto bad_opt;

			else

				continue; /* skip unmodified */

		}

		/* Additional checks dependent on operation. */

		switch (tor->MGMT_flags) {

		case T_NEGOTIATE:

			if (!OA_WRITE_OR_EXECUTE(optd, cr)) {

				/* can't negotiate option */

				if (!(OA_MATCHED_PRIV(optd, cr)) &&

				    OA_WX_ANYPRIV(optd)) {

					/*

					 * not privileged but privilege

					 * will help negotiate option.

					 */

					optcom_err_ack(q, mp, TACCES, 0);

					return (0);

				} else

					goto bad_opt;

			}

			/*

			 * Verify size for options

			 * Note: For retaining compatibility with historical

			 * behavior, variable lengths options will have their

			 * length verified in the setfn() processing.

			 * In order to be compatible with SunOS 4.X we return

			 * EINVAL errors for bad lengths.

			 */

			if (!(optd->opdes_props & OP_VARLEN)) {

				/* fixed length - size must match */

				if (opt->len != optd->opdes_size) {

					optcom_err_ack(q, mp, TSYSERR, EINVAL);

					return (0);

				}

			}

			break;

		case T_CHECK:

			if (!OA_RWX_ANYPRIV(optd))

				/* any of "rwx" permission but not not none */

				goto bad_opt;

			/*

			 * XXX Since T_CURRENT was not there in TLI and the

			 * official TLI inspired TPI standard, getsockopt()

			 * API uses T_CHECK (for T_CURRENT semantics)

			 * The following fallthru makes sense because of its

			 * historical use as semantic equivalent to T_CURRENT.

			 */

			/* FALLTHRU */

		case T_CURRENT:

			if (!OA_READ_PERMISSION(optd, cr)) {

				/* can't read option value */

				if (!(OA_MATCHED_PRIV(optd, cr)) &&

				    OA_R_ANYPRIV(optd)) {

					/*

					 * not privileged but privilege

					 * will help in reading option value.

					 */

					optcom_err_ack(q, mp, TACCES, 0);

					return (0);

				} else

					goto bad_opt;

			}

			break;

		default:

			optcom_err_ack(q, mp, TBADFLAG, 0);

			return (0);

		}

		/* We liked it.  Keep going. */

	} /* end for loop scanning option buffer */

	/* Now complete the operation as required. */

	switch (tor->MGMT_flags) {

	case T_CHECK:

		/*

		 * Historically used same as T_CURRENT (which was added to

		 * standard later). Code retained for compatibility.

		 */

		/* FALLTHROUGH */

	case T_CURRENT:

		/*

		 * Allocate a maximum size reply.  Perhaps we are supposed to

		 * assume that the input buffer includes space for the answers

		 * as well as the opthdrs, but we don't know that for sure.

		 * So, instead, we create a new output buffer, using the

		 * input buffer only as a list of options.

		 */

		max_optbuf_len = optcom_max_optbuf_len(opt_arr,

		    opt_arr_cnt);

		mp1 = allocb_cred(max_optbuf_len, cr);

		if (!mp1)

			goto no_mem;

		/* Initialize the header. */

		mp1->b_datap->db_type = M_PCPROTO;

		mp1->b_wptr = &mp1->b_rptr[sizeof (struct T_optmgmt_ack)];

		toa = (struct T_optmgmt_ack *)mp1->b_rptr;

		toa->OPT_offset = (t_scalar_t)sizeof (struct T_optmgmt_ack);

		toa->MGMT_flags = tor->MGMT_flags;