path: root/usr/src/uts/common/inet/ipf/ip_fil_solaris.c

/*
 * Copyright (C) 1993-2001, 2003 by Darren Reed.
 *
 * See the IPFILTER.LICENCE file for details on licencing.
 *
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 *
 * Copyright 2018 Joyent, Inc.
 */

#if !defined(lint)
static const char sccsid[] = "@(#)ip_fil_solaris.c	1.7 07/22/06 (C) 1993-2000 Darren Reed";
static const char rcsid[] = "@(#)$Id: ip_fil_solaris.c,v 2.62.2.19 2005/07/13 21:40:46 darrenr Exp $";
#endif

#include <sys/types.h>
#include <sys/errno.h>
#include <sys/param.h>
#include <sys/cpuvar.h>
#include <sys/open.h>
#include <sys/ioctl.h>
#include <sys/filio.h>
#include <sys/systm.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/cred.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/ksynch.h>
#include <sys/kmem.h>
#include <sys/mac_provider.h>
#include <sys/mkdev.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/dditypes.h>
#include <sys/cmn_err.h>
#include <sys/zone.h>
#include <net/if.h>
#include <net/af.h>
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/tcpip.h>
#include <netinet/ip_icmp.h>
#include "netinet/ip_compat.h"
#ifdef	USE_INET6
# include <netinet/icmp6.h>
#endif
#include "netinet/ip_fil.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_auth.h"
#include "netinet/ip_proxy.h"
#include "netinet/ipf_stack.h"
#ifdef	IPFILTER_LOOKUP
# include "netinet/ip_lookup.h"
#endif
#include <inet/ip_ire.h>

#include <sys/md5.h>
#include <sys/neti.h>

static	int	frzerostats __P((caddr_t, ipf_stack_t *));
static	int	fr_setipfloopback __P((int, ipf_stack_t *));
static	int	fr_enableipf __P((ipf_stack_t *, int));
static	int	fr_send_ip __P((fr_info_t *fin, mblk_t *m, mblk_t **mp));
static	int	ipf_nic_event_v4 __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_nic_event_v6 __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hook __P((hook_data_t, int, int, void *));
static	int	ipf_hook4_in __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hook4_out __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hook4_loop_out __P((hook_event_token_t, hook_data_t,
    void *));
static	int	ipf_hook4_loop_in __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hook4 __P((hook_data_t, int, int, void *));
static	int	ipf_hook6_out __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hook6_in __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hook6_loop_out __P((hook_event_token_t, hook_data_t,
    void *));
static	int	ipf_hook6_loop_in __P((hook_event_token_t, hook_data_t,
    void *));
static	int     ipf_hook6 __P((hook_data_t, int, int, void *));

static	int	ipf_hookviona_in __P((hook_event_token_t, hook_data_t, void *));
static	int	ipf_hookviona_out __P((hook_event_token_t, hook_data_t,
    void *));

extern	int	ipf_geniter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
extern	int	ipf_frruleiter __P((void *, int, void *, ipf_stack_t *));

static int	ipf_hook_protocol_notify __P((hook_notify_cmd_t, void *,
    const char *, const char *, const char *));
static int	ipf_hook_instance_notify __P((hook_notify_cmd_t, void *,
    const char *, const char *, const char *));

#if SOLARIS2 < 10
#if SOLARIS2 >= 7
u_int		*ip_ttl_ptr = NULL;
u_int		*ip_mtudisc = NULL;
# if SOLARIS2 >= 8
int		*ip_forwarding = NULL;
u_int		*ip6_forwarding = NULL;
# else
u_int		*ip_forwarding = NULL;
# endif
#else
u_long		*ip_ttl_ptr = NULL;
u_long		*ip_mtudisc = NULL;
u_long		*ip_forwarding = NULL;
#endif
#endif

vmem_t	*ipf_minor;	/* minor number arena */
void 	*ipf_state;	/* DDI state */

/*
 * GZ-controlled and per-zone stacks:
 *
 * For each non-global zone, we create two ipf stacks: the per-zone stack and
 * the GZ-controlled stack.  The per-zone stack can be controlled and observed
 * from inside the zone or from the global zone.  The GZ-controlled stack can
 * only be controlled and observed from the global zone (though the rules
 * still only affect that non-global zone).
 *
 * The two hooks are always arranged so that the GZ-controlled stack is always
 * "outermost" with respect to the zone.  The traffic flow then looks like
 * this:
 *
 * Inbound:
 *
 *     nic ---> [ GZ-controlled rules ] ---> [ per-zone rules ] ---> zone
 *
 * Outbound:
 *
 *     nic <--- [ GZ-controlled rules ] <--- [ per-zone rules ] <--- zone
 */

/* IPv4 hook names */
char *hook4_nicevents = 	"ipfilter_hook4_nicevents";
char *hook4_nicevents_gz = 	"ipfilter_hook4_nicevents_gz";
char *hook4_in = 		"ipfilter_hook4_in";
char *hook4_in_gz = 		"ipfilter_hook4_in_gz";
char *hook4_out = 		"ipfilter_hook4_out";
char *hook4_out_gz = 		"ipfilter_hook4_out_gz";
char *hook4_loop_in = 		"ipfilter_hook4_loop_in";
char *hook4_loop_in_gz = 	"ipfilter_hook4_loop_in_gz";
char *hook4_loop_out = 		"ipfilter_hook4_loop_out";
char *hook4_loop_out_gz = 	"ipfilter_hook4_loop_out_gz";

/* IPv6 hook names */
char *hook6_nicevents = 	"ipfilter_hook6_nicevents";
char *hook6_nicevents_gz = 	"ipfilter_hook6_nicevents_gz";
char *hook6_in = 		"ipfilter_hook6_in";
char *hook6_in_gz = 		"ipfilter_hook6_in_gz";
char *hook6_out = 		"ipfilter_hook6_out";
char *hook6_out_gz = 		"ipfilter_hook6_out_gz";
char *hook6_loop_in = 		"ipfilter_hook6_loop_in";
char *hook6_loop_in_gz = 	"ipfilter_hook6_loop_in_gz";
char *hook6_loop_out = 		"ipfilter_hook6_loop_out";
char *hook6_loop_out_gz = 	"ipfilter_hook6_loop_out_gz";

/* viona hook names */
char *hook_viona_in =		"ipfilter_hookviona_in";
char *hook_viona_in_gz =	"ipfilter_hookviona_in_gz";
char *hook_viona_out =		"ipfilter_hookviona_out";
char *hook_viona_out_gz =	"ipfilter_hookviona_out_gz";

/* ------------------------------------------------------------------------ */
/* Function:    ipldetach                                                   */
/* Returns:     int - 0 == success, else error.                             */
/* Parameters:  Nil                                                         */
/*                                                                          */
/* This function is responsible for undoing anything that might have been   */
/* done in a call to iplattach().  It must be able to clean up from a call  */
/* to iplattach() that did not succeed.  Why might that happen?  Someone    */
/* configures a table to be so large that we cannot allocate enough memory  */
/* for it.                                                                  */
/* ------------------------------------------------------------------------ */
int ipldetach(ifs)
ipf_stack_t *ifs;
{

	ASSERT(RW_WRITE_HELD(&ifs->ifs_ipf_global.ipf_lk));

#if SOLARIS2 < 10

	if (ifs->ifs_fr_control_forwarding & 2) {
		if (ip_forwarding != NULL)
			*ip_forwarding = 0;
#if SOLARIS2 >= 8
		if (ip6_forwarding != NULL)
			*ip6_forwarding = 0;
#endif
	}
#endif

	/*
	 * This lock needs to be dropped around the net_hook_unregister calls
	 * because we can deadlock here with:
	 * W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs
	 * R(hook_family)->R(hei_lock)->R(ipf_global) (active hook running)
	 */
	RWLOCK_EXIT(&ifs->ifs_ipf_global);

#define	UNDO_HOOK(_f, _b, _e, _h)					\
	do {								\
		if (ifs->_f != NULL) {					\
			if (ifs->_b) {					\
				int tmp = net_hook_unregister(ifs->_f,	\
					   _e, ifs->_h);		\
				ifs->_b = (tmp != 0 && tmp != ENXIO);	\
				if (!ifs->_b && ifs->_h != NULL) {	\
					hook_free(ifs->_h);		\
					ifs->_h = NULL;			\
				}					\
			} else if (ifs->_h != NULL) {			\
				hook_free(ifs->_h);			\
				ifs->_h = NULL;				\
			}						\
		}							\
		_NOTE(CONSTCOND)					\
	} while (0)

	/*
	 * Remove IPv6 Hooks
	 */
	if (ifs->ifs_ipf_ipv6 != NULL) {
		UNDO_HOOK(ifs_ipf_ipv6, ifs_hook6_physical_in,
			  NH_PHYSICAL_IN, ifs_ipfhook6_in);
		UNDO_HOOK(ifs_ipf_ipv6, ifs_hook6_physical_out,
			  NH_PHYSICAL_OUT, ifs_ipfhook6_out);
		UNDO_HOOK(ifs_ipf_ipv6, ifs_hook6_nic_events,
			  NH_NIC_EVENTS, ifs_ipfhook6_nicevents);
		UNDO_HOOK(ifs_ipf_ipv6, ifs_hook6_loopback_in,
			  NH_LOOPBACK_IN, ifs_ipfhook6_loop_in);
		UNDO_HOOK(ifs_ipf_ipv6, ifs_hook6_loopback_out,
			  NH_LOOPBACK_OUT, ifs_ipfhook6_loop_out);

		if (net_protocol_release(ifs->ifs_ipf_ipv6) != 0)
			goto detach_failed;
		ifs->ifs_ipf_ipv6 = NULL;
        }

	/*
	 * Remove IPv4 Hooks
	 */
	if (ifs->ifs_ipf_ipv4 != NULL) {
		UNDO_HOOK(ifs_ipf_ipv4, ifs_hook4_physical_in,
			  NH_PHYSICAL_IN, ifs_ipfhook4_in);
		UNDO_HOOK(ifs_ipf_ipv4, ifs_hook4_physical_out,
			  NH_PHYSICAL_OUT, ifs_ipfhook4_out);
		UNDO_HOOK(ifs_ipf_ipv4, ifs_hook4_nic_events,
			  NH_NIC_EVENTS, ifs_ipfhook4_nicevents);
		UNDO_HOOK(ifs_ipf_ipv4, ifs_hook4_loopback_in,
			  NH_LOOPBACK_IN, ifs_ipfhook4_loop_in);
		UNDO_HOOK(ifs_ipf_ipv4, ifs_hook4_loopback_out,
			  NH_LOOPBACK_OUT, ifs_ipfhook4_loop_out);

		if (net_protocol_release(ifs->ifs_ipf_ipv4) != 0)
			goto detach_failed;
		ifs->ifs_ipf_ipv4 = NULL;
	}

	/*
	 * Remove notification of viona hooks
	 */
	net_instance_notify_unregister(ifs->ifs_netid,
	    ipf_hook_instance_notify);

#undef UNDO_HOOK

	/*
	 * Normally, viona will unregister itself before ipldetach() is called,
	 * so these will be no-ops, but out of caution, we try to make sure
	 * we've removed any of our references.
	 */
	(void) ipf_hook_protocol_notify(HN_UNREGISTER, ifs, Hn_VIONA, NULL,
	    NH_PHYSICAL_IN);
	(void) ipf_hook_protocol_notify(HN_UNREGISTER, ifs, Hn_VIONA, NULL,
	    NH_PHYSICAL_OUT);

	{
		char netidstr[12]; /* Large enough for INT_MAX + NUL */
		(void) snprintf(netidstr, sizeof (netidstr), "%d",
		    ifs->ifs_netid);

		/*
		 * The notify callbacks expect the netid value passed as a
		 * string in the third argument.  To prevent confusion if
		 * traced, we pass the same value the nethook framework would
		 * pass, even though the callback does not currently use the
		 * value.
		 */
		(void) ipf_hook_instance_notify(HN_UNREGISTER, ifs, netidstr,
		    NULL, Hn_VIONA);
	}

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "ipldetach()\n");
#endif

	WRITE_ENTER(&ifs->ifs_ipf_global);
	fr_deinitialise(ifs);

	(void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE|FR_INACTIVE, ifs);
	(void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE, ifs);

	if (ifs->ifs_ipf_locks_done == 1) {
		MUTEX_DESTROY(&ifs->ifs_ipf_timeoutlock);
		MUTEX_DESTROY(&ifs->ifs_ipf_rw);
		RW_DESTROY(&ifs->ifs_ipf_tokens);
		RW_DESTROY(&ifs->ifs_ipf_ipidfrag);
		ifs->ifs_ipf_locks_done = 0;
	}

	if (ifs->ifs_hook4_physical_in || ifs->ifs_hook4_physical_out ||
	    ifs->ifs_hook4_nic_events || ifs->ifs_hook4_loopback_in ||
	    ifs->ifs_hook4_loopback_out || ifs->ifs_hook6_nic_events ||
	    ifs->ifs_hook6_physical_in || ifs->ifs_hook6_physical_out ||
	    ifs->ifs_hook6_loopback_in || ifs->ifs_hook6_loopback_out)
		return -1;

	return 0;

detach_failed:
	WRITE_ENTER(&ifs->ifs_ipf_global);
	return -1;
}

int iplattach(ifs)
ipf_stack_t *ifs;
{
#if SOLARIS2 < 10
	int i;
#endif
	netid_t id = ifs->ifs_netid;

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "iplattach()\n");
#endif

	ASSERT(RW_WRITE_HELD(&ifs->ifs_ipf_global.ipf_lk));
	ifs->ifs_fr_flags = IPF_LOGGING;
#ifdef _KERNEL
	ifs->ifs_fr_update_ipid = 0;
#else
	ifs->ifs_fr_update_ipid = 1;
#endif
	ifs->ifs_fr_minttl = 4;
	ifs->ifs_fr_icmpminfragmtu = 68;
#if defined(IPFILTER_DEFAULT_BLOCK)
	ifs->ifs_fr_pass = FR_BLOCK|FR_NOMATCH;
#else
	ifs->ifs_fr_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH;
#endif

	bzero((char *)ifs->ifs_frcache, sizeof(ifs->ifs_frcache));
	MUTEX_INIT(&ifs->ifs_ipf_rw, "ipf rw mutex");
	MUTEX_INIT(&ifs->ifs_ipf_timeoutlock, "ipf timeout lock mutex");
	RWLOCK_INIT(&ifs->ifs_ipf_ipidfrag, "ipf IP NAT-Frag rwlock");
	RWLOCK_INIT(&ifs->ifs_ipf_tokens, "ipf token rwlock");
	ifs->ifs_ipf_locks_done = 1;

	if (fr_initialise(ifs) < 0)
		return -1;

	/*
	 * For incoming packets, we want the GZ-controlled hooks to run before
	 * the per-zone hooks, regardless of what order they're are installed.
	 * See the "GZ-controlled and per-zone stacks" comment block at the top
	 * of this file.
	 */
#define HOOK_INIT_GZ_BEFORE(x, fn, n, gzn, a)				\
	HOOK_INIT(x, fn, ifs->ifs_gz_controlled ? gzn : n, ifs);	\
	(x)->h_hint = ifs->ifs_gz_controlled ? HH_BEFORE : HH_AFTER;	\
	(x)->h_hintvalue = (uintptr_t) (ifs->ifs_gz_controlled ? n : gzn);

	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhook4_nicevents, ipf_nic_event_v4,
		  hook4_nicevents, hook4_nicevents_gz, ifs);
	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhook4_in, ipf_hook4_in,
		  hook4_in, hook4_in_gz, ifs);
	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhook4_loop_in, ipf_hook4_loop_in,
		  hook4_loop_in, hook4_loop_in_gz, ifs);

	/*
	 * For outgoing packets, we want the GZ-controlled hooks to run after
	 * the per-zone hooks, regardless of what order they're are installed.
	 * See the "GZ-controlled and per-zone stacks" comment block at the top
	 * of this file.
	 */
#define HOOK_INIT_GZ_AFTER(x, fn, n, gzn, a)				\
	HOOK_INIT(x, fn, ifs->ifs_gz_controlled ? gzn : n, ifs);	\
	(x)->h_hint = ifs->ifs_gz_controlled ? HH_AFTER : HH_BEFORE;	\
	(x)->h_hintvalue = (uintptr_t) (ifs->ifs_gz_controlled ? n : gzn);

	HOOK_INIT_GZ_AFTER(ifs->ifs_ipfhook4_out, ipf_hook4_out,
		  hook4_out, hook4_out_gz, ifs);
	HOOK_INIT_GZ_AFTER(ifs->ifs_ipfhook4_loop_out, ipf_hook4_loop_out,
		  hook4_loop_out, hook4_loop_out_gz, ifs);

	/*
	 * If we hold this lock over all of the net_hook_register calls, we
	 * can cause a deadlock to occur with the following lock ordering:
	 * W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs
	 * R(hook_family)->R(hei_lock)->R(ipf_global) (packet path)
	 */
	RWLOCK_EXIT(&ifs->ifs_ipf_global);

	/*
	 * Add IPv4 hooks
	 */
	ifs->ifs_ipf_ipv4 = net_protocol_lookup(id, NHF_INET);
	if (ifs->ifs_ipf_ipv4 == NULL)
		goto hookup_failed;

	ifs->ifs_hook4_nic_events = (net_hook_register(ifs->ifs_ipf_ipv4,
	    NH_NIC_EVENTS, ifs->ifs_ipfhook4_nicevents) == 0);
	if (!ifs->ifs_hook4_nic_events)
		goto hookup_failed;

	ifs->ifs_hook4_physical_in = (net_hook_register(ifs->ifs_ipf_ipv4,
	    NH_PHYSICAL_IN, ifs->ifs_ipfhook4_in) == 0);
	if (!ifs->ifs_hook4_physical_in)
		goto hookup_failed;

	ifs->ifs_hook4_physical_out = (net_hook_register(ifs->ifs_ipf_ipv4,
	    NH_PHYSICAL_OUT, ifs->ifs_ipfhook4_out) == 0);
	if (!ifs->ifs_hook4_physical_out)
		goto hookup_failed;

	if (ifs->ifs_ipf_loopback) {
		ifs->ifs_hook4_loopback_in = (net_hook_register(
		    ifs->ifs_ipf_ipv4, NH_LOOPBACK_IN,
		    ifs->ifs_ipfhook4_loop_in) == 0);
		if (!ifs->ifs_hook4_loopback_in)
			goto hookup_failed;

		ifs->ifs_hook4_loopback_out = (net_hook_register(
		    ifs->ifs_ipf_ipv4, NH_LOOPBACK_OUT,
		    ifs->ifs_ipfhook4_loop_out) == 0);
		if (!ifs->ifs_hook4_loopback_out)
			goto hookup_failed;
	}

	/*
	 * Add IPv6 hooks
	 */
	ifs->ifs_ipf_ipv6 = net_protocol_lookup(id, NHF_INET6);
	if (ifs->ifs_ipf_ipv6 == NULL)
		goto hookup_failed;

	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhook6_nicevents, ipf_nic_event_v6,
		  hook6_nicevents, hook6_nicevents_gz, ifs);
	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhook6_in, ipf_hook6_in,
		  hook6_in, hook6_in_gz, ifs);
	HOOK_INIT_GZ_BEFORE(ifs->ifs_ipfhook6_loop_in, ipf_hook6_loop_in,
		  hook6_loop_in, hook6_loop_in_gz, ifs);
	HOOK_INIT_GZ_AFTER(ifs->ifs_ipfhook6_out, ipf_hook6_out,
		  hook6_out, hook6_out_gz, ifs);
	HOOK_INIT_GZ_AFTER(ifs->ifs_ipfhook6_loop_out, ipf_hook6_loop_out,
		  hook6_loop_out, hook6_loop_out_gz, ifs);

	ifs->ifs_hook6_nic_events = (net_hook_register(ifs->ifs_ipf_ipv6,
	    NH_NIC_EVENTS, ifs->ifs_ipfhook6_nicevents) == 0);
	if (!ifs->ifs_hook6_nic_events)
		goto hookup_failed;

	ifs->ifs_hook6_physical_in = (net_hook_register(ifs->ifs_ipf_ipv6,
	    NH_PHYSICAL_IN, ifs->ifs_ipfhook6_in) == 0);
	if (!ifs->ifs_hook6_physical_in)
		goto hookup_failed;

	ifs->ifs_hook6_physical_out = (net_hook_register(ifs->ifs_ipf_ipv6,
	    NH_PHYSICAL_OUT, ifs->ifs_ipfhook6_out) == 0);
	if (!ifs->ifs_hook6_physical_out)
		goto hookup_failed;

	if (ifs->ifs_ipf_loopback) {
		ifs->ifs_hook6_loopback_in = (net_hook_register(
		    ifs->ifs_ipf_ipv6, NH_LOOPBACK_IN,
		    ifs->ifs_ipfhook6_loop_in) == 0);
		if (!ifs->ifs_hook6_loopback_in)
			goto hookup_failed;

		ifs->ifs_hook6_loopback_out = (net_hook_register(
		    ifs->ifs_ipf_ipv6, NH_LOOPBACK_OUT,
		    ifs->ifs_ipfhook6_loop_out) == 0);
		if (!ifs->ifs_hook6_loopback_out)
			goto hookup_failed;
	}

	/*
	 * VIONA INET hooks.  While the nethook framework allows us to register
	 * hooks for events that haven't been registered yet, we instead
	 * register and unregister our hooks in response to notifications
	 * about the viona hooks from the nethook framework.  This prevents
	 * problems when the viona module gets unloaded while the ipf module
	 * does not.  If we do not unregister our hooks after the viona module
	 * is unloaded, the viona module cannot later re-register them if it
	 * gets reloaded.  As the ip, vnd, and ipf modules are rarely unloaded
	 * even on DEBUG kernels, they do not experience this issue.
	 */
	if (net_instance_notify_register(id, ipf_hook_instance_notify,
	    ifs) != 0)
		goto hookup_failed;

	/*
	 * Reacquire ipf_global, now it is safe.
	 */
	WRITE_ENTER(&ifs->ifs_ipf_global);

/* Do not use private interface ip_params_arr[] in Solaris 10 */
#if SOLARIS2 < 10

#if SOLARIS2 >= 8
	ip_forwarding = &ip_g_forward;
#endif
	/*
	 * XXX - There is no terminator for this array, so it is not possible
	 * to tell if what we are looking for is missing and go off the end
	 * of the array.
	 */

#if SOLARIS2 <= 8
	for (i = 0; ; i++) {
		if (!strcmp(ip_param_arr[i].ip_param_name, "ip_def_ttl")) {
			ip_ttl_ptr = &ip_param_arr[i].ip_param_value;
		} else if (!strcmp(ip_param_arr[i].ip_param_name,
			    "ip_path_mtu_discovery")) {
			ip_mtudisc = &ip_param_arr[i].ip_param_value;
		}
#if SOLARIS2 < 8
		else if (!strcmp(ip_param_arr[i].ip_param_name,
			    "ip_forwarding")) {
			ip_forwarding = &ip_param_arr[i].ip_param_value;
		}
#else
		else if (!strcmp(ip_param_arr[i].ip_param_name,
			    "ip6_forwarding")) {
			ip6_forwarding = &ip_param_arr[i].ip_param_value;
		}
#endif

		if (ip_mtudisc != NULL && ip_ttl_ptr != NULL &&
#if SOLARIS2 >= 8
		    ip6_forwarding != NULL &&
#endif
		    ip_forwarding != NULL)
			break;
	}
#endif

	if (ifs->ifs_fr_control_forwarding & 1) {
		if (ip_forwarding != NULL)
			*ip_forwarding = 1;
#if SOLARIS2 >= 8
		if (ip6_forwarding != NULL)
			*ip6_forwarding = 1;
#endif
	}

#endif

	return 0;
hookup_failed:
	WRITE_ENTER(&ifs->ifs_ipf_global);
	return -1;
}

/* ------------------------------------------------------------------------ */
/*
 * Called whenever a nethook protocol is registered or unregistered.  Currently
 * only used to add or remove the hooks for viona.
 *
 * While the function signature requires returning int, nothing
 * in usr/src/uts/common/io/hook.c that invokes the callbacks
 * captures the return value (nor is there currently any documentation
 * on what return values should be).  For now at least, we'll return 0
 * on success (or 'not applicable') or an error value.  Even if the
 * nethook framework doesn't use the return address, it can be observed via
 * dtrace if needed.
 */
static int
ipf_hook_protocol_notify(hook_notify_cmd_t command, void *arg,
    const char *name, const char *dummy __unused, const char *he_name)
{
	ipf_stack_t *ifs = arg;
	hook_t **hookpp;
	char *hook_name, *hint_name;
	hook_func_t hookfn;
	boolean_t *hookedp;
	hook_hint_t hint;
	boolean_t out;
	int ret = 0;

	const boolean_t gz = ifs->ifs_gz_controlled;

	/* We currently only care about viona hooks notifications */
	if (strcmp(name, Hn_VIONA) != 0)
		return (0);

	if (strcmp(he_name, NH_PHYSICAL_IN) == 0) {
		out = B_FALSE;
	} else if (strcmp(he_name, NH_PHYSICAL_OUT) == 0) {
		out = B_TRUE;
	} else {
		/*
		 * If we've added more hook events to viona, we must add
		 * the corresponding handling here (even if it's just to
		 * ignore it) to prevent the firewall from not working as
		 * intended.
		 */
		cmn_err(CE_PANIC, "%s: unhandled hook event %s", __func__,
		    he_name);

		return (0);
	}

	if (out) {
		hookpp = &ifs->ifs_ipfhookviona_out;
		hookfn = ipf_hookviona_out;
		hookedp = &ifs->ifs_hookviona_physical_out;
		name = gz ? hook_viona_out_gz : hook_viona_out;
		hint = gz ? HH_AFTER : HH_BEFORE;
		hint_name = gz ? hook_viona_out : hook_viona_out_gz;
	} else {
		hookpp = &ifs->ifs_ipfhookviona_in;
		hookfn = ipf_hookviona_in;
		hookedp = &ifs->ifs_hookviona_physical_in;
		name = gz ? hook_viona_in_gz : hook_viona_in;
		hint = gz ? HH_BEFORE : HH_AFTER;
		hint_name = gz ? hook_viona_in : hook_viona_in_gz;
	}

	switch (command) {
	default:
	case HN_NONE:
		break;
	case HN_REGISTER:
		HOOK_INIT(*hookpp, hookfn, (char *)name, ifs);
		(*hookpp)->h_hint = hint;
		(*hookpp)->h_hintvalue = (uintptr_t)hint_name;
		ret = net_hook_register(ifs->ifs_ipf_viona,
		    (char *)he_name, *hookpp);
		if (ret != 0) {
			cmn_err(CE_NOTE, "%s: could not register hook "
			    "(hook family=%s hook=%s) err=%d", __func__,
			    name, he_name, ret);
			*hookedp = B_FALSE;
			return (ret);
		}
		*hookedp = B_TRUE;
		break;
	case HN_UNREGISTER:
		if (ifs->ifs_ipf_viona == NULL)
			break;

		ret = *hookedp ? net_hook_unregister(ifs->ifs_ipf_viona,
		    (char *)he_name, *hookpp) : 0;
		if ((ret == 0 || ret == ENXIO)) {
			if (*hookpp != NULL) {
				hook_free(*hookpp);
				*hookpp = NULL;
			}
			*hookedp = B_FALSE;
		}
		break;
	}

	return (ret);
}

/*
 * Called whenever a new nethook instance is created.  Currently only used
 * with the Hn_VIONA nethooks.  Similar to ipf_hook_protocol_notify, the out
 * function signature must return an int, though the result is never used.
 * We elect to return 0 on success (or not applicable) or a non-zero value
 * on error.
 */
static int
ipf_hook_instance_notify(hook_notify_cmd_t command, void *arg,
    const char *netid, const char *dummy __unused, const char *instance)
{
	ipf_stack_t *ifs = arg;
	int ret = 0;

	/* We currently only care about viona hooks */
	if (strcmp(instance, Hn_VIONA) != 0)
		return (0);

	switch (command) {
	case HN_NONE:
	default:
		return (0);
	case HN_REGISTER:
		ifs->ifs_ipf_viona = net_protocol_lookup(ifs->ifs_netid,
		    NHF_VIONA);

		if (ifs->ifs_ipf_viona == NULL)
			return (EPROTONOSUPPORT);

		ret = net_protocol_notify_register(ifs->ifs_ipf_viona,
		    ipf_hook_protocol_notify, ifs);
		VERIFY(ret == 0 || ret == ESHUTDOWN);
		break;
	case HN_UNREGISTER:
		if (ifs->ifs_ipf_viona == NULL)
			break;
		VERIFY0(net_protocol_notify_unregister(ifs->ifs_ipf_viona,
		    ipf_hook_protocol_notify));
		VERIFY0(net_protocol_release(ifs->ifs_ipf_viona));
		ifs->ifs_ipf_viona = NULL;
		break;
	}

	return (ret);
}

static	int	fr_setipfloopback(set, ifs)
int set;
ipf_stack_t *ifs;
{
	if (ifs->ifs_ipf_ipv4 == NULL || ifs->ifs_ipf_ipv6 == NULL)
		return EFAULT;

	if (set && !ifs->ifs_ipf_loopback) {
		ifs->ifs_ipf_loopback = 1;

		ifs->ifs_hook4_loopback_in = (net_hook_register(
		    ifs->ifs_ipf_ipv4, NH_LOOPBACK_IN,
		    ifs->ifs_ipfhook4_loop_in) == 0);
		if (!ifs->ifs_hook4_loopback_in)
			return EINVAL;

		ifs->ifs_hook4_loopback_out = (net_hook_register(
		    ifs->ifs_ipf_ipv4, NH_LOOPBACK_OUT,
		    ifs->ifs_ipfhook4_loop_out) == 0);
		if (!ifs->ifs_hook4_loopback_out)
			return EINVAL;

		ifs->ifs_hook6_loopback_in = (net_hook_register(
		    ifs->ifs_ipf_ipv6, NH_LOOPBACK_IN,
		    ifs->ifs_ipfhook6_loop_in) == 0);
		if (!ifs->ifs_hook6_loopback_in)
			return EINVAL;

		ifs->ifs_hook6_loopback_out = (net_hook_register(
		    ifs->ifs_ipf_ipv6, NH_LOOPBACK_OUT,
		    ifs->ifs_ipfhook6_loop_out) == 0);
		if (!ifs->ifs_hook6_loopback_out)
			return EINVAL;

	} else if (!set && ifs->ifs_ipf_loopback) {
		ifs->ifs_ipf_loopback = 0;

		ifs->ifs_hook4_loopback_in =
		    (net_hook_unregister(ifs->ifs_ipf_ipv4,
		    NH_LOOPBACK_IN, ifs->ifs_ipfhook4_loop_in) != 0);
		if (ifs->ifs_hook4_loopback_in)
			return EBUSY;

		ifs->ifs_hook4_loopback_out =
		    (net_hook_unregister(ifs->ifs_ipf_ipv4,
		    NH_LOOPBACK_OUT, ifs->ifs_ipfhook4_loop_out) != 0);
		if (ifs->ifs_hook4_loopback_out)
			return EBUSY;

		ifs->ifs_hook6_loopback_in =
		    (net_hook_unregister(ifs->ifs_ipf_ipv6,
		    NH_LOOPBACK_IN, ifs->ifs_ipfhook4_loop_in) != 0);
		if (ifs->ifs_hook6_loopback_in)
			return EBUSY;

		ifs->ifs_hook6_loopback_out =
		    (net_hook_unregister(ifs->ifs_ipf_ipv6,
		    NH_LOOPBACK_OUT, ifs->ifs_ipfhook6_loop_out) != 0);
		if (ifs->ifs_hook6_loopback_out)
			return EBUSY;
	}
	return 0;
}


/*
 * Filter ioctl interface.
 */
/*ARGSUSED*/
int iplioctl(dev, cmd, data, mode, cp, rp)
dev_t dev;
int cmd;
#if SOLARIS2 >= 7
intptr_t data;
#else
int *data;
#endif
int mode;
cred_t *cp;
int *rp;
{
	int error = 0, tmp;
	friostat_t fio;
	minor_t unit;
	u_int enable;
	ipf_stack_t *ifs;
	zoneid_t zid;
	ipf_devstate_t *isp;

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "iplioctl(%x,%x,%x,%d,%x,%d)\n",
		dev, cmd, data, mode, cp, rp);
#endif
	unit = getminor(dev);

	isp = ddi_get_soft_state(ipf_state, unit);
	if (isp == NULL)
		return ENXIO;
	unit = isp->ipfs_minor;

	zid = crgetzoneid(cp);
	if (cmd == SIOCIPFZONESET) {
		if (zid == GLOBAL_ZONEID)
			return fr_setzoneid(isp, (caddr_t) data);
		return EACCES;
	}

        /*
	 * ipf_find_stack returns with a read lock on ifs_ipf_global
	 */
	ifs = ipf_find_stack(zid, isp);
	if (ifs == NULL)
		return ENXIO;

	if (ifs->ifs_fr_running <= 0) {
		if (unit != IPL_LOGIPF) {
			RWLOCK_EXIT(&ifs->ifs_ipf_global);
			return EIO;
		}
		if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET &&
		    cmd != SIOCIPFSET && cmd != SIOCFRENB &&
		    cmd != SIOCGETFS && cmd != SIOCGETFF) {
			RWLOCK_EXIT(&ifs->ifs_ipf_global);
			return EIO;
		}
	}

	if (ifs->ifs_fr_enable_active != 0) {
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return EBUSY;
	}

	error = fr_ioctlswitch(unit, (caddr_t)data, cmd, mode, crgetuid(cp),
			       curproc, ifs);
	if (error != -1) {
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return error;
	}
	error = 0;

	switch (cmd)
	{
	case SIOCFRENB :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			error = COPYIN((caddr_t)data, (caddr_t)&enable,
				       sizeof(enable));
			if (error != 0) {
				error = EFAULT;
				break;
			}

			RWLOCK_EXIT(&ifs->ifs_ipf_global);
			WRITE_ENTER(&ifs->ifs_ipf_global);

			/*
			 * We must recheck fr_enable_active here, since we've
			 * dropped ifs_ipf_global from R in order to get it
			 * exclusively.
			 */
			if (ifs->ifs_fr_enable_active == 0) {
				ifs->ifs_fr_enable_active = 1;
				error = fr_enableipf(ifs, enable);
				ifs->ifs_fr_enable_active = 0;
			}
		}
		break;
	case SIOCIPFSET :
		if (!(mode & FWRITE)) {
			error = EPERM;
			break;
		}
		/* FALLTHRU */
	case SIOCIPFGETNEXT :
	case SIOCIPFGET :
		error = fr_ipftune(cmd, (void *)data, ifs);
		break;
	case SIOCSETFF :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			error = COPYIN((caddr_t)data,
				       (caddr_t)&ifs->ifs_fr_flags,
				       sizeof(ifs->ifs_fr_flags));
			if (error != 0)
				error = EFAULT;
		}
		break;
	case SIOCIPFLP :
		error = COPYIN((caddr_t)data, (caddr_t)&tmp,
			       sizeof(tmp));
		if (error != 0)
			error = EFAULT;
		else
			error = fr_setipfloopback(tmp, ifs);
		break;
	case SIOCGETFF :
		error = COPYOUT((caddr_t)&ifs->ifs_fr_flags, (caddr_t)data,
				sizeof(ifs->ifs_fr_flags));
		if (error != 0)
			error = EFAULT;
		break;
	case SIOCFUNCL :
		error = fr_resolvefunc((void *)data);
		break;
	case SIOCINAFR :
	case SIOCRMAFR :
	case SIOCADAFR :
	case SIOCZRLST :
		if (!(mode & FWRITE))
			error = EPERM;
		else
			error = frrequest(unit, cmd, (caddr_t)data,
					  ifs->ifs_fr_active, 1, ifs);
		break;
	case SIOCINIFR :
	case SIOCRMIFR :
	case SIOCADIFR :
		if (!(mode & FWRITE))
			error = EPERM;
		else
			error = frrequest(unit, cmd, (caddr_t)data,
					  1 - ifs->ifs_fr_active, 1, ifs);
		break;
	case SIOCSWAPA :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			WRITE_ENTER(&ifs->ifs_ipf_mutex);
			bzero((char *)ifs->ifs_frcache,
			    sizeof (ifs->ifs_frcache));
			error = COPYOUT((caddr_t)&ifs->ifs_fr_active,
					(caddr_t)data,
					sizeof(ifs->ifs_fr_active));
			if (error != 0)
				error = EFAULT;
			else
				ifs->ifs_fr_active = 1 - ifs->ifs_fr_active;
			RWLOCK_EXIT(&ifs->ifs_ipf_mutex);
		}
		break;
	case SIOCGETFS :
		fr_getstat(&fio, ifs);
		error = fr_outobj((void *)data, &fio, IPFOBJ_IPFSTAT);
		break;
	case SIOCFRZST :
		if (!(mode & FWRITE))
			error = EPERM;
		else
			error = fr_zerostats((caddr_t)data, ifs);
		break;
	case	SIOCIPFFL :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			error = COPYIN((caddr_t)data, (caddr_t)&tmp,
				       sizeof(tmp));
			if (!error) {
				tmp = frflush(unit, 4, tmp, ifs);
				error = COPYOUT((caddr_t)&tmp, (caddr_t)data,
						sizeof(tmp));
				if (error != 0)
					error = EFAULT;
			} else
				error = EFAULT;
		}
		break;
#ifdef USE_INET6
	case	SIOCIPFL6 :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			error = COPYIN((caddr_t)data, (caddr_t)&tmp,
				       sizeof(tmp));
			if (!error) {
				tmp = frflush(unit, 6, tmp, ifs);
				error = COPYOUT((caddr_t)&tmp, (caddr_t)data,
						sizeof(tmp));
				if (error != 0)
					error = EFAULT;
			} else
				error = EFAULT;
		}
		break;
#endif
	case SIOCSTLCK :
		error = COPYIN((caddr_t)data, (caddr_t)&tmp, sizeof(tmp));
		if (error == 0) {
			ifs->ifs_fr_state_lock = tmp;
			ifs->ifs_fr_nat_lock = tmp;
			ifs->ifs_fr_frag_lock = tmp;
			ifs->ifs_fr_auth_lock = tmp;
		} else
			error = EFAULT;
	break;
#ifdef	IPFILTER_LOG
	case	SIOCIPFFB :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			tmp = ipflog_clear(unit, ifs);
			error = COPYOUT((caddr_t)&tmp, (caddr_t)data,
				       sizeof(tmp));
			if (error)
				error = EFAULT;
		}
		break;
#endif /* IPFILTER_LOG */
	case SIOCFRSYN :
		if (!(mode & FWRITE))
			error = EPERM;
		else {
			RWLOCK_EXIT(&ifs->ifs_ipf_global);
			WRITE_ENTER(&ifs->ifs_ipf_global);

			frsync(IPFSYNC_RESYNC, 0, NULL, NULL, ifs);
			fr_natifpsync(IPFSYNC_RESYNC, 0, NULL, NULL, ifs);
			fr_nataddrsync(0, NULL, NULL, ifs);
			fr_statesync(IPFSYNC_RESYNC, 0, NULL, NULL, ifs);
			error = 0;
		}
		break;
	case SIOCGFRST :
		error = fr_outobj((void *)data, fr_fragstats(ifs),
				  IPFOBJ_FRAGSTAT);
		break;
	case FIONREAD :
#ifdef	IPFILTER_LOG
		tmp = (int)ifs->ifs_iplused[IPL_LOGIPF];

		error = COPYOUT((caddr_t)&tmp, (caddr_t)data, sizeof(tmp));
		if (error != 0)
			error = EFAULT;
#endif
		break;
	case SIOCIPFITER :
		error = ipf_frruleiter((caddr_t)data, crgetuid(cp),
				       curproc, ifs);
		break;

	case SIOCGENITER :
		error = ipf_genericiter((caddr_t)data, crgetuid(cp),
					curproc, ifs);
		break;

	case SIOCIPFDELTOK :
		error = BCOPYIN((caddr_t)data, (caddr_t)&tmp, sizeof(tmp));
		if (error != 0) {
			error = EFAULT;
		} else {
			error = ipf_deltoken(tmp, crgetuid(cp), curproc, ifs);
		}
		break;

	default :
#ifdef	IPFDEBUG
		cmn_err(CE_NOTE, "Unknown: cmd 0x%x data %p",
			cmd, (void *)data);
#endif
		error = EINVAL;
		break;
	}
	RWLOCK_EXIT(&ifs->ifs_ipf_global);
	return error;
}


static int fr_enableipf(ifs, enable)
ipf_stack_t *ifs;
int enable;
{
	int error;

	if (!enable) {
		error = ipldetach(ifs);
		if (error == 0)
			ifs->ifs_fr_running = -1;
		return error;
	}

	if (ifs->ifs_fr_running > 0)
		return 0;

	error = iplattach(ifs);
	if (error == 0) {
		if (ifs->ifs_fr_timer_id == NULL) {
			int hz = drv_usectohz(500000);

			ifs->ifs_fr_timer_id = timeout(fr_slowtimer,
						       (void *)ifs,
						       hz);
		}
		ifs->ifs_fr_running = 1;
	} else {
		(void) ipldetach(ifs);
	}
	return error;
}


phy_if_t get_unit(name, v, ifs)
char *name;
int v;
ipf_stack_t *ifs;
{
	net_handle_t nif;
 
  	if (v == 4)
 		nif = ifs->ifs_ipf_ipv4;
  	else if (v == 6)
 		nif = ifs->ifs_ipf_ipv6;
  	else
 		return 0;

 	return (net_phylookup(nif, name));
}

/*
 * routines below for saving IP headers to buffer
 */
/*ARGSUSED*/
int iplopen(devp, flags, otype, cred)
dev_t *devp;
int flags, otype;
cred_t *cred;
{
	ipf_devstate_t *isp;
	minor_t min = getminor(*devp);
	minor_t minor;

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "iplopen(%x,%x,%x,%x)\n", devp, flags, otype, cred);
#endif
	if (!(otype & OTYP_CHR))
		return ENXIO;

	if (IPL_LOGMAX < min)
		return ENXIO;

	minor = (minor_t)(uintptr_t)vmem_alloc(ipf_minor, 1,
	    VM_BESTFIT | VM_SLEEP);

	if (ddi_soft_state_zalloc(ipf_state, minor) != 0) {
		vmem_free(ipf_minor, (void *)(uintptr_t)minor, 1);
		return ENXIO;
	}

	*devp = makedevice(getmajor(*devp), minor);
	isp = ddi_get_soft_state(ipf_state, minor);
	VERIFY(isp != NULL);

	isp->ipfs_minor = min;
	isp->ipfs_zoneid = IPFS_ZONE_UNSET;

	return 0;
}


/*ARGSUSED*/
int iplclose(dev, flags, otype, cred)
dev_t dev;
int flags, otype;
cred_t *cred;
{
	minor_t	min = getminor(dev);

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "iplclose(%x,%x,%x,%x)\n", dev, flags, otype, cred);
#endif

	if (IPL_LOGMAX < min)
		return ENXIO;

	ddi_soft_state_free(ipf_state, min);
	vmem_free(ipf_minor, (void *)(uintptr_t)min, 1);

	return 0;
}

#ifdef	IPFILTER_LOG
/*
 * iplread/ipllog
 * both of these must operate with at least splnet() lest they be
 * called during packet processing and cause an inconsistancy to appear in
 * the filter lists.
 */
/*ARGSUSED*/
int iplread(dev, uio, cp)
dev_t dev;
register struct uio *uio;
cred_t *cp;
{
	ipf_stack_t *ifs;
	int ret;
	minor_t unit;
	ipf_devstate_t *isp;

	unit = getminor(dev);
	isp = ddi_get_soft_state(ipf_state, unit);
	if (isp == NULL)
		return ENXIO;
	unit = isp->ipfs_minor;


        /*
	 * ipf_find_stack returns with a read lock on ifs_ipf_global
	 */
	ifs = ipf_find_stack(crgetzoneid(cp), isp);
	if (ifs == NULL)
		return ENXIO;

# ifdef	IPFDEBUG
	cmn_err(CE_CONT, "iplread(%x,%x,%x)\n", dev, uio, cp);
# endif

	if (ifs->ifs_fr_running < 1) {
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return EIO;
	}

# ifdef	IPFILTER_SYNC
	if (unit == IPL_LOGSYNC) {
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return ipfsync_read(uio);
	}
# endif

	ret = ipflog_read(unit, uio, ifs);
	RWLOCK_EXIT(&ifs->ifs_ipf_global);
	return ret;
}
#endif /* IPFILTER_LOG */


/*
 * iplread/ipllog
 * both of these must operate with at least splnet() lest they be
 * called during packet processing and cause an inconsistancy to appear in
 * the filter lists.
 */
int iplwrite(dev, uio, cp)
dev_t dev;
register struct uio *uio;
cred_t *cp;
{
	ipf_stack_t *ifs;
	minor_t unit;
	ipf_devstate_t *isp;

	unit = getminor(dev);
	isp = ddi_get_soft_state(ipf_state, unit);
	if (isp == NULL)
		return ENXIO;
	unit = isp->ipfs_minor;

        /*
	 * ipf_find_stack returns with a read lock on ifs_ipf_global
	 */
	ifs = ipf_find_stack(crgetzoneid(cp), isp);
	if (ifs == NULL)
		return ENXIO;

#ifdef	IPFDEBUG
	cmn_err(CE_CONT, "iplwrite(%x,%x,%x)\n", dev, uio, cp);
#endif

	if (ifs->ifs_fr_running < 1) {
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return EIO;
	}

#ifdef	IPFILTER_SYNC
	if (getminor(dev) == IPL_LOGSYNC) {
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return ipfsync_write(uio);
	}
#endif /* IPFILTER_SYNC */
	dev = dev;	/* LINT */
	uio = uio;	/* LINT */
	cp = cp;	/* LINT */
	RWLOCK_EXIT(&ifs->ifs_ipf_global);
	return ENXIO;
}


/*
 * fr_send_reset - this could conceivably be a call to tcp_respond(), but that
 * requires a large amount of setting up and isn't any more efficient.
 */
int fr_send_reset(fin)
fr_info_t *fin;
{
	tcphdr_t *tcp, *tcp2;
	int tlen, hlen;
	mblk_t *m;
#ifdef	USE_INET6
	ip6_t *ip6;
#endif
	ip_t *ip;

	tcp = fin->fin_dp;
	if (tcp->th_flags & TH_RST)
		return -1;

#ifndef	IPFILTER_CKSUM
	if (fr_checkl4sum(fin) == -1)
		return -1;
#endif

	tlen = (tcp->th_flags & (TH_SYN|TH_FIN)) ? 1 : 0;
#ifdef	USE_INET6
	if (fin->fin_v == 6)
		hlen = sizeof(ip6_t);
	else
#endif
		hlen = sizeof(ip_t);
	hlen += sizeof(*tcp2);
	if ((m = (mblk_t *)allocb(hlen + 64, BPRI_HI)) == NULL)
		return -1;

	m->b_rptr += 64;
	MTYPE(m) = M_DATA;
	m->b_wptr = m->b_rptr + hlen;
	ip = (ip_t *)m->b_rptr;
	bzero((char *)ip, hlen);
	tcp2 = (struct tcphdr *)(m->b_rptr + hlen - sizeof(*tcp2));
	tcp2->th_dport = tcp->th_sport;
	tcp2->th_sport = tcp->th_dport;
	if (tcp->th_flags & TH_ACK) {
		tcp2->th_seq = tcp->th_ack;
		tcp2->th_flags = TH_RST;
	} else {
		tcp2->th_ack = ntohl(tcp->th_seq);
		tcp2->th_ack += tlen;
		tcp2->th_ack = htonl(tcp2->th_ack);
		tcp2->th_flags = TH_RST|TH_ACK;
	}
	tcp2->th_off = sizeof(struct tcphdr) >> 2;

	ip->ip_v = fin->fin_v;
#ifdef	USE_INET6
	if (fin->fin_v == 6) {
		ip6 = (ip6_t *)m->b_rptr;
		ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
		ip6->ip6_src = fin->fin_dst6.in6;
		ip6->ip6_dst = fin->fin_src6.in6;
		ip6->ip6_plen = htons(sizeof(*tcp));
		ip6->ip6_nxt = IPPROTO_TCP;
		tcp2->th_sum = fr_cksum(m, (ip_t *)ip6, IPPROTO_TCP, tcp2);
	} else
#endif
	{
		ip->ip_src.s_addr = fin->fin_daddr;
		ip->ip_dst.s_addr = fin->fin_saddr;
		ip->ip_id = fr_nextipid(fin);
		ip->ip_hl = sizeof(*ip) >> 2;
		ip->ip_p = IPPROTO_TCP;
		ip->ip_len = sizeof(*ip) + sizeof(*tcp);
		ip->ip_tos = fin->fin_ip->ip_tos;
		tcp2->th_sum = fr_cksum(m, ip, IPPROTO_TCP, tcp2);
	}
	return fr_send_ip(fin, m, &m);
}

/*
 * Function:	fr_send_ip
 * Returns:	 0: success
 *		-1: failed
 * Parameters:
 *	fin: packet information
 *	m: the message block where ip head starts
 *
 * Send a new packet through the IP stack. 
 *
 * For IPv4 packets, ip_len must be in host byte order, and ip_v,
 * ip_ttl, ip_off, and ip_sum are ignored (filled in by this
 * function).
 *
 * For IPv6 packets, ip6_flow, ip6_vfc, and ip6_hlim are filled
 * in by this function.
 *
 * All other portions of the packet must be in on-the-wire format.
 */
/*ARGSUSED*/
static int fr_send_ip(fin, m, mpp)
fr_info_t *fin;
mblk_t *m, **mpp;
{
	qpktinfo_t qpi, *qpip;
	fr_info_t fnew;
	ip_t *ip;
	int i, hlen;
	ipf_stack_t *ifs = fin->fin_ifs;

	ip = (ip_t *)m->b_rptr;
	bzero((char *)&fnew, sizeof(fnew));

#ifdef	USE_INET6
	if (fin->fin_v == 6) {
		ip6_t *ip6;

		ip6 = (ip6_t *)ip;
		ip6->ip6_vfc = 0x60;
		ip6->ip6_hlim = 127;
		fnew.fin_v = 6;
		hlen = sizeof(*ip6);
		fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen;
	} else
#endif
	{
		fnew.fin_v = 4;
#if SOLARIS2 >= 10
		ip->ip_ttl = 255;
		if (net_getpmtuenabled(ifs->ifs_ipf_ipv4) == 1)
			ip->ip_off = htons(IP_DF);
#else
		if (ip_ttl_ptr != NULL)
			ip->ip_ttl = (u_char)(*ip_ttl_ptr);
		else
			ip->ip_ttl = 63;
		if (ip_mtudisc != NULL)
			ip->ip_off = htons(*ip_mtudisc ? IP_DF : 0);
		else
			ip->ip_off = htons(IP_DF);
#endif
		/*
		 * The dance with byte order and ip_len/ip_off is because in
		 * fr_fastroute, it expects them to be in host byte order but
		 * ipf_cksum expects them to be in network byte order.
		 */
		ip->ip_len = htons(ip->ip_len);
		ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
		ip->ip_len = ntohs(ip->ip_len);
		ip->ip_off = ntohs(ip->ip_off);
		hlen = sizeof(*ip);
		fnew.fin_plen = ip->ip_len;
	}

	qpip = fin->fin_qpi;
	qpi.qpi_off = 0;
	qpi.qpi_ill = qpip->qpi_ill;
	qpi.qpi_m = m;
	qpi.qpi_data = ip;
	fnew.fin_qpi = &qpi;
	fnew.fin_ifp = fin->fin_ifp;
	fnew.fin_flx = FI_NOCKSUM | FI_GENERATED;
	fnew.fin_m = m;
	fnew.fin_qfm = m;
	fnew.fin_ip = ip;
	fnew.fin_mp = mpp;
	fnew.fin_hlen = hlen;
	fnew.fin_dp = (char *)ip + hlen;
	fnew.fin_ifs = fin->fin_ifs;
	(void) fr_makefrip(hlen, ip, &fnew);

	i = fr_fastroute(m, mpp, &fnew, NULL);
	return i;
}


int fr_send_icmp_err(type, fin, dst)
int type;
fr_info_t *fin;
int dst;
{
	struct in_addr dst4;
	struct icmp *icmp;
	qpktinfo_t *qpi;
	int hlen, code;
	phy_if_t phy;
	u_short sz;
#ifdef	USE_INET6
	mblk_t *mb;
#endif
	mblk_t *m;
#ifdef	USE_INET6
	ip6_t *ip6;
#endif
	ip_t *ip;
	ipf_stack_t *ifs = fin->fin_ifs;

	if ((type < 0) || (type > ICMP_MAXTYPE))
		return -1;

	code = fin->fin_icode;
#ifdef USE_INET6
	if ((code < 0) || (code >= ICMP_MAX_UNREACH))
		return -1;
#endif

#ifndef	IPFILTER_CKSUM
	if (fr_checkl4sum(fin) == -1)
		return -1;
#endif

	qpi = fin->fin_qpi;

#ifdef	USE_INET6
	mb = fin->fin_qfm;

	if (fin->fin_v == 6) {
		sz = sizeof(ip6_t);
		sz += MIN(mb->b_wptr - mb->b_rptr, 512);
		hlen = sizeof(ip6_t);
		type = icmptoicmp6types[type];
		if (type == ICMP6_DST_UNREACH)
			code = icmptoicmp6unreach[code];
	} else
#endif
	{
		if ((fin->fin_p == IPPROTO_ICMP) &&
		    !(fin->fin_flx & FI_SHORT))
			switch (ntohs(fin->fin_data[0]) >> 8)
			{
			case ICMP_ECHO :
			case ICMP_TSTAMP :
			case ICMP_IREQ :
			case ICMP_MASKREQ :
				break;
			default :
				return 0;
			}

		sz = sizeof(ip_t) * 2;
		sz += 8;		/* 64 bits of data */
		hlen = sizeof(ip_t);
	}

	sz += offsetof(struct icmp, icmp_ip);
	if ((m = (mblk_t *)allocb((size_t)sz + 64, BPRI_HI)) == NULL)
		return -1;
	MTYPE(m) = M_DATA;
	m->b_rptr += 64;
	m->b_wptr = m->b_rptr + sz;
	bzero((char *)m->b_rptr, (size_t)sz);
	ip = (ip_t *)m->b_rptr;
	ip->ip_v = fin->fin_v;
	icmp = (struct icmp *)(m->b_rptr + hlen);
	icmp->icmp_type = type & 0xff;
	icmp->icmp_code = code & 0xff;
	phy = (phy_if_t)qpi->qpi_ill; 
	if (type == ICMP_UNREACH && (phy != 0) && 
	    fin->fin_icode == ICMP_UNREACH_NEEDFRAG)
		icmp->icmp_nextmtu = net_getmtu(ifs->ifs_ipf_ipv4, phy,0 );

#ifdef	USE_INET6
	if (fin->fin_v == 6) {
		struct in6_addr dst6;
		int csz;

		if (dst == 0) {
			ipf_stack_t *ifs = fin->fin_ifs;

			if (fr_ifpaddr(6, FRI_NORMAL, (void *)phy,
				       (void *)&dst6, NULL, ifs) == -1) {
				FREE_MB_T(m);
				return -1;
			}
		} else
			dst6 = fin->fin_dst6.in6;

		csz = sz;
		sz -= sizeof(ip6_t);
		ip6 = (ip6_t *)m->b_rptr;
		ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
		ip6->ip6_plen = htons((u_short)sz);
		ip6->ip6_nxt = IPPROTO_ICMPV6;
		ip6->ip6_src = dst6;
		ip6->ip6_dst = fin->fin_src6.in6;
		sz -= offsetof(struct icmp, icmp_ip);
		bcopy((char *)mb->b_rptr, (char *)&icmp->icmp_ip, sz);
		icmp->icmp_cksum = csz - sizeof(ip6_t);
	} else
#endif
	{
		ip->ip_hl = sizeof(*ip) >> 2;
		ip->ip_p = IPPROTO_ICMP;
		ip->ip_id = fin->fin_ip->ip_id;
		ip->ip_tos = fin->fin_ip->ip_tos;
		ip->ip_len = (u_short)sz;
		if (dst == 0) {
			ipf_stack_t *ifs = fin->fin_ifs;

			if (fr_ifpaddr(4, FRI_NORMAL, (void *)phy,
				       (void *)&dst4, NULL, ifs) == -1) {
				FREE_MB_T(m);
				return -1;
			}
		} else {
			dst4 = fin->fin_dst;
		}
		ip->ip_src = dst4;
		ip->ip_dst = fin->fin_src;
		bcopy((char *)fin->fin_ip, (char *)&icmp->icmp_ip,
		      sizeof(*fin->fin_ip));
		bcopy((char *)fin->fin_ip + fin->fin_hlen,
		      (char *)&icmp->icmp_ip + sizeof(*fin->fin_ip), 8);
		icmp->icmp_ip.ip_len = htons(icmp->icmp_ip.ip_len);
		icmp->icmp_ip.ip_off = htons(icmp->icmp_ip.ip_off);
		icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
					     sz - sizeof(ip_t));
	}

	/*
	 * Need to exit out of these so we don't recursively call rw_enter
	 * from fr_qout.
	 */
	return fr_send_ip(fin, m, &m);
}

#include <sys/time.h>
#include <sys/varargs.h>

#ifndef _KERNEL
#include <stdio.h>
#endif

/*
 * Return the first IP Address associated with an interface
 * For IPv6, we walk through the list of logical interfaces and return
 * the address of the first one that isn't a link-local interface.
 * We can't assume that it is :1 because another link-local address
 * may have been assigned there.
 */
/*ARGSUSED*/
int fr_ifpaddr(v, atype, ifptr, inp, inpmask, ifs)
int v, atype;
void *ifptr;
struct in_addr  *inp, *inpmask;
ipf_stack_t *ifs;
{
	struct sockaddr_in6 v6addr[2];
	struct sockaddr_in v4addr[2];
	net_ifaddr_t type[2];
	net_handle_t net_data;
	phy_if_t phyif;
	void *array;

	switch (v)
	{
	case 4:
		net_data = ifs->ifs_ipf_ipv4;
		array = v4addr;
		break;
	case 6:
		net_data = ifs->ifs_ipf_ipv6;
		array = v6addr;
		break;
	default:
		net_data = NULL;
		break;
	}

	if (net_data == NULL)
		return -1;

	phyif = (phy_if_t)ifptr;

	switch (atype)
	{
	case FRI_PEERADDR :
		type[0] = NA_PEER;
		break;

	case FRI_BROADCAST :
		type[0] = NA_BROADCAST;
		break;

	default :
		type[0] = NA_ADDRESS;
		break;
	}

	type[1] = NA_NETMASK;

	if (v == 6) {
		lif_if_t idx = 0;

		do {
			idx = net_lifgetnext(net_data, phyif, idx);
			if (net_getlifaddr(net_data, phyif, idx, 2, type,
					   array) < 0)
				return -1;
			if (!IN6_IS_ADDR_LINKLOCAL(&v6addr[0].sin6_addr) &&
			    !IN6_IS_ADDR_MULTICAST(&v6addr[0].sin6_addr))
				break;
		} while (idx != 0);

		if (idx == 0)
			return -1;

		return fr_ifpfillv6addr(atype, &v6addr[0], &v6addr[1],
					inp, inpmask);
	}

	if (net_getlifaddr(net_data, phyif, 0, 2, type, array) < 0)
		return -1;

	return fr_ifpfillv4addr(atype, &v4addr[0], &v4addr[1], inp, inpmask);
}


u_32_t fr_newisn(fin)
fr_info_t *fin;
{
	static int iss_seq_off = 0;
	u_char hash[16];
	u_32_t newiss;
	MD5_CTX ctx;
	ipf_stack_t *ifs = fin->fin_ifs;

	/*
	 * Compute the base value of the ISS.  It is a hash
	 * of (saddr, sport, daddr, dport, secret).
	 */
	MD5Init(&ctx);

	MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src,
		  sizeof(fin->fin_fi.fi_src));
	MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst,
		  sizeof(fin->fin_fi.fi_dst));
	MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat));

	MD5Update(&ctx, ifs->ifs_ipf_iss_secret, sizeof(ifs->ifs_ipf_iss_secret));

	MD5Final(hash, &ctx);

	bcopy(hash, &newiss, sizeof(newiss));

	/*
	 * Now increment our "timer", and add it in to
	 * the computed value.
	 *
	 * XXX Use `addin'?
	 * XXX TCP_ISSINCR too large to use?
	 */
	iss_seq_off += 0x00010000;
	newiss += iss_seq_off;
	return newiss;
}


/* ------------------------------------------------------------------------ */
/* Function:    fr_nextipid                                                 */
/* Returns:     int - 0 == success, -1 == error (packet should be droppped) */
/* Parameters:  fin(I) - pointer to packet information                      */
/*                                                                          */
/* Returns the next IPv4 ID to use for this packet.                         */
/* ------------------------------------------------------------------------ */
u_short fr_nextipid(fin)
fr_info_t *fin;
{
	static u_short ipid = 0;
	u_short id;
	ipf_stack_t *ifs = fin->fin_ifs;

	MUTEX_ENTER(&ifs->ifs_ipf_rw);
	if (fin->fin_pktnum != 0) {
		id = fin->fin_pktnum & 0xffff;
	} else {
		id = ipid++;
	}
	MUTEX_EXIT(&ifs->ifs_ipf_rw);

	return id;
}


#ifndef IPFILTER_CKSUM
/* ARGSUSED */
#endif
INLINE void fr_checkv4sum(fin)
fr_info_t *fin;
{
#ifdef IPFILTER_CKSUM
	if (fr_checkl4sum(fin) == -1)
		fin->fin_flx |= FI_BAD;
#endif
}


#ifdef USE_INET6
# ifndef IPFILTER_CKSUM
/* ARGSUSED */
# endif
INLINE void fr_checkv6sum(fin)
fr_info_t *fin;
{
# ifdef IPFILTER_CKSUM
	if (fr_checkl4sum(fin) == -1)
		fin->fin_flx |= FI_BAD;
# endif
}
#endif /* USE_INET6 */


#if (SOLARIS2 < 7)
void fr_slowtimer()
#else
/*ARGSUSED*/
void fr_slowtimer __P((void *arg))
#endif
{
	ipf_stack_t *ifs = arg;

	READ_ENTER(&ifs->ifs_ipf_global);
	if (ifs->ifs_fr_running != 1) {
		ifs->ifs_fr_timer_id = NULL;
		RWLOCK_EXIT(&ifs->ifs_ipf_global);
		return;
	}
	ipf_expiretokens(ifs);
	fr_fragexpire(ifs);
	fr_timeoutstate(ifs);
	fr_natexpire(ifs);
	fr_authexpire(ifs);
	ifs->ifs_fr_ticks++;
	if (ifs->ifs_fr_running == 1)
		ifs->ifs_fr_timer_id = timeout(fr_slowtimer, arg,
		    drv_usectohz(500000));
	else
		ifs->ifs_fr_timer_id = NULL;
	RWLOCK_EXIT(&ifs->ifs_ipf_global);
}


/* ------------------------------------------------------------------------ */
/* Function:    fr_pullup                                                   */
/* Returns:     NULL == pullup failed, else pointer to protocol header      */
/* Parameters:  m(I)   - pointer to buffer where data packet starts         */
/*              fin(I) - pointer to packet information                      */
/*              len(I) - number of bytes to pullup                          */
/*                                                                          */
/* Attempt to move at least len bytes (from the start of the buffer) into a */
/* single buffer for ease of access.  Operating system native functions are */
/* used to manage buffers - if necessary.  If the entire packet ends up in  */
/* a single buffer, set the FI_COALESCE flag even though fr_coalesce() has  */
/* not been called.  Both fin_ip and fin_dp are updated before exiting _IF_ */
/* and ONLY if the pullup succeeds.                                         */
/*                                                                          */
/* We assume that 'min' is a pointer to a buffer that is part of the chain  */
/* of buffers that starts at *fin->fin_mp.                                  */
/* ------------------------------------------------------------------------ */
void *fr_pullup(min, fin, len)
mb_t *min;
fr_info_t *fin;
int len;
{
	qpktinfo_t *qpi = fin->fin_qpi;
	int out = fin->fin_out, dpoff, ipoff;
	mb_t *m = min, *m1, *m2;
	char *ip;
	uint32_t start, stuff, end, value, flags;
	ipf_stack_t *ifs = fin->fin_ifs;

	if (m == NULL)
		return NULL;

	ip = (char *)fin->fin_ip;
	if ((fin->fin_flx & FI_COALESCE) != 0)
		return ip;

	ipoff = fin->fin_ipoff;
	if (fin->fin_dp != NULL)
		dpoff = (char *)fin->fin_dp - (char *)ip;
	else
		dpoff = 0;

	if (M_LEN(m) < len + ipoff) {

		/*
		 * pfil_precheck ensures the IP header is on a 32bit
		 * aligned address so simply fail if that isn't currently
		 * the case (should never happen).
		 */
		int inc = 0;

		if (ipoff > 0) {
			if ((ipoff & 3) != 0) {
				inc = 4 - (ipoff & 3);
				if (m->b_rptr - inc >= m->b_datap->db_base)
					m->b_rptr -= inc;
				else
					inc = 0;
			}
		}

		/*
		 * XXX This is here as a work around for a bug with DEBUG
		 * XXX Solaris kernels.  The problem is b_prev is used by IP
		 * XXX code as a way to stash the phyint_index for a packet,
		 * XXX this doesn't get reset by IP but freeb does an ASSERT()
		 * XXX for both of these to be NULL.  See 6442390.
		 */
		m1 = m;
		m2 = m->b_prev;

		do {
			m1->b_next = NULL;
			m1->b_prev = NULL;
			m1 = m1->b_cont;
		} while (m1);

		/*
		 * Need to preserve checksum information by copying them
		 * to newmp which heads the pulluped message.
		 */
		mac_hcksum_get(m, &start, &stuff, &end, &value, &flags);

		if (pullupmsg(m, len + ipoff + inc) == 0) {
			ATOMIC_INCL(ifs->ifs_frstats[out].fr_pull[1]);
			FREE_MB_T(*fin->fin_mp);
			*fin->fin_mp = NULL;
			fin->fin_m = NULL;
			fin->fin_ip = NULL;
			fin->fin_dp = NULL;
			qpi->qpi_data = NULL;
			return NULL;
		}

		mac_hcksum_set(m, start, stuff, end, value, flags);

		m->b_prev = m2;
		m->b_rptr += inc;
		fin->fin_m = m;
		ip = MTOD(m, char *) + ipoff;
		qpi->qpi_data = ip;
	}

	ATOMIC_INCL(ifs->ifs_frstats[out].fr_pull[0]);
	fin->fin_ip = (ip_t *)ip;
	if (fin->fin_dp != NULL)
		fin->fin_dp = (char *)fin->fin_ip + dpoff;

	if (len == fin->fin_plen)
		fin->fin_flx |= FI_COALESCE;
	return ip;
}


/*
 * Function:	fr_verifysrc
 * Returns:	int (really boolean)
 * Parameters:	fin - packet information
 *
 * Check whether the packet has a valid source address for the interface on
 * which the packet arrived, implementing the "fr_chksrc" feature.
 * Returns true iff the packet's source address is valid.
 */
int fr_verifysrc(fin)
fr_info_t *fin;
{
	net_handle_t net_data_p;
	phy_if_t phy_ifdata_routeto;
	struct sockaddr	sin;
	ipf_stack_t *ifs = fin->fin_ifs;

	if (fin->fin_v == 4) { 
		net_data_p = ifs->ifs_ipf_ipv4;
	} else if (fin->fin_v == 6) { 
		net_data_p = ifs->ifs_ipf_ipv6;
	} else { 
		return (0); 
	}

	/* Get the index corresponding to the if name */
	sin.sa_family = (fin->fin_v == 4) ? AF_INET : AF_INET6;
	bcopy(&fin->fin_saddr, &sin.sa_data, sizeof (struct in_addr));
	phy_ifdata_routeto = net_routeto(net_data_p, &sin, NULL);

	return (((phy_if_t)fin->fin_ifp == phy_ifdata_routeto) ? 1 : 0); 
}

/*
 * Return true only if forwarding is enabled on the interface.
 */
static int
fr_forwarding_enabled(phy_if_t phyif, net_handle_t ndp)
{
	lif_if_t lif;

	for (lif = net_lifgetnext(ndp, phyif, 0); lif > 0;
	    lif = net_lifgetnext(ndp, phyif, lif)) {
		int res;
		uint64_t flags;

		res = net_getlifflags(ndp, phyif, lif, &flags);
		if (res != 0)
			return (0);
		if (flags & IFF_ROUTER)
			return (1);
	}

	return (0);
}

/*
 * Function:	fr_fastroute
 * Returns:	 0: success;
 *		-1: failed
 * Parameters:
 *	mb: the message block where ip head starts
 *	mpp: the pointer to the pointer of the orignal
 *		packet message
 *	fin: packet information
 *	fdp: destination interface information
 *	if it is NULL, no interface information provided.
 *
 * This function is for fastroute/to/dup-to rules. It calls
 * pfil_make_lay2_packet to search route, make lay-2 header
 * ,and identify output queue for the IP packet.
 * The destination address depends on the following conditions:
 * 1: for fastroute rule, fdp is passed in as NULL, so the
 *	destination address is the IP Packet's destination address
 * 2: for to/dup-to rule, if an ip address is specified after
 *	the interface name, this address is the as destination
 *	address. Otherwise IP Packet's destination address is used
 */
int fr_fastroute(mb, mpp, fin, fdp)
mblk_t *mb, **mpp;
fr_info_t *fin;
frdest_t *fdp;
{
        net_handle_t net_data_p;
	net_inject_t *inj;
	mblk_t *mp = NULL;
	frentry_t *fr = fin->fin_fr;
	qpktinfo_t *qpi;
	ip_t *ip;

	struct sockaddr_in *sin;
	struct sockaddr_in6 *sin6;
	struct sockaddr *sinp;
	ipf_stack_t *ifs = fin->fin_ifs;
#ifndef	sparc
	u_short __iplen, __ipoff;
#endif

	if (fin->fin_v == 4) {
		net_data_p = ifs->ifs_ipf_ipv4;
	} else if (fin->fin_v == 6) {
		net_data_p = ifs->ifs_ipf_ipv6;
	} else {
		return (-1);
	}

	/* Check the src here, fin_ifp is the src interface. */
	if (!(fin->fin_flx & FI_GENERATED) &&
	    !fr_forwarding_enabled((phy_if_t)fin->fin_ifp, net_data_p)) {
		return (-1);
	}

	inj = net_inject_alloc(NETINFO_VERSION);
	if (inj == NULL)
		return -1;

	ip = fin->fin_ip;
	qpi = fin->fin_qpi;

	/*
	 * If this is a duplicate mblk then we want ip to point at that
	 * data, not the original, if and only if it is already pointing at
	 * the current mblk data.
	 *
	 * Otherwise, if it's not a duplicate, and we're not already pointing
	 * at the current mblk data, then we want to ensure that the data
	 * points at ip.
	 */

	if ((ip == (ip_t *)qpi->qpi_m->b_rptr) && (qpi->qpi_m != mb)) {
		ip = (ip_t *)mb->b_rptr;
	} else if ((qpi->qpi_m == mb) && (ip != (ip_t *)qpi->qpi_m->b_rptr)) {
		qpi->qpi_m->b_rptr = (uchar_t *)ip;
		qpi->qpi_off = 0;
	}

	/*
	 * If there is another M_PROTO, we don't want it
	 */
	if (*mpp != mb) {
		mp = unlinkb(*mpp);
		freeb(*mpp);
		*mpp = mp;
	}

	sinp = (struct sockaddr *)&inj->ni_addr;
	sin = (struct sockaddr_in *)sinp;
	sin6 = (struct sockaddr_in6 *)sinp;
	bzero((char *)&inj->ni_addr, sizeof (inj->ni_addr));
	inj->ni_addr.ss_family = (fin->fin_v == 4) ? AF_INET : AF_INET6;
	inj->ni_packet = mb;

	/*
	 * In case we're here due to "to <if>" being used with
	 * "keep state", check that we're going in the correct
	 * direction.
	 */
	if (fdp != NULL) {
		if ((fr != NULL) && (fdp->fd_ifp != NULL) &&
			(fin->fin_rev != 0) && (fdp == &fr->fr_tif))
			goto bad_fastroute;
		inj->ni_physical = (phy_if_t)fdp->fd_ifp;
		if (fin->fin_v == 4) {
			sin->sin_addr = fdp->fd_ip;
		} else {
			sin6->sin6_addr = fdp->fd_ip6.in6;
		}
	} else {
		if (fin->fin_v == 4) {
			sin->sin_addr = ip->ip_dst;
		} else {
			sin6->sin6_addr = ((ip6_t *)ip)->ip6_dst;
		}
		inj->ni_physical = net_routeto(net_data_p, sinp, NULL);
	}

	/* we're checking the destination here */
	if (!(fin->fin_flx & FI_GENERATED) &&
	    !fr_forwarding_enabled(inj->ni_physical, net_data_p)) {
		goto bad_fastroute;
	}

	/*
	 * Clear the hardware checksum flags from packets that we are doing
	 * input processing on as leaving them set will cause the outgoing
	 * NIC (if it supports hardware checksum) to calculate them anew,
	 * using the old (correct) checksums as the pseudo value to start
	 * from.
	 */
	if (fin->fin_out == 0) {
		DB_CKSUMFLAGS(mb) = 0;
	}

	*mpp = mb;

	if (fin->fin_out == 0) {
		void *saveifp;
		u_32_t pass;

		saveifp = fin->fin_ifp;
		fin->fin_ifp = (void *)inj->ni_physical;
		fin->fin_flx &= ~FI_STATE;
		fin->fin_out = 1;
		(void) fr_acctpkt(fin, &pass);
		fin->fin_fr = NULL;
		if (!fr || !(fr->fr_flags & FR_RETMASK))
			(void) fr_checkstate(fin, &pass);
		if (fr_checknatout(fin, NULL) == -1)
			goto bad_fastroute;
		fin->fin_out = 0;
		fin->fin_ifp = saveifp;
	}
#ifndef	sparc
	if (fin->fin_v == 4) {
		__iplen = (u_short)ip->ip_len,
		__ipoff = (u_short)ip->ip_off;

		ip->ip_len = htons(__iplen);
		ip->ip_off = htons(__ipoff);
	}
#endif

	if (net_data_p) {
		if (net_inject(net_data_p, NI_DIRECT_OUT, inj) < 0) {
			net_inject_free(inj);
			return (-1);
		}
	}

	ifs->ifs_fr_frouteok[0]++;
	net_inject_free(inj);
	return 0;
bad_fastroute:
	net_inject_free(inj);
	freemsg(mb);
	ifs->ifs_fr_frouteok[1]++;
	return -1;
}


/* ------------------------------------------------------------------------ */
/* Function:    ipf_hook4_out                                               */
/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to hook information for firewalling  */
/*                                                                          */
/* Calling ipf_hook.                                                        */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int ipf_hook4_out(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook(info, 1, 0, arg);
}
/*ARGSUSED*/
int ipf_hook6_out(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook6(info, 1, 0, arg);
}

/* ------------------------------------------------------------------------ */
/* Function:    ipf_hook4_in                                                */
/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to hook information for firewalling  */
/*                                                                          */
/* Calling ipf_hook.                                                        */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int ipf_hook4_in(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook(info, 0, 0, arg);
}
/*ARGSUSED*/
int ipf_hook6_in(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook6(info, 0, 0, arg);
}


/* ------------------------------------------------------------------------ */
/* Function:    ipf_hook4_loop_out                                          */
/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to hook information for firewalling  */
/*                                                                          */
/* Calling ipf_hook.                                                        */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int ipf_hook4_loop_out(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook(info, 1, FI_NOCKSUM, arg);
}
/*ARGSUSED*/
int ipf_hook6_loop_out(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook6(info, 1, FI_NOCKSUM, arg);
}

/* Static constants used by ipf_hook_ether */
static uint8_t ipf_eth_bcast_addr[ETHERADDRL] = {
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};
static uint8_t ipf_eth_ipv4_mcast[3] = { 0x01, 0x00, 0x5E };
static uint8_t ipf_eth_ipv6_mcast[2] = { 0x33, 0x33 };

/* ------------------------------------------------------------------------ */
/* Function:	ipf_hook_ether                                              */
/* Returns:	int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:	token(I)     - pointer to event                             */
/*              info(I)      - pointer to hook information for firewalling  */
/*                                                                          */
/* The ipf_hook_ether hook is currently private to illumos.  It represents  */
/* a layer 2 datapath generally used by virtual machines.  Currently the    */
/* hook is only used by the viona driver to pass along L2 frames for        */
/* inspection.  It requires that the L2 ethernet header is contained within */
/* a single dblk_t (however layers above the L2 header have no restrctions  */
/* in ipf).  ipf does not currently support filtering on L2 fields (e.g.    */
/* filtering on a MAC address or ethertype), however virtual machines do    */
/* not have native IP stack instances where ipf traditionally hooks in.     */
/* Instead this entry point is used to determine if the packet is unicast,  */
/* broadcast, or multicast. The IPv4 or IPv6 packet is then passed to the   */
/* traditional ip hooks for filtering.  Non IPv4 or non IPv6 packets are    */
/* not subject to examination.                                              */
/* ------------------------------------------------------------------------ */
int ipf_hook_ether(hook_event_token_t token, hook_data_t info, void *arg,
    boolean_t out)
{
	struct ether_header *ethp;
	hook_pkt_event_t *hpe = (hook_pkt_event_t *)info;
	mblk_t *mp;
	size_t offset, len;
	uint16_t etype;
	boolean_t v6;

	/*
	 * viona will only pass us mblks with the L2 header contained in a
	 * single data block.
	 */
	mp = *hpe->hpe_mp;
	len = MBLKL(mp);

	VERIFY3S(len, >=, sizeof (struct ether_header));

	ethp = (struct ether_header *)mp->b_rptr;
	if ((etype = ntohs(ethp->ether_type)) == ETHERTYPE_VLAN) {
		struct ether_vlan_header *evh =
		    (struct ether_vlan_header *)ethp;

		VERIFY3S(len, >=, sizeof (struct ether_vlan_header));

		etype = ntohs(evh->ether_type);
		offset = sizeof (*evh);
	} else {
		offset = sizeof (*ethp);
	}

	/*
	 * ipf only support filtering IPv4 and IPv6.  Ignore other types.
	 */
	if (etype == ETHERTYPE_IP)
		v6 = B_FALSE;
	else if (etype == ETHERTYPE_IPV6)
		v6 = B_TRUE;
	else
		return (0);

	if (bcmp(ipf_eth_bcast_addr, ethp, ETHERADDRL) == 0)
		hpe->hpe_flags |= HPE_BROADCAST;
	else if (bcmp(ipf_eth_ipv4_mcast, ethp,
	    sizeof (ipf_eth_ipv4_mcast)) == 0)
		hpe->hpe_flags |= HPE_MULTICAST;
	else if (bcmp(ipf_eth_ipv6_mcast, ethp,
	    sizeof (ipf_eth_ipv6_mcast)) == 0)
		hpe->hpe_flags |= HPE_MULTICAST;

	/* Find the start of the IPv4 or IPv6 header */
	for (; offset >= len; len = MBLKL(mp)) {
		offset -= len;
		mp = mp->b_cont;
		if (mp == NULL) {
			freemsg(*hpe->hpe_mp);
			*hpe->hpe_mp = NULL;
			return (-1);
		}
	}
	hpe->hpe_mb = mp;
	hpe->hpe_hdr = mp->b_rptr + offset;

	return (v6 ? ipf_hook6(info, out, 0, arg) :
	    ipf_hook(info, out, 0, arg));
}

/* ------------------------------------------------------------------------ */
/* Function:    ipf_hookviona_{in,out}                                      */
/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to hook information for firewalling  */
/*                                                                          */
/* The viona hooks are private hooks to illumos. They represents a layer 2  */
/* datapath generally used to implement virtual machines.                   */
/* along L2 packets.                                                        */
/*                                                                          */
/* They end up calling the appropriate traditional ip hooks.                */
/* ------------------------------------------------------------------------ */
int
ipf_hookviona_in(hook_event_token_t token, hook_data_t info, void *arg)
{
	return (ipf_hook_ether(token, info, arg, B_FALSE));
}

int
ipf_hookviona_out(hook_event_token_t token, hook_data_t info, void *arg)
{
	return (ipf_hook_ether(token, info, arg, B_TRUE));
}

/* ------------------------------------------------------------------------ */
/* Function:    ipf_hook4_loop_in                                           */
/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to hook information for firewalling  */
/*                                                                          */
/* Calling ipf_hook.                                                        */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int ipf_hook4_loop_in(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook(info, 0, FI_NOCKSUM, arg);
}
/*ARGSUSED*/
int ipf_hook6_loop_in(hook_event_token_t token, hook_data_t info, void *arg)
{
	return ipf_hook6(info, 0, FI_NOCKSUM, arg);
}

/* ------------------------------------------------------------------------ */
/* Function:    ipf_hook                                                    */
/* Returns:     int - 0 == packet ok, else problem, free packet if not done */
/* Parameters:  info(I)      - pointer to hook information for firewalling  */
/*              out(I)       - whether packet is going in or out            */
/*              loopback(I)  - whether packet is a loopback packet or not   */
/*                                                                          */
/* Stepping stone function between the IP mainline and IPFilter.  Extracts  */
/* parameters out of the info structure and forms them up to be useful for  */
/* calling ipfilter.                                                        */
/* ------------------------------------------------------------------------ */
int ipf_hook(hook_data_t info, int out, int loopback, void *arg)
{
	hook_pkt_event_t *fw;
	ipf_stack_t *ifs;
	qpktinfo_t qpi;
	int rval, hlen;
	u_short swap;
	phy_if_t phy; 
	ip_t *ip;

	ifs = arg;
	fw = (hook_pkt_event_t *)info;

	ASSERT(fw != NULL);
	phy = (out == 0) ? fw->hpe_ifp : fw->hpe_ofp;

	ip = fw->hpe_hdr;
	swap = ntohs(ip->ip_len);
	ip->ip_len = swap;
	swap = ntohs(ip->ip_off);
	ip->ip_off = swap;
	hlen = IPH_HDR_LENGTH(ip);

	qpi.qpi_m = fw->hpe_mb;
	qpi.qpi_data = fw->hpe_hdr;
	qpi.qpi_off = (char *)qpi.qpi_data - (char *)fw->hpe_mb->b_rptr;
	qpi.qpi_ill = (void *)phy;
	qpi.qpi_flags = fw->hpe_flags & (HPE_MULTICAST|HPE_BROADCAST);
	if (qpi.qpi_flags)
		qpi.qpi_flags |= FI_MBCAST;
	qpi.qpi_flags |= loopback;

	rval = fr_check(fw->hpe_hdr, hlen, qpi.qpi_ill, out,
	    &qpi, fw->hpe_mp, ifs);

	/* For fastroute cases, fr_check returns 0 with mp set to NULL */
	if (rval == 0 && *(fw->hpe_mp) == NULL)
		rval = 1;

	/* Notify IP the packet mblk_t and IP header pointers. */
	fw->hpe_mb = qpi.qpi_m;
	fw->hpe_hdr = qpi.qpi_data;
	if (rval == 0) {
		ip = qpi.qpi_data;
		swap = ntohs(ip->ip_len);
		ip->ip_len = swap;
		swap = ntohs(ip->ip_off);
		ip->ip_off = swap;
	}
	return rval;

}
int ipf_hook6(hook_data_t info, int out, int loopback, void *arg)
{
	hook_pkt_event_t *fw;
	int rval, hlen;
	qpktinfo_t qpi;
	phy_if_t phy; 

	fw = (hook_pkt_event_t *)info;

	ASSERT(fw != NULL);
	phy = (out == 0) ? fw->hpe_ifp : fw->hpe_ofp;

	hlen = sizeof (ip6_t);

	qpi.qpi_m = fw->hpe_mb;
	qpi.qpi_data = fw->hpe_hdr;
	qpi.qpi_off = (char *)qpi.qpi_data - (char *)fw->hpe_mb->b_rptr;
	qpi.qpi_ill = (void *)phy;
	qpi.qpi_flags = fw->hpe_flags & (HPE_MULTICAST|HPE_BROADCAST);
	if (qpi.qpi_flags)
		qpi.qpi_flags |= FI_MBCAST;
	qpi.qpi_flags |= loopback;

	rval = fr_check(fw->hpe_hdr, hlen, qpi.qpi_ill, out,
	    &qpi, fw->hpe_mp, arg);

	/* For fastroute cases, fr_check returns 0 with mp set to NULL */
	if (rval == 0 && *(fw->hpe_mp) == NULL)
		rval = 1;

	/* Notify IP the packet mblk_t and IP header pointers. */
	fw->hpe_mb = qpi.qpi_m;
	fw->hpe_hdr = qpi.qpi_data;
	return rval;
}


/* ------------------------------------------------------------------------ */
/* Function:    ipf_nic_event_v4                                            */
/* Returns:     int - 0 == no problems encountered                          */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to information about a NIC event     */
/*                                                                          */
/* Function to receive asynchronous NIC events from IP                      */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int ipf_nic_event_v4(hook_event_token_t event, hook_data_t info, void *arg)
{
	struct sockaddr_in *sin;
	hook_nic_event_t *hn;
	ipf_stack_t *ifs = arg;
	void *new_ifp = NULL;

	if (ifs->ifs_fr_running <= 0)
		return (0);

	hn = (hook_nic_event_t *)info;

	switch (hn->hne_event)
	{
	case NE_PLUMB :
		frsync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic, hn->hne_data,
		       ifs);
		fr_natifpsync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic,
			      hn->hne_data, ifs);
		fr_statesync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic,
			     hn->hne_data, ifs);
		break;

	case NE_UNPLUMB :
		frsync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL, ifs);
		fr_natifpsync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL,
			      ifs);
		fr_statesync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL, ifs);
		break;

	case NE_ADDRESS_CHANGE :
		/*
		 * We only respond to events for logical interface 0 because
		 * IPFilter only uses the first address given to a network
		 * interface.  We check for hne_lif==1 because the netinfo
		 * code maps adds 1 to the lif number so that it can return
		 * 0 to indicate "no more lifs" when walking them.
		 */
		if (hn->hne_lif == 1) {
			frsync(IPFSYNC_RESYNC, 4, (void *)hn->hne_nic, NULL,
			    ifs);
			sin = hn->hne_data;
			fr_nataddrsync(4, (void *)hn->hne_nic, &sin->sin_addr,
			    ifs);
		}
		break;

#if SOLARIS2 >= 10
	case NE_IFINDEX_CHANGE :
		WRITE_ENTER(&ifs->ifs_ipf_mutex);

		if (hn->hne_data != NULL) {
			/*
			 * The netinfo passes interface index as int (hne_data should be
			 * handled as a pointer to int), which is always 32bit. We need to
			 * convert it to void pointer here, since interfaces are
			 * represented as pointers to void in IPF. The pointers are 64 bits
			 * long on 64bit platforms. Doing something like
			 *	(void *)((int) x)
			 * will throw warning:
			 *   "cast to pointer from integer of different size"
			 * during 64bit compilation.
			 *
			 * The line below uses (size_t) to typecast int to
			 * size_t, which might be 64bit/32bit (depending
			 * on architecture). Once we have proper 64bit/32bit
			 * type (size_t), we can safely convert it to void pointer.
			 */
			new_ifp = (void *)(size_t)*((int *)hn->hne_data);
			fr_ifindexsync((void *)hn->hne_nic, new_ifp, ifs);
			fr_natifindexsync((void *)hn->hne_nic, new_ifp, ifs);
			fr_stateifindexsync((void *)hn->hne_nic, new_ifp, ifs);
		}
		RWLOCK_EXIT(&ifs->ifs_ipf_mutex);
		break;
#endif

	default :
		break;
	}

	return 0;
}


/* ------------------------------------------------------------------------ */
/* Function:    ipf_nic_event_v6                                            */
/* Returns:     int - 0 == no problems encountered                          */
/* Parameters:  event(I)     - pointer to event                             */
/*              info(I)      - pointer to information about a NIC event     */
/*                                                                          */
/* Function to receive asynchronous NIC events from IP                      */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int ipf_nic_event_v6(hook_event_token_t event, hook_data_t info, void *arg)
{
	struct sockaddr_in6 *sin6;
	hook_nic_event_t *hn;
	ipf_stack_t *ifs = arg;
	void *new_ifp = NULL;

	if (ifs->ifs_fr_running <= 0)
		return (0);

	hn = (hook_nic_event_t *)info;

	switch (hn->hne_event)
	{
	case NE_PLUMB :
		frsync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic,
		       hn->hne_data, ifs);
		fr_natifpsync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic,
			      hn->hne_data, ifs);
		fr_statesync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic,
			     hn->hne_data, ifs);
		break;

	case NE_UNPLUMB :
		frsync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL, ifs);
		fr_natifpsync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL,
			      ifs);
		fr_statesync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL, ifs);
		break;

	case NE_ADDRESS_CHANGE :
		if (hn->hne_lif == 1) {
			sin6 = hn->hne_data;
			fr_nataddrsync(6, (void *)hn->hne_nic, &sin6->sin6_addr,
				       ifs);
		}
		break;

#if SOLARIS2 >= 10
	case NE_IFINDEX_CHANGE :
		WRITE_ENTER(&ifs->ifs_ipf_mutex);
		if (hn->hne_data != NULL) {
			/*
			 * The netinfo passes interface index as int (hne_data should be
			 * handled as a pointer to int), which is always 32bit. We need to
			 * convert it to void pointer here, since interfaces are
			 * represented as pointers to void in IPF. The pointers are 64 bits
			 * long on 64bit platforms. Doing something like
			 *	(void *)((int) x)
			 * will throw warning:
			 *   "cast to pointer from integer of different size"
			 * during 64bit compilation.
			 *
			 * The line below uses (size_t) to typecast int to
			 * size_t, which might be 64bit/32bit (depending
			 * on architecture). Once we have proper 64bit/32bit
			 * type (size_t), we can safely convert it to void pointer.
			 */
			new_ifp = (void *)(size_t)*((int *)hn->hne_data);
			fr_ifindexsync((void *)hn->hne_nic, new_ifp, ifs);
			fr_natifindexsync((void *)hn->hne_nic, new_ifp, ifs);
			fr_stateifindexsync((void *)hn->hne_nic, new_ifp, ifs);
		}
		RWLOCK_EXIT(&ifs->ifs_ipf_mutex);
		break;
#endif

	default :
		break;
	}

	return 0;
}

/*
 * Functions fr_make_rst(), fr_make_icmp_v4(), fr_make_icmp_v6()
 * are needed in Solaris kernel only. We don't need them in
 * ipftest to pretend the ICMP/RST packet was sent as a response.
 */
#if defined(_KERNEL) && (SOLARIS2 >= 10)
/* ------------------------------------------------------------------------ */
/* Function:    fr_make_rst                                                 */
/* Returns:     int - 0 on success, -1 on failure			    */
/* Parameters:  fin(I) - pointer to packet information                      */
/*                                                                          */
/* We must alter the original mblks passed to IPF from IP stack via	    */
/* FW_HOOKS. FW_HOOKS interface is powerfull, but it has some limitations.  */
/* IPF can basicaly do only these things with mblk representing the packet: */
/*	leave it as it is (pass the packet)				    */
/*                                                                          */
/*	discard it (block the packet)					    */
/*                                                                          */
/*	alter it (i.e. NAT)						    */
/*                                                                          */
/* As you can see IPF can not simply discard the mblk and supply a new one  */
/* instead to IP stack via FW_HOOKS.					    */
/*                                                                          */
/* The return-rst action for packets coming via NIC is handled as follows:  */
/*	mblk with packet is discarded					    */
/*                                                                          */
/*	new mblk with RST response is constructed and injected to network   */
/*                                                                          */
/* IPF can't inject packets to loopback interface, this is just another	    */
/* limitation we have to deal with here. The only option to send RST	    */
/* response to offending TCP packet coming via loopback is to alter it.	    */
/*									    */
/* The fr_make_rst() function alters TCP SYN/FIN packet intercepted on	    */
/* loopback interface into TCP RST packet. fin->fin_mp is pointer to	    */
/* mblk L3 (IP) and L4 (TCP/UDP) packet headers.			    */
/* ------------------------------------------------------------------------ */
int fr_make_rst(fin)
fr_info_t *fin;
{
	uint16_t tmp_port;
	int rv = -1;
	uint32_t old_ack;
	tcphdr_t *tcp = NULL;
	struct in_addr tmp_src;
#ifdef USE_INET6
	struct in6_addr	tmp_src6;
#endif

	ASSERT(fin->fin_p == IPPROTO_TCP);

	/*
	 * We do not need to adjust chksum, since it is not being checked by
	 * Solaris IP stack for loopback clients.
	 */
	if ((fin->fin_v == 4) && (fin->fin_p == IPPROTO_TCP) &&
	    ((tcp = (tcphdr_t *) fin->fin_dp) != NULL)) {

		if (tcp->th_flags & (TH_SYN | TH_FIN)) {
			/* Swap IPv4 addresses. */
			tmp_src = fin->fin_ip->ip_src;
			fin->fin_ip->ip_src = fin->fin_ip->ip_dst;
			fin->fin_ip->ip_dst = tmp_src;

			rv = 0;
		}
		else
			tcp = NULL;
	}
#ifdef USE_INET6
	else if ((fin->fin_v == 6) && (fin->fin_p == IPPROTO_TCP) &&
	    ((tcp = (tcphdr_t *) fin->fin_dp) != NULL)) {
		/*
		 * We are relying on fact the next header is TCP, which is true
		 * for regular TCP packets coming in over loopback.
		 */
		if (tcp->th_flags & (TH_SYN | TH_FIN)) {
			/* Swap IPv6 addresses. */
			tmp_src6 = fin->fin_ip6->ip6_src;
			fin->fin_ip6->ip6_src = fin->fin_ip6->ip6_dst;
			fin->fin_ip6->ip6_dst = tmp_src6;

			rv = 0;
		}
		else
			tcp = NULL;
	}
#endif

	if (tcp != NULL) {
		/*
		 * Adjust TCP header:
		 *	swap ports,
		 *	set flags,
		 *	set correct ACK number
		 */
		tmp_port = tcp->th_sport;
		tcp->th_sport = tcp->th_dport;
		tcp->th_dport = tmp_port;
		old_ack = tcp->th_ack;
		tcp->th_ack = htonl(ntohl(tcp->th_seq) + 1);
		tcp->th_seq = old_ack;
		tcp->th_flags = TH_RST | TH_ACK;
	}

	return (rv);
}

/* ------------------------------------------------------------------------ */
/* Function:    fr_make_icmp_v4                                             */
/* Returns:     int - 0 on success, -1 on failure			    */
/* Parameters:  fin(I) - pointer to packet information                      */
/*                                                                          */
/* Please read comment at fr_make_icmp() wrapper function to get an idea    */
/* what is going to happen here and why. Once you read the comment there,   */
/* continue here with next paragraph.					    */
/*									    */
/* To turn IPv4 packet into ICMPv4 response packet, these things must	    */
/* happen here:								    */
/*	(1) Original mblk is copied (duplicated).			    */
/*                                                                          */
/*	(2) ICMP header is created.					    */
/*                                                                          */
/*	(3) Link ICMP header with copy of original mblk, we have ICMPv4	    */
/*	    data ready then.						    */
/*                                                                          */
/*      (4) Swap IP addresses in original mblk and adjust IP header data.   */
/*                                                                          */
/*	(5) The mblk containing original packet is trimmed to contain IP    */
/*	    header only and ICMP chksum is computed.			    */
/*                                                                          */
/*	(6) The ICMP header we have from (3) is linked to original mblk,    */
/*	    which now contains new IP header. If original packet was spread */
/*	    over several mblks, only the first mblk is kept.		    */
/* ------------------------------------------------------------------------ */
static int fr_make_icmp_v4(fin)
fr_info_t *fin;
{
	struct in_addr tmp_src;
	tcphdr_t *tcp;
	struct icmp *icmp;
	mblk_t *mblk_icmp;
	mblk_t *mblk_ip;
	size_t icmp_pld_len;	/* octets to append to ICMP header */
	size_t orig_iphdr_len;	/* length of IP header only */
	uint32_t sum;
	uint16_t *buf;
	int len;


	if (fin->fin_v != 4)
		return (-1);

	/*
	 * If we are dealing with TCP, then packet must be SYN/FIN to be routed
	 * by IP stack. If it is not SYN/FIN, then we must drop it silently.
	 */
	tcp = (tcphdr_t *) fin->fin_dp;

	if ((fin->fin_p == IPPROTO_TCP) && 
	    ((tcp == NULL) || ((tcp->th_flags & (TH_SYN | TH_FIN)) == 0)))
		return (-1);

	/*
	 * Step (1)
	 *
	 * Make copy of original mblk.
	 *
	 * We want to copy as much data as necessary, not less, not more.  The
	 * ICMPv4 payload length for unreachable messages is:
	 *	original IP header + 8 bytes of L4 (if there are any).
	 *
	 * We determine if there are at least 8 bytes of L4 data following IP
	 * header first.
	 */
	icmp_pld_len = (fin->fin_dlen > ICMPERR_ICMPHLEN) ?
		ICMPERR_ICMPHLEN : fin->fin_dlen;
	/*
	 * Since we don't want to copy more data than necessary, we must trim
	 * the original mblk here.  The right way (STREAMish) would be to use
	 * adjmsg() to trim it.  However we would have to calculate the length
	 * argument for adjmsg() from pointers we already have here.
	 *
	 * Since we have pointers and offsets, it's faster and easier for
	 * us to just adjust pointers by hand instead of using adjmsg().
	 */
	fin->fin_m->b_wptr = (unsigned char *) fin->fin_dp;
	fin->fin_m->b_wptr += icmp_pld_len;
	icmp_pld_len = fin->fin_m->b_wptr - (unsigned char *) fin->fin_ip;

	/*
	 * Also we don't want to copy any L2 stuff, which might precede IP
	 * header, so we have have to set b_rptr to point to the start of IP
	 * header.
	 */
	fin->fin_m->b_rptr += fin->fin_ipoff;
	if ((mblk_ip = copyb(fin->fin_m)) == NULL)
		return (-1);
	fin->fin_m->b_rptr -= fin->fin_ipoff;

	/*
	 * Step (2)
	 *
	 * Create an ICMP header, which will be appened to original mblk later.
	 * ICMP header is just another mblk.
	 */
	mblk_icmp = (mblk_t *) allocb(ICMPERR_ICMPHLEN, BPRI_HI);
	if (mblk_icmp == NULL) {
		FREE_MB_T(mblk_ip);
		return (-1);
	}

	MTYPE(mblk_icmp) = M_DATA;
	icmp = (struct icmp *) mblk_icmp->b_wptr;
	icmp->icmp_type = ICMP_UNREACH;
	icmp->icmp_code = fin->fin_icode & 0xFF;
	icmp->icmp_void = 0;
	icmp->icmp_cksum = 0;
	mblk_icmp->b_wptr += ICMPERR_ICMPHLEN;

	/*
	 * Step (3)
	 *
	 * Complete ICMP packet - link ICMP header with L4 data from original
	 * IP packet.
	 */
	linkb(mblk_icmp, mblk_ip);

	/*
	 * Step (4)
	 *
	 * Swap IP addresses and change IP header fields accordingly in
	 * original IP packet.
	 *
	 * There is a rule option return-icmp as a dest for physical
	 * interfaces. This option becomes useless for loopback, since IPF box
	 * uses same address as a loopback destination. We ignore the option
	 * here, the ICMP packet will always look like as it would have been
	 * sent from the original destination host.
	 */
	tmp_src = fin->fin_ip->ip_src;
	fin->fin_ip->ip_src = fin->fin_ip->ip_dst;
	fin->fin_ip->ip_dst = tmp_src;
	fin->fin_ip->ip_p = IPPROTO_ICMP;
	fin->fin_ip->ip_sum = 0;

	/*
	 * Step (5)
	 *
	 * We trim the orignal mblk to hold IP header only.
	 */
	fin->fin_m->b_wptr = fin->fin_dp;
	orig_iphdr_len = fin->fin_m->b_wptr -
			    (fin->fin_m->b_rptr + fin->fin_ipoff);
	fin->fin_ip->ip_len = htons(icmp_pld_len + ICMPERR_ICMPHLEN +
			    orig_iphdr_len);

	/*
	 * ICMP chksum calculation. The data we are calculating chksum for are
	 * spread over two mblks, therefore we have to use two for loops.
	 *
	 * First for loop computes chksum part for ICMP header.
	 */
	buf = (uint16_t *) icmp;
	len = ICMPERR_ICMPHLEN;
	for (sum = 0; len > 1; len -= 2)
		sum += *buf++;

	/*
	 * Here we add chksum part for ICMP payload.
	 */
	len = icmp_pld_len;
	buf = (uint16_t *) mblk_ip->b_rptr;
	for (; len > 1; len -= 2)
		sum += *buf++;

	/*
	 * Chksum is done.
	 */
	sum = (sum >> 16) + (sum & 0xffff);
	sum += (sum >> 16);
	icmp->icmp_cksum = ~sum; 

	/*
	 * Step (6)
	 *
	 * Release all packet mblks, except the first one.
	 */
	if (fin->fin_m->b_cont != NULL) {
		FREE_MB_T(fin->fin_m->b_cont);
	}

	/*
	 * Append ICMP payload to first mblk, which already contains new IP
	 * header.
	 */
	linkb(fin->fin_m, mblk_icmp);

	return (0);
}

#ifdef USE_INET6
/* ------------------------------------------------------------------------ */
/* Function:    fr_make_icmp_v6                                             */
/* Returns:     int - 0 on success, -1 on failure			    */
/* Parameters:  fin(I) - pointer to packet information                      */
/*									    */
/* Please read comment at fr_make_icmp() wrapper function to get an idea    */
/* what and why is going to happen here. Once you read the comment there,   */
/* continue here with next paragraph.					    */
/*									    */
/* This function turns IPv6 packet (UDP, TCP, ...) into ICMPv6 response.    */
/* The algorithm is fairly simple:					    */
/*	1) We need to get copy of complete mblk.			    */
/*									    */
/*	2) New ICMPv6 header is created.				    */
/*									    */
/*	3) The copy of original mblk with packet is linked to ICMPv6	    */
/*	   header.							    */
/*									    */
/*	4) The checksum must be adjusted.				    */
/*									    */
/*	5) IP addresses in original mblk are swapped and IP header data	    */
/*	   are adjusted (protocol number).				    */
/*									    */
/*	6) Original mblk is trimmed to hold IPv6 header only, then it is    */
/*	   linked with the ICMPv6 data we got from (3).			    */
/* ------------------------------------------------------------------------ */
static int fr_make_icmp_v6(fin)
fr_info_t *fin;
{
	struct icmp6_hdr *icmp6;
	tcphdr_t *tcp;
	struct in6_addr	tmp_src6;
	size_t icmp_pld_len;
	mblk_t *mblk_ip, *mblk_icmp;

	if (fin->fin_v != 6)
		return (-1);

	/*
	 * If we are dealing with TCP, then packet must SYN/FIN to be routed by
	 * IP stack. If it is not SYN/FIN, then we must drop it silently.
	 */
	tcp = (tcphdr_t *) fin->fin_dp;

	if ((fin->fin_p == IPPROTO_TCP) && 
	    ((tcp == NULL) || ((tcp->th_flags & (TH_SYN | TH_FIN)) == 0)))
		return (-1);

	/*
	 * Step (1)
	 *
	 * We need to copy complete packet in case of IPv6, no trimming is
	 * needed (except the L2 headers).
	 */
	icmp_pld_len = M_LEN(fin->fin_m);
	fin->fin_m->b_rptr += fin->fin_ipoff;
	if ((mblk_ip = copyb(fin->fin_m)) == NULL)
		return (-1);
	fin->fin_m->b_rptr -= fin->fin_ipoff;

	/*
	 * Step (2)
	 *
	 * Allocate and create ICMP header.
	 */
	mblk_icmp = (mblk_t *) allocb(sizeof (struct icmp6_hdr),
			BPRI_HI);

	if (mblk_icmp == NULL)
		return (-1);
	
	MTYPE(mblk_icmp) = M_DATA;
	icmp6 =  (struct icmp6_hdr *) mblk_icmp->b_wptr;
	icmp6->icmp6_type = ICMP6_DST_UNREACH;
	icmp6->icmp6_code = fin->fin_icode & 0xFF;
	icmp6->icmp6_data32[0] = 0;
	mblk_icmp->b_wptr += sizeof (struct icmp6_hdr);
	
	/*
	 * Step (3)
	 *
	 * Link the copy of IP packet to ICMP header.
	 */
	linkb(mblk_icmp, mblk_ip);

	/* 
	 * Step (4)
	 *
	 * Calculate chksum - this is much more easier task than in case of
	 * IPv4  - ICMPv6 chksum only covers IP addresses, and payload length.
	 * We are making compensation just for change of packet length.
	 */
	icmp6->icmp6_cksum = icmp_pld_len + sizeof (struct icmp6_hdr);

	/*
	 * Step (5)
	 *
	 * Swap IP addresses.
	 */
	tmp_src6 = fin->fin_ip6->ip6_src;
	fin->fin_ip6->ip6_src = fin->fin_ip6->ip6_dst;
	fin->fin_ip6->ip6_dst = tmp_src6;

	/*
	 * and adjust IP header data.
	 */
	fin->fin_ip6->ip6_nxt = IPPROTO_ICMPV6;
	fin->fin_ip6->ip6_plen = htons(icmp_pld_len + sizeof (struct icmp6_hdr));

	/*
	 * Step (6)
	 *
	 * We must release all linked mblks from original packet and keep only
	 * the first mblk with IP header to link ICMP data.
	 */
	fin->fin_m->b_wptr = (unsigned char *) fin->fin_ip6 + sizeof (ip6_t);

	if (fin->fin_m->b_cont != NULL) {
		FREE_MB_T(fin->fin_m->b_cont);
	}

	/*
	 * Append ICMP payload to IP header.
	 */
	linkb(fin->fin_m, mblk_icmp);

	return (0);
}
#endif	/* USE_INET6 */

/* ------------------------------------------------------------------------ */
/* Function:    fr_make_icmp                                                */
/* Returns:     int - 0 on success, -1 on failure			    */
/* Parameters:  fin(I) - pointer to packet information                      */
/*                                                                          */
/* We must alter the original mblks passed to IPF from IP stack via	    */
/* FW_HOOKS. The reasons why we must alter packet are discussed within	    */
/* comment at fr_make_rst() function.					    */
/*									    */
/* The fr_make_icmp() function acts as a wrapper, which passes the code	    */
/* execution to	fr_make_icmp_v4() or fr_make_icmp_v6() depending on	    */
/* protocol version. However there are some details, which are common to    */
/* both IP versions. The details are going to be explained here.	    */
/*                                                                          */
/* The packet looks as follows:						    */
/*    xxx | IP hdr | IP payload    ...	| 				    */
/*    ^   ^        ^            	^				    */
/*    |   |        |            	|				    */
/*    |   |        |		fin_m->b_wptr = fin->fin_dp + fin->fin_dlen */
/*    |   |        |							    */
/*    |   |        `- fin_m->fin_dp (in case of IPv4 points to L4 header)   */
/*    |   |								    */
/*    |   `- fin_m->b_rptr + fin_ipoff (fin_ipoff is most likely 0 in case  */
/*    |      of loopback)						    */
/*    |   								    */
/*    `- fin_m->b_rptr -  points to L2 header in case of physical NIC	    */
/*                                                                          */
/* All relevant IP headers are pulled up into the first mblk. It happened   */
/* well in advance before the matching rule was found (the rule, which took */
/* us here, to fr_make_icmp() function).				    */
/*                                                                          */
/* Both functions will turn packet passed in fin->fin_m mblk into a new	    */
/* packet. New packet will be represented as chain of mblks.		    */
/* orig mblk |- b_cont ---.						    */
/*    ^                    `-> ICMP hdr |- b_cont--.			    */
/*    |	                          ^	            `-> duped orig mblk	    */
/*    |                           |				^	    */
/*    `- The original mblk        |				|	    */
/*       will be trimmed to       |				|	    */
/*       to contain IP header     |				|	    */
/*       only                     |				|	    */
/*                                |				|	    */
/*                                `- This is newly		|           */
/*                                   allocated mblk to		|	    */
/*                                   hold ICMPv6 data.		|	    */
/*								|	    */
/*								|	    */
/*								|	    */
/*	    This is the copy of original mblk, it will contain -'	    */
/*	    orignal IP  packet in case of ICMPv6. In case of		    */
/*	    ICMPv4 it will contain up to 8 bytes of IP payload		    */
/*	    (TCP/UDP/L4) data from original packet.			    */
/* ------------------------------------------------------------------------ */
int fr_make_icmp(fin)
fr_info_t *fin;
{
	int rv;
	
	if (fin->fin_v == 4)
		rv = fr_make_icmp_v4(fin);
#ifdef USE_INET6
	else if (fin->fin_v == 6)
		rv = fr_make_icmp_v6(fin);
#endif
	else
		rv = -1;

	return (rv);
}

/* ------------------------------------------------------------------------ */
/* Function:    fr_buf_sum						    */
/* Returns:     unsigned int - sum of buffer buf			    */
/* Parameters:  buf - pointer to buf we want to sum up			    */
/*              len - length of buffer buf				    */
/*                                                                          */
/* Sums buffer buf. The result is used for chksum calculation. The buf	    */
/* argument must be aligned.						    */
/* ------------------------------------------------------------------------ */
static uint32_t fr_buf_sum(buf, len)
const void *buf;
unsigned int len;
{
	uint32_t	sum = 0;
	uint16_t	*b = (uint16_t *)buf;

	while (len > 1) {
		sum += *b++;
		len -= 2;
	}

	if (len == 1)
		sum += htons((*(unsigned char *)b) << 8);

	return (sum);
}

/* ------------------------------------------------------------------------ */
/* Function:    fr_calc_chksum						    */
/* Returns:     void							    */
/* Parameters:  fin - pointer to fr_info_t instance with packet data	    */
/*              pkt - pointer to duplicated packet			    */
/*                                                                          */
/* Calculates all chksums (L3, L4) for packet pkt. Works for both IP	    */
/* versions.								    */
/* ------------------------------------------------------------------------ */
void fr_calc_chksum(fin, pkt)
fr_info_t *fin;
mb_t *pkt;
{
	struct pseudo_hdr {
		union {
			struct in_addr	in4;
#ifdef USE_INET6
			struct in6_addr	in6;
#endif
		} src_addr;
		union {
			struct in_addr	in4;
#ifdef USE_INET6
			struct in6_addr	in6;
#endif
		} dst_addr;
		char		zero;
		char		proto;
		uint16_t	len;
	}	phdr;
	uint32_t	sum, ip_sum;
	void	*buf;
	uint16_t	*l4_csum_p;
	tcphdr_t	*tcp;
	udphdr_t	*udp;
	icmphdr_t	*icmp;
#ifdef USE_INET6
	struct icmp6_hdr	*icmp6;
#endif
	ip_t		*ip;
	unsigned int	len;
	int		pld_len;

	/*
	 * We need to pullup the packet to the single continuous buffer to avoid
	 * potential misaligment of b_rptr member in mblk chain.
	 */
	if (pullupmsg(pkt, -1) == 0) {
		cmn_err(CE_WARN, "Failed to pullup loopback pkt -> chksum"
		    " will not be computed by IPF");
		return;
	}

	/*
	 * It is guaranteed IP header starts right at b_rptr, because we are
	 * working with a copy of the original packet.
	 *
	 * Compute pseudo header chksum for TCP and UDP.
	 */
	if ((fin->fin_p == IPPROTO_UDP) ||
	    (fin->fin_p == IPPROTO_TCP)) {
		bzero(&phdr, sizeof (phdr));
#ifdef USE_INET6
		if (fin->fin_v == 6) {
			phdr.src_addr.in6 = fin->fin_srcip6;
			phdr.dst_addr.in6 = fin->fin_dstip6;
		} else {
			phdr.src_addr.in4 = fin->fin_src;
			phdr.dst_addr.in4 = fin->fin_dst;
		}
#else
		phdr.src_addr.in4 = fin->fin_src;
		phdr.dst_addr.in4 = fin->fin_dst;
#endif
		phdr.zero = (char) 0;
		phdr.proto = fin->fin_p;
		phdr.len = htons((uint16_t)fin->fin_dlen);
		sum = fr_buf_sum(&phdr, (unsigned int)sizeof (phdr));
	} else {
		sum = 0;
	}

	/*
	 * Set pointer to the L4 chksum field in the packet, set buf pointer to
	 * the L4 header start.
	 */
	switch (fin->fin_p) {
		case IPPROTO_UDP:
			udp = (udphdr_t *)(pkt->b_rptr + fin->fin_hlen);
			l4_csum_p = &udp->uh_sum;
			buf = udp;
			break;
		case IPPROTO_TCP:
			tcp = (tcphdr_t *)(pkt->b_rptr + fin->fin_hlen);
			l4_csum_p = &tcp->th_sum;
			buf = tcp;
			break;
		case IPPROTO_ICMP:
			icmp = (icmphdr_t *)(pkt->b_rptr + fin->fin_hlen);
			l4_csum_p = &icmp->icmp_cksum;
			buf = icmp;
			break;
#ifdef USE_INET6
		case IPPROTO_ICMPV6:
			icmp6 = (struct icmp6_hdr *)(pkt->b_rptr + fin->fin_hlen);
			l4_csum_p = &icmp6->icmp6_cksum;
			buf = icmp6;
			break;
#endif
		default:
			l4_csum_p = NULL;
	}

	/*
	 * Compute L4 chksum if needed.
	 */
	if (l4_csum_p != NULL) {
		*l4_csum_p = (uint16_t)0;
		pld_len = fin->fin_dlen;
		len = pkt->b_wptr - (unsigned char *)buf;
		ASSERT(len == pld_len);
		/*
		 * Add payload sum to pseudoheader sum.
		 */
		sum += fr_buf_sum(buf, len);
		while (sum >> 16)
			sum = (sum & 0xFFFF) + (sum >> 16);

		*l4_csum_p = ~((uint16_t)sum);
		DTRACE_PROBE1(l4_sum, uint16_t, *l4_csum_p);
	}

	/*
	 * The IP header chksum is needed just for IPv4.
	 */
	if (fin->fin_v == 4) {
		/*
		 * Compute IPv4 header chksum.
		 */
		ip = (ip_t *)pkt->b_rptr;
		ip->ip_sum = (uint16_t)0;
		ip_sum = fr_buf_sum(ip, (unsigned int)fin->fin_hlen);
		while (ip_sum >> 16)
			ip_sum = (ip_sum & 0xFFFF) + (ip_sum >> 16);

		ip->ip_sum = ~((uint16_t)ip_sum);
		DTRACE_PROBE1(l3_sum, uint16_t, ip->ip_sum);
	}

	return;
}

#endif	/* _KERNEL && SOLARIS2 >= 10 */