common/inet/optcom.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/* Copyright (c) 1990 Mentat Inc. */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*
 * This file contains common code for handling Options Management requests.
 */

#include <sys/types.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/strsubr.h>
#include <sys/errno.h>
#define	_SUN_TPI_VERSION 2
#include <sys/tihdr.h>
#include <sys/socket.h>
#include <sys/ddi.h>
#include <sys/debug.h>		/* for ASSERT */
#include <sys/policy.h>

#include <inet/common.h>
#include <inet/mi.h>
#include <inet/nd.h>
#include <netinet/ip6.h>
#include <inet/ip.h>
#include <inet/mib2.h>
#include <netinet/in.h>
#include "optcom.h"

#include <inet/optcom.h>

/*
 * Function prototypes
 */
static t_scalar_t process_topthdrs_first_pass(mblk_t *, cred_t *, optdb_obj_t *,
    boolean_t *, size_t *);
static t_scalar_t do_options_second_pass(queue_t *q, mblk_t *reqmp,
    mblk_t *ack_mp, cred_t *, optdb_obj_t *dbobjp,
    mblk_t *first_mp, boolean_t is_restart, boolean_t *queued_statusp);
static t_uscalar_t get_worst_status(t_uscalar_t, t_uscalar_t);
static int do_opt_default(queue_t *, struct T_opthdr *, uchar_t **,
    t_uscalar_t *, cred_t *, optdb_obj_t *);
static void do_opt_current(queue_t *, struct T_opthdr *, uchar_t **,
    t_uscalar_t *, cred_t *cr, optdb_obj_t *);
static int do_opt_check_or_negotiate(queue_t *q, struct T_opthdr *reqopt,
    uint_t optset_context, uchar_t **resptrp, t_uscalar_t *worst_statusp,
    cred_t *, optdb_obj_t *dbobjp, mblk_t *first_mp);
static opdes_t *opt_chk_lookup(t_uscalar_t, t_uscalar_t, opdes_t *, uint_t);
static boolean_t opt_level_valid(t_uscalar_t, optlevel_t *, uint_t);
static size_t opt_level_allopts_lengths(t_uscalar_t, opdes_t *, uint_t);
static boolean_t opt_length_ok(opdes_t *, struct T_opthdr *);
static t_uscalar_t optcom_max_optbuf_len(opdes_t *, uint_t);
static boolean_t opt_bloated_maxsize(opdes_t *);

/* Common code for sending back a T_ERROR_ACK. */
void
optcom_err_ack(queue_t *q, mblk_t *mp, t_scalar_t t_error, int sys_error)
{
	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
		qreply(q, mp);
}

/*
 * The option management routines svr4_optcom_req() and tpi_optcom_req() use
 * callback functions as arguments. Here is the expected interfaces
 * assumed from the callback functions
 *
 *
 * (1) deffn(q, optlevel, optname, optvalp)
 *
 *	- Function only called when default value comes from protocol
 *	 specific code and not the option database table (indicated by
 *	  OP_DEF_FN property in option database.)
 *	- Error return is -1. Valid returns are >=0.
 *	- When valid, the return value represents the length used for storing
 *		the default value of the option.
 *      - Error return implies the called routine did not recognize this
 *              option. Something downstream could so input is left unchanged
 *              in request buffer.
 *
 * (2) getfn(q, optlevel, optname, optvalp)
 *
 *	- Error return is -1. Valid returns are >=0.
 *	- When valid, the return value represents the length used for storing
 *		the actual value of the option.
 *      - Error return implies the called routine did not recognize this
 *              option. Something downstream could so input is left unchanged
 *              in request buffer.
 *
 * (3) setfn(q, optset_context, optlevel, optname, inlen, invalp,
 *	outlenp, outvalp, attrp, cr);
 *
 *	- OK return is 0, Error code is returned as a non-zero argument.
 *      - If negative it is ignored by svr4_optcom_req(). If positive, error
 *        is returned. A negative return implies that option, while handled on
 *	  this stack is not handled at this level and will be handled further
 *	  downstream.
 *	- Both negative and positive errors are treats as errors in an
 *	  identical manner by tpi_optcom_req(). The errors affect "status"
 *	  field of each option's T_opthdr. If sucessfull, an appropriate sucess
 *	  result is carried. If error, it instantiated to "failure" at the
 *	  topmost level and left unchanged at other levels. (This "failure" can
 *	  turn to a success at another level).
 *	- optset_context passed for tpi_optcom_req(). It is interpreted as:
 *        - SETFN_OPTCOM_CHECKONLY
 *		semantics are to pretend to set the value and report
 *		back if it would be successful.
 *		This is used with T_CHECK semantics in XTI
 *        - SETFN_OPTCOM_NEGOTIATE
 *		set the value. Call from option management primitive
 *		T_OPTMGMT_REQ when T_NEGOTIATE flags is used.
 *	  - SETFN_UD_NEGOTIATE
 *		option request came riding on UNITDATA primitive most often
 *		has  "this datagram" semantics to influence prpoerties
 *		affecting an outgoig datagram or associated with recived
 *		datagram
 *		[ Note: XTI permits this use outside of "this datagram"
 *		semantics also and permits setting "management related"
 *		options in this	context and its test suite enforces it ]
 *	  - SETFN_CONN_NEGOTATE
 *		option request came riding on CONN_REQ/RES primitive and
 *		most often has "this connection" (negotiation during
 *		"connection estblishment") semantics.
 *		[ Note: XTI permits use of these outside of "this connection"
 *		semantics and permits "management related" options in this
 *		context and its test suite enforces it. ]
 *
 *	- inlen, invalp is the option length,value requested to be set.
 *	- outlenp, outvalp represent return parameters which contain the
 *	  value set and it might be different from one passed on input.
 *	- attrp points to a data structure that's used by v6 modules to
 *	  store ancillary data options or sticky options.
 *	- cr points to the caller's credentials
 *	- the caller might pass same buffers for input and output and the
 *	  routine should protect against this case by not updating output
 *	  buffers until it is done referencing input buffers and any other
 *	  issues (e.g. not use bcopy() if we do not trust what it does).
 *      - If option is not known, it returns error. We randomly pick EINVAL.
 *        It can however get called with options that are handled downstream
 *        opr upstream so for svr4_optcom_req(), it does not return error for
 *        negative return values.
 *
 */

/*
 * Upper Level Protocols call this routine when they receive
 * a T_SVR4_OPTMGMT_REQ message.  They supply callback functions
 * for setting a new value for a single options, getting the
 * current value for a single option, and checking for support
 * of a single option.  svr4_optcom_req validates the option management
 * buffer passed in, and calls the appropriate routines to do the
 * job requested.
 * XXX Code below needs some restructuring after we have some more
 * macros to support 'struct opthdr' in the headers.
 *
 * IP-MT notes: The option management framework functions svr4_optcom_req() and
 * tpi_optcom_req() allocate and prepend an M_CTL mblk to the actual
 * T_optmgmt_req mblk and pass the chain as an additional parameter to the
 * protocol set functions. If a protocol set function (such as ip_opt_set)
 * cannot process the option immediately it can return EINPROGRESS. ip_opt_set
 * enqueues the message in the appropriate sq and returns EINPROGRESS. Later
 * the sq framework arranges to restart this operation and passes control to
 * the restart function ip_restart_optmgmt() which in turn calls
 * svr4_optcom_req() or tpi_optcom_req() to restart the option processing.
 */
int
svr4_optcom_req(queue_t *q, mblk_t *mp, cred_t *cr, optdb_obj_t *dbobjp,
    boolean_t pass_to_ip)
{
	pfi_t	deffn = dbobjp->odb_deffn;
	pfi_t	getfn = dbobjp->odb_getfn;
	opt_set_fn setfn = dbobjp->odb_setfn;
	opdes_t	*opt_arr = dbobjp->odb_opt_des_arr;
	uint_t opt_arr_cnt = dbobjp->odb_opt_arr_cnt;
	boolean_t topmost_tpiprovider = dbobjp->odb_topmost_tpiprovider;
	opt_restart_t *or;
	struct opthdr *restart_opt;
	boolean_t is_restart = B_FALSE;
	mblk_t	*first_mp;

	t_uscalar_t max_optbuf_len;
	int len;
	mblk_t	*mp1 = NULL;
	struct opthdr *next_opt;
	struct opthdr *opt;
	struct opthdr *opt1;
	struct opthdr *opt_end;
	struct opthdr *opt_start;
	opdes_t	*optd;
	boolean_t	pass_to_next = B_FALSE;
	struct T_optmgmt_ack *toa;
	struct T_optmgmt_req *tor;

	/*
	 * Allocate M_CTL and prepend to the packet for restarting this
	 * option if needed. IP may need to queue and restart the option
	 * if it cannot obtain exclusive conditions immediately. Please see
	 * IP-MT notes before the start of svr4_optcom_req
	 */
	if (mp->b_datap->db_type == M_CTL) {
		is_restart = B_TRUE;
		first_mp = mp;
		mp = mp->b_cont;
		ASSERT(mp->b_wptr - mp->b_rptr >=
		    sizeof (struct T_optmgmt_req));
		tor = (struct T_optmgmt_req *)mp->b_rptr;
		ASSERT(tor->MGMT_flags == T_NEGOTIATE);

		or = (opt_restart_t *)first_mp->b_rptr;
		opt_start = or->or_start;
		opt_end = or->or_end;
		restart_opt = or->or_ropt;
		goto restart;
	}

	tor = (struct T_optmgmt_req *)mp->b_rptr;
	/* Verify message integrity. */
	if (mp->b_wptr - mp->b_rptr < sizeof (struct T_optmgmt_req))
		goto bad_opt;
	/* Verify MGMT_flags legal */
	switch (tor->MGMT_flags) {
	case T_DEFAULT:
	case T_NEGOTIATE:
	case T_CURRENT:
	case T_CHECK:
		/* OK - legal request flags */
		break;
	default:
		optcom_err_ack(q, mp, TBADFLAG, 0);
		return (0);
	}
	if (tor->MGMT_flags == T_DEFAULT) {
		/* Is it a request for default option settings? */

		/*
		 * Note: XXX TLI and TPI specification was unclear about
		 * semantics of T_DEFAULT and the following historical note
		 * and its interpretation is incorrect (it implies a request
		 * for default values of only the identified options not all.
		 * The semantics have been explained better in XTI spec.)
		 * However, we do not modify (comment or code) here to keep
		 * compatibility.
		 * We can rethink this if it ever becomes an issue.
		 * ----historical comment start------
		 * As we understand it, the input buffer is meaningless
		 * so we ditch the message.  A T_DEFAULT request is a
		 * request to obtain a buffer containing defaults for
		 * all supported options, so we allocate a maximum length
		 * reply.
		 * ----historical comment end -------
		 */
		/* T_DEFAULT not passed down */
		ASSERT(topmost_tpiprovider == B_TRUE);
		freemsg(mp);
		max_optbuf_len = optcom_max_optbuf_len(opt_arr,
		    opt_arr_cnt);
		mp = allocb(max_optbuf_len, BPRI_MED);
		if (!mp) {
no_mem:;
			optcom_err_ack(q, mp, TSYSERR, ENOMEM);
			return (0);
		}

		/* Initialize the T_optmgmt_ack header. */
		toa = (struct T_optmgmt_ack *)mp->b_rptr;
		bzero((char *)toa, max_optbuf_len);
		toa->PRIM_type = T_OPTMGMT_ACK;
		toa->OPT_offset = (t_scalar_t)sizeof (struct T_optmgmt_ack);
		/* TODO: Is T_DEFAULT the right thing to put in MGMT_flags? */
		toa->MGMT_flags = T_DEFAULT;

		/* Now walk the table of options passed in */
		opt = (struct opthdr *)&toa[1];
		for (optd = opt_arr; optd < &opt_arr[opt_arr_cnt]; optd++) {
			/*
			 * All the options in the table of options passed
			 * in are by definition supported by the protocol
			 * calling this function.
			 */
			if (!OA_READ_PERMISSION(optd, cr))
				continue;
			opt->level = optd->opdes_level;
			opt->name = optd->opdes_name;
			if (!(optd->opdes_props & OP_DEF_FN) ||
			    ((len = (*deffn)(q, opt->level,
			    opt->name, (uchar_t *)&opt[1])) < 0)) {
				/*
				 * Fill length and value from table.
				 *
				 * Default value not instantiated from function
				 * (or the protocol specific function failed it;
				 * In this interpretation of T_DEFAULT, this is
				 * the best we can do)
				 */
				switch (optd->opdes_size) {
				/*
				 * Since options are guaranteed aligned only
				 * on a 4 byte boundary (t_scalar_t) any
				 * option that is greater in size will default
				 * to the bcopy below
				 */
				case sizeof (int32_t):
					*(int32_t *)&opt[1] =
					    (int32_t)optd->opdes_default;
					break;
				case sizeof (int16_t):
					*(int16_t *)&opt[1] =
					    (int16_t)optd->opdes_default;
					break;
				case sizeof (int8_t):
					*(int8_t *)&opt[1] =
					    (int8_t)optd->opdes_default;
					break;
				default:
					/*
					 * other length but still assume
					 * fixed - use bcopy
					 */
					bcopy(optd->opdes_defbuf,
					    &opt[1], optd->opdes_size);
					break;
				}
				opt->len = optd->opdes_size;
			}
			else
				opt->len = (t_uscalar_t)len;
			opt = (struct opthdr *)((char *)&opt[1] +
			    _TPI_ALIGN_OPT(opt->len));
		}

		/* Now record the final length. */
		toa->OPT_length = (t_scalar_t)((char *)opt - (char *)&toa[1]);
		mp->b_wptr = (uchar_t *)opt;
		mp->b_datap->db_type = M_PCPROTO;
		/* Ship it back. */
		qreply(q, mp);
		return (0);
	}
	/* T_DEFAULT processing complete - no more T_DEFAULT */

	/*
	 * For T_NEGOTIATE, T_CURRENT, and T_CHECK requests, we make a
	 * pass through the input buffer validating the details and
	 * making sure each option is supported by the protocol.
	 */
	if ((opt_start = (struct opthdr *)mi_offset_param(mp,
	    tor->OPT_offset, tor->OPT_length)) == NULL)
		goto bad_opt;
	if (!__TPI_OPT_ISALIGNED(opt_start))
		goto bad_opt;

	opt_end = (struct opthdr *)((uchar_t *)opt_start +
	    tor->OPT_length);

	for (opt = opt_start; opt < opt_end; opt = next_opt) {
		/*
		 * Verify we have room to reference the option header
		 * fields in the option buffer.
		 */
		if ((uchar_t *)opt + sizeof (struct opthdr) >
		    (uchar_t *)opt_end)
			goto bad_opt;
		/*
		 * We now compute pointer to next option in buffer 'next_opt'
		 * The next_opt computation above below 'opt->len' initialized
		 * by application which cannot be trusted. The usual value
		 * too large will be captured by the loop termination condition
		 * above. We check for the following which it will miss.
		 * 	-pointer space wraparound arithmetic overflow
		 *	-last option in buffer with 'opt->len' being too large
		 *	 (only reason 'next_opt' should equal or exceed
		 *	 'opt_end' for last option is roundup unless length is
		 *	 too-large/invalid)
		 */
		next_opt = (struct opthdr *)((uchar_t *)&opt[1] +
		    _TPI_ALIGN_OPT(opt->len));

		if ((uchar_t *)next_opt < (uchar_t *)&opt[1] ||
		    ((next_opt >= opt_end) &&
		    (((uchar_t *)next_opt - (uchar_t *)opt_end) >=
		    __TPI_ALIGN_SIZE)))
			goto bad_opt;

		/* sanity check */
		if (opt->name == T_ALLOPT)
			goto bad_opt;

		/* Find the option in the opt_arr. */
		if ((optd = opt_chk_lookup(opt->level, opt->name,
		    opt_arr, opt_arr_cnt)) == NULL) {
			/*
			 * Not found, that is a bad thing if
			 * the caller is a tpi provider
			 */
			if (topmost_tpiprovider)
				goto bad_opt;
			else
				continue; /* skip unmodified */
		}

		/* Additional checks dependent on operation. */
		switch (tor->MGMT_flags) {
		case T_NEGOTIATE:
			if (!OA_WRITE_OR_EXECUTE(optd, cr)) {
				/* can't negotiate option */
				if (!(OA_MATCHED_PRIV(optd, cr)) &&
				    OA_WX_ANYPRIV(optd)) {
					/*
					 * not privileged but privilege
					 * will help negotiate option.
					 */
					optcom_err_ack(q, mp, TACCES, 0);
					return (0);
				} else
					goto bad_opt;
			}
			/*
			 * Verify size for options
			 * Note: For retaining compatibility with historical
			 * behavior, variable lengths options will have their
			 * length verified in the setfn() processing.
			 * In order to be compatible with SunOS 4.X we return
			 * EINVAL errors for bad lengths.
			 */
			if (!(optd->opdes_props & OP_VARLEN)) {
				/* fixed length - size must match */
				if (opt->len != optd->opdes_size) {
					optcom_err_ack(q, mp, TSYSERR, EINVAL);
					return (0);
				}
			}
			break;

		case T_CHECK:
			if (!OA_RWX_ANYPRIV(optd))
				/* any of "rwx" permission but not not none */
				goto bad_opt;
			/*
			 * XXX Since T_CURRENT was not there in TLI and the
			 * official TLI inspired TPI standard, getsockopt()
			 * API uses T_CHECK (for T_CURRENT semantics)
			 * The following fallthru makes sense because of its
			 * historical use as semantic equivalent to T_CURRENT.
			 */
			/* FALLTHRU */
		case T_CURRENT:
			if (!OA_READ_PERMISSION(optd, cr)) {
				/* can't read option value */
				if (!(OA_MATCHED_PRIV(optd, cr)) &&
				    OA_R_ANYPRIV(optd)) {
					/*
					 * not privileged but privilege
					 * will help in reading option value.
					 */
					optcom_err_ack(q, mp, TACCES, 0);
					return (0);
				} else
					goto bad_opt;
			}
			break;

		default:
			optcom_err_ack(q, mp, TBADFLAG, 0);
			return (0);
		}
		/* We liked it.  Keep going. */
	} /* end for loop scanning option buffer */

	/* Now complete the operation as required. */
	switch (tor->MGMT_flags) {
	case T_CHECK:
		/*
		 * Historically used same as T_CURRENT (which was added to
		 * standard later). Code retained for compatibility.
		 */
		/* FALLTHROUGH */
	case T_CURRENT:
		/*
		 * Allocate a maximum size reply.  Perhaps we are supposed to
		 * assume that the input buffer includes space for the answers
		 * as well as the opthdrs, but we don't know that for sure.
		 * So, instead, we create a new output buffer, using the
		 * input buffer only as a list of options.
		 */
		max_optbuf_len = optcom_max_optbuf_len(opt_arr,
		    opt_arr_cnt);
		mp1 = allocb_cred(max_optbuf_len, cr);
		if (!mp1)
			goto no_mem;
		/* Initialize the header. */
		mp1->b_datap->db_type = M_PCPROTO;
		mp1->b_wptr = &mp1->b_rptr[sizeof (struct T_optmgmt_ack)];
		toa = (struct T_optmgmt_ack *)mp1->b_rptr;
		toa->OPT_offset = (t_scalar_t)sizeof (struct T_optmgmt_ack);
		toa->MGMT_flags = tor->MGMT_flags;
		/*
		 * Walk through the input buffer again, this time adding
		 * entries to the output buffer for each option requested.
		 * Note, sanity of option header, last option etc, verified
		 * in first pass.
		 */
		opt1 = (struct opthdr *)&toa[1];

		for (opt = opt_start; opt < opt_end; opt = next_opt) {

			next_opt = (struct opthdr *)((uchar_t *)&opt[1] +
			    _TPI_ALIGN_OPT(opt->len));

			opt1->name = opt->name;
			opt1->level = opt->level;
			len = (*getfn)(q, opt->level,
			    opt->name, (uchar_t *)&opt1[1]);
			/*
			 * Failure means option is not recognized. Copy input
			 * buffer as is
			 */
			if (len < 0) {
				opt1->len = opt->len;
				bcopy(&opt[1], &opt1[1], opt->len);
			} else {
				opt1->len = (t_uscalar_t)len;
			}
			opt1 = (struct opthdr *)((uchar_t *)&opt1[1] +
			    _TPI_ALIGN_OPT(opt1->len));
		} /* end for loop */

		/* Record the final length. */
		toa->OPT_length = (t_scalar_t)((uchar_t *)opt1 -
		    (uchar_t *)&toa[1]);
		mp1->b_wptr = (uchar_t *)opt1;
		/* Ditch the input buffer. */
		freemsg(mp);
		mp = mp1;
		/* Always let the next module look at the option. */
		pass_to_next = B_TRUE;
		break;

	case T_NEGOTIATE:
		first_mp = allocb(sizeof (opt_restart_t), BPRI_LO);
		if (first_mp == NULL) {
			optcom_err_ack(q, mp, TSYSERR, ENOMEM);
			return (0);
		}
		first_mp->b_datap->db_type = M_CTL;
		or = (opt_restart_t *)first_mp->b_rptr;
		or->or_start = opt_start;
		or->or_end =  opt_end;
		or->or_type = T_SVR4_OPTMGMT_REQ;
		or->or_private = 0;
		first_mp->b_cont = mp;
restart:
		/*
		 * Here we are expecting that the response buffer is exactly
		 * the same size as the input buffer.  We pass each opthdr
		 * to the protocol's set function.  If the protocol doesn't
		 * like it, it can update the value in it return argument.
		 */
		/*
		 * Pass each negotiated option through the protocol set
		 * function.
		 * Note: sanity check on option header values done in first
		 * pass and not repeated here.
		 */
		toa = (struct T_optmgmt_ack *)tor;

		for (opt = is_restart ? restart_opt: opt_start; opt < opt_end;
		    opt = next_opt) {
			int error;

			/*
			 * Point to the current option in or, in case this
			 * option has to be restarted later on
			 */
			or->or_ropt = opt;
			next_opt = (struct opthdr *)((uchar_t *)&opt[1] +
			    _TPI_ALIGN_OPT(opt->len));

			error = (*setfn)(q, SETFN_OPTCOM_NEGOTIATE,
			    opt->level, opt->name,
			    opt->len, (uchar_t *)&opt[1],
			    &opt->len, (uchar_t *)&opt[1], NULL, cr, first_mp);
			/*
			 * Treat positive "errors" as real.
			 * Note: negative errors are to be treated as
			 * non-fatal by svr4_optcom_req() and are
			 * returned by setfn() when it is passed an
			 * option it does not handle. Since the option
			 * passed opt_chk_lookup(), it is implied that
			 * it is valid but was either handled upstream
			 * or will be handled downstream.
			 */
			if (error == EINPROGRESS) {
				/*
				 * The message is queued and will be
				 * reprocessed later. Typically ip queued
				 * the message to get some exclusive conditions
				 * and later on calls this func again.
				 */
				return (EINPROGRESS);
			} else if (error > 0) {
				optcom_err_ack(q, mp, TSYSERR, error);
				freeb(first_mp);
				return (0);
			}
			/*
			 * error < 0 means option is not recognized.
			 * But with OP_PASSNEXT the next module
			 * might recognize it.
			 */
		}
		/* Done with the restart control mp. */
		freeb(first_mp);
		pass_to_next = B_TRUE;
		break;
	default:
		optcom_err_ack(q, mp, TBADFLAG, 0);
		return (0);
	}

	if (pass_to_next && (q->q_next != NULL || pass_to_ip)) {
		/* Send it down to the next module and let it reply */
		toa->PRIM_type = T_SVR4_OPTMGMT_REQ; /* Changed by IP to ACK */
		if (q->q_next != NULL)
			putnext(q, mp);
		else
			ip_output(Q_TO_CONN(q), mp, q, IP_WPUT);
	} else {
		/* Set common fields in the header. */
		toa->MGMT_flags = T_SUCCESS;
		mp->b_datap->db_type = M_PCPROTO;
		toa->PRIM_type = T_OPTMGMT_ACK;
		qreply(q, mp);
	}
	return (0);
bad_opt:;
	optcom_err_ack(q, mp, TBADOPT, 0);
	return (0);
}

/*
 * New optcom_req inspired by TPI/XTI semantics
 */
int
tpi_optcom_req(queue_t *q, mblk_t *mp, cred_t *cr, optdb_obj_t *dbobjp,
    boolean_t pass_to_ip)
{
	t_scalar_t t_error;
	mblk_t *toa_mp;
	boolean_t pass_to_next;
	size_t toa_len;
	struct T_optmgmt_ack *toa;
	struct T_optmgmt_req *tor =
	    (struct T_optmgmt_req *)mp->b_rptr;

	opt_restart_t *or;
	boolean_t is_restart = B_FALSE;
	mblk_t	*first_mp = NULL;
	t_uscalar_t worst_status;
	boolean_t queued_status;

	/*
	 * Allocate M_CTL and prepend to the packet for restarting this
	 * option if needed. IP may need to queue and restart the option
	 * if it cannot obtain exclusive conditions immediately. Please see
	 * IP-MT notes before the start of svr4_optcom_req
	 */
	if (mp->b_datap->db_type == M_CTL) {
		is_restart = B_TRUE;
		first_mp = mp;
		toa_mp = mp->b_cont;
		mp = toa_mp->b_cont;
		ASSERT(mp->b_wptr - mp->b_rptr >=
		    sizeof (struct T_optmgmt_req));
		tor = (struct T_optmgmt_req *)mp->b_rptr;
		ASSERT(tor->MGMT_flags == T_NEGOTIATE);

		or = (opt_restart_t *)first_mp->b_rptr;
		goto restart;
	}

	/* Verify message integrity. */
	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_optmgmt_req)) {
		optcom_err_ack(q, mp, TBADOPT, 0);
		return (0);
	}

	/* Verify MGMT_flags legal */
	switch (tor->MGMT_flags) {
	case T_DEFAULT:
	case T_NEGOTIATE:
	case T_CURRENT:
	case T_CHECK:
		/* OK - legal request flags */
		break;
	default:
		optcom_err_ack(q, mp, TBADFLAG, 0);
		return (0);
	}

	/*
	 * In this design, there are two passes required on the input buffer
	 * mostly to accomodate variable length options and "T_ALLOPT" option
	 * which has the semantics "all options of the specified level".
	 *
	 * For T_DEFAULT, T_NEGOTIATE, T_CURRENT, and T_CHECK requests, we make
	 * a pass through the input buffer validating the details and making
	 * sure each option is supported by the protocol. We also determine the
	 * length of the option buffer to return. (Variable length options and
	 * T_ALLOPT mean that length can be different for output buffer).
	 */

	pass_to_next = B_FALSE;	/* initial value */
	toa_len = 0;		/* initial value */

	/*
	 * First pass, we do the following
	 *	- estimate cumulative length needed for results
	 *	- set "status" field based on permissions, option header check
	 *	  etc.
	 *	- determine "pass_to_next" whether we need to send request to
	 *	  downstream module/driver.
	 */
	if ((t_error = process_topthdrs_first_pass(mp, cr, dbobjp,
	    &pass_to_next, &toa_len)) != 0) {
		optcom_err_ack(q, mp, t_error, 0);
		return (0);
	}

	/*
	 * A validation phase of the input buffer is done. We have also
	 * obtained the length requirement and and other details about the
	 * input and we liked input buffer so far.  We make another scan
	 * through the input now and generate the output necessary to complete
	 * the operation.
	 */

	toa_mp = allocb_cred(toa_len, cr);
	if (!toa_mp) {
		optcom_err_ack(q, mp, TSYSERR, ENOMEM);
		return (0);
	}

	first_mp = allocb(sizeof (opt_restart_t), BPRI_LO);
	if (first_mp == NULL) {
		freeb(toa_mp);
		optcom_err_ack(q, mp, TSYSERR, ENOMEM);
		return (0);
	}
	first_mp->b_datap->db_type = M_CTL;
	or = (opt_restart_t *)first_mp->b_rptr;
	/*
	 * Set initial values for generating output.
	 */
	or->or_worst_status = T_SUCCESS;
	or->or_type = T_OPTMGMT_REQ;
	or->or_private = 0;
	/* remaining fields fileed in do_options_second_pass */

restart:
	/*
	 * This routine makes another pass through the option buffer this
	 * time acting on the request based on "status" result in the
	 * first pass. It also performs "expansion" of T_ALLOPT into
	 * all options of a certain level and acts on each for this request.
	 */
	if ((t_error = do_options_second_pass(q, mp, toa_mp, cr, dbobjp,
	    first_mp, is_restart, &queued_status)) != 0) {
		freemsg(toa_mp);
		optcom_err_ack(q, mp, t_error, 0);
		return (0);
	}
	if (queued_status) {
		/* Option will be restarted */
		return (EINPROGRESS);
	}
	worst_status = or->or_worst_status;
	/* Done with the first mp */
	freeb(first_mp);
	toa_mp->b_cont = NULL;

	/*
	 * Following code relies on the coincidence that T_optmgmt_req
	 * and T_optmgmt_ack are identical in binary representation
	 */
	toa = (struct T_optmgmt_ack *)toa_mp->b_rptr;
	toa->OPT_length = (t_scalar_t)(toa_mp->b_wptr - (toa_mp->b_rptr +
	    sizeof (struct T_optmgmt_ack)));
	toa->OPT_offset = (t_scalar_t)sizeof (struct T_optmgmt_ack);

	toa->MGMT_flags = tor->MGMT_flags;


	freemsg(mp);		/* free input mblk */

	/*
	 * If there is atleast one option that requires a downstream
	 * forwarding and if it is possible, we forward the message
	 * downstream. Else we ack it.
	 */
	if (pass_to_next && (q->q_next != NULL || pass_to_ip)) {
		/*
		 * We pass it down as T_OPTMGMT_REQ. This code relies
		 * on the happy coincidence that T_optmgmt_req and
		 * T_optmgmt_ack are identical data structures
		 * at the binary representation level.
		 */
		toa_mp->b_datap->db_type = M_PROTO;
		toa->PRIM_type = T_OPTMGMT_REQ;
		if (q->q_next != NULL)
			putnext(q, toa_mp);
		else
			ip_output(Q_TO_CONN(q), toa_mp, q, IP_WPUT);
	} else {
		toa->PRIM_type = T_OPTMGMT_ACK;
		toa_mp->b_datap->db_type = M_PCPROTO;
		toa->MGMT_flags |= worst_status; /* XXX "worst" or "OR" TPI ? */
		qreply(q, toa_mp);
	}
	return (0);
}


/*
 * Following routine makes a pass through option buffer in mp and performs the
 * following tasks.
 *	- estimate cumulative length needed for results
 *	- set "status" field based on permissions, option header check
 *	  etc.
 *	- determine "pass_to_next" whether we need to send request to
 *	  downstream module/driver.
 */

static t_scalar_t
process_topthdrs_first_pass(mblk_t *mp, cred_t *cr, optdb_obj_t *dbobjp,
    boolean_t *pass_to_nextp, size_t *toa_lenp)
{
	opdes_t	*opt_arr = dbobjp->odb_opt_des_arr;
	uint_t opt_arr_cnt = dbobjp->odb_opt_arr_cnt;
	boolean_t topmost_tpiprovider = dbobjp->odb_topmost_tpiprovider;
	optlevel_t *valid_level_arr = dbobjp->odb_valid_levels_arr;
	uint_t valid_level_arr_cnt = dbobjp->odb_valid_levels_arr_cnt;
	struct T_opthdr *opt;
	struct T_opthdr *opt_start, *opt_end;
	opdes_t	*optd;
	size_t allopt_len;
	struct T_optmgmt_req *tor =
	    (struct T_optmgmt_req *)mp->b_rptr;

	*toa_lenp = sizeof (struct T_optmgmt_ack); /* initial value */

	if ((opt_start = (struct T_opthdr *)
	    mi_offset_param(mp, tor->OPT_offset, tor->OPT_length)) == NULL) {
		return (TBADOPT);
	}
	if (!__TPI_TOPT_ISALIGNED(opt_start))
		return (TBADOPT);

	opt_end = (struct T_opthdr *)((uchar_t *)opt_start + tor->OPT_length);

	for (opt = opt_start; opt && (opt < opt_end);
	    opt = _TPI_TOPT_NEXTHDR(opt_start, tor->OPT_length, opt)) {
		/*
		 * Validate the option for length and alignment
		 * before accessing anything in it.
		 */
		if (!(_TPI_TOPT_VALID(opt, opt_start, opt_end)))
			return (TBADOPT);

		/* Find the option in the opt_arr. */
		if (opt->name != T_ALLOPT) {
			optd = opt_chk_lookup(opt->level, opt->name,
			    opt_arr, opt_arr_cnt);
			if (optd == NULL) {
				/*
				 * Option not found
				 *
				 * Verify if level is "valid" or not.
				 * Note: This check is required by XTI
				 *
				 * TPI provider always initializes
				 * the "not supported" (or whatever) status
				 * for the options. Other levels leave status
				 * unchanged if they do not understand an
				 * option.
				 */
				if (topmost_tpiprovider) {
					if (!opt_level_valid(opt->level,
					    valid_level_arr,
					    valid_level_arr_cnt))
						return (TBADOPT);
					/*
					 * level is valid - initialize
					 * option as not supported
					 */
					opt->status = T_NOTSUPPORT;
				}

				*toa_lenp += _TPI_ALIGN_TOPT(opt->len);
				continue;
			}
		} else {
			/*
			 * Handle T_ALLOPT case as a special case.
			 * Note: T_ALLOPT does not mean anything
			 * for T_CHECK operation.
			 */
			allopt_len = 0;
			if (tor->MGMT_flags == T_CHECK ||
			    !topmost_tpiprovider ||
			    ((allopt_len = opt_level_allopts_lengths(opt->level,
			    opt_arr, opt_arr_cnt)) == 0)) {
				/*
				 * This is confusing but correct !
				 * It is not valid to to use T_ALLOPT with
				 * T_CHECK flag.
				 *
				 * T_ALLOPT is assumed "expanded" at the
				 * topmost_tpiprovider level so it should not
				 * be there as an "option name" if this is not
				 * a topmost_tpiprovider call and we fail it.
				 *
				 * opt_level_allopts_lengths() is used to verify
				 * that "level" associated with the T_ALLOPT is
				 * supported.
				 *
				 */
				opt->status = T_FAILURE;
				*toa_lenp += _TPI_ALIGN_TOPT(opt->len);
				continue;
			}
			ASSERT(allopt_len != 0); /* remove ? */

			*toa_lenp += allopt_len;
			opt->status = T_SUCCESS;
			/* XXX - always set T_ALLOPT 'pass_to_next' for now */
			*pass_to_nextp = B_TRUE;
			continue;
		}
		/*
		 * Check if option wants to flow downstream
		 */
		if (optd->opdes_props & OP_PASSNEXT)
			*pass_to_nextp = B_TRUE;

		/* Additional checks dependent on operation. */
		switch (tor->MGMT_flags) {
		case T_DEFAULT:
		case T_CURRENT:

			/*
			 * The opt_chk_lookup() routine call above approved of
			 * this option so we can work on the status for it
			 * based on the permissions for the operation. (This
			 * can override any status for it set at higher levels)
			 * We assume this override is OK since chkfn at this
			 * level approved of this option.
			 *
			 * T_CURRENT semantics:
			 * The read access is required. Else option
			 * status is T_NOTSUPPORT.
			 *
			 * T_DEFAULT semantics:
			 * Note: specification is not clear on this but we
			 * interpret T_DEFAULT semantics such that access to
			 * read value is required for access even the default
			 * value. Otherwise the option status is T_NOTSUPPORT.
			 */
			if (!OA_READ_PERMISSION(optd, cr)) {
				opt->status = T_NOTSUPPORT;
				*toa_lenp += _TPI_ALIGN_TOPT(opt->len);
				/* skip to next */
				continue;
			}

			/*
			 * T_DEFAULT/T_CURRENT semantics:
			 * We know that read access is set. If no other access
			 * is set, then status is T_READONLY.
			 */
			if (OA_READONLY_PERMISSION(optd, cr))
				opt->status = T_READONLY;
			else
				opt->status = T_SUCCESS;
			/*
			 * Option passes all checks. Make room for it in the
			 * ack. Note: size stored in table does not include
			 * space for option header.
			 */
			*toa_lenp += sizeof (struct T_opthdr) +
			    _TPI_ALIGN_TOPT(optd->opdes_size);
			break;

		case T_CHECK:
		case T_NEGOTIATE:

			/*
			 * T_NEGOTIATE semantics:
			 * If for fixed length option value on input is not the
			 * same as value supplied, then status is T_FAILURE.
			 *
			 * T_CHECK semantics:
			 * If value is supplied, semantics same as T_NEGOTIATE.
			 * It is however ok not to supply a value with T_CHECK.
			 */

			if (tor->MGMT_flags == T_NEGOTIATE ||
			    (opt->len != sizeof (struct T_opthdr))) {
				/*
				 * Implies "value" is specified in T_CHECK or
				 * it is a T_NEGOTIATE request.
				 * Verify size.
				 * Note: This can override anything about this
				 * option request done at a higher level.
				 */
				if (!opt_length_ok(optd, opt)) {
					/* bad size */
					*toa_lenp += _TPI_ALIGN_TOPT(opt->len);
					opt->status = T_FAILURE;
					continue;
				}
			}
			/*
			 * The opt_chk_lookup()  routine above() approved of
			 * this option so we can work on the status for it based
			 * on the permissions for the operation. (This can
			 * override anything set at a higher level).
			 *
			 * T_CHECK/T_NEGOTIATE semantics:
			 * Set status to T_READONLY if read is the only access
			 * permitted
			 */
			if (OA_READONLY_PERMISSION(optd, cr)) {
				opt->status = T_READONLY;
				*toa_lenp += _TPI_ALIGN_TOPT(opt->len);
				/* skip to next */
				continue;
			}

			/*
			 * T_CHECK/T_NEGOTIATE semantics:
			 * If write (or execute) access is not set, then status
			 * is T_NOTSUPPORT.
			 */
			if (!OA_WRITE_OR_EXECUTE(optd, cr)) {
				opt->status = T_NOTSUPPORT;
				*toa_lenp += _TPI_ALIGN_TOPT(opt->len);
				/* skip to next option */
				continue;
			}
			/*
			 * Option passes all checks. Make room for it in the
			 * ack and set success in status.
			 * Note: size stored in table does not include header
			 * length.
			 */
			opt->status = T_SUCCESS;
			*toa_lenp += sizeof (struct T_opthdr) +
			    _TPI_ALIGN_TOPT(optd->opdes_size);
			break;

		default:
			return (TBADFLAG);
		}
	} /* for loop scanning input buffer */

	return (0);		/* OK return */
}

/*
 * This routine makes another pass through the option buffer this
 * time acting on the request based on "status" result in the
 * first pass. It also performs "expansion" of T_ALLOPT into
 * all options of a certain level and acts on each for this request.
 */
static t_scalar_t
do_options_second_pass(queue_t *q, mblk_t *reqmp, mblk_t *ack_mp, cred_t *cr,
    optdb_obj_t *dbobjp, mblk_t *first_mp, boolean_t is_restart,
    boolean_t *queued_statusp)
{
	boolean_t topmost_tpiprovider = dbobjp->odb_topmost_tpiprovider;
	int failed_option;
	struct T_opthdr *opt;
	struct T_opthdr *opt_start, *opt_end, *restart_opt;
	uchar_t *optr;
	uint_t optset_context;
	struct T_optmgmt_req *tor = (struct T_optmgmt_req *)reqmp->b_rptr;
	opt_restart_t	*or;
	t_uscalar_t	*worst_statusp;
	int	err;

	*queued_statusp = B_FALSE;
	or = (opt_restart_t *)first_mp->b_rptr;
	worst_statusp = &or->or_worst_status;

	optr = (uchar_t *)ack_mp->