io/mac/mac_protect.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2015, Joyent, Inc.  All rights reserved.
 */
/*
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 */

#include <sys/cmn_err.h>
#include <sys/strsun.h>
#include <sys/sdt.h>
#include <sys/mac.h>
#include <sys/mac_impl.h>
#include <sys/mac_client_impl.h>
#include <sys/mac_client_priv.h>
#include <sys/ethernet.h>
#include <sys/vlan.h>
#include <sys/dlpi.h>
#include <sys/avl.h>
#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/arp.h>
#include <netinet/arp.h>
#include <netinet/udp.h>
#include <netinet/dhcp.h>
#include <netinet/dhcp6.h>

/*
 * Implementation overview for DHCP address detection
 *
 * The purpose of DHCP address detection is to relieve the user of having to
 * manually configure static IP addresses when ip-nospoof protection is turned
 * on. To achieve this, the mac layer needs to intercept DHCP packets to
 * determine the assigned IP addresses.
 *
 * A DHCP handshake between client and server typically requires at least
 * 4 messages:
 *
 * 1. DISCOVER - client attempts to locate DHCP servers via a
 *               broadcast message to its subnet.
 * 2. OFFER    - server responds to client with an IP address and
 *               other parameters.
 * 3. REQUEST  - client requests the offered address.
 * 4. ACK      - server verifies that the requested address matches
 *               the one it offered.
 *
 * DHCPv6 behaves pretty much the same way aside from different message names.
 *
 * Address information is embedded in either the OFFER or REQUEST message.
 * We chose to intercept REQUEST because this is at the last part of the
 * handshake and it indicates that the client intends to keep the address.
 * Intercepting OFFERs is unreliable because the client may receive multiple
 * offers from different servers, and we can't tell which address the client
 * will keep.
 *
 * Each DHCP message has a transaction ID. We use this transaction ID to match
 * REQUESTs with ACKs received from servers.
 *
 * For IPv4, the process to acquire a DHCP-assigned address is as follows:
 *
 * 1. Client sends REQUEST. a new dhcpv4_txn_t object is created and inserted
 *    in the the mci_v4_pending_txn table (keyed by xid). This object represents
 *    a new transaction. It contains the xid, the client ID and requested IP
 *    address.
 *
 * 2. Server responds with an ACK. The xid from this ACK is used to lookup the
 *    pending transaction from the mci_v4_pending_txn table. Once the object is
 *    found, it is removed from the pending table and inserted into the
 *    completed table (mci_v4_completed_txn, keyed by client ID) and the dynamic
 *    IP table (mci_v4_dyn_ip, keyed by IP address).
 *
 * 3. An outgoing packet that goes through the ip-nospoof path will be checked
 *    against the dynamic IP table. Packets that have the assigned DHCP address
 *    as the source IP address will pass the check and be admitted onto the
 *    network.
 *
 * IPv4 notes:
 *
 * If the server never responds with an ACK, there is a timer that is set after
 * the insertion of the transaction into the pending table. When the timer
 * fires, it will check whether the transaction is old (by comparing current
 * time and the txn's timestamp), if so the transaction will be freed. along
 * with this, any transaction in the completed/dyn-ip tables matching the client
 * ID of this stale transaction will also be freed. If the client fails to
 * extend a lease, we want to stop the client from using any IP addresses that
 * were granted previously.
 *
 * A RELEASE message from the client will not cause a transaction to be created.
 * The client ID in the RELEASE message will be used for finding and removing
 * transactions in the completed and dyn-ip tables.
 *
 *
 * For IPv6, the process to acquire a DHCPv6-assigned address is as follows:
 *
 * 1. Client sends REQUEST. The DUID is extracted and stored into a dhcpv6_cid_t
 *    structure. A new transaction structure (dhcpv6_txn_t) is also created and
 *    it will point to the dhcpv6_cid_t. If an existing transaction with a
 *    matching xid is not found, this dhcpv6_txn_t will be inserted into the
 *    mci_v6_pending_txn table (keyed by xid).
 *
 * 2. Server responds with a REPLY. If a pending transaction is found, the
 *    addresses in the reply will be placed into the dhcpv6_cid_t pointed to by
 *    the transaction. The dhcpv6_cid_t will then be moved to the mci_v6_cid
 *    table (keyed by cid). The associated addresses will be added to the
 *    mci_v6_dyn_ip table (while still being pointed to by the dhcpv6_cid_t).
 *
 * 3. IPv6 ip-nospoof will now check mci_v6_dyn_ip for matching packets.
 *    Packets with a source address matching one of the DHCPv6-assigned
 *    addresses will be allowed through.
 *
 * IPv6 notes:
 *
 * The v6 code shares the same timer as v4 for scrubbing stale transactions.
 * Just like v4, as part of removing an expired transaction, a RELEASE will be
 * be triggered on the cid associated with the expired transaction.
 *
 * The data structures used for v6 are slightly different because a v6 client
 * may have multiple addresses associated with it.
 */

/*
 * These are just arbitrary limits meant for preventing abuse (e.g. a user
 * flooding the network with bogus transactions). They are not meant to be
 * user-modifiable so they are not exposed as linkprops.
 */
static ulong_t  dhcp_max_pending_txn = 512;
static ulong_t  dhcp_max_completed_txn = 512;
static ulong_t  slaac_max_allowed = 512;
static hrtime_t txn_cleanup_interval = 60 * NANOSEC;

/*
 * DHCPv4 transaction. It may be added to three different tables
 * (keyed by different fields).
 */
typedef struct dhcpv4_txn {
    uint32_t        dt_xid;
    hrtime_t        dt_timestamp;
    uint8_t         dt_cid[DHCP_MAX_OPT_SIZE];
    uint8_t         dt_cid_len;
    ipaddr_t        dt_ipaddr;
    avl_node_t      dt_node;
    avl_node_t      dt_ipnode;
    struct dhcpv4_txn   *dt_next;
} dhcpv4_txn_t;

/*
 * DHCPv6 address. May be added to mci_v6_dyn_ip.
 * It is always pointed to by its parent dhcpv6_cid_t structure.
 */
typedef struct dhcpv6_addr {
    in6_addr_t      da_addr;
    avl_node_t      da_node;
    struct dhcpv6_addr  *da_next;
} dhcpv6_addr_t;

/*
 * DHCPv6 client ID. May be added to mci_v6_cid.
 * No dhcpv6_txn_t should be pointing to it after it is added to mci_v6_cid.
 */
typedef struct dhcpv6_cid {
    uchar_t         *dc_cid;
    uint_t          dc_cid_len;
    dhcpv6_addr_t       *dc_addr;
    uint_t          dc_addrcnt;
    avl_node_t      dc_node;
} dhcpv6_cid_t;

/*
 * DHCPv6 transaction. Unlike its v4 counterpart, this object gets freed up
 * as soon as the transaction completes or expires.
 */
typedef struct dhcpv6_txn {
    uint32_t        dt_xid;
    hrtime_t        dt_timestamp;
    dhcpv6_cid_t        *dt_cid;
    avl_node_t      dt_node;
    struct dhcpv6_txn   *dt_next;
} dhcpv6_txn_t;

/*
 * Stateless address autoconfiguration (SLAAC) address. May be added to
 * mci_v6_slaac_ip.
 */
typedef struct slaac_addr {
    in6_addr_t      sla_prefix;
    in6_addr_t      sla_addr;
    avl_node_t      sla_node;
} slaac_addr_t;

static void start_txn_cleanup_timer(mac_client_impl_t *);
static boolean_t allowed_ips_set(mac_resource_props_t *, uint32_t);

#define BUMP_STAT(m, s) (m)->mci_misc_stat.mms_##s++

/*
 * Comparison functions for the 3 AVL trees used:
 * mci_v4_pending_txn, mci_v4_completed_txn, mci_v4_dyn_ip
 */
static int
compare_dhcpv4_xid(const void *arg1, const void *arg2)
{
    const dhcpv4_txn_t  *txn1 = arg1, *txn2 = arg2;

    if (txn1->dt_xid < txn2->dt_xid)
        return (-1);
    else if (txn1->dt_xid > txn2->dt_xid)
        return (1);
    else
        return (0);
}

static int
compare_dhcpv4_cid(const void *arg1, const void *arg2)
{
    const dhcpv4_txn_t  *txn1 = arg1, *txn2 = arg2;
    int         ret;

    if (txn1->dt_cid_len < txn2->dt_cid_len)
        return (-1);
    else if (txn1->dt_cid_len > txn2->dt_cid_len)
        return (1);

    if (txn1->dt_cid_len == 0)
        return (0);

    ret = memcmp(txn1->dt_cid, txn2->dt_cid, txn1->dt_cid_len);
    if (ret < 0)
        return (-1);
    else if (ret > 0)
        return (1);
    else
        return (0);
}

static int
compare_dhcpv4_ip(const void *arg1, const void *arg2)
{
    const dhcpv4_txn_t  *txn1 = arg1, *txn2 = arg2;

    if (txn1->dt_ipaddr < txn2->dt_ipaddr)
        return (-1);
    else if (txn1->dt_ipaddr > txn2->dt_ipaddr)
        return (1);
    else
        return (0);
}

/*
 * Find the specified DHCPv4 option.
 */
static int
get_dhcpv4_option(struct dhcp *dh4, uchar_t *end, uint8_t type,
    uchar_t **opt, uint8_t *opt_len)
{
    uchar_t     *start = (uchar_t *)dh4->options;
    uint8_t     otype, olen;

    while (start < end) {
        if (*start == CD_PAD) {
            start++;
            continue;
        }
        if (*start == CD_END)
            break;

        otype = *start++;
        olen = *start++;
        if (otype == type && olen > 0) {
            *opt = start;
            *opt_len = olen;
            return (0);
        }
        start += olen;
    }
    return (ENOENT);
}

/*
 * Locate the start of a DHCPv4 header.
 * The possible return values and associated meanings are:
 * 0      - packet is DHCP and has a DHCP header.
 * EINVAL - packet is not DHCP. the recommended action is to let it pass.
 * ENOSPC - packet is a initial fragment that is DHCP or is unidentifiable.
 *          the recommended action is to drop it.
 */
static int
get_dhcpv4_info(ipha_t *ipha, uchar_t *end, struct dhcp **dh4)
{
    uint16_t    offset_and_flags, client, server;
    boolean_t   first_frag = B_FALSE;
    struct udphdr   *udph;
    uchar_t     *dh;

    if (ipha->ipha_protocol != IPPROTO_UDP)
        return (EINVAL);

    offset_and_flags = ntohs(ipha->ipha_fragment_offset_and_flags);
    if ((offset_and_flags & (IPH_MF | IPH_OFFSET)) != 0) {
        /*
         * All non-initial fragments may pass because we cannot
         * identify their type. It's safe to let them through
         * because reassembly will fail if we decide to drop the
         * initial fragment.
         */
        if (((offset_and_flags << 3) & 0xffff) != 0)
            return (EINVAL);
        first_frag = B_TRUE;
    }
    /* drop packets without a udp header */
    udph = (struct udphdr *)((uchar_t *)ipha + IPH_HDR_LENGTH(ipha));
    if ((uchar_t *)&udph[1] > end)
        return (ENOSPC);

    client = htons(IPPORT_BOOTPC);
    server = htons(IPPORT_BOOTPS);
    if (udph->uh_sport != client && udph->uh_sport != server &&
        udph->uh_dport != client && udph->uh_dport != server)
        return (EINVAL);

    /* drop dhcp fragments */
    if (first_frag)
        return (ENOSPC);

    dh = (uchar_t *)&udph[1];
    if (dh + BASE_PKT_SIZE > end)
        return (EINVAL);

    *dh4 = (struct dhcp *)dh;
    return (0);
}

/*
 * Wrappers for accesses to avl trees to improve readability.
 * Their purposes are fairly self-explanatory.
 */
static dhcpv4_txn_t *
find_dhcpv4_pending_txn(mac_client_impl_t *mcip, uint32_t xid)
{
    dhcpv4_txn_t    tmp_txn;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    tmp_txn.dt_xid = xid;
    return (avl_find(&mcip->mci_v4_pending_txn, &tmp_txn, NULL));
}

static int
insert_dhcpv4_pending_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
    avl_index_t where;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if (avl_find(&mcip->mci_v4_pending_txn, txn, &where) != NULL)
        return (EEXIST);

    if (avl_numnodes(&mcip->mci_v4_pending_txn) >= dhcp_max_pending_txn) {
        BUMP_STAT(mcip, dhcpdropped);
        return (EAGAIN);
    }
    avl_insert(&mcip->mci_v4_pending_txn, txn, where);
    return (0);
}

static void
remove_dhcpv4_pending_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    avl_remove(&mcip->mci_v4_pending_txn, txn);
}

static dhcpv4_txn_t *
find_dhcpv4_completed_txn(mac_client_impl_t *mcip, uint8_t *cid,
    uint8_t cid_len)
{
    dhcpv4_txn_t    tmp_txn;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if (cid_len > 0)
        bcopy(cid, tmp_txn.dt_cid, cid_len);
    tmp_txn.dt_cid_len = cid_len;
    return (avl_find(&mcip->mci_v4_completed_txn, &tmp_txn, NULL));
}

/*
 * After a pending txn is removed from the pending table, it is inserted
 * into both the completed and dyn-ip tables. These two insertions are
 * done together because a client ID must have 1:1 correspondence with
 * an IP address and IP addresses must be unique in the dyn-ip table.
 */
static int
insert_dhcpv4_completed_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
    avl_index_t where;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if (avl_find(&mcip->mci_v4_completed_txn, txn, &where) != NULL)
        return (EEXIST);

    if (avl_numnodes(&mcip->mci_v4_completed_txn) >=
        dhcp_max_completed_txn) {
        BUMP_STAT(mcip, dhcpdropped);
        return (EAGAIN);
    }

    avl_insert(&mcip->mci_v4_completed_txn, txn, where);
    if (avl_find(&mcip->mci_v4_dyn_ip, txn, &where) != NULL) {
        avl_remove(&mcip->mci_v4_completed_txn, txn);
        return (EEXIST);
    }
    avl_insert(&mcip->mci_v4_dyn_ip, txn, where);
    return (0);
}

static void
remove_dhcpv4_completed_txn(mac_client_impl_t *mcip, dhcpv4_txn_t *txn)
{
    dhcpv4_txn_t    *ctxn;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if ((ctxn = avl_find(&mcip->mci_v4_dyn_ip, txn, NULL)) != NULL &&
        ctxn == txn)
        avl_remove(&mcip->mci_v4_dyn_ip, txn);

    avl_remove(&mcip->mci_v4_completed_txn, txn);
}

/*
 * Check whether an IP address is in the dyn-ip table.
 */
static boolean_t
check_dhcpv4_dyn_ip(mac_client_impl_t *mcip, ipaddr_t ipaddr)
{
    dhcpv4_txn_t    tmp_txn, *txn;

    mutex_enter(&mcip->mci_protect_lock);
    tmp_txn.dt_ipaddr = ipaddr;
    txn = avl_find(&mcip->mci_v4_dyn_ip, &tmp_txn, NULL);
    mutex_exit(&mcip->mci_protect_lock);
    return (txn != NULL);
}

/*
 * Create/destroy a DHCPv4 transaction.
 */
static dhcpv4_txn_t *
create_dhcpv4_txn(uint32_t xid, uint8_t *cid, uint8_t cid_len, ipaddr_t ipaddr)
{
    dhcpv4_txn_t    *txn;

    if ((txn = kmem_zalloc(sizeof (*txn), KM_NOSLEEP)) == NULL)
        return (NULL);

    txn->dt_xid = xid;
    txn->dt_timestamp = gethrtime();
    if (cid_len > 0)
        bcopy(cid, &txn->dt_cid, cid_len);
    txn->dt_cid_len = cid_len;
    txn->dt_ipaddr = ipaddr;
    return (txn);
}

static void
free_dhcpv4_txn(dhcpv4_txn_t *txn)
{
    kmem_free(txn, sizeof (*txn));
}

/*
 * Clean up all v4 tables.
 */
static void
flush_dhcpv4(mac_client_impl_t *mcip)
{
    void        *cookie = NULL;
    dhcpv4_txn_t    *txn;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    while ((txn = avl_destroy_nodes(&mcip->mci_v4_dyn_ip,
        &cookie)) != NULL) {
        /*
         * No freeing needed here because the same txn exists
         * in the mci_v4_completed_txn table as well.
         */
    }
    cookie = NULL;
    while ((txn = avl_destroy_nodes(&mcip->mci_v4_completed_txn,
        &cookie)) != NULL) {
        free_dhcpv4_txn(txn);
    }
    cookie = NULL;
    while ((txn = avl_destroy_nodes(&mcip->mci_v4_pending_txn,
        &cookie)) != NULL) {
        free_dhcpv4_txn(txn);
    }
}

/*
 * Cleanup stale DHCPv4 transactions.
 */
static void
txn_cleanup_v4(mac_client_impl_t *mcip)
{
    dhcpv4_txn_t        *txn, *ctxn, *next, *txn_list = NULL;

    /*
     * Find stale pending transactions and place them on a list
     * to be removed.
     */
    for (txn = avl_first(&mcip->mci_v4_pending_txn); txn != NULL;
        txn = avl_walk(&mcip->mci_v4_pending_txn, txn, AVL_AFTER)) {
        if (gethrtime() - txn->dt_timestamp > txn_cleanup_interval) {
            DTRACE_PROBE2(found__expired__txn,
                mac_client_impl_t *, mcip,
                dhcpv4_txn_t *, txn);

            txn->dt_next = txn_list;
            txn_list = txn;
        }
    }

    /*
     * Remove and free stale pending transactions and completed
     * transactions with the same client IDs as the stale transactions.
     */
    for (txn = txn_list; txn != NULL; txn = next) {
        avl_remove(&mcip->mci_v4_pending_txn, txn);

        ctxn = find_dhcpv4_completed_txn(mcip, txn->dt_cid,
            txn->dt_cid_len);
        if (ctxn != NULL) {
            DTRACE_PROBE2(removing__completed__txn,
                mac_client_impl_t *, mcip,
                dhcpv4_txn_t *, ctxn);

            remove_dhcpv4_completed_txn(mcip, ctxn);
            free_dhcpv4_txn(ctxn);
        }
        next = txn->dt_next;
        txn->dt_next = NULL;

        DTRACE_PROBE2(freeing__txn, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);
        free_dhcpv4_txn(txn);
    }
}

/*
 * Core logic for intercepting outbound DHCPv4 packets.
 */
static boolean_t
intercept_dhcpv4_outbound(mac_client_impl_t *mcip, ipha_t *ipha, uchar_t *end)
{
    struct dhcp     *dh4;
    uchar_t         *opt;
    dhcpv4_txn_t        *txn, *ctxn;
    ipaddr_t        ipaddr;
    uint8_t         opt_len, mtype, cid[DHCP_MAX_OPT_SIZE], cid_len;
    mac_resource_props_t    *mrp = MCIP_RESOURCE_PROPS(mcip);

    if (get_dhcpv4_info(ipha, end, &dh4) != 0)
        return (B_TRUE);

    /* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
    if (allowed_ips_set(mrp, IPV4_VERSION))
        return (B_FALSE);

    if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
        opt_len != 1) {
        DTRACE_PROBE2(mtype__not__found, mac_client_impl_t *, mcip,
            struct dhcp *, dh4);
        return (B_TRUE);
    }
    mtype = *opt;
    if (mtype != REQUEST && mtype != RELEASE) {
        DTRACE_PROBE3(ignored__mtype, mac_client_impl_t *, mcip,
            struct dhcp *, dh4, uint8_t, mtype);
        return (B_TRUE);
    }

    /* client ID is optional for IPv4 */
    if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &opt, &opt_len) == 0 &&
        opt_len >= 2) {
        bcopy(opt, cid, opt_len);
        cid_len = opt_len;
    } else {
        bzero(cid, DHCP_MAX_OPT_SIZE);
        cid_len = 0;
    }

    mutex_enter(&mcip->mci_protect_lock);
    if (mtype == RELEASE) {
        DTRACE_PROBE2(release, mac_client_impl_t *, mcip,
            struct dhcp *, dh4);

        /* flush any completed txn with this cid */
        ctxn = find_dhcpv4_completed_txn(mcip, cid, cid_len);
        if (ctxn != NULL) {
            DTRACE_PROBE2(release__successful, mac_client_impl_t *,
                mcip, struct dhcp *, dh4);

            remove_dhcpv4_completed_txn(mcip, ctxn);
            free_dhcpv4_txn(ctxn);
        }
        goto done;
    }

    /*
     * If a pending txn already exists, we'll update its timestamp so
     * it won't get flushed by the timer. We don't need to create new
     * txns for retransmissions.
     */
    if ((txn = find_dhcpv4_pending_txn(mcip, dh4->xid)) != NULL) {
        DTRACE_PROBE2(update, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);
        txn->dt_timestamp = gethrtime();
        goto done;
    }

    if (get_dhcpv4_option(dh4, end, CD_REQUESTED_IP_ADDR,
        &opt, &opt_len) != 0 || opt_len != sizeof (ipaddr)) {
        DTRACE_PROBE2(ipaddr__not__found, mac_client_impl_t *, mcip,
            struct dhcp *, dh4);
        goto done;
    }
    bcopy(opt, &ipaddr, sizeof (ipaddr));
    if ((txn = create_dhcpv4_txn(dh4->xid, cid, cid_len, ipaddr)) == NULL)
        goto done;

    if (insert_dhcpv4_pending_txn(mcip, txn) != 0) {
        DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);
        free_dhcpv4_txn(txn);
        goto done;
    }
    start_txn_cleanup_timer(mcip);

    DTRACE_PROBE2(txn__pending, mac_client_impl_t *, mcip,
        dhcpv4_txn_t *, txn);

done:
    mutex_exit(&mcip->mci_protect_lock);
    return (B_TRUE);
}

/*
 * Core logic for intercepting inbound DHCPv4 packets.
 */
static void
intercept_dhcpv4_inbound(mac_client_impl_t *mcip, uchar_t *end,
    struct dhcp *dh4)
{
    uchar_t     *opt;
    dhcpv4_txn_t    *txn, *ctxn;
    uint8_t     opt_len, mtype;

    if (get_dhcpv4_option(dh4, end, CD_DHCP_TYPE, &opt, &opt_len) != 0 ||
        opt_len != 1) {
        DTRACE_PROBE2(mtype__not__found, mac_client_impl_t *, mcip,
            struct dhcp *, dh4);
        return;
    }
    mtype = *opt;
    if (mtype != ACK && mtype != NAK) {
        DTRACE_PROBE3(ignored__mtype, mac_client_impl_t *, mcip,
            struct dhcp *, dh4, uint8_t, mtype);
        return;
    }

    mutex_enter(&mcip->mci_protect_lock);
    if ((txn = find_dhcpv4_pending_txn(mcip, dh4->xid)) == NULL) {
        DTRACE_PROBE2(txn__not__found, mac_client_impl_t *, mcip,
            struct dhcp *, dh4);
        goto done;
    }
    remove_dhcpv4_pending_txn(mcip, txn);

    /*
     * We're about to move a txn from the pending table to the completed/
     * dyn-ip tables. If there is an existing completed txn with the
     * same cid as our txn, we need to remove and free it.
     */
    ctxn = find_dhcpv4_completed_txn(mcip, txn->dt_cid, txn->dt_cid_len);
    if (ctxn != NULL) {
        DTRACE_PROBE2(replacing__old__txn, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, ctxn);
        remove_dhcpv4_completed_txn(mcip, ctxn);
        free_dhcpv4_txn(ctxn);
    }
    if (mtype == NAK) {
        DTRACE_PROBE2(nak__received, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);
        free_dhcpv4_txn(txn);
        goto done;
    }
    if (insert_dhcpv4_completed_txn(mcip, txn) != 0) {
        DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
            dhcpv4_txn_t *, txn);
        free_dhcpv4_txn(txn);
        goto done;
    }
    DTRACE_PROBE2(txn__completed, mac_client_impl_t *, mcip,
        dhcpv4_txn_t *, txn);

done:
    mutex_exit(&mcip->mci_protect_lock);
}


/*
 * Comparison functions for the DHCPv6 AVL trees.
 */
static int
compare_dhcpv6_xid(const void *arg1, const void *arg2)
{
    const dhcpv6_txn_t  *txn1 = arg1, *txn2 = arg2;

    if (txn1->dt_xid < txn2->dt_xid)
        return (-1);
    else if (txn1->dt_xid > txn2->dt_xid)
        return (1);
    else
        return (0);
}

static int
compare_dhcpv6_ip(const void *arg1, const void *arg2)
{
    const dhcpv6_addr_t *ip1 = arg1, *ip2 = arg2;
    int         ret;

    ret = memcmp(&ip1->da_addr, &ip2->da_addr, sizeof (in6_addr_t));
    if (ret < 0)
        return (-1);
    else if (ret > 0)
        return (1);
    else
        return (0);
}

static int
compare_dhcpv6_cid(const void *arg1, const void *arg2)
{
    const dhcpv6_cid_t  *cid1 = arg1, *cid2 = arg2;
    int         ret;

    if (cid1->dc_cid_len < cid2->dc_cid_len)
        return (-1);
    else if (cid1->dc_cid_len > cid2->dc_cid_len)
        return (1);

    if (cid1->dc_cid_len == 0)
        return (0);

    ret = memcmp(cid1->dc_cid, cid2->dc_cid, cid1->dc_cid_len);
    if (ret < 0)
        return (-1);
    else if (ret > 0)
        return (1);
    else
        return (0);
}

static int
compare_slaac_ip(const void *arg1, const void *arg2)
{
    const slaac_addr_t  *ip1 = arg1, *ip2 = arg2;
    int         ret;

    ret = memcmp(&ip1->sla_addr, &ip2->sla_addr, sizeof (in6_addr_t));
    if (ret < 0)
        return (-1);
    else if (ret > 0)
        return (1);
    else
        return (0);
}

/*
 * Locate the start of a DHCPv6 header.
 * The possible return values and associated meanings are:
 * 0      - packet is DHCP and has a DHCP header.
 * EINVAL - packet is not DHCP. the recommended action is to let it pass.
 * ENOSPC - packet is a initial fragment that is DHCP or is unidentifiable.
 *          the recommended action is to drop it.
 */
static int
get_dhcpv6_info(ip6_t *ip6h, uchar_t *end, dhcpv6_message_t **dh6)
{
    uint16_t    hdrlen, client, server;
    boolean_t   first_frag = B_FALSE;
    ip6_frag_t  *frag = NULL;
    uint8_t     proto;
    struct udphdr   *udph;
    uchar_t     *dh;

    if (!mac_ip_hdr_length_v6(ip6h, end, &hdrlen, &proto, &frag))
        return (ENOSPC);

    if (proto != IPPROTO_UDP)
        return (EINVAL);

    if (frag != NULL) {
        /*
         * All non-initial fragments may pass because we cannot
         * identify their type. It's safe to let them through
         * because reassembly will fail if we decide to drop the
         * initial fragment.
         */
        if ((ntohs(frag->ip6f_offlg) & ~7) != 0)
            return (EINVAL);
        first_frag = B_TRUE;
    }
    /* drop packets without a udp header */
    udph = (struct udphdr *)((uchar_t *)ip6h + hdrlen);
    if ((uchar_t *)&udph[1] > end)
        return (ENOSPC);

    client = htons(IPPORT_DHCPV6C);
    server = htons(IPPORT_DHCPV6S);
    if (udph->uh_sport != client && udph->uh_sport != server &&
        udph->uh_dport != client && udph->uh_dport != server)
        return (EINVAL);

    /* drop dhcp fragments */
    if (first_frag)
        return (ENOSPC);

    dh = (uchar_t *)&udph[1];
    if (dh + sizeof (dhcpv6_message_t) > end)
        return (EINVAL);

    *dh6 = (dhcpv6_message_t *)dh;
    return (0);
}

static int
get_ra_info(ip6_t *ip6h, uchar_t *end, nd_router_advert_t **ra)
{
    uint16_t        hdrlen;
    ip6_frag_t      *frag = NULL;
    uint8_t         proto;
    uchar_t         *hdrp;
    struct icmp6_hdr    *icmp;

    if (!mac_ip_hdr_length_v6(ip6h, end, &hdrlen, &proto, &frag))
        return (ENOSPC);

    if (proto != IPPROTO_ICMPV6)
        return (EINVAL);

    if (frag != NULL) {
        /*
         * All non-initial fragments may pass because we cannot
         * identify their type. It's safe to let them through
         * because reassembly will fail if we decide to drop the
         * initial fragment.
         */
        if ((ntohs(frag->ip6f_offlg) & ~7) != 0)
            return (EINVAL);
        return (ENOSPC);
    }

    /*
     * Ensure that the ICMP header falls w/in packet boundaries, in case
     * we've received a malicious packet that reports incorrect lengths.
     */
    hdrp = (uchar_t *)ip6h + hdrlen;
    if ((hdrp + sizeof (struct icmp6_hdr)) > end) {
        return (EINVAL);
    }
    icmp = (struct icmp6_hdr *)hdrp;

    if (icmp->icmp6_type != ND_ROUTER_ADVERT ||
        icmp->icmp6_code != 0)
        return (EINVAL);

    *ra = (nd_router_advert_t *)icmp;
    return (0);
}

/*
 * Find the specified DHCPv6 option.
 */
static dhcpv6_option_t *
get_dhcpv6_option(void *buf, size_t buflen, dhcpv6_option_t *oldopt,
    uint16_t codenum, uint_t *retlenp)
{
    uchar_t     *bp;
    dhcpv6_option_t d6o;
    uint_t      olen;

    codenum = htons(codenum);
    bp = buf;
    while (buflen >= sizeof (dhcpv6_option_t)) {
        bcopy(bp, &d6o, sizeof (d6o));
        olen = ntohs(d6o.d6o_len) + sizeof (d6o);
        if (olen > buflen)
            break;
        if (d6o.d6o_code != codenum || d6o.d6o_len == 0 ||
            (oldopt != NULL && bp <= (uchar_t *)oldopt)) {
            bp += olen;
            buflen -= olen;
            continue;
        }
        if (retlenp != NULL)
            *retlenp = olen;
        /* LINTED : alignment */
        return ((dhcpv6_option_t *)bp);
    }
    return (NULL);
}

/*
 * Get the status code from a reply message.
 */
static int
get_dhcpv6_status(dhcpv6_message_t *dh6, uchar_t *end, uint16_t *status)
{
    dhcpv6_option_t *d6o;
    uint_t      olen;
    uint16_t    s;

    d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
        DHCPV6_OPT_STATUS_CODE, &olen);

    /* Success is implied if status code is missing */
    if (d6o == NULL) {
        *status = DHCPV6_STAT_SUCCESS;
        return (0);
    }
    if ((uchar_t *)d6o + olen > end)
        return (EINVAL);

    olen -= sizeof (*d6o);
    if (olen < sizeof (s))
        return (EINVAL);

    bcopy(&d6o[1], &s, sizeof (s));
    *status = ntohs(s);
    return (0);
}

/*
 * Get the addresses from a reply message.
 */
static int
get_dhcpv6_addrs(dhcpv6_message_t *dh6, uchar_t *end, dhcpv6_cid_t *cid)
{
    dhcpv6_option_t     *d6o;
    dhcpv6_addr_t       *next;
    uint_t          olen;

    d6o = NULL;
    while ((d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1],
        d6o, DHCPV6_OPT_IA_NA, &olen)) != NULL) {
        dhcpv6_option_t     *d6so;
        dhcpv6_iaaddr_t     d6ia;
        dhcpv6_addr_t       **addrp;
        uchar_t         *obase;
        uint_t          solen;

        if (olen < sizeof (dhcpv6_ia_na_t) ||
            (uchar_t *)d6o + olen > end)
            goto fail;

        obase = (uchar_t *)d6o + sizeof (dhcpv6_ia_na_t);
        olen -= sizeof (dhcpv6_ia_na_t);
        d6so = NULL;
        while ((d6so = get_dhcpv6_option(obase, olen, d6so,
            DHCPV6_OPT_IAADDR, &solen)) != NULL) {
            if (solen < sizeof (dhcpv6_iaaddr_t) ||
                (uchar_t *)d6so + solen > end)
                goto fail;

            bcopy(d6so, &d6ia, sizeof (d6ia));
            for (addrp = &cid->dc_addr; *addrp != NULL;
                addrp = &(*addrp)->da_next) {
                if (bcmp(&(*addrp)->da_addr, &d6ia.d6ia_addr,
                    sizeof (in6_addr_t)) == 0)
                    goto fail;
            }
            if ((*addrp = kmem_zalloc(sizeof (dhcpv6_addr_t),
                KM_NOSLEEP)) == NULL)
                goto fail;

            bcopy(&d6ia.d6ia_addr, &(*addrp)->da_addr,
                sizeof (in6_addr_t));
            cid->dc_addrcnt++;
        }
    }
    if (cid->dc_addrcnt == 0)
        return (ENOENT);

    return (0);

fail:
    for (; cid->dc_addr != NULL; cid->dc_addr = next) {
        next = cid->dc_addr->da_next;
        kmem_free(cid->dc_addr, sizeof (dhcpv6_addr_t));
        cid->dc_addrcnt--;
    }
    ASSERT(cid->dc_addrcnt == 0);
    return (EINVAL);
}

/*
 * Free a cid.
 * Before this gets called the caller must ensure that all the
 * addresses are removed from the mci_v6_dyn_ip table.
 */
static void
free_dhcpv6_cid(dhcpv6_cid_t *cid)
{
    dhcpv6_addr_t   *addr, *next;
    uint_t      cnt = 0;

    kmem_free(cid->dc_cid, cid->dc_cid_len);
    for (addr = cid->dc_addr; addr != NULL; addr = next) {
        next = addr->da_next;
        kmem_free(addr, sizeof (*addr));
        cnt++;
    }
    ASSERT(cnt == cid->dc_addrcnt);
    kmem_free(cid, sizeof (*cid));
}

/*
 * Extract the DUID from a message. The associated addresses will be
 * extracted later from the reply message.
 */
static dhcpv6_cid_t *
create_dhcpv6_cid(dhcpv6_message_t *dh6, uchar_t *end)
{
    dhcpv6_option_t     *d6o;
    dhcpv6_cid_t        *cid;
    uchar_t         *rawcid;
    uint_t          olen, rawcidlen;

    d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
        DHCPV6_OPT_CLIENTID, &olen);
    if (d6o == NULL || (uchar_t *)d6o + olen > end)
        return (NULL);

    rawcidlen = olen - sizeof (*d6o);
    if ((rawcid = kmem_zalloc(rawcidlen, KM_NOSLEEP)) == NULL)
        return (NULL);
    bcopy(d6o + 1, rawcid, rawcidlen);

    if ((cid = kmem_zalloc(sizeof (*cid), KM_NOSLEEP)) == NULL) {
        kmem_free(rawcid, rawcidlen);
        return (NULL);
    }
    cid->dc_cid = rawcid;
    cid->dc_cid_len = rawcidlen;
    return (cid);
}

/*
 * Remove a cid from mci_v6_cid. The addresses owned by the cid
 * are also removed from mci_v6_dyn_ip.
 */
static void
remove_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
{
    dhcpv6_addr_t   *addr, *tmp_addr;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    avl_remove(&mcip->mci_v6_cid, cid);
    for (addr = cid->dc_addr; addr != NULL; addr = addr->da_next) {
        tmp_addr = avl_find(&mcip->mci_v6_dyn_ip, addr, NULL);
        if (tmp_addr == addr)
            avl_remove(&mcip->mci_v6_dyn_ip, addr);
    }
}

/*
 * Find and remove a matching cid and associated addresses from
 * their respective tables.
 */
static void
release_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
{
    dhcpv6_cid_t    *oldcid;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if ((oldcid = avl_find(&mcip->mci_v6_cid, cid, NULL)) == NULL)
        return;

    /*
     * Since cid belongs to a pending txn, it can't possibly be in
     * mci_v6_cid. Anything that's found must be an existing cid.
     */
    ASSERT(oldcid != cid);
    remove_dhcpv6_cid(mcip, oldcid);
    free_dhcpv6_cid(oldcid);
}

/*
 * Insert cid into mci_v6_cid.
 */
static int
insert_dhcpv6_cid(mac_client_impl_t *mcip, dhcpv6_cid_t *cid)
{
    avl_index_t where;
    dhcpv6_addr_t   *addr;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if (avl_find(&mcip->mci_v6_cid, cid, &where) != NULL)
        return (EEXIST);

    if (avl_numnodes(&mcip->mci_v6_cid) >= dhcp_max_completed_txn) {
        BUMP_STAT(mcip, dhcpdropped);
        return (EAGAIN);
    }
    avl_insert(&mcip->mci_v6_cid, cid, where);
    for (addr = cid->dc_addr; addr != NULL; addr = addr->da_next) {
        if (avl_find(&mcip->mci_v6_dyn_ip, addr, &where) != NULL)
            goto fail;

        avl_insert(&mcip->mci_v6_dyn_ip, addr, where);
    }
    return (0);

fail:
    remove_dhcpv6_cid(mcip, cid);
    return (EEXIST);
}

/*
 * Check whether an IP address is in the dyn-ip table.
 */
static boolean_t
check_dhcpv6_dyn_ip(mac_client_impl_t *mcip, in6_addr_t *addr)
{
    dhcpv6_addr_t   tmp_addr, *a;

    mutex_enter(&mcip->mci_protect_lock);
    bcopy(addr, &tmp_addr.da_addr, sizeof (in6_addr_t));
    a = avl_find(&mcip->mci_v6_dyn_ip, &tmp_addr, NULL);
    mutex_exit(&mcip->mci_protect_lock);
    return (a != NULL);
}

static dhcpv6_txn_t *
find_dhcpv6_pending_txn(mac_client_impl_t *mcip, uint32_t xid)
{
    dhcpv6_txn_t    tmp_txn;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    tmp_txn.dt_xid = xid;
    return (avl_find(&mcip->mci_v6_pending_txn, &tmp_txn, NULL));
}

static void
remove_dhcpv6_pending_txn(mac_client_impl_t *mcip, dhcpv6_txn_t *txn)
{
    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    avl_remove(&mcip->mci_v6_pending_txn, txn);
}

static dhcpv6_txn_t *
create_dhcpv6_txn(uint32_t xid, dhcpv6_cid_t *cid)
{
    dhcpv6_txn_t    *txn;

    if ((txn = kmem_zalloc(sizeof (dhcpv6_txn_t), KM_NOSLEEP)) == NULL)
        return (NULL);

    txn->dt_xid = xid;
    txn->dt_cid = cid;
    txn->dt_timestamp = gethrtime();
    return (txn);
}

static void
free_dhcpv6_txn(dhcpv6_txn_t *txn)
{
    if (txn->dt_cid != NULL)
        free_dhcpv6_cid(txn->dt_cid);
    kmem_free(txn, sizeof (dhcpv6_txn_t));
}

static int
insert_dhcpv6_pending_txn(mac_client_impl_t *mcip, dhcpv6_txn_t *txn)
{
    avl_index_t where;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if (avl_find(&mcip->mci_v6_pending_txn, txn, &where) != NULL)
        return (EEXIST);

    if (avl_numnodes(&mcip->mci_v6_pending_txn) >= dhcp_max_pending_txn) {
        BUMP_STAT(mcip, dhcpdropped);
        return (EAGAIN);
    }
    avl_insert(&mcip->mci_v6_pending_txn, txn, where);
    return (0);
}

/*
 * Clean up all v6 tables.
 */
static void
flush_dhcpv6(mac_client_impl_t *mcip)
{
    void        *cookie = NULL;
    dhcpv6_cid_t    *cid;
    dhcpv6_txn_t    *txn;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    while (avl_destroy_nodes(&mcip->mci_v6_dyn_ip, &cookie) != NULL) {
    }
    cookie = NULL;
    while ((cid = avl_destroy_nodes(&mcip->mci_v6_cid, &cookie)) != NULL) {
        free_dhcpv6_cid(cid);
    }
    cookie = NULL;
    while ((txn = avl_destroy_nodes(&mcip->mci_v6_pending_txn,
        &cookie)) != NULL) {
        free_dhcpv6_txn(txn);
    }
}

void
flush_slaac(mac_client_impl_t *mcip)
{
    void        *cookie = NULL;
    slaac_addr_t    *addr = NULL;

    while ((addr = avl_destroy_nodes(&mcip->mci_v6_slaac_ip, &cookie)) !=
        NULL) {
        kmem_free(addr, sizeof (slaac_addr_t));
    }
}

/*
 * Cleanup stale DHCPv6 transactions.
 */
static void
txn_cleanup_v6(mac_client_impl_t *mcip)
{
    dhcpv6_txn_t        *txn, *next, *txn_list = NULL;

    /*
     * Find stale pending transactions and place them on a list
     * to be removed.
     */
    for (txn = avl_first(&mcip->mci_v6_pending_txn); txn != NULL;
        txn = avl_walk(&mcip->mci_v6_pending_txn, txn, AVL_AFTER)) {
        if (gethrtime() - txn->dt_timestamp > txn_cleanup_interval) {
            DTRACE_PROBE2(found__expired__txn,
                mac_client_impl_t *, mcip,
                dhcpv6_txn_t *, txn);

            txn->dt_next = txn_list;
            txn_list = txn;
        }
    }

    /*
     * Remove and free stale pending transactions.
     * Release any existing cids matching the stale transactions.
     */
    for (txn = txn_list; txn != NULL; txn = next) {
        avl_remove(&mcip->mci_v6_pending_txn, txn);
        release_dhcpv6_cid(mcip, txn->dt_cid);
        next = txn->dt_next;
        txn->dt_next = NULL;

        DTRACE_PROBE2(freeing__txn, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);
        free_dhcpv6_txn(txn);
    }

}

/*
 * Core logic for intercepting outbound DHCPv6 packets.
 */
static boolean_t
intercept_dhcpv6_outbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end)
{
    dhcpv6_message_t    *dh6;
    dhcpv6_txn_t        *txn;
    dhcpv6_cid_t        *cid = NULL;
    uint32_t        xid;
    uint8_t         mtype;
    mac_resource_props_t *mrp = MCIP_RESOURCE_PROPS(mcip);

    if (get_dhcpv6_info(ip6h, end, &dh6) != 0)
        return (B_TRUE);

    /* ip_nospoof/allowed-ips and DHCP are mutually exclusive by default */
    if (allowed_ips_set(mrp, IPV6_VERSION))
        return (B_FALSE);

    /*
     * We want to act on packets that result in DHCPv6 Reply messages, or
     * on packets that give up an IPv6 address. For example, a Request or
     * Solicit (w/ the Rapid Commit option) will cause the server to send a
     * Reply, ending the transaction.
     */
    mtype = dh6->d6m_msg_type;
    if (mtype != DHCPV6_MSG_SOLICIT && mtype != DHCPV6_MSG_REQUEST &&
        mtype != DHCPV6_MSG_RENEW && mtype != DHCPV6_MSG_REBIND &&
        mtype != DHCPV6_MSG_RELEASE)
        return (B_TRUE);

    if ((cid = create_dhcpv6_cid(dh6, end)) == NULL)
        return (B_TRUE);

    mutex_enter(&mcip->mci_protect_lock);
    if (mtype == DHCPV6_MSG_RELEASE) {
        release_dhcpv6_cid(mcip, cid);
        goto done;
    }
    xid = DHCPV6_GET_TRANSID(dh6);
    if ((txn = find_dhcpv6_pending_txn(mcip, xid)) != NULL) {
        DTRACE_PROBE2(update, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);
        txn->dt_timestamp = gethrtime();
        goto done;
    }
    if ((txn = create_dhcpv6_txn(xid, cid)) == NULL)
        goto done;

    cid = NULL;
    if (insert_dhcpv6_pending_txn(mcip, txn) != 0) {
        DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);
        free_dhcpv6_txn(txn);
        goto done;
    }
    start_txn_cleanup_timer(mcip);

    DTRACE_PROBE2(txn__pending, mac_client_impl_t *, mcip,
        dhcpv6_txn_t *, txn);

done:
    if (cid != NULL)
        free_dhcpv6_cid(cid);

    mutex_exit(&mcip->mci_protect_lock);
    return (B_TRUE);
}

/*
 * Core logic for intercepting inbound DHCPv6 packets.
 */
static void
intercept_dhcpv6_inbound(mac_client_impl_t *mcip, uchar_t *end,
    dhcpv6_message_t *dh6)
{
    dhcpv6_txn_t        *txn;
    uint32_t        xid;
    uint8_t         mtype;
    uint16_t        status;

    mtype = dh6->d6m_msg_type;
    if (mtype != DHCPV6_MSG_REPLY)
        return;

    mutex_enter(&mcip->mci_protect_lock);
    xid = DHCPV6_GET_TRANSID(dh6);
    if ((txn = find_dhcpv6_pending_txn(mcip, xid)) == NULL) {
        DTRACE_PROBE2(txn__not__found, mac_client_impl_t *, mcip,
            dhcpv6_message_t *, dh6);
        goto done;
    }
    remove_dhcpv6_pending_txn(mcip, txn);
    release_dhcpv6_cid(mcip, txn->dt_cid);

    if (get_dhcpv6_status(dh6, end, &status) != 0 ||
        status != DHCPV6_STAT_SUCCESS) {
        DTRACE_PROBE2(error__status, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);
        goto done;
    }
    if (get_dhcpv6_addrs(dh6, end, txn->dt_cid) != 0) {
        DTRACE_PROBE2(no__addrs, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);
        goto done;
    }
    if (insert_dhcpv6_cid(mcip, txn->dt_cid) != 0) {
        DTRACE_PROBE2(insert__failed, mac_client_impl_t *, mcip,
            dhcpv6_txn_t *, txn);
        goto done;
    }
    DTRACE_PROBE2(txn__completed, mac_client_impl_t *, mcip,
        dhcpv6_txn_t *, txn);

    txn->dt_cid = NULL;

done:
    if (txn != NULL)
        free_dhcpv6_txn(txn);
    mutex_exit(&mcip->mci_protect_lock);
}

/*
 * Check whether an IP address is in the SLAAC table.
 */
static boolean_t
check_slaac_ip(mac_client_impl_t *mcip, in6_addr_t *addr)
{
    slaac_addr_t    tmp_addr, *a;

    mutex_enter(&mcip->mci_protect_lock);
    bcopy(addr, &tmp_addr.sla_addr, sizeof (in6_addr_t));
    a = avl_find(&mcip->mci_v6_slaac_ip, &tmp_addr, NULL);
    mutex_exit(&mcip->mci_protect_lock);
    return (a != NULL);
}

static boolean_t
insert_slaac_ip(avl_tree_t *tree, in6_addr_t *token, slaac_addr_t *addr)
{
    uint_t      i;
    avl_index_t where;
    in6_addr_t  *prefix = &addr->sla_prefix;
    in6_addr_t  *in6p = &addr->sla_addr;

    bcopy(prefix, in6p, sizeof (struct in6_addr));

    for (i = 0; i < 4; i++) {
        in6p->s6_addr32[i] = token->s6_addr32[i] |
            in6p->s6_addr32[i];
    }

    DTRACE_PROBE1(generated__addr, in6_addr_t *, in6p);

    if (avl_find(tree, addr, &where) != NULL)
        return (B_FALSE);

    avl_insert(tree, addr, where);
    return (B_TRUE);
}

static void
insert_slaac_prefix(mac_client_impl_t *mcip, nd_opt_prefix_info_t *po)
{
    slaac_addr_t    *addr = NULL;
    in6_addr_t  *token = &mcip->mci_v6_mac_token;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));

    if (avl_numnodes(&mcip->mci_v6_slaac_ip) >= slaac_max_allowed) {
        DTRACE_PROBE(limit__reached);
        return;
    }

    if ((addr = kmem_zalloc(sizeof (slaac_addr_t),
        KM_NOSLEEP | KM_NORMALPRI)) == NULL)
        return;

    bcopy(&po->nd_opt_pi_prefix, &addr->sla_prefix,
        sizeof (struct in6_addr));

    if (!insert_slaac_ip(&mcip->mci_v6_slaac_ip, token, addr)) {
        kmem_free(addr, sizeof (slaac_addr_t));
    }
}

static void
intercept_prefix_info(mac_client_impl_t *mcip, nd_opt_prefix_info_t *po)
{
    if (8 * po->nd_opt_pi_len != sizeof (nd_opt_prefix_info_t)) {
        DTRACE_PROBE(invalid__length);
        return;
    }

    if (po->nd_opt_pi_prefix_len > 128) {
        DTRACE_PROBE(invalid__plen);
        return;
    }

    if (IN6_IS_ADDR_LINKLOCAL(&po->nd_opt_pi_prefix)) {
        DTRACE_PROBE(link__local);
        return;
    }

    if ((po->nd_opt_pi_flags_reserved & ND_OPT_PI_FLAG_AUTO) == 0)
        return;

    mutex_enter(&mcip->mci_protect_lock);
    insert_slaac_prefix(mcip, po);
    mutex_exit(&mcip->mci_protect_lock);
}

/*
 * If we receive a Router Advertisement carrying prefix information and
 * indicating that SLAAC should be performed, then track the prefix.
 */
static void
intercept_ra_inbound(mac_client_impl_t *mcip, ip6_t *ip6h, uchar_t *end,
    nd_router_advert_t *ra)
{
    struct nd_opt_hdr *opt;
    int len, optlen;

    if (ip6h->ip6_hlim != 255) {
        DTRACE_PROBE1(invalid__hoplimit, uint8_t, ip6h->ip6_hlim);
        return;
    }

    len = ip6h->ip6_plen - sizeof (nd_router_advert_t);
    opt = (struct nd_opt_hdr *)&ra[1];
    while (len >= sizeof (struct nd_opt_hdr) &&
        ((uchar_t *)opt + sizeof (struct nd_opt_hdr)) <= end) {
        optlen = opt->nd_opt_len * 8;

        if (optlen < sizeof (struct nd_opt_hdr) ||
            ((uchar_t *)opt + optlen) > end) {
            DTRACE_PROBE(invalid__length);
            return;
        }

        if (opt->nd_opt_type == ND_OPT_PREFIX_INFORMATION) {
            intercept_prefix_info(mcip,
                (nd_opt_prefix_info_t *)opt);
        }

        opt = (struct nd_opt_hdr *)((char *)opt + optlen);
        len -= optlen;
    }
}

/*
 * Timer for cleaning up stale transactions.
 */
static void
txn_cleanup_timer(void *arg)
{
    mac_client_impl_t   *mcip = arg;

    mutex_enter(&mcip->mci_protect_lock);
    if (mcip->mci_txn_cleanup_tid == 0) {
        /* do nothing if timer got cancelled */
        mutex_exit(&mcip->mci_protect_lock);
        return;
    }
    mcip->mci_txn_cleanup_tid = 0;

    txn_cleanup_v4(mcip);
    txn_cleanup_v6(mcip);

    /*
     * Restart timer if pending transactions still exist.
     */
    if (!avl_is_empty(&mcip->mci_v4_pending_txn) ||
        !avl_is_empty(&mcip->mci_v6_pending_txn)) {
        DTRACE_PROBE1(restarting__timer, mac_client_impl_t *, mcip);

        mcip->mci_txn_cleanup_tid = timeout(txn_cleanup_timer, mcip,
            drv_usectohz(txn_cleanup_interval / (NANOSEC / MICROSEC)));
    }
    mutex_exit(&mcip->mci_protect_lock);
}

static void
start_txn_cleanup_timer(mac_client_impl_t *mcip)
{
    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));
    if (mcip->mci_txn_cleanup_tid == 0) {
        mcip->mci_txn_cleanup_tid = timeout(txn_cleanup_timer, mcip,
            drv_usectohz(txn_cleanup_interval / (NANOSEC / MICROSEC)));
    }
}

static void
cancel_txn_cleanup_timer(mac_client_impl_t *mcip)
{
    timeout_id_t    tid;

    ASSERT(MUTEX_HELD(&mcip->mci_protect_lock));

    /*
     * This needs to be a while loop because the timer could get
     * rearmed during untimeout().
     */
    while ((tid = mcip->mci_txn_cleanup_tid) != 0) {
        mcip->mci_txn_cleanup_tid = 0;
        mutex_exit(&mcip->mci_protect_lock);
        (void) untimeout(tid);
        mutex_enter(&mcip->mci_protect_lock);
    }
}

/*
 * Get the start/end pointers of an L3 packet and also do pullup if needed.
 * pulled-up packet needs to be freed by the caller.
 */
static int
get_l3_info(mblk_t *mp, size_t hdrsize, uchar_t **start, uchar_t **end,
    mblk_t **nmp)
{
    uchar_t *s, *e;
    mblk_t  *newmp = NULL;

    /*
     * Pullup if necessary but reject packets that do not have
     * a proper mac header.
     */
    s = mp->b_rptr + hdrsize;
    e = mp->b_wptr;

    if (s > mp->b_wptr)
        return (EINVAL);

    if (!OK_32PTR(s) || mp->b_cont != NULL) {
        /*
         * Temporarily adjust mp->b_rptr to ensure proper
         * alignment of IP header in newmp.
         */
        DTRACE_PROBE1(pullup__needed, mblk_t *, mp);

        mp->b_rptr += hdrsize;
        newmp = msgpullup(mp, -1);
        mp->b_rptr -= hdrsize;

        if (newmp == NULL)
            return (ENOMEM);

        s = newmp->b_rptr;
        e = newmp->b_wptr;
    }

    *start = s;
    *end = e;
    *nmp = newmp;
    return (0);
}

void
mac_protect_intercept_dynamic_one(mac_client_impl_t *mcip, mblk_t *mp)
{
    mac_impl_t      *mip = mcip->mci_mip;
    uchar_t         *start, *end;
    mblk_t          *nmp = NULL;
    mac_header_info_t   mhi;
    int         err;

    err = mac_vlan_header_info((mac_handle_t)mip, mp, &mhi);
    if (err != 0) {
        DTRACE_PROBE2(invalid__header, mac_client_impl_t *, mcip,
            mblk_t *, mp);
        return;
    }

    err = get_l3_info(mp, mhi.mhi_hdrsize, &start, &end, &nmp);
    if (err != 0) {
        DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
            mblk_t *, mp);
        return;
    }

    switch (mhi.mhi_bindsap) {
    case ETHERTYPE_IP: {
        struct dhcp *dh4;
        ipha_t      *ipha = (ipha_t *)start;

        if (start + sizeof (ipha_t) > end)
            return;

        if (get_dhcpv4_info(ipha, end, &dh4) == 0) {
            intercept_dhcpv4_inbound(mcip, end, dh4);
        }
        break;
    }
    case ETHERTYPE_IPV6: {
        dhcpv6_message_t    *dh6;
        nd_router_advert_t  *ra;
        ip6_t           *ip6h = (ip6_t *)start;

        if (start + sizeof (ip6_t) > end)
            return;

        if (get_dhcpv6_info(ip6h, end, &dh6) == 0) {
            intercept_dhcpv6_inbound(mcip, end, dh6);
        } else if (get_ra_info(ip6h, end, &ra) == 0) {
            intercept_ra_inbound(mcip, ip6h, end, ra);
        }

        break;
    }
    }
    freemsg(nmp);
}

void
mac_protect_intercept_dynamic(mac_client_impl_t *mcip, mblk_t *mp)
{
    /*
     * Skip checks if we are part of an aggr.
     */
    if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
        return;

    for (; mp != NULL; mp = mp->b_next)
        mac_protect_intercept_dynamic_one(mcip, mp);
}

void
mac_protect_flush_dynamic(mac_client_impl_t *mcip)
{
    mutex_enter(&mcip->mci_protect_lock);
    flush_dhcpv4(mcip);
    flush_dhcpv6(mcip);
    flush_slaac(mcip);
    mutex_exit(&mcip->mci_protect_lock);
}

void
mac_protect_cancel_timer(mac_client_impl_t *mcip)
{
    mutex_enter(&mcip->mci_protect_lock);
    cancel_txn_cleanup_timer(mcip);
    mutex_exit(&mcip->mci_protect_lock);
}

/*
 * Check if addr is in the 'allowed-ips' list.
 */

/* ARGSUSED */
static boolean_t
ipnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *protect,
    ipaddr_t *addr)
{
    uint_t  i;

    /*
     * The unspecified address is allowed.
     */
    if (*addr == INADDR_ANY)
        return (B_TRUE);

    for (i = 0; i < protect->mp_ipaddrcnt; i++) {
        mac_ipaddr_t    *v4addr = &protect->mp_ipaddrs[i];

        if (v4addr->ip_version == IPV4_VERSION) {
            uint32_t mask;

            /* LINTED E_SUSPICIOUS_COMPARISON */
            ASSERT(v4addr->ip_netmask >= 0 &&
                v4addr->ip_netmask <= 32);
            mask = 0xFFFFFFFFu << (32 - v4addr->ip_netmask);
            /*
             * Since we have a netmask we know this entry
             * signifies the entire subnet. Check if the
             * given address is on the subnet.
             */
            if (htonl(V4_PART_OF_V6(v4addr->ip_addr)) ==
                (htonl(*addr) & mask))
                return (B_TRUE);
        }
    }
    return (protect->mp_ipaddrcnt == 0 ?
        check_dhcpv4_dyn_ip(mcip, *addr) : B_FALSE);
}

static boolean_t
ipnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *protect,
    in6_addr_t *addr)
{
    uint_t  i;

    /*
     * The unspecified address and the v6 link local address are allowed.
     */
    if (IN6_IS_ADDR_UNSPECIFIED(addr) ||
        ((mcip->mci_protect_flags & MPT_FLAG_V6_LOCAL_ADDR_SET) != 0 &&
        IN6_ARE_ADDR_EQUAL(&mcip->mci_v6_local_addr, addr)))
        return (B_TRUE);


    for (i = 0; i < protect->mp_ipaddrcnt; i++) {
        mac_ipaddr_t    *v6addr = &protect->mp_ipaddrs[i];

        if (v6addr->ip_version == IPV6_VERSION &&
            /* LINTED E_SUSPICIOUS_COMPARISON */
            IN6_ARE_PREFIXEDADDR_EQUAL(&v6addr->ip_addr, addr,
            v6addr->ip_netmask))
            return (B_TRUE);
    }

    if (protect->mp_ipaddrcnt == 0) {
        return (check_slaac_ip(mcip, addr) ||
            check_dhcpv6_dyn_ip(mcip, addr));
    } else {
        return (B_FALSE);
    }
}

/*
 * Checks various fields within an IPv6 NDP packet.
 */
static boolean_t
ipnospoof_check_ndp(mac_client_impl_t *mcip, mac_protect_t *protect,
    ip6_t *ip6h, uchar_t *end)
{
    icmp6_t         *icmp_nd = (icmp6_t *)&ip6h[1];
    int         hdrlen, optlen, opttype, len;
    uint_t          addrlen, maclen;
    uint8_t         type;
    nd_opt_hdr_t        *opt;
    struct nd_opt_lla   *lla = NULL;

    /*
     * NDP packets do not have extension headers so the ICMPv6 header
     * must immediately follow the IPv6 header.
     */
    if (ip6h->ip6_nxt != IPPROTO_ICMPV6)
        return (B_TRUE);

    /* ICMPv6 header missing */
    if ((uchar_t *)&icmp_nd[1] > end)
        return (B_FALSE);

    len = end - (uchar_t *)icmp_nd;
    type = icmp_nd->icmp6_type;

    switch (type) {
    case ND_ROUTER_SOLICIT:
        hdrlen = sizeof (nd_router_solicit_t);
        break;
    case ND_ROUTER_ADVERT:
        hdrlen = sizeof (nd_router_advert_t);
        break;
    case ND_NEIGHBOR_SOLICIT:
        hdrlen = sizeof (nd_neighbor_solicit_t);
        break;
    case ND_NEIGHBOR_ADVERT:
        hdrlen = sizeof (nd_neighbor_advert_t);
        break;
    case ND_REDIRECT:
        hdrlen = sizeof (nd_redirect_t);
        break;
    default:
        return (B_TRUE);
    }

    if (len < hdrlen)
        return (B_FALSE);

    /* SLLA option checking is needed for RS/RA/NS */
    opttype = ND_OPT_SOURCE_LINKADDR;

    switch (type) {
    case ND_NEIGHBOR_ADVERT: {
        nd_neighbor_advert_t    *na = (nd_neighbor_advert_t *)icmp_nd;

        if (!ipnospoof_check_v6(mcip, protect, &na->nd_na_target)) {
            DTRACE_PROBE2(ndp__na__fail,
                mac_client_impl_t *, mcip, ip6_t *, ip6h);
            return (B_FALSE);
        }

        /* TLLA option for NA */
        opttype = ND_OPT_TARGET_LINKADDR;
        break;
    }
    case ND_REDIRECT: {
        /* option checking not needed for RD */
        return (B_TRUE);
    }
    default:
        break;
    }

    if (len == hdrlen) {
        /* no options, we're done */
        return (B_TRUE);
    }
    opt = (nd_opt_hdr_t *)((uchar_t *)icmp_nd + hdrlen);
    optlen = len - hdrlen;

    /* find the option header we need */
    while (optlen > sizeof (nd_opt_hdr_t)) {
        if (opt->nd_opt_type == opttype) {
            lla = (struct nd_opt_lla *)opt;
            break;
        }
        optlen -= 8 * opt->nd_opt_len;
        opt = (nd_opt_hdr_t *)
            ((uchar_t *)opt + 8 * opt->nd_opt_len);
    }
    if (lla == NULL)
        return (B_TRUE);

    addrlen = lla->nd_opt_lla_len * 8 - sizeof (nd_opt_hdr_t);
    maclen = mcip->mci_mip->mi_info.mi_addr_length;

    if (addrlen != maclen ||
        bcmp(mcip->mci_unicast->ma_addr,
        lla->nd_opt_lla_hdw_addr, maclen) != 0) {
        DTRACE_PROBE2(ndp__lla__fail,
            mac_client_impl_t *, mcip, ip6_t *, ip6h);
        return (B_FALSE);
    }

    DTRACE_PROBE2(ndp__lla__ok, mac_client_impl_t *, mcip, ip6_t *, ip6h);
    return (B_TRUE);
}

/*
 * Enforce ip-nospoof protection.
 */
static int
ipnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
    mblk_t *mp, mac_header_info_t *mhip)
{
    size_t      hdrsize = mhip->mhi_hdrsize;
    uint32_t    sap = mhip->mhi_bindsap;
    uchar_t     *start, *end;
    mblk_t      *nmp = NULL;
    int     err;

    err = get_l3_info(mp, hdrsize, &start, &end, &nmp);
    if (err != 0) {
        DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
            mblk_t *, mp);
        return (err);
    }
    err = EINVAL;

    switch (sap) {
    case ETHERTYPE_IP: {
        ipha_t  *ipha = (ipha_t *)start;

        if (start + sizeof (ipha_t) > end)
            goto fail;

        if (!ipnospoof_check_v4(mcip, protect, &ipha->ipha_src))
            goto fail;

        if (!intercept_dhcpv4_outbound(mcip, ipha, end))
            goto fail;
        break;
    }
    case ETHERTYPE_ARP: {
        arh_t       *arh = (arh_t *)start;
        uint32_t    maclen, hlen, plen, arplen;
        ipaddr_t    spaddr;
        uchar_t     *shaddr;

        if (start + sizeof (arh_t) > end)
            goto fail;

        maclen = mcip->mci_mip->mi_info.mi_addr_length;
        hlen = arh->arh_hlen;
        plen = arh->arh_plen;
        if ((hlen != 0 && hlen != maclen) ||
            plen != sizeof (ipaddr_t))
            goto fail;

        arplen = sizeof (arh_t) + 2 * hlen + 2 * plen;
        if (start + arplen > end)
            goto fail;

        shaddr = start + sizeof (arh_t);
        if (hlen != 0 &&
            bcmp(mcip->mci_unicast->ma_addr, shaddr, maclen) != 0)
            goto fail;

        bcopy(shaddr + hlen, &spaddr, sizeof (spaddr));
        if (!ipnospoof_check_v4(mcip, protect, &spaddr))
            goto fail;
        break;
    }
    case ETHERTYPE_IPV6: {
        ip6_t       *ip6h = (ip6_t *)start;

        if (start + sizeof (ip6_t) > end)
            goto fail;

        if (!ipnospoof_check_v6(mcip, protect, &ip6h->ip6_src))
            goto fail;

        if (!ipnospoof_check_ndp(mcip, protect, ip6h, end))
            goto fail;

        if (!intercept_dhcpv6_outbound(mcip, ip6h, end))
            goto fail;
        break;
    }
    }
    freemsg(nmp);
    return (0);

fail:
    freemsg(nmp);
    return (err);
}

static boolean_t
dhcpnospoof_check_cid(mac_protect_t *p, uchar_t *cid, uint_t cidlen)
{
    int i;

    for (i = 0; i < p->mp_cidcnt; i++) {
        mac_dhcpcid_t   *dcid = &p->mp_cids[i];

        if (dcid->dc_len == cidlen &&
            bcmp(dcid->dc_id, cid, cidlen) == 0)
            return (B_TRUE);
    }
    return (B_FALSE);
}

static boolean_t
dhcpnospoof_check_v4(mac_client_impl_t *mcip, mac_protect_t *p,
    ipha_t *ipha, uchar_t *end)
{
    struct dhcp *dh4;
    uchar_t     *cid;
    uint_t      maclen, cidlen = 0;
    uint8_t     optlen;
    int     err;

    if ((err = get_dhcpv4_info(ipha, end, &dh4)) != 0)
        return (err == EINVAL);

    maclen = mcip->mci_mip->mi_info.mi_addr_length;
    if (dh4->hlen == maclen &&
        bcmp(mcip->mci_unicast->ma_addr, dh4->chaddr, maclen) != 0) {
        return (B_FALSE);
    }
    if (get_dhcpv4_option(dh4, end, CD_CLIENT_ID, &cid, &optlen) == 0)
        cidlen = optlen;

    if (cidlen == 0)
        return (B_TRUE);

    if (*cid == ARPHRD_ETHER && cidlen - 1 == maclen &&
        bcmp(mcip->mci_unicast->ma_addr, cid + 1, maclen) == 0)
        return (B_TRUE);

    return (dhcpnospoof_check_cid(p, cid, cidlen));
}

static boolean_t
dhcpnospoof_check_v6(mac_client_impl_t *mcip, mac_protect_t *p,
    ip6_t *ip6h, uchar_t *end)
{
    dhcpv6_message_t    *dh6;
    dhcpv6_option_t     *d6o;
    uint8_t         mtype;
    uchar_t         *cid, *lladdr = NULL;
    uint_t          cidlen, maclen, addrlen = 0;
    uint16_t        cidtype;
    int         err;

    if ((err = get_dhcpv6_info(ip6h, end, &dh6)) != 0)
        return (err == EINVAL);

    /*
     * We only check client-generated messages.
     */
    mtype = dh6->d6m_msg_type;
    if (mtype == DHCPV6_MSG_ADVERTISE || mtype == DHCPV6_MSG_REPLY ||
        mtype == DHCPV6_MSG_RECONFIGURE)
        return (B_TRUE);

    d6o = get_dhcpv6_option(&dh6[1], end - (uchar_t *)&dh6[1], NULL,
        DHCPV6_OPT_CLIENTID, &cidlen);
    if (d6o == NULL || (uchar_t *)d6o + cidlen > end)
        return (B_TRUE);

    cid = (uchar_t *)&d6o[1];
    cidlen -= sizeof (*d6o);
    if (cidlen < sizeof (cidtype))
        return (B_TRUE);

    bcopy(cid, &cidtype, sizeof (cidtype));
    cidtype = ntohs(cidtype);
    if (cidtype == DHCPV6_DUID_LLT && cidlen >= sizeof (duid_llt_t)) {
        lladdr = cid + sizeof (duid_llt_t);
        addrlen = cidlen - sizeof (duid_llt_t);
    }
    if (cidtype == DHCPV6_DUID_LL && cidlen >= sizeof (duid_ll_t)) {
        lladdr = cid + sizeof (duid_ll_t);
        addrlen = cidlen - sizeof (duid_ll_t);
    }
    maclen = mcip->mci_mip->mi_info.mi_addr_length;
    if (lladdr != NULL && addrlen == maclen &&
        bcmp(mcip->mci_unicast->ma_addr, lladdr, maclen) == 0) {
        return (B_TRUE);
    }
    return (dhcpnospoof_check_cid(p, cid, cidlen));
}

/*
 * Enforce dhcp-nospoof protection.
 */
static int
dhcpnospoof_check(mac_client_impl_t *mcip, mac_protect_t *protect,
    mblk_t *mp, mac_header_info_t *mhip)
{
    size_t      hdrsize = mhip->mhi_hdrsize;
    uint32_t    sap = mhip->mhi_bindsap;
    uchar_t     *start, *end;
    mblk_t      *nmp = NULL;
    int     err;

    err = get_l3_info(mp, hdrsize, &start, &end, &nmp);
    if (err != 0) {
        DTRACE_PROBE2(invalid__l3, mac_client_impl_t *, mcip,
            mblk_t *, mp);
        return (err);
    }
    err = EINVAL;

    switch (sap) {
    case ETHERTYPE_IP: {
        ipha_t  *ipha = (ipha_t *)start;

        if (start + sizeof (ipha_t) > end)
            goto fail;

        if (!dhcpnospoof_check_v4(mcip, protect, ipha, end))
            goto fail;

        break;
    }
    case ETHERTYPE_IPV6: {
        ip6_t       *ip6h = (ip6_t *)start;

        if (start + sizeof (ip6_t) > end)
            goto fail;

        if (!dhcpnospoof_check_v6(mcip, protect, ip6h, end))
            goto fail;

        break;
    }
    }
    freemsg(nmp);
    return (0);

fail:
    /* increment dhcpnospoof stat here */
    freemsg(nmp);
    return (err);
}

/*
 * This is called whenever the mac client's mac address changes, to make sure
 * we allow use of the new link-local address.
 */
static void
mac_protect_update_v6_local_addr(mac_client_impl_t *mcip)
{
    uint_t      i;
    in6_addr_t  *token = &mcip->mci_v6_mac_token;
    in6_addr_t  *v6addr = &mcip->mci_v6_local_addr;
    in6_addr_t  ll_template = {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};

    for (i = 0; i < 4; i++) {
        v6addr->s6_addr32[i] = token->s6_addr32[i] |
            ll_template.s6_addr32[i];
    }
    mcip->mci_protect_flags |= MPT_FLAG_V6_LOCAL_ADDR_SET;
}

/*
 * This is called whenever the mac client's mac address changes, to make sure
 * that any existing addresses gained via SLAAC are appropriately updated.
 */
static void
mac_protect_update_v6_slaac_addr(mac_client_impl_t *mcip)
{
    void        *cookie = NULL;
    avl_tree_t  temp_tree;
    avl_tree_t  *ttp = &temp_tree, *sip = &mcip->mci_v6_slaac_ip;
    in6_addr_t  *token = &mcip->mci_v6_mac_token;
    slaac_addr_t    *addr = NULL;

    avl_create(ttp, compare_slaac_ip, sizeof (slaac_addr_t),
        offsetof(slaac_addr_t, sla_node));

    /* Copy everything over to the temporary tree, and fix the IP address */
    while ((addr = avl_destroy_nodes(sip, &cookie)) != NULL) {
        VERIFY(insert_slaac_ip(ttp, token, addr) == B_TRUE);
    }

    /*
     * Now that the tempory tree has all of the modified addresses, we can
     * swap them over to the original tree once it's reset.
     */
    avl_destroy(sip);
    avl_create(sip, compare_slaac_ip, sizeof (slaac_addr_t),
        offsetof(slaac_addr_t, sla_node));
    avl_swap(ttp, sip);
}

/*
 * After the unicast MAC address changes, we need to update the derived token,
 * and update the IPv6 addresses that use the token.
 */
void
mac_protect_update_mac_token(mac_client_impl_t *mcip)
{
    uint_t      media = mcip->mci_mip->mi_info.mi_media;
    uint8_t     *p, *macaddr = mcip->mci_unicast->ma_addr;
    in6_addr_t  *token = &mcip->mci_v6_mac_token;

    bzero(token, sizeof (in6_addr_t));
    p = (uint8_t *)&token->s6_addr32[2];

    switch (media) {
    case DL_ETHER:
        bcopy(macaddr, p, 3);
        p[0] ^= 0x2;
        p[3] = 0xff;
        p[4] = 0xfe;
        bcopy(macaddr + 3, p + 5, 3);
        break;
    case DL_IB:
        ASSERT(mcip->mci_mip->mi_info.mi_addr_length == 20);
        bcopy(macaddr + 12, p, 8);
        p[0] |= 2;
        break;
    default:
        /*
         * We do not need to generate the local address for link types
         * that do not support link protection. Wifi pretends to be
         * Ethernet so it is covered by the DL_ETHER case (note the
         * use of mi_media instead of mi_nativemedia).
         */
        return;
    }

    mac_protect_update_v6_local_addr(mcip);
    mac_protect_update_v6_slaac_addr(mcip);
}


/*
 * Enforce link protection on one packet.
 */
static int
mac_protect_check_one(mac_client_impl_t *mcip, mblk_t *mp)
{
    mac_impl_t      *mip = mcip->mci_mip;
    mac_resource_props_t    *mrp = MCIP_RESOURCE_PROPS(mcip);
    mac_protect_t       *protect;
    mac_header_info_t   mhi;
    uint32_t        types;
    int         err;

    ASSERT(mp->b_next == NULL);
    ASSERT(mrp != NULL);

    err = mac_vlan_header_info((mac_handle_t)mip, mp, &mhi);
    if (err != 0) {
        DTRACE_PROBE2(invalid__header, mac_client_impl_t *, mcip,
            mblk_t *, mp);
        return (err);
    }
    protect = &mrp->mrp_protect;
    types = protect->mp_types;

    if ((types & MPT_MACNOSPOOF) != 0) {
        if (mhi.mhi_saddr != NULL &&
            bcmp(mcip->mci_unicast->ma_addr, mhi.mhi_saddr,
            mip->mi_info.mi_addr_length) != 0) {
            BUMP_STAT(mcip, macspoofed);
            DTRACE_PROBE2(mac__nospoof__fail,
                mac_client_impl_t *, mcip, mblk_t *, mp);
            return (EINVAL);
        }
    }
    if ((types & MPT_RESTRICTED) != 0) {
        uint32_t    vid = VLAN_ID(mhi.mhi_tci);
        uint32_t    sap = mhi.mhi_bindsap;

        /*
         * ETHERTYPE_VLAN packets are allowed through, provided that
         * the vid is not spoofed.
         */
        if (vid != 0 && !mac_client_check_flow_vid(mcip, vid)) {
            BUMP_STAT(mcip, restricted);
            DTRACE_PROBE2(restricted__vid__invalid,
                mac_client_impl_t *, mcip, mblk_t *, mp);
            return (EINVAL);
        }

        if (sap != ETHERTYPE_IP && sap != ETHERTYPE_IPV6 &&
            sap != ETHERTYPE_ARP) {
            BUMP_STAT(mcip, restricted);
            DTRACE_PROBE2(restricted__fail,
                mac_client_impl_t *, mcip, mblk_t *, mp);
            return (EINVAL);
        }
    }
    if ((types & MPT_IPNOSPOOF) != 0) {
        if ((err = ipnospoof_check(mcip, protect, mp, &mhi)) != 0) {
            BUMP_STAT(mcip, ipspoofed);
            DTRACE_PROBE2(ip__nospoof__fail,
                mac_client_impl_t *, mcip, mblk_t *, mp);
            return (err);
        }
    }
    if ((types & MPT_DHCPNOSPOOF) != 0) {
        if ((err = dhcpnospoof_check(mcip, protect, mp, &mhi)) != 0) {
            BUMP_STAT(mcip, dhcpspoofed);
            DTRACE_PROBE2(dhcp__nospoof__fail,
                mac_client_impl_t *, mcip, mblk_t *, mp);
            return (err);
        }
    }
    return (0);
}

/*
 * Enforce link protection on a packet chain.
 * Packets that pass the checks are returned back to the caller.
 */
mblk_t *
mac_protect_check(mac_client_handle_t mch, mblk_t *mp)
{
    mac_client_impl_t   *mcip = (mac_client_impl_t *)mch;
    mblk_t          *ret_mp = NULL, **tailp = &ret_mp, *next;

    /*
     * Skip checks if we are part of an aggr.
     */
    if ((mcip->mci_state_flags & MCIS_IS_AGGR_PORT) != 0)
        return (mp);

    for (; mp != NULL; mp = next) {
        next = mp->b_next;
        mp->b_next = NULL;

        if (mac_protect_check_one(mcip, mp) == 0) {
            *tailp = mp;
            tailp = &mp->b_next;
        } else {
            freemsg(mp);
        }
    }
    return (ret_mp);
}

/*
 * Check if a particular protection type is enabled.
 */
boolean_t
mac_protect_enabled(mac_client_handle_t mch, uint32_t type)
{
    return (MAC_PROTECT_ENABLED((mac_client_impl_t *)mch, type));
}

static int
validate_ips(mac_protect_t *p)
{
    uint_t      i, j;

    if (p->mp_ipaddrcnt == MPT_RESET)
        return (0);

    if (p->mp_ipaddrcnt > MPT_MAXIPADDR)
        return (EINVAL);

    for (i = 0; i < p->mp_ipaddrcnt; i++) {
        mac_ipaddr_t    *addr = &p->mp_ipaddrs[i];

        /*
         * The unspecified address is implicitly allowed so there's no
         * need to add it to the list. Also, validate that the netmask,
         * if any, is sane for the specific version of IP. A mask of
         * some kind is always required.
         */
        if (addr->ip_netmask == 0)
            return (EINVAL);

        if (addr->ip_version == IPV4_VERSION) {
            if (V4_PART_OF_V6(addr->ip_addr) == INADDR_ANY)
                return (EINVAL);
            if (addr->ip_netmask > 32)
                return (EINVAL);
        } else if (addr->ip_version == IPV6_VERSION) {
            if (IN6_IS_ADDR_UNSPECIFIED(&addr->ip_addr))
                return (EINVAL);

            if (IN6_IS_ADDR_V4MAPPED_ANY(&addr->ip_addr))
                return (EINVAL);

            if (addr->ip_netmask > 128)
                return (EINVAL);
        } else {
            /* invalid ip version */
            return (EINVAL);
        }

        for (j = 0; j < p->mp_ipaddrcnt; j++) {
            mac_ipaddr_t    *addr1 = &p->mp_ipaddrs[j];

            if (i == j || addr->ip_version != addr1->ip_version)
                continue;

            /* found a duplicate */
            if ((addr->ip_version == IPV4_VERSION &&
                V4_PART_OF_V6(addr->ip_addr) ==
                V4_PART_OF_V6(addr1->ip_addr)) ||
                IN6_ARE_ADDR_EQUAL(&addr->ip_addr,
                &addr1->ip_addr))
                return (EINVAL);
        }
    }
    return (0);
}

/* ARGSUSED */
static int
validate_cids(mac_protect_t *p)
{
    uint_t      i, j;

    if (p->mp_cidcnt == MPT_RESET)
        return (0);

    if (p->mp_cidcnt > MPT_MAXCID)
        return (EINVAL);

    for (i = 0; i < p->mp_cidcnt; i++) {
        mac_dhcpcid_t   *cid = &p->mp_cids[i];

        if (cid->dc_len > MPT_MAXCIDLEN ||
            (cid->dc_form != CIDFORM_TYPED &&
            cid->dc_form != CIDFORM_HEX &&
            cid->dc_form != CIDFORM_STR))
            return (EINVAL);

        for (j = 0; j < p->mp_cidcnt; j++) {
            mac_dhcpcid_t   *cid1 = &p->mp_cids[j];

            if (i == j || cid->dc_len != cid1->dc_len)
                continue;

            /* found a duplicate */
            if (bcmp(cid->dc_id, cid1->dc_id, cid->dc_len) == 0)
                return (EINVAL);
        }
    }
    return (0);
}

/*
 * Sanity-checks parameters given by userland.
 */
int
mac_protect_validate(mac_resource_props_t *mrp)
{
    mac_protect_t   *p = &mrp->mrp_protect;
    int     err;

    /* check for invalid types */
    if (p->mp_types != MPT_RESET && (p->mp_types & ~MPT_ALL) != 0)
        return (EINVAL);

    if ((err = validate_ips(p)) != 0)
        return (err);

    if ((err = validate_cids(p)) != 0)
        return (err);

    return (0);
}

/*
 * Enable/disable link protection.
 */
int
mac_protect_set(mac_client_handle_t mch, mac_resource_props_t *mrp)
{
    mac_client_impl_t   *mcip = (mac_client_impl_t *)mch;
    mac_impl_t      *mip = mcip->mci_mip;
    uint_t          media = mip->mi_info.mi_nativemedia;
    int         err;

    ASSERT(MAC_PERIM_HELD((mac_handle_t)mip));

    /* tunnels are not supported */
    if (media == DL_IPV4 || media == DL_IPV6 || media == DL_6TO4)
        return (ENOTSUP);

    if ((err = mac_protect_validate(mrp)) != 0)
        return (err);

    if (err != 0)
        return (err);

    mac_update_resources(mrp, MCIP_RESOURCE_PROPS(mcip), B_FALSE);
    i_mac_notify(((mcip->mci_state_flags & MCIS_IS_VNIC) != 0 ?
        mcip->mci_upper_mip : mip), MAC_NOTE_ALLOWED_IPS);
    return (0);
}

void
mac_protect_update(mac_resource_props_t *new, mac_resource_props_t *curr)
{
    mac_protect_t   *np = &new->mrp_protect;
    mac_protect_t   *cp = &curr->mrp_protect;
    uint32_t    types = np->mp_types;

    if (types == MPT_RESET) {
        cp->mp_types = 0;
        curr->mrp_mask &= ~MRP_PROTECT;
    } else {
        if (types != 0) {
            cp->mp_types = types;
            curr->mrp_mask |= MRP_PROTECT;
        }
    }
    if (np->mp_ipaddrcnt != 0) {
        if (np->mp_ipaddrcnt <= MPT_MAXIPADDR) {
            bcopy(np->mp_ipaddrs, cp->mp_ipaddrs,
                sizeof (cp->mp_ipaddrs));
            cp->mp_ipaddrcnt = np->mp_ipaddrcnt;
        } else if (np->mp_ipaddrcnt == MPT_RESET) {
            bzero(cp->mp_ipaddrs, sizeof (cp->mp_ipaddrs));
            cp->mp_ipaddrcnt = 0;
        }
    }
    if (np->mp_cidcnt != 0) {
        if (np->mp_cidcnt <= MPT_MAXCID) {
            bcopy(np->mp_cids, cp->mp_cids, sizeof (cp->mp_cids));
            cp->mp_cidcnt = np->mp_cidcnt;
        } else if (np->mp_cidcnt == MPT_RESET) {
            bzero(cp->mp_cids, sizeof (cp->mp_cids));
            cp->mp_cidcnt = 0;
        }
    }
}

void
mac_protect_init(mac_client_impl_t *mcip)
{
    mutex_init(&mcip->mci_protect_lock, NULL, MUTEX_DRIVER, NULL);
    mcip->mci_protect_flags = 0;
    mcip->mci_txn_cleanup_tid = 0;
    avl_create(&mcip->mci_v4_pending_txn, compare_dhcpv4_xid,
        sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_node));
    avl_create(&mcip->mci_v4_completed_txn, compare_dhcpv4_cid,
        sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_node));
    avl_create(&mcip->mci_v4_dyn_ip, compare_dhcpv4_ip,
        sizeof (dhcpv4_txn_t), offsetof(dhcpv4_txn_t, dt_ipnode));
    avl_create(&mcip->mci_v6_pending_txn, compare_dhcpv6_xid,
        sizeof (dhcpv6_txn_t), offsetof(dhcpv6_txn_t, dt_node));
    avl_create(&mcip->mci_v6_cid, compare_dhcpv6_cid,
        sizeof (dhcpv6_cid_t), offsetof(dhcpv6_cid_t, dc_node));
    avl_create(&mcip->mci_v6_dyn_ip, compare_dhcpv6_ip,
        sizeof (dhcpv6_addr_t), offsetof(dhcpv6_addr_t, da_node));
    avl_create(&mcip->mci_v6_slaac_ip, compare_slaac_ip,
        sizeof (slaac_addr_t), offsetof(slaac_addr_t, sla_node));

    if (mcip->mci_state_flags & MCIS_IS_VNIC)
        mcip->mci_protect_flags |= MPT_FLAG_PROMISC_FILTERED;
}

void
mac_protect_fini(mac_client_impl_t *mcip)
{
    avl_destroy(&mcip->mci_v6_dyn_ip);
    avl_destroy(&mcip->mci_v6_cid);
    avl_destroy(&mcip->mci_v6_pending_txn);
    avl_destroy(&mcip->mci_v4_dyn_ip);
    avl_destroy(&mcip->mci_v4_completed_txn);
    avl_destroy(&mcip->mci_v4_pending_txn);
    avl_destroy(&mcip->mci_v6_slaac_ip);
    mcip->mci_txn_cleanup_tid = 0;
    mcip->mci_protect_flags = 0;
    mutex_destroy(&mcip->mci_protect_lock);
}

static boolean_t
allowed_ips_set(mac_resource_props_t *mrp, uint32_t af)
{
    int i;

    for (i = 0; i < mrp->mrp_protect.mp_ipaddrcnt; i++) {
        if (mrp->mrp_protect.mp_ipaddrs[i].ip_version == af)
            return (B_TRUE);
    }
    return (B_FALSE);
}

mac_protect_t *
mac_protect_get(mac_handle_t mh)
{
    mac_impl_t *mip = (mac_impl_t *)mh;

    return (&mip->mi_resource_props.mrp_protect);
}