/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2013 by Delphix. All rights reserved.
 * Copyright (c) 2012, Joyent, Inc. All rights reserved.
 */
/* Copyright (c) 1990 Mentat Inc. */

#include <inet/ip.h>
#include <inet/ip6.h>
#include <inet/ip_if.h>
#include <inet/ip_ire.h>
#include <inet/ipclassifier.h>
#include <inet/ip_impl.h>
#include <inet/tunables.h>
#include <sys/sunddi.h>
#include <sys/policy.h>

/* How long, in seconds, we allow frags to hang around. */
#define IP_REASM_TIMEOUT        15
#define IPV6_REASM_TIMEOUT      60

/*
 * Set ip{,6}_forwarding values. If the value is being set on an ill,
 * find the ill and set the value on it. On the other hand if we are modifying
 * global property, modify the global value and set the value on all the ills.
 */
/* ARGSUSED */
static int
ip_set_forwarding(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
        char                    *end;
        unsigned long           new_value;
        boolean_t               per_ill, isv6;
        ill_walk_context_t      ctx;
        ill_t                   *ill;
        ip_stack_t              *ipst = stack->netstack_ip;

        if (flags & MOD_PROP_DEFAULT) {
                new_value = pinfo->prop_def_bval;
        } else {
                if (ddi_strtoul(pval, &end, 10, &new_value) != 0 ||
                    *end != '\0')
                        return (EINVAL);
                if (new_value != B_TRUE && new_value != B_FALSE)
                        return (EINVAL);
        }

        per_ill = (ifname != NULL && ifname[0] != '\0');
        /*
         * if it's not per ill then set the global property and bring all the
         * ills up to date with the new global value.
         */
        if (!per_ill)
                pinfo->prop_cur_bval = (new_value == 1 ? B_TRUE : B_FALSE);

        isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6 ? B_TRUE : B_FALSE);
        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        if (isv6)
                ill = ILL_START_WALK_V6(&ctx, ipst);
        else
                ill = ILL_START_WALK_V4(&ctx, ipst);

        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                /*
                 * if the property needs to be set on a particular
                 * interface, look for that interface.
                 */
                if (per_ill && strcmp(ifname, ill->ill_name) != 0)
                        continue;
                (void) ill_forward_set(ill, new_value != 0);
        }
        rw_exit(&ipst->ips_ill_g_lock);

        return (0);
}

static int
ip_get_forwarding(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t pr_size, uint_t flags)
{
        boolean_t               value;
        ill_walk_context_t      ctx;
        ill_t                   *ill;
        ip_stack_t              *ipst = stack->netstack_ip;
        boolean_t               get_def = (flags & MOD_PROP_DEFAULT);
        boolean_t               get_perm = (flags & MOD_PROP_PERM);
        boolean_t               isv6;
        size_t                  nbytes = 0;

        if (get_perm) {
                nbytes = snprintf(pval, pr_size, "%d", MOD_PROP_PERM_RW);
                goto ret;
        } else if (get_def) {
                nbytes = snprintf(pval, pr_size, "%d", pinfo->prop_def_bval);
                goto ret;
        }

        /*
         * if per interface value is not asked for return the current
         * global value
         */
        if (ifname == NULL || ifname[0] == '\0') {
                nbytes = snprintf(pval, pr_size, "%d", pinfo->prop_cur_bval);
                goto ret;
        }

        isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6 ? B_TRUE : B_FALSE);
        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        if (isv6)
                ill = ILL_START_WALK_V6(&ctx, ipst);
        else
                ill = ILL_START_WALK_V4(&ctx, ipst);
        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                /*
                 * if the property needs to be obtained on a particular
                 * interface, look for that interface.
                 */
                if (strcmp(ifname, ill->ill_name) == 0)
                        break;
        }
        if (ill == NULL) {
                rw_exit(&ipst->ips_ill_g_lock);
                return (ENXIO);
        }
        value = ((ill->ill_flags & ILLF_ROUTER) ? B_TRUE : B_FALSE);
        rw_exit(&ipst->ips_ill_g_lock);
        nbytes = snprintf(pval, pr_size, "%d", value);
ret:
        if (nbytes >= pr_size)
                return (ENOBUFS);
        return (0);
}

/*
 * `ip_debug' is a global variable. So, we will be modifying the global
 * variable here.
 */
/* ARGSUSED */
int
ip_set_debug(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
        unsigned long   new_value;
        int             err;

        if (cr != NULL && secpolicy_net_config(cr, B_FALSE) != 0)
                return (EPERM);

        if ((err = mod_uint32_value(pval, pinfo, flags, &new_value)) != 0)
                return (err);
        ip_debug = (uint32_t)new_value;
        return (0);
}

/*
 * ip_debug is a global property. For default, permission and value range
 * we retrieve the value from `pinfo'. However for the current value we
 * retrieve the value from the global variable `ip_debug'
 */
/* ARGSUSED */
int
ip_get_debug(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t psize, uint_t flags)
{
        boolean_t       get_def = (flags & MOD_PROP_DEFAULT);
        boolean_t       get_perm = (flags & MOD_PROP_PERM);
        boolean_t       get_range = (flags & MOD_PROP_POSSIBLE);
        size_t          nbytes;

        bzero(pval, psize);
        if (get_perm)
                nbytes = snprintf(pval, psize, "%u", MOD_PROP_PERM_RW);
        else if (get_range)
                nbytes = snprintf(pval, psize, "%u-%u",
                    pinfo->prop_min_uval, pinfo->prop_max_uval);
        else if (get_def)
                nbytes = snprintf(pval, psize, "%u", pinfo->prop_def_uval);
        else
                nbytes = snprintf(pval, psize, "%u", ip_debug);
        if (nbytes >= psize)
                return (ENOBUFS);
        return (0);
}

/*
 * Set the CGTP (multirouting) filtering status. If the status is changed
 * from active to transparent or from transparent to active, forward the
 * new status to the filtering module (if loaded).
 */
/* ARGSUSED */
static int
ip_set_cgtp_filter(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
        unsigned long   new_value;
        ip_stack_t      *ipst = stack->netstack_ip;
        char            *end;

        if (flags & MOD_PROP_DEFAULT) {
                new_value = pinfo->prop_def_bval;
        } else {
                if (ddi_strtoul(pval, &end, 10, &new_value) != 0 ||
                    *end != '\0' || new_value > 1) {
                        return (EINVAL);
                }
        }
        if (!pinfo->prop_cur_bval && new_value) {
                cmn_err(CE_NOTE, "IP: enabling CGTP filtering%s",
                    ipst->ips_ip_cgtp_filter_ops == NULL ?
                    " (module not loaded)" : "");
        }
        if (pinfo->prop_cur_bval && !new_value) {
                cmn_err(CE_NOTE, "IP: disabling CGTP filtering%s",
                    ipst->ips_ip_cgtp_filter_ops == NULL ?
                    " (module not loaded)" : "");
        }
        if (ipst->ips_ip_cgtp_filter_ops != NULL) {
                int     res;
                netstackid_t stackid = ipst->ips_netstack->netstack_stackid;

                res = ipst->ips_ip_cgtp_filter_ops->cfo_change_state(stackid,
                    new_value);
                if (res)
                        return (res);
        }
        pinfo->prop_cur_bval = (new_value == 1 ? B_TRUE : B_FALSE);
        ill_set_inputfn_all(ipst);
        return (0);
}

/*
 * Retrieve the default MTU or min-max MTU range for a given interface.
 *
 *  -- ill_max_frag value tells us the maximum MTU that can be handled by the
 *     datalink. This value is advertised by the driver via DLPI messages
 *     (DL_NOTE_SDU_SIZE/DL_INFO_ACK).
 *
 *  -- ill_current_frag for the most link-types will be same as ill_max_frag
 *     to begin with. However it is dynamically computed for some link-types
 *     like tunnels, based on the tunnel PMTU.
 *
 *  -- ill_mtu is the user set MTU using SIOCSLIFMTU and must lie between
 *     (IPV6_MIN_MTU/IP_MIN_MTU) and ill_max_frag.
 *
 *  -- ill_user_mtu is set by in.ndpd using SIOCSLIFLNKINFO and must lie between
 *     (IPV6_MIN_MTU/IP_MIN_MTU) and ill_max_frag.
 */
int
ip_get_mtu(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t psize, uint_t flags)
{
        ill_walk_context_t      ctx;
        ill_t                   *ill;
        ip_stack_t              *ipst = stack->netstack_ip;
        boolean_t               isv6;
        uint32_t                max_mtu, def_mtu;
        size_t                  nbytes = 0;

        if (!(flags & (MOD_PROP_DEFAULT|MOD_PROP_POSSIBLE)))
                return (ENOTSUP);

        if (ifname == NULL || ifname[0] == '\0')
                return (ENOTSUP);

        isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6 ? B_TRUE : B_FALSE);
        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
        if (isv6)
                ill = ILL_START_WALK_V6(&ctx, ipst);
        else
                ill = ILL_START_WALK_V4(&ctx, ipst);
        for (; ill != NULL; ill = ill_next(&ctx, ill)) {
                if (strcmp(ifname, ill->ill_name) == 0)
                        break;
        }
        if (ill == NULL) {
                rw_exit(&ipst->ips_ill_g_lock);
                return (ENXIO);
        }
        max_mtu = ill->ill_max_frag;
        def_mtu = ill->ill_current_frag;
        rw_exit(&ipst->ips_ill_g_lock);

        if (flags & MOD_PROP_DEFAULT) {
                nbytes = snprintf(pval, psize, "%u", def_mtu);
        } else if (flags & MOD_PROP_POSSIBLE) {
                uint32_t        min_mtu;

                min_mtu = isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
                nbytes = snprintf(pval, psize, "%u-%u", min_mtu, max_mtu);
        } else {
                return (ENOTSUP);
        }

        if (nbytes >= psize)
                return (ENOBUFS);
        return (0);
}

/*
 * See the comments for ip[6]_strict_src_multihoming for an explanation
 * of the semanitcs.
 */
void
ip_set_src_multihoming_common(ulong_t new_value, ulong_t old_value,
    boolean_t isv6, ip_stack_t *ipst)
{
        if (isv6)
                ipst->ips_ipv6_strict_src_multihoming = new_value;
        else
                ipst->ips_ip_strict_src_multihoming = new_value;
        if (new_value != old_value) {
                if (!isv6) {
                        if (old_value == 0) {
                                ire_walk_v4(ip_ire_rebind_walker, NULL,
                                    ALL_ZONES, ipst);
                        } else if (new_value == 0) {
                                ire_walk_v4(ip_ire_unbind_walker, NULL,
                                    ALL_ZONES, ipst);
                        }
                        ipcl_walk(conn_ire_revalidate, (void *)B_FALSE, ipst);
                } else {
                        if (old_value == 0) {
                                ire_walk_v6(ip_ire_rebind_walker, NULL,
                                    ALL_ZONES, ipst);
                        } else if (new_value == 0) {
                                ire_walk_v6(ip_ire_unbind_walker, NULL,
                                    ALL_ZONES, ipst);
                        }
                        ipcl_walk(conn_ire_revalidate, (void *)B_TRUE, ipst);
                }
        }
}

/* ARGSUSED */
static int
ip_set_src_multihoming(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
        unsigned long   new_value, old_value;
        boolean_t       isv6;
        ip_stack_t      *ipst = stack->netstack_ip;
        int             err;

        old_value = pinfo->prop_cur_uval;

        if ((err = mod_uint32_value(pval, pinfo, flags, &new_value)) != 0)
                return (err);
        pinfo->prop_cur_uval = new_value;
        isv6 = (strcmp(pinfo->mpi_name, "ip6_strict_src_multihoming") == 0);
        ip_set_src_multihoming_common(new_value, old_value, isv6, ipst);
        return (0);
}


/* ARGSUSED */
static int
ip_set_hostmodel(netstack_t *stack, cred_t *cr, mod_prop_info_t *pinfo,
    const char *ifname, const void* pval, uint_t flags)
{
        ip_hostmodel_t  new_value, old_value;
        ip_stack_t      *ipst = stack->netstack_ip;
        uint32_t        old_src_multihoming;
        int             err;
        ulong_t         tmp;
        boolean_t       isv6;

        old_value = pinfo->prop_cur_uval;

        if ((err = mod_uint32_value(pval, pinfo, flags, &tmp)) != 0)
                return (err);
        new_value = tmp;
        pinfo->prop_cur_uval = new_value;

        switch (old_value) {
        case IP_WEAK_ES:
                old_src_multihoming = 0;
                break;
        case IP_SRC_PRI_ES:
                old_src_multihoming = 1;
                break;
        case IP_STRONG_ES:
                old_src_multihoming = 2;
                break;
        default:
                ASSERT(0);
                old_src_multihoming = IP_MAXVAL_ES;
                break;
        }
        /*
         * Changes to src_multihoming may require ire's to be rebound/unbound,
         * and also require generation number resets. Changes to dst_multihoming
         * require a simple reset of the value.
         */
        isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6);
        if (new_value != old_value) {
                switch (new_value) {
                case IP_WEAK_ES:
                        ip_set_src_multihoming_common(0, old_src_multihoming,
                            isv6, ipst);
                        if (isv6)
                                ipst->ips_ipv6_strict_dst_multihoming = 0;
                        else
                                ipst->ips_ip_strict_dst_multihoming = 0;
                        break;
                case IP_SRC_PRI_ES:
                        ip_set_src_multihoming_common(1, old_src_multihoming,
                            isv6, ipst);
                        if (isv6)
                                ipst->ips_ipv6_strict_dst_multihoming = 0;
                        else
                                ipst->ips_ip_strict_dst_multihoming = 0;
                        break;
                case IP_STRONG_ES:
                        ip_set_src_multihoming_common(2, old_src_multihoming,
                            isv6, ipst);
                        if (isv6)
                                ipst->ips_ipv6_strict_dst_multihoming = 1;
                        else
                                ipst->ips_ip_strict_dst_multihoming = 1;
                        break;
                default:
                        return (EINVAL);
                }
        }
        return (0);
}

/* ARGSUSED */
int
ip_get_hostmodel(netstack_t *stack, mod_prop_info_t *pinfo, const char *ifname,
    void *pval, uint_t psize, uint_t flags)
{
        boolean_t       isv6 = (pinfo->mpi_proto == MOD_PROTO_IPV6);
        ip_stack_t      *ipst = stack->netstack_ip;
        ip_hostmodel_t  hostmodel;

        if (psize < sizeof (hostmodel))
                return (ENOBUFS);
        bzero(pval, psize);
        if (!isv6) {
                if (ipst->ips_ip_strict_src_multihoming == 0 &&
                    ipst->ips_ip_strict_dst_multihoming == 0)
                        hostmodel = IP_WEAK_ES;
                else if (ipst->ips_ip_strict_src_multihoming == 1 &&
                    ipst->ips_ip_strict_dst_multihoming == 0)
                        hostmodel = IP_SRC_PRI_ES;
                else if (ipst->ips_ip_strict_src_multihoming == 2 &&
                    ipst->ips_ip_strict_dst_multihoming == 1)
                        hostmodel = IP_STRONG_ES;
                else
                        hostmodel = IP_MAXVAL_ES;
        } else {
                if (ipst->ips_ipv6_strict_src_multihoming == 0 &&
                    ipst->ips_ipv6_strict_dst_multihoming == 0)
                        hostmodel = IP_WEAK_ES;
                else if (ipst->ips_ipv6_strict_src_multihoming == 1 &&
                    ipst->ips_ipv6_strict_dst_multihoming == 0)
                        hostmodel = IP_SRC_PRI_ES;
                else if (ipst->ips_ipv6_strict_src_multihoming == 2 &&
                    ipst->ips_ipv6_strict_dst_multihoming == 1)
                        hostmodel = IP_STRONG_ES;
                else
                        hostmodel = IP_MAXVAL_ES;
        }
        bcopy(&hostmodel, pval, sizeof (hostmodel));
        return (0);
}

/*
 * All of these are alterable, within the min/max values given, at run time.
 *
 * Note: All those tunables which do not start with "_" are Committed and
 * therefore are public. See PSARC 2010/080.
 */
mod_prop_info_t ip_propinfo_tbl[] = {
        /* tunable - 0 */
        { "_respond_to_address_mask_broadcast", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_respond_to_echo_broadcast", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE},  {B_TRUE} },

        { "_respond_to_echo_multicast", MOD_PROTO_IPV4,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_respond_to_timestamp", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_respond_to_timestamp_broadcast", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_send_redirects", MOD_PROTO_IPV4,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_forward_directed_broadcasts", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_mrtdebug", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 10, 0}, {0} },

        { "_ire_reclaim_fraction", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 8, 3}, {3} },

        { "_nce_reclaim_fraction", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 8, 3}, {3} },

        /* tunable - 10 */
        { "_dce_reclaim_fraction", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 8, 3}, {3} },

        { "ttl", MOD_PROTO_IPV4,
            mod_set_uint32, mod_get_uint32,
            {1, 255, 255}, {255} },

        { "_forward_src_routed", MOD_PROTO_IPV4,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_wroff_extra", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 256, 32}, {32} },

        /* following tunable is in seconds - a deviant! */
        { "_pathmtu_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {2, 999999999, 60*20}, {60*20} },

        { "_icmp_return_data_bytes", MOD_PROTO_IPV4,
            mod_set_uint32, mod_get_uint32,
            {8, 65536, 64}, {64} },

        { "_path_mtu_discovery", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_pmtu_min", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {68, 65535, 576}, {576} },

        { "_ignore_redirect", MOD_PROTO_IPV4,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_arp_icmp_error", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        /* tunable - 20 */
        { "_broadcast_ttl", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 254, 1}, {1} },

        { "_icmp_err_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 99999, 100}, {100} },

        { "_icmp_err_burst", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 99999, 10}, {10} },

        { "_reass_queue_bytes", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 999999999, 1000000}, {1000000} },

        /*
         * See comments for ip_strict_src_multihoming for an explanation
         * of the semantics of ip_strict_dst_multihoming
         */
        { "_strict_dst_multihoming", MOD_PROTO_IPV4,
            mod_set_uint32, mod_get_uint32,
            {0, 1, 0}, {0} },

        { "_addrs_per_if", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, MAX_ADDRS_PER_IF, 256}, {256} },

        { "_ipsec_override_persocket_policy", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_icmp_accept_clear_messages", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_igmp_accept_clear_messages", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_ndp_delay_first_probe_time", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {2, 999999999, ND_DELAY_FIRST_PROBE_TIME},
            {ND_DELAY_FIRST_PROBE_TIME} },

        /* tunable - 30 */
        { "_ndp_max_unicast_solicit", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 999999999, ND_MAX_UNICAST_SOLICIT}, {ND_MAX_UNICAST_SOLICIT} },

        { "hoplimit", MOD_PROTO_IPV6,
            mod_set_uint32, mod_get_uint32,
            {1, 255, IPV6_MAX_HOPS}, {IPV6_MAX_HOPS} },

        { "_icmp_return_data_bytes", MOD_PROTO_IPV6,
            mod_set_uint32, mod_get_uint32,
            {8, IPV6_MIN_MTU, IPV6_MIN_MTU}, {IPV6_MIN_MTU} },

        { "_forward_src_routed", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        { "_respond_to_echo_multicast", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_send_redirects", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_ignore_redirect", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        /*
         * See comments for ip6_strict_src_multihoming for an explanation
         * of the semantics of ip6_strict_dst_multihoming
         */
        { "_strict_dst_multihoming", MOD_PROTO_IPV6,
            mod_set_uint32, mod_get_uint32,
            {0, 1, 0}, {0} },

        { "_src_check", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 2, 2}, {2} },

        { "_ipsec_policy_log_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 999999, 0}, {0} },

        /* tunable - 40 */
        { "_pim_accept_clear_messages", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_ndp_unsolicit_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1000, 20000, 2000}, {2000} },

        { "_ndp_unsolicit_count", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 20, 3}, {3} },

        { "_ignore_home_address_opt", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_policy_mask", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 15, 0}, {0} },

        { "_ecmp_behavior", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 2, 2}, {2} },

        { "_multirt_ttl", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 255, 1}, {1} },

        /* following tunable is in seconds - a deviant */
        { "_ire_badcnt_lifetime", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 3600, 60}, {60} },

        { "_max_temp_idle", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 999999, 60*60*24}, {60*60*24} },

        { "_max_temp_defend", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 1000, 1}, {1} },

        /* tunable - 50 */
        /*
         * when a conflict of an active address is detected,
         * defend up to ip_max_defend times, within any
         * ip_defend_interval span.
         */
        { "_max_defend", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 1000, 3}, {3} },

        { "_defend_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 999999, 30}, {30} },

        { "_dup_recovery", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 3600000, 300000}, {300000} },

        { "_restrict_interzone_loopback", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_lso_outbound", MOD_PROTO_IP,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_igmp_max_version", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {IGMP_V1_ROUTER, IGMP_V3_ROUTER, IGMP_V3_ROUTER},
            {IGMP_V3_ROUTER} },

        { "_mld_max_version", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {MLD_V1_ROUTER, MLD_V2_ROUTER, MLD_V2_ROUTER}, {MLD_V2_ROUTER} },

        { "forwarding", MOD_PROTO_IPV4,
            ip_set_forwarding, ip_get_forwarding,
            {IP_FORWARD_NEVER}, {IP_FORWARD_NEVER} },

        { "forwarding", MOD_PROTO_IPV6,
            ip_set_forwarding, ip_get_forwarding,
            {IP_FORWARD_NEVER}, {IP_FORWARD_NEVER} },

        { "_reasm_timeout", MOD_PROTO_IPV4,
            mod_set_uint32, mod_get_uint32,
            {5, 255, IP_REASM_TIMEOUT},
            {IP_REASM_TIMEOUT} },

        /* tunable - 60 */
        { "_reasm_timeout", MOD_PROTO_IPV6,
            mod_set_uint32, mod_get_uint32,
            {5, 255, IPV6_REASM_TIMEOUT},
            {IPV6_REASM_TIMEOUT} },

        { "_cgtp_filter", MOD_PROTO_IP,
            ip_set_cgtp_filter, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },

        /* delay before sending first probe: */
        { "_arp_probe_delay", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 20000, 1000}, {1000} },

        { "_arp_fastprobe_delay", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 20000, 100}, {100} },

        /* interval at which DAD probes are sent: */
        { "_arp_probe_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {10, 20000, 1500}, {1500} },

        { "_arp_fastprobe_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {10, 20000, 150}, {150} },

        { "_arp_probe_count", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 20, 3}, {3} },

        { "_arp_fastprobe_count", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 20, 3}, {3} },

        { "_dad_announce_interval", MOD_PROTO_IPV4,
            mod_set_uint32, mod_get_uint32,
            {0, 3600000, 15000}, {15000} },

        { "_dad_announce_interval", MOD_PROTO_IPV6,
            mod_set_uint32, mod_get_uint32,
            {0, 3600000, 15000}, {15000} },

        /* tunable - 70 */
        /*
         * Rate limiting parameters for DAD defense used in
         * ill_defend_rate_limit():
         * defend_rate : pkts/hour permitted
         * defend_interval : time that can elapse before we send out a
         *                      DAD defense.
         * defend_period: denominator for defend_rate (in seconds).
         */
        { "_arp_defend_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 3600000, 300000}, {300000} },

        { "_arp_defend_rate", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 20000, 100}, {100} },

        { "_ndp_defend_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 3600000, 300000}, {300000} },

        { "_ndp_defend_rate", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {0, 20000, 100}, {100} },

        { "_arp_defend_period", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {5, 86400, 3600}, {3600} },

        { "_ndp_defend_period", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {5, 86400, 3600}, {3600} },

        { "_icmp_return_pmtu", MOD_PROTO_IPV4,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        { "_icmp_return_pmtu", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_TRUE}, {B_TRUE} },

        /*
         * publish count/interval values used to announce local addresses
         * for IPv4, IPv6.
         */
        { "_arp_publish_count", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 20, 5}, {5} },

        { "_arp_publish_interval", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1000, 20000, 2000}, {2000} },

        /* tunable - 80 */
        /*
         * The ip*strict_src_multihoming and ip*strict_dst_multihoming provide
         * a range of choices for setting strong/weak/preferred end-system
         * behavior. The semantics for setting these are:
         *
         * ip*_strict_dst_multihoming = 0
         *    weak end system model for managing ip destination addresses.
         *    A packet with IP dst D1 that's received on interface I1 will be
         *    accepted as long as D1 is one of the local addresses on
         *    the machine, even if D1 is not configured on I1.
         * ip*strict_dst_multihioming = 1
         *    strong end system model for managing ip destination addresses.
         *    A packet with IP dst D1 that's received on interface I1 will be
         *    accepted if, and only if, D1 is configured on I1.
         *
         * ip*strict_src_multihoming = 0
         *    Source agnostic route selection for outgoing packets: the
         *    outgoing interface for a packet will be computed using
         *    default algorithms for route selection, where the route
         *    with the longest matching prefix is chosen for the output
         *    unless other route selection constraints are explicitly
         *    specified during routing table lookup.  This may result
         *    in packet being sent out on interface I2 with source
         *    address S1, even though S1 is not a configured address on I2.
         * ip*strict_src_multihoming = 1
         *    Preferred source aware route selection for outgoing packets: for
         *    a packet with source S2, destination D2, the route selection
         *    algorithm will first attempt to find a route for the destination
         *    that goes out through an interface where S2 is
         *    configured. If such a route cannot be found, then the
         *    best-matching route for D2 will be selected.
         * ip*strict_src_multihoming = 2
         *    Source aware route selection for outgoing packets: a packet will
         *    be sent out on an interface I2 only if the src address S2 of the
         *    packet is a configured address on I2. In conjunction with
         *    the setting 'ip_strict_dst_multihoming == 1', this will result in
         *    the implementation of Strong ES as defined in Section 3.3.4.2 of
         *    RFC 1122
         */
        { "_strict_src_multihoming", MOD_PROTO_IPV4,
            ip_set_src_multihoming, mod_get_uint32,
            {0, 2, 0}, {0} },

        { "_strict_src_multihoming", MOD_PROTO_IPV6,
            ip_set_src_multihoming, mod_get_uint32,
            {0, 2, 0}, {0} },

#ifdef DEBUG
        { "_drop_inbound_icmpv6", MOD_PROTO_IPV6,
            mod_set_boolean, mod_get_boolean,
            {B_FALSE}, {B_FALSE} },
#else
        { "", 0, NULL, NULL, {0}, {0} },
#endif

        { "_dce_reclaim_threshold", MOD_PROTO_IP,
            mod_set_uint32, mod_get_uint32,
            {1, 100000, 32}, {32} },

        { "mtu", MOD_PROTO_IPV4, NULL, ip_get_mtu, {0}, {0} },

        { "mtu", MOD_PROTO_IPV6, NULL, ip_get_mtu, {0}, {0} },

        /*
         * The following entry is a placeholder for `ip_debug' global
         * variable. Within these callback functions, we will be
         * setting/getting the global variable
         */
        { "_debug", MOD_PROTO_IP,
            ip_set_debug, ip_get_debug,
            {0, 20, 0}, {0} },

        { "hostmodel", MOD_PROTO_IPV4, ip_set_hostmodel, ip_get_hostmodel,
            {IP_WEAK_ES, IP_STRONG_ES, IP_WEAK_ES}, {IP_WEAK_ES} },

        { "hostmodel", MOD_PROTO_IPV6, ip_set_hostmodel, ip_get_hostmodel,
            {IP_WEAK_ES, IP_STRONG_ES, IP_WEAK_ES}, {IP_WEAK_ES} },

        { "?", MOD_PROTO_IP, NULL, mod_get_allprop, {0}, {0} },

        { NULL, 0, NULL, NULL, {0}, {0} }
};

int ip_propinfo_count = A_CNT(ip_propinfo_tbl);