Patch-ID# 109280-10
Keywords: security ip ndd IP multipathing ip_wsrv HIPPI Mpath tunneling
Synopsis: SunOS 5.8_x86: /kernel/drv/ip patch
Date: 21/Jan/01

Solaris Release: 8_x86

SunOS release: 5.8_x86

Unbundled Product: 

Unbundled Release: 

Topic: SunOS 5.8_x86: /kernel/drv/ip patch

	NOTE:   Refer to Special Install Instructions section for 
                IMPORTANT specific information on this patch.

BugId's fixed with this patch: 4278842 4291034 4299644 4299951 4302749 4303422 4304991 4305039 4306362 4308728 4310956 4311938 4313189 4317221 4320818 4323647 4323830 4324051 4324430 4333995 4335568 4336478 4337275 4338724 4339375 4347223 4360818 4370123 4375920 4376886 4387783 

Changes incorporated in this version: 4304991

Relevant Architectures: i386

Patches accumulated and obsoleted by this patch: 109049-06 110181-01 110553-01 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch:

/kernel/drv/ip
/kernel/drv/ipsecah
/kernel/strmod/tun
/usr/include/inet/ip.h
/usr/include/inet/ip_if.h
/usr/include/inet/ip_ire.h
/usr/include/inet/ip_multi.h
/usr/include/inet/mi.h
/usr/include/net/if.h
/usr/include/net/route.h
/usr/include/netinet/in.h
/usr/include/sys/sockio.h
/usr/lib/adb/ill
/usr/lib/adb/ipc
/usr/lib/adb/ipif
/usr/lib/adb/ire
/usr/lib/adb/iulp
/usr/lib/mdb/kvm/ip.so

Problem Description:

4304991 IP: M_FLUSH messages generated doing UNBIND can remove DETACH reqs

(from 109280-09)

      This patch revision was generated to accumulate and obsolete the 
      feature changes introduced in feature point patch 110553-01

(from 109280-08)

4387783 Update 2 breaks IPsec

(from 109280-07)

      This patch revision was generated to accumulate and obsolete the
      feature changes introduced in point patches 110181-01.

4317221 mipagent needs to read IP TTL to fully  support  reverse tunneling
4302749 Foreign Agent should not broadcast ARP for Mobile Nodes Link Layer address
4310956 ARP support needed for Mobile IP addresses
4320818 add radius hooks to mipagent daemon
4335568 mipagent's generic auth extension processing is broken
4338724 panic due to NULL ipif
4347223 Network Multipathing should provide offlining capability.

(from 109280-06)

4338724 panic due to NULL ipif

(from 109280-05)

	This patch revision was generated to accumulate and obsolete
	the feature changes introduced in point patch 109049-06.

4305039 ipc_walk() does not cleanup causes bad trap in module "genunix"
4311938 Network Multipathing should be integrated into 2.8.
4299644 debug kernel panics; race between ip_close and ip_wsrv threads
4291034 arp: bad trap in ip while deleting logical interface during arp
4308728 ifconfig results in spurious message on the console
4324430 Turning on multihoming can panic the machine under some cases.
4323647 A repaired IP Multipathed interface can get into unconfigurable state sometimes.
4333995 IPv4 source address should be obtained from the destination route.
4339375 PANIC when HIPPI interface mistakenly config into existing ethernet Mpath group

(from 109280-04)

4306362 Only one multicast client gets data on the same node.
4303422 bind to V4 multicast address using V6 socket fails.

(from 109280-03)

4337275 icmp error processing path needs to sanity check inner ip header

(from 109280-02)

4323830 ip_open/ip_close race condition causes bad trap in ipif_lookup_on_name
4336478 SIOCTMYADDR/SIOCTONLINK need not gain exclusive access to IP perimeter.

(from 109280-01)

4299951 ndd can set nca_vpmax/nca_ppmax to incorrect large values

(from 109049-06)

4339375 PANIC when HIPPI interface mistakenly config into existing ethernet Mpath group

(from 109049-05)

	This point patch revision was generated to include some escalated
	bugfixes.

4324430 Turning on multihoming can panic the machine under some cases.
4323647 A repaired IP Multipathed interface can get into unconfigurable state sometimes.

(from 109049-04)

4324430 Turning on multihoming can panic the machine under some cases.
4323647 A repaired IP Multipathed interface can get into unconfigurable state sometimes.
4333995 IPv4 source address should be obtained from the destination route.

(from 109049-03)

	This patch revision was generated to include an S8 8/00 showstopper
	fix for 4299951 (ndd can set nca_vpmax/nca_ppmax to incorrect large 
	values.

(from 109049-02)

4305039 Solaris 8: ipc_walk() does not cleanup causes bad trap in module "genunix"

(from 109049-01)

4311938 Network Multipathing should be integrated into Solaris 8
4299644 debug kernel panics; race between ip_close and ip_wsrv threads
4291034 arp: bad trap in ip while deleting logical interface during arp
4308728 ifconfig results in spurious message on the console

(from 110181-01)

4317221 mipagent needs to read IP TTL to fully  support  reverse tunneling
4302749 Foreign Agent should not broadcast ARP for Mobile Nodes Link Layer address
4310956 ARP support needed for Mobile IP addresses
4320818 add radius hooks to mipagent daemon
4335568 mipagent's generic auth extension processing is broken
4347223 Network Multipathing should provide offlining capability.

(from 110553-01)

4278842 Add reverse tunneling to Foreign Agent and Home Agent
4313189 Mipagent needs to use routing socket to add/delete routes for rev-tun support
4324051 Mipagent needs to have a socket option to route reg reply directly to MN
4360818 Provide kernel support for Reverse tunneling and private addressing
4370123 AAA extensions to RADIUS interface between mipagent and radius
4376886 mipagent doesn't work with PPP interfaces
4375920 Foreign agent does not create two tunnels to HA when different COAs used

Patch Installation Instructions:
--------------------------------

For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.

For Solaris 7-8 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:

       example# patchadd /var/spool/patch/104945-02

The following example removes a patch from a standalone system:

       example# patchrm 104945-02

For additional examples please see the appropriate man pages.

Special Install Instructions: 
----------------------------- 

Reboot the system after patch installation.

        NOTE 1: To get the complete fix for bug 4299951 (ndd can set
                nca_vpmax/nca_ppmax to incorrect large values), one needs
                to install the NCA Support for Apache Web Server patch, 
                109067-03 (or newer).

	NOTE 2:	To get the complete fix for bugs:

		4306362 Only one multicast client gets data on the same node
		4303422 bind to V4 multicast address using V6 socket fails

		one needs to install the following patches:

		109741-01 (or newer)	udp patch
		109743-01 (or newer)    icmp patch

	NOTE 3: To get the complete IP Multipathing support, one needs
                to install the following patches:

                109899-01 (or newer)    /kernel/drv/arp patch
                109743-02 (or newer)    /kernel/drv/icmp patch
		109280-05 (or newer)    /kernel/drv/ip patch
                109901-01 (or newer)    /etc/init.d/network and 
                                        /etc/rcS.d/S30network.sh patch
                109473-03 (or newer)    /kernel/drv/tcp patch
                109741-02 (or newer)    /kernel/drv/udp patch
                109903-01 (or newer)    /usr/lib/inet/in.ndpd patch
                109905-01 (or newer)    /etc/default/mpathd and 
                                        /sbin/in.mpathd patch
                109907-01 (or newer)    /sbin/ifconfig and /usr/sbin/ifconfig 
                                        patch

	NOTE 4:	To get full implementation for 4317221, please also install 
		the udp patch, 110197-01, or its newer revision.

        NOTE 5: To get Network Multipathing offlining capability, one needs
                to install the following patches:

                109280-07 (or newer)    /kernel/drv/ip patch
                109741-03 (or newer)    /kernel/drv/udp patch
                109903-02 (or newer)    /usr/lib/inet/in.ndpd patch
                109905-02 (or newer)    /sbin/in.mpathd patch
                109907-03 (or newer)    /sbin/ifconfig patch
                110396-01 (or newer)    /usr/lib/inet/mipagent patch

        NOTE 6: To get the complete support for the following:

                Add reverse tunneling to Foreign Agent and Home Agent
                Mipagent needs to use routing socket to add/delete 
                        routes for rev-tun support
                Mipagent needs to have a socket option to route reg 
                        reply directly to MN
                Provide kernel support for Reverse tunneling and 
                        private addressing

                one needs to install the following patches:

                110396-04 (or newer)    mipagent patch
                109280-09 (or newer)    ip/ipsecah patch
                109741-04 (or newer)    udp patch
                109743-03 (or newer)    icmp patch
                109473-05 (or newer)    tcp patch

