Print this page
    
787 Kernel panic in ip_input.c
    
      
        | Split | 
	Close | 
      
      | Expand all | 
      | Collapse all | 
    
    
          --- old/usr/src/uts/common/inet/ip/ip_input.c
          +++ new/usr/src/uts/common/inet/ip/ip_input.c
   1    1  /*
   2    2   * CDDL HEADER START
   3    3   *
   4    4   * The contents of this file are subject to the terms of the
   5    5   * Common Development and Distribution License (the "License").
   6    6   * You may not use this file except in compliance with the License.
   7    7   *
   8    8   * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9    9   * or http://www.opensolaris.org/os/licensing.
  10   10   * See the License for the specific language governing permissions
  11   11   * and limitations under the License.
  12   12   *
  13   13   * When distributing Covered Code, include this CDDL HEADER in each
  
    | 
      ↓ open down ↓ | 
    13 lines elided | 
    
      ↑ open up ↑ | 
  
  14   14   * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  
  22   22  /*
  23   23   * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
       24 + *
       25 + * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  24   26   */
  25   27  /* Copyright (c) 1990 Mentat Inc. */
  26   28  
  27   29  #include <sys/types.h>
  28   30  #include <sys/stream.h>
  29   31  #include <sys/dlpi.h>
  30   32  #include <sys/stropts.h>
  31   33  #include <sys/sysmacros.h>
  32   34  #include <sys/strsubr.h>
  33   35  #include <sys/strlog.h>
  34   36  #include <sys/strsun.h>
  35   37  #include <sys/zone.h>
  36   38  #define _SUN_TPI_VERSION 2
  37   39  #include <sys/tihdr.h>
  38   40  #include <sys/xti_inet.h>
  39   41  #include <sys/ddi.h>
  40   42  #include <sys/sunddi.h>
  41   43  #include <sys/cmn_err.h>
  42   44  #include <sys/debug.h>
  43   45  #include <sys/kobj.h>
  44   46  #include <sys/modctl.h>
  45   47  #include <sys/atomic.h>
  46   48  #include <sys/policy.h>
  47   49  #include <sys/priv.h>
  48   50  
  49   51  #include <sys/systm.h>
  50   52  #include <sys/param.h>
  51   53  #include <sys/kmem.h>
  52   54  #include <sys/sdt.h>
  53   55  #include <sys/socket.h>
  54   56  #include <sys/vtrace.h>
  55   57  #include <sys/isa_defs.h>
  56   58  #include <sys/mac.h>
  57   59  #include <net/if.h>
  58   60  #include <net/if_arp.h>
  59   61  #include <net/route.h>
  60   62  #include <sys/sockio.h>
  61   63  #include <netinet/in.h>
  62   64  #include <net/if_dl.h>
  63   65  
  64   66  #include <inet/common.h>
  65   67  #include <inet/mi.h>
  66   68  #include <inet/mib2.h>
  67   69  #include <inet/nd.h>
  68   70  #include <inet/arp.h>
  69   71  #include <inet/snmpcom.h>
  70   72  #include <inet/kstatcom.h>
  71   73  
  72   74  #include <netinet/igmp_var.h>
  73   75  #include <netinet/ip6.h>
  74   76  #include <netinet/icmp6.h>
  75   77  #include <netinet/sctp.h>
  76   78  
  77   79  #include <inet/ip.h>
  78   80  #include <inet/ip_impl.h>
  79   81  #include <inet/ip6.h>
  80   82  #include <inet/ip6_asp.h>
  81   83  #include <inet/optcom.h>
  82   84  #include <inet/tcp.h>
  83   85  #include <inet/tcp_impl.h>
  84   86  #include <inet/ip_multi.h>
  85   87  #include <inet/ip_if.h>
  86   88  #include <inet/ip_ire.h>
  87   89  #include <inet/ip_ftable.h>
  88   90  #include <inet/ip_rts.h>
  89   91  #include <inet/ip_ndp.h>
  90   92  #include <inet/ip_listutils.h>
  91   93  #include <netinet/igmp.h>
  92   94  #include <netinet/ip_mroute.h>
  93   95  #include <inet/ipp_common.h>
  94   96  
  95   97  #include <net/pfkeyv2.h>
  96   98  #include <inet/sadb.h>
  97   99  #include <inet/ipsec_impl.h>
  98  100  #include <inet/ipdrop.h>
  99  101  #include <inet/ip_netinfo.h>
 100  102  #include <inet/ilb_ip.h>
 101  103  #include <sys/squeue_impl.h>
 102  104  #include <sys/squeue.h>
 103  105  
 104  106  #include <sys/ethernet.h>
 105  107  #include <net/if_types.h>
 106  108  #include <sys/cpuvar.h>
 107  109  
 108  110  #include <ipp/ipp.h>
 109  111  #include <ipp/ipp_impl.h>
 110  112  #include <ipp/ipgpc/ipgpc.h>
 111  113  
 112  114  #include <sys/pattr.h>
 113  115  #include <inet/ipclassifier.h>
 114  116  #include <inet/sctp_ip.h>
 115  117  #include <inet/sctp/sctp_impl.h>
 116  118  #include <inet/udp_impl.h>
 117  119  #include <sys/sunddi.h>
 118  120  
 119  121  #include <sys/tsol/label.h>
 120  122  #include <sys/tsol/tnet.h>
 121  123  
 122  124  #include <sys/clock_impl.h>     /* For LBOLT_FASTPATH{,64} */
 123  125  
 124  126  #ifdef  DEBUG
 125  127  extern boolean_t skip_sctp_cksum;
 126  128  #endif
 127  129  
 128  130  static void     ip_input_local_v4(ire_t *, mblk_t *, ipha_t *,
 129  131      ip_recv_attr_t *);
 130  132  
 131  133  static void     ip_input_broadcast_v4(ire_t *, mblk_t *, ipha_t *,
 132  134      ip_recv_attr_t *);
 133  135  static void     ip_input_multicast_v4(ire_t *, mblk_t *, ipha_t *,
 134  136      ip_recv_attr_t *);
 135  137  
 136  138  #pragma inline(ip_input_common_v4, ip_input_local_v4, ip_forward_xmit_v4)
 137  139  
 138  140  /*
 139  141   * Direct read side procedure capable of dealing with chains. GLDv3 based
 140  142   * drivers call this function directly with mblk chains while STREAMS
 141  143   * read side procedure ip_rput() calls this for single packet with ip_ring
 142  144   * set to NULL to process one packet at a time.
 143  145   *
 144  146   * The ill will always be valid if this function is called directly from
 145  147   * the driver.
 146  148   *
 147  149   * If ip_input() is called from GLDv3:
 148  150   *
 149  151   *   - This must be a non-VLAN IP stream.
 150  152   *   - 'mp' is either an untagged or a special priority-tagged packet.
 151  153   *   - Any VLAN tag that was in the MAC header has been stripped.
 152  154   *
 153  155   * If the IP header in packet is not 32-bit aligned, every message in the
 154  156   * chain will be aligned before further operations. This is required on SPARC
 155  157   * platform.
 156  158   */
 157  159  void
 158  160  ip_input(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
 159  161      struct mac_header_info_s *mhip)
 160  162  {
 161  163          (void) ip_input_common_v4(ill, ip_ring, mp_chain, mhip, NULL, NULL,
 162  164              NULL);
 163  165  }
 164  166  
 165  167  /*
 166  168   * ip_accept_tcp() - This function is called by the squeue when it retrieves
 167  169   * a chain of packets in the poll mode. The packets have gone through the
 168  170   * data link processing but not IP processing. For performance and latency
 169  171   * reasons, the squeue wants to process the chain in line instead of feeding
 170  172   * it back via ip_input path.
 171  173   *
 172  174   * We set up the ip_recv_attr_t with IRAF_TARGET_SQP to that ip_fanout_v4
 173  175   * will pass back any TCP packets matching the target sqp to
 174  176   * ip_input_common_v4 using ira_target_sqp_mp. Other packets are handled by
 175  177   * ip_input_v4 and ip_fanout_v4 as normal.
 176  178   * The TCP packets that match the target squeue are returned to the caller
 177  179   * as a b_next chain after each packet has been prepend with an mblk
 178  180   * from ip_recv_attr_to_mblk.
 179  181   */
 180  182  mblk_t *
 181  183  ip_accept_tcp(ill_t *ill, ill_rx_ring_t *ip_ring, squeue_t *target_sqp,
 182  184      mblk_t *mp_chain, mblk_t **last, uint_t *cnt)
 183  185  {
 184  186          return (ip_input_common_v4(ill, ip_ring, mp_chain, NULL, target_sqp,
 185  187              last, cnt));
 186  188  }
 187  189  
 188  190  /*
 189  191   * Used by ip_input and ip_accept_tcp
 190  192   * The last three arguments are only used by ip_accept_tcp, and mhip is
 191  193   * only used by ip_input.
 192  194   */
 193  195  mblk_t *
 194  196  ip_input_common_v4(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
 195  197      struct mac_header_info_s *mhip, squeue_t *target_sqp,
 196  198      mblk_t **last, uint_t *cnt)
 197  199  {
 198  200          mblk_t          *mp;
 199  201          ipha_t          *ipha;
 200  202          ip_recv_attr_t  iras;   /* Receive attributes */
 201  203          rtc_t           rtc;
 202  204          iaflags_t       chain_flags = 0;        /* Fixed for chain */
 203  205          mblk_t          *ahead = NULL;  /* Accepted head */
 204  206          mblk_t          *atail = NULL;  /* Accepted tail */
 205  207          uint_t          acnt = 0;       /* Accepted count */
 206  208  
 207  209          ASSERT(mp_chain != NULL);
 208  210          ASSERT(ill != NULL);
 209  211  
 210  212          /* These ones do not change as we loop over packets */
 211  213          iras.ira_ill = iras.ira_rill = ill;
 212  214          iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
 213  215          iras.ira_rifindex = iras.ira_ruifindex;
 214  216          iras.ira_sqp = NULL;
 215  217          iras.ira_ring = ip_ring;
 216  218          /* For ECMP and outbound transmit ring selection */
 217  219          iras.ira_xmit_hint = ILL_RING_TO_XMIT_HINT(ip_ring);
 218  220  
 219  221          iras.ira_target_sqp = target_sqp;
 220  222          iras.ira_target_sqp_mp = NULL;
 221  223          if (target_sqp != NULL)
 222  224                  chain_flags |= IRAF_TARGET_SQP;
 223  225  
 224  226          /*
 225  227           * We try to have a mhip pointer when possible, but
 226  228           * it might be NULL in some cases. In those cases we
 227  229           * have to assume unicast.
 228  230           */
 229  231          iras.ira_mhip = mhip;
 230  232          iras.ira_flags = 0;
 231  233          if (mhip != NULL) {
 232  234                  switch (mhip->mhi_dsttype) {
 233  235                  case MAC_ADDRTYPE_MULTICAST :
 234  236                          chain_flags |= IRAF_L2DST_MULTICAST;
 235  237                          break;
 236  238                  case MAC_ADDRTYPE_BROADCAST :
 237  239                          chain_flags |= IRAF_L2DST_BROADCAST;
 238  240                          break;
 239  241                  }
 240  242          }
 241  243  
 242  244          /*
 243  245           * Initialize the one-element route cache.
 244  246           *
 245  247           * We do ire caching from one iteration to
 246  248           * another. In the event the packet chain contains
 247  249           * all packets from the same dst, this caching saves
 248  250           * an ire_route_recursive for each of the succeeding
 249  251           * packets in a packet chain.
 250  252           */
 251  253          rtc.rtc_ire = NULL;
 252  254          rtc.rtc_ipaddr = INADDR_ANY;
 253  255  
 254  256          /* Loop over b_next */
 255  257          for (mp = mp_chain; mp != NULL; mp = mp_chain) {
 256  258                  mp_chain = mp->b_next;
 257  259                  mp->b_next = NULL;
 258  260  
 259  261                  ASSERT(DB_TYPE(mp) == M_DATA);
 260  262  
 261  263  
 262  264                  /*
 263  265                   * if db_ref > 1 then copymsg and free original. Packet
 264  266                   * may be changed and we do not want the other entity
 265  267                   * who has a reference to this message to trip over the
 266  268                   * changes. This is a blind change because trying to
 267  269                   * catch all places that might change the packet is too
 268  270                   * difficult.
 269  271                   *
 270  272                   * This corresponds to the fast path case, where we have
 271  273                   * a chain of M_DATA mblks.  We check the db_ref count
 272  274                   * of only the 1st data block in the mblk chain. There
 273  275                   * doesn't seem to be a reason why a device driver would
 274  276                   * send up data with varying db_ref counts in the mblk
 275  277                   * chain. In any case the Fast path is a private
 276  278                   * interface, and our drivers don't do such a thing.
 277  279                   * Given the above assumption, there is no need to walk
 278  280                   * down the entire mblk chain (which could have a
 279  281                   * potential performance problem)
 280  282                   *
 281  283                   * The "(DB_REF(mp) > 1)" check was moved from ip_rput()
 282  284                   * to here because of exclusive ip stacks and vnics.
 283  285                   * Packets transmitted from exclusive stack over vnic
 284  286                   * can have db_ref > 1 and when it gets looped back to
 285  287                   * another vnic in a different zone, you have ip_input()
 286  288                   * getting dblks with db_ref > 1. So if someone
 287  289                   * complains of TCP performance under this scenario,
 288  290                   * take a serious look here on the impact of copymsg().
 289  291                   */
 290  292                  if (DB_REF(mp) > 1) {
 291  293                          if ((mp = ip_fix_dbref(mp, &iras)) == NULL) {
 292  294                                  /* mhip might point into 1st packet in chain */
 293  295                                  iras.ira_mhip = NULL;
 294  296                                  continue;
 295  297                          }
 296  298                  }
 297  299  
 298  300                  /*
 299  301                   * IP header ptr not aligned?
 300  302                   * OR IP header not complete in first mblk
 301  303                   */
 302  304                  ipha = (ipha_t *)mp->b_rptr;
 303  305                  if (!OK_32PTR(ipha) || MBLKL(mp) < IP_SIMPLE_HDR_LENGTH) {
 304  306                          mp = ip_check_and_align_header(mp, IP_SIMPLE_HDR_LENGTH,
 305  307                              &iras);
 306  308                          if (mp == NULL) {
 307  309                                  /* mhip might point into 1st packet in chain */
 308  310                                  iras.ira_mhip = NULL;
 309  311                                  continue;
 310  312                          }
 311  313                          ipha = (ipha_t *)mp->b_rptr;
 312  314                  }
 313  315  
 314  316                  /* Protect against a mix of Ethertypes and IP versions */
 315  317                  if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
 316  318                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
 317  319                          ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
 318  320                          freemsg(mp);
 319  321                          /* mhip might point into 1st packet in the chain. */
 320  322                          iras.ira_mhip = NULL;
 321  323                          continue;
 322  324                  }
 323  325  
 324  326                  /*
 325  327                   * Check for Martian addrs; we have to explicitly
 326  328                   * test for for zero dst since this is also used as
 327  329                   * an indication that the rtc is not used.
 328  330                   */
 329  331                  if (ipha->ipha_dst == INADDR_ANY) {
 330  332                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
 331  333                          ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
 332  334                          freemsg(mp);
 333  335                          /* mhip might point into 1st packet in the chain. */
 334  336                          iras.ira_mhip = NULL;
 335  337                          continue;
 336  338                  }
 337  339  
 338  340                  /*
 339  341                   * Keep L2SRC from a previous packet in chain since mhip
 340  342                   * might point into an earlier packet in the chain.
 341  343                   * Keep IRAF_VERIFIED_SRC to avoid redoing broadcast
 342  344                   * source check in forwarding path.
 343  345                   */
 344  346                  chain_flags |= (iras.ira_flags &
 345  347                      (IRAF_L2SRC_SET|IRAF_VERIFIED_SRC));
 346  348  
 347  349                  iras.ira_flags = IRAF_IS_IPV4 | IRAF_VERIFY_IP_CKSUM |
 348  350                      IRAF_VERIFY_ULP_CKSUM | chain_flags;
 349  351                  iras.ira_free_flags = 0;
 350  352                  iras.ira_cred = NULL;
 351  353                  iras.ira_cpid = NOPID;
 352  354                  iras.ira_tsl = NULL;
 353  355                  iras.ira_zoneid = ALL_ZONES;    /* Default for forwarding */
 354  356  
 355  357                  /*
 356  358                   * We must count all incoming packets, even if they end
 357  359                   * up being dropped later on. Defer counting bytes until
 358  360                   * we have the whole IP header in first mblk.
 359  361                   */
 360  362                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
 361  363  
 362  364                  iras.ira_pktlen = ntohs(ipha->ipha_length);
 363  365                  UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets,
 364  366                      iras.ira_pktlen);
 365  367  
 366  368                  /*
 367  369                   * Call one of:
 368  370                   *      ill_input_full_v4
 369  371                   *      ill_input_short_v4
 370  372                   * The former is used in unusual cases. See ill_set_inputfn().
 371  373                   */
 372  374                  (*ill->ill_inputfn)(mp, ipha, &ipha->ipha_dst, &iras, &rtc);
 373  375  
 374  376                  /* Any references to clean up? No hold on ira_ill */
 375  377                  if (iras.ira_flags & (IRAF_IPSEC_SECURE|IRAF_SYSTEM_LABELED))
 376  378                          ira_cleanup(&iras, B_FALSE);
 377  379  
 378  380                  if (iras.ira_target_sqp_mp != NULL) {
 379  381                          /* Better be called from ip_accept_tcp */
 380  382                          ASSERT(target_sqp != NULL);
 381  383  
 382  384                          /* Found one packet to accept */
 383  385                          mp = iras.ira_target_sqp_mp;
 384  386                          iras.ira_target_sqp_mp = NULL;
 385  387                          ASSERT(ip_recv_attr_is_mblk(mp));
 386  388  
 387  389                          if (atail != NULL)
 388  390                                  atail->b_next = mp;
 389  391                          else
 390  392                                  ahead = mp;
 391  393                          atail = mp;
 392  394                          acnt++;
 393  395                          mp = NULL;
 394  396                  }
 395  397                  /* mhip might point into 1st packet in the chain. */
 396  398                  iras.ira_mhip = NULL;
 397  399          }
 398  400          /* Any remaining references to the route cache? */
 399  401          if (rtc.rtc_ire != NULL) {
 400  402                  ASSERT(rtc.rtc_ipaddr != INADDR_ANY);
 401  403                  ire_refrele(rtc.rtc_ire);
 402  404          }
 403  405  
 404  406          if (ahead != NULL) {
 405  407                  /* Better be called from ip_accept_tcp */
 406  408                  ASSERT(target_sqp != NULL);
 407  409                  *last = atail;
 408  410                  *cnt = acnt;
 409  411                  return (ahead);
 410  412          }
 411  413  
 412  414          return (NULL);
 413  415  }
 414  416  
 415  417  /*
 416  418   * This input function is used when
 417  419   *  - is_system_labeled()
 418  420   *  - CGTP filtering
 419  421   *  - DHCP unicast before we have an IP address configured
 420  422   *  - there is an listener for IPPROTO_RSVP
 421  423   */
 422  424  void
 423  425  ill_input_full_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
 424  426      ip_recv_attr_t *ira, rtc_t *rtc)
 425  427  {
 426  428          ipha_t          *ipha = (ipha_t *)iph_arg;
 427  429          ipaddr_t        nexthop = *(ipaddr_t *)nexthop_arg;
 428  430          ill_t           *ill = ira->ira_ill;
 429  431          ip_stack_t      *ipst = ill->ill_ipst;
 430  432          int             cgtp_flt_pkt;
 431  433  
 432  434          ASSERT(ira->ira_tsl == NULL);
 433  435  
 434  436          /*
 435  437           * Attach any necessary label information to
 436  438           * this packet
 437  439           */
 438  440          if (is_system_labeled()) {
 439  441                  ira->ira_flags |= IRAF_SYSTEM_LABELED;
 440  442  
 441  443                  /*
 442  444                   * This updates ira_cred, ira_tsl and ira_free_flags based
 443  445                   * on the label.
 444  446                   */
 445  447                  if (!tsol_get_pkt_label(mp, IPV4_VERSION, ira)) {
 446  448                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 447  449                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
 448  450                          freemsg(mp);
 449  451                          return;
 450  452                  }
 451  453                  /* Note that ira_tsl can be NULL here. */
 452  454  
 453  455                  /* tsol_get_pkt_label sometimes does pullupmsg */
 454  456                  ipha = (ipha_t *)mp->b_rptr;
 455  457          }
 456  458  
 457  459          /*
 458  460           * Invoke the CGTP (multirouting) filtering module to process
 459  461           * the incoming packet. Packets identified as duplicates
 460  462           * must be discarded. Filtering is active only if the
 461  463           * the ip_cgtp_filter ndd variable is non-zero.
 462  464           */
 463  465          cgtp_flt_pkt = CGTP_IP_PKT_NOT_CGTP;
 464  466          if (ipst->ips_ip_cgtp_filter &&
 465  467              ipst->ips_ip_cgtp_filter_ops != NULL) {
 466  468                  netstackid_t stackid;
 467  469  
 468  470                  stackid = ipst->ips_netstack->netstack_stackid;
 469  471                  /*
 470  472                   * CGTP and IPMP are mutually exclusive so
 471  473                   * phyint_ifindex is fine here.
 472  474                   */
 473  475                  cgtp_flt_pkt =
 474  476                      ipst->ips_ip_cgtp_filter_ops->cfo_filter(stackid,
 475  477                      ill->ill_phyint->phyint_ifindex, mp);
 476  478                  if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
 477  479                          ip_drop_input("CGTP_IP_PKT_DUPLICATE", mp, ill);
 478  480                          freemsg(mp);
 479  481                          return;
 480  482                  }
 481  483          }
 482  484  
 483  485          /*
 484  486           * Brutal hack for DHCPv4 unicast: RFC2131 allows a DHCP
 485  487           * server to unicast DHCP packets to a DHCP client using the
 486  488           * IP address it is offering to the client.  This can be
 487  489           * disabled through the "broadcast bit", but not all DHCP
 488  490           * servers honor that bit.  Therefore, to interoperate with as
 489  491           * many DHCP servers as possible, the DHCP client allows the
 490  492           * server to unicast, but we treat those packets as broadcast
 491  493           * here.  Note that we don't rewrite the packet itself since
 492  494           * (a) that would mess up the checksums and (b) the DHCP
 493  495           * client conn is bound to INADDR_ANY so ip_fanout_udp() will
 494  496           * hand it the packet regardless.
 495  497           */
 496  498          if (ill->ill_dhcpinit != 0 &&
 497  499              ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION &&
 498  500              ipha->ipha_protocol == IPPROTO_UDP) {
 499  501                  udpha_t *udpha;
 500  502  
 501  503                  ipha = ip_pullup(mp, sizeof (ipha_t) + sizeof (udpha_t), ira);
 502  504                  if (ipha == NULL) {
 503  505                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 504  506                          ip_drop_input("ipIfStatsInDiscards - dhcp", mp, ill);
 505  507                          freemsg(mp);
 506  508                          return;
 507  509                  }
 508  510                  /* Reload since pullupmsg() can change b_rptr. */
 509  511                  udpha = (udpha_t *)&ipha[1];
 510  512  
 511  513                  if (ntohs(udpha->uha_dst_port) == IPPORT_BOOTPC) {
 512  514                          DTRACE_PROBE2(ip4__dhcpinit__pkt, ill_t *, ill,
 513  515                              mblk_t *, mp);
 514  516                          /*
 515  517                           * This assumes that we deliver to all conns for
 516  518                           * multicast and broadcast packets.
 517  519                           */
 518  520                          nexthop = INADDR_BROADCAST;
 519  521                          ira->ira_flags |= IRAF_DHCP_UNICAST;
 520  522                  }
 521  523          }
 522  524  
 523  525          /*
 524  526           * If rsvpd is running, let RSVP daemon handle its processing
 525  527           * and forwarding of RSVP multicast/unicast packets.
 526  528           * If rsvpd is not running but mrouted is running, RSVP
 527  529           * multicast packets are forwarded as multicast traffic
 528  530           * and RSVP unicast packets are forwarded by unicast router.
 529  531           * If neither rsvpd nor mrouted is running, RSVP multicast
 530  532           * packets are not forwarded, but the unicast packets are
 531  533           * forwarded like unicast traffic.
 532  534           */
 533  535          if (ipha->ipha_protocol == IPPROTO_RSVP &&
 534  536              ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head != NULL) {
 535  537                  /* RSVP packet and rsvpd running. Treat as ours */
 536  538                  ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(nexthop)));
 537  539                  /*
 538  540                   * We use a multicast address to get the packet to
 539  541                   * ire_recv_multicast_v4. There will not be a membership
 540  542                   * check since we set IRAF_RSVP
 541  543                   */
 542  544                  nexthop = htonl(INADDR_UNSPEC_GROUP);
 543  545                  ira->ira_flags |= IRAF_RSVP;
 544  546          }
 545  547  
 546  548          ill_input_short_v4(mp, ipha, &nexthop, ira, rtc);
 547  549  }
 548  550  
 549  551  /*
 550  552   * This is the tail-end of the full receive side packet handling.
 551  553   * It can be used directly when the configuration is simple.
 552  554   */
 553  555  void
 554  556  ill_input_short_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
 555  557      ip_recv_attr_t *ira, rtc_t *rtc)
 556  558  {
 557  559          ire_t           *ire;
 558  560          uint_t          opt_len;
 559  561          ill_t           *ill = ira->ira_ill;
 560  562          ip_stack_t      *ipst = ill->ill_ipst;
 561  563          uint_t          pkt_len;
 562  564          ssize_t         len;
 563  565          ipha_t          *ipha = (ipha_t *)iph_arg;
 564  566          ipaddr_t        nexthop = *(ipaddr_t *)nexthop_arg;
 565  567          ilb_stack_t     *ilbs = ipst->ips_netstack->netstack_ilb;
 566  568          uint_t          irr_flags;
 567  569  #define rptr    ((uchar_t *)ipha)
 568  570  
 569  571          ASSERT(DB_TYPE(mp) == M_DATA);
 570  572  
 571  573          /*
 572  574           * The following test for loopback is faster than
 573  575           * IP_LOOPBACK_ADDR(), because it avoids any bitwise
 574  576           * operations.
 575  577           * Note that these addresses are always in network byte order
 576  578           */
 577  579          if (((*(uchar_t *)&ipha->ipha_dst) == IN_LOOPBACKNET) ||
 578  580              ((*(uchar_t *)&ipha->ipha_src) == IN_LOOPBACKNET)) {
 579  581                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
 580  582                  ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
 581  583                  freemsg(mp);
 582  584                  return;
 583  585          }
 584  586  
 585  587          len = mp->b_wptr - rptr;
 586  588          pkt_len = ira->ira_pktlen;
 587  589  
 588  590          /* multiple mblk or too short */
 589  591          len -= pkt_len;
 590  592          if (len != 0) {
 591  593                  mp = ip_check_length(mp, rptr, len, pkt_len,
 592  594                      IP_SIMPLE_HDR_LENGTH, ira);
 593  595                  if (mp == NULL)
 594  596                          return;
 595  597                  ipha = (ipha_t *)mp->b_rptr;
 596  598          }
 597  599  
 598  600          DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
 599  601              ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *, NULL,
 600  602              int, 0);
 601  603  
 602  604          /*
 603  605           * The event for packets being received from a 'physical'
 604  606           * interface is placed after validation of the source and/or
 605  607           * destination address as being local so that packets can be
 606  608           * redirected to loopback addresses using ipnat.
 607  609           */
 608  610          DTRACE_PROBE4(ip4__physical__in__start,
 609  611              ill_t *, ill, ill_t *, NULL,
 610  612              ipha_t *, ipha, mblk_t *, mp);
 611  613  
 612  614          if (HOOKS4_INTERESTED_PHYSICAL_IN(ipst)) {
 613  615                  int     ll_multicast = 0;
 614  616                  int     error;
 615  617                  ipaddr_t orig_dst = ipha->ipha_dst;
 616  618  
 617  619                  if (ira->ira_flags & IRAF_L2DST_MULTICAST)
 618  620                          ll_multicast = HPE_MULTICAST;
 619  621                  else if (ira->ira_flags & IRAF_L2DST_BROADCAST)
 620  622                          ll_multicast = HPE_BROADCAST;
 621  623  
 622  624                  FW_HOOKS(ipst->ips_ip4_physical_in_event,
 623  625                      ipst->ips_ipv4firewall_physical_in,
 624  626                      ill, NULL, ipha, mp, mp, ll_multicast, ipst, error);
 625  627  
 626  628                  DTRACE_PROBE1(ip4__physical__in__end, mblk_t *, mp);
 627  629  
 628  630                  if (mp == NULL)
 629  631                          return;
 630  632                  /* The length could have changed */
 631  633                  ipha = (ipha_t *)mp->b_rptr;
 632  634                  ira->ira_pktlen = ntohs(ipha->ipha_length);
 633  635                  pkt_len = ira->ira_pktlen;
 634  636  
 635  637                  /*
 636  638                   * In case the destination changed we override any previous
 637  639                   * change to nexthop.
 638  640                   */
 639  641                  if (orig_dst != ipha->ipha_dst)
 640  642                          nexthop = ipha->ipha_dst;
 641  643                  if (nexthop == INADDR_ANY) {
 642  644                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
 643  645                          ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
 644  646                          freemsg(mp);
 645  647                          return;
 646  648                  }
 647  649          }
 648  650  
 649  651          if (ipst->ips_ip4_observe.he_interested) {
 650  652                  zoneid_t dzone;
 651  653  
 652  654                  /*
 653  655                   * On the inbound path the src zone will be unknown as
 654  656                   * this packet has come from the wire.
 655  657                   */
 656  658                  dzone = ip_get_zoneid_v4(nexthop, mp, ira, ALL_ZONES);
 657  659                  ipobs_hook(mp, IPOBS_HOOK_INBOUND, ALL_ZONES, dzone, ill, ipst);
 658  660          }
 659  661  
 660  662          /*
 661  663           * If there is a good HW IP header checksum we clear the need
 662  664           * look at the IP header checksum.
 663  665           */
 664  666          if ((DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM) &&
 665  667              ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
 666  668                  /* Header checksum was ok. Clear the flag */
 667  669                  DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM;
 668  670                  ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
 669  671          }
 670  672  
 671  673          /*
 672  674           * Here we check to see if we machine is setup as
 673  675           * L3 loadbalancer and if the incoming packet is for a VIP
 674  676           *
 675  677           * Check the following:
 676  678           * - there is at least a rule
 677  679           * - protocol of the packet is supported
 678  680           */
 679  681          if (ilb_has_rules(ilbs) && ILB_SUPP_L4(ipha->ipha_protocol)) {
 680  682                  ipaddr_t        lb_dst;
 681  683                  int             lb_ret;
 682  684  
 683  685                  /* For convenience, we pull up the mblk. */
 684  686                  if (mp->b_cont != NULL) {
 685  687                          if (pullupmsg(mp, -1) == 0) {
 686  688                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 687  689                                  ip_drop_input("ipIfStatsInDiscards - pullupmsg",
 688  690                                      mp, ill);
 689  691                                  freemsg(mp);
 690  692                                  return;
 691  693                          }
 692  694                          ipha = (ipha_t *)mp->b_rptr;
 693  695                  }
 694  696  
 695  697                  /*
 696  698                   * We just drop all fragments going to any VIP, at
 697  699                   * least for now....
 698  700                   */
 699  701                  if (ntohs(ipha->ipha_fragment_offset_and_flags) &
 700  702                      (IPH_MF | IPH_OFFSET)) {
 701  703                          if (!ilb_rule_match_vip_v4(ilbs, nexthop, NULL)) {
 702  704                                  goto after_ilb;
 703  705                          }
 704  706  
 705  707                          ILB_KSTAT_UPDATE(ilbs, ip_frag_in, 1);
 706  708                          ILB_KSTAT_UPDATE(ilbs, ip_frag_dropped, 1);
 707  709                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 708  710                          ip_drop_input("ILB fragment", mp, ill);
 709  711                          freemsg(mp);
 710  712                          return;
 711  713                  }
 712  714                  lb_ret = ilb_check_v4(ilbs, ill, mp, ipha, ipha->ipha_protocol,
 713  715                      (uint8_t *)ipha + IPH_HDR_LENGTH(ipha), &lb_dst);
 714  716  
 715  717                  if (lb_ret == ILB_DROPPED) {
 716  718                          /* Is this the right counter to increase? */
 717  719                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 718  720                          ip_drop_input("ILB_DROPPED", mp, ill);
 719  721                          freemsg(mp);
 720  722                          return;
 721  723                  }
 722  724                  if (lb_ret == ILB_BALANCED) {
 723  725                          /* Set the dst to that of the chosen server */
 724  726                          nexthop = lb_dst;
 725  727                          DB_CKSUMFLAGS(mp) = 0;
 726  728                  }
 727  729          }
 728  730  
 729  731  after_ilb:
 730  732          opt_len = ipha->ipha_version_and_hdr_length - IP_SIMPLE_HDR_VERSION;
 731  733          ira->ira_ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
 732  734          if (opt_len != 0) {
 733  735                  int error = 0;
 734  736  
 735  737                  ira->ira_ip_hdr_length += (opt_len << 2);
 736  738                  ira->ira_flags |= IRAF_IPV4_OPTIONS;
 737  739  
 738  740                  /* IP Options present!  Validate the length. */
 739  741                  mp = ip_check_optlen(mp, ipha, opt_len, pkt_len, ira);
 740  742                  if (mp == NULL)
 741  743                          return;
 742  744  
 743  745                  /* Might have changed */
 744  746                  ipha = (ipha_t *)mp->b_rptr;
 745  747  
 746  748                  /* Verify IP header checksum before parsing the options */
 747  749                  if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
 748  750                      ip_csum_hdr(ipha)) {
 749  751                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
 750  752                          ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
 751  753                          freemsg(mp);
 752  754                          return;
 753  755                  }
 754  756                  ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
 755  757  
 756  758                  /*
 757  759                   * Go off to ip_input_options which returns the next hop
 758  760                   * destination address, which may have been affected
 759  761                   * by source routing.
 760  762                   */
 761  763                  IP_STAT(ipst, ip_opt);
 762  764  
 763  765                  nexthop = ip_input_options(ipha, nexthop, mp, ira, &error);
 764  766                  if (error != 0) {
 765  767                          /*
 766  768                           * An ICMP error has been sent and the packet has
 767  769                           * been dropped.
 768  770                           */
 769  771                          return;
 770  772                  }
 771  773          }
 772  774  
 773  775          if (ill->ill_flags & ILLF_ROUTER)
 774  776                  irr_flags = IRR_ALLOCATE;
 775  777          else
 776  778                  irr_flags = IRR_NONE;
 777  779  
 778  780          /* Can not use route cache with TX since the labels can differ */
 779  781          if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
 780  782                  if (CLASSD(nexthop)) {
 781  783                          ire = ire_multicast(ill);
 782  784                  } else {
 783  785                          /* Match destination and label */
 784  786                          ire = ire_route_recursive_v4(nexthop, 0, NULL,
  
    | 
      ↓ open down ↓ | 
    751 lines elided | 
    
      ↑ open up ↑ | 
  
 785  787                              ALL_ZONES, ira->ira_tsl, MATCH_IRE_SECATTR,
 786  788                              irr_flags, ira->ira_xmit_hint, ipst, NULL, NULL,
 787  789                              NULL);
 788  790                  }
 789  791                  /* Update the route cache so we do the ire_refrele */
 790  792                  ASSERT(ire != NULL);
 791  793                  if (rtc->rtc_ire != NULL)
 792  794                          ire_refrele(rtc->rtc_ire);
 793  795                  rtc->rtc_ire = ire;
 794  796                  rtc->rtc_ipaddr = nexthop;
 795      -        } else if (nexthop == rtc->rtc_ipaddr) {
      797 +        } else if (nexthop == rtc->rtc_ipaddr && rtc->rtc_ire != NULL) {
 796  798                  /* Use the route cache */
 797      -                ASSERT(rtc->rtc_ire != NULL);
 798  799                  ire = rtc->rtc_ire;
 799  800          } else {
 800  801                  /* Update the route cache */
 801  802                  if (CLASSD(nexthop)) {
 802  803                          ire = ire_multicast(ill);
 803  804                  } else {
 804  805                          /* Just match the destination */
 805  806                          ire = ire_route_recursive_dstonly_v4(nexthop, irr_flags,
 806  807                              ira->ira_xmit_hint, ipst);
 807  808                  }
 808  809                  ASSERT(ire != NULL);
 809  810                  if (rtc->rtc_ire != NULL)
 810  811                          ire_refrele(rtc->rtc_ire);
 811  812                  rtc->rtc_ire = ire;
 812  813                  rtc->rtc_ipaddr = nexthop;
 813  814          }
 814  815  
 815  816          ire->ire_ib_pkt_count++;
 816  817  
 817  818          /*
 818  819           * Based on ire_type and ire_flags call one of:
 819  820           *      ire_recv_local_v4 - for IRE_LOCAL
 820  821           *      ire_recv_loopback_v4 - for IRE_LOOPBACK
 821  822           *      ire_recv_multirt_v4 - if RTF_MULTIRT
 822  823           *      ire_recv_noroute_v4 - if RTF_REJECT or RTF_BLACHOLE
 823  824           *      ire_recv_multicast_v4 - for IRE_MULTICAST
 824  825           *      ire_recv_broadcast_v4 - for IRE_BROADCAST
 825  826           *      ire_recv_noaccept_v4 - for ire_noaccept ones
 826  827           *      ire_recv_forward_v4 - for the rest.
 827  828           */
 828  829          (*ire->ire_recvfn)(ire, mp, ipha, ira);
 829  830  }
 830  831  #undef rptr
 831  832  
 832  833  /*
 833  834   * ire_recvfn for IREs that need forwarding
 834  835   */
 835  836  void
 836  837  ire_recv_forward_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
 837  838  {
 838  839          ipha_t          *ipha = (ipha_t *)iph_arg;
 839  840          ill_t           *ill = ira->ira_ill;
 840  841          ip_stack_t      *ipst = ill->ill_ipst;
 841  842          ill_t           *dst_ill;
 842  843          nce_t           *nce;
 843  844          ipaddr_t        src = ipha->ipha_src;
 844  845          uint32_t        added_tx_len;
 845  846          uint32_t        mtu, iremtu;
 846  847  
 847  848          if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
 848  849                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
 849  850                  ip_drop_input("l2 multicast not forwarded", mp, ill);
 850  851                  freemsg(mp);
 851  852                  return;
 852  853          }
 853  854  
 854  855          if (!(ill->ill_flags & ILLF_ROUTER) && !ip_source_routed(ipha, ipst)) {
 855  856                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
 856  857                  ip_drop_input("ipIfStatsForwProhibits", mp, ill);
 857  858                  freemsg(mp);
 858  859                  return;
 859  860          }
 860  861  
 861  862          /*
 862  863           * Either ire_nce_capable or ire_dep_parent would be set for the IRE
 863  864           * when it is found by ire_route_recursive, but that some other thread
 864  865           * could have changed the routes with the effect of clearing
 865  866           * ire_dep_parent. In that case we'd end up dropping the packet, or
 866  867           * finding a new nce below.
 867  868           * Get, allocate, or update the nce.
 868  869           * We get a refhold on ire_nce_cache as a result of this to avoid races
 869  870           * where ire_nce_cache is deleted.
 870  871           *
 871  872           * This ensures that we don't forward if the interface is down since
 872  873           * ipif_down removes all the nces.
 873  874           */
 874  875          mutex_enter(&ire->ire_lock);
 875  876          nce = ire->ire_nce_cache;
 876  877          if (nce == NULL) {
 877  878                  /* Not yet set up - try to set one up */
 878  879                  mutex_exit(&ire->ire_lock);
 879  880                  (void) ire_revalidate_nce(ire);
 880  881                  mutex_enter(&ire->ire_lock);
 881  882                  nce = ire->ire_nce_cache;
 882  883                  if (nce == NULL) {
 883  884                          mutex_exit(&ire->ire_lock);
 884  885                          /* The ire_dep_parent chain went bad, or no memory */
 885  886                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 886  887                          ip_drop_input("No ire_dep_parent", mp, ill);
 887  888                          freemsg(mp);
 888  889                          return;
 889  890                  }
 890  891          }
 891  892          nce_refhold(nce);
 892  893          mutex_exit(&ire->ire_lock);
 893  894  
 894  895          if (nce->nce_is_condemned) {
 895  896                  nce_t *nce1;
 896  897  
 897  898                  nce1 = ire_handle_condemned_nce(nce, ire, ipha, NULL, B_FALSE);
 898  899                  nce_refrele(nce);
 899  900                  if (nce1 == NULL) {
 900  901                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
 901  902                          ip_drop_input("No nce", mp, ill);
 902  903                          freemsg(mp);
 903  904                          return;
 904  905                  }
 905  906                  nce = nce1;
 906  907          }
 907  908          dst_ill = nce->nce_ill;
 908  909  
 909  910          /*
 910  911           * Unless we are forwarding, drop the packet.
 911  912           * We have to let source routed packets through if they go out
 912  913           * the same interface i.e., they are 'ping -l' packets.
 913  914           */
 914  915          if (!(dst_ill->ill_flags & ILLF_ROUTER) &&
 915  916              !(ip_source_routed(ipha, ipst) && dst_ill == ill)) {
 916  917                  if (ip_source_routed(ipha, ipst)) {
 917  918                          ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
 918  919                          icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
 919  920                          nce_refrele(nce);
 920  921                          return;
 921  922                  }
 922  923                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
 923  924                  ip_drop_input("ipIfStatsForwProhibits", mp, ill);
 924  925                  freemsg(mp);
 925  926                  nce_refrele(nce);
 926  927                  return;
 927  928          }
 928  929  
 929  930          if (ire->ire_zoneid != GLOBAL_ZONEID && ire->ire_zoneid != ALL_ZONES) {
 930  931                  ipaddr_t        dst = ipha->ipha_dst;
 931  932  
 932  933                  ire->ire_ib_pkt_count--;
 933  934                  /*
 934  935                   * Should only use IREs that are visible from the
 935  936                   * global zone for forwarding.
 936  937                   * Take a source route into account the same way as ip_input
 937  938                   * did.
 938  939                   */
 939  940                  if (ira->ira_flags & IRAF_IPV4_OPTIONS) {
 940  941                          int             error = 0;
 941  942  
 942  943                          dst = ip_input_options(ipha, dst, mp, ira, &error);
 943  944                          ASSERT(error == 0);     /* ip_input checked */
 944  945                  }
 945  946                  ire = ire_route_recursive_v4(dst, 0, NULL, GLOBAL_ZONEID,
 946  947                      ira->ira_tsl, MATCH_IRE_SECATTR,
 947  948                      (ill->ill_flags & ILLF_ROUTER) ? IRR_ALLOCATE : IRR_NONE,
 948  949                      ira->ira_xmit_hint, ipst, NULL, NULL, NULL);
 949  950                  ire->ire_ib_pkt_count++;
 950  951                  (*ire->ire_recvfn)(ire, mp, ipha, ira);
 951  952                  ire_refrele(ire);
 952  953                  nce_refrele(nce);
 953  954                  return;
 954  955          }
 955  956  
 956  957          /*
 957  958           * ipIfStatsHCInForwDatagrams should only be increment if there
 958  959           * will be an attempt to forward the packet, which is why we
 959  960           * increment after the above condition has been checked.
 960  961           */
 961  962          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
 962  963  
 963  964          /* Initiate Read side IPPF processing */
 964  965          if (IPP_ENABLED(IPP_FWD_IN, ipst)) {
 965  966                  /* ip_process translates an IS_UNDER_IPMP */
 966  967                  mp = ip_process(IPP_FWD_IN, mp, ill, ill);
 967  968                  if (mp == NULL) {
 968  969                          /* ip_drop_packet and MIB done */
 969  970                          ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred "
 970  971                              "during IPPF processing\n"));
 971  972                          nce_refrele(nce);
 972  973                          return;
 973  974                  }
 974  975          }
 975  976  
 976  977          DTRACE_PROBE4(ip4__forwarding__start,
 977  978              ill_t *, ill, ill_t *, dst_ill, ipha_t *, ipha, mblk_t *, mp);
 978  979  
 979  980          if (HOOKS4_INTERESTED_FORWARDING(ipst)) {
 980  981                  int error;
 981  982  
 982  983                  FW_HOOKS(ipst->ips_ip4_forwarding_event,
 983  984                      ipst->ips_ipv4firewall_forwarding,
 984  985                      ill, dst_ill, ipha, mp, mp, 0, ipst, error);
 985  986  
 986  987                  DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp);
 987  988  
 988  989                  if (mp == NULL) {
 989  990                          nce_refrele(nce);
 990  991                          return;
 991  992                  }
 992  993                  /*
 993  994                   * Even if the destination was changed by the filter we use the
 994  995                   * forwarding decision that was made based on the address
 995  996                   * in ip_input.
 996  997                   */
 997  998  
 998  999                  /* Might have changed */
 999 1000                  ipha = (ipha_t *)mp->b_rptr;
1000 1001                  ira->ira_pktlen = ntohs(ipha->ipha_length);
1001 1002          }
1002 1003  
1003 1004          /* Packet is being forwarded. Turning off hwcksum flag. */
1004 1005          DB_CKSUMFLAGS(mp) = 0;
1005 1006  
1006 1007          /*
1007 1008           * Martian Address Filtering [RFC 1812, Section 5.3.7]
1008 1009           * The loopback address check for both src and dst has already
1009 1010           * been checked in ip_input
1010 1011           * In the future one can envision adding RPF checks using number 3.
1011 1012           * If we already checked the same source address we can skip this.
1012 1013           */
1013 1014          if (!(ira->ira_flags & IRAF_VERIFIED_SRC) ||
1014 1015              src != ira->ira_verified_src) {
1015 1016                  switch (ipst->ips_src_check) {
1016 1017                  case 0:
1017 1018                          break;
1018 1019                  case 2:
1019 1020                          if (ip_type_v4(src, ipst) == IRE_BROADCAST) {
1020 1021                                  BUMP_MIB(ill->ill_ip_mib,
1021 1022                                      ipIfStatsForwProhibits);
1022 1023                                  BUMP_MIB(ill->ill_ip_mib,
1023 1024                                      ipIfStatsInAddrErrors);
1024 1025                                  ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1025 1026                                  freemsg(mp);
1026 1027                                  nce_refrele(nce);
1027 1028                                  return;
1028 1029                          }
1029 1030                          /* FALLTHRU */
1030 1031  
1031 1032                  case 1:
1032 1033                          if (CLASSD(src)) {
1033 1034                                  BUMP_MIB(ill->ill_ip_mib,
1034 1035                                      ipIfStatsForwProhibits);
1035 1036                                  BUMP_MIB(ill->ill_ip_mib,
1036 1037                                      ipIfStatsInAddrErrors);
1037 1038                                  ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1038 1039                                  freemsg(mp);
1039 1040                                  nce_refrele(nce);
1040 1041                                  return;
1041 1042                          }
1042 1043                          break;
1043 1044                  }
1044 1045                  /* Remember for next packet */
1045 1046                  ira->ira_flags |= IRAF_VERIFIED_SRC;
1046 1047                  ira->ira_verified_src = src;
1047 1048          }
1048 1049  
1049 1050          /*
1050 1051           * Check if packet is going out the same link on which it arrived.
1051 1052           * Means we might need to send a redirect.
1052 1053           */
1053 1054          if (IS_ON_SAME_LAN(dst_ill, ill) && ipst->ips_ip_g_send_redirects) {
1054 1055                  ip_send_potential_redirect_v4(mp, ipha, ire, ira);
1055 1056          }
1056 1057  
1057 1058          added_tx_len = 0;
1058 1059          if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
1059 1060                  mblk_t          *mp1;
1060 1061                  uint32_t        old_pkt_len = ira->ira_pktlen;
1061 1062  
1062 1063                  /* Verify IP header checksum before adding/removing options */
1063 1064                  if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
1064 1065                      ip_csum_hdr(ipha)) {
1065 1066                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1066 1067                          ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1067 1068                          freemsg(mp);
1068 1069                          nce_refrele(nce);
1069 1070                          return;
1070 1071                  }
1071 1072                  ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
1072 1073  
1073 1074                  /*
1074 1075                   * Check if it can be forwarded and add/remove
1075 1076                   * CIPSO options as needed.
1076 1077                   */
1077 1078                  if ((mp1 = tsol_ip_forward(ire, mp, ira)) == NULL) {
1078 1079                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1079 1080                          ip_drop_input("tsol_ip_forward", mp, ill);
1080 1081                          freemsg(mp);
1081 1082                          nce_refrele(nce);
1082 1083                          return;
1083 1084                  }
1084 1085                  /*
1085 1086                   * Size may have changed. Remember amount added in case
1086 1087                   * IP needs to send an ICMP too big.
1087 1088                   */
1088 1089                  mp = mp1;
1089 1090                  ipha = (ipha_t *)mp->b_rptr;
1090 1091                  ira->ira_pktlen = ntohs(ipha->ipha_length);
1091 1092                  ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
1092 1093                  if (ira->ira_pktlen > old_pkt_len)
1093 1094                          added_tx_len = ira->ira_pktlen - old_pkt_len;
1094 1095  
1095 1096                  /* Options can have been added or removed */
1096 1097                  if (ira->ira_ip_hdr_length != IP_SIMPLE_HDR_LENGTH)
1097 1098                          ira->ira_flags |= IRAF_IPV4_OPTIONS;
1098 1099                  else
1099 1100                          ira->ira_flags &= ~IRAF_IPV4_OPTIONS;
1100 1101          }
1101 1102  
1102 1103          mtu = dst_ill->ill_mtu;
1103 1104          if ((iremtu = ire->ire_metrics.iulp_mtu) != 0 && iremtu < mtu)
1104 1105                  mtu = iremtu;
1105 1106          ip_forward_xmit_v4(nce, ill, mp, ipha, ira, mtu, added_tx_len);
1106 1107          nce_refrele(nce);
1107 1108  }
1108 1109  
1109 1110  /*
1110 1111   * Used for sending out unicast and multicast packets that are
1111 1112   * forwarded.
1112 1113   */
1113 1114  void
1114 1115  ip_forward_xmit_v4(nce_t *nce, ill_t *ill, mblk_t *mp, ipha_t *ipha,
1115 1116      ip_recv_attr_t *ira, uint32_t mtu, uint32_t added_tx_len)
1116 1117  {
1117 1118          ill_t           *dst_ill = nce->nce_ill;
1118 1119          uint32_t        pkt_len;
1119 1120          uint32_t        sum;
1120 1121          iaflags_t       iraflags = ira->ira_flags;
1121 1122          ip_stack_t      *ipst = ill->ill_ipst;
1122 1123          iaflags_t       ixaflags;
1123 1124  
1124 1125          if (ipha->ipha_ttl <= 1) {
1125 1126                  /* Perhaps the checksum was bad */
1126 1127                  if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1127 1128                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1128 1129                          ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1129 1130                          freemsg(mp);
1130 1131                          return;
1131 1132                  }
1132 1133                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1133 1134                  ip_drop_input("ICMP_TTL_EXCEEDED", mp, ill);
1134 1135                  icmp_time_exceeded(mp, ICMP_TTL_EXCEEDED, ira);
1135 1136                  return;
1136 1137          }
1137 1138          ipha->ipha_ttl--;
1138 1139          /* Adjust the checksum to reflect the ttl decrement. */
1139 1140          sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST;
1140 1141          ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16));
1141 1142  
1142 1143          /* Check if there are options to update */
1143 1144          if (iraflags & IRAF_IPV4_OPTIONS) {
1144 1145                  ASSERT(ipha->ipha_version_and_hdr_length !=
1145 1146                      IP_SIMPLE_HDR_VERSION);
1146 1147                  ASSERT(!(iraflags & IRAF_VERIFY_IP_CKSUM));
1147 1148  
1148 1149                  if (!ip_forward_options(mp, ipha, dst_ill, ira)) {
1149 1150                          /* ipIfStatsForwProhibits and ip_drop_input done */
1150 1151                          return;
1151 1152                  }
1152 1153  
1153 1154                  ipha->ipha_hdr_checksum = 0;
1154 1155                  ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1155 1156          }
1156 1157  
1157 1158          /* Initiate Write side IPPF processing before any fragmentation */
1158 1159          if (IPP_ENABLED(IPP_FWD_OUT, ipst)) {
1159 1160                  /* ip_process translates an IS_UNDER_IPMP */
1160 1161                  mp = ip_process(IPP_FWD_OUT, mp, dst_ill, dst_ill);
1161 1162                  if (mp == NULL) {
1162 1163                          /* ip_drop_packet and MIB done */
1163 1164                          ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred" \
1164 1165                              " during IPPF processing\n"));
1165 1166                          return;
1166 1167                  }
1167 1168          }
1168 1169  
1169 1170          pkt_len = ira->ira_pktlen;
1170 1171  
1171 1172          BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsHCOutForwDatagrams);
1172 1173  
1173 1174          ixaflags = IXAF_IS_IPV4 | IXAF_NO_DEV_FLOW_CTL;
1174 1175  
1175 1176          if (pkt_len > mtu) {
1176 1177                  /*
1177 1178                   * It needs fragging on its way out.  If we haven't
1178 1179                   * verified the header checksum yet we do it now since
1179 1180                   * are going to put a surely good checksum in the
1180 1181                   * outgoing header, we have to make sure that it
1181 1182                   * was good coming in.
1182 1183                   */
1183 1184                  if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1184 1185                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1185 1186                          ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1186 1187                          freemsg(mp);
1187 1188                          return;
1188 1189                  }
1189 1190                  if (ipha->ipha_fragment_offset_and_flags & IPH_DF_HTONS) {
1190 1191                          BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutFragFails);
1191 1192                          ip_drop_output("ipIfStatsOutFragFails", mp, dst_ill);
1192 1193                          if (iraflags & IRAF_SYSTEM_LABELED) {
1193 1194                                  /*
1194 1195                                   * Remove any CIPSO option added by
1195 1196                                   * tsol_ip_forward, and make sure we report
1196 1197                                   * a path MTU so that there
1197 1198                                   * is room to add such a CIPSO option for future
1198 1199                                   * packets.
1199 1200                                   */
1200 1201                                  mtu = tsol_pmtu_adjust(mp, mtu, added_tx_len,
1201 1202                                      AF_INET);
1202 1203                          }
1203 1204  
1204 1205                          icmp_frag_needed(mp, mtu, ira);
1205 1206                          return;
1206 1207                  }
1207 1208  
1208 1209                  (void) ip_fragment_v4(mp, nce, ixaflags, pkt_len, mtu,
1209 1210                      ira->ira_xmit_hint, GLOBAL_ZONEID, 0, ip_xmit, NULL);
1210 1211                  return;
1211 1212          }
1212 1213  
1213 1214          ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length));
1214 1215          if (iraflags & IRAF_LOOPBACK_COPY) {
1215 1216                  /*
1216 1217                   * IXAF_NO_LOOP_ZONEID is not set hence 7th arg
1217 1218                   * is don't care
1218 1219                   */
1219 1220                  (void) ip_postfrag_loopcheck(mp, nce,
1220 1221                      ixaflags | IXAF_LOOPBACK_COPY,
1221 1222                      pkt_len, ira->ira_xmit_hint, GLOBAL_ZONEID, 0, NULL);
1222 1223          } else {
1223 1224                  (void) ip_xmit(mp, nce, ixaflags, pkt_len, ira->ira_xmit_hint,
1224 1225                      GLOBAL_ZONEID, 0, NULL);
1225 1226          }
1226 1227  }
1227 1228  
1228 1229  /*
1229 1230   * ire_recvfn for RTF_REJECT and RTF_BLACKHOLE routes, including IRE_NOROUTE,
1230 1231   * which is what ire_route_recursive returns when there is no matching ire.
1231 1232   * Send ICMP unreachable unless blackhole.
1232 1233   */
1233 1234  void
1234 1235  ire_recv_noroute_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1235 1236  {
1236 1237          ipha_t          *ipha = (ipha_t *)iph_arg;
1237 1238          ill_t           *ill = ira->ira_ill;
1238 1239          ip_stack_t      *ipst = ill->ill_ipst;
1239 1240  
1240 1241          /* Would we have forwarded this packet if we had a route? */
1241 1242          if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
1242 1243                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1243 1244                  ip_drop_input("l2 multicast not forwarded", mp, ill);
1244 1245                  freemsg(mp);
1245 1246                  return;
1246 1247          }
1247 1248  
1248 1249          if (!(ill->ill_flags & ILLF_ROUTER)) {
1249 1250                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1250 1251                  ip_drop_input("ipIfStatsForwProhibits", mp, ill);
1251 1252                  freemsg(mp);
1252 1253                  return;
1253 1254          }
1254 1255          /*
1255 1256           * If we had a route this could have been forwarded. Count as such.
1256 1257           *
1257 1258           * ipIfStatsHCInForwDatagrams should only be increment if there
1258 1259           * will be an attempt to forward the packet, which is why we
1259 1260           * increment after the above condition has been checked.
1260 1261           */
1261 1262          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
1262 1263  
1263 1264          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1264 1265  
1265 1266          ip_rts_change(RTM_MISS, ipha->ipha_dst, 0, 0, 0, 0, 0, 0, RTA_DST,
1266 1267              ipst);
1267 1268  
1268 1269          if (ire->ire_flags & RTF_BLACKHOLE) {
1269 1270                  ip_drop_input("ipIfStatsInNoRoutes RTF_BLACKHOLE", mp, ill);
1270 1271                  freemsg(mp);
1271 1272          } else {
1272 1273                  ip_drop_input("ipIfStatsInNoRoutes RTF_REJECT", mp, ill);
1273 1274  
1274 1275                  if (ip_source_routed(ipha, ipst)) {
1275 1276                          icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
1276 1277                  } else {
1277 1278                          icmp_unreachable(mp, ICMP_HOST_UNREACHABLE, ira);
1278 1279                  }
1279 1280          }
1280 1281  }
1281 1282  
1282 1283  /*
1283 1284   * ire_recvfn for IRE_LOCALs marked with ire_noaccept. Such IREs are used for
1284 1285   * VRRP when in noaccept mode.
1285 1286   * We silently drop the packet. ARP handles packets even if noaccept is set.
1286 1287   */
1287 1288  /* ARGSUSED */
1288 1289  void
1289 1290  ire_recv_noaccept_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1290 1291      ip_recv_attr_t *ira)
1291 1292  {
1292 1293          ill_t           *ill = ira->ira_ill;
1293 1294  
1294 1295          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1295 1296          ip_drop_input("ipIfStatsInDiscards - noaccept", mp, ill);
1296 1297          freemsg(mp);
1297 1298  }
1298 1299  
1299 1300  /*
1300 1301   * ire_recvfn for IRE_BROADCAST.
1301 1302   */
1302 1303  void
1303 1304  ire_recv_broadcast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1304 1305      ip_recv_attr_t *ira)
1305 1306  {
1306 1307          ipha_t          *ipha = (ipha_t *)iph_arg;
1307 1308          ill_t           *ill = ira->ira_ill;
1308 1309          ill_t           *dst_ill = ire->ire_ill;
1309 1310          ip_stack_t      *ipst = ill->ill_ipst;
1310 1311          ire_t           *alt_ire;
1311 1312          nce_t           *nce;
1312 1313          ipaddr_t        ipha_dst;
1313 1314  
1314 1315          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInBcastPkts);
1315 1316  
1316 1317          /* Tag for higher-level protocols */
1317 1318          ira->ira_flags |= IRAF_BROADCAST;
1318 1319  
1319 1320          /*
1320 1321           * Whether local or directed broadcast forwarding: don't allow
1321 1322           * for TCP.
1322 1323           */
1323 1324          if (ipha->ipha_protocol == IPPROTO_TCP) {
1324 1325                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1325 1326                  ip_drop_input("ipIfStatsInDiscards", mp, ill);
1326 1327                  freemsg(mp);
1327 1328                  return;
1328 1329          }
1329 1330  
1330 1331          /*
1331 1332           * So that we don't end up with dups, only one ill an IPMP group is
1332 1333           * nominated to receive broadcast traffic.
1333 1334           * If we have no cast_ill we are liberal and accept everything.
1334 1335           */
1335 1336          if (IS_UNDER_IPMP(ill)) {
1336 1337                  /* For an under ill_grp can change under lock */
1337 1338                  rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1338 1339                  if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1339 1340                      ill->ill_grp->ig_cast_ill != NULL) {
1340 1341                          rw_exit(&ipst->ips_ill_g_lock);
1341 1342                          /* No MIB since this is normal operation */
1342 1343                          ip_drop_input("not nom_cast", mp, ill);
1343 1344                          freemsg(mp);
1344 1345                          return;
1345 1346                  }
1346 1347                  rw_exit(&ipst->ips_ill_g_lock);
1347 1348  
1348 1349                  ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1349 1350          }
1350 1351  
1351 1352          /*
1352 1353           * After reassembly and IPsec we will need to duplicate the
1353 1354           * broadcast packet for all matching zones on the ill.
1354 1355           */
1355 1356          ira->ira_zoneid = ALL_ZONES;
1356 1357  
1357 1358          /*
1358 1359           * Check for directed broadcast i.e. ire->ire_ill is different than
1359 1360           * the incoming ill.
1360 1361           * The same broadcast address can be assigned to multiple interfaces
1361 1362           * so have to check explicitly for that case by looking up the alt_ire
1362 1363           */
1363 1364          if (dst_ill == ill && !(ire->ire_flags & RTF_MULTIRT)) {
1364 1365                  /* Reassemble on the ill on which the packet arrived */
1365 1366                  ip_input_local_v4(ire, mp, ipha, ira);
1366 1367                  /* Restore */
1367 1368                  ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1368 1369                  return;
1369 1370          }
1370 1371  
1371 1372          /* Is there an IRE_BROADCAST on the incoming ill? */
1372 1373          ipha_dst = ((ira->ira_flags & IRAF_DHCP_UNICAST) ? INADDR_BROADCAST :
1373 1374              ipha->ipha_dst);
1374 1375          alt_ire = ire_ftable_lookup_v4(ipha_dst, 0, 0, IRE_BROADCAST, ill,
1375 1376              ALL_ZONES, ira->ira_tsl,
1376 1377              MATCH_IRE_TYPE|MATCH_IRE_ILL|MATCH_IRE_SECATTR, 0, ipst, NULL);
1377 1378          if (alt_ire != NULL) {
1378 1379                  /* Not a directed broadcast */
1379 1380                  /*
1380 1381                   * In the special case of multirouted broadcast
1381 1382                   * packets, we unconditionally need to "gateway"
1382 1383                   * them to the appropriate interface here so that reassembly
1383 1384                   * works. We know that the IRE_BROADCAST on cgtp0 doesn't
1384 1385                   * have RTF_MULTIRT set so we look for such an IRE in the
1385 1386                   * bucket.
1386 1387                   */
1387 1388                  if (alt_ire->ire_flags & RTF_MULTIRT) {
1388 1389                          irb_t           *irb;
1389 1390                          ire_t           *ire1;
1390 1391  
1391 1392                          irb = ire->ire_bucket;
1392 1393                          irb_refhold(irb);
1393 1394                          for (ire1 = irb->irb_ire; ire1 != NULL;
1394 1395                              ire1 = ire1->ire_next) {
1395 1396                                  if (IRE_IS_CONDEMNED(ire1))
1396 1397                                          continue;
1397 1398                                  if (!(ire1->ire_type & IRE_BROADCAST) ||
1398 1399                                      (ire1->ire_flags & RTF_MULTIRT))
1399 1400                                          continue;
1400 1401                                  ill = ire1->ire_ill;
1401 1402                                  ill_refhold(ill);
1402 1403                                  break;
1403 1404                          }
1404 1405                          irb_refrele(irb);
1405 1406                          if (ire1 != NULL) {
1406 1407                                  ill_t *orig_ill = ira->ira_ill;
1407 1408  
1408 1409                                  ire_refrele(alt_ire);
1409 1410                                  /* Reassemble on the new ill */
1410 1411                                  ira->ira_ill = ill;
1411 1412                                  ip_input_local_v4(ire, mp, ipha, ira);
1412 1413                                  ill_refrele(ill);
1413 1414                                  /* Restore */
1414 1415                                  ira->ira_ill = orig_ill;
1415 1416                                  ira->ira_ruifindex =
1416 1417                                      orig_ill->ill_phyint->phyint_ifindex;
1417 1418                                  return;
1418 1419                          }
1419 1420                  }
1420 1421                  ire_refrele(alt_ire);
1421 1422                  /* Reassemble on the ill on which the packet arrived */
1422 1423                  ip_input_local_v4(ire, mp, ipha, ira);
1423 1424                  goto done;
1424 1425          }
1425 1426  
1426 1427          /*
1427 1428           * This is a directed broadcast
1428 1429           *
1429 1430           * If directed broadcast is allowed, then forward the packet out
1430 1431           * the destination interface with IXAF_LOOPBACK_COPY set. That will
1431 1432           * result in ip_input() receiving a copy of the packet on the
1432 1433           * appropriate ill. (We could optimize this to avoid the extra trip
1433 1434           * via ip_input(), but since directed broadcasts are normally disabled
1434 1435           * it doesn't make sense to optimize it.)
1435 1436           */
1436 1437          if (!ipst->ips_ip_g_forward_directed_bcast ||
1437 1438              (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST))) {
1438 1439                  ip_drop_input("directed broadcast not allowed", mp, ill);
1439 1440                  freemsg(mp);
1440 1441                  goto done;
1441 1442          }
1442 1443          if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1443 1444                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1444 1445                  ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1445 1446                  freemsg(mp);
1446 1447                  goto done;
1447 1448          }
1448 1449  
1449 1450          /*
1450 1451           * Clear the indication that this may have hardware
1451 1452           * checksum as we are not using it for forwarding.
1452 1453           */
1453 1454          DB_CKSUMFLAGS(mp) = 0;
1454 1455  
1455 1456          /*
1456 1457           * Adjust ttl to 2 (1+1 - the forward engine will decrement it by one.
1457 1458           */
1458 1459          ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl + 1;
1459 1460          ipha->ipha_hdr_checksum = 0;
1460 1461          ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1461 1462  
1462 1463          /*
1463 1464           * We use ip_forward_xmit to do any fragmentation.
1464 1465           * and loopback copy on the outbound interface.
1465 1466           *
1466 1467           * Make it so that IXAF_LOOPBACK_COPY to be set on transmit side.
1467 1468           */
1468 1469          ira->ira_flags |= IRAF_LOOPBACK_COPY;
1469 1470  
1470 1471          nce = arp_nce_init(dst_ill, ipha->ipha_dst, IRE_BROADCAST);
1471 1472          if (nce == NULL) {
1472 1473                  BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutDiscards);
1473 1474                  ip_drop_output("No nce", mp, dst_ill);
1474 1475                  freemsg(mp);
1475 1476                  goto done;
1476 1477          }
1477 1478  
1478 1479          ip_forward_xmit_v4(nce, ill, mp, ipha, ira, dst_ill->ill_mc_mtu, 0);
1479 1480          nce_refrele(nce);
1480 1481  done:
1481 1482          /* Restore */
1482 1483          ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1483 1484  }
1484 1485  
1485 1486  /*
1486 1487   * ire_recvfn for IRE_MULTICAST.
1487 1488   */
1488 1489  void
1489 1490  ire_recv_multicast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1490 1491      ip_recv_attr_t *ira)
1491 1492  {
1492 1493          ipha_t          *ipha = (ipha_t *)iph_arg;
1493 1494          ill_t           *ill = ira->ira_ill;
1494 1495          ip_stack_t      *ipst = ill->ill_ipst;
1495 1496  
1496 1497          ASSERT(ire->ire_ill == ira->ira_ill);
1497 1498  
1498 1499          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts);
1499 1500          UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets, ira->ira_pktlen);
1500 1501  
1501 1502          /* RSVP hook */
1502 1503          if (ira->ira_flags & IRAF_RSVP)
1503 1504                  goto forus;
1504 1505  
1505 1506          /* Tag for higher-level protocols */
1506 1507          ira->ira_flags |= IRAF_MULTICAST;
1507 1508  
1508 1509          /*
1509 1510           * So that we don't end up with dups, only one ill an IPMP group is
1510 1511           * nominated to receive multicast traffic.
1511 1512           * If we have no cast_ill we are liberal and accept everything.
1512 1513           */
1513 1514          if (IS_UNDER_IPMP(ill)) {
1514 1515                  ip_stack_t      *ipst = ill->ill_ipst;
1515 1516  
1516 1517                  /* For an under ill_grp can change under lock */
1517 1518                  rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1518 1519                  if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1519 1520                      ill->ill_grp->ig_cast_ill != NULL) {
1520 1521                          rw_exit(&ipst->ips_ill_g_lock);
1521 1522                          ip_drop_input("not on cast ill", mp, ill);
1522 1523                          freemsg(mp);
1523 1524                          return;
1524 1525                  }
1525 1526                  rw_exit(&ipst->ips_ill_g_lock);
1526 1527                  /*
1527 1528                   * We switch to the upper ill so that mrouter and hasmembers
1528 1529                   * can operate on upper here and in ip_input_multicast.
1529 1530                   */
1530 1531                  ill = ipmp_ill_hold_ipmp_ill(ill);
1531 1532                  if (ill != NULL) {
1532 1533                          ASSERT(ill != ira->ira_ill);
1533 1534                          ASSERT(ire->ire_ill == ira->ira_ill);
1534 1535                          ira->ira_ill = ill;
1535 1536                          ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1536 1537                  } else {
1537 1538                          ill = ira->ira_ill;
1538 1539                  }
1539 1540          }
1540 1541  
1541 1542          /*
1542 1543           * Check if we are a multicast router - send ip_mforward a copy of
1543 1544           * the packet.
1544 1545           * Due to mroute_decap tunnels we consider forwarding packets even if
1545 1546           * mrouted has not joined the allmulti group on this interface.
1546 1547           */
1547 1548          if (ipst->ips_ip_g_mrouter) {
1548 1549                  int retval;
1549 1550  
1550 1551                  /*
1551 1552                   * Clear the indication that this may have hardware
1552 1553                   * checksum as we are not using it for forwarding.
1553 1554                   */
1554 1555                  DB_CKSUMFLAGS(mp) = 0;
1555 1556  
1556 1557                  /*
1557 1558                   * ip_mforward helps us make these distinctions: If received
1558 1559                   * on tunnel and not IGMP, then drop.
1559 1560                   * If IGMP packet, then don't check membership
1560 1561                   * If received on a phyint and IGMP or PIM, then
1561 1562                   * don't check membership
1562 1563                   */
1563 1564                  retval = ip_mforward(mp, ira);
1564 1565                  /* ip_mforward updates mib variables if needed */
1565 1566  
1566 1567                  switch (retval) {
1567 1568                  case 0:
1568 1569                          /*
1569 1570                           * pkt is okay and arrived on phyint.
1570 1571                           *
1571 1572                           * If we are running as a multicast router
1572 1573                           * we need to see all IGMP and/or PIM packets.
1573 1574                           */
1574 1575                          if ((ipha->ipha_protocol == IPPROTO_IGMP) ||
1575 1576                              (ipha->ipha_protocol == IPPROTO_PIM)) {
1576 1577                                  goto forus;
1577 1578                          }
1578 1579                          break;
1579 1580                  case -1:
1580 1581                          /* pkt is mal-formed, toss it */
1581 1582                          freemsg(mp);
1582 1583                          goto done;
1583 1584                  case 1:
1584 1585                          /*
1585 1586                           * pkt is okay and arrived on a tunnel
1586 1587                           *
1587 1588                           * If we are running a multicast router
1588 1589                           * we need to see all igmp packets.
1589 1590                           */
1590 1591                          if (ipha->ipha_protocol == IPPROTO_IGMP) {
1591 1592                                  goto forus;
1592 1593                          }
1593 1594                          ip_drop_input("Multicast on tunnel ignored", mp, ill);
1594 1595                          freemsg(mp);
1595 1596                          goto done;
1596 1597                  }
1597 1598          }
1598 1599  
1599 1600          /*
1600 1601           * Check if we have members on this ill. This is not necessary for
1601 1602           * correctness because even if the NIC/GLD had a leaky filter, we
1602 1603           * filter before passing to each conn_t.
1603 1604           */
1604 1605          if (!ill_hasmembers_v4(ill, ipha->ipha_dst)) {
1605 1606                  /*
1606 1607                   * Nobody interested
1607 1608                   *
1608 1609                   * This might just be caused by the fact that
1609 1610                   * multiple IP Multicast addresses map to the same
1610 1611                   * link layer multicast - no need to increment counter!
1611 1612                   */
1612 1613                  ip_drop_input("Multicast with no members", mp, ill);
1613 1614                  freemsg(mp);
1614 1615                  goto done;
1615 1616          }
1616 1617  forus:
1617 1618          ip2dbg(("ire_recv_multicast_v4: multicast for us: 0x%x\n",
1618 1619              ntohl(ipha->ipha_dst)));
1619 1620  
1620 1621          /*
1621 1622           * After reassembly and IPsec we will need to duplicate the
1622 1623           * multicast packet for all matching zones on the ill.
1623 1624           */
1624 1625          ira->ira_zoneid = ALL_ZONES;
1625 1626  
1626 1627          /* Reassemble on the ill on which the packet arrived */
1627 1628          ip_input_local_v4(ire, mp, ipha, ira);
1628 1629  done:
1629 1630          if (ill != ire->ire_ill) {
1630 1631                  ill_refrele(ill);
1631 1632                  ira->ira_ill = ire->ire_ill;
1632 1633                  ira->ira_ruifindex = ira->ira_ill->ill_phyint->phyint_ifindex;
1633 1634          }
1634 1635  }
1635 1636  
1636 1637  /*
1637 1638   * ire_recvfn for IRE_OFFLINK with RTF_MULTIRT.
1638 1639   * Drop packets since we don't forward out multirt routes.
1639 1640   */
1640 1641  /* ARGSUSED */
1641 1642  void
1642 1643  ire_recv_multirt_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1643 1644  {
1644 1645          ill_t           *ill = ira->ira_ill;
1645 1646  
1646 1647          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1647 1648          ip_drop_input("Not forwarding out MULTIRT", mp, ill);
1648 1649          freemsg(mp);
1649 1650  }
1650 1651  
1651 1652  /*
1652 1653   * ire_recvfn for IRE_LOOPBACK. This is only used when a FW_HOOK
1653 1654   * has rewritten the packet to have a loopback destination address (We
1654 1655   * filter out packet with a loopback destination from arriving over the wire).
1655 1656   * We don't know what zone to use, thus we always use the GLOBAL_ZONEID.
1656 1657   */
1657 1658  void
1658 1659  ire_recv_loopback_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1659 1660  {
1660 1661          ipha_t          *ipha = (ipha_t *)iph_arg;
1661 1662          ill_t           *ill = ira->ira_ill;
1662 1663          ill_t           *ire_ill = ire->ire_ill;
1663 1664  
1664 1665          ira->ira_zoneid = GLOBAL_ZONEID;
1665 1666  
1666 1667          /* Switch to the lo0 ill for further processing  */
1667 1668          if (ire_ill != ill) {
1668 1669                  /*
1669 1670                   * Update ira_ill to be the ILL on which the IP address
1670 1671                   * is hosted.
1671 1672                   * No need to hold the ill since we have a hold on the ire
1672 1673                   */
1673 1674                  ASSERT(ira->ira_ill == ira->ira_rill);
1674 1675                  ira->ira_ill = ire_ill;
1675 1676  
1676 1677                  ip_input_local_v4(ire, mp, ipha, ira);
1677 1678  
1678 1679                  /* Restore */
1679 1680                  ASSERT(ira->ira_ill == ire_ill);
1680 1681                  ira->ira_ill = ill;
1681 1682                  return;
1682 1683  
1683 1684          }
1684 1685          ip_input_local_v4(ire, mp, ipha, ira);
1685 1686  }
1686 1687  
1687 1688  /*
1688 1689   * ire_recvfn for IRE_LOCAL.
1689 1690   */
1690 1691  void
1691 1692  ire_recv_local_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1692 1693  {
1693 1694          ipha_t          *ipha = (ipha_t *)iph_arg;
1694 1695          ill_t           *ill = ira->ira_ill;
1695 1696          ill_t           *ire_ill = ire->ire_ill;
1696 1697  
1697 1698          /* Make a note for DAD that this address is in use */
1698 1699          ire->ire_last_used_time = LBOLT_FASTPATH;
1699 1700  
1700 1701          /* Only target the IRE_LOCAL with the right zoneid. */
1701 1702          ira->ira_zoneid = ire->ire_zoneid;
1702 1703  
1703 1704          /*
1704 1705           * If the packet arrived on the wrong ill, we check that
1705 1706           * this is ok.
1706 1707           * If it is, then we ensure that we do the reassembly on
1707 1708           * the ill on which the address is hosted. We keep ira_rill as
1708 1709           * the one on which the packet arrived, so that IP_PKTINFO and
1709 1710           * friends can report this.
1710 1711           */
1711 1712          if (ire_ill != ill) {
1712 1713                  ire_t *new_ire;
1713 1714  
1714 1715                  new_ire = ip_check_multihome(&ipha->ipha_dst, ire, ill);
1715 1716                  if (new_ire == NULL) {
1716 1717                          /* Drop packet */
1717 1718                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1718 1719                          ip_drop_input("ipIfStatsInForwProhibits", mp, ill);
1719 1720                          freemsg(mp);
1720 1721                          return;
1721 1722                  }
1722 1723                  /*
1723 1724                   * Update ira_ill to be the ILL on which the IP address
1724 1725                   * is hosted. No need to hold the ill since we have a
1725 1726                   * hold on the ire. Note that we do the switch even if
1726 1727                   * new_ire == ire (for IPMP, ire would be the one corresponding
1727 1728                   * to the IPMP ill).
1728 1729                   */
1729 1730                  ASSERT(ira->ira_ill == ira->ira_rill);
1730 1731                  ira->ira_ill = new_ire->ire_ill;
1731 1732  
1732 1733                  /* ira_ruifindex tracks the upper for ira_rill */
1733 1734                  if (IS_UNDER_IPMP(ill))
1734 1735                          ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1735 1736  
1736 1737                  ip_input_local_v4(new_ire, mp, ipha, ira);
1737 1738  
1738 1739                  /* Restore */
1739 1740                  ASSERT(ira->ira_ill == new_ire->ire_ill);
1740 1741                  ira->ira_ill = ill;
1741 1742                  ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1742 1743  
1743 1744                  if (new_ire != ire)
1744 1745                          ire_refrele(new_ire);
1745 1746                  return;
1746 1747          }
1747 1748  
1748 1749          ip_input_local_v4(ire, mp, ipha, ira);
1749 1750  }
1750 1751  
1751 1752  /*
1752 1753   * Common function for packets arriving for the host. Handles
1753 1754   * checksum verification, reassembly checks, etc.
1754 1755   */
1755 1756  static void
1756 1757  ip_input_local_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1757 1758  {
1758 1759          ill_t           *ill = ira->ira_ill;
1759 1760          iaflags_t       iraflags = ira->ira_flags;
1760 1761  
1761 1762          /*
1762 1763           * Verify IP header checksum. If the packet was AH or ESP then
1763 1764           * this flag has already been cleared. Likewise if the packet
1764 1765           * had a hardware checksum.
1765 1766           */
1766 1767          if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1767 1768                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1768 1769                  ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1769 1770                  freemsg(mp);
1770 1771                  return;
1771 1772          }
1772 1773  
1773 1774          if (iraflags & IRAF_IPV4_OPTIONS) {
1774 1775                  if (!ip_input_local_options(mp, ipha, ira)) {
1775 1776                          /* Error has been sent and mp consumed */
1776 1777                          return;
1777 1778                  }
1778 1779                  /*
1779 1780                   * Some old hardware does partial checksum by including the
1780 1781                   * whole IP header, so the partial checksum value might have
1781 1782                   * become invalid if any option in the packet have been
1782 1783                   * updated. Always clear partial checksum flag here.
1783 1784                   */
1784 1785                  DB_CKSUMFLAGS(mp) &= ~HCK_PARTIALCKSUM;
1785 1786          }
1786 1787  
1787 1788          /*
1788 1789           * Is packet part of fragmented IP packet?
1789 1790           * We compare against defined values in network byte order
1790 1791           */
1791 1792          if (ipha->ipha_fragment_offset_and_flags &
1792 1793              (IPH_MF_HTONS | IPH_OFFSET_HTONS)) {
1793 1794                  /*
1794 1795                   * Make sure we have ira_l2src before we loose the original
1795 1796                   * mblk
1796 1797                   */
1797 1798                  if (!(ira->ira_flags & IRAF_L2SRC_SET))
1798 1799                          ip_setl2src(mp, ira, ira->ira_rill);
1799 1800  
1800 1801                  mp = ip_input_fragment(mp, ipha, ira);
1801 1802                  if (mp == NULL)
1802 1803                          return;
1803 1804                  /* Completed reassembly */
1804 1805                  ipha = (ipha_t *)mp->b_rptr;
1805 1806          }
1806 1807  
1807 1808          /*
1808 1809           * For broadcast and multicast we need some extra work before
1809 1810           * we call ip_fanout_v4(), since in the case of shared-IP zones
1810 1811           * we need to pretend that a packet arrived for each zoneid.
1811 1812           */
1812 1813          if (iraflags & IRAF_MULTIBROADCAST) {
1813 1814                  if (iraflags & IRAF_BROADCAST)
1814 1815                          ip_input_broadcast_v4(ire, mp, ipha, ira);
1815 1816                  else
1816 1817                          ip_input_multicast_v4(ire, mp, ipha, ira);
1817 1818                  return;
1818 1819          }
1819 1820          ip_fanout_v4(mp, ipha, ira);
1820 1821  }
1821 1822  
1822 1823  
1823 1824  /*
1824 1825   * Handle multiple zones which match the same broadcast address
1825 1826   * and ill by delivering a packet to each of them.
1826 1827   * Walk the bucket and look for different ire_zoneid but otherwise
1827 1828   * the same IRE (same ill/addr/mask/type).
1828 1829   * Note that ire_add() tracks IREs that are identical in all
1829 1830   * fields (addr/mask/type/gw/ill/zoneid) within a single IRE by
1830 1831   * increasing ire_identical_cnt. Thus we don't need to be concerned
1831 1832   * about those.
1832 1833   */
1833 1834  static void
1834 1835  ip_input_broadcast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1835 1836  {
1836 1837          ill_t           *ill = ira->ira_ill;
1837 1838          ip_stack_t      *ipst = ill->ill_ipst;
1838 1839          netstack_t      *ns = ipst->ips_netstack;
1839 1840          irb_t           *irb;
1840 1841          ire_t           *ire1;
1841 1842          mblk_t          *mp1;
1842 1843          ipha_t          *ipha1;
1843 1844          uint_t          ira_pktlen = ira->ira_pktlen;
1844 1845          uint16_t        ira_ip_hdr_length = ira->ira_ip_hdr_length;
1845 1846  
1846 1847          irb = ire->ire_bucket;
1847 1848  
1848 1849          /*
1849 1850           * If we don't have more than one shared-IP zone, or if
1850 1851           * there can't be more than one IRE_BROADCAST for this
1851 1852           * IP address, then just set the zoneid and proceed.
1852 1853           */
1853 1854          if (ns->netstack_numzones == 1 || irb->irb_ire_cnt == 1) {
1854 1855                  ira->ira_zoneid = ire->ire_zoneid;
1855 1856  
1856 1857                  ip_fanout_v4(mp, ipha, ira);
1857 1858                  return;
1858 1859          }
1859 1860          irb_refhold(irb);
1860 1861          for (ire1 = irb->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
1861 1862                  /* We do the main IRE after the end of the loop */
1862 1863                  if (ire1 == ire)
1863 1864                          continue;
1864 1865  
1865 1866                  /*
1866 1867                   * Only IREs for the same IP address should be in the same
1867 1868                   * bucket.
1868 1869                   * But could have IRE_HOSTs in the case of CGTP.
1869 1870                   */
1870 1871                  ASSERT(ire1->ire_addr == ire->ire_addr);
1871 1872                  if (!(ire1->ire_type & IRE_BROADCAST))
1872 1873                          continue;
1873 1874  
1874 1875                  if (IRE_IS_CONDEMNED(ire1))
1875 1876                          continue;
1876 1877  
1877 1878                  mp1 = copymsg(mp);
1878 1879                  if (mp1 == NULL) {
1879 1880                          /* Failed to deliver to one zone */
1880 1881                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1881 1882                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
1882 1883                          continue;
1883 1884                  }
1884 1885                  ira->ira_zoneid = ire1->ire_zoneid;
1885 1886                  ipha1 = (ipha_t *)mp1->b_rptr;
1886 1887                  ip_fanout_v4(mp1, ipha1, ira);
1887 1888                  /*
1888 1889                   * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1889 1890                   * so we restore them for a potential next iteration
1890 1891                   */
1891 1892                  ira->ira_pktlen = ira_pktlen;
1892 1893                  ira->ira_ip_hdr_length = ira_ip_hdr_length;
1893 1894          }
1894 1895          irb_refrele(irb);
1895 1896          /* Do the main ire */
1896 1897          ira->ira_zoneid = ire->ire_zoneid;
1897 1898          ip_fanout_v4(mp, ipha, ira);
1898 1899  }
1899 1900  
1900 1901  /*
1901 1902   * Handle multiple zones which want to receive the same multicast packets
1902 1903   * on this ill by delivering a packet to each of them.
1903 1904   *
1904 1905   * Note that for packets delivered to transports we could instead do this
1905 1906   * as part of the fanout code, but since we need to handle icmp_inbound
1906 1907   * it is simpler to have multicast work the same as broadcast.
1907 1908   *
1908 1909   * The ip_fanout matching for multicast matches based on ilm independent of
1909 1910   * zoneid since the zoneid restriction is applied when joining a multicast
1910 1911   * group.
1911 1912   */
1912 1913  /* ARGSUSED */
1913 1914  static void
1914 1915  ip_input_multicast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1915 1916  {
1916 1917          ill_t           *ill = ira->ira_ill;
1917 1918          iaflags_t       iraflags = ira->ira_flags;
1918 1919          ip_stack_t      *ipst = ill->ill_ipst;
1919 1920          netstack_t      *ns = ipst->ips_netstack;
1920 1921          zoneid_t        zoneid;
1921 1922          mblk_t          *mp1;
1922 1923          ipha_t          *ipha1;
1923 1924          uint_t          ira_pktlen = ira->ira_pktlen;
1924 1925          uint16_t        ira_ip_hdr_length = ira->ira_ip_hdr_length;
1925 1926  
1926 1927          /* ire_recv_multicast has switched to the upper ill for IPMP */
1927 1928          ASSERT(!IS_UNDER_IPMP(ill));
1928 1929  
1929 1930          /*
1930 1931           * If we don't have more than one shared-IP zone, or if
1931 1932           * there are no members in anything but the global zone,
1932 1933           * then just set the zoneid and proceed.
1933 1934           */
1934 1935          if (ns->netstack_numzones == 1 ||
1935 1936              !ill_hasmembers_otherzones_v4(ill, ipha->ipha_dst,
1936 1937              GLOBAL_ZONEID)) {
1937 1938                  ira->ira_zoneid = GLOBAL_ZONEID;
1938 1939  
1939 1940                  /* If sender didn't want this zone to receive it, drop */
1940 1941                  if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1941 1942                      ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1942 1943                          ip_drop_input("Multicast but wrong zoneid", mp, ill);
1943 1944                          freemsg(mp);
1944 1945                          return;
1945 1946                  }
1946 1947                  ip_fanout_v4(mp, ipha, ira);
1947 1948                  return;
1948 1949          }
1949 1950  
1950 1951          /*
1951 1952           * Here we loop over all zoneids that have members in the group
1952 1953           * and deliver a packet to ip_fanout for each zoneid.
1953 1954           *
1954 1955           * First find any members in the lowest numeric zoneid by looking for
1955 1956           * first zoneid larger than -1 (ALL_ZONES).
1956 1957           * We terminate the loop when we receive -1 (ALL_ZONES).
1957 1958           */
1958 1959          zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, ALL_ZONES);
1959 1960          for (; zoneid != ALL_ZONES;
1960 1961              zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, zoneid)) {
1961 1962                  /*
1962 1963                   * Avoid an extra copymsg/freemsg by skipping global zone here
1963 1964                   * and doing that at the end.
1964 1965                   */
1965 1966                  if (zoneid == GLOBAL_ZONEID)
1966 1967                          continue;
1967 1968  
1968 1969                  ira->ira_zoneid = zoneid;
1969 1970  
1970 1971                  /* If sender didn't want this zone to receive it, skip */
1971 1972                  if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1972 1973                      ira->ira_no_loop_zoneid == ira->ira_zoneid)
1973 1974                          continue;
1974 1975  
1975 1976                  mp1 = copymsg(mp);
1976 1977                  if (mp1 == NULL) {
1977 1978                          /* Failed to deliver to one zone */
1978 1979                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1979 1980                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
1980 1981                          continue;
1981 1982                  }
1982 1983                  ipha1 = (ipha_t *)mp1->b_rptr;
1983 1984                  ip_fanout_v4(mp1, ipha1, ira);
1984 1985                  /*
1985 1986                   * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1986 1987                   * so we restore them for a potential next iteration
1987 1988                   */
1988 1989                  ira->ira_pktlen = ira_pktlen;
1989 1990                  ira->ira_ip_hdr_length = ira_ip_hdr_length;
1990 1991          }
1991 1992  
1992 1993          /* Do the main ire */
1993 1994          ira->ira_zoneid = GLOBAL_ZONEID;
1994 1995          /* If sender didn't want this zone to receive it, drop */
1995 1996          if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1996 1997              ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1997 1998                  ip_drop_input("Multicast but wrong zoneid", mp, ill);
1998 1999                  freemsg(mp);
1999 2000          } else {
2000 2001                  ip_fanout_v4(mp, ipha, ira);
2001 2002          }
2002 2003  }
2003 2004  
2004 2005  
2005 2006  /*
2006 2007   * Determine the zoneid and IRAF_TX_* flags if trusted extensions
2007 2008   * is in use. Updates ira_zoneid and ira_flags as a result.
2008 2009   */
2009 2010  static void
2010 2011  ip_fanout_tx_v4(mblk_t *mp, ipha_t *ipha, uint8_t protocol,
2011 2012      uint_t ip_hdr_length, ip_recv_attr_t *ira)
2012 2013  {
2013 2014          uint16_t        *up;
2014 2015          uint16_t        lport;
2015 2016          zoneid_t        zoneid;
2016 2017  
2017 2018          ASSERT(ira->ira_flags & IRAF_SYSTEM_LABELED);
2018 2019  
2019 2020          /*
2020 2021           * If the packet is unlabeled we might allow read-down
2021 2022           * for MAC_EXEMPT. Below we clear this if it is a multi-level
2022 2023           * port (MLP).
2023 2024           * Note that ira_tsl can be NULL here.
2024 2025           */
2025 2026          if (ira->ira_tsl != NULL && ira->ira_tsl->tsl_flags & TSLF_UNLABELED)
2026 2027                  ira->ira_flags |= IRAF_TX_MAC_EXEMPTABLE;
2027 2028  
2028 2029          if (ira->ira_zoneid != ALL_ZONES)
2029 2030                  return;
2030 2031  
2031 2032          ira->ira_flags |= IRAF_TX_SHARED_ADDR;
2032 2033  
2033 2034          up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2034 2035          switch (protocol) {
2035 2036          case IPPROTO_TCP:
2036 2037          case IPPROTO_SCTP:
2037 2038          case IPPROTO_UDP:
2038 2039                  /* Caller ensures this */
2039 2040                  ASSERT(((uchar_t *)ipha) + ip_hdr_length +4 <= mp->b_wptr);
2040 2041  
2041 2042                  /*
2042 2043                   * Only these transports support MLP.
2043 2044                   * We know their destination port numbers is in
2044 2045                   * the same place in the header.
2045 2046                   */
2046 2047                  lport = up[1];
2047 2048  
2048 2049                  /*
2049 2050                   * No need to handle exclusive-stack zones
2050 2051                   * since ALL_ZONES only applies to the shared IP instance.
2051 2052                   */
2052 2053                  zoneid = tsol_mlp_findzone(protocol, lport);
2053 2054                  /*
2054 2055                   * If no shared MLP is found, tsol_mlp_findzone returns
2055 2056                   * ALL_ZONES.  In that case, we assume it's SLP, and
2056 2057                   * search for the zone based on the packet label.
2057 2058                   *
2058 2059                   * If there is such a zone, we prefer to find a
2059 2060                   * connection in it.  Otherwise, we look for a
2060 2061                   * MAC-exempt connection in any zone whose label
2061 2062                   * dominates the default label on the packet.
2062 2063                   */
2063 2064                  if (zoneid == ALL_ZONES)
2064 2065                          zoneid = tsol_attr_to_zoneid(ira);
2065 2066                  else
2066 2067                          ira->ira_flags &= ~IRAF_TX_MAC_EXEMPTABLE;
2067 2068                  break;
2068 2069          default:
2069 2070                  /* Handle shared address for other protocols */
2070 2071                  zoneid = tsol_attr_to_zoneid(ira);
2071 2072                  break;
2072 2073          }
2073 2074          ira->ira_zoneid = zoneid;
2074 2075  }
2075 2076  
2076 2077  /*
2077 2078   * Increment checksum failure statistics
2078 2079   */
2079 2080  static void
2080 2081  ip_input_cksum_err_v4(uint8_t protocol, uint16_t hck_flags, ill_t *ill)
2081 2082  {
2082 2083          ip_stack_t      *ipst = ill->ill_ipst;
2083 2084  
2084 2085          switch (protocol) {
2085 2086          case IPPROTO_TCP:
2086 2087                  BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs);
2087 2088  
2088 2089                  if (hck_flags & HCK_FULLCKSUM)
2089 2090                          IP_STAT(ipst, ip_tcp_in_full_hw_cksum_err);
2090 2091                  else if (hck_flags & HCK_PARTIALCKSUM)
2091 2092                          IP_STAT(ipst, ip_tcp_in_part_hw_cksum_err);
2092 2093                  else
2093 2094                          IP_STAT(ipst, ip_tcp_in_sw_cksum_err);
2094 2095                  break;
2095 2096          case IPPROTO_UDP:
2096 2097                  BUMP_MIB(ill->ill_ip_mib, udpIfStatsInCksumErrs);
2097 2098                  if (hck_flags & HCK_FULLCKSUM)
2098 2099                          IP_STAT(ipst, ip_udp_in_full_hw_cksum_err);
2099 2100                  else if (hck_flags & HCK_PARTIALCKSUM)
2100 2101                          IP_STAT(ipst, ip_udp_in_part_hw_cksum_err);
2101 2102                  else
2102 2103                          IP_STAT(ipst, ip_udp_in_sw_cksum_err);
2103 2104                  break;
2104 2105          case IPPROTO_ICMP:
2105 2106                  BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2106 2107                  break;
2107 2108          default:
2108 2109                  ASSERT(0);
2109 2110                  break;
2110 2111          }
2111 2112  }
2112 2113  
2113 2114  /* Calculate the IPv4 pseudo-header checksum */
2114 2115  uint32_t
2115 2116  ip_input_cksum_pseudo_v4(ipha_t *ipha, ip_recv_attr_t *ira)
2116 2117  {
2117 2118          uint_t          ulp_len;
2118 2119          uint32_t        cksum;
2119 2120          uint8_t         protocol = ira->ira_protocol;
2120 2121          uint16_t        ip_hdr_length = ira->ira_ip_hdr_length;
2121 2122  
2122 2123  #define iphs    ((uint16_t *)ipha)
2123 2124  
2124 2125          switch (protocol) {
2125 2126          case IPPROTO_TCP:
2126 2127                  ulp_len = ira->ira_pktlen - ip_hdr_length;
2127 2128  
2128 2129                  /* Protocol and length */
2129 2130                  cksum = htons(ulp_len) + IP_TCP_CSUM_COMP;
2130 2131                  /* IP addresses */
2131 2132                  cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2132 2133                  break;
2133 2134  
2134 2135          case IPPROTO_UDP: {
2135 2136                  udpha_t         *udpha;
2136 2137  
2137 2138                  udpha = (udpha_t  *)((uchar_t *)ipha + ip_hdr_length);
2138 2139  
2139 2140                  /* Protocol and length */
2140 2141                  cksum = udpha->uha_length + IP_UDP_CSUM_COMP;
2141 2142                  /* IP addresses */
2142 2143                  cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2143 2144                  break;
2144 2145          }
2145 2146  
2146 2147          default:
2147 2148                  cksum = 0;
2148 2149                  break;
2149 2150          }
2150 2151  #undef  iphs
2151 2152          return (cksum);
2152 2153  }
2153 2154  
2154 2155  
2155 2156  /*
2156 2157   * Software verification of the ULP checksums.
2157 2158   * Returns B_TRUE if ok.
2158 2159   * Increments statistics of failed.
2159 2160   */
2160 2161  static boolean_t
2161 2162  ip_input_sw_cksum_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2162 2163  {
2163 2164          ip_stack_t      *ipst = ira->ira_ill->ill_ipst;
2164 2165          uint32_t        cksum;
2165 2166          uint8_t         protocol = ira->ira_protocol;
2166 2167          uint16_t        ip_hdr_length = ira->ira_ip_hdr_length;
2167 2168  
2168 2169          IP_STAT(ipst, ip_in_sw_cksum);
2169 2170  
2170 2171          ASSERT(protocol == IPPROTO_TCP || protocol == IPPROTO_UDP);
2171 2172  
2172 2173          cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2173 2174          cksum = IP_CSUM(mp, ip_hdr_length, cksum);
2174 2175          if (cksum == 0)
2175 2176                  return (B_TRUE);
2176 2177  
2177 2178          ip_input_cksum_err_v4(protocol, 0, ira->ira_ill);
2178 2179          return (B_FALSE);
2179 2180  }
2180 2181  
2181 2182  /*
2182 2183   * Verify the ULP checksums.
2183 2184   * Returns B_TRUE if ok, or if the ULP doesn't have a well-defined checksum
2184 2185   * algorithm.
2185 2186   * Increments statistics if failed.
2186 2187   */
2187 2188  static boolean_t
2188 2189  ip_input_cksum_v4(iaflags_t iraflags, mblk_t *mp, ipha_t *ipha,
2189 2190      ip_recv_attr_t *ira)
2190 2191  {
2191 2192          ill_t           *ill = ira->ira_rill;
2192 2193          uint16_t        hck_flags;
2193 2194          uint32_t        cksum;
2194 2195          mblk_t          *mp1;
2195 2196          int32_t         len;
2196 2197          uint8_t         protocol = ira->ira_protocol;
2197 2198          uint16_t        ip_hdr_length = ira->ira_ip_hdr_length;
2198 2199  
2199 2200  
2200 2201          switch (protocol) {
2201 2202          case IPPROTO_TCP:
2202 2203                  break;
2203 2204  
2204 2205          case IPPROTO_UDP: {
2205 2206                  udpha_t         *udpha;
2206 2207  
2207 2208                  udpha = (udpha_t  *)((uchar_t *)ipha + ip_hdr_length);
2208 2209                  if (udpha->uha_checksum == 0) {
2209 2210                          /* Packet doesn't have a UDP checksum */
2210 2211                          return (B_TRUE);
2211 2212                  }
2212 2213                  break;
2213 2214          }
2214 2215          case IPPROTO_SCTP: {
2215 2216                  sctp_hdr_t      *sctph;
2216 2217                  uint32_t        pktsum;
2217 2218  
2218 2219                  sctph = (sctp_hdr_t *)((uchar_t *)ipha + ip_hdr_length);
2219 2220  #ifdef  DEBUG
2220 2221                  if (skip_sctp_cksum)
2221 2222                          return (B_TRUE);
2222 2223  #endif
2223 2224                  pktsum = sctph->sh_chksum;
2224 2225                  sctph->sh_chksum = 0;
2225 2226                  cksum = sctp_cksum(mp, ip_hdr_length);
2226 2227                  sctph->sh_chksum = pktsum;
2227 2228                  if (cksum == pktsum)
2228 2229                          return (B_TRUE);
2229 2230  
2230 2231                  /*
2231 2232                   * Defer until later whether a bad checksum is ok
2232 2233                   * in order to allow RAW sockets to use Adler checksum
2233 2234                   * with SCTP.
2234 2235                   */
2235 2236                  ira->ira_flags |= IRAF_SCTP_CSUM_ERR;
2236 2237                  return (B_TRUE);
2237 2238          }
2238 2239  
2239 2240          default:
2240 2241                  /* No ULP checksum to verify. */
2241 2242                  return (B_TRUE);
2242 2243          }
2243 2244          /*
2244 2245           * Revert to software checksum calculation if the interface
2245 2246           * isn't capable of checksum offload.
2246 2247           * We clear DB_CKSUMFLAGS when going through IPsec in ip_fanout.
2247 2248           * Note: IRAF_NO_HW_CKSUM is not currently used.
2248 2249           */
2249 2250          ASSERT(!IS_IPMP(ill));
2250 2251          if ((iraflags & IRAF_NO_HW_CKSUM) || !ILL_HCKSUM_CAPABLE(ill) ||
2251 2252              !dohwcksum) {
2252 2253                  return (ip_input_sw_cksum_v4(mp, ipha, ira));
2253 2254          }
2254 2255  
2255 2256          /*
2256 2257           * We apply this for all ULP protocols. Does the HW know to
2257 2258           * not set the flags for SCTP and other protocols.
2258 2259           */
2259 2260  
2260 2261          hck_flags = DB_CKSUMFLAGS(mp);
2261 2262  
2262 2263          if (hck_flags & HCK_FULLCKSUM_OK) {
2263 2264                  /*
2264 2265                   * Hardware has already verified the checksum.
2265 2266                   */
2266 2267                  return (B_TRUE);
2267 2268          }
2268 2269  
2269 2270          if (hck_flags & HCK_FULLCKSUM) {
2270 2271                  /*
2271 2272                   * Full checksum has been computed by the hardware
2272 2273                   * and has been attached.  If the driver wants us to
2273 2274                   * verify the correctness of the attached value, in
2274 2275                   * order to protect against faulty hardware, compare
2275 2276                   * it against -0 (0xFFFF) to see if it's valid.
2276 2277                   */
2277 2278                  cksum = DB_CKSUM16(mp);
2278 2279                  if (cksum == 0xFFFF)
2279 2280                          return (B_TRUE);
2280 2281                  ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2281 2282                  return (B_FALSE);
2282 2283          }
2283 2284  
2284 2285          mp1 = mp->b_cont;
2285 2286          if ((hck_flags & HCK_PARTIALCKSUM) &&
2286 2287              (mp1 == NULL || mp1->b_cont == NULL) &&
2287 2288              ip_hdr_length >= DB_CKSUMSTART(mp) &&
2288 2289              ((len = ip_hdr_length - DB_CKSUMSTART(mp)) & 1) == 0) {
2289 2290                  uint32_t        adj;
2290 2291                  uchar_t         *cksum_start;
2291 2292  
2292 2293                  cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2293 2294  
2294 2295                  cksum_start = ((uchar_t *)ipha + DB_CKSUMSTART(mp));
2295 2296  
2296 2297                  /*
2297 2298                   * Partial checksum has been calculated by hardware
2298 2299                   * and attached to the packet; in addition, any
2299 2300                   * prepended extraneous data is even byte aligned,
2300 2301                   * and there are at most two mblks associated with
2301 2302                   * the packet.  If any such data exists, we adjust
2302 2303                   * the checksum; also take care any postpended data.
2303 2304                   */
2304 2305                  IP_ADJCKSUM_PARTIAL(cksum_start, mp, mp1, len, adj);
2305 2306                  /*
2306 2307                   * One's complement subtract extraneous checksum
2307 2308                   */
2308 2309                  cksum += DB_CKSUM16(mp);
2309 2310                  if (adj >= cksum)
2310 2311                          cksum = ~(adj - cksum) & 0xFFFF;
2311 2312                  else
2312 2313                          cksum -= adj;
2313 2314                  cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2314 2315                  cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2315 2316                  if (!(~cksum & 0xFFFF))
2316 2317                          return (B_TRUE);
2317 2318  
2318 2319                  ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2319 2320                  return (B_FALSE);
2320 2321          }
2321 2322          return (ip_input_sw_cksum_v4(mp, ipha, ira));
2322 2323  }
2323 2324  
2324 2325  
2325 2326  /*
2326 2327   * Handle fanout of received packets.
2327 2328   * Unicast packets that are looped back (from ire_send_local_v4) and packets
2328 2329   * from the wire are differentiated by checking IRAF_VERIFY_ULP_CKSUM.
2329 2330   *
2330 2331   * IPQoS Notes
2331 2332   * Before sending it to the client, invoke IPPF processing. Policy processing
2332 2333   * takes place only if the callout_position, IPP_LOCAL_IN, is enabled.
2333 2334   */
2334 2335  void
2335 2336  ip_fanout_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2336 2337  {
2337 2338          ill_t           *ill = ira->ira_ill;
2338 2339          iaflags_t       iraflags = ira->ira_flags;
2339 2340          ip_stack_t      *ipst = ill->ill_ipst;
2340 2341          uint8_t         protocol = ipha->ipha_protocol;
2341 2342          conn_t          *connp;
2342 2343  #define rptr    ((uchar_t *)ipha)
2343 2344          uint_t          ip_hdr_length;
2344 2345          uint_t          min_ulp_header_length;
2345 2346          int             offset;
2346 2347          ssize_t         len;
2347 2348          netstack_t      *ns = ipst->ips_netstack;
2348 2349          ipsec_stack_t   *ipss = ns->netstack_ipsec;
2349 2350          ill_t           *rill = ira->ira_rill;
2350 2351  
2351 2352          ASSERT(ira->ira_pktlen == ntohs(ipha->ipha_length));
2352 2353  
2353 2354          ip_hdr_length = ira->ira_ip_hdr_length;
2354 2355          ira->ira_protocol = protocol;
2355 2356  
2356 2357          /*
2357 2358           * Time for IPP once we've done reassembly and IPsec.
2358 2359           * We skip this for loopback packets since we don't do IPQoS
2359 2360           * on loopback.
2360 2361           */
2361 2362          if (IPP_ENABLED(IPP_LOCAL_IN, ipst) &&
2362 2363              !(iraflags & IRAF_LOOPBACK) &&
2363 2364              (protocol != IPPROTO_ESP || protocol != IPPROTO_AH)) {
2364 2365                  /*
2365 2366                   * Use the interface on which the packet arrived - not where
2366 2367                   * the IP address is hosted.
2367 2368                   */
2368 2369                  /* ip_process translates an IS_UNDER_IPMP */
2369 2370                  mp = ip_process(IPP_LOCAL_IN, mp, rill, ill);
2370 2371                  if (mp == NULL) {
2371 2372                          /* ip_drop_packet and MIB done */
2372 2373                          return;
2373 2374                  }
2374 2375          }
2375 2376  
2376 2377          /* Determine the minimum required size of the upper-layer header */
2377 2378          /* Need to do this for at least the set of ULPs that TX handles. */
2378 2379          switch (protocol) {
2379 2380          case IPPROTO_TCP:
2380 2381                  min_ulp_header_length = TCP_MIN_HEADER_LENGTH;
2381 2382                  break;
2382 2383          case IPPROTO_SCTP:
2383 2384                  min_ulp_header_length = SCTP_COMMON_HDR_LENGTH;
2384 2385                  break;
2385 2386          case IPPROTO_UDP:
2386 2387                  min_ulp_header_length = UDPH_SIZE;
2387 2388                  break;
2388 2389          case IPPROTO_ICMP:
2389 2390                  min_ulp_header_length = ICMPH_SIZE;
2390 2391                  break;
2391 2392          default:
2392 2393                  min_ulp_header_length = 0;
2393 2394                  break;
2394 2395          }
2395 2396          /* Make sure we have the min ULP header length */
2396 2397          len = mp->b_wptr - rptr;
2397 2398          if (len < ip_hdr_length + min_ulp_header_length) {
2398 2399                  if (ira->ira_pktlen < ip_hdr_length + min_ulp_header_length) {
2399 2400                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2400 2401                          ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2401 2402                          freemsg(mp);
2402 2403                          return;
2403 2404                  }
2404 2405                  IP_STAT(ipst, ip_recv_pullup);
2405 2406                  ipha = ip_pullup(mp, ip_hdr_length + min_ulp_header_length,
2406 2407                      ira);
2407 2408                  if (ipha == NULL)
2408 2409                          goto discard;
2409 2410                  len = mp->b_wptr - rptr;
2410 2411          }
2411 2412  
2412 2413          /*
2413 2414           * If trusted extensions then determine the zoneid and TX specific
2414 2415           * ira_flags.
2415 2416           */
2416 2417          if (iraflags & IRAF_SYSTEM_LABELED) {
2417 2418                  /* This can update ira->ira_flags and ira->ira_zoneid */
2418 2419                  ip_fanout_tx_v4(mp, ipha, protocol, ip_hdr_length, ira);
2419 2420                  iraflags = ira->ira_flags;
2420 2421          }
2421 2422  
2422 2423  
2423 2424          /* Verify ULP checksum. Handles TCP, UDP, and SCTP */
2424 2425          if (iraflags & IRAF_VERIFY_ULP_CKSUM) {
2425 2426                  if (!ip_input_cksum_v4(iraflags, mp, ipha, ira)) {
2426 2427                          /* Bad checksum. Stats are already incremented */
2427 2428                          ip_drop_input("Bad ULP checksum", mp, ill);
2428 2429                          freemsg(mp);
2429 2430                          return;
2430 2431                  }
2431 2432                  /* IRAF_SCTP_CSUM_ERR could have been set */
2432 2433                  iraflags = ira->ira_flags;
2433 2434          }
2434 2435          switch (protocol) {
2435 2436          case IPPROTO_TCP:
2436 2437                  /* For TCP, discard broadcast and multicast packets. */
2437 2438                  if (iraflags & IRAF_MULTIBROADCAST)
2438 2439                          goto discard;
2439 2440  
2440 2441                  /* First mblk contains IP+TCP headers per above check */
2441 2442                  ASSERT(len >= ip_hdr_length + TCP_MIN_HEADER_LENGTH);
2442 2443  
2443 2444                  /* TCP options present? */
2444 2445                  offset = ((uchar_t *)ipha)[ip_hdr_length + 12] >> 4;
2445 2446                  if (offset != 5) {
2446 2447                          if (offset < 5)
2447 2448                                  goto discard;
2448 2449  
2449 2450                          /*
2450 2451                           * There must be TCP options.
2451 2452                           * Make sure we can grab them.
2452 2453                           */
2453 2454                          offset <<= 2;
2454 2455                          offset += ip_hdr_length;
2455 2456                          if (len < offset) {
2456 2457                                  if (ira->ira_pktlen < offset) {
2457 2458                                          BUMP_MIB(ill->ill_ip_mib,
2458 2459                                              ipIfStatsInTruncatedPkts);
2459 2460                                          ip_drop_input(
2460 2461                                              "ipIfStatsInTruncatedPkts",
2461 2462                                              mp, ill);
2462 2463                                          freemsg(mp);
2463 2464                                          return;
2464 2465                                  }
2465 2466                                  IP_STAT(ipst, ip_recv_pullup);
2466 2467                                  ipha = ip_pullup(mp, offset, ira);
2467 2468                                  if (ipha == NULL)
2468 2469                                          goto discard;
2469 2470                                  len = mp->b_wptr - rptr;
2470 2471                          }
2471 2472                  }
2472 2473  
2473 2474                  /*
2474 2475                   * Pass up a squeue hint to tcp.
2475 2476                   * If ira_sqp is already set (this is loopback) we leave it
2476 2477                   * alone.
2477 2478                   */
2478 2479                  if (ira->ira_sqp == NULL) {
2479 2480                          ira->ira_sqp = ip_squeue_get(ira->ira_ring);
2480 2481                  }
2481 2482  
2482 2483                  /* Look for AF_INET or AF_INET6 that matches */
2483 2484                  connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_length,
2484 2485                      ira, ipst);
2485 2486                  if (connp == NULL) {
2486 2487                          /* Send the TH_RST */
2487 2488                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2488 2489                          tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2489 2490                          return;
2490 2491                  }
2491 2492                  if (connp->conn_incoming_ifindex != 0 &&
2492 2493                      connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2493 2494                          CONN_DEC_REF(connp);
2494 2495  
2495 2496                          /* Send the TH_RST */
2496 2497                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2497 2498                          tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2498 2499                          return;
2499 2500                  }
2500 2501                  if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2501 2502                      (iraflags & IRAF_IPSEC_SECURE)) {
2502 2503                          mp = ipsec_check_inbound_policy(mp, connp,
2503 2504                              ipha, NULL, ira);
2504 2505                          if (mp == NULL) {
2505 2506                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2506 2507                                  /* Note that mp is NULL */
2507 2508                                  ip_drop_input("ipIfStatsInDiscards", mp, ill);
2508 2509                                  CONN_DEC_REF(connp);
2509 2510                                  return;
2510 2511                          }
2511 2512                  }
2512 2513                  /* Found a client; up it goes */
2513 2514                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2514 2515                  ira->ira_ill = ira->ira_rill = NULL;
2515 2516                  if (!IPCL_IS_TCP(connp)) {
2516 2517                          /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2517 2518                          (connp->conn_recv)(connp, mp, NULL, ira);
2518 2519                          CONN_DEC_REF(connp);
2519 2520                          ira->ira_ill = ill;
2520 2521                          ira->ira_rill = rill;
2521 2522                          return;
2522 2523                  }
2523 2524  
2524 2525                  /*
2525 2526                   * We do different processing whether called from
2526 2527                   * ip_accept_tcp and we match the target, don't match
2527 2528                   * the target, and when we are called by ip_input.
2528 2529                   */
2529 2530                  if (iraflags & IRAF_TARGET_SQP) {
2530 2531                          if (ira->ira_target_sqp == connp->conn_sqp) {
2531 2532                                  mblk_t  *attrmp;
2532 2533  
2533 2534                                  attrmp = ip_recv_attr_to_mblk(ira);
2534 2535                                  if (attrmp == NULL) {
2535 2536                                          BUMP_MIB(ill->ill_ip_mib,
2536 2537                                              ipIfStatsInDiscards);
2537 2538                                          ip_drop_input("ipIfStatsInDiscards",
2538 2539                                              mp, ill);
2539 2540                                          freemsg(mp);
2540 2541                                          CONN_DEC_REF(connp);
2541 2542                                  } else {
2542 2543                                          SET_SQUEUE(attrmp, connp->conn_recv,
2543 2544                                              connp);
2544 2545                                          attrmp->b_cont = mp;
2545 2546                                          ASSERT(ira->ira_target_sqp_mp == NULL);
2546 2547                                          ira->ira_target_sqp_mp = attrmp;
2547 2548                                          /*
2548 2549                                           * Conn ref release when drained from
2549 2550                                           * the squeue.
2550 2551                                           */
2551 2552                                  }
2552 2553                          } else {
2553 2554                                  SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2554 2555                                      connp->conn_recv, connp, ira, SQ_FILL,
2555 2556                                      SQTAG_IP_TCP_INPUT);
2556 2557                          }
2557 2558                  } else {
2558 2559                          SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv,
2559 2560                              connp, ira, ip_squeue_flag, SQTAG_IP_TCP_INPUT);
2560 2561                  }
2561 2562                  ira->ira_ill = ill;
2562 2563                  ira->ira_rill = rill;
2563 2564                  return;
2564 2565  
2565 2566          case IPPROTO_SCTP: {
2566 2567                  sctp_hdr_t      *sctph;
2567 2568                  in6_addr_t      map_src, map_dst;
2568 2569                  uint32_t        ports;  /* Source and destination ports */
2569 2570                  sctp_stack_t    *sctps = ipst->ips_netstack->netstack_sctp;
2570 2571  
2571 2572                  /* For SCTP, discard broadcast and multicast packets. */
2572 2573                  if (iraflags & IRAF_MULTIBROADCAST)
2573 2574                          goto discard;
2574 2575  
2575 2576                  /*
2576 2577                   * Since there is no SCTP h/w cksum support yet, just
2577 2578                   * clear the flag.
2578 2579                   */
2579 2580                  DB_CKSUMFLAGS(mp) = 0;
2580 2581  
2581 2582                  /* Length ensured above */
2582 2583                  ASSERT(MBLKL(mp) >= ip_hdr_length + SCTP_COMMON_HDR_LENGTH);
2583 2584                  sctph = (sctp_hdr_t *)(rptr + ip_hdr_length);
2584 2585  
2585 2586                  /* get the ports */
2586 2587                  ports = *(uint32_t *)&sctph->sh_sport;
2587 2588  
2588 2589                  IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_dst);
2589 2590                  IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_src);
2590 2591                  if (iraflags & IRAF_SCTP_CSUM_ERR) {
2591 2592                          /*
2592 2593                           * No potential sctp checksum errors go to the Sun
2593 2594                           * sctp stack however they might be Adler-32 summed
2594 2595                           * packets a userland stack bound to a raw IP socket
2595 2596                           * could reasonably use. Note though that Adler-32 is
2596 2597                           * a long deprecated algorithm and customer sctp
2597 2598                           * networks should eventually migrate to CRC-32 at
2598 2599                           * which time this facility should be removed.
2599 2600                           */
2600 2601                          ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2601 2602                          return;
2602 2603                  }
2603 2604                  connp = sctp_fanout(&map_src, &map_dst, ports, ira, mp,
2604 2605                      sctps, sctph);
2605 2606                  if (connp == NULL) {
2606 2607                          /* Check for raw socket or OOTB handling */
2607 2608                          ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2608 2609                          return;
2609 2610                  }
2610 2611                  if (connp->conn_incoming_ifindex != 0 &&
2611 2612                      connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2612 2613                          CONN_DEC_REF(connp);
2613 2614                          /* Check for raw socket or OOTB handling */
2614 2615                          ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2615 2616                          return;
2616 2617                  }
2617 2618  
2618 2619                  /* Found a client; up it goes */
2619 2620                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2620 2621                  sctp_input(connp, ipha, NULL, mp, ira);
2621 2622                  /* sctp_input does a rele of the sctp_t */
2622 2623                  return;
2623 2624          }
2624 2625  
2625 2626          case IPPROTO_UDP:
2626 2627                  /* First mblk contains IP+UDP headers as checked above */
2627 2628                  ASSERT(MBLKL(mp) >= ip_hdr_length + UDPH_SIZE);
2628 2629  
2629 2630                  if (iraflags & IRAF_MULTIBROADCAST) {
2630 2631                          uint16_t *up;   /* Pointer to ports in ULP header */
2631 2632  
2632 2633                          up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2633 2634                          ip_fanout_udp_multi_v4(mp, ipha, up[1], up[0], ira);
2634 2635                          return;
2635 2636                  }
2636 2637  
2637 2638                  /* Look for AF_INET or AF_INET6 that matches */
2638 2639                  connp = ipcl_classify_v4(mp, IPPROTO_UDP, ip_hdr_length,
2639 2640                      ira, ipst);
2640 2641                  if (connp == NULL) {
2641 2642          no_udp_match:
2642 2643                          if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].
2643 2644                              connf_head != NULL) {
2644 2645                                  ASSERT(ira->ira_protocol == IPPROTO_UDP);
2645 2646                                  ip_fanout_proto_v4(mp, ipha, ira);
2646 2647                          } else {
2647 2648                                  ip_fanout_send_icmp_v4(mp,
2648 2649                                      ICMP_DEST_UNREACHABLE,
2649 2650                                      ICMP_PORT_UNREACHABLE, ira);
2650 2651                          }
2651 2652                          return;
2652 2653  
2653 2654                  }
2654 2655                  if (connp->conn_incoming_ifindex != 0 &&
2655 2656                      connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2656 2657                          CONN_DEC_REF(connp);
2657 2658                          goto no_udp_match;
2658 2659                  }
2659 2660                  if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld :
2660 2661                      !canputnext(connp->conn_rq)) {
2661 2662                          CONN_DEC_REF(connp);
2662 2663                          BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
2663 2664                          ip_drop_input("udpIfStatsInOverflows", mp, ill);
2664 2665                          freemsg(mp);
2665 2666                          return;
2666 2667                  }
2667 2668                  if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2668 2669                      (iraflags & IRAF_IPSEC_SECURE)) {
2669 2670                          mp = ipsec_check_inbound_policy(mp, connp,
2670 2671                              ipha, NULL, ira);
2671 2672                          if (mp == NULL) {
2672 2673                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2673 2674                                  /* Note that mp is NULL */
2674 2675                                  ip_drop_input("ipIfStatsInDiscards", mp, ill);
2675 2676                                  CONN_DEC_REF(connp);
2676 2677                                  return;
2677 2678                          }
2678 2679                  }
2679 2680                  /*
2680 2681                   * Remove 0-spi if it's 0, or move everything behind
2681 2682                   * the UDP header over it and forward to ESP via
2682 2683                   * ip_fanout_v4().
2683 2684                   */
2684 2685                  if (connp->conn_udp->udp_nat_t_endpoint) {
2685 2686                          if (iraflags & IRAF_IPSEC_SECURE) {
2686 2687                                  ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2687 2688                                      DROPPER(ipss, ipds_esp_nat_t_ipsec),
2688 2689                                      &ipss->ipsec_dropper);
2689 2690                                  CONN_DEC_REF(connp);
2690 2691                                  return;
2691 2692                          }
2692 2693  
2693 2694                          mp = zero_spi_check(mp, ira);
2694 2695                          if (mp == NULL) {
2695 2696                                  /*
2696 2697                                   * Packet was consumed - probably sent to
2697 2698                                   * ip_fanout_v4.
2698 2699                                   */
2699 2700                                  CONN_DEC_REF(connp);
2700 2701                                  return;
2701 2702                          }
2702 2703                          /* Else continue like a normal UDP packet. */
2703 2704                          ipha = (ipha_t *)mp->b_rptr;
2704 2705                          protocol = ipha->ipha_protocol;
2705 2706                          ira->ira_protocol = protocol;
2706 2707                  }
2707 2708                  /* Found a client; up it goes */
2708 2709                  IP_STAT(ipst, ip_udp_fannorm);
2709 2710                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2710 2711                  ira->ira_ill = ira->ira_rill = NULL;
2711 2712                  (connp->conn_recv)(connp, mp, NULL, ira);
2712 2713                  CONN_DEC_REF(connp);
2713 2714                  ira->ira_ill = ill;
2714 2715                  ira->ira_rill = rill;
2715 2716                  return;
2716 2717          default:
2717 2718                  break;
2718 2719          }
2719 2720  
2720 2721          /*
2721 2722           * Clear hardware checksumming flag as it is currently only
2722 2723           * used by TCP and UDP.
2723 2724           */
2724 2725          DB_CKSUMFLAGS(mp) = 0;
2725 2726  
2726 2727          switch (protocol) {
2727 2728          case IPPROTO_ICMP:
2728 2729                  /*
2729 2730                   * We need to accomodate icmp messages coming in clear
2730 2731                   * until we get everything secure from the wire. If
2731 2732                   * icmp_accept_clear_messages is zero we check with
2732 2733                   * the global policy and act accordingly. If it is
2733 2734                   * non-zero, we accept the message without any checks.
2734 2735                   * But *this does not mean* that this will be delivered
2735 2736                   * to RAW socket clients. By accepting we might send
2736 2737                   * replies back, change our MTU value etc.,
2737 2738                   * but delivery to the ULP/clients depends on their
2738 2739                   * policy dispositions.
2739 2740                   */
2740 2741                  if (ipst->ips_icmp_accept_clear_messages == 0) {
2741 2742                          mp = ipsec_check_global_policy(mp, NULL,
2742 2743                              ipha, NULL, ira, ns);
2743 2744                          if (mp == NULL)
2744 2745                                  return;
2745 2746                  }
2746 2747  
2747 2748                  /*
2748 2749                   * On a labeled system, we have to check whether the zone
2749 2750                   * itself is permitted to receive raw traffic.
2750 2751                   */
2751 2752                  if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
2752 2753                          if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
2753 2754                                  BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
2754 2755                                  ip_drop_input("tsol_can_accept_raw", mp, ill);
2755 2756                                  freemsg(mp);
2756 2757                                  return;
2757 2758                          }
2758 2759                  }
2759 2760  
2760 2761                  /*
2761 2762                   * ICMP header checksum, including checksum field,
2762 2763                   * should be zero.
2763 2764                   */
2764 2765                  if (IP_CSUM(mp, ip_hdr_length, 0)) {
2765 2766                          BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2766 2767                          ip_drop_input("icmpInCksumErrs", mp, ill);
2767 2768                          freemsg(mp);
2768 2769                          return;
2769 2770                  }
2770 2771                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2771 2772                  mp = icmp_inbound_v4(mp, ira);
2772 2773                  if (mp == NULL) {
2773 2774                          /* No need to pass to RAW sockets */
2774 2775                          return;
2775 2776                  }
2776 2777                  break;
2777 2778  
2778 2779          case IPPROTO_IGMP:
2779 2780                  /*
2780 2781                   * If we are not willing to accept IGMP packets in clear,
2781 2782                   * then check with global policy.
2782 2783                   */
2783 2784                  if (ipst->ips_igmp_accept_clear_messages == 0) {
2784 2785                          mp = ipsec_check_global_policy(mp, NULL,
2785 2786                              ipha, NULL, ira, ns);
2786 2787                          if (mp == NULL)
2787 2788                                  return;
2788 2789                  }
2789 2790                  if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2790 2791                      !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2791 2792                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2792 2793                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
2793 2794                          freemsg(mp);
2794 2795                          return;
2795 2796                  }
2796 2797                  /*
2797 2798                   * Validate checksum
2798 2799                   */
2799 2800                  if (IP_CSUM(mp, ip_hdr_length, 0)) {
2800 2801                          ++ipst->ips_igmpstat.igps_rcv_badsum;
2801 2802                          ip_drop_input("igps_rcv_badsum", mp, ill);
2802 2803                          freemsg(mp);
2803 2804                          return;
2804 2805                  }
2805 2806  
2806 2807                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2807 2808                  mp = igmp_input(mp, ira);
2808 2809                  if (mp == NULL) {
2809 2810                          /* Bad packet - discarded by igmp_input */
2810 2811                          return;
2811 2812                  }
2812 2813                  break;
2813 2814          case IPPROTO_PIM:
2814 2815                  /*
2815 2816                   * If we are not willing to accept PIM packets in clear,
2816 2817                   * then check with global policy.
2817 2818                   */
2818 2819                  if (ipst->ips_pim_accept_clear_messages == 0) {
2819 2820                          mp = ipsec_check_global_policy(mp, NULL,
2820 2821                              ipha, NULL, ira, ns);
2821 2822                          if (mp == NULL)
2822 2823                                  return;
2823 2824                  }
2824 2825                  if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2825 2826                      !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2826 2827                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2827 2828                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
2828 2829                          freemsg(mp);
2829 2830                          return;
2830 2831                  }
2831 2832                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2832 2833  
2833 2834                  /* Checksum is verified in pim_input */
2834 2835                  mp = pim_input(mp, ira);
2835 2836                  if (mp == NULL) {
2836 2837                          /* Bad packet - discarded by pim_input */
2837 2838                          return;
2838 2839                  }
2839 2840                  break;
2840 2841          case IPPROTO_AH:
2841 2842          case IPPROTO_ESP: {
2842 2843                  /*
2843 2844                   * Fast path for AH/ESP.
2844 2845                   */
2845 2846                  netstack_t *ns = ipst->ips_netstack;
2846 2847                  ipsec_stack_t *ipss = ns->netstack_ipsec;
2847 2848  
2848 2849                  IP_STAT(ipst, ipsec_proto_ahesp);
2849 2850  
2850 2851                  if (!ipsec_loaded(ipss)) {
2851 2852                          ip_proto_not_sup(mp, ira);
2852 2853                          return;
2853 2854                  }
2854 2855  
2855 2856                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2856 2857                  /* select inbound SA and have IPsec process the pkt */
2857 2858                  if (protocol == IPPROTO_ESP) {
2858 2859                          esph_t *esph;
2859 2860                          boolean_t esp_in_udp_sa;
2860 2861                          boolean_t esp_in_udp_packet;
2861 2862  
2862 2863                          mp = ipsec_inbound_esp_sa(mp, ira, &esph);
2863 2864                          if (mp == NULL)
2864 2865                                  return;
2865 2866  
2866 2867                          ASSERT(esph != NULL);
2867 2868                          ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2868 2869                          ASSERT(ira->ira_ipsec_esp_sa != NULL);
2869 2870                          ASSERT(ira->ira_ipsec_esp_sa->ipsa_input_func != NULL);
2870 2871  
2871 2872                          esp_in_udp_sa = ((ira->ira_ipsec_esp_sa->ipsa_flags &
2872 2873                              IPSA_F_NATT) != 0);
2873 2874                          esp_in_udp_packet =
2874 2875                              (ira->ira_flags & IRAF_ESP_UDP_PORTS) != 0;
2875 2876  
2876 2877                          /*
2877 2878                           * The following is a fancy, but quick, way of saying:
2878 2879                           * ESP-in-UDP SA and Raw ESP packet --> drop
2879 2880                           *    OR
2880 2881                           * ESP SA and ESP-in-UDP packet --> drop
2881 2882                           */
2882 2883                          if (esp_in_udp_sa != esp_in_udp_packet) {
2883 2884                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2884 2885                                  ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2885 2886                                      DROPPER(ipss, ipds_esp_no_sa),
2886 2887                                      &ipss->ipsec_dropper);
2887 2888                                  return;
2888 2889                          }
2889 2890                          mp = ira->ira_ipsec_esp_sa->ipsa_input_func(mp, esph,
2890 2891                              ira);
2891 2892                  } else {
2892 2893                          ah_t *ah;
2893 2894  
2894 2895                          mp = ipsec_inbound_ah_sa(mp, ira, &ah);
2895 2896                          if (mp == NULL)
2896 2897                                  return;
2897 2898  
2898 2899                          ASSERT(ah != NULL);
2899 2900                          ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2900 2901                          ASSERT(ira->ira_ipsec_ah_sa != NULL);
2901 2902                          ASSERT(ira->ira_ipsec_ah_sa->ipsa_input_func != NULL);
2902 2903                          mp = ira->ira_ipsec_ah_sa->ipsa_input_func(mp, ah,
2903 2904                              ira);
2904 2905                  }
2905 2906  
2906 2907                  if (mp == NULL) {
2907 2908                          /*
2908 2909                           * Either it failed or is pending. In the former case
2909 2910                           * ipIfStatsInDiscards was increased.
2910 2911                           */
2911 2912                          return;
2912 2913                  }
2913 2914                  /* we're done with IPsec processing, send it up */
2914 2915                  ip_input_post_ipsec(mp, ira);
2915 2916                  return;
2916 2917          }
2917 2918          case IPPROTO_ENCAP: {
2918 2919                  ipha_t          *inner_ipha;
2919 2920  
2920 2921                  /*
2921 2922                   * Handle self-encapsulated packets (IP-in-IP where
2922 2923                   * the inner addresses == the outer addresses).
2923 2924                   */
2924 2925                  if ((uchar_t *)ipha + ip_hdr_length + sizeof (ipha_t) >
2925 2926                      mp->b_wptr) {
2926 2927                          if (ira->ira_pktlen <
2927 2928                              ip_hdr_length + sizeof (ipha_t)) {
2928 2929                                  BUMP_MIB(ill->ill_ip_mib,
2929 2930                                      ipIfStatsInTruncatedPkts);
2930 2931                                  ip_drop_input("ipIfStatsInTruncatedPkts",
2931 2932                                      mp, ill);
2932 2933                                  freemsg(mp);
2933 2934                                  return;
2934 2935                          }
2935 2936                          ipha = ip_pullup(mp, (uchar_t *)ipha + ip_hdr_length +
2936 2937                              sizeof (ipha_t) - mp->b_rptr, ira);
2937 2938                          if (ipha == NULL) {
2938 2939                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2939 2940                                  ip_drop_input("ipIfStatsInDiscards", mp, ill);
2940 2941                                  freemsg(mp);
2941 2942                                  return;
2942 2943                          }
2943 2944                  }
2944 2945                  inner_ipha = (ipha_t *)((uchar_t *)ipha + ip_hdr_length);
2945 2946                  /*
2946 2947                   * Check the sanity of the inner IP header.
2947 2948                   */
2948 2949                  if ((IPH_HDR_VERSION(inner_ipha) != IPV4_VERSION)) {
2949 2950                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2950 2951                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
2951 2952                          freemsg(mp);
2952 2953                          return;
2953 2954                  }
2954 2955                  if (IPH_HDR_LENGTH(inner_ipha) < sizeof (ipha_t)) {
2955 2956                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2956 2957                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
2957 2958                          freemsg(mp);
2958 2959                          return;
2959 2960                  }
2960 2961                  if (inner_ipha->ipha_src != ipha->ipha_src ||
2961 2962                      inner_ipha->ipha_dst != ipha->ipha_dst) {
2962 2963                          /* We fallthru to iptun fanout below */
2963 2964                          goto iptun;
2964 2965                  }
2965 2966  
2966 2967                  /*
2967 2968                   * Self-encapsulated tunnel packet. Remove
2968 2969                   * the outer IP header and fanout again.
2969 2970                   * We also need to make sure that the inner
2970 2971                   * header is pulled up until options.
2971 2972                   */
2972 2973                  mp->b_rptr = (uchar_t *)inner_ipha;
2973 2974                  ipha = inner_ipha;
2974 2975                  ip_hdr_length = IPH_HDR_LENGTH(ipha);
2975 2976                  if ((uchar_t *)ipha + ip_hdr_length > mp->b_wptr) {
2976 2977                          if (ira->ira_pktlen <
2977 2978                              (uchar_t *)ipha + ip_hdr_length - mp->b_rptr) {
2978 2979                                  BUMP_MIB(ill->ill_ip_mib,
2979 2980                                      ipIfStatsInTruncatedPkts);
2980 2981                                  ip_drop_input("ipIfStatsInTruncatedPkts",
2981 2982                                      mp, ill);
2982 2983                                  freemsg(mp);
2983 2984                                  return;
2984 2985                          }
2985 2986                          ipha = ip_pullup(mp,
2986 2987                              (uchar_t *)ipha + ip_hdr_length - mp->b_rptr, ira);
2987 2988                          if (ipha == NULL) {
2988 2989                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2989 2990                                  ip_drop_input("ipIfStatsInDiscards", mp, ill);
2990 2991                                  freemsg(mp);
2991 2992                                  return;
2992 2993                          }
2993 2994                  }
2994 2995                  if (ip_hdr_length > sizeof (ipha_t)) {
2995 2996                          /* We got options on the inner packet. */
2996 2997                          ipaddr_t        dst = ipha->ipha_dst;
2997 2998                          int             error = 0;
2998 2999  
2999 3000                          dst = ip_input_options(ipha, dst, mp, ira, &error);
3000 3001                          if (error != 0) {
3001 3002                                  /*
3002 3003                                   * An ICMP error has been sent and the packet
3003 3004                                   * has been dropped.
3004 3005                                   */
3005 3006                                  return;
3006 3007                          }
3007 3008                          if (dst != ipha->ipha_dst) {
3008 3009                                  /*
3009 3010                                   * Someone put a source-route in
3010 3011                                   * the inside header of a self-
3011 3012                                   * encapsulated packet.  Drop it
3012 3013                                   * with extreme prejudice and let
3013 3014                                   * the sender know.
3014 3015                                   */
3015 3016                                  ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
3016 3017                                      mp, ill);
3017 3018                                  icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED,
3018 3019                                      ira);
3019 3020                                  return;
3020 3021                          }
3021 3022                  }
3022 3023                  if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
3023 3024                          /*
3024 3025                           * This means that somebody is sending
3025 3026                           * Self-encapsualted packets without AH/ESP.
3026 3027                           *
3027 3028                           * Send this packet to find a tunnel endpoint.
3028 3029                           * if I can't find one, an ICMP
3029 3030                           * PROTOCOL_UNREACHABLE will get sent.
3030 3031                           */
3031 3032                          protocol = ipha->ipha_protocol;
3032 3033                          ira->ira_protocol = protocol;
3033 3034                          goto iptun;
3034 3035                  }
3035 3036  
3036 3037                  /* Update based on removed IP header */
3037 3038                  ira->ira_ip_hdr_length = ip_hdr_length;
3038 3039                  ira->ira_pktlen = ntohs(ipha->ipha_length);
3039 3040  
3040 3041                  if (ira->ira_flags & IRAF_IPSEC_DECAPS) {
3041 3042                          /*
3042 3043                           * This packet is self-encapsulated multiple
3043 3044                           * times. We don't want to recurse infinitely.
3044 3045                           * To keep it simple, drop the packet.
3045 3046                           */
3046 3047                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3047 3048                          ip_drop_input("ipIfStatsInDiscards", mp, ill);
3048 3049                          freemsg(mp);
3049 3050                          return;
3050 3051                  }
3051 3052                  ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
3052 3053                  ira->ira_flags |= IRAF_IPSEC_DECAPS;
3053 3054  
3054 3055                  ip_input_post_ipsec(mp, ira);
3055 3056                  return;
3056 3057          }
3057 3058  
3058 3059          iptun:  /* IPPROTO_ENCAPS that is not self-encapsulated */
3059 3060          case IPPROTO_IPV6:
3060 3061                  /* iptun will verify trusted label */
3061 3062                  connp = ipcl_classify_v4(mp, protocol, ip_hdr_length,
3062 3063                      ira, ipst);
3063 3064                  if (connp != NULL) {
3064 3065                          BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3065 3066                          ira->ira_ill = ira->ira_rill = NULL;
3066 3067                          (connp->conn_recv)(connp, mp, NULL, ira);
3067 3068                          CONN_DEC_REF(connp);
3068 3069                          ira->ira_ill = ill;
3069 3070                          ira->ira_rill = rill;
3070 3071                          return;
3071 3072                  }
3072 3073                  /* FALLTHRU */
3073 3074          default:
3074 3075                  /*
3075 3076                   * On a labeled system, we have to check whether the zone
3076 3077                   * itself is permitted to receive raw traffic.
3077 3078                   */
3078 3079                  if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
3079 3080                          if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
3080 3081                                  BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3081 3082                                  ip_drop_input("ipIfStatsInDiscards", mp, ill);
3082 3083                                  freemsg(mp);
3083 3084                                  return;
3084 3085                          }
3085 3086                  }
3086 3087                  break;
3087 3088          }
3088 3089  
3089 3090          /*
3090 3091           * The above input functions may have returned the pulled up message.
3091 3092           * So ipha need to be reinitialized.
3092 3093           */
3093 3094          ipha = (ipha_t *)mp->b_rptr;
3094 3095          ira->ira_protocol = protocol = ipha->ipha_protocol;
3095 3096          if (ipst->ips_ipcl_proto_fanout_v4[protocol].connf_head == NULL) {
3096 3097                  /*
3097 3098                   * No user-level listener for these packets packets.
3098 3099                   * Check for IPPROTO_ENCAP...
3099 3100                   */
3100 3101                  if (protocol == IPPROTO_ENCAP && ipst->ips_ip_g_mrouter) {
3101 3102                          /*
3102 3103                           * Check policy here,
3103 3104                           * THEN ship off to ip_mroute_decap().
3104 3105                           *
3105 3106                           * BTW,  If I match a configured IP-in-IP
3106 3107                           * tunnel above, this path will not be reached, and
3107 3108                           * ip_mroute_decap will never be called.
3108 3109                           */
3109 3110                          mp = ipsec_check_global_policy(mp, connp,
3110 3111                              ipha, NULL, ira, ns);
3111 3112                          if (mp != NULL) {
3112 3113                                  ip_mroute_decap(mp, ira);
3113 3114                          } /* Else we already freed everything! */
3114 3115                  } else {
3115 3116                          ip_proto_not_sup(mp, ira);
3116 3117                  }
3117 3118                  return;
3118 3119          }
3119 3120  
3120 3121          /*
3121 3122           * Handle fanout to raw sockets.  There
3122 3123           * can be more than one stream bound to a particular
3123 3124           * protocol.  When this is the case, each one gets a copy
3124 3125           * of any incoming packets.
3125 3126           */
3126 3127          ASSERT(ira->ira_protocol == ipha->ipha_protocol);
3127 3128          ip_fanout_proto_v4(mp, ipha, ira);
3128 3129          return;
3129 3130  
3130 3131  discard:
3131 3132          BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3132 3133          ip_drop_input("ipIfStatsInDiscards", mp, ill);
3133 3134          freemsg(mp);
3134 3135  #undef rptr
3135 3136  }
  
    | 
      ↓ open down ↓ | 
    2328 lines elided | 
    
      ↑ open up ↑ | 
  
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX