Print this page
787 Kernel panic in ip_input.c
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/ip/ip_input.c
+++ new/usr/src/uts/common/inet/ip/ip_input.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
|
↓ open down ↓ |
13 lines elided |
↑ open up ↑ |
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24 + *
25 + * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
24 26 */
25 27 /* Copyright (c) 1990 Mentat Inc. */
26 28
27 29 #include <sys/types.h>
28 30 #include <sys/stream.h>
29 31 #include <sys/dlpi.h>
30 32 #include <sys/stropts.h>
31 33 #include <sys/sysmacros.h>
32 34 #include <sys/strsubr.h>
33 35 #include <sys/strlog.h>
34 36 #include <sys/strsun.h>
35 37 #include <sys/zone.h>
36 38 #define _SUN_TPI_VERSION 2
37 39 #include <sys/tihdr.h>
38 40 #include <sys/xti_inet.h>
39 41 #include <sys/ddi.h>
40 42 #include <sys/sunddi.h>
41 43 #include <sys/cmn_err.h>
42 44 #include <sys/debug.h>
43 45 #include <sys/kobj.h>
44 46 #include <sys/modctl.h>
45 47 #include <sys/atomic.h>
46 48 #include <sys/policy.h>
47 49 #include <sys/priv.h>
48 50
49 51 #include <sys/systm.h>
50 52 #include <sys/param.h>
51 53 #include <sys/kmem.h>
52 54 #include <sys/sdt.h>
53 55 #include <sys/socket.h>
54 56 #include <sys/vtrace.h>
55 57 #include <sys/isa_defs.h>
56 58 #include <sys/mac.h>
57 59 #include <net/if.h>
58 60 #include <net/if_arp.h>
59 61 #include <net/route.h>
60 62 #include <sys/sockio.h>
61 63 #include <netinet/in.h>
62 64 #include <net/if_dl.h>
63 65
64 66 #include <inet/common.h>
65 67 #include <inet/mi.h>
66 68 #include <inet/mib2.h>
67 69 #include <inet/nd.h>
68 70 #include <inet/arp.h>
69 71 #include <inet/snmpcom.h>
70 72 #include <inet/kstatcom.h>
71 73
72 74 #include <netinet/igmp_var.h>
73 75 #include <netinet/ip6.h>
74 76 #include <netinet/icmp6.h>
75 77 #include <netinet/sctp.h>
76 78
77 79 #include <inet/ip.h>
78 80 #include <inet/ip_impl.h>
79 81 #include <inet/ip6.h>
80 82 #include <inet/ip6_asp.h>
81 83 #include <inet/optcom.h>
82 84 #include <inet/tcp.h>
83 85 #include <inet/tcp_impl.h>
84 86 #include <inet/ip_multi.h>
85 87 #include <inet/ip_if.h>
86 88 #include <inet/ip_ire.h>
87 89 #include <inet/ip_ftable.h>
88 90 #include <inet/ip_rts.h>
89 91 #include <inet/ip_ndp.h>
90 92 #include <inet/ip_listutils.h>
91 93 #include <netinet/igmp.h>
92 94 #include <netinet/ip_mroute.h>
93 95 #include <inet/ipp_common.h>
94 96
95 97 #include <net/pfkeyv2.h>
96 98 #include <inet/sadb.h>
97 99 #include <inet/ipsec_impl.h>
98 100 #include <inet/ipdrop.h>
99 101 #include <inet/ip_netinfo.h>
100 102 #include <inet/ilb_ip.h>
101 103 #include <sys/squeue_impl.h>
102 104 #include <sys/squeue.h>
103 105
104 106 #include <sys/ethernet.h>
105 107 #include <net/if_types.h>
106 108 #include <sys/cpuvar.h>
107 109
108 110 #include <ipp/ipp.h>
109 111 #include <ipp/ipp_impl.h>
110 112 #include <ipp/ipgpc/ipgpc.h>
111 113
112 114 #include <sys/pattr.h>
113 115 #include <inet/ipclassifier.h>
114 116 #include <inet/sctp_ip.h>
115 117 #include <inet/sctp/sctp_impl.h>
116 118 #include <inet/udp_impl.h>
117 119 #include <sys/sunddi.h>
118 120
119 121 #include <sys/tsol/label.h>
120 122 #include <sys/tsol/tnet.h>
121 123
122 124 #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */
123 125
124 126 #ifdef DEBUG
125 127 extern boolean_t skip_sctp_cksum;
126 128 #endif
127 129
128 130 static void ip_input_local_v4(ire_t *, mblk_t *, ipha_t *,
129 131 ip_recv_attr_t *);
130 132
131 133 static void ip_input_broadcast_v4(ire_t *, mblk_t *, ipha_t *,
132 134 ip_recv_attr_t *);
133 135 static void ip_input_multicast_v4(ire_t *, mblk_t *, ipha_t *,
134 136 ip_recv_attr_t *);
135 137
136 138 #pragma inline(ip_input_common_v4, ip_input_local_v4, ip_forward_xmit_v4)
137 139
138 140 /*
139 141 * Direct read side procedure capable of dealing with chains. GLDv3 based
140 142 * drivers call this function directly with mblk chains while STREAMS
141 143 * read side procedure ip_rput() calls this for single packet with ip_ring
142 144 * set to NULL to process one packet at a time.
143 145 *
144 146 * The ill will always be valid if this function is called directly from
145 147 * the driver.
146 148 *
147 149 * If ip_input() is called from GLDv3:
148 150 *
149 151 * - This must be a non-VLAN IP stream.
150 152 * - 'mp' is either an untagged or a special priority-tagged packet.
151 153 * - Any VLAN tag that was in the MAC header has been stripped.
152 154 *
153 155 * If the IP header in packet is not 32-bit aligned, every message in the
154 156 * chain will be aligned before further operations. This is required on SPARC
155 157 * platform.
156 158 */
157 159 void
158 160 ip_input(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
159 161 struct mac_header_info_s *mhip)
160 162 {
161 163 (void) ip_input_common_v4(ill, ip_ring, mp_chain, mhip, NULL, NULL,
162 164 NULL);
163 165 }
164 166
165 167 /*
166 168 * ip_accept_tcp() - This function is called by the squeue when it retrieves
167 169 * a chain of packets in the poll mode. The packets have gone through the
168 170 * data link processing but not IP processing. For performance and latency
169 171 * reasons, the squeue wants to process the chain in line instead of feeding
170 172 * it back via ip_input path.
171 173 *
172 174 * We set up the ip_recv_attr_t with IRAF_TARGET_SQP to that ip_fanout_v4
173 175 * will pass back any TCP packets matching the target sqp to
174 176 * ip_input_common_v4 using ira_target_sqp_mp. Other packets are handled by
175 177 * ip_input_v4 and ip_fanout_v4 as normal.
176 178 * The TCP packets that match the target squeue are returned to the caller
177 179 * as a b_next chain after each packet has been prepend with an mblk
178 180 * from ip_recv_attr_to_mblk.
179 181 */
180 182 mblk_t *
181 183 ip_accept_tcp(ill_t *ill, ill_rx_ring_t *ip_ring, squeue_t *target_sqp,
182 184 mblk_t *mp_chain, mblk_t **last, uint_t *cnt)
183 185 {
184 186 return (ip_input_common_v4(ill, ip_ring, mp_chain, NULL, target_sqp,
185 187 last, cnt));
186 188 }
187 189
188 190 /*
189 191 * Used by ip_input and ip_accept_tcp
190 192 * The last three arguments are only used by ip_accept_tcp, and mhip is
191 193 * only used by ip_input.
192 194 */
193 195 mblk_t *
194 196 ip_input_common_v4(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
195 197 struct mac_header_info_s *mhip, squeue_t *target_sqp,
196 198 mblk_t **last, uint_t *cnt)
197 199 {
198 200 mblk_t *mp;
199 201 ipha_t *ipha;
200 202 ip_recv_attr_t iras; /* Receive attributes */
201 203 rtc_t rtc;
202 204 iaflags_t chain_flags = 0; /* Fixed for chain */
203 205 mblk_t *ahead = NULL; /* Accepted head */
204 206 mblk_t *atail = NULL; /* Accepted tail */
205 207 uint_t acnt = 0; /* Accepted count */
206 208
207 209 ASSERT(mp_chain != NULL);
208 210 ASSERT(ill != NULL);
209 211
210 212 /* These ones do not change as we loop over packets */
211 213 iras.ira_ill = iras.ira_rill = ill;
212 214 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
213 215 iras.ira_rifindex = iras.ira_ruifindex;
214 216 iras.ira_sqp = NULL;
215 217 iras.ira_ring = ip_ring;
216 218 /* For ECMP and outbound transmit ring selection */
217 219 iras.ira_xmit_hint = ILL_RING_TO_XMIT_HINT(ip_ring);
218 220
219 221 iras.ira_target_sqp = target_sqp;
220 222 iras.ira_target_sqp_mp = NULL;
221 223 if (target_sqp != NULL)
222 224 chain_flags |= IRAF_TARGET_SQP;
223 225
224 226 /*
225 227 * We try to have a mhip pointer when possible, but
226 228 * it might be NULL in some cases. In those cases we
227 229 * have to assume unicast.
228 230 */
229 231 iras.ira_mhip = mhip;
230 232 iras.ira_flags = 0;
231 233 if (mhip != NULL) {
232 234 switch (mhip->mhi_dsttype) {
233 235 case MAC_ADDRTYPE_MULTICAST :
234 236 chain_flags |= IRAF_L2DST_MULTICAST;
235 237 break;
236 238 case MAC_ADDRTYPE_BROADCAST :
237 239 chain_flags |= IRAF_L2DST_BROADCAST;
238 240 break;
239 241 }
240 242 }
241 243
242 244 /*
243 245 * Initialize the one-element route cache.
244 246 *
245 247 * We do ire caching from one iteration to
246 248 * another. In the event the packet chain contains
247 249 * all packets from the same dst, this caching saves
248 250 * an ire_route_recursive for each of the succeeding
249 251 * packets in a packet chain.
250 252 */
251 253 rtc.rtc_ire = NULL;
252 254 rtc.rtc_ipaddr = INADDR_ANY;
253 255
254 256 /* Loop over b_next */
255 257 for (mp = mp_chain; mp != NULL; mp = mp_chain) {
256 258 mp_chain = mp->b_next;
257 259 mp->b_next = NULL;
258 260
259 261 ASSERT(DB_TYPE(mp) == M_DATA);
260 262
261 263
262 264 /*
263 265 * if db_ref > 1 then copymsg and free original. Packet
264 266 * may be changed and we do not want the other entity
265 267 * who has a reference to this message to trip over the
266 268 * changes. This is a blind change because trying to
267 269 * catch all places that might change the packet is too
268 270 * difficult.
269 271 *
270 272 * This corresponds to the fast path case, where we have
271 273 * a chain of M_DATA mblks. We check the db_ref count
272 274 * of only the 1st data block in the mblk chain. There
273 275 * doesn't seem to be a reason why a device driver would
274 276 * send up data with varying db_ref counts in the mblk
275 277 * chain. In any case the Fast path is a private
276 278 * interface, and our drivers don't do such a thing.
277 279 * Given the above assumption, there is no need to walk
278 280 * down the entire mblk chain (which could have a
279 281 * potential performance problem)
280 282 *
281 283 * The "(DB_REF(mp) > 1)" check was moved from ip_rput()
282 284 * to here because of exclusive ip stacks and vnics.
283 285 * Packets transmitted from exclusive stack over vnic
284 286 * can have db_ref > 1 and when it gets looped back to
285 287 * another vnic in a different zone, you have ip_input()
286 288 * getting dblks with db_ref > 1. So if someone
287 289 * complains of TCP performance under this scenario,
288 290 * take a serious look here on the impact of copymsg().
289 291 */
290 292 if (DB_REF(mp) > 1) {
291 293 if ((mp = ip_fix_dbref(mp, &iras)) == NULL) {
292 294 /* mhip might point into 1st packet in chain */
293 295 iras.ira_mhip = NULL;
294 296 continue;
295 297 }
296 298 }
297 299
298 300 /*
299 301 * IP header ptr not aligned?
300 302 * OR IP header not complete in first mblk
301 303 */
302 304 ipha = (ipha_t *)mp->b_rptr;
303 305 if (!OK_32PTR(ipha) || MBLKL(mp) < IP_SIMPLE_HDR_LENGTH) {
304 306 mp = ip_check_and_align_header(mp, IP_SIMPLE_HDR_LENGTH,
305 307 &iras);
306 308 if (mp == NULL) {
307 309 /* mhip might point into 1st packet in chain */
308 310 iras.ira_mhip = NULL;
309 311 continue;
310 312 }
311 313 ipha = (ipha_t *)mp->b_rptr;
312 314 }
313 315
314 316 /* Protect against a mix of Ethertypes and IP versions */
315 317 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
316 318 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
317 319 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
318 320 freemsg(mp);
319 321 /* mhip might point into 1st packet in the chain. */
320 322 iras.ira_mhip = NULL;
321 323 continue;
322 324 }
323 325
324 326 /*
325 327 * Check for Martian addrs; we have to explicitly
326 328 * test for for zero dst since this is also used as
327 329 * an indication that the rtc is not used.
328 330 */
329 331 if (ipha->ipha_dst == INADDR_ANY) {
330 332 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
331 333 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
332 334 freemsg(mp);
333 335 /* mhip might point into 1st packet in the chain. */
334 336 iras.ira_mhip = NULL;
335 337 continue;
336 338 }
337 339
338 340 /*
339 341 * Keep L2SRC from a previous packet in chain since mhip
340 342 * might point into an earlier packet in the chain.
341 343 * Keep IRAF_VERIFIED_SRC to avoid redoing broadcast
342 344 * source check in forwarding path.
343 345 */
344 346 chain_flags |= (iras.ira_flags &
345 347 (IRAF_L2SRC_SET|IRAF_VERIFIED_SRC));
346 348
347 349 iras.ira_flags = IRAF_IS_IPV4 | IRAF_VERIFY_IP_CKSUM |
348 350 IRAF_VERIFY_ULP_CKSUM | chain_flags;
349 351 iras.ira_free_flags = 0;
350 352 iras.ira_cred = NULL;
351 353 iras.ira_cpid = NOPID;
352 354 iras.ira_tsl = NULL;
353 355 iras.ira_zoneid = ALL_ZONES; /* Default for forwarding */
354 356
355 357 /*
356 358 * We must count all incoming packets, even if they end
357 359 * up being dropped later on. Defer counting bytes until
358 360 * we have the whole IP header in first mblk.
359 361 */
360 362 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
361 363
362 364 iras.ira_pktlen = ntohs(ipha->ipha_length);
363 365 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets,
364 366 iras.ira_pktlen);
365 367
366 368 /*
367 369 * Call one of:
368 370 * ill_input_full_v4
369 371 * ill_input_short_v4
370 372 * The former is used in unusual cases. See ill_set_inputfn().
371 373 */
372 374 (*ill->ill_inputfn)(mp, ipha, &ipha->ipha_dst, &iras, &rtc);
373 375
374 376 /* Any references to clean up? No hold on ira_ill */
375 377 if (iras.ira_flags & (IRAF_IPSEC_SECURE|IRAF_SYSTEM_LABELED))
376 378 ira_cleanup(&iras, B_FALSE);
377 379
378 380 if (iras.ira_target_sqp_mp != NULL) {
379 381 /* Better be called from ip_accept_tcp */
380 382 ASSERT(target_sqp != NULL);
381 383
382 384 /* Found one packet to accept */
383 385 mp = iras.ira_target_sqp_mp;
384 386 iras.ira_target_sqp_mp = NULL;
385 387 ASSERT(ip_recv_attr_is_mblk(mp));
386 388
387 389 if (atail != NULL)
388 390 atail->b_next = mp;
389 391 else
390 392 ahead = mp;
391 393 atail = mp;
392 394 acnt++;
393 395 mp = NULL;
394 396 }
395 397 /* mhip might point into 1st packet in the chain. */
396 398 iras.ira_mhip = NULL;
397 399 }
398 400 /* Any remaining references to the route cache? */
399 401 if (rtc.rtc_ire != NULL) {
400 402 ASSERT(rtc.rtc_ipaddr != INADDR_ANY);
401 403 ire_refrele(rtc.rtc_ire);
402 404 }
403 405
404 406 if (ahead != NULL) {
405 407 /* Better be called from ip_accept_tcp */
406 408 ASSERT(target_sqp != NULL);
407 409 *last = atail;
408 410 *cnt = acnt;
409 411 return (ahead);
410 412 }
411 413
412 414 return (NULL);
413 415 }
414 416
415 417 /*
416 418 * This input function is used when
417 419 * - is_system_labeled()
418 420 * - CGTP filtering
419 421 * - DHCP unicast before we have an IP address configured
420 422 * - there is an listener for IPPROTO_RSVP
421 423 */
422 424 void
423 425 ill_input_full_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
424 426 ip_recv_attr_t *ira, rtc_t *rtc)
425 427 {
426 428 ipha_t *ipha = (ipha_t *)iph_arg;
427 429 ipaddr_t nexthop = *(ipaddr_t *)nexthop_arg;
428 430 ill_t *ill = ira->ira_ill;
429 431 ip_stack_t *ipst = ill->ill_ipst;
430 432 int cgtp_flt_pkt;
431 433
432 434 ASSERT(ira->ira_tsl == NULL);
433 435
434 436 /*
435 437 * Attach any necessary label information to
436 438 * this packet
437 439 */
438 440 if (is_system_labeled()) {
439 441 ira->ira_flags |= IRAF_SYSTEM_LABELED;
440 442
441 443 /*
442 444 * This updates ira_cred, ira_tsl and ira_free_flags based
443 445 * on the label.
444 446 */
445 447 if (!tsol_get_pkt_label(mp, IPV4_VERSION, ira)) {
446 448 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
447 449 ip_drop_input("ipIfStatsInDiscards", mp, ill);
448 450 freemsg(mp);
449 451 return;
450 452 }
451 453 /* Note that ira_tsl can be NULL here. */
452 454
453 455 /* tsol_get_pkt_label sometimes does pullupmsg */
454 456 ipha = (ipha_t *)mp->b_rptr;
455 457 }
456 458
457 459 /*
458 460 * Invoke the CGTP (multirouting) filtering module to process
459 461 * the incoming packet. Packets identified as duplicates
460 462 * must be discarded. Filtering is active only if the
461 463 * the ip_cgtp_filter ndd variable is non-zero.
462 464 */
463 465 cgtp_flt_pkt = CGTP_IP_PKT_NOT_CGTP;
464 466 if (ipst->ips_ip_cgtp_filter &&
465 467 ipst->ips_ip_cgtp_filter_ops != NULL) {
466 468 netstackid_t stackid;
467 469
468 470 stackid = ipst->ips_netstack->netstack_stackid;
469 471 /*
470 472 * CGTP and IPMP are mutually exclusive so
471 473 * phyint_ifindex is fine here.
472 474 */
473 475 cgtp_flt_pkt =
474 476 ipst->ips_ip_cgtp_filter_ops->cfo_filter(stackid,
475 477 ill->ill_phyint->phyint_ifindex, mp);
476 478 if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
477 479 ip_drop_input("CGTP_IP_PKT_DUPLICATE", mp, ill);
478 480 freemsg(mp);
479 481 return;
480 482 }
481 483 }
482 484
483 485 /*
484 486 * Brutal hack for DHCPv4 unicast: RFC2131 allows a DHCP
485 487 * server to unicast DHCP packets to a DHCP client using the
486 488 * IP address it is offering to the client. This can be
487 489 * disabled through the "broadcast bit", but not all DHCP
488 490 * servers honor that bit. Therefore, to interoperate with as
489 491 * many DHCP servers as possible, the DHCP client allows the
490 492 * server to unicast, but we treat those packets as broadcast
491 493 * here. Note that we don't rewrite the packet itself since
492 494 * (a) that would mess up the checksums and (b) the DHCP
493 495 * client conn is bound to INADDR_ANY so ip_fanout_udp() will
494 496 * hand it the packet regardless.
495 497 */
496 498 if (ill->ill_dhcpinit != 0 &&
497 499 ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION &&
498 500 ipha->ipha_protocol == IPPROTO_UDP) {
499 501 udpha_t *udpha;
500 502
501 503 ipha = ip_pullup(mp, sizeof (ipha_t) + sizeof (udpha_t), ira);
502 504 if (ipha == NULL) {
503 505 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
504 506 ip_drop_input("ipIfStatsInDiscards - dhcp", mp, ill);
505 507 freemsg(mp);
506 508 return;
507 509 }
508 510 /* Reload since pullupmsg() can change b_rptr. */
509 511 udpha = (udpha_t *)&ipha[1];
510 512
511 513 if (ntohs(udpha->uha_dst_port) == IPPORT_BOOTPC) {
512 514 DTRACE_PROBE2(ip4__dhcpinit__pkt, ill_t *, ill,
513 515 mblk_t *, mp);
514 516 /*
515 517 * This assumes that we deliver to all conns for
516 518 * multicast and broadcast packets.
517 519 */
518 520 nexthop = INADDR_BROADCAST;
519 521 ira->ira_flags |= IRAF_DHCP_UNICAST;
520 522 }
521 523 }
522 524
523 525 /*
524 526 * If rsvpd is running, let RSVP daemon handle its processing
525 527 * and forwarding of RSVP multicast/unicast packets.
526 528 * If rsvpd is not running but mrouted is running, RSVP
527 529 * multicast packets are forwarded as multicast traffic
528 530 * and RSVP unicast packets are forwarded by unicast router.
529 531 * If neither rsvpd nor mrouted is running, RSVP multicast
530 532 * packets are not forwarded, but the unicast packets are
531 533 * forwarded like unicast traffic.
532 534 */
533 535 if (ipha->ipha_protocol == IPPROTO_RSVP &&
534 536 ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head != NULL) {
535 537 /* RSVP packet and rsvpd running. Treat as ours */
536 538 ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(nexthop)));
537 539 /*
538 540 * We use a multicast address to get the packet to
539 541 * ire_recv_multicast_v4. There will not be a membership
540 542 * check since we set IRAF_RSVP
541 543 */
542 544 nexthop = htonl(INADDR_UNSPEC_GROUP);
543 545 ira->ira_flags |= IRAF_RSVP;
544 546 }
545 547
546 548 ill_input_short_v4(mp, ipha, &nexthop, ira, rtc);
547 549 }
548 550
549 551 /*
550 552 * This is the tail-end of the full receive side packet handling.
551 553 * It can be used directly when the configuration is simple.
552 554 */
553 555 void
554 556 ill_input_short_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
555 557 ip_recv_attr_t *ira, rtc_t *rtc)
556 558 {
557 559 ire_t *ire;
558 560 uint_t opt_len;
559 561 ill_t *ill = ira->ira_ill;
560 562 ip_stack_t *ipst = ill->ill_ipst;
561 563 uint_t pkt_len;
562 564 ssize_t len;
563 565 ipha_t *ipha = (ipha_t *)iph_arg;
564 566 ipaddr_t nexthop = *(ipaddr_t *)nexthop_arg;
565 567 ilb_stack_t *ilbs = ipst->ips_netstack->netstack_ilb;
566 568 uint_t irr_flags;
567 569 #define rptr ((uchar_t *)ipha)
568 570
569 571 ASSERT(DB_TYPE(mp) == M_DATA);
570 572
571 573 /*
572 574 * The following test for loopback is faster than
573 575 * IP_LOOPBACK_ADDR(), because it avoids any bitwise
574 576 * operations.
575 577 * Note that these addresses are always in network byte order
576 578 */
577 579 if (((*(uchar_t *)&ipha->ipha_dst) == IN_LOOPBACKNET) ||
578 580 ((*(uchar_t *)&ipha->ipha_src) == IN_LOOPBACKNET)) {
579 581 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
580 582 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
581 583 freemsg(mp);
582 584 return;
583 585 }
584 586
585 587 len = mp->b_wptr - rptr;
586 588 pkt_len = ira->ira_pktlen;
587 589
588 590 /* multiple mblk or too short */
589 591 len -= pkt_len;
590 592 if (len != 0) {
591 593 mp = ip_check_length(mp, rptr, len, pkt_len,
592 594 IP_SIMPLE_HDR_LENGTH, ira);
593 595 if (mp == NULL)
594 596 return;
595 597 ipha = (ipha_t *)mp->b_rptr;
596 598 }
597 599
598 600 DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
599 601 ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *, NULL,
600 602 int, 0);
601 603
602 604 /*
603 605 * The event for packets being received from a 'physical'
604 606 * interface is placed after validation of the source and/or
605 607 * destination address as being local so that packets can be
606 608 * redirected to loopback addresses using ipnat.
607 609 */
608 610 DTRACE_PROBE4(ip4__physical__in__start,
609 611 ill_t *, ill, ill_t *, NULL,
610 612 ipha_t *, ipha, mblk_t *, mp);
611 613
612 614 if (HOOKS4_INTERESTED_PHYSICAL_IN(ipst)) {
613 615 int ll_multicast = 0;
614 616 int error;
615 617 ipaddr_t orig_dst = ipha->ipha_dst;
616 618
617 619 if (ira->ira_flags & IRAF_L2DST_MULTICAST)
618 620 ll_multicast = HPE_MULTICAST;
619 621 else if (ira->ira_flags & IRAF_L2DST_BROADCAST)
620 622 ll_multicast = HPE_BROADCAST;
621 623
622 624 FW_HOOKS(ipst->ips_ip4_physical_in_event,
623 625 ipst->ips_ipv4firewall_physical_in,
624 626 ill, NULL, ipha, mp, mp, ll_multicast, ipst, error);
625 627
626 628 DTRACE_PROBE1(ip4__physical__in__end, mblk_t *, mp);
627 629
628 630 if (mp == NULL)
629 631 return;
630 632 /* The length could have changed */
631 633 ipha = (ipha_t *)mp->b_rptr;
632 634 ira->ira_pktlen = ntohs(ipha->ipha_length);
633 635 pkt_len = ira->ira_pktlen;
634 636
635 637 /*
636 638 * In case the destination changed we override any previous
637 639 * change to nexthop.
638 640 */
639 641 if (orig_dst != ipha->ipha_dst)
640 642 nexthop = ipha->ipha_dst;
641 643 if (nexthop == INADDR_ANY) {
642 644 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
643 645 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
644 646 freemsg(mp);
645 647 return;
646 648 }
647 649 }
648 650
649 651 if (ipst->ips_ip4_observe.he_interested) {
650 652 zoneid_t dzone;
651 653
652 654 /*
653 655 * On the inbound path the src zone will be unknown as
654 656 * this packet has come from the wire.
655 657 */
656 658 dzone = ip_get_zoneid_v4(nexthop, mp, ira, ALL_ZONES);
657 659 ipobs_hook(mp, IPOBS_HOOK_INBOUND, ALL_ZONES, dzone, ill, ipst);
658 660 }
659 661
660 662 /*
661 663 * If there is a good HW IP header checksum we clear the need
662 664 * look at the IP header checksum.
663 665 */
664 666 if ((DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM) &&
665 667 ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
666 668 /* Header checksum was ok. Clear the flag */
667 669 DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM;
668 670 ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
669 671 }
670 672
671 673 /*
672 674 * Here we check to see if we machine is setup as
673 675 * L3 loadbalancer and if the incoming packet is for a VIP
674 676 *
675 677 * Check the following:
676 678 * - there is at least a rule
677 679 * - protocol of the packet is supported
678 680 */
679 681 if (ilb_has_rules(ilbs) && ILB_SUPP_L4(ipha->ipha_protocol)) {
680 682 ipaddr_t lb_dst;
681 683 int lb_ret;
682 684
683 685 /* For convenience, we pull up the mblk. */
684 686 if (mp->b_cont != NULL) {
685 687 if (pullupmsg(mp, -1) == 0) {
686 688 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
687 689 ip_drop_input("ipIfStatsInDiscards - pullupmsg",
688 690 mp, ill);
689 691 freemsg(mp);
690 692 return;
691 693 }
692 694 ipha = (ipha_t *)mp->b_rptr;
693 695 }
694 696
695 697 /*
696 698 * We just drop all fragments going to any VIP, at
697 699 * least for now....
698 700 */
699 701 if (ntohs(ipha->ipha_fragment_offset_and_flags) &
700 702 (IPH_MF | IPH_OFFSET)) {
701 703 if (!ilb_rule_match_vip_v4(ilbs, nexthop, NULL)) {
702 704 goto after_ilb;
703 705 }
704 706
705 707 ILB_KSTAT_UPDATE(ilbs, ip_frag_in, 1);
706 708 ILB_KSTAT_UPDATE(ilbs, ip_frag_dropped, 1);
707 709 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
708 710 ip_drop_input("ILB fragment", mp, ill);
709 711 freemsg(mp);
710 712 return;
711 713 }
712 714 lb_ret = ilb_check_v4(ilbs, ill, mp, ipha, ipha->ipha_protocol,
713 715 (uint8_t *)ipha + IPH_HDR_LENGTH(ipha), &lb_dst);
714 716
715 717 if (lb_ret == ILB_DROPPED) {
716 718 /* Is this the right counter to increase? */
717 719 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
718 720 ip_drop_input("ILB_DROPPED", mp, ill);
719 721 freemsg(mp);
720 722 return;
721 723 }
722 724 if (lb_ret == ILB_BALANCED) {
723 725 /* Set the dst to that of the chosen server */
724 726 nexthop = lb_dst;
725 727 DB_CKSUMFLAGS(mp) = 0;
726 728 }
727 729 }
728 730
729 731 after_ilb:
730 732 opt_len = ipha->ipha_version_and_hdr_length - IP_SIMPLE_HDR_VERSION;
731 733 ira->ira_ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
732 734 if (opt_len != 0) {
733 735 int error = 0;
734 736
735 737 ira->ira_ip_hdr_length += (opt_len << 2);
736 738 ira->ira_flags |= IRAF_IPV4_OPTIONS;
737 739
738 740 /* IP Options present! Validate the length. */
739 741 mp = ip_check_optlen(mp, ipha, opt_len, pkt_len, ira);
740 742 if (mp == NULL)
741 743 return;
742 744
743 745 /* Might have changed */
744 746 ipha = (ipha_t *)mp->b_rptr;
745 747
746 748 /* Verify IP header checksum before parsing the options */
747 749 if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
748 750 ip_csum_hdr(ipha)) {
749 751 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
750 752 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
751 753 freemsg(mp);
752 754 return;
753 755 }
754 756 ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
755 757
756 758 /*
757 759 * Go off to ip_input_options which returns the next hop
758 760 * destination address, which may have been affected
759 761 * by source routing.
760 762 */
761 763 IP_STAT(ipst, ip_opt);
762 764
763 765 nexthop = ip_input_options(ipha, nexthop, mp, ira, &error);
764 766 if (error != 0) {
765 767 /*
766 768 * An ICMP error has been sent and the packet has
767 769 * been dropped.
768 770 */
769 771 return;
770 772 }
771 773 }
772 774
773 775 if (ill->ill_flags & ILLF_ROUTER)
774 776 irr_flags = IRR_ALLOCATE;
775 777 else
776 778 irr_flags = IRR_NONE;
777 779
778 780 /* Can not use route cache with TX since the labels can differ */
779 781 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
780 782 if (CLASSD(nexthop)) {
781 783 ire = ire_multicast(ill);
782 784 } else {
783 785 /* Match destination and label */
784 786 ire = ire_route_recursive_v4(nexthop, 0, NULL,
|
↓ open down ↓ |
751 lines elided |
↑ open up ↑ |
785 787 ALL_ZONES, ira->ira_tsl, MATCH_IRE_SECATTR,
786 788 irr_flags, ira->ira_xmit_hint, ipst, NULL, NULL,
787 789 NULL);
788 790 }
789 791 /* Update the route cache so we do the ire_refrele */
790 792 ASSERT(ire != NULL);
791 793 if (rtc->rtc_ire != NULL)
792 794 ire_refrele(rtc->rtc_ire);
793 795 rtc->rtc_ire = ire;
794 796 rtc->rtc_ipaddr = nexthop;
795 - } else if (nexthop == rtc->rtc_ipaddr) {
797 + } else if (nexthop == rtc->rtc_ipaddr && rtc->rtc_ire != NULL) {
796 798 /* Use the route cache */
797 - ASSERT(rtc->rtc_ire != NULL);
798 799 ire = rtc->rtc_ire;
799 800 } else {
800 801 /* Update the route cache */
801 802 if (CLASSD(nexthop)) {
802 803 ire = ire_multicast(ill);
803 804 } else {
804 805 /* Just match the destination */
805 806 ire = ire_route_recursive_dstonly_v4(nexthop, irr_flags,
806 807 ira->ira_xmit_hint, ipst);
807 808 }
808 809 ASSERT(ire != NULL);
809 810 if (rtc->rtc_ire != NULL)
810 811 ire_refrele(rtc->rtc_ire);
811 812 rtc->rtc_ire = ire;
812 813 rtc->rtc_ipaddr = nexthop;
813 814 }
814 815
815 816 ire->ire_ib_pkt_count++;
816 817
817 818 /*
818 819 * Based on ire_type and ire_flags call one of:
819 820 * ire_recv_local_v4 - for IRE_LOCAL
820 821 * ire_recv_loopback_v4 - for IRE_LOOPBACK
821 822 * ire_recv_multirt_v4 - if RTF_MULTIRT
822 823 * ire_recv_noroute_v4 - if RTF_REJECT or RTF_BLACHOLE
823 824 * ire_recv_multicast_v4 - for IRE_MULTICAST
824 825 * ire_recv_broadcast_v4 - for IRE_BROADCAST
825 826 * ire_recv_noaccept_v4 - for ire_noaccept ones
826 827 * ire_recv_forward_v4 - for the rest.
827 828 */
828 829 (*ire->ire_recvfn)(ire, mp, ipha, ira);
829 830 }
830 831 #undef rptr
831 832
832 833 /*
833 834 * ire_recvfn for IREs that need forwarding
834 835 */
835 836 void
836 837 ire_recv_forward_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
837 838 {
838 839 ipha_t *ipha = (ipha_t *)iph_arg;
839 840 ill_t *ill = ira->ira_ill;
840 841 ip_stack_t *ipst = ill->ill_ipst;
841 842 ill_t *dst_ill;
842 843 nce_t *nce;
843 844 ipaddr_t src = ipha->ipha_src;
844 845 uint32_t added_tx_len;
845 846 uint32_t mtu, iremtu;
846 847
847 848 if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
848 849 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
849 850 ip_drop_input("l2 multicast not forwarded", mp, ill);
850 851 freemsg(mp);
851 852 return;
852 853 }
853 854
854 855 if (!(ill->ill_flags & ILLF_ROUTER) && !ip_source_routed(ipha, ipst)) {
855 856 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
856 857 ip_drop_input("ipIfStatsForwProhibits", mp, ill);
857 858 freemsg(mp);
858 859 return;
859 860 }
860 861
861 862 /*
862 863 * Either ire_nce_capable or ire_dep_parent would be set for the IRE
863 864 * when it is found by ire_route_recursive, but that some other thread
864 865 * could have changed the routes with the effect of clearing
865 866 * ire_dep_parent. In that case we'd end up dropping the packet, or
866 867 * finding a new nce below.
867 868 * Get, allocate, or update the nce.
868 869 * We get a refhold on ire_nce_cache as a result of this to avoid races
869 870 * where ire_nce_cache is deleted.
870 871 *
871 872 * This ensures that we don't forward if the interface is down since
872 873 * ipif_down removes all the nces.
873 874 */
874 875 mutex_enter(&ire->ire_lock);
875 876 nce = ire->ire_nce_cache;
876 877 if (nce == NULL) {
877 878 /* Not yet set up - try to set one up */
878 879 mutex_exit(&ire->ire_lock);
879 880 (void) ire_revalidate_nce(ire);
880 881 mutex_enter(&ire->ire_lock);
881 882 nce = ire->ire_nce_cache;
882 883 if (nce == NULL) {
883 884 mutex_exit(&ire->ire_lock);
884 885 /* The ire_dep_parent chain went bad, or no memory */
885 886 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
886 887 ip_drop_input("No ire_dep_parent", mp, ill);
887 888 freemsg(mp);
888 889 return;
889 890 }
890 891 }
891 892 nce_refhold(nce);
892 893 mutex_exit(&ire->ire_lock);
893 894
894 895 if (nce->nce_is_condemned) {
895 896 nce_t *nce1;
896 897
897 898 nce1 = ire_handle_condemned_nce(nce, ire, ipha, NULL, B_FALSE);
898 899 nce_refrele(nce);
899 900 if (nce1 == NULL) {
900 901 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
901 902 ip_drop_input("No nce", mp, ill);
902 903 freemsg(mp);
903 904 return;
904 905 }
905 906 nce = nce1;
906 907 }
907 908 dst_ill = nce->nce_ill;
908 909
909 910 /*
910 911 * Unless we are forwarding, drop the packet.
911 912 * We have to let source routed packets through if they go out
912 913 * the same interface i.e., they are 'ping -l' packets.
913 914 */
914 915 if (!(dst_ill->ill_flags & ILLF_ROUTER) &&
915 916 !(ip_source_routed(ipha, ipst) && dst_ill == ill)) {
916 917 if (ip_source_routed(ipha, ipst)) {
917 918 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
918 919 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
919 920 nce_refrele(nce);
920 921 return;
921 922 }
922 923 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
923 924 ip_drop_input("ipIfStatsForwProhibits", mp, ill);
924 925 freemsg(mp);
925 926 nce_refrele(nce);
926 927 return;
927 928 }
928 929
929 930 if (ire->ire_zoneid != GLOBAL_ZONEID && ire->ire_zoneid != ALL_ZONES) {
930 931 ipaddr_t dst = ipha->ipha_dst;
931 932
932 933 ire->ire_ib_pkt_count--;
933 934 /*
934 935 * Should only use IREs that are visible from the
935 936 * global zone for forwarding.
936 937 * Take a source route into account the same way as ip_input
937 938 * did.
938 939 */
939 940 if (ira->ira_flags & IRAF_IPV4_OPTIONS) {
940 941 int error = 0;
941 942
942 943 dst = ip_input_options(ipha, dst, mp, ira, &error);
943 944 ASSERT(error == 0); /* ip_input checked */
944 945 }
945 946 ire = ire_route_recursive_v4(dst, 0, NULL, GLOBAL_ZONEID,
946 947 ira->ira_tsl, MATCH_IRE_SECATTR,
947 948 (ill->ill_flags & ILLF_ROUTER) ? IRR_ALLOCATE : IRR_NONE,
948 949 ira->ira_xmit_hint, ipst, NULL, NULL, NULL);
949 950 ire->ire_ib_pkt_count++;
950 951 (*ire->ire_recvfn)(ire, mp, ipha, ira);
951 952 ire_refrele(ire);
952 953 nce_refrele(nce);
953 954 return;
954 955 }
955 956
956 957 /*
957 958 * ipIfStatsHCInForwDatagrams should only be increment if there
958 959 * will be an attempt to forward the packet, which is why we
959 960 * increment after the above condition has been checked.
960 961 */
961 962 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
962 963
963 964 /* Initiate Read side IPPF processing */
964 965 if (IPP_ENABLED(IPP_FWD_IN, ipst)) {
965 966 /* ip_process translates an IS_UNDER_IPMP */
966 967 mp = ip_process(IPP_FWD_IN, mp, ill, ill);
967 968 if (mp == NULL) {
968 969 /* ip_drop_packet and MIB done */
969 970 ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred "
970 971 "during IPPF processing\n"));
971 972 nce_refrele(nce);
972 973 return;
973 974 }
974 975 }
975 976
976 977 DTRACE_PROBE4(ip4__forwarding__start,
977 978 ill_t *, ill, ill_t *, dst_ill, ipha_t *, ipha, mblk_t *, mp);
978 979
979 980 if (HOOKS4_INTERESTED_FORWARDING(ipst)) {
980 981 int error;
981 982
982 983 FW_HOOKS(ipst->ips_ip4_forwarding_event,
983 984 ipst->ips_ipv4firewall_forwarding,
984 985 ill, dst_ill, ipha, mp, mp, 0, ipst, error);
985 986
986 987 DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp);
987 988
988 989 if (mp == NULL) {
989 990 nce_refrele(nce);
990 991 return;
991 992 }
992 993 /*
993 994 * Even if the destination was changed by the filter we use the
994 995 * forwarding decision that was made based on the address
995 996 * in ip_input.
996 997 */
997 998
998 999 /* Might have changed */
999 1000 ipha = (ipha_t *)mp->b_rptr;
1000 1001 ira->ira_pktlen = ntohs(ipha->ipha_length);
1001 1002 }
1002 1003
1003 1004 /* Packet is being forwarded. Turning off hwcksum flag. */
1004 1005 DB_CKSUMFLAGS(mp) = 0;
1005 1006
1006 1007 /*
1007 1008 * Martian Address Filtering [RFC 1812, Section 5.3.7]
1008 1009 * The loopback address check for both src and dst has already
1009 1010 * been checked in ip_input
1010 1011 * In the future one can envision adding RPF checks using number 3.
1011 1012 * If we already checked the same source address we can skip this.
1012 1013 */
1013 1014 if (!(ira->ira_flags & IRAF_VERIFIED_SRC) ||
1014 1015 src != ira->ira_verified_src) {
1015 1016 switch (ipst->ips_src_check) {
1016 1017 case 0:
1017 1018 break;
1018 1019 case 2:
1019 1020 if (ip_type_v4(src, ipst) == IRE_BROADCAST) {
1020 1021 BUMP_MIB(ill->ill_ip_mib,
1021 1022 ipIfStatsForwProhibits);
1022 1023 BUMP_MIB(ill->ill_ip_mib,
1023 1024 ipIfStatsInAddrErrors);
1024 1025 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1025 1026 freemsg(mp);
1026 1027 nce_refrele(nce);
1027 1028 return;
1028 1029 }
1029 1030 /* FALLTHRU */
1030 1031
1031 1032 case 1:
1032 1033 if (CLASSD(src)) {
1033 1034 BUMP_MIB(ill->ill_ip_mib,
1034 1035 ipIfStatsForwProhibits);
1035 1036 BUMP_MIB(ill->ill_ip_mib,
1036 1037 ipIfStatsInAddrErrors);
1037 1038 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1038 1039 freemsg(mp);
1039 1040 nce_refrele(nce);
1040 1041 return;
1041 1042 }
1042 1043 break;
1043 1044 }
1044 1045 /* Remember for next packet */
1045 1046 ira->ira_flags |= IRAF_VERIFIED_SRC;
1046 1047 ira->ira_verified_src = src;
1047 1048 }
1048 1049
1049 1050 /*
1050 1051 * Check if packet is going out the same link on which it arrived.
1051 1052 * Means we might need to send a redirect.
1052 1053 */
1053 1054 if (IS_ON_SAME_LAN(dst_ill, ill) && ipst->ips_ip_g_send_redirects) {
1054 1055 ip_send_potential_redirect_v4(mp, ipha, ire, ira);
1055 1056 }
1056 1057
1057 1058 added_tx_len = 0;
1058 1059 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
1059 1060 mblk_t *mp1;
1060 1061 uint32_t old_pkt_len = ira->ira_pktlen;
1061 1062
1062 1063 /* Verify IP header checksum before adding/removing options */
1063 1064 if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
1064 1065 ip_csum_hdr(ipha)) {
1065 1066 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1066 1067 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1067 1068 freemsg(mp);
1068 1069 nce_refrele(nce);
1069 1070 return;
1070 1071 }
1071 1072 ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
1072 1073
1073 1074 /*
1074 1075 * Check if it can be forwarded and add/remove
1075 1076 * CIPSO options as needed.
1076 1077 */
1077 1078 if ((mp1 = tsol_ip_forward(ire, mp, ira)) == NULL) {
1078 1079 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1079 1080 ip_drop_input("tsol_ip_forward", mp, ill);
1080 1081 freemsg(mp);
1081 1082 nce_refrele(nce);
1082 1083 return;
1083 1084 }
1084 1085 /*
1085 1086 * Size may have changed. Remember amount added in case
1086 1087 * IP needs to send an ICMP too big.
1087 1088 */
1088 1089 mp = mp1;
1089 1090 ipha = (ipha_t *)mp->b_rptr;
1090 1091 ira->ira_pktlen = ntohs(ipha->ipha_length);
1091 1092 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
1092 1093 if (ira->ira_pktlen > old_pkt_len)
1093 1094 added_tx_len = ira->ira_pktlen - old_pkt_len;
1094 1095
1095 1096 /* Options can have been added or removed */
1096 1097 if (ira->ira_ip_hdr_length != IP_SIMPLE_HDR_LENGTH)
1097 1098 ira->ira_flags |= IRAF_IPV4_OPTIONS;
1098 1099 else
1099 1100 ira->ira_flags &= ~IRAF_IPV4_OPTIONS;
1100 1101 }
1101 1102
1102 1103 mtu = dst_ill->ill_mtu;
1103 1104 if ((iremtu = ire->ire_metrics.iulp_mtu) != 0 && iremtu < mtu)
1104 1105 mtu = iremtu;
1105 1106 ip_forward_xmit_v4(nce, ill, mp, ipha, ira, mtu, added_tx_len);
1106 1107 nce_refrele(nce);
1107 1108 }
1108 1109
1109 1110 /*
1110 1111 * Used for sending out unicast and multicast packets that are
1111 1112 * forwarded.
1112 1113 */
1113 1114 void
1114 1115 ip_forward_xmit_v4(nce_t *nce, ill_t *ill, mblk_t *mp, ipha_t *ipha,
1115 1116 ip_recv_attr_t *ira, uint32_t mtu, uint32_t added_tx_len)
1116 1117 {
1117 1118 ill_t *dst_ill = nce->nce_ill;
1118 1119 uint32_t pkt_len;
1119 1120 uint32_t sum;
1120 1121 iaflags_t iraflags = ira->ira_flags;
1121 1122 ip_stack_t *ipst = ill->ill_ipst;
1122 1123 iaflags_t ixaflags;
1123 1124
1124 1125 if (ipha->ipha_ttl <= 1) {
1125 1126 /* Perhaps the checksum was bad */
1126 1127 if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1127 1128 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1128 1129 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1129 1130 freemsg(mp);
1130 1131 return;
1131 1132 }
1132 1133 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1133 1134 ip_drop_input("ICMP_TTL_EXCEEDED", mp, ill);
1134 1135 icmp_time_exceeded(mp, ICMP_TTL_EXCEEDED, ira);
1135 1136 return;
1136 1137 }
1137 1138 ipha->ipha_ttl--;
1138 1139 /* Adjust the checksum to reflect the ttl decrement. */
1139 1140 sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST;
1140 1141 ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16));
1141 1142
1142 1143 /* Check if there are options to update */
1143 1144 if (iraflags & IRAF_IPV4_OPTIONS) {
1144 1145 ASSERT(ipha->ipha_version_and_hdr_length !=
1145 1146 IP_SIMPLE_HDR_VERSION);
1146 1147 ASSERT(!(iraflags & IRAF_VERIFY_IP_CKSUM));
1147 1148
1148 1149 if (!ip_forward_options(mp, ipha, dst_ill, ira)) {
1149 1150 /* ipIfStatsForwProhibits and ip_drop_input done */
1150 1151 return;
1151 1152 }
1152 1153
1153 1154 ipha->ipha_hdr_checksum = 0;
1154 1155 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1155 1156 }
1156 1157
1157 1158 /* Initiate Write side IPPF processing before any fragmentation */
1158 1159 if (IPP_ENABLED(IPP_FWD_OUT, ipst)) {
1159 1160 /* ip_process translates an IS_UNDER_IPMP */
1160 1161 mp = ip_process(IPP_FWD_OUT, mp, dst_ill, dst_ill);
1161 1162 if (mp == NULL) {
1162 1163 /* ip_drop_packet and MIB done */
1163 1164 ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred" \
1164 1165 " during IPPF processing\n"));
1165 1166 return;
1166 1167 }
1167 1168 }
1168 1169
1169 1170 pkt_len = ira->ira_pktlen;
1170 1171
1171 1172 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsHCOutForwDatagrams);
1172 1173
1173 1174 ixaflags = IXAF_IS_IPV4 | IXAF_NO_DEV_FLOW_CTL;
1174 1175
1175 1176 if (pkt_len > mtu) {
1176 1177 /*
1177 1178 * It needs fragging on its way out. If we haven't
1178 1179 * verified the header checksum yet we do it now since
1179 1180 * are going to put a surely good checksum in the
1180 1181 * outgoing header, we have to make sure that it
1181 1182 * was good coming in.
1182 1183 */
1183 1184 if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1184 1185 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1185 1186 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1186 1187 freemsg(mp);
1187 1188 return;
1188 1189 }
1189 1190 if (ipha->ipha_fragment_offset_and_flags & IPH_DF_HTONS) {
1190 1191 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutFragFails);
1191 1192 ip_drop_output("ipIfStatsOutFragFails", mp, dst_ill);
1192 1193 if (iraflags & IRAF_SYSTEM_LABELED) {
1193 1194 /*
1194 1195 * Remove any CIPSO option added by
1195 1196 * tsol_ip_forward, and make sure we report
1196 1197 * a path MTU so that there
1197 1198 * is room to add such a CIPSO option for future
1198 1199 * packets.
1199 1200 */
1200 1201 mtu = tsol_pmtu_adjust(mp, mtu, added_tx_len,
1201 1202 AF_INET);
1202 1203 }
1203 1204
1204 1205 icmp_frag_needed(mp, mtu, ira);
1205 1206 return;
1206 1207 }
1207 1208
1208 1209 (void) ip_fragment_v4(mp, nce, ixaflags, pkt_len, mtu,
1209 1210 ira->ira_xmit_hint, GLOBAL_ZONEID, 0, ip_xmit, NULL);
1210 1211 return;
1211 1212 }
1212 1213
1213 1214 ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length));
1214 1215 if (iraflags & IRAF_LOOPBACK_COPY) {
1215 1216 /*
1216 1217 * IXAF_NO_LOOP_ZONEID is not set hence 7th arg
1217 1218 * is don't care
1218 1219 */
1219 1220 (void) ip_postfrag_loopcheck(mp, nce,
1220 1221 ixaflags | IXAF_LOOPBACK_COPY,
1221 1222 pkt_len, ira->ira_xmit_hint, GLOBAL_ZONEID, 0, NULL);
1222 1223 } else {
1223 1224 (void) ip_xmit(mp, nce, ixaflags, pkt_len, ira->ira_xmit_hint,
1224 1225 GLOBAL_ZONEID, 0, NULL);
1225 1226 }
1226 1227 }
1227 1228
1228 1229 /*
1229 1230 * ire_recvfn for RTF_REJECT and RTF_BLACKHOLE routes, including IRE_NOROUTE,
1230 1231 * which is what ire_route_recursive returns when there is no matching ire.
1231 1232 * Send ICMP unreachable unless blackhole.
1232 1233 */
1233 1234 void
1234 1235 ire_recv_noroute_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1235 1236 {
1236 1237 ipha_t *ipha = (ipha_t *)iph_arg;
1237 1238 ill_t *ill = ira->ira_ill;
1238 1239 ip_stack_t *ipst = ill->ill_ipst;
1239 1240
1240 1241 /* Would we have forwarded this packet if we had a route? */
1241 1242 if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
1242 1243 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1243 1244 ip_drop_input("l2 multicast not forwarded", mp, ill);
1244 1245 freemsg(mp);
1245 1246 return;
1246 1247 }
1247 1248
1248 1249 if (!(ill->ill_flags & ILLF_ROUTER)) {
1249 1250 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1250 1251 ip_drop_input("ipIfStatsForwProhibits", mp, ill);
1251 1252 freemsg(mp);
1252 1253 return;
1253 1254 }
1254 1255 /*
1255 1256 * If we had a route this could have been forwarded. Count as such.
1256 1257 *
1257 1258 * ipIfStatsHCInForwDatagrams should only be increment if there
1258 1259 * will be an attempt to forward the packet, which is why we
1259 1260 * increment after the above condition has been checked.
1260 1261 */
1261 1262 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
1262 1263
1263 1264 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1264 1265
1265 1266 ip_rts_change(RTM_MISS, ipha->ipha_dst, 0, 0, 0, 0, 0, 0, RTA_DST,
1266 1267 ipst);
1267 1268
1268 1269 if (ire->ire_flags & RTF_BLACKHOLE) {
1269 1270 ip_drop_input("ipIfStatsInNoRoutes RTF_BLACKHOLE", mp, ill);
1270 1271 freemsg(mp);
1271 1272 } else {
1272 1273 ip_drop_input("ipIfStatsInNoRoutes RTF_REJECT", mp, ill);
1273 1274
1274 1275 if (ip_source_routed(ipha, ipst)) {
1275 1276 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
1276 1277 } else {
1277 1278 icmp_unreachable(mp, ICMP_HOST_UNREACHABLE, ira);
1278 1279 }
1279 1280 }
1280 1281 }
1281 1282
1282 1283 /*
1283 1284 * ire_recvfn for IRE_LOCALs marked with ire_noaccept. Such IREs are used for
1284 1285 * VRRP when in noaccept mode.
1285 1286 * We silently drop the packet. ARP handles packets even if noaccept is set.
1286 1287 */
1287 1288 /* ARGSUSED */
1288 1289 void
1289 1290 ire_recv_noaccept_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1290 1291 ip_recv_attr_t *ira)
1291 1292 {
1292 1293 ill_t *ill = ira->ira_ill;
1293 1294
1294 1295 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1295 1296 ip_drop_input("ipIfStatsInDiscards - noaccept", mp, ill);
1296 1297 freemsg(mp);
1297 1298 }
1298 1299
1299 1300 /*
1300 1301 * ire_recvfn for IRE_BROADCAST.
1301 1302 */
1302 1303 void
1303 1304 ire_recv_broadcast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1304 1305 ip_recv_attr_t *ira)
1305 1306 {
1306 1307 ipha_t *ipha = (ipha_t *)iph_arg;
1307 1308 ill_t *ill = ira->ira_ill;
1308 1309 ill_t *dst_ill = ire->ire_ill;
1309 1310 ip_stack_t *ipst = ill->ill_ipst;
1310 1311 ire_t *alt_ire;
1311 1312 nce_t *nce;
1312 1313 ipaddr_t ipha_dst;
1313 1314
1314 1315 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInBcastPkts);
1315 1316
1316 1317 /* Tag for higher-level protocols */
1317 1318 ira->ira_flags |= IRAF_BROADCAST;
1318 1319
1319 1320 /*
1320 1321 * Whether local or directed broadcast forwarding: don't allow
1321 1322 * for TCP.
1322 1323 */
1323 1324 if (ipha->ipha_protocol == IPPROTO_TCP) {
1324 1325 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1325 1326 ip_drop_input("ipIfStatsInDiscards", mp, ill);
1326 1327 freemsg(mp);
1327 1328 return;
1328 1329 }
1329 1330
1330 1331 /*
1331 1332 * So that we don't end up with dups, only one ill an IPMP group is
1332 1333 * nominated to receive broadcast traffic.
1333 1334 * If we have no cast_ill we are liberal and accept everything.
1334 1335 */
1335 1336 if (IS_UNDER_IPMP(ill)) {
1336 1337 /* For an under ill_grp can change under lock */
1337 1338 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1338 1339 if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1339 1340 ill->ill_grp->ig_cast_ill != NULL) {
1340 1341 rw_exit(&ipst->ips_ill_g_lock);
1341 1342 /* No MIB since this is normal operation */
1342 1343 ip_drop_input("not nom_cast", mp, ill);
1343 1344 freemsg(mp);
1344 1345 return;
1345 1346 }
1346 1347 rw_exit(&ipst->ips_ill_g_lock);
1347 1348
1348 1349 ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1349 1350 }
1350 1351
1351 1352 /*
1352 1353 * After reassembly and IPsec we will need to duplicate the
1353 1354 * broadcast packet for all matching zones on the ill.
1354 1355 */
1355 1356 ira->ira_zoneid = ALL_ZONES;
1356 1357
1357 1358 /*
1358 1359 * Check for directed broadcast i.e. ire->ire_ill is different than
1359 1360 * the incoming ill.
1360 1361 * The same broadcast address can be assigned to multiple interfaces
1361 1362 * so have to check explicitly for that case by looking up the alt_ire
1362 1363 */
1363 1364 if (dst_ill == ill && !(ire->ire_flags & RTF_MULTIRT)) {
1364 1365 /* Reassemble on the ill on which the packet arrived */
1365 1366 ip_input_local_v4(ire, mp, ipha, ira);
1366 1367 /* Restore */
1367 1368 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1368 1369 return;
1369 1370 }
1370 1371
1371 1372 /* Is there an IRE_BROADCAST on the incoming ill? */
1372 1373 ipha_dst = ((ira->ira_flags & IRAF_DHCP_UNICAST) ? INADDR_BROADCAST :
1373 1374 ipha->ipha_dst);
1374 1375 alt_ire = ire_ftable_lookup_v4(ipha_dst, 0, 0, IRE_BROADCAST, ill,
1375 1376 ALL_ZONES, ira->ira_tsl,
1376 1377 MATCH_IRE_TYPE|MATCH_IRE_ILL|MATCH_IRE_SECATTR, 0, ipst, NULL);
1377 1378 if (alt_ire != NULL) {
1378 1379 /* Not a directed broadcast */
1379 1380 /*
1380 1381 * In the special case of multirouted broadcast
1381 1382 * packets, we unconditionally need to "gateway"
1382 1383 * them to the appropriate interface here so that reassembly
1383 1384 * works. We know that the IRE_BROADCAST on cgtp0 doesn't
1384 1385 * have RTF_MULTIRT set so we look for such an IRE in the
1385 1386 * bucket.
1386 1387 */
1387 1388 if (alt_ire->ire_flags & RTF_MULTIRT) {
1388 1389 irb_t *irb;
1389 1390 ire_t *ire1;
1390 1391
1391 1392 irb = ire->ire_bucket;
1392 1393 irb_refhold(irb);
1393 1394 for (ire1 = irb->irb_ire; ire1 != NULL;
1394 1395 ire1 = ire1->ire_next) {
1395 1396 if (IRE_IS_CONDEMNED(ire1))
1396 1397 continue;
1397 1398 if (!(ire1->ire_type & IRE_BROADCAST) ||
1398 1399 (ire1->ire_flags & RTF_MULTIRT))
1399 1400 continue;
1400 1401 ill = ire1->ire_ill;
1401 1402 ill_refhold(ill);
1402 1403 break;
1403 1404 }
1404 1405 irb_refrele(irb);
1405 1406 if (ire1 != NULL) {
1406 1407 ill_t *orig_ill = ira->ira_ill;
1407 1408
1408 1409 ire_refrele(alt_ire);
1409 1410 /* Reassemble on the new ill */
1410 1411 ira->ira_ill = ill;
1411 1412 ip_input_local_v4(ire, mp, ipha, ira);
1412 1413 ill_refrele(ill);
1413 1414 /* Restore */
1414 1415 ira->ira_ill = orig_ill;
1415 1416 ira->ira_ruifindex =
1416 1417 orig_ill->ill_phyint->phyint_ifindex;
1417 1418 return;
1418 1419 }
1419 1420 }
1420 1421 ire_refrele(alt_ire);
1421 1422 /* Reassemble on the ill on which the packet arrived */
1422 1423 ip_input_local_v4(ire, mp, ipha, ira);
1423 1424 goto done;
1424 1425 }
1425 1426
1426 1427 /*
1427 1428 * This is a directed broadcast
1428 1429 *
1429 1430 * If directed broadcast is allowed, then forward the packet out
1430 1431 * the destination interface with IXAF_LOOPBACK_COPY set. That will
1431 1432 * result in ip_input() receiving a copy of the packet on the
1432 1433 * appropriate ill. (We could optimize this to avoid the extra trip
1433 1434 * via ip_input(), but since directed broadcasts are normally disabled
1434 1435 * it doesn't make sense to optimize it.)
1435 1436 */
1436 1437 if (!ipst->ips_ip_g_forward_directed_bcast ||
1437 1438 (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST))) {
1438 1439 ip_drop_input("directed broadcast not allowed", mp, ill);
1439 1440 freemsg(mp);
1440 1441 goto done;
1441 1442 }
1442 1443 if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1443 1444 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1444 1445 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1445 1446 freemsg(mp);
1446 1447 goto done;
1447 1448 }
1448 1449
1449 1450 /*
1450 1451 * Clear the indication that this may have hardware
1451 1452 * checksum as we are not using it for forwarding.
1452 1453 */
1453 1454 DB_CKSUMFLAGS(mp) = 0;
1454 1455
1455 1456 /*
1456 1457 * Adjust ttl to 2 (1+1 - the forward engine will decrement it by one.
1457 1458 */
1458 1459 ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl + 1;
1459 1460 ipha->ipha_hdr_checksum = 0;
1460 1461 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1461 1462
1462 1463 /*
1463 1464 * We use ip_forward_xmit to do any fragmentation.
1464 1465 * and loopback copy on the outbound interface.
1465 1466 *
1466 1467 * Make it so that IXAF_LOOPBACK_COPY to be set on transmit side.
1467 1468 */
1468 1469 ira->ira_flags |= IRAF_LOOPBACK_COPY;
1469 1470
1470 1471 nce = arp_nce_init(dst_ill, ipha->ipha_dst, IRE_BROADCAST);
1471 1472 if (nce == NULL) {
1472 1473 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutDiscards);
1473 1474 ip_drop_output("No nce", mp, dst_ill);
1474 1475 freemsg(mp);
1475 1476 goto done;
1476 1477 }
1477 1478
1478 1479 ip_forward_xmit_v4(nce, ill, mp, ipha, ira, dst_ill->ill_mc_mtu, 0);
1479 1480 nce_refrele(nce);
1480 1481 done:
1481 1482 /* Restore */
1482 1483 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1483 1484 }
1484 1485
1485 1486 /*
1486 1487 * ire_recvfn for IRE_MULTICAST.
1487 1488 */
1488 1489 void
1489 1490 ire_recv_multicast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1490 1491 ip_recv_attr_t *ira)
1491 1492 {
1492 1493 ipha_t *ipha = (ipha_t *)iph_arg;
1493 1494 ill_t *ill = ira->ira_ill;
1494 1495 ip_stack_t *ipst = ill->ill_ipst;
1495 1496
1496 1497 ASSERT(ire->ire_ill == ira->ira_ill);
1497 1498
1498 1499 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts);
1499 1500 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets, ira->ira_pktlen);
1500 1501
1501 1502 /* RSVP hook */
1502 1503 if (ira->ira_flags & IRAF_RSVP)
1503 1504 goto forus;
1504 1505
1505 1506 /* Tag for higher-level protocols */
1506 1507 ira->ira_flags |= IRAF_MULTICAST;
1507 1508
1508 1509 /*
1509 1510 * So that we don't end up with dups, only one ill an IPMP group is
1510 1511 * nominated to receive multicast traffic.
1511 1512 * If we have no cast_ill we are liberal and accept everything.
1512 1513 */
1513 1514 if (IS_UNDER_IPMP(ill)) {
1514 1515 ip_stack_t *ipst = ill->ill_ipst;
1515 1516
1516 1517 /* For an under ill_grp can change under lock */
1517 1518 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1518 1519 if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1519 1520 ill->ill_grp->ig_cast_ill != NULL) {
1520 1521 rw_exit(&ipst->ips_ill_g_lock);
1521 1522 ip_drop_input("not on cast ill", mp, ill);
1522 1523 freemsg(mp);
1523 1524 return;
1524 1525 }
1525 1526 rw_exit(&ipst->ips_ill_g_lock);
1526 1527 /*
1527 1528 * We switch to the upper ill so that mrouter and hasmembers
1528 1529 * can operate on upper here and in ip_input_multicast.
1529 1530 */
1530 1531 ill = ipmp_ill_hold_ipmp_ill(ill);
1531 1532 if (ill != NULL) {
1532 1533 ASSERT(ill != ira->ira_ill);
1533 1534 ASSERT(ire->ire_ill == ira->ira_ill);
1534 1535 ira->ira_ill = ill;
1535 1536 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1536 1537 } else {
1537 1538 ill = ira->ira_ill;
1538 1539 }
1539 1540 }
1540 1541
1541 1542 /*
1542 1543 * Check if we are a multicast router - send ip_mforward a copy of
1543 1544 * the packet.
1544 1545 * Due to mroute_decap tunnels we consider forwarding packets even if
1545 1546 * mrouted has not joined the allmulti group on this interface.
1546 1547 */
1547 1548 if (ipst->ips_ip_g_mrouter) {
1548 1549 int retval;
1549 1550
1550 1551 /*
1551 1552 * Clear the indication that this may have hardware
1552 1553 * checksum as we are not using it for forwarding.
1553 1554 */
1554 1555 DB_CKSUMFLAGS(mp) = 0;
1555 1556
1556 1557 /*
1557 1558 * ip_mforward helps us make these distinctions: If received
1558 1559 * on tunnel and not IGMP, then drop.
1559 1560 * If IGMP packet, then don't check membership
1560 1561 * If received on a phyint and IGMP or PIM, then
1561 1562 * don't check membership
1562 1563 */
1563 1564 retval = ip_mforward(mp, ira);
1564 1565 /* ip_mforward updates mib variables if needed */
1565 1566
1566 1567 switch (retval) {
1567 1568 case 0:
1568 1569 /*
1569 1570 * pkt is okay and arrived on phyint.
1570 1571 *
1571 1572 * If we are running as a multicast router
1572 1573 * we need to see all IGMP and/or PIM packets.
1573 1574 */
1574 1575 if ((ipha->ipha_protocol == IPPROTO_IGMP) ||
1575 1576 (ipha->ipha_protocol == IPPROTO_PIM)) {
1576 1577 goto forus;
1577 1578 }
1578 1579 break;
1579 1580 case -1:
1580 1581 /* pkt is mal-formed, toss it */
1581 1582 freemsg(mp);
1582 1583 goto done;
1583 1584 case 1:
1584 1585 /*
1585 1586 * pkt is okay and arrived on a tunnel
1586 1587 *
1587 1588 * If we are running a multicast router
1588 1589 * we need to see all igmp packets.
1589 1590 */
1590 1591 if (ipha->ipha_protocol == IPPROTO_IGMP) {
1591 1592 goto forus;
1592 1593 }
1593 1594 ip_drop_input("Multicast on tunnel ignored", mp, ill);
1594 1595 freemsg(mp);
1595 1596 goto done;
1596 1597 }
1597 1598 }
1598 1599
1599 1600 /*
1600 1601 * Check if we have members on this ill. This is not necessary for
1601 1602 * correctness because even if the NIC/GLD had a leaky filter, we
1602 1603 * filter before passing to each conn_t.
1603 1604 */
1604 1605 if (!ill_hasmembers_v4(ill, ipha->ipha_dst)) {
1605 1606 /*
1606 1607 * Nobody interested
1607 1608 *
1608 1609 * This might just be caused by the fact that
1609 1610 * multiple IP Multicast addresses map to the same
1610 1611 * link layer multicast - no need to increment counter!
1611 1612 */
1612 1613 ip_drop_input("Multicast with no members", mp, ill);
1613 1614 freemsg(mp);
1614 1615 goto done;
1615 1616 }
1616 1617 forus:
1617 1618 ip2dbg(("ire_recv_multicast_v4: multicast for us: 0x%x\n",
1618 1619 ntohl(ipha->ipha_dst)));
1619 1620
1620 1621 /*
1621 1622 * After reassembly and IPsec we will need to duplicate the
1622 1623 * multicast packet for all matching zones on the ill.
1623 1624 */
1624 1625 ira->ira_zoneid = ALL_ZONES;
1625 1626
1626 1627 /* Reassemble on the ill on which the packet arrived */
1627 1628 ip_input_local_v4(ire, mp, ipha, ira);
1628 1629 done:
1629 1630 if (ill != ire->ire_ill) {
1630 1631 ill_refrele(ill);
1631 1632 ira->ira_ill = ire->ire_ill;
1632 1633 ira->ira_ruifindex = ira->ira_ill->ill_phyint->phyint_ifindex;
1633 1634 }
1634 1635 }
1635 1636
1636 1637 /*
1637 1638 * ire_recvfn for IRE_OFFLINK with RTF_MULTIRT.
1638 1639 * Drop packets since we don't forward out multirt routes.
1639 1640 */
1640 1641 /* ARGSUSED */
1641 1642 void
1642 1643 ire_recv_multirt_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1643 1644 {
1644 1645 ill_t *ill = ira->ira_ill;
1645 1646
1646 1647 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1647 1648 ip_drop_input("Not forwarding out MULTIRT", mp, ill);
1648 1649 freemsg(mp);
1649 1650 }
1650 1651
1651 1652 /*
1652 1653 * ire_recvfn for IRE_LOOPBACK. This is only used when a FW_HOOK
1653 1654 * has rewritten the packet to have a loopback destination address (We
1654 1655 * filter out packet with a loopback destination from arriving over the wire).
1655 1656 * We don't know what zone to use, thus we always use the GLOBAL_ZONEID.
1656 1657 */
1657 1658 void
1658 1659 ire_recv_loopback_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1659 1660 {
1660 1661 ipha_t *ipha = (ipha_t *)iph_arg;
1661 1662 ill_t *ill = ira->ira_ill;
1662 1663 ill_t *ire_ill = ire->ire_ill;
1663 1664
1664 1665 ira->ira_zoneid = GLOBAL_ZONEID;
1665 1666
1666 1667 /* Switch to the lo0 ill for further processing */
1667 1668 if (ire_ill != ill) {
1668 1669 /*
1669 1670 * Update ira_ill to be the ILL on which the IP address
1670 1671 * is hosted.
1671 1672 * No need to hold the ill since we have a hold on the ire
1672 1673 */
1673 1674 ASSERT(ira->ira_ill == ira->ira_rill);
1674 1675 ira->ira_ill = ire_ill;
1675 1676
1676 1677 ip_input_local_v4(ire, mp, ipha, ira);
1677 1678
1678 1679 /* Restore */
1679 1680 ASSERT(ira->ira_ill == ire_ill);
1680 1681 ira->ira_ill = ill;
1681 1682 return;
1682 1683
1683 1684 }
1684 1685 ip_input_local_v4(ire, mp, ipha, ira);
1685 1686 }
1686 1687
1687 1688 /*
1688 1689 * ire_recvfn for IRE_LOCAL.
1689 1690 */
1690 1691 void
1691 1692 ire_recv_local_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1692 1693 {
1693 1694 ipha_t *ipha = (ipha_t *)iph_arg;
1694 1695 ill_t *ill = ira->ira_ill;
1695 1696 ill_t *ire_ill = ire->ire_ill;
1696 1697
1697 1698 /* Make a note for DAD that this address is in use */
1698 1699 ire->ire_last_used_time = LBOLT_FASTPATH;
1699 1700
1700 1701 /* Only target the IRE_LOCAL with the right zoneid. */
1701 1702 ira->ira_zoneid = ire->ire_zoneid;
1702 1703
1703 1704 /*
1704 1705 * If the packet arrived on the wrong ill, we check that
1705 1706 * this is ok.
1706 1707 * If it is, then we ensure that we do the reassembly on
1707 1708 * the ill on which the address is hosted. We keep ira_rill as
1708 1709 * the one on which the packet arrived, so that IP_PKTINFO and
1709 1710 * friends can report this.
1710 1711 */
1711 1712 if (ire_ill != ill) {
1712 1713 ire_t *new_ire;
1713 1714
1714 1715 new_ire = ip_check_multihome(&ipha->ipha_dst, ire, ill);
1715 1716 if (new_ire == NULL) {
1716 1717 /* Drop packet */
1717 1718 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1718 1719 ip_drop_input("ipIfStatsInForwProhibits", mp, ill);
1719 1720 freemsg(mp);
1720 1721 return;
1721 1722 }
1722 1723 /*
1723 1724 * Update ira_ill to be the ILL on which the IP address
1724 1725 * is hosted. No need to hold the ill since we have a
1725 1726 * hold on the ire. Note that we do the switch even if
1726 1727 * new_ire == ire (for IPMP, ire would be the one corresponding
1727 1728 * to the IPMP ill).
1728 1729 */
1729 1730 ASSERT(ira->ira_ill == ira->ira_rill);
1730 1731 ira->ira_ill = new_ire->ire_ill;
1731 1732
1732 1733 /* ira_ruifindex tracks the upper for ira_rill */
1733 1734 if (IS_UNDER_IPMP(ill))
1734 1735 ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1735 1736
1736 1737 ip_input_local_v4(new_ire, mp, ipha, ira);
1737 1738
1738 1739 /* Restore */
1739 1740 ASSERT(ira->ira_ill == new_ire->ire_ill);
1740 1741 ira->ira_ill = ill;
1741 1742 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1742 1743
1743 1744 if (new_ire != ire)
1744 1745 ire_refrele(new_ire);
1745 1746 return;
1746 1747 }
1747 1748
1748 1749 ip_input_local_v4(ire, mp, ipha, ira);
1749 1750 }
1750 1751
1751 1752 /*
1752 1753 * Common function for packets arriving for the host. Handles
1753 1754 * checksum verification, reassembly checks, etc.
1754 1755 */
1755 1756 static void
1756 1757 ip_input_local_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1757 1758 {
1758 1759 ill_t *ill = ira->ira_ill;
1759 1760 iaflags_t iraflags = ira->ira_flags;
1760 1761
1761 1762 /*
1762 1763 * Verify IP header checksum. If the packet was AH or ESP then
1763 1764 * this flag has already been cleared. Likewise if the packet
1764 1765 * had a hardware checksum.
1765 1766 */
1766 1767 if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1767 1768 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1768 1769 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1769 1770 freemsg(mp);
1770 1771 return;
1771 1772 }
1772 1773
1773 1774 if (iraflags & IRAF_IPV4_OPTIONS) {
1774 1775 if (!ip_input_local_options(mp, ipha, ira)) {
1775 1776 /* Error has been sent and mp consumed */
1776 1777 return;
1777 1778 }
1778 1779 /*
1779 1780 * Some old hardware does partial checksum by including the
1780 1781 * whole IP header, so the partial checksum value might have
1781 1782 * become invalid if any option in the packet have been
1782 1783 * updated. Always clear partial checksum flag here.
1783 1784 */
1784 1785 DB_CKSUMFLAGS(mp) &= ~HCK_PARTIALCKSUM;
1785 1786 }
1786 1787
1787 1788 /*
1788 1789 * Is packet part of fragmented IP packet?
1789 1790 * We compare against defined values in network byte order
1790 1791 */
1791 1792 if (ipha->ipha_fragment_offset_and_flags &
1792 1793 (IPH_MF_HTONS | IPH_OFFSET_HTONS)) {
1793 1794 /*
1794 1795 * Make sure we have ira_l2src before we loose the original
1795 1796 * mblk
1796 1797 */
1797 1798 if (!(ira->ira_flags & IRAF_L2SRC_SET))
1798 1799 ip_setl2src(mp, ira, ira->ira_rill);
1799 1800
1800 1801 mp = ip_input_fragment(mp, ipha, ira);
1801 1802 if (mp == NULL)
1802 1803 return;
1803 1804 /* Completed reassembly */
1804 1805 ipha = (ipha_t *)mp->b_rptr;
1805 1806 }
1806 1807
1807 1808 /*
1808 1809 * For broadcast and multicast we need some extra work before
1809 1810 * we call ip_fanout_v4(), since in the case of shared-IP zones
1810 1811 * we need to pretend that a packet arrived for each zoneid.
1811 1812 */
1812 1813 if (iraflags & IRAF_MULTIBROADCAST) {
1813 1814 if (iraflags & IRAF_BROADCAST)
1814 1815 ip_input_broadcast_v4(ire, mp, ipha, ira);
1815 1816 else
1816 1817 ip_input_multicast_v4(ire, mp, ipha, ira);
1817 1818 return;
1818 1819 }
1819 1820 ip_fanout_v4(mp, ipha, ira);
1820 1821 }
1821 1822
1822 1823
1823 1824 /*
1824 1825 * Handle multiple zones which match the same broadcast address
1825 1826 * and ill by delivering a packet to each of them.
1826 1827 * Walk the bucket and look for different ire_zoneid but otherwise
1827 1828 * the same IRE (same ill/addr/mask/type).
1828 1829 * Note that ire_add() tracks IREs that are identical in all
1829 1830 * fields (addr/mask/type/gw/ill/zoneid) within a single IRE by
1830 1831 * increasing ire_identical_cnt. Thus we don't need to be concerned
1831 1832 * about those.
1832 1833 */
1833 1834 static void
1834 1835 ip_input_broadcast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1835 1836 {
1836 1837 ill_t *ill = ira->ira_ill;
1837 1838 ip_stack_t *ipst = ill->ill_ipst;
1838 1839 netstack_t *ns = ipst->ips_netstack;
1839 1840 irb_t *irb;
1840 1841 ire_t *ire1;
1841 1842 mblk_t *mp1;
1842 1843 ipha_t *ipha1;
1843 1844 uint_t ira_pktlen = ira->ira_pktlen;
1844 1845 uint16_t ira_ip_hdr_length = ira->ira_ip_hdr_length;
1845 1846
1846 1847 irb = ire->ire_bucket;
1847 1848
1848 1849 /*
1849 1850 * If we don't have more than one shared-IP zone, or if
1850 1851 * there can't be more than one IRE_BROADCAST for this
1851 1852 * IP address, then just set the zoneid and proceed.
1852 1853 */
1853 1854 if (ns->netstack_numzones == 1 || irb->irb_ire_cnt == 1) {
1854 1855 ira->ira_zoneid = ire->ire_zoneid;
1855 1856
1856 1857 ip_fanout_v4(mp, ipha, ira);
1857 1858 return;
1858 1859 }
1859 1860 irb_refhold(irb);
1860 1861 for (ire1 = irb->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
1861 1862 /* We do the main IRE after the end of the loop */
1862 1863 if (ire1 == ire)
1863 1864 continue;
1864 1865
1865 1866 /*
1866 1867 * Only IREs for the same IP address should be in the same
1867 1868 * bucket.
1868 1869 * But could have IRE_HOSTs in the case of CGTP.
1869 1870 */
1870 1871 ASSERT(ire1->ire_addr == ire->ire_addr);
1871 1872 if (!(ire1->ire_type & IRE_BROADCAST))
1872 1873 continue;
1873 1874
1874 1875 if (IRE_IS_CONDEMNED(ire1))
1875 1876 continue;
1876 1877
1877 1878 mp1 = copymsg(mp);
1878 1879 if (mp1 == NULL) {
1879 1880 /* Failed to deliver to one zone */
1880 1881 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1881 1882 ip_drop_input("ipIfStatsInDiscards", mp, ill);
1882 1883 continue;
1883 1884 }
1884 1885 ira->ira_zoneid = ire1->ire_zoneid;
1885 1886 ipha1 = (ipha_t *)mp1->b_rptr;
1886 1887 ip_fanout_v4(mp1, ipha1, ira);
1887 1888 /*
1888 1889 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1889 1890 * so we restore them for a potential next iteration
1890 1891 */
1891 1892 ira->ira_pktlen = ira_pktlen;
1892 1893 ira->ira_ip_hdr_length = ira_ip_hdr_length;
1893 1894 }
1894 1895 irb_refrele(irb);
1895 1896 /* Do the main ire */
1896 1897 ira->ira_zoneid = ire->ire_zoneid;
1897 1898 ip_fanout_v4(mp, ipha, ira);
1898 1899 }
1899 1900
1900 1901 /*
1901 1902 * Handle multiple zones which want to receive the same multicast packets
1902 1903 * on this ill by delivering a packet to each of them.
1903 1904 *
1904 1905 * Note that for packets delivered to transports we could instead do this
1905 1906 * as part of the fanout code, but since we need to handle icmp_inbound
1906 1907 * it is simpler to have multicast work the same as broadcast.
1907 1908 *
1908 1909 * The ip_fanout matching for multicast matches based on ilm independent of
1909 1910 * zoneid since the zoneid restriction is applied when joining a multicast
1910 1911 * group.
1911 1912 */
1912 1913 /* ARGSUSED */
1913 1914 static void
1914 1915 ip_input_multicast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1915 1916 {
1916 1917 ill_t *ill = ira->ira_ill;
1917 1918 iaflags_t iraflags = ira->ira_flags;
1918 1919 ip_stack_t *ipst = ill->ill_ipst;
1919 1920 netstack_t *ns = ipst->ips_netstack;
1920 1921 zoneid_t zoneid;
1921 1922 mblk_t *mp1;
1922 1923 ipha_t *ipha1;
1923 1924 uint_t ira_pktlen = ira->ira_pktlen;
1924 1925 uint16_t ira_ip_hdr_length = ira->ira_ip_hdr_length;
1925 1926
1926 1927 /* ire_recv_multicast has switched to the upper ill for IPMP */
1927 1928 ASSERT(!IS_UNDER_IPMP(ill));
1928 1929
1929 1930 /*
1930 1931 * If we don't have more than one shared-IP zone, or if
1931 1932 * there are no members in anything but the global zone,
1932 1933 * then just set the zoneid and proceed.
1933 1934 */
1934 1935 if (ns->netstack_numzones == 1 ||
1935 1936 !ill_hasmembers_otherzones_v4(ill, ipha->ipha_dst,
1936 1937 GLOBAL_ZONEID)) {
1937 1938 ira->ira_zoneid = GLOBAL_ZONEID;
1938 1939
1939 1940 /* If sender didn't want this zone to receive it, drop */
1940 1941 if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1941 1942 ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1942 1943 ip_drop_input("Multicast but wrong zoneid", mp, ill);
1943 1944 freemsg(mp);
1944 1945 return;
1945 1946 }
1946 1947 ip_fanout_v4(mp, ipha, ira);
1947 1948 return;
1948 1949 }
1949 1950
1950 1951 /*
1951 1952 * Here we loop over all zoneids that have members in the group
1952 1953 * and deliver a packet to ip_fanout for each zoneid.
1953 1954 *
1954 1955 * First find any members in the lowest numeric zoneid by looking for
1955 1956 * first zoneid larger than -1 (ALL_ZONES).
1956 1957 * We terminate the loop when we receive -1 (ALL_ZONES).
1957 1958 */
1958 1959 zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, ALL_ZONES);
1959 1960 for (; zoneid != ALL_ZONES;
1960 1961 zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, zoneid)) {
1961 1962 /*
1962 1963 * Avoid an extra copymsg/freemsg by skipping global zone here
1963 1964 * and doing that at the end.
1964 1965 */
1965 1966 if (zoneid == GLOBAL_ZONEID)
1966 1967 continue;
1967 1968
1968 1969 ira->ira_zoneid = zoneid;
1969 1970
1970 1971 /* If sender didn't want this zone to receive it, skip */
1971 1972 if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1972 1973 ira->ira_no_loop_zoneid == ira->ira_zoneid)
1973 1974 continue;
1974 1975
1975 1976 mp1 = copymsg(mp);
1976 1977 if (mp1 == NULL) {
1977 1978 /* Failed to deliver to one zone */
1978 1979 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1979 1980 ip_drop_input("ipIfStatsInDiscards", mp, ill);
1980 1981 continue;
1981 1982 }
1982 1983 ipha1 = (ipha_t *)mp1->b_rptr;
1983 1984 ip_fanout_v4(mp1, ipha1, ira);
1984 1985 /*
1985 1986 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1986 1987 * so we restore them for a potential next iteration
1987 1988 */
1988 1989 ira->ira_pktlen = ira_pktlen;
1989 1990 ira->ira_ip_hdr_length = ira_ip_hdr_length;
1990 1991 }
1991 1992
1992 1993 /* Do the main ire */
1993 1994 ira->ira_zoneid = GLOBAL_ZONEID;
1994 1995 /* If sender didn't want this zone to receive it, drop */
1995 1996 if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1996 1997 ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1997 1998 ip_drop_input("Multicast but wrong zoneid", mp, ill);
1998 1999 freemsg(mp);
1999 2000 } else {
2000 2001 ip_fanout_v4(mp, ipha, ira);
2001 2002 }
2002 2003 }
2003 2004
2004 2005
2005 2006 /*
2006 2007 * Determine the zoneid and IRAF_TX_* flags if trusted extensions
2007 2008 * is in use. Updates ira_zoneid and ira_flags as a result.
2008 2009 */
2009 2010 static void
2010 2011 ip_fanout_tx_v4(mblk_t *mp, ipha_t *ipha, uint8_t protocol,
2011 2012 uint_t ip_hdr_length, ip_recv_attr_t *ira)
2012 2013 {
2013 2014 uint16_t *up;
2014 2015 uint16_t lport;
2015 2016 zoneid_t zoneid;
2016 2017
2017 2018 ASSERT(ira->ira_flags & IRAF_SYSTEM_LABELED);
2018 2019
2019 2020 /*
2020 2021 * If the packet is unlabeled we might allow read-down
2021 2022 * for MAC_EXEMPT. Below we clear this if it is a multi-level
2022 2023 * port (MLP).
2023 2024 * Note that ira_tsl can be NULL here.
2024 2025 */
2025 2026 if (ira->ira_tsl != NULL && ira->ira_tsl->tsl_flags & TSLF_UNLABELED)
2026 2027 ira->ira_flags |= IRAF_TX_MAC_EXEMPTABLE;
2027 2028
2028 2029 if (ira->ira_zoneid != ALL_ZONES)
2029 2030 return;
2030 2031
2031 2032 ira->ira_flags |= IRAF_TX_SHARED_ADDR;
2032 2033
2033 2034 up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2034 2035 switch (protocol) {
2035 2036 case IPPROTO_TCP:
2036 2037 case IPPROTO_SCTP:
2037 2038 case IPPROTO_UDP:
2038 2039 /* Caller ensures this */
2039 2040 ASSERT(((uchar_t *)ipha) + ip_hdr_length +4 <= mp->b_wptr);
2040 2041
2041 2042 /*
2042 2043 * Only these transports support MLP.
2043 2044 * We know their destination port numbers is in
2044 2045 * the same place in the header.
2045 2046 */
2046 2047 lport = up[1];
2047 2048
2048 2049 /*
2049 2050 * No need to handle exclusive-stack zones
2050 2051 * since ALL_ZONES only applies to the shared IP instance.
2051 2052 */
2052 2053 zoneid = tsol_mlp_findzone(protocol, lport);
2053 2054 /*
2054 2055 * If no shared MLP is found, tsol_mlp_findzone returns
2055 2056 * ALL_ZONES. In that case, we assume it's SLP, and
2056 2057 * search for the zone based on the packet label.
2057 2058 *
2058 2059 * If there is such a zone, we prefer to find a
2059 2060 * connection in it. Otherwise, we look for a
2060 2061 * MAC-exempt connection in any zone whose label
2061 2062 * dominates the default label on the packet.
2062 2063 */
2063 2064 if (zoneid == ALL_ZONES)
2064 2065 zoneid = tsol_attr_to_zoneid(ira);
2065 2066 else
2066 2067 ira->ira_flags &= ~IRAF_TX_MAC_EXEMPTABLE;
2067 2068 break;
2068 2069 default:
2069 2070 /* Handle shared address for other protocols */
2070 2071 zoneid = tsol_attr_to_zoneid(ira);
2071 2072 break;
2072 2073 }
2073 2074 ira->ira_zoneid = zoneid;
2074 2075 }
2075 2076
2076 2077 /*
2077 2078 * Increment checksum failure statistics
2078 2079 */
2079 2080 static void
2080 2081 ip_input_cksum_err_v4(uint8_t protocol, uint16_t hck_flags, ill_t *ill)
2081 2082 {
2082 2083 ip_stack_t *ipst = ill->ill_ipst;
2083 2084
2084 2085 switch (protocol) {
2085 2086 case IPPROTO_TCP:
2086 2087 BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs);
2087 2088
2088 2089 if (hck_flags & HCK_FULLCKSUM)
2089 2090 IP_STAT(ipst, ip_tcp_in_full_hw_cksum_err);
2090 2091 else if (hck_flags & HCK_PARTIALCKSUM)
2091 2092 IP_STAT(ipst, ip_tcp_in_part_hw_cksum_err);
2092 2093 else
2093 2094 IP_STAT(ipst, ip_tcp_in_sw_cksum_err);
2094 2095 break;
2095 2096 case IPPROTO_UDP:
2096 2097 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInCksumErrs);
2097 2098 if (hck_flags & HCK_FULLCKSUM)
2098 2099 IP_STAT(ipst, ip_udp_in_full_hw_cksum_err);
2099 2100 else if (hck_flags & HCK_PARTIALCKSUM)
2100 2101 IP_STAT(ipst, ip_udp_in_part_hw_cksum_err);
2101 2102 else
2102 2103 IP_STAT(ipst, ip_udp_in_sw_cksum_err);
2103 2104 break;
2104 2105 case IPPROTO_ICMP:
2105 2106 BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2106 2107 break;
2107 2108 default:
2108 2109 ASSERT(0);
2109 2110 break;
2110 2111 }
2111 2112 }
2112 2113
2113 2114 /* Calculate the IPv4 pseudo-header checksum */
2114 2115 uint32_t
2115 2116 ip_input_cksum_pseudo_v4(ipha_t *ipha, ip_recv_attr_t *ira)
2116 2117 {
2117 2118 uint_t ulp_len;
2118 2119 uint32_t cksum;
2119 2120 uint8_t protocol = ira->ira_protocol;
2120 2121 uint16_t ip_hdr_length = ira->ira_ip_hdr_length;
2121 2122
2122 2123 #define iphs ((uint16_t *)ipha)
2123 2124
2124 2125 switch (protocol) {
2125 2126 case IPPROTO_TCP:
2126 2127 ulp_len = ira->ira_pktlen - ip_hdr_length;
2127 2128
2128 2129 /* Protocol and length */
2129 2130 cksum = htons(ulp_len) + IP_TCP_CSUM_COMP;
2130 2131 /* IP addresses */
2131 2132 cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2132 2133 break;
2133 2134
2134 2135 case IPPROTO_UDP: {
2135 2136 udpha_t *udpha;
2136 2137
2137 2138 udpha = (udpha_t *)((uchar_t *)ipha + ip_hdr_length);
2138 2139
2139 2140 /* Protocol and length */
2140 2141 cksum = udpha->uha_length + IP_UDP_CSUM_COMP;
2141 2142 /* IP addresses */
2142 2143 cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2143 2144 break;
2144 2145 }
2145 2146
2146 2147 default:
2147 2148 cksum = 0;
2148 2149 break;
2149 2150 }
2150 2151 #undef iphs
2151 2152 return (cksum);
2152 2153 }
2153 2154
2154 2155
2155 2156 /*
2156 2157 * Software verification of the ULP checksums.
2157 2158 * Returns B_TRUE if ok.
2158 2159 * Increments statistics of failed.
2159 2160 */
2160 2161 static boolean_t
2161 2162 ip_input_sw_cksum_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2162 2163 {
2163 2164 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2164 2165 uint32_t cksum;
2165 2166 uint8_t protocol = ira->ira_protocol;
2166 2167 uint16_t ip_hdr_length = ira->ira_ip_hdr_length;
2167 2168
2168 2169 IP_STAT(ipst, ip_in_sw_cksum);
2169 2170
2170 2171 ASSERT(protocol == IPPROTO_TCP || protocol == IPPROTO_UDP);
2171 2172
2172 2173 cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2173 2174 cksum = IP_CSUM(mp, ip_hdr_length, cksum);
2174 2175 if (cksum == 0)
2175 2176 return (B_TRUE);
2176 2177
2177 2178 ip_input_cksum_err_v4(protocol, 0, ira->ira_ill);
2178 2179 return (B_FALSE);
2179 2180 }
2180 2181
2181 2182 /*
2182 2183 * Verify the ULP checksums.
2183 2184 * Returns B_TRUE if ok, or if the ULP doesn't have a well-defined checksum
2184 2185 * algorithm.
2185 2186 * Increments statistics if failed.
2186 2187 */
2187 2188 static boolean_t
2188 2189 ip_input_cksum_v4(iaflags_t iraflags, mblk_t *mp, ipha_t *ipha,
2189 2190 ip_recv_attr_t *ira)
2190 2191 {
2191 2192 ill_t *ill = ira->ira_rill;
2192 2193 uint16_t hck_flags;
2193 2194 uint32_t cksum;
2194 2195 mblk_t *mp1;
2195 2196 int32_t len;
2196 2197 uint8_t protocol = ira->ira_protocol;
2197 2198 uint16_t ip_hdr_length = ira->ira_ip_hdr_length;
2198 2199
2199 2200
2200 2201 switch (protocol) {
2201 2202 case IPPROTO_TCP:
2202 2203 break;
2203 2204
2204 2205 case IPPROTO_UDP: {
2205 2206 udpha_t *udpha;
2206 2207
2207 2208 udpha = (udpha_t *)((uchar_t *)ipha + ip_hdr_length);
2208 2209 if (udpha->uha_checksum == 0) {
2209 2210 /* Packet doesn't have a UDP checksum */
2210 2211 return (B_TRUE);
2211 2212 }
2212 2213 break;
2213 2214 }
2214 2215 case IPPROTO_SCTP: {
2215 2216 sctp_hdr_t *sctph;
2216 2217 uint32_t pktsum;
2217 2218
2218 2219 sctph = (sctp_hdr_t *)((uchar_t *)ipha + ip_hdr_length);
2219 2220 #ifdef DEBUG
2220 2221 if (skip_sctp_cksum)
2221 2222 return (B_TRUE);
2222 2223 #endif
2223 2224 pktsum = sctph->sh_chksum;
2224 2225 sctph->sh_chksum = 0;
2225 2226 cksum = sctp_cksum(mp, ip_hdr_length);
2226 2227 sctph->sh_chksum = pktsum;
2227 2228 if (cksum == pktsum)
2228 2229 return (B_TRUE);
2229 2230
2230 2231 /*
2231 2232 * Defer until later whether a bad checksum is ok
2232 2233 * in order to allow RAW sockets to use Adler checksum
2233 2234 * with SCTP.
2234 2235 */
2235 2236 ira->ira_flags |= IRAF_SCTP_CSUM_ERR;
2236 2237 return (B_TRUE);
2237 2238 }
2238 2239
2239 2240 default:
2240 2241 /* No ULP checksum to verify. */
2241 2242 return (B_TRUE);
2242 2243 }
2243 2244 /*
2244 2245 * Revert to software checksum calculation if the interface
2245 2246 * isn't capable of checksum offload.
2246 2247 * We clear DB_CKSUMFLAGS when going through IPsec in ip_fanout.
2247 2248 * Note: IRAF_NO_HW_CKSUM is not currently used.
2248 2249 */
2249 2250 ASSERT(!IS_IPMP(ill));
2250 2251 if ((iraflags & IRAF_NO_HW_CKSUM) || !ILL_HCKSUM_CAPABLE(ill) ||
2251 2252 !dohwcksum) {
2252 2253 return (ip_input_sw_cksum_v4(mp, ipha, ira));
2253 2254 }
2254 2255
2255 2256 /*
2256 2257 * We apply this for all ULP protocols. Does the HW know to
2257 2258 * not set the flags for SCTP and other protocols.
2258 2259 */
2259 2260
2260 2261 hck_flags = DB_CKSUMFLAGS(mp);
2261 2262
2262 2263 if (hck_flags & HCK_FULLCKSUM_OK) {
2263 2264 /*
2264 2265 * Hardware has already verified the checksum.
2265 2266 */
2266 2267 return (B_TRUE);
2267 2268 }
2268 2269
2269 2270 if (hck_flags & HCK_FULLCKSUM) {
2270 2271 /*
2271 2272 * Full checksum has been computed by the hardware
2272 2273 * and has been attached. If the driver wants us to
2273 2274 * verify the correctness of the attached value, in
2274 2275 * order to protect against faulty hardware, compare
2275 2276 * it against -0 (0xFFFF) to see if it's valid.
2276 2277 */
2277 2278 cksum = DB_CKSUM16(mp);
2278 2279 if (cksum == 0xFFFF)
2279 2280 return (B_TRUE);
2280 2281 ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2281 2282 return (B_FALSE);
2282 2283 }
2283 2284
2284 2285 mp1 = mp->b_cont;
2285 2286 if ((hck_flags & HCK_PARTIALCKSUM) &&
2286 2287 (mp1 == NULL || mp1->b_cont == NULL) &&
2287 2288 ip_hdr_length >= DB_CKSUMSTART(mp) &&
2288 2289 ((len = ip_hdr_length - DB_CKSUMSTART(mp)) & 1) == 0) {
2289 2290 uint32_t adj;
2290 2291 uchar_t *cksum_start;
2291 2292
2292 2293 cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2293 2294
2294 2295 cksum_start = ((uchar_t *)ipha + DB_CKSUMSTART(mp));
2295 2296
2296 2297 /*
2297 2298 * Partial checksum has been calculated by hardware
2298 2299 * and attached to the packet; in addition, any
2299 2300 * prepended extraneous data is even byte aligned,
2300 2301 * and there are at most two mblks associated with
2301 2302 * the packet. If any such data exists, we adjust
2302 2303 * the checksum; also take care any postpended data.
2303 2304 */
2304 2305 IP_ADJCKSUM_PARTIAL(cksum_start, mp, mp1, len, adj);
2305 2306 /*
2306 2307 * One's complement subtract extraneous checksum
2307 2308 */
2308 2309 cksum += DB_CKSUM16(mp);
2309 2310 if (adj >= cksum)
2310 2311 cksum = ~(adj - cksum) & 0xFFFF;
2311 2312 else
2312 2313 cksum -= adj;
2313 2314 cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2314 2315 cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2315 2316 if (!(~cksum & 0xFFFF))
2316 2317 return (B_TRUE);
2317 2318
2318 2319 ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2319 2320 return (B_FALSE);
2320 2321 }
2321 2322 return (ip_input_sw_cksum_v4(mp, ipha, ira));
2322 2323 }
2323 2324
2324 2325
2325 2326 /*
2326 2327 * Handle fanout of received packets.
2327 2328 * Unicast packets that are looped back (from ire_send_local_v4) and packets
2328 2329 * from the wire are differentiated by checking IRAF_VERIFY_ULP_CKSUM.
2329 2330 *
2330 2331 * IPQoS Notes
2331 2332 * Before sending it to the client, invoke IPPF processing. Policy processing
2332 2333 * takes place only if the callout_position, IPP_LOCAL_IN, is enabled.
2333 2334 */
2334 2335 void
2335 2336 ip_fanout_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2336 2337 {
2337 2338 ill_t *ill = ira->ira_ill;
2338 2339 iaflags_t iraflags = ira->ira_flags;
2339 2340 ip_stack_t *ipst = ill->ill_ipst;
2340 2341 uint8_t protocol = ipha->ipha_protocol;
2341 2342 conn_t *connp;
2342 2343 #define rptr ((uchar_t *)ipha)
2343 2344 uint_t ip_hdr_length;
2344 2345 uint_t min_ulp_header_length;
2345 2346 int offset;
2346 2347 ssize_t len;
2347 2348 netstack_t *ns = ipst->ips_netstack;
2348 2349 ipsec_stack_t *ipss = ns->netstack_ipsec;
2349 2350 ill_t *rill = ira->ira_rill;
2350 2351
2351 2352 ASSERT(ira->ira_pktlen == ntohs(ipha->ipha_length));
2352 2353
2353 2354 ip_hdr_length = ira->ira_ip_hdr_length;
2354 2355 ira->ira_protocol = protocol;
2355 2356
2356 2357 /*
2357 2358 * Time for IPP once we've done reassembly and IPsec.
2358 2359 * We skip this for loopback packets since we don't do IPQoS
2359 2360 * on loopback.
2360 2361 */
2361 2362 if (IPP_ENABLED(IPP_LOCAL_IN, ipst) &&
2362 2363 !(iraflags & IRAF_LOOPBACK) &&
2363 2364 (protocol != IPPROTO_ESP || protocol != IPPROTO_AH)) {
2364 2365 /*
2365 2366 * Use the interface on which the packet arrived - not where
2366 2367 * the IP address is hosted.
2367 2368 */
2368 2369 /* ip_process translates an IS_UNDER_IPMP */
2369 2370 mp = ip_process(IPP_LOCAL_IN, mp, rill, ill);
2370 2371 if (mp == NULL) {
2371 2372 /* ip_drop_packet and MIB done */
2372 2373 return;
2373 2374 }
2374 2375 }
2375 2376
2376 2377 /* Determine the minimum required size of the upper-layer header */
2377 2378 /* Need to do this for at least the set of ULPs that TX handles. */
2378 2379 switch (protocol) {
2379 2380 case IPPROTO_TCP:
2380 2381 min_ulp_header_length = TCP_MIN_HEADER_LENGTH;
2381 2382 break;
2382 2383 case IPPROTO_SCTP:
2383 2384 min_ulp_header_length = SCTP_COMMON_HDR_LENGTH;
2384 2385 break;
2385 2386 case IPPROTO_UDP:
2386 2387 min_ulp_header_length = UDPH_SIZE;
2387 2388 break;
2388 2389 case IPPROTO_ICMP:
2389 2390 min_ulp_header_length = ICMPH_SIZE;
2390 2391 break;
2391 2392 default:
2392 2393 min_ulp_header_length = 0;
2393 2394 break;
2394 2395 }
2395 2396 /* Make sure we have the min ULP header length */
2396 2397 len = mp->b_wptr - rptr;
2397 2398 if (len < ip_hdr_length + min_ulp_header_length) {
2398 2399 if (ira->ira_pktlen < ip_hdr_length + min_ulp_header_length) {
2399 2400 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2400 2401 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2401 2402 freemsg(mp);
2402 2403 return;
2403 2404 }
2404 2405 IP_STAT(ipst, ip_recv_pullup);
2405 2406 ipha = ip_pullup(mp, ip_hdr_length + min_ulp_header_length,
2406 2407 ira);
2407 2408 if (ipha == NULL)
2408 2409 goto discard;
2409 2410 len = mp->b_wptr - rptr;
2410 2411 }
2411 2412
2412 2413 /*
2413 2414 * If trusted extensions then determine the zoneid and TX specific
2414 2415 * ira_flags.
2415 2416 */
2416 2417 if (iraflags & IRAF_SYSTEM_LABELED) {
2417 2418 /* This can update ira->ira_flags and ira->ira_zoneid */
2418 2419 ip_fanout_tx_v4(mp, ipha, protocol, ip_hdr_length, ira);
2419 2420 iraflags = ira->ira_flags;
2420 2421 }
2421 2422
2422 2423
2423 2424 /* Verify ULP checksum. Handles TCP, UDP, and SCTP */
2424 2425 if (iraflags & IRAF_VERIFY_ULP_CKSUM) {
2425 2426 if (!ip_input_cksum_v4(iraflags, mp, ipha, ira)) {
2426 2427 /* Bad checksum. Stats are already incremented */
2427 2428 ip_drop_input("Bad ULP checksum", mp, ill);
2428 2429 freemsg(mp);
2429 2430 return;
2430 2431 }
2431 2432 /* IRAF_SCTP_CSUM_ERR could have been set */
2432 2433 iraflags = ira->ira_flags;
2433 2434 }
2434 2435 switch (protocol) {
2435 2436 case IPPROTO_TCP:
2436 2437 /* For TCP, discard broadcast and multicast packets. */
2437 2438 if (iraflags & IRAF_MULTIBROADCAST)
2438 2439 goto discard;
2439 2440
2440 2441 /* First mblk contains IP+TCP headers per above check */
2441 2442 ASSERT(len >= ip_hdr_length + TCP_MIN_HEADER_LENGTH);
2442 2443
2443 2444 /* TCP options present? */
2444 2445 offset = ((uchar_t *)ipha)[ip_hdr_length + 12] >> 4;
2445 2446 if (offset != 5) {
2446 2447 if (offset < 5)
2447 2448 goto discard;
2448 2449
2449 2450 /*
2450 2451 * There must be TCP options.
2451 2452 * Make sure we can grab them.
2452 2453 */
2453 2454 offset <<= 2;
2454 2455 offset += ip_hdr_length;
2455 2456 if (len < offset) {
2456 2457 if (ira->ira_pktlen < offset) {
2457 2458 BUMP_MIB(ill->ill_ip_mib,
2458 2459 ipIfStatsInTruncatedPkts);
2459 2460 ip_drop_input(
2460 2461 "ipIfStatsInTruncatedPkts",
2461 2462 mp, ill);
2462 2463 freemsg(mp);
2463 2464 return;
2464 2465 }
2465 2466 IP_STAT(ipst, ip_recv_pullup);
2466 2467 ipha = ip_pullup(mp, offset, ira);
2467 2468 if (ipha == NULL)
2468 2469 goto discard;
2469 2470 len = mp->b_wptr - rptr;
2470 2471 }
2471 2472 }
2472 2473
2473 2474 /*
2474 2475 * Pass up a squeue hint to tcp.
2475 2476 * If ira_sqp is already set (this is loopback) we leave it
2476 2477 * alone.
2477 2478 */
2478 2479 if (ira->ira_sqp == NULL) {
2479 2480 ira->ira_sqp = ip_squeue_get(ira->ira_ring);
2480 2481 }
2481 2482
2482 2483 /* Look for AF_INET or AF_INET6 that matches */
2483 2484 connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_length,
2484 2485 ira, ipst);
2485 2486 if (connp == NULL) {
2486 2487 /* Send the TH_RST */
2487 2488 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2488 2489 tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2489 2490 return;
2490 2491 }
2491 2492 if (connp->conn_incoming_ifindex != 0 &&
2492 2493 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2493 2494 CONN_DEC_REF(connp);
2494 2495
2495 2496 /* Send the TH_RST */
2496 2497 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2497 2498 tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2498 2499 return;
2499 2500 }
2500 2501 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2501 2502 (iraflags & IRAF_IPSEC_SECURE)) {
2502 2503 mp = ipsec_check_inbound_policy(mp, connp,
2503 2504 ipha, NULL, ira);
2504 2505 if (mp == NULL) {
2505 2506 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2506 2507 /* Note that mp is NULL */
2507 2508 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2508 2509 CONN_DEC_REF(connp);
2509 2510 return;
2510 2511 }
2511 2512 }
2512 2513 /* Found a client; up it goes */
2513 2514 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2514 2515 ira->ira_ill = ira->ira_rill = NULL;
2515 2516 if (!IPCL_IS_TCP(connp)) {
2516 2517 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2517 2518 (connp->conn_recv)(connp, mp, NULL, ira);
2518 2519 CONN_DEC_REF(connp);
2519 2520 ira->ira_ill = ill;
2520 2521 ira->ira_rill = rill;
2521 2522 return;
2522 2523 }
2523 2524
2524 2525 /*
2525 2526 * We do different processing whether called from
2526 2527 * ip_accept_tcp and we match the target, don't match
2527 2528 * the target, and when we are called by ip_input.
2528 2529 */
2529 2530 if (iraflags & IRAF_TARGET_SQP) {
2530 2531 if (ira->ira_target_sqp == connp->conn_sqp) {
2531 2532 mblk_t *attrmp;
2532 2533
2533 2534 attrmp = ip_recv_attr_to_mblk(ira);
2534 2535 if (attrmp == NULL) {
2535 2536 BUMP_MIB(ill->ill_ip_mib,
2536 2537 ipIfStatsInDiscards);
2537 2538 ip_drop_input("ipIfStatsInDiscards",
2538 2539 mp, ill);
2539 2540 freemsg(mp);
2540 2541 CONN_DEC_REF(connp);
2541 2542 } else {
2542 2543 SET_SQUEUE(attrmp, connp->conn_recv,
2543 2544 connp);
2544 2545 attrmp->b_cont = mp;
2545 2546 ASSERT(ira->ira_target_sqp_mp == NULL);
2546 2547 ira->ira_target_sqp_mp = attrmp;
2547 2548 /*
2548 2549 * Conn ref release when drained from
2549 2550 * the squeue.
2550 2551 */
2551 2552 }
2552 2553 } else {
2553 2554 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2554 2555 connp->conn_recv, connp, ira, SQ_FILL,
2555 2556 SQTAG_IP_TCP_INPUT);
2556 2557 }
2557 2558 } else {
2558 2559 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv,
2559 2560 connp, ira, ip_squeue_flag, SQTAG_IP_TCP_INPUT);
2560 2561 }
2561 2562 ira->ira_ill = ill;
2562 2563 ira->ira_rill = rill;
2563 2564 return;
2564 2565
2565 2566 case IPPROTO_SCTP: {
2566 2567 sctp_hdr_t *sctph;
2567 2568 in6_addr_t map_src, map_dst;
2568 2569 uint32_t ports; /* Source and destination ports */
2569 2570 sctp_stack_t *sctps = ipst->ips_netstack->netstack_sctp;
2570 2571
2571 2572 /* For SCTP, discard broadcast and multicast packets. */
2572 2573 if (iraflags & IRAF_MULTIBROADCAST)
2573 2574 goto discard;
2574 2575
2575 2576 /*
2576 2577 * Since there is no SCTP h/w cksum support yet, just
2577 2578 * clear the flag.
2578 2579 */
2579 2580 DB_CKSUMFLAGS(mp) = 0;
2580 2581
2581 2582 /* Length ensured above */
2582 2583 ASSERT(MBLKL(mp) >= ip_hdr_length + SCTP_COMMON_HDR_LENGTH);
2583 2584 sctph = (sctp_hdr_t *)(rptr + ip_hdr_length);
2584 2585
2585 2586 /* get the ports */
2586 2587 ports = *(uint32_t *)&sctph->sh_sport;
2587 2588
2588 2589 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_dst);
2589 2590 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_src);
2590 2591 if (iraflags & IRAF_SCTP_CSUM_ERR) {
2591 2592 /*
2592 2593 * No potential sctp checksum errors go to the Sun
2593 2594 * sctp stack however they might be Adler-32 summed
2594 2595 * packets a userland stack bound to a raw IP socket
2595 2596 * could reasonably use. Note though that Adler-32 is
2596 2597 * a long deprecated algorithm and customer sctp
2597 2598 * networks should eventually migrate to CRC-32 at
2598 2599 * which time this facility should be removed.
2599 2600 */
2600 2601 ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2601 2602 return;
2602 2603 }
2603 2604 connp = sctp_fanout(&map_src, &map_dst, ports, ira, mp,
2604 2605 sctps, sctph);
2605 2606 if (connp == NULL) {
2606 2607 /* Check for raw socket or OOTB handling */
2607 2608 ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2608 2609 return;
2609 2610 }
2610 2611 if (connp->conn_incoming_ifindex != 0 &&
2611 2612 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2612 2613 CONN_DEC_REF(connp);
2613 2614 /* Check for raw socket or OOTB handling */
2614 2615 ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2615 2616 return;
2616 2617 }
2617 2618
2618 2619 /* Found a client; up it goes */
2619 2620 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2620 2621 sctp_input(connp, ipha, NULL, mp, ira);
2621 2622 /* sctp_input does a rele of the sctp_t */
2622 2623 return;
2623 2624 }
2624 2625
2625 2626 case IPPROTO_UDP:
2626 2627 /* First mblk contains IP+UDP headers as checked above */
2627 2628 ASSERT(MBLKL(mp) >= ip_hdr_length + UDPH_SIZE);
2628 2629
2629 2630 if (iraflags & IRAF_MULTIBROADCAST) {
2630 2631 uint16_t *up; /* Pointer to ports in ULP header */
2631 2632
2632 2633 up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2633 2634 ip_fanout_udp_multi_v4(mp, ipha, up[1], up[0], ira);
2634 2635 return;
2635 2636 }
2636 2637
2637 2638 /* Look for AF_INET or AF_INET6 that matches */
2638 2639 connp = ipcl_classify_v4(mp, IPPROTO_UDP, ip_hdr_length,
2639 2640 ira, ipst);
2640 2641 if (connp == NULL) {
2641 2642 no_udp_match:
2642 2643 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].
2643 2644 connf_head != NULL) {
2644 2645 ASSERT(ira->ira_protocol == IPPROTO_UDP);
2645 2646 ip_fanout_proto_v4(mp, ipha, ira);
2646 2647 } else {
2647 2648 ip_fanout_send_icmp_v4(mp,
2648 2649 ICMP_DEST_UNREACHABLE,
2649 2650 ICMP_PORT_UNREACHABLE, ira);
2650 2651 }
2651 2652 return;
2652 2653
2653 2654 }
2654 2655 if (connp->conn_incoming_ifindex != 0 &&
2655 2656 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2656 2657 CONN_DEC_REF(connp);
2657 2658 goto no_udp_match;
2658 2659 }
2659 2660 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld :
2660 2661 !canputnext(connp->conn_rq)) {
2661 2662 CONN_DEC_REF(connp);
2662 2663 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
2663 2664 ip_drop_input("udpIfStatsInOverflows", mp, ill);
2664 2665 freemsg(mp);
2665 2666 return;
2666 2667 }
2667 2668 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2668 2669 (iraflags & IRAF_IPSEC_SECURE)) {
2669 2670 mp = ipsec_check_inbound_policy(mp, connp,
2670 2671 ipha, NULL, ira);
2671 2672 if (mp == NULL) {
2672 2673 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2673 2674 /* Note that mp is NULL */
2674 2675 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2675 2676 CONN_DEC_REF(connp);
2676 2677 return;
2677 2678 }
2678 2679 }
2679 2680 /*
2680 2681 * Remove 0-spi if it's 0, or move everything behind
2681 2682 * the UDP header over it and forward to ESP via
2682 2683 * ip_fanout_v4().
2683 2684 */
2684 2685 if (connp->conn_udp->udp_nat_t_endpoint) {
2685 2686 if (iraflags & IRAF_IPSEC_SECURE) {
2686 2687 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2687 2688 DROPPER(ipss, ipds_esp_nat_t_ipsec),
2688 2689 &ipss->ipsec_dropper);
2689 2690 CONN_DEC_REF(connp);
2690 2691 return;
2691 2692 }
2692 2693
2693 2694 mp = zero_spi_check(mp, ira);
2694 2695 if (mp == NULL) {
2695 2696 /*
2696 2697 * Packet was consumed - probably sent to
2697 2698 * ip_fanout_v4.
2698 2699 */
2699 2700 CONN_DEC_REF(connp);
2700 2701 return;
2701 2702 }
2702 2703 /* Else continue like a normal UDP packet. */
2703 2704 ipha = (ipha_t *)mp->b_rptr;
2704 2705 protocol = ipha->ipha_protocol;
2705 2706 ira->ira_protocol = protocol;
2706 2707 }
2707 2708 /* Found a client; up it goes */
2708 2709 IP_STAT(ipst, ip_udp_fannorm);
2709 2710 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2710 2711 ira->ira_ill = ira->ira_rill = NULL;
2711 2712 (connp->conn_recv)(connp, mp, NULL, ira);
2712 2713 CONN_DEC_REF(connp);
2713 2714 ira->ira_ill = ill;
2714 2715 ira->ira_rill = rill;
2715 2716 return;
2716 2717 default:
2717 2718 break;
2718 2719 }
2719 2720
2720 2721 /*
2721 2722 * Clear hardware checksumming flag as it is currently only
2722 2723 * used by TCP and UDP.
2723 2724 */
2724 2725 DB_CKSUMFLAGS(mp) = 0;
2725 2726
2726 2727 switch (protocol) {
2727 2728 case IPPROTO_ICMP:
2728 2729 /*
2729 2730 * We need to accomodate icmp messages coming in clear
2730 2731 * until we get everything secure from the wire. If
2731 2732 * icmp_accept_clear_messages is zero we check with
2732 2733 * the global policy and act accordingly. If it is
2733 2734 * non-zero, we accept the message without any checks.
2734 2735 * But *this does not mean* that this will be delivered
2735 2736 * to RAW socket clients. By accepting we might send
2736 2737 * replies back, change our MTU value etc.,
2737 2738 * but delivery to the ULP/clients depends on their
2738 2739 * policy dispositions.
2739 2740 */
2740 2741 if (ipst->ips_icmp_accept_clear_messages == 0) {
2741 2742 mp = ipsec_check_global_policy(mp, NULL,
2742 2743 ipha, NULL, ira, ns);
2743 2744 if (mp == NULL)
2744 2745 return;
2745 2746 }
2746 2747
2747 2748 /*
2748 2749 * On a labeled system, we have to check whether the zone
2749 2750 * itself is permitted to receive raw traffic.
2750 2751 */
2751 2752 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
2752 2753 if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
2753 2754 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
2754 2755 ip_drop_input("tsol_can_accept_raw", mp, ill);
2755 2756 freemsg(mp);
2756 2757 return;
2757 2758 }
2758 2759 }
2759 2760
2760 2761 /*
2761 2762 * ICMP header checksum, including checksum field,
2762 2763 * should be zero.
2763 2764 */
2764 2765 if (IP_CSUM(mp, ip_hdr_length, 0)) {
2765 2766 BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2766 2767 ip_drop_input("icmpInCksumErrs", mp, ill);
2767 2768 freemsg(mp);
2768 2769 return;
2769 2770 }
2770 2771 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2771 2772 mp = icmp_inbound_v4(mp, ira);
2772 2773 if (mp == NULL) {
2773 2774 /* No need to pass to RAW sockets */
2774 2775 return;
2775 2776 }
2776 2777 break;
2777 2778
2778 2779 case IPPROTO_IGMP:
2779 2780 /*
2780 2781 * If we are not willing to accept IGMP packets in clear,
2781 2782 * then check with global policy.
2782 2783 */
2783 2784 if (ipst->ips_igmp_accept_clear_messages == 0) {
2784 2785 mp = ipsec_check_global_policy(mp, NULL,
2785 2786 ipha, NULL, ira, ns);
2786 2787 if (mp == NULL)
2787 2788 return;
2788 2789 }
2789 2790 if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2790 2791 !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2791 2792 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2792 2793 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2793 2794 freemsg(mp);
2794 2795 return;
2795 2796 }
2796 2797 /*
2797 2798 * Validate checksum
2798 2799 */
2799 2800 if (IP_CSUM(mp, ip_hdr_length, 0)) {
2800 2801 ++ipst->ips_igmpstat.igps_rcv_badsum;
2801 2802 ip_drop_input("igps_rcv_badsum", mp, ill);
2802 2803 freemsg(mp);
2803 2804 return;
2804 2805 }
2805 2806
2806 2807 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2807 2808 mp = igmp_input(mp, ira);
2808 2809 if (mp == NULL) {
2809 2810 /* Bad packet - discarded by igmp_input */
2810 2811 return;
2811 2812 }
2812 2813 break;
2813 2814 case IPPROTO_PIM:
2814 2815 /*
2815 2816 * If we are not willing to accept PIM packets in clear,
2816 2817 * then check with global policy.
2817 2818 */
2818 2819 if (ipst->ips_pim_accept_clear_messages == 0) {
2819 2820 mp = ipsec_check_global_policy(mp, NULL,
2820 2821 ipha, NULL, ira, ns);
2821 2822 if (mp == NULL)
2822 2823 return;
2823 2824 }
2824 2825 if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2825 2826 !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2826 2827 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2827 2828 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2828 2829 freemsg(mp);
2829 2830 return;
2830 2831 }
2831 2832 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2832 2833
2833 2834 /* Checksum is verified in pim_input */
2834 2835 mp = pim_input(mp, ira);
2835 2836 if (mp == NULL) {
2836 2837 /* Bad packet - discarded by pim_input */
2837 2838 return;
2838 2839 }
2839 2840 break;
2840 2841 case IPPROTO_AH:
2841 2842 case IPPROTO_ESP: {
2842 2843 /*
2843 2844 * Fast path for AH/ESP.
2844 2845 */
2845 2846 netstack_t *ns = ipst->ips_netstack;
2846 2847 ipsec_stack_t *ipss = ns->netstack_ipsec;
2847 2848
2848 2849 IP_STAT(ipst, ipsec_proto_ahesp);
2849 2850
2850 2851 if (!ipsec_loaded(ipss)) {
2851 2852 ip_proto_not_sup(mp, ira);
2852 2853 return;
2853 2854 }
2854 2855
2855 2856 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2856 2857 /* select inbound SA and have IPsec process the pkt */
2857 2858 if (protocol == IPPROTO_ESP) {
2858 2859 esph_t *esph;
2859 2860 boolean_t esp_in_udp_sa;
2860 2861 boolean_t esp_in_udp_packet;
2861 2862
2862 2863 mp = ipsec_inbound_esp_sa(mp, ira, &esph);
2863 2864 if (mp == NULL)
2864 2865 return;
2865 2866
2866 2867 ASSERT(esph != NULL);
2867 2868 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2868 2869 ASSERT(ira->ira_ipsec_esp_sa != NULL);
2869 2870 ASSERT(ira->ira_ipsec_esp_sa->ipsa_input_func != NULL);
2870 2871
2871 2872 esp_in_udp_sa = ((ira->ira_ipsec_esp_sa->ipsa_flags &
2872 2873 IPSA_F_NATT) != 0);
2873 2874 esp_in_udp_packet =
2874 2875 (ira->ira_flags & IRAF_ESP_UDP_PORTS) != 0;
2875 2876
2876 2877 /*
2877 2878 * The following is a fancy, but quick, way of saying:
2878 2879 * ESP-in-UDP SA and Raw ESP packet --> drop
2879 2880 * OR
2880 2881 * ESP SA and ESP-in-UDP packet --> drop
2881 2882 */
2882 2883 if (esp_in_udp_sa != esp_in_udp_packet) {
2883 2884 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2884 2885 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2885 2886 DROPPER(ipss, ipds_esp_no_sa),
2886 2887 &ipss->ipsec_dropper);
2887 2888 return;
2888 2889 }
2889 2890 mp = ira->ira_ipsec_esp_sa->ipsa_input_func(mp, esph,
2890 2891 ira);
2891 2892 } else {
2892 2893 ah_t *ah;
2893 2894
2894 2895 mp = ipsec_inbound_ah_sa(mp, ira, &ah);
2895 2896 if (mp == NULL)
2896 2897 return;
2897 2898
2898 2899 ASSERT(ah != NULL);
2899 2900 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2900 2901 ASSERT(ira->ira_ipsec_ah_sa != NULL);
2901 2902 ASSERT(ira->ira_ipsec_ah_sa->ipsa_input_func != NULL);
2902 2903 mp = ira->ira_ipsec_ah_sa->ipsa_input_func(mp, ah,
2903 2904 ira);
2904 2905 }
2905 2906
2906 2907 if (mp == NULL) {
2907 2908 /*
2908 2909 * Either it failed or is pending. In the former case
2909 2910 * ipIfStatsInDiscards was increased.
2910 2911 */
2911 2912 return;
2912 2913 }
2913 2914 /* we're done with IPsec processing, send it up */
2914 2915 ip_input_post_ipsec(mp, ira);
2915 2916 return;
2916 2917 }
2917 2918 case IPPROTO_ENCAP: {
2918 2919 ipha_t *inner_ipha;
2919 2920
2920 2921 /*
2921 2922 * Handle self-encapsulated packets (IP-in-IP where
2922 2923 * the inner addresses == the outer addresses).
2923 2924 */
2924 2925 if ((uchar_t *)ipha + ip_hdr_length + sizeof (ipha_t) >
2925 2926 mp->b_wptr) {
2926 2927 if (ira->ira_pktlen <
2927 2928 ip_hdr_length + sizeof (ipha_t)) {
2928 2929 BUMP_MIB(ill->ill_ip_mib,
2929 2930 ipIfStatsInTruncatedPkts);
2930 2931 ip_drop_input("ipIfStatsInTruncatedPkts",
2931 2932 mp, ill);
2932 2933 freemsg(mp);
2933 2934 return;
2934 2935 }
2935 2936 ipha = ip_pullup(mp, (uchar_t *)ipha + ip_hdr_length +
2936 2937 sizeof (ipha_t) - mp->b_rptr, ira);
2937 2938 if (ipha == NULL) {
2938 2939 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2939 2940 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2940 2941 freemsg(mp);
2941 2942 return;
2942 2943 }
2943 2944 }
2944 2945 inner_ipha = (ipha_t *)((uchar_t *)ipha + ip_hdr_length);
2945 2946 /*
2946 2947 * Check the sanity of the inner IP header.
2947 2948 */
2948 2949 if ((IPH_HDR_VERSION(inner_ipha) != IPV4_VERSION)) {
2949 2950 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2950 2951 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2951 2952 freemsg(mp);
2952 2953 return;
2953 2954 }
2954 2955 if (IPH_HDR_LENGTH(inner_ipha) < sizeof (ipha_t)) {
2955 2956 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2956 2957 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2957 2958 freemsg(mp);
2958 2959 return;
2959 2960 }
2960 2961 if (inner_ipha->ipha_src != ipha->ipha_src ||
2961 2962 inner_ipha->ipha_dst != ipha->ipha_dst) {
2962 2963 /* We fallthru to iptun fanout below */
2963 2964 goto iptun;
2964 2965 }
2965 2966
2966 2967 /*
2967 2968 * Self-encapsulated tunnel packet. Remove
2968 2969 * the outer IP header and fanout again.
2969 2970 * We also need to make sure that the inner
2970 2971 * header is pulled up until options.
2971 2972 */
2972 2973 mp->b_rptr = (uchar_t *)inner_ipha;
2973 2974 ipha = inner_ipha;
2974 2975 ip_hdr_length = IPH_HDR_LENGTH(ipha);
2975 2976 if ((uchar_t *)ipha + ip_hdr_length > mp->b_wptr) {
2976 2977 if (ira->ira_pktlen <
2977 2978 (uchar_t *)ipha + ip_hdr_length - mp->b_rptr) {
2978 2979 BUMP_MIB(ill->ill_ip_mib,
2979 2980 ipIfStatsInTruncatedPkts);
2980 2981 ip_drop_input("ipIfStatsInTruncatedPkts",
2981 2982 mp, ill);
2982 2983 freemsg(mp);
2983 2984 return;
2984 2985 }
2985 2986 ipha = ip_pullup(mp,
2986 2987 (uchar_t *)ipha + ip_hdr_length - mp->b_rptr, ira);
2987 2988 if (ipha == NULL) {
2988 2989 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2989 2990 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2990 2991 freemsg(mp);
2991 2992 return;
2992 2993 }
2993 2994 }
2994 2995 if (ip_hdr_length > sizeof (ipha_t)) {
2995 2996 /* We got options on the inner packet. */
2996 2997 ipaddr_t dst = ipha->ipha_dst;
2997 2998 int error = 0;
2998 2999
2999 3000 dst = ip_input_options(ipha, dst, mp, ira, &error);
3000 3001 if (error != 0) {
3001 3002 /*
3002 3003 * An ICMP error has been sent and the packet
3003 3004 * has been dropped.
3004 3005 */
3005 3006 return;
3006 3007 }
3007 3008 if (dst != ipha->ipha_dst) {
3008 3009 /*
3009 3010 * Someone put a source-route in
3010 3011 * the inside header of a self-
3011 3012 * encapsulated packet. Drop it
3012 3013 * with extreme prejudice and let
3013 3014 * the sender know.
3014 3015 */
3015 3016 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
3016 3017 mp, ill);
3017 3018 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED,
3018 3019 ira);
3019 3020 return;
3020 3021 }
3021 3022 }
3022 3023 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
3023 3024 /*
3024 3025 * This means that somebody is sending
3025 3026 * Self-encapsualted packets without AH/ESP.
3026 3027 *
3027 3028 * Send this packet to find a tunnel endpoint.
3028 3029 * if I can't find one, an ICMP
3029 3030 * PROTOCOL_UNREACHABLE will get sent.
3030 3031 */
3031 3032 protocol = ipha->ipha_protocol;
3032 3033 ira->ira_protocol = protocol;
3033 3034 goto iptun;
3034 3035 }
3035 3036
3036 3037 /* Update based on removed IP header */
3037 3038 ira->ira_ip_hdr_length = ip_hdr_length;
3038 3039 ira->ira_pktlen = ntohs(ipha->ipha_length);
3039 3040
3040 3041 if (ira->ira_flags & IRAF_IPSEC_DECAPS) {
3041 3042 /*
3042 3043 * This packet is self-encapsulated multiple
3043 3044 * times. We don't want to recurse infinitely.
3044 3045 * To keep it simple, drop the packet.
3045 3046 */
3046 3047 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3047 3048 ip_drop_input("ipIfStatsInDiscards", mp, ill);
3048 3049 freemsg(mp);
3049 3050 return;
3050 3051 }
3051 3052 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
3052 3053 ira->ira_flags |= IRAF_IPSEC_DECAPS;
3053 3054
3054 3055 ip_input_post_ipsec(mp, ira);
3055 3056 return;
3056 3057 }
3057 3058
3058 3059 iptun: /* IPPROTO_ENCAPS that is not self-encapsulated */
3059 3060 case IPPROTO_IPV6:
3060 3061 /* iptun will verify trusted label */
3061 3062 connp = ipcl_classify_v4(mp, protocol, ip_hdr_length,
3062 3063 ira, ipst);
3063 3064 if (connp != NULL) {
3064 3065 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3065 3066 ira->ira_ill = ira->ira_rill = NULL;
3066 3067 (connp->conn_recv)(connp, mp, NULL, ira);
3067 3068 CONN_DEC_REF(connp);
3068 3069 ira->ira_ill = ill;
3069 3070 ira->ira_rill = rill;
3070 3071 return;
3071 3072 }
3072 3073 /* FALLTHRU */
3073 3074 default:
3074 3075 /*
3075 3076 * On a labeled system, we have to check whether the zone
3076 3077 * itself is permitted to receive raw traffic.
3077 3078 */
3078 3079 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
3079 3080 if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
3080 3081 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3081 3082 ip_drop_input("ipIfStatsInDiscards", mp, ill);
3082 3083 freemsg(mp);
3083 3084 return;
3084 3085 }
3085 3086 }
3086 3087 break;
3087 3088 }
3088 3089
3089 3090 /*
3090 3091 * The above input functions may have returned the pulled up message.
3091 3092 * So ipha need to be reinitialized.
3092 3093 */
3093 3094 ipha = (ipha_t *)mp->b_rptr;
3094 3095 ira->ira_protocol = protocol = ipha->ipha_protocol;
3095 3096 if (ipst->ips_ipcl_proto_fanout_v4[protocol].connf_head == NULL) {
3096 3097 /*
3097 3098 * No user-level listener for these packets packets.
3098 3099 * Check for IPPROTO_ENCAP...
3099 3100 */
3100 3101 if (protocol == IPPROTO_ENCAP && ipst->ips_ip_g_mrouter) {
3101 3102 /*
3102 3103 * Check policy here,
3103 3104 * THEN ship off to ip_mroute_decap().
3104 3105 *
3105 3106 * BTW, If I match a configured IP-in-IP
3106 3107 * tunnel above, this path will not be reached, and
3107 3108 * ip_mroute_decap will never be called.
3108 3109 */
3109 3110 mp = ipsec_check_global_policy(mp, connp,
3110 3111 ipha, NULL, ira, ns);
3111 3112 if (mp != NULL) {
3112 3113 ip_mroute_decap(mp, ira);
3113 3114 } /* Else we already freed everything! */
3114 3115 } else {
3115 3116 ip_proto_not_sup(mp, ira);
3116 3117 }
3117 3118 return;
3118 3119 }
3119 3120
3120 3121 /*
3121 3122 * Handle fanout to raw sockets. There
3122 3123 * can be more than one stream bound to a particular
3123 3124 * protocol. When this is the case, each one gets a copy
3124 3125 * of any incoming packets.
3125 3126 */
3126 3127 ASSERT(ira->ira_protocol == ipha->ipha_protocol);
3127 3128 ip_fanout_proto_v4(mp, ipha, ira);
3128 3129 return;
3129 3130
3130 3131 discard:
3131 3132 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3132 3133 ip_drop_input("ipIfStatsInDiscards", mp, ill);
3133 3134 freemsg(mp);
3134 3135 #undef rptr
3135 3136 }
|
↓ open down ↓ |
2328 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX