Print this page
%B
Split |
Close |
Expand all |
Collapse all |
--- old/usr/src/uts/common/inet/ip/ip_input.c
+++ new/usr/src/uts/common/inet/ip/ip_input.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24 24 *
25 25 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
26 26 */
27 27 /* Copyright (c) 1990 Mentat Inc. */
28 28
29 29 #include <sys/types.h>
30 30 #include <sys/stream.h>
31 31 #include <sys/dlpi.h>
32 32 #include <sys/stropts.h>
33 33 #include <sys/sysmacros.h>
34 34 #include <sys/strsubr.h>
35 35 #include <sys/strlog.h>
36 36 #include <sys/strsun.h>
37 37 #include <sys/zone.h>
38 38 #define _SUN_TPI_VERSION 2
39 39 #include <sys/tihdr.h>
40 40 #include <sys/xti_inet.h>
41 41 #include <sys/ddi.h>
42 42 #include <sys/sunddi.h>
43 43 #include <sys/cmn_err.h>
44 44 #include <sys/debug.h>
45 45 #include <sys/kobj.h>
46 46 #include <sys/modctl.h>
47 47 #include <sys/atomic.h>
48 48 #include <sys/policy.h>
49 49 #include <sys/priv.h>
50 50
51 51 #include <sys/systm.h>
52 52 #include <sys/param.h>
53 53 #include <sys/kmem.h>
54 54 #include <sys/sdt.h>
55 55 #include <sys/socket.h>
56 56 #include <sys/vtrace.h>
57 57 #include <sys/isa_defs.h>
58 58 #include <sys/mac.h>
59 59 #include <net/if.h>
60 60 #include <net/if_arp.h>
61 61 #include <net/route.h>
62 62 #include <sys/sockio.h>
63 63 #include <netinet/in.h>
64 64 #include <net/if_dl.h>
65 65
66 66 #include <inet/common.h>
67 67 #include <inet/mi.h>
68 68 #include <inet/mib2.h>
69 69 #include <inet/nd.h>
70 70 #include <inet/arp.h>
71 71 #include <inet/snmpcom.h>
72 72 #include <inet/kstatcom.h>
73 73
74 74 #include <netinet/igmp_var.h>
75 75 #include <netinet/ip6.h>
76 76 #include <netinet/icmp6.h>
77 77 #include <netinet/sctp.h>
78 78
79 79 #include <inet/ip.h>
80 80 #include <inet/ip_impl.h>
81 81 #include <inet/ip6.h>
82 82 #include <inet/ip6_asp.h>
83 83 #include <inet/optcom.h>
84 84 #include <inet/tcp.h>
85 85 #include <inet/tcp_impl.h>
86 86 #include <inet/ip_multi.h>
87 87 #include <inet/ip_if.h>
88 88 #include <inet/ip_ire.h>
89 89 #include <inet/ip_ftable.h>
90 90 #include <inet/ip_rts.h>
91 91 #include <inet/ip_ndp.h>
92 92 #include <inet/ip_listutils.h>
93 93 #include <netinet/igmp.h>
94 94 #include <netinet/ip_mroute.h>
95 95 #include <inet/ipp_common.h>
96 96
97 97 #include <net/pfkeyv2.h>
98 98 #include <inet/sadb.h>
99 99 #include <inet/ipsec_impl.h>
100 100 #include <inet/ipdrop.h>
101 101 #include <inet/ip_netinfo.h>
102 102 #include <inet/ilb_ip.h>
103 103 #include <sys/squeue_impl.h>
104 104 #include <sys/squeue.h>
105 105
106 106 #include <sys/ethernet.h>
107 107 #include <net/if_types.h>
108 108 #include <sys/cpuvar.h>
↓ open down ↓ |
108 lines elided |
↑ open up ↑ |
109 109
110 110 #include <ipp/ipp.h>
111 111 #include <ipp/ipp_impl.h>
112 112 #include <ipp/ipgpc/ipgpc.h>
113 113
114 114 #include <sys/pattr.h>
115 115 #include <inet/ipclassifier.h>
116 116 #include <inet/sctp_ip.h>
117 117 #include <inet/sctp/sctp_impl.h>
118 118 #include <inet/udp_impl.h>
119 +#include <inet/dccp/dccp_impl.h>
119 120 #include <sys/sunddi.h>
120 121
121 122 #include <sys/tsol/label.h>
122 123 #include <sys/tsol/tnet.h>
123 124
124 125 #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */
125 126
126 127 #ifdef DEBUG
127 128 extern boolean_t skip_sctp_cksum;
128 129 #endif
129 130
130 131 static void ip_input_local_v4(ire_t *, mblk_t *, ipha_t *,
131 132 ip_recv_attr_t *);
132 133
133 134 static void ip_input_broadcast_v4(ire_t *, mblk_t *, ipha_t *,
134 135 ip_recv_attr_t *);
135 136 static void ip_input_multicast_v4(ire_t *, mblk_t *, ipha_t *,
136 137 ip_recv_attr_t *);
137 138
138 139 #pragma inline(ip_input_common_v4, ip_input_local_v4, ip_forward_xmit_v4)
139 140
140 141 /*
141 142 * Direct read side procedure capable of dealing with chains. GLDv3 based
142 143 * drivers call this function directly with mblk chains while STREAMS
143 144 * read side procedure ip_rput() calls this for single packet with ip_ring
144 145 * set to NULL to process one packet at a time.
145 146 *
146 147 * The ill will always be valid if this function is called directly from
147 148 * the driver.
148 149 *
149 150 * If ip_input() is called from GLDv3:
150 151 *
151 152 * - This must be a non-VLAN IP stream.
152 153 * - 'mp' is either an untagged or a special priority-tagged packet.
153 154 * - Any VLAN tag that was in the MAC header has been stripped.
154 155 *
155 156 * If the IP header in packet is not 32-bit aligned, every message in the
156 157 * chain will be aligned before further operations. This is required on SPARC
157 158 * platform.
158 159 */
159 160 void
160 161 ip_input(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
161 162 struct mac_header_info_s *mhip)
162 163 {
163 164 (void) ip_input_common_v4(ill, ip_ring, mp_chain, mhip, NULL, NULL,
164 165 NULL);
165 166 }
166 167
167 168 /*
168 169 * ip_accept_tcp() - This function is called by the squeue when it retrieves
169 170 * a chain of packets in the poll mode. The packets have gone through the
170 171 * data link processing but not IP processing. For performance and latency
171 172 * reasons, the squeue wants to process the chain in line instead of feeding
172 173 * it back via ip_input path.
173 174 *
174 175 * We set up the ip_recv_attr_t with IRAF_TARGET_SQP to that ip_fanout_v4
175 176 * will pass back any TCP packets matching the target sqp to
176 177 * ip_input_common_v4 using ira_target_sqp_mp. Other packets are handled by
177 178 * ip_input_v4 and ip_fanout_v4 as normal.
178 179 * The TCP packets that match the target squeue are returned to the caller
179 180 * as a b_next chain after each packet has been prepend with an mblk
180 181 * from ip_recv_attr_to_mblk.
181 182 */
182 183 mblk_t *
183 184 ip_accept_tcp(ill_t *ill, ill_rx_ring_t *ip_ring, squeue_t *target_sqp,
184 185 mblk_t *mp_chain, mblk_t **last, uint_t *cnt)
185 186 {
186 187 return (ip_input_common_v4(ill, ip_ring, mp_chain, NULL, target_sqp,
187 188 last, cnt));
188 189 }
189 190
190 191 /*
191 192 * Used by ip_input and ip_accept_tcp
192 193 * The last three arguments are only used by ip_accept_tcp, and mhip is
193 194 * only used by ip_input.
194 195 */
195 196 mblk_t *
196 197 ip_input_common_v4(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
197 198 struct mac_header_info_s *mhip, squeue_t *target_sqp,
198 199 mblk_t **last, uint_t *cnt)
199 200 {
200 201 mblk_t *mp;
201 202 ipha_t *ipha;
202 203 ip_recv_attr_t iras; /* Receive attributes */
203 204 rtc_t rtc;
204 205 iaflags_t chain_flags = 0; /* Fixed for chain */
205 206 mblk_t *ahead = NULL; /* Accepted head */
206 207 mblk_t *atail = NULL; /* Accepted tail */
207 208 uint_t acnt = 0; /* Accepted count */
208 209
209 210 ASSERT(mp_chain != NULL);
210 211 ASSERT(ill != NULL);
211 212
212 213 /* These ones do not change as we loop over packets */
213 214 iras.ira_ill = iras.ira_rill = ill;
214 215 iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
215 216 iras.ira_rifindex = iras.ira_ruifindex;
216 217 iras.ira_sqp = NULL;
217 218 iras.ira_ring = ip_ring;
218 219 /* For ECMP and outbound transmit ring selection */
219 220 iras.ira_xmit_hint = ILL_RING_TO_XMIT_HINT(ip_ring);
220 221
221 222 iras.ira_target_sqp = target_sqp;
222 223 iras.ira_target_sqp_mp = NULL;
223 224 if (target_sqp != NULL)
224 225 chain_flags |= IRAF_TARGET_SQP;
225 226
226 227 /*
227 228 * We try to have a mhip pointer when possible, but
228 229 * it might be NULL in some cases. In those cases we
229 230 * have to assume unicast.
230 231 */
231 232 iras.ira_mhip = mhip;
232 233 iras.ira_flags = 0;
233 234 if (mhip != NULL) {
234 235 switch (mhip->mhi_dsttype) {
235 236 case MAC_ADDRTYPE_MULTICAST :
236 237 chain_flags |= IRAF_L2DST_MULTICAST;
237 238 break;
238 239 case MAC_ADDRTYPE_BROADCAST :
239 240 chain_flags |= IRAF_L2DST_BROADCAST;
240 241 break;
241 242 }
242 243 }
243 244
244 245 /*
245 246 * Initialize the one-element route cache.
246 247 *
247 248 * We do ire caching from one iteration to
248 249 * another. In the event the packet chain contains
249 250 * all packets from the same dst, this caching saves
250 251 * an ire_route_recursive for each of the succeeding
251 252 * packets in a packet chain.
252 253 */
253 254 rtc.rtc_ire = NULL;
254 255 rtc.rtc_ipaddr = INADDR_ANY;
255 256
256 257 /* Loop over b_next */
257 258 for (mp = mp_chain; mp != NULL; mp = mp_chain) {
258 259 mp_chain = mp->b_next;
259 260 mp->b_next = NULL;
260 261
261 262 ASSERT(DB_TYPE(mp) == M_DATA);
262 263
263 264
264 265 /*
265 266 * if db_ref > 1 then copymsg and free original. Packet
266 267 * may be changed and we do not want the other entity
267 268 * who has a reference to this message to trip over the
268 269 * changes. This is a blind change because trying to
269 270 * catch all places that might change the packet is too
270 271 * difficult.
271 272 *
272 273 * This corresponds to the fast path case, where we have
273 274 * a chain of M_DATA mblks. We check the db_ref count
274 275 * of only the 1st data block in the mblk chain. There
275 276 * doesn't seem to be a reason why a device driver would
276 277 * send up data with varying db_ref counts in the mblk
277 278 * chain. In any case the Fast path is a private
278 279 * interface, and our drivers don't do such a thing.
279 280 * Given the above assumption, there is no need to walk
280 281 * down the entire mblk chain (which could have a
281 282 * potential performance problem)
282 283 *
283 284 * The "(DB_REF(mp) > 1)" check was moved from ip_rput()
284 285 * to here because of exclusive ip stacks and vnics.
285 286 * Packets transmitted from exclusive stack over vnic
286 287 * can have db_ref > 1 and when it gets looped back to
287 288 * another vnic in a different zone, you have ip_input()
288 289 * getting dblks with db_ref > 1. So if someone
289 290 * complains of TCP performance under this scenario,
290 291 * take a serious look here on the impact of copymsg().
291 292 */
292 293 if (DB_REF(mp) > 1) {
293 294 if ((mp = ip_fix_dbref(mp, &iras)) == NULL) {
294 295 /* mhip might point into 1st packet in chain */
295 296 iras.ira_mhip = NULL;
296 297 continue;
297 298 }
298 299 }
299 300
300 301 /*
301 302 * IP header ptr not aligned?
302 303 * OR IP header not complete in first mblk
303 304 */
304 305 ipha = (ipha_t *)mp->b_rptr;
305 306 if (!OK_32PTR(ipha) || MBLKL(mp) < IP_SIMPLE_HDR_LENGTH) {
306 307 mp = ip_check_and_align_header(mp, IP_SIMPLE_HDR_LENGTH,
307 308 &iras);
308 309 if (mp == NULL) {
309 310 /* mhip might point into 1st packet in chain */
310 311 iras.ira_mhip = NULL;
311 312 continue;
312 313 }
313 314 ipha = (ipha_t *)mp->b_rptr;
314 315 }
315 316
316 317 /* Protect against a mix of Ethertypes and IP versions */
317 318 if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
318 319 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
319 320 ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
320 321 freemsg(mp);
321 322 /* mhip might point into 1st packet in the chain. */
322 323 iras.ira_mhip = NULL;
323 324 continue;
324 325 }
325 326
326 327 /*
327 328 * Check for Martian addrs; we have to explicitly
328 329 * test for for zero dst since this is also used as
329 330 * an indication that the rtc is not used.
330 331 */
331 332 if (ipha->ipha_dst == INADDR_ANY) {
332 333 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
333 334 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
334 335 freemsg(mp);
335 336 /* mhip might point into 1st packet in the chain. */
336 337 iras.ira_mhip = NULL;
337 338 continue;
338 339 }
339 340
340 341 /*
341 342 * Keep L2SRC from a previous packet in chain since mhip
342 343 * might point into an earlier packet in the chain.
343 344 * Keep IRAF_VERIFIED_SRC to avoid redoing broadcast
344 345 * source check in forwarding path.
345 346 */
346 347 chain_flags |= (iras.ira_flags &
347 348 (IRAF_L2SRC_SET|IRAF_VERIFIED_SRC));
348 349
349 350 iras.ira_flags = IRAF_IS_IPV4 | IRAF_VERIFY_IP_CKSUM |
350 351 IRAF_VERIFY_ULP_CKSUM | chain_flags;
351 352 iras.ira_free_flags = 0;
352 353 iras.ira_cred = NULL;
353 354 iras.ira_cpid = NOPID;
354 355 iras.ira_tsl = NULL;
355 356 iras.ira_zoneid = ALL_ZONES; /* Default for forwarding */
356 357
357 358 /*
358 359 * We must count all incoming packets, even if they end
359 360 * up being dropped later on. Defer counting bytes until
360 361 * we have the whole IP header in first mblk.
361 362 */
362 363 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
363 364
364 365 iras.ira_pktlen = ntohs(ipha->ipha_length);
365 366 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets,
366 367 iras.ira_pktlen);
367 368
368 369 /*
369 370 * Call one of:
370 371 * ill_input_full_v4
371 372 * ill_input_short_v4
372 373 * The former is used in unusual cases. See ill_set_inputfn().
373 374 */
374 375 (*ill->ill_inputfn)(mp, ipha, &ipha->ipha_dst, &iras, &rtc);
375 376
376 377 /* Any references to clean up? No hold on ira_ill */
377 378 if (iras.ira_flags & (IRAF_IPSEC_SECURE|IRAF_SYSTEM_LABELED))
378 379 ira_cleanup(&iras, B_FALSE);
379 380
380 381 if (iras.ira_target_sqp_mp != NULL) {
381 382 /* Better be called from ip_accept_tcp */
382 383 ASSERT(target_sqp != NULL);
383 384
384 385 /* Found one packet to accept */
385 386 mp = iras.ira_target_sqp_mp;
386 387 iras.ira_target_sqp_mp = NULL;
387 388 ASSERT(ip_recv_attr_is_mblk(mp));
388 389
389 390 if (atail != NULL)
390 391 atail->b_next = mp;
391 392 else
392 393 ahead = mp;
393 394 atail = mp;
394 395 acnt++;
395 396 mp = NULL;
396 397 }
397 398 /* mhip might point into 1st packet in the chain. */
398 399 iras.ira_mhip = NULL;
399 400 }
400 401 /* Any remaining references to the route cache? */
401 402 if (rtc.rtc_ire != NULL) {
402 403 ASSERT(rtc.rtc_ipaddr != INADDR_ANY);
403 404 ire_refrele(rtc.rtc_ire);
404 405 }
405 406
406 407 if (ahead != NULL) {
407 408 /* Better be called from ip_accept_tcp */
408 409 ASSERT(target_sqp != NULL);
409 410 *last = atail;
410 411 *cnt = acnt;
411 412 return (ahead);
412 413 }
413 414
414 415 return (NULL);
415 416 }
416 417
417 418 /*
418 419 * This input function is used when
419 420 * - is_system_labeled()
420 421 * - CGTP filtering
421 422 * - DHCP unicast before we have an IP address configured
422 423 * - there is an listener for IPPROTO_RSVP
423 424 */
424 425 void
425 426 ill_input_full_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
426 427 ip_recv_attr_t *ira, rtc_t *rtc)
427 428 {
428 429 ipha_t *ipha = (ipha_t *)iph_arg;
429 430 ipaddr_t nexthop = *(ipaddr_t *)nexthop_arg;
430 431 ill_t *ill = ira->ira_ill;
431 432 ip_stack_t *ipst = ill->ill_ipst;
432 433 int cgtp_flt_pkt;
433 434
434 435 ASSERT(ira->ira_tsl == NULL);
435 436
436 437 /*
437 438 * Attach any necessary label information to
438 439 * this packet
439 440 */
440 441 if (is_system_labeled()) {
441 442 ira->ira_flags |= IRAF_SYSTEM_LABELED;
442 443
443 444 /*
444 445 * This updates ira_cred, ira_tsl and ira_free_flags based
445 446 * on the label.
446 447 */
447 448 if (!tsol_get_pkt_label(mp, IPV4_VERSION, ira)) {
448 449 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
449 450 ip_drop_input("ipIfStatsInDiscards", mp, ill);
450 451 freemsg(mp);
451 452 return;
452 453 }
453 454 /* Note that ira_tsl can be NULL here. */
454 455
455 456 /* tsol_get_pkt_label sometimes does pullupmsg */
456 457 ipha = (ipha_t *)mp->b_rptr;
457 458 }
458 459
459 460 /*
460 461 * Invoke the CGTP (multirouting) filtering module to process
461 462 * the incoming packet. Packets identified as duplicates
462 463 * must be discarded. Filtering is active only if the
463 464 * the ip_cgtp_filter ndd variable is non-zero.
464 465 */
465 466 cgtp_flt_pkt = CGTP_IP_PKT_NOT_CGTP;
466 467 if (ipst->ips_ip_cgtp_filter &&
467 468 ipst->ips_ip_cgtp_filter_ops != NULL) {
468 469 netstackid_t stackid;
469 470
470 471 stackid = ipst->ips_netstack->netstack_stackid;
471 472 /*
472 473 * CGTP and IPMP are mutually exclusive so
473 474 * phyint_ifindex is fine here.
474 475 */
475 476 cgtp_flt_pkt =
476 477 ipst->ips_ip_cgtp_filter_ops->cfo_filter(stackid,
477 478 ill->ill_phyint->phyint_ifindex, mp);
478 479 if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
479 480 ip_drop_input("CGTP_IP_PKT_DUPLICATE", mp, ill);
480 481 freemsg(mp);
481 482 return;
482 483 }
483 484 }
484 485
485 486 /*
486 487 * Brutal hack for DHCPv4 unicast: RFC2131 allows a DHCP
487 488 * server to unicast DHCP packets to a DHCP client using the
488 489 * IP address it is offering to the client. This can be
489 490 * disabled through the "broadcast bit", but not all DHCP
490 491 * servers honor that bit. Therefore, to interoperate with as
491 492 * many DHCP servers as possible, the DHCP client allows the
492 493 * server to unicast, but we treat those packets as broadcast
493 494 * here. Note that we don't rewrite the packet itself since
494 495 * (a) that would mess up the checksums and (b) the DHCP
495 496 * client conn is bound to INADDR_ANY so ip_fanout_udp() will
496 497 * hand it the packet regardless.
497 498 */
498 499 if (ill->ill_dhcpinit != 0 &&
499 500 ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION &&
500 501 ipha->ipha_protocol == IPPROTO_UDP) {
501 502 udpha_t *udpha;
502 503
503 504 ipha = ip_pullup(mp, sizeof (ipha_t) + sizeof (udpha_t), ira);
504 505 if (ipha == NULL) {
505 506 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
506 507 ip_drop_input("ipIfStatsInDiscards - dhcp", mp, ill);
507 508 freemsg(mp);
508 509 return;
509 510 }
510 511 /* Reload since pullupmsg() can change b_rptr. */
511 512 udpha = (udpha_t *)&ipha[1];
512 513
513 514 if (ntohs(udpha->uha_dst_port) == IPPORT_BOOTPC) {
514 515 DTRACE_PROBE2(ip4__dhcpinit__pkt, ill_t *, ill,
515 516 mblk_t *, mp);
516 517 /*
517 518 * This assumes that we deliver to all conns for
518 519 * multicast and broadcast packets.
519 520 */
520 521 nexthop = INADDR_BROADCAST;
521 522 ira->ira_flags |= IRAF_DHCP_UNICAST;
522 523 }
523 524 }
524 525
525 526 /*
526 527 * If rsvpd is running, let RSVP daemon handle its processing
527 528 * and forwarding of RSVP multicast/unicast packets.
528 529 * If rsvpd is not running but mrouted is running, RSVP
529 530 * multicast packets are forwarded as multicast traffic
530 531 * and RSVP unicast packets are forwarded by unicast router.
531 532 * If neither rsvpd nor mrouted is running, RSVP multicast
532 533 * packets are not forwarded, but the unicast packets are
533 534 * forwarded like unicast traffic.
534 535 */
535 536 if (ipha->ipha_protocol == IPPROTO_RSVP &&
536 537 ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head != NULL) {
537 538 /* RSVP packet and rsvpd running. Treat as ours */
538 539 ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(nexthop)));
539 540 /*
540 541 * We use a multicast address to get the packet to
541 542 * ire_recv_multicast_v4. There will not be a membership
542 543 * check since we set IRAF_RSVP
543 544 */
544 545 nexthop = htonl(INADDR_UNSPEC_GROUP);
545 546 ira->ira_flags |= IRAF_RSVP;
546 547 }
547 548
548 549 ill_input_short_v4(mp, ipha, &nexthop, ira, rtc);
549 550 }
550 551
551 552 /*
552 553 * This is the tail-end of the full receive side packet handling.
553 554 * It can be used directly when the configuration is simple.
554 555 */
555 556 void
556 557 ill_input_short_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
557 558 ip_recv_attr_t *ira, rtc_t *rtc)
558 559 {
559 560 ire_t *ire;
560 561 uint_t opt_len;
561 562 ill_t *ill = ira->ira_ill;
562 563 ip_stack_t *ipst = ill->ill_ipst;
563 564 uint_t pkt_len;
564 565 ssize_t len;
565 566 ipha_t *ipha = (ipha_t *)iph_arg;
566 567 ipaddr_t nexthop = *(ipaddr_t *)nexthop_arg;
567 568 ilb_stack_t *ilbs = ipst->ips_netstack->netstack_ilb;
568 569 uint_t irr_flags;
569 570 #define rptr ((uchar_t *)ipha)
570 571
571 572 ASSERT(DB_TYPE(mp) == M_DATA);
572 573
573 574 /*
574 575 * The following test for loopback is faster than
575 576 * IP_LOOPBACK_ADDR(), because it avoids any bitwise
576 577 * operations.
577 578 * Note that these addresses are always in network byte order
578 579 */
579 580 if (((*(uchar_t *)&ipha->ipha_dst) == IN_LOOPBACKNET) ||
580 581 ((*(uchar_t *)&ipha->ipha_src) == IN_LOOPBACKNET)) {
581 582 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
582 583 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
583 584 freemsg(mp);
584 585 return;
585 586 }
586 587
587 588 len = mp->b_wptr - rptr;
588 589 pkt_len = ira->ira_pktlen;
589 590
590 591 /* multiple mblk or too short */
591 592 len -= pkt_len;
592 593 if (len != 0) {
593 594 mp = ip_check_length(mp, rptr, len, pkt_len,
594 595 IP_SIMPLE_HDR_LENGTH, ira);
595 596 if (mp == NULL)
596 597 return;
597 598 ipha = (ipha_t *)mp->b_rptr;
598 599 }
599 600
600 601 DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
601 602 ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *, NULL,
602 603 int, 0);
603 604
604 605 /*
605 606 * The event for packets being received from a 'physical'
606 607 * interface is placed after validation of the source and/or
607 608 * destination address as being local so that packets can be
608 609 * redirected to loopback addresses using ipnat.
609 610 */
610 611 DTRACE_PROBE4(ip4__physical__in__start,
611 612 ill_t *, ill, ill_t *, NULL,
612 613 ipha_t *, ipha, mblk_t *, mp);
613 614
614 615 if (HOOKS4_INTERESTED_PHYSICAL_IN(ipst)) {
615 616 int ll_multicast = 0;
616 617 int error;
617 618 ipaddr_t orig_dst = ipha->ipha_dst;
618 619
619 620 if (ira->ira_flags & IRAF_L2DST_MULTICAST)
620 621 ll_multicast = HPE_MULTICAST;
621 622 else if (ira->ira_flags & IRAF_L2DST_BROADCAST)
622 623 ll_multicast = HPE_BROADCAST;
623 624
624 625 FW_HOOKS(ipst->ips_ip4_physical_in_event,
625 626 ipst->ips_ipv4firewall_physical_in,
626 627 ill, NULL, ipha, mp, mp, ll_multicast, ipst, error);
627 628
628 629 DTRACE_PROBE1(ip4__physical__in__end, mblk_t *, mp);
629 630
630 631 if (mp == NULL)
631 632 return;
632 633 /* The length could have changed */
633 634 ipha = (ipha_t *)mp->b_rptr;
634 635 ira->ira_pktlen = ntohs(ipha->ipha_length);
635 636 pkt_len = ira->ira_pktlen;
636 637
637 638 /*
638 639 * In case the destination changed we override any previous
639 640 * change to nexthop.
640 641 */
641 642 if (orig_dst != ipha->ipha_dst)
642 643 nexthop = ipha->ipha_dst;
643 644 if (nexthop == INADDR_ANY) {
644 645 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
645 646 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
646 647 freemsg(mp);
647 648 return;
648 649 }
649 650 }
650 651
651 652 if (ipst->ips_ip4_observe.he_interested) {
652 653 zoneid_t dzone;
653 654
654 655 /*
655 656 * On the inbound path the src zone will be unknown as
656 657 * this packet has come from the wire.
657 658 */
658 659 dzone = ip_get_zoneid_v4(nexthop, mp, ira, ALL_ZONES);
659 660 ipobs_hook(mp, IPOBS_HOOK_INBOUND, ALL_ZONES, dzone, ill, ipst);
660 661 }
661 662
662 663 /*
663 664 * If there is a good HW IP header checksum we clear the need
664 665 * look at the IP header checksum.
665 666 */
666 667 if ((DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM) &&
667 668 ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
668 669 /* Header checksum was ok. Clear the flag */
669 670 DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM;
670 671 ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
671 672 }
672 673
673 674 /*
674 675 * Here we check to see if we machine is setup as
675 676 * L3 loadbalancer and if the incoming packet is for a VIP
676 677 *
677 678 * Check the following:
678 679 * - there is at least a rule
679 680 * - protocol of the packet is supported
680 681 */
681 682 if (ilb_has_rules(ilbs) && ILB_SUPP_L4(ipha->ipha_protocol)) {
682 683 ipaddr_t lb_dst;
683 684 int lb_ret;
684 685
685 686 /* For convenience, we pull up the mblk. */
686 687 if (mp->b_cont != NULL) {
687 688 if (pullupmsg(mp, -1) == 0) {
688 689 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
689 690 ip_drop_input("ipIfStatsInDiscards - pullupmsg",
690 691 mp, ill);
691 692 freemsg(mp);
692 693 return;
693 694 }
694 695 ipha = (ipha_t *)mp->b_rptr;
695 696 }
696 697
697 698 /*
698 699 * We just drop all fragments going to any VIP, at
699 700 * least for now....
700 701 */
701 702 if (ntohs(ipha->ipha_fragment_offset_and_flags) &
702 703 (IPH_MF | IPH_OFFSET)) {
703 704 if (!ilb_rule_match_vip_v4(ilbs, nexthop, NULL)) {
704 705 goto after_ilb;
705 706 }
706 707
707 708 ILB_KSTAT_UPDATE(ilbs, ip_frag_in, 1);
708 709 ILB_KSTAT_UPDATE(ilbs, ip_frag_dropped, 1);
709 710 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
710 711 ip_drop_input("ILB fragment", mp, ill);
711 712 freemsg(mp);
712 713 return;
713 714 }
714 715 lb_ret = ilb_check_v4(ilbs, ill, mp, ipha, ipha->ipha_protocol,
715 716 (uint8_t *)ipha + IPH_HDR_LENGTH(ipha), &lb_dst);
716 717
717 718 if (lb_ret == ILB_DROPPED) {
718 719 /* Is this the right counter to increase? */
719 720 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
720 721 ip_drop_input("ILB_DROPPED", mp, ill);
721 722 freemsg(mp);
722 723 return;
723 724 }
724 725 if (lb_ret == ILB_BALANCED) {
725 726 /* Set the dst to that of the chosen server */
726 727 nexthop = lb_dst;
727 728 DB_CKSUMFLAGS(mp) = 0;
728 729 }
729 730 }
730 731
731 732 after_ilb:
732 733 opt_len = ipha->ipha_version_and_hdr_length - IP_SIMPLE_HDR_VERSION;
733 734 ira->ira_ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
734 735 if (opt_len != 0) {
735 736 int error = 0;
736 737
737 738 ira->ira_ip_hdr_length += (opt_len << 2);
738 739 ira->ira_flags |= IRAF_IPV4_OPTIONS;
739 740
740 741 /* IP Options present! Validate the length. */
741 742 mp = ip_check_optlen(mp, ipha, opt_len, pkt_len, ira);
742 743 if (mp == NULL)
743 744 return;
744 745
745 746 /* Might have changed */
746 747 ipha = (ipha_t *)mp->b_rptr;
747 748
748 749 /* Verify IP header checksum before parsing the options */
749 750 if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
750 751 ip_csum_hdr(ipha)) {
751 752 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
752 753 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
753 754 freemsg(mp);
754 755 return;
755 756 }
756 757 ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
757 758
758 759 /*
759 760 * Go off to ip_input_options which returns the next hop
760 761 * destination address, which may have been affected
761 762 * by source routing.
762 763 */
763 764 IP_STAT(ipst, ip_opt);
764 765
765 766 nexthop = ip_input_options(ipha, nexthop, mp, ira, &error);
766 767 if (error != 0) {
767 768 /*
768 769 * An ICMP error has been sent and the packet has
769 770 * been dropped.
770 771 */
771 772 return;
772 773 }
773 774 }
774 775
775 776 if (ill->ill_flags & ILLF_ROUTER)
776 777 irr_flags = IRR_ALLOCATE;
777 778 else
778 779 irr_flags = IRR_NONE;
779 780
780 781 /* Can not use route cache with TX since the labels can differ */
781 782 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
782 783 if (CLASSD(nexthop)) {
783 784 ire = ire_multicast(ill);
784 785 } else {
785 786 /* Match destination and label */
786 787 ire = ire_route_recursive_v4(nexthop, 0, NULL,
787 788 ALL_ZONES, ira->ira_tsl, MATCH_IRE_SECATTR,
788 789 irr_flags, ira->ira_xmit_hint, ipst, NULL, NULL,
789 790 NULL);
790 791 }
791 792 /* Update the route cache so we do the ire_refrele */
792 793 ASSERT(ire != NULL);
793 794 if (rtc->rtc_ire != NULL)
794 795 ire_refrele(rtc->rtc_ire);
795 796 rtc->rtc_ire = ire;
796 797 rtc->rtc_ipaddr = nexthop;
797 798 } else if (nexthop == rtc->rtc_ipaddr && rtc->rtc_ire != NULL) {
798 799 /* Use the route cache */
799 800 ire = rtc->rtc_ire;
800 801 } else {
801 802 /* Update the route cache */
802 803 if (CLASSD(nexthop)) {
803 804 ire = ire_multicast(ill);
804 805 } else {
805 806 /* Just match the destination */
806 807 ire = ire_route_recursive_dstonly_v4(nexthop, irr_flags,
807 808 ira->ira_xmit_hint, ipst);
808 809 }
809 810 ASSERT(ire != NULL);
810 811 if (rtc->rtc_ire != NULL)
811 812 ire_refrele(rtc->rtc_ire);
812 813 rtc->rtc_ire = ire;
813 814 rtc->rtc_ipaddr = nexthop;
814 815 }
815 816
816 817 ire->ire_ib_pkt_count++;
817 818
818 819 /*
819 820 * Based on ire_type and ire_flags call one of:
820 821 * ire_recv_local_v4 - for IRE_LOCAL
821 822 * ire_recv_loopback_v4 - for IRE_LOOPBACK
822 823 * ire_recv_multirt_v4 - if RTF_MULTIRT
823 824 * ire_recv_noroute_v4 - if RTF_REJECT or RTF_BLACHOLE
824 825 * ire_recv_multicast_v4 - for IRE_MULTICAST
825 826 * ire_recv_broadcast_v4 - for IRE_BROADCAST
826 827 * ire_recv_noaccept_v4 - for ire_noaccept ones
827 828 * ire_recv_forward_v4 - for the rest.
828 829 */
829 830 (*ire->ire_recvfn)(ire, mp, ipha, ira);
830 831 }
831 832 #undef rptr
832 833
833 834 /*
834 835 * ire_recvfn for IREs that need forwarding
835 836 */
836 837 void
837 838 ire_recv_forward_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
838 839 {
839 840 ipha_t *ipha = (ipha_t *)iph_arg;
840 841 ill_t *ill = ira->ira_ill;
841 842 ip_stack_t *ipst = ill->ill_ipst;
842 843 ill_t *dst_ill;
843 844 nce_t *nce;
844 845 ipaddr_t src = ipha->ipha_src;
845 846 uint32_t added_tx_len;
846 847 uint32_t mtu, iremtu;
847 848
848 849 if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
849 850 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
850 851 ip_drop_input("l2 multicast not forwarded", mp, ill);
851 852 freemsg(mp);
852 853 return;
853 854 }
854 855
855 856 if (!(ill->ill_flags & ILLF_ROUTER) && !ip_source_routed(ipha, ipst)) {
856 857 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
857 858 ip_drop_input("ipIfStatsForwProhibits", mp, ill);
858 859 freemsg(mp);
859 860 return;
860 861 }
861 862
862 863 /*
863 864 * Either ire_nce_capable or ire_dep_parent would be set for the IRE
864 865 * when it is found by ire_route_recursive, but that some other thread
865 866 * could have changed the routes with the effect of clearing
866 867 * ire_dep_parent. In that case we'd end up dropping the packet, or
867 868 * finding a new nce below.
868 869 * Get, allocate, or update the nce.
869 870 * We get a refhold on ire_nce_cache as a result of this to avoid races
870 871 * where ire_nce_cache is deleted.
871 872 *
872 873 * This ensures that we don't forward if the interface is down since
873 874 * ipif_down removes all the nces.
874 875 */
875 876 mutex_enter(&ire->ire_lock);
876 877 nce = ire->ire_nce_cache;
877 878 if (nce == NULL) {
878 879 /* Not yet set up - try to set one up */
879 880 mutex_exit(&ire->ire_lock);
880 881 (void) ire_revalidate_nce(ire);
881 882 mutex_enter(&ire->ire_lock);
882 883 nce = ire->ire_nce_cache;
883 884 if (nce == NULL) {
884 885 mutex_exit(&ire->ire_lock);
885 886 /* The ire_dep_parent chain went bad, or no memory */
886 887 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
887 888 ip_drop_input("No ire_dep_parent", mp, ill);
888 889 freemsg(mp);
889 890 return;
890 891 }
891 892 }
892 893 nce_refhold(nce);
893 894 mutex_exit(&ire->ire_lock);
894 895
895 896 if (nce->nce_is_condemned) {
896 897 nce_t *nce1;
897 898
898 899 nce1 = ire_handle_condemned_nce(nce, ire, ipha, NULL, B_FALSE);
899 900 nce_refrele(nce);
900 901 if (nce1 == NULL) {
901 902 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
902 903 ip_drop_input("No nce", mp, ill);
903 904 freemsg(mp);
904 905 return;
905 906 }
906 907 nce = nce1;
907 908 }
908 909 dst_ill = nce->nce_ill;
909 910
910 911 /*
911 912 * Unless we are forwarding, drop the packet.
912 913 * We have to let source routed packets through if they go out
913 914 * the same interface i.e., they are 'ping -l' packets.
914 915 */
915 916 if (!(dst_ill->ill_flags & ILLF_ROUTER) &&
916 917 !(ip_source_routed(ipha, ipst) && dst_ill == ill)) {
917 918 if (ip_source_routed(ipha, ipst)) {
918 919 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
919 920 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
920 921 nce_refrele(nce);
921 922 return;
922 923 }
923 924 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
924 925 ip_drop_input("ipIfStatsForwProhibits", mp, ill);
925 926 freemsg(mp);
926 927 nce_refrele(nce);
927 928 return;
928 929 }
929 930
930 931 if (ire->ire_zoneid != GLOBAL_ZONEID && ire->ire_zoneid != ALL_ZONES) {
931 932 ipaddr_t dst = ipha->ipha_dst;
932 933
933 934 ire->ire_ib_pkt_count--;
934 935 /*
935 936 * Should only use IREs that are visible from the
936 937 * global zone for forwarding.
937 938 * Take a source route into account the same way as ip_input
938 939 * did.
939 940 */
940 941 if (ira->ira_flags & IRAF_IPV4_OPTIONS) {
941 942 int error = 0;
942 943
943 944 dst = ip_input_options(ipha, dst, mp, ira, &error);
944 945 ASSERT(error == 0); /* ip_input checked */
945 946 }
946 947 ire = ire_route_recursive_v4(dst, 0, NULL, GLOBAL_ZONEID,
947 948 ira->ira_tsl, MATCH_IRE_SECATTR,
948 949 (ill->ill_flags & ILLF_ROUTER) ? IRR_ALLOCATE : IRR_NONE,
949 950 ira->ira_xmit_hint, ipst, NULL, NULL, NULL);
950 951 ire->ire_ib_pkt_count++;
951 952 (*ire->ire_recvfn)(ire, mp, ipha, ira);
952 953 ire_refrele(ire);
953 954 nce_refrele(nce);
954 955 return;
955 956 }
956 957
957 958 /*
958 959 * ipIfStatsHCInForwDatagrams should only be increment if there
959 960 * will be an attempt to forward the packet, which is why we
960 961 * increment after the above condition has been checked.
961 962 */
962 963 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
963 964
964 965 /* Initiate Read side IPPF processing */
965 966 if (IPP_ENABLED(IPP_FWD_IN, ipst)) {
966 967 /* ip_process translates an IS_UNDER_IPMP */
967 968 mp = ip_process(IPP_FWD_IN, mp, ill, ill);
968 969 if (mp == NULL) {
969 970 /* ip_drop_packet and MIB done */
970 971 ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred "
971 972 "during IPPF processing\n"));
972 973 nce_refrele(nce);
973 974 return;
974 975 }
975 976 }
976 977
977 978 DTRACE_PROBE4(ip4__forwarding__start,
978 979 ill_t *, ill, ill_t *, dst_ill, ipha_t *, ipha, mblk_t *, mp);
979 980
980 981 if (HOOKS4_INTERESTED_FORWARDING(ipst)) {
981 982 int error;
982 983
983 984 FW_HOOKS(ipst->ips_ip4_forwarding_event,
984 985 ipst->ips_ipv4firewall_forwarding,
985 986 ill, dst_ill, ipha, mp, mp, 0, ipst, error);
986 987
987 988 DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp);
988 989
989 990 if (mp == NULL) {
990 991 nce_refrele(nce);
991 992 return;
992 993 }
993 994 /*
994 995 * Even if the destination was changed by the filter we use the
995 996 * forwarding decision that was made based on the address
996 997 * in ip_input.
997 998 */
998 999
999 1000 /* Might have changed */
1000 1001 ipha = (ipha_t *)mp->b_rptr;
1001 1002 ira->ira_pktlen = ntohs(ipha->ipha_length);
1002 1003 }
1003 1004
1004 1005 /* Packet is being forwarded. Turning off hwcksum flag. */
1005 1006 DB_CKSUMFLAGS(mp) = 0;
1006 1007
1007 1008 /*
1008 1009 * Martian Address Filtering [RFC 1812, Section 5.3.7]
1009 1010 * The loopback address check for both src and dst has already
1010 1011 * been checked in ip_input
1011 1012 * In the future one can envision adding RPF checks using number 3.
1012 1013 * If we already checked the same source address we can skip this.
1013 1014 */
1014 1015 if (!(ira->ira_flags & IRAF_VERIFIED_SRC) ||
1015 1016 src != ira->ira_verified_src) {
1016 1017 switch (ipst->ips_src_check) {
1017 1018 case 0:
1018 1019 break;
1019 1020 case 2:
1020 1021 if (ip_type_v4(src, ipst) == IRE_BROADCAST) {
1021 1022 BUMP_MIB(ill->ill_ip_mib,
1022 1023 ipIfStatsForwProhibits);
1023 1024 BUMP_MIB(ill->ill_ip_mib,
1024 1025 ipIfStatsInAddrErrors);
1025 1026 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1026 1027 freemsg(mp);
1027 1028 nce_refrele(nce);
1028 1029 return;
1029 1030 }
1030 1031 /* FALLTHRU */
1031 1032
1032 1033 case 1:
1033 1034 if (CLASSD(src)) {
1034 1035 BUMP_MIB(ill->ill_ip_mib,
1035 1036 ipIfStatsForwProhibits);
1036 1037 BUMP_MIB(ill->ill_ip_mib,
1037 1038 ipIfStatsInAddrErrors);
1038 1039 ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1039 1040 freemsg(mp);
1040 1041 nce_refrele(nce);
1041 1042 return;
1042 1043 }
1043 1044 break;
1044 1045 }
1045 1046 /* Remember for next packet */
1046 1047 ira->ira_flags |= IRAF_VERIFIED_SRC;
1047 1048 ira->ira_verified_src = src;
1048 1049 }
1049 1050
1050 1051 /*
1051 1052 * Check if packet is going out the same link on which it arrived.
1052 1053 * Means we might need to send a redirect.
1053 1054 */
1054 1055 if (IS_ON_SAME_LAN(dst_ill, ill) && ipst->ips_ip_g_send_redirects) {
1055 1056 ip_send_potential_redirect_v4(mp, ipha, ire, ira);
1056 1057 }
1057 1058
1058 1059 added_tx_len = 0;
1059 1060 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
1060 1061 mblk_t *mp1;
1061 1062 uint32_t old_pkt_len = ira->ira_pktlen;
1062 1063
1063 1064 /* Verify IP header checksum before adding/removing options */
1064 1065 if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
1065 1066 ip_csum_hdr(ipha)) {
1066 1067 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1067 1068 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1068 1069 freemsg(mp);
1069 1070 nce_refrele(nce);
1070 1071 return;
1071 1072 }
1072 1073 ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
1073 1074
1074 1075 /*
1075 1076 * Check if it can be forwarded and add/remove
1076 1077 * CIPSO options as needed.
1077 1078 */
1078 1079 if ((mp1 = tsol_ip_forward(ire, mp, ira)) == NULL) {
1079 1080 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1080 1081 ip_drop_input("tsol_ip_forward", mp, ill);
1081 1082 freemsg(mp);
1082 1083 nce_refrele(nce);
1083 1084 return;
1084 1085 }
1085 1086 /*
1086 1087 * Size may have changed. Remember amount added in case
1087 1088 * IP needs to send an ICMP too big.
1088 1089 */
1089 1090 mp = mp1;
1090 1091 ipha = (ipha_t *)mp->b_rptr;
1091 1092 ira->ira_pktlen = ntohs(ipha->ipha_length);
1092 1093 ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
1093 1094 if (ira->ira_pktlen > old_pkt_len)
1094 1095 added_tx_len = ira->ira_pktlen - old_pkt_len;
1095 1096
1096 1097 /* Options can have been added or removed */
1097 1098 if (ira->ira_ip_hdr_length != IP_SIMPLE_HDR_LENGTH)
1098 1099 ira->ira_flags |= IRAF_IPV4_OPTIONS;
1099 1100 else
1100 1101 ira->ira_flags &= ~IRAF_IPV4_OPTIONS;
1101 1102 }
1102 1103
1103 1104 mtu = dst_ill->ill_mtu;
1104 1105 if ((iremtu = ire->ire_metrics.iulp_mtu) != 0 && iremtu < mtu)
1105 1106 mtu = iremtu;
1106 1107 ip_forward_xmit_v4(nce, ill, mp, ipha, ira, mtu, added_tx_len);
1107 1108 nce_refrele(nce);
1108 1109 }
1109 1110
1110 1111 /*
1111 1112 * Used for sending out unicast and multicast packets that are
1112 1113 * forwarded.
1113 1114 */
1114 1115 void
1115 1116 ip_forward_xmit_v4(nce_t *nce, ill_t *ill, mblk_t *mp, ipha_t *ipha,
1116 1117 ip_recv_attr_t *ira, uint32_t mtu, uint32_t added_tx_len)
1117 1118 {
1118 1119 ill_t *dst_ill = nce->nce_ill;
1119 1120 uint32_t pkt_len;
1120 1121 uint32_t sum;
1121 1122 iaflags_t iraflags = ira->ira_flags;
1122 1123 ip_stack_t *ipst = ill->ill_ipst;
1123 1124 iaflags_t ixaflags;
1124 1125
1125 1126 if (ipha->ipha_ttl <= 1) {
1126 1127 /* Perhaps the checksum was bad */
1127 1128 if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1128 1129 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1129 1130 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1130 1131 freemsg(mp);
1131 1132 return;
1132 1133 }
1133 1134 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1134 1135 ip_drop_input("ICMP_TTL_EXCEEDED", mp, ill);
1135 1136 icmp_time_exceeded(mp, ICMP_TTL_EXCEEDED, ira);
1136 1137 return;
1137 1138 }
1138 1139 ipha->ipha_ttl--;
1139 1140 /* Adjust the checksum to reflect the ttl decrement. */
1140 1141 sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST;
1141 1142 ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16));
1142 1143
1143 1144 /* Check if there are options to update */
1144 1145 if (iraflags & IRAF_IPV4_OPTIONS) {
1145 1146 ASSERT(ipha->ipha_version_and_hdr_length !=
1146 1147 IP_SIMPLE_HDR_VERSION);
1147 1148 ASSERT(!(iraflags & IRAF_VERIFY_IP_CKSUM));
1148 1149
1149 1150 if (!ip_forward_options(mp, ipha, dst_ill, ira)) {
1150 1151 /* ipIfStatsForwProhibits and ip_drop_input done */
1151 1152 return;
1152 1153 }
1153 1154
1154 1155 ipha->ipha_hdr_checksum = 0;
1155 1156 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1156 1157 }
1157 1158
1158 1159 /* Initiate Write side IPPF processing before any fragmentation */
1159 1160 if (IPP_ENABLED(IPP_FWD_OUT, ipst)) {
1160 1161 /* ip_process translates an IS_UNDER_IPMP */
1161 1162 mp = ip_process(IPP_FWD_OUT, mp, dst_ill, dst_ill);
1162 1163 if (mp == NULL) {
1163 1164 /* ip_drop_packet and MIB done */
1164 1165 ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred" \
1165 1166 " during IPPF processing\n"));
1166 1167 return;
1167 1168 }
1168 1169 }
1169 1170
1170 1171 pkt_len = ira->ira_pktlen;
1171 1172
1172 1173 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsHCOutForwDatagrams);
1173 1174
1174 1175 ixaflags = IXAF_IS_IPV4 | IXAF_NO_DEV_FLOW_CTL;
1175 1176
1176 1177 if (pkt_len > mtu) {
1177 1178 /*
1178 1179 * It needs fragging on its way out. If we haven't
1179 1180 * verified the header checksum yet we do it now since
1180 1181 * are going to put a surely good checksum in the
1181 1182 * outgoing header, we have to make sure that it
1182 1183 * was good coming in.
1183 1184 */
1184 1185 if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1185 1186 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1186 1187 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1187 1188 freemsg(mp);
1188 1189 return;
1189 1190 }
1190 1191 if (ipha->ipha_fragment_offset_and_flags & IPH_DF_HTONS) {
1191 1192 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutFragFails);
1192 1193 ip_drop_output("ipIfStatsOutFragFails", mp, dst_ill);
1193 1194 if (iraflags & IRAF_SYSTEM_LABELED) {
1194 1195 /*
1195 1196 * Remove any CIPSO option added by
1196 1197 * tsol_ip_forward, and make sure we report
1197 1198 * a path MTU so that there
1198 1199 * is room to add such a CIPSO option for future
1199 1200 * packets.
1200 1201 */
1201 1202 mtu = tsol_pmtu_adjust(mp, mtu, added_tx_len,
1202 1203 AF_INET);
1203 1204 }
1204 1205
1205 1206 icmp_frag_needed(mp, mtu, ira);
1206 1207 return;
1207 1208 }
1208 1209
1209 1210 (void) ip_fragment_v4(mp, nce, ixaflags, pkt_len, mtu,
1210 1211 ira->ira_xmit_hint, GLOBAL_ZONEID, 0, ip_xmit, NULL);
1211 1212 return;
1212 1213 }
1213 1214
1214 1215 ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length));
1215 1216 if (iraflags & IRAF_LOOPBACK_COPY) {
1216 1217 /*
1217 1218 * IXAF_NO_LOOP_ZONEID is not set hence 7th arg
1218 1219 * is don't care
1219 1220 */
1220 1221 (void) ip_postfrag_loopcheck(mp, nce,
1221 1222 ixaflags | IXAF_LOOPBACK_COPY,
1222 1223 pkt_len, ira->ira_xmit_hint, GLOBAL_ZONEID, 0, NULL);
1223 1224 } else {
1224 1225 (void) ip_xmit(mp, nce, ixaflags, pkt_len, ira->ira_xmit_hint,
1225 1226 GLOBAL_ZONEID, 0, NULL);
1226 1227 }
1227 1228 }
1228 1229
1229 1230 /*
1230 1231 * ire_recvfn for RTF_REJECT and RTF_BLACKHOLE routes, including IRE_NOROUTE,
1231 1232 * which is what ire_route_recursive returns when there is no matching ire.
1232 1233 * Send ICMP unreachable unless blackhole.
1233 1234 */
1234 1235 void
1235 1236 ire_recv_noroute_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1236 1237 {
1237 1238 ipha_t *ipha = (ipha_t *)iph_arg;
1238 1239 ill_t *ill = ira->ira_ill;
1239 1240 ip_stack_t *ipst = ill->ill_ipst;
1240 1241
1241 1242 /* Would we have forwarded this packet if we had a route? */
1242 1243 if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
1243 1244 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1244 1245 ip_drop_input("l2 multicast not forwarded", mp, ill);
1245 1246 freemsg(mp);
1246 1247 return;
1247 1248 }
1248 1249
1249 1250 if (!(ill->ill_flags & ILLF_ROUTER)) {
1250 1251 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1251 1252 ip_drop_input("ipIfStatsForwProhibits", mp, ill);
1252 1253 freemsg(mp);
1253 1254 return;
1254 1255 }
1255 1256 /*
1256 1257 * If we had a route this could have been forwarded. Count as such.
1257 1258 *
1258 1259 * ipIfStatsHCInForwDatagrams should only be increment if there
1259 1260 * will be an attempt to forward the packet, which is why we
1260 1261 * increment after the above condition has been checked.
1261 1262 */
1262 1263 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
1263 1264
1264 1265 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1265 1266
1266 1267 ip_rts_change(RTM_MISS, ipha->ipha_dst, 0, 0, 0, 0, 0, 0, RTA_DST,
1267 1268 ipst);
1268 1269
1269 1270 if (ire->ire_flags & RTF_BLACKHOLE) {
1270 1271 ip_drop_input("ipIfStatsInNoRoutes RTF_BLACKHOLE", mp, ill);
1271 1272 freemsg(mp);
1272 1273 } else {
1273 1274 ip_drop_input("ipIfStatsInNoRoutes RTF_REJECT", mp, ill);
1274 1275
1275 1276 if (ip_source_routed(ipha, ipst)) {
1276 1277 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
1277 1278 } else {
1278 1279 icmp_unreachable(mp, ICMP_HOST_UNREACHABLE, ira);
1279 1280 }
1280 1281 }
1281 1282 }
1282 1283
1283 1284 /*
1284 1285 * ire_recvfn for IRE_LOCALs marked with ire_noaccept. Such IREs are used for
1285 1286 * VRRP when in noaccept mode.
1286 1287 * We silently drop the packet. ARP handles packets even if noaccept is set.
1287 1288 */
1288 1289 /* ARGSUSED */
1289 1290 void
1290 1291 ire_recv_noaccept_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1291 1292 ip_recv_attr_t *ira)
1292 1293 {
1293 1294 ill_t *ill = ira->ira_ill;
1294 1295
1295 1296 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1296 1297 ip_drop_input("ipIfStatsInDiscards - noaccept", mp, ill);
1297 1298 freemsg(mp);
1298 1299 }
1299 1300
1300 1301 /*
1301 1302 * ire_recvfn for IRE_BROADCAST.
1302 1303 */
1303 1304 void
1304 1305 ire_recv_broadcast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1305 1306 ip_recv_attr_t *ira)
1306 1307 {
1307 1308 ipha_t *ipha = (ipha_t *)iph_arg;
1308 1309 ill_t *ill = ira->ira_ill;
1309 1310 ill_t *dst_ill = ire->ire_ill;
1310 1311 ip_stack_t *ipst = ill->ill_ipst;
1311 1312 ire_t *alt_ire;
1312 1313 nce_t *nce;
1313 1314 ipaddr_t ipha_dst;
1314 1315
1315 1316 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInBcastPkts);
1316 1317
1317 1318 /* Tag for higher-level protocols */
1318 1319 ira->ira_flags |= IRAF_BROADCAST;
1319 1320
1320 1321 /*
1321 1322 * Whether local or directed broadcast forwarding: don't allow
1322 1323 * for TCP.
1323 1324 */
1324 1325 if (ipha->ipha_protocol == IPPROTO_TCP) {
1325 1326 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1326 1327 ip_drop_input("ipIfStatsInDiscards", mp, ill);
1327 1328 freemsg(mp);
1328 1329 return;
1329 1330 }
1330 1331
1331 1332 /*
1332 1333 * So that we don't end up with dups, only one ill an IPMP group is
1333 1334 * nominated to receive broadcast traffic.
1334 1335 * If we have no cast_ill we are liberal and accept everything.
1335 1336 */
1336 1337 if (IS_UNDER_IPMP(ill)) {
1337 1338 /* For an under ill_grp can change under lock */
1338 1339 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1339 1340 if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1340 1341 ill->ill_grp->ig_cast_ill != NULL) {
1341 1342 rw_exit(&ipst->ips_ill_g_lock);
1342 1343 /* No MIB since this is normal operation */
1343 1344 ip_drop_input("not nom_cast", mp, ill);
1344 1345 freemsg(mp);
1345 1346 return;
1346 1347 }
1347 1348 rw_exit(&ipst->ips_ill_g_lock);
1348 1349
1349 1350 ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1350 1351 }
1351 1352
1352 1353 /*
1353 1354 * After reassembly and IPsec we will need to duplicate the
1354 1355 * broadcast packet for all matching zones on the ill.
1355 1356 */
1356 1357 ira->ira_zoneid = ALL_ZONES;
1357 1358
1358 1359 /*
1359 1360 * Check for directed broadcast i.e. ire->ire_ill is different than
1360 1361 * the incoming ill.
1361 1362 * The same broadcast address can be assigned to multiple interfaces
1362 1363 * so have to check explicitly for that case by looking up the alt_ire
1363 1364 */
1364 1365 if (dst_ill == ill && !(ire->ire_flags & RTF_MULTIRT)) {
1365 1366 /* Reassemble on the ill on which the packet arrived */
1366 1367 ip_input_local_v4(ire, mp, ipha, ira);
1367 1368 /* Restore */
1368 1369 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1369 1370 return;
1370 1371 }
1371 1372
1372 1373 /* Is there an IRE_BROADCAST on the incoming ill? */
1373 1374 ipha_dst = ((ira->ira_flags & IRAF_DHCP_UNICAST) ? INADDR_BROADCAST :
1374 1375 ipha->ipha_dst);
1375 1376 alt_ire = ire_ftable_lookup_v4(ipha_dst, 0, 0, IRE_BROADCAST, ill,
1376 1377 ALL_ZONES, ira->ira_tsl,
1377 1378 MATCH_IRE_TYPE|MATCH_IRE_ILL|MATCH_IRE_SECATTR, 0, ipst, NULL);
1378 1379 if (alt_ire != NULL) {
1379 1380 /* Not a directed broadcast */
1380 1381 /*
1381 1382 * In the special case of multirouted broadcast
1382 1383 * packets, we unconditionally need to "gateway"
1383 1384 * them to the appropriate interface here so that reassembly
1384 1385 * works. We know that the IRE_BROADCAST on cgtp0 doesn't
1385 1386 * have RTF_MULTIRT set so we look for such an IRE in the
1386 1387 * bucket.
1387 1388 */
1388 1389 if (alt_ire->ire_flags & RTF_MULTIRT) {
1389 1390 irb_t *irb;
1390 1391 ire_t *ire1;
1391 1392
1392 1393 irb = ire->ire_bucket;
1393 1394 irb_refhold(irb);
1394 1395 for (ire1 = irb->irb_ire; ire1 != NULL;
1395 1396 ire1 = ire1->ire_next) {
1396 1397 if (IRE_IS_CONDEMNED(ire1))
1397 1398 continue;
1398 1399 if (!(ire1->ire_type & IRE_BROADCAST) ||
1399 1400 (ire1->ire_flags & RTF_MULTIRT))
1400 1401 continue;
1401 1402 ill = ire1->ire_ill;
1402 1403 ill_refhold(ill);
1403 1404 break;
1404 1405 }
1405 1406 irb_refrele(irb);
1406 1407 if (ire1 != NULL) {
1407 1408 ill_t *orig_ill = ira->ira_ill;
1408 1409
1409 1410 ire_refrele(alt_ire);
1410 1411 /* Reassemble on the new ill */
1411 1412 ira->ira_ill = ill;
1412 1413 ip_input_local_v4(ire, mp, ipha, ira);
1413 1414 ill_refrele(ill);
1414 1415 /* Restore */
1415 1416 ira->ira_ill = orig_ill;
1416 1417 ira->ira_ruifindex =
1417 1418 orig_ill->ill_phyint->phyint_ifindex;
1418 1419 return;
1419 1420 }
1420 1421 }
1421 1422 ire_refrele(alt_ire);
1422 1423 /* Reassemble on the ill on which the packet arrived */
1423 1424 ip_input_local_v4(ire, mp, ipha, ira);
1424 1425 goto done;
1425 1426 }
1426 1427
1427 1428 /*
1428 1429 * This is a directed broadcast
1429 1430 *
1430 1431 * If directed broadcast is allowed, then forward the packet out
1431 1432 * the destination interface with IXAF_LOOPBACK_COPY set. That will
1432 1433 * result in ip_input() receiving a copy of the packet on the
1433 1434 * appropriate ill. (We could optimize this to avoid the extra trip
1434 1435 * via ip_input(), but since directed broadcasts are normally disabled
1435 1436 * it doesn't make sense to optimize it.)
1436 1437 */
1437 1438 if (!ipst->ips_ip_g_forward_directed_bcast ||
1438 1439 (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST))) {
1439 1440 ip_drop_input("directed broadcast not allowed", mp, ill);
1440 1441 freemsg(mp);
1441 1442 goto done;
1442 1443 }
1443 1444 if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1444 1445 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1445 1446 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1446 1447 freemsg(mp);
1447 1448 goto done;
1448 1449 }
1449 1450
1450 1451 /*
1451 1452 * Clear the indication that this may have hardware
1452 1453 * checksum as we are not using it for forwarding.
1453 1454 */
1454 1455 DB_CKSUMFLAGS(mp) = 0;
1455 1456
1456 1457 /*
1457 1458 * Adjust ttl to 2 (1+1 - the forward engine will decrement it by one.
1458 1459 */
1459 1460 ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl + 1;
1460 1461 ipha->ipha_hdr_checksum = 0;
1461 1462 ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1462 1463
1463 1464 /*
1464 1465 * We use ip_forward_xmit to do any fragmentation.
1465 1466 * and loopback copy on the outbound interface.
1466 1467 *
1467 1468 * Make it so that IXAF_LOOPBACK_COPY to be set on transmit side.
1468 1469 */
1469 1470 ira->ira_flags |= IRAF_LOOPBACK_COPY;
1470 1471
1471 1472 nce = arp_nce_init(dst_ill, ipha->ipha_dst, IRE_BROADCAST);
1472 1473 if (nce == NULL) {
1473 1474 BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutDiscards);
1474 1475 ip_drop_output("No nce", mp, dst_ill);
1475 1476 freemsg(mp);
1476 1477 goto done;
1477 1478 }
1478 1479
1479 1480 ip_forward_xmit_v4(nce, ill, mp, ipha, ira, dst_ill->ill_mc_mtu, 0);
1480 1481 nce_refrele(nce);
1481 1482 done:
1482 1483 /* Restore */
1483 1484 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1484 1485 }
1485 1486
1486 1487 /*
1487 1488 * ire_recvfn for IRE_MULTICAST.
1488 1489 */
1489 1490 void
1490 1491 ire_recv_multicast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1491 1492 ip_recv_attr_t *ira)
1492 1493 {
1493 1494 ipha_t *ipha = (ipha_t *)iph_arg;
1494 1495 ill_t *ill = ira->ira_ill;
1495 1496 ip_stack_t *ipst = ill->ill_ipst;
1496 1497
1497 1498 ASSERT(ire->ire_ill == ira->ira_ill);
1498 1499
1499 1500 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts);
1500 1501 UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets, ira->ira_pktlen);
1501 1502
1502 1503 /* RSVP hook */
1503 1504 if (ira->ira_flags & IRAF_RSVP)
1504 1505 goto forus;
1505 1506
1506 1507 /* Tag for higher-level protocols */
1507 1508 ira->ira_flags |= IRAF_MULTICAST;
1508 1509
1509 1510 /*
1510 1511 * So that we don't end up with dups, only one ill an IPMP group is
1511 1512 * nominated to receive multicast traffic.
1512 1513 * If we have no cast_ill we are liberal and accept everything.
1513 1514 */
1514 1515 if (IS_UNDER_IPMP(ill)) {
1515 1516 ip_stack_t *ipst = ill->ill_ipst;
1516 1517
1517 1518 /* For an under ill_grp can change under lock */
1518 1519 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1519 1520 if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1520 1521 ill->ill_grp->ig_cast_ill != NULL) {
1521 1522 rw_exit(&ipst->ips_ill_g_lock);
1522 1523 ip_drop_input("not on cast ill", mp, ill);
1523 1524 freemsg(mp);
1524 1525 return;
1525 1526 }
1526 1527 rw_exit(&ipst->ips_ill_g_lock);
1527 1528 /*
1528 1529 * We switch to the upper ill so that mrouter and hasmembers
1529 1530 * can operate on upper here and in ip_input_multicast.
1530 1531 */
1531 1532 ill = ipmp_ill_hold_ipmp_ill(ill);
1532 1533 if (ill != NULL) {
1533 1534 ASSERT(ill != ira->ira_ill);
1534 1535 ASSERT(ire->ire_ill == ira->ira_ill);
1535 1536 ira->ira_ill = ill;
1536 1537 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1537 1538 } else {
1538 1539 ill = ira->ira_ill;
1539 1540 }
1540 1541 }
1541 1542
1542 1543 /*
1543 1544 * Check if we are a multicast router - send ip_mforward a copy of
1544 1545 * the packet.
1545 1546 * Due to mroute_decap tunnels we consider forwarding packets even if
1546 1547 * mrouted has not joined the allmulti group on this interface.
1547 1548 */
1548 1549 if (ipst->ips_ip_g_mrouter) {
1549 1550 int retval;
1550 1551
1551 1552 /*
1552 1553 * Clear the indication that this may have hardware
1553 1554 * checksum as we are not using it for forwarding.
1554 1555 */
1555 1556 DB_CKSUMFLAGS(mp) = 0;
1556 1557
1557 1558 /*
1558 1559 * ip_mforward helps us make these distinctions: If received
1559 1560 * on tunnel and not IGMP, then drop.
1560 1561 * If IGMP packet, then don't check membership
1561 1562 * If received on a phyint and IGMP or PIM, then
1562 1563 * don't check membership
1563 1564 */
1564 1565 retval = ip_mforward(mp, ira);
1565 1566 /* ip_mforward updates mib variables if needed */
1566 1567
1567 1568 switch (retval) {
1568 1569 case 0:
1569 1570 /*
1570 1571 * pkt is okay and arrived on phyint.
1571 1572 *
1572 1573 * If we are running as a multicast router
1573 1574 * we need to see all IGMP and/or PIM packets.
1574 1575 */
1575 1576 if ((ipha->ipha_protocol == IPPROTO_IGMP) ||
1576 1577 (ipha->ipha_protocol == IPPROTO_PIM)) {
1577 1578 goto forus;
1578 1579 }
1579 1580 break;
1580 1581 case -1:
1581 1582 /* pkt is mal-formed, toss it */
1582 1583 freemsg(mp);
1583 1584 goto done;
1584 1585 case 1:
1585 1586 /*
1586 1587 * pkt is okay and arrived on a tunnel
1587 1588 *
1588 1589 * If we are running a multicast router
1589 1590 * we need to see all igmp packets.
1590 1591 */
1591 1592 if (ipha->ipha_protocol == IPPROTO_IGMP) {
1592 1593 goto forus;
1593 1594 }
1594 1595 ip_drop_input("Multicast on tunnel ignored", mp, ill);
1595 1596 freemsg(mp);
1596 1597 goto done;
1597 1598 }
1598 1599 }
1599 1600
1600 1601 /*
1601 1602 * Check if we have members on this ill. This is not necessary for
1602 1603 * correctness because even if the NIC/GLD had a leaky filter, we
1603 1604 * filter before passing to each conn_t.
1604 1605 */
1605 1606 if (!ill_hasmembers_v4(ill, ipha->ipha_dst)) {
1606 1607 /*
1607 1608 * Nobody interested
1608 1609 *
1609 1610 * This might just be caused by the fact that
1610 1611 * multiple IP Multicast addresses map to the same
1611 1612 * link layer multicast - no need to increment counter!
1612 1613 */
1613 1614 ip_drop_input("Multicast with no members", mp, ill);
1614 1615 freemsg(mp);
1615 1616 goto done;
1616 1617 }
1617 1618 forus:
1618 1619 ip2dbg(("ire_recv_multicast_v4: multicast for us: 0x%x\n",
1619 1620 ntohl(ipha->ipha_dst)));
1620 1621
1621 1622 /*
1622 1623 * After reassembly and IPsec we will need to duplicate the
1623 1624 * multicast packet for all matching zones on the ill.
1624 1625 */
1625 1626 ira->ira_zoneid = ALL_ZONES;
1626 1627
1627 1628 /* Reassemble on the ill on which the packet arrived */
1628 1629 ip_input_local_v4(ire, mp, ipha, ira);
1629 1630 done:
1630 1631 if (ill != ire->ire_ill) {
1631 1632 ill_refrele(ill);
1632 1633 ira->ira_ill = ire->ire_ill;
1633 1634 ira->ira_ruifindex = ira->ira_ill->ill_phyint->phyint_ifindex;
1634 1635 }
1635 1636 }
1636 1637
1637 1638 /*
1638 1639 * ire_recvfn for IRE_OFFLINK with RTF_MULTIRT.
1639 1640 * Drop packets since we don't forward out multirt routes.
1640 1641 */
1641 1642 /* ARGSUSED */
1642 1643 void
1643 1644 ire_recv_multirt_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1644 1645 {
1645 1646 ill_t *ill = ira->ira_ill;
1646 1647
1647 1648 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1648 1649 ip_drop_input("Not forwarding out MULTIRT", mp, ill);
1649 1650 freemsg(mp);
1650 1651 }
1651 1652
1652 1653 /*
1653 1654 * ire_recvfn for IRE_LOOPBACK. This is only used when a FW_HOOK
1654 1655 * has rewritten the packet to have a loopback destination address (We
1655 1656 * filter out packet with a loopback destination from arriving over the wire).
1656 1657 * We don't know what zone to use, thus we always use the GLOBAL_ZONEID.
1657 1658 */
1658 1659 void
1659 1660 ire_recv_loopback_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1660 1661 {
1661 1662 ipha_t *ipha = (ipha_t *)iph_arg;
1662 1663 ill_t *ill = ira->ira_ill;
1663 1664 ill_t *ire_ill = ire->ire_ill;
1664 1665
1665 1666 ira->ira_zoneid = GLOBAL_ZONEID;
1666 1667
1667 1668 /* Switch to the lo0 ill for further processing */
1668 1669 if (ire_ill != ill) {
1669 1670 /*
1670 1671 * Update ira_ill to be the ILL on which the IP address
1671 1672 * is hosted.
1672 1673 * No need to hold the ill since we have a hold on the ire
1673 1674 */
1674 1675 ASSERT(ira->ira_ill == ira->ira_rill);
1675 1676 ira->ira_ill = ire_ill;
1676 1677
1677 1678 ip_input_local_v4(ire, mp, ipha, ira);
1678 1679
1679 1680 /* Restore */
1680 1681 ASSERT(ira->ira_ill == ire_ill);
1681 1682 ira->ira_ill = ill;
1682 1683 return;
1683 1684
1684 1685 }
1685 1686 ip_input_local_v4(ire, mp, ipha, ira);
1686 1687 }
1687 1688
1688 1689 /*
1689 1690 * ire_recvfn for IRE_LOCAL.
1690 1691 */
1691 1692 void
1692 1693 ire_recv_local_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1693 1694 {
1694 1695 ipha_t *ipha = (ipha_t *)iph_arg;
1695 1696 ill_t *ill = ira->ira_ill;
1696 1697 ill_t *ire_ill = ire->ire_ill;
1697 1698
1698 1699 /* Make a note for DAD that this address is in use */
1699 1700 ire->ire_last_used_time = LBOLT_FASTPATH;
1700 1701
1701 1702 /* Only target the IRE_LOCAL with the right zoneid. */
1702 1703 ira->ira_zoneid = ire->ire_zoneid;
1703 1704
1704 1705 /*
1705 1706 * If the packet arrived on the wrong ill, we check that
1706 1707 * this is ok.
1707 1708 * If it is, then we ensure that we do the reassembly on
1708 1709 * the ill on which the address is hosted. We keep ira_rill as
1709 1710 * the one on which the packet arrived, so that IP_PKTINFO and
1710 1711 * friends can report this.
1711 1712 */
1712 1713 if (ire_ill != ill) {
1713 1714 ire_t *new_ire;
1714 1715
1715 1716 new_ire = ip_check_multihome(&ipha->ipha_dst, ire, ill);
1716 1717 if (new_ire == NULL) {
1717 1718 /* Drop packet */
1718 1719 BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1719 1720 ip_drop_input("ipIfStatsInForwProhibits", mp, ill);
1720 1721 freemsg(mp);
1721 1722 return;
1722 1723 }
1723 1724 /*
1724 1725 * Update ira_ill to be the ILL on which the IP address
1725 1726 * is hosted. No need to hold the ill since we have a
1726 1727 * hold on the ire. Note that we do the switch even if
1727 1728 * new_ire == ire (for IPMP, ire would be the one corresponding
1728 1729 * to the IPMP ill).
1729 1730 */
1730 1731 ASSERT(ira->ira_ill == ira->ira_rill);
1731 1732 ira->ira_ill = new_ire->ire_ill;
1732 1733
1733 1734 /* ira_ruifindex tracks the upper for ira_rill */
1734 1735 if (IS_UNDER_IPMP(ill))
1735 1736 ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1736 1737
1737 1738 ip_input_local_v4(new_ire, mp, ipha, ira);
1738 1739
1739 1740 /* Restore */
1740 1741 ASSERT(ira->ira_ill == new_ire->ire_ill);
1741 1742 ira->ira_ill = ill;
1742 1743 ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1743 1744
1744 1745 if (new_ire != ire)
1745 1746 ire_refrele(new_ire);
1746 1747 return;
1747 1748 }
1748 1749
1749 1750 ip_input_local_v4(ire, mp, ipha, ira);
1750 1751 }
1751 1752
1752 1753 /*
1753 1754 * Common function for packets arriving for the host. Handles
1754 1755 * checksum verification, reassembly checks, etc.
1755 1756 */
1756 1757 static void
1757 1758 ip_input_local_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1758 1759 {
1759 1760 ill_t *ill = ira->ira_ill;
1760 1761 iaflags_t iraflags = ira->ira_flags;
1761 1762
1762 1763 /*
1763 1764 * Verify IP header checksum. If the packet was AH or ESP then
1764 1765 * this flag has already been cleared. Likewise if the packet
1765 1766 * had a hardware checksum.
1766 1767 */
1767 1768 if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1768 1769 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1769 1770 ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1770 1771 freemsg(mp);
1771 1772 return;
1772 1773 }
1773 1774
1774 1775 if (iraflags & IRAF_IPV4_OPTIONS) {
1775 1776 if (!ip_input_local_options(mp, ipha, ira)) {
1776 1777 /* Error has been sent and mp consumed */
1777 1778 return;
1778 1779 }
1779 1780 /*
1780 1781 * Some old hardware does partial checksum by including the
1781 1782 * whole IP header, so the partial checksum value might have
1782 1783 * become invalid if any option in the packet have been
1783 1784 * updated. Always clear partial checksum flag here.
1784 1785 */
1785 1786 DB_CKSUMFLAGS(mp) &= ~HCK_PARTIALCKSUM;
1786 1787 }
1787 1788
1788 1789 /*
1789 1790 * Is packet part of fragmented IP packet?
1790 1791 * We compare against defined values in network byte order
1791 1792 */
1792 1793 if (ipha->ipha_fragment_offset_and_flags &
1793 1794 (IPH_MF_HTONS | IPH_OFFSET_HTONS)) {
1794 1795 /*
1795 1796 * Make sure we have ira_l2src before we loose the original
1796 1797 * mblk
1797 1798 */
1798 1799 if (!(ira->ira_flags & IRAF_L2SRC_SET))
1799 1800 ip_setl2src(mp, ira, ira->ira_rill);
1800 1801
1801 1802 mp = ip_input_fragment(mp, ipha, ira);
1802 1803 if (mp == NULL)
1803 1804 return;
1804 1805 /* Completed reassembly */
1805 1806 ipha = (ipha_t *)mp->b_rptr;
1806 1807 }
1807 1808
1808 1809 /*
1809 1810 * For broadcast and multicast we need some extra work before
1810 1811 * we call ip_fanout_v4(), since in the case of shared-IP zones
1811 1812 * we need to pretend that a packet arrived for each zoneid.
1812 1813 */
1813 1814 if (iraflags & IRAF_MULTIBROADCAST) {
1814 1815 if (iraflags & IRAF_BROADCAST)
1815 1816 ip_input_broadcast_v4(ire, mp, ipha, ira);
1816 1817 else
1817 1818 ip_input_multicast_v4(ire, mp, ipha, ira);
1818 1819 return;
1819 1820 }
1820 1821 ip_fanout_v4(mp, ipha, ira);
1821 1822 }
1822 1823
1823 1824
1824 1825 /*
1825 1826 * Handle multiple zones which match the same broadcast address
1826 1827 * and ill by delivering a packet to each of them.
1827 1828 * Walk the bucket and look for different ire_zoneid but otherwise
1828 1829 * the same IRE (same ill/addr/mask/type).
1829 1830 * Note that ire_add() tracks IREs that are identical in all
1830 1831 * fields (addr/mask/type/gw/ill/zoneid) within a single IRE by
1831 1832 * increasing ire_identical_cnt. Thus we don't need to be concerned
1832 1833 * about those.
1833 1834 */
1834 1835 static void
1835 1836 ip_input_broadcast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1836 1837 {
1837 1838 ill_t *ill = ira->ira_ill;
1838 1839 ip_stack_t *ipst = ill->ill_ipst;
1839 1840 netstack_t *ns = ipst->ips_netstack;
1840 1841 irb_t *irb;
1841 1842 ire_t *ire1;
1842 1843 mblk_t *mp1;
1843 1844 ipha_t *ipha1;
1844 1845 uint_t ira_pktlen = ira->ira_pktlen;
1845 1846 uint16_t ira_ip_hdr_length = ira->ira_ip_hdr_length;
1846 1847
1847 1848 irb = ire->ire_bucket;
1848 1849
1849 1850 /*
1850 1851 * If we don't have more than one shared-IP zone, or if
1851 1852 * there can't be more than one IRE_BROADCAST for this
1852 1853 * IP address, then just set the zoneid and proceed.
1853 1854 */
1854 1855 if (ns->netstack_numzones == 1 || irb->irb_ire_cnt == 1) {
1855 1856 ira->ira_zoneid = ire->ire_zoneid;
1856 1857
1857 1858 ip_fanout_v4(mp, ipha, ira);
1858 1859 return;
1859 1860 }
1860 1861 irb_refhold(irb);
1861 1862 for (ire1 = irb->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
1862 1863 /* We do the main IRE after the end of the loop */
1863 1864 if (ire1 == ire)
1864 1865 continue;
1865 1866
1866 1867 /*
1867 1868 * Only IREs for the same IP address should be in the same
1868 1869 * bucket.
1869 1870 * But could have IRE_HOSTs in the case of CGTP.
1870 1871 */
1871 1872 ASSERT(ire1->ire_addr == ire->ire_addr);
1872 1873 if (!(ire1->ire_type & IRE_BROADCAST))
1873 1874 continue;
1874 1875
1875 1876 if (IRE_IS_CONDEMNED(ire1))
1876 1877 continue;
1877 1878
1878 1879 mp1 = copymsg(mp);
1879 1880 if (mp1 == NULL) {
1880 1881 /* Failed to deliver to one zone */
1881 1882 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1882 1883 ip_drop_input("ipIfStatsInDiscards", mp, ill);
1883 1884 continue;
1884 1885 }
1885 1886 ira->ira_zoneid = ire1->ire_zoneid;
1886 1887 ipha1 = (ipha_t *)mp1->b_rptr;
1887 1888 ip_fanout_v4(mp1, ipha1, ira);
1888 1889 /*
1889 1890 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1890 1891 * so we restore them for a potential next iteration
1891 1892 */
1892 1893 ira->ira_pktlen = ira_pktlen;
1893 1894 ira->ira_ip_hdr_length = ira_ip_hdr_length;
1894 1895 }
1895 1896 irb_refrele(irb);
1896 1897 /* Do the main ire */
1897 1898 ira->ira_zoneid = ire->ire_zoneid;
1898 1899 ip_fanout_v4(mp, ipha, ira);
1899 1900 }
1900 1901
1901 1902 /*
1902 1903 * Handle multiple zones which want to receive the same multicast packets
1903 1904 * on this ill by delivering a packet to each of them.
1904 1905 *
1905 1906 * Note that for packets delivered to transports we could instead do this
1906 1907 * as part of the fanout code, but since we need to handle icmp_inbound
1907 1908 * it is simpler to have multicast work the same as broadcast.
1908 1909 *
1909 1910 * The ip_fanout matching for multicast matches based on ilm independent of
1910 1911 * zoneid since the zoneid restriction is applied when joining a multicast
1911 1912 * group.
1912 1913 */
1913 1914 /* ARGSUSED */
1914 1915 static void
1915 1916 ip_input_multicast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1916 1917 {
1917 1918 ill_t *ill = ira->ira_ill;
1918 1919 iaflags_t iraflags = ira->ira_flags;
1919 1920 ip_stack_t *ipst = ill->ill_ipst;
1920 1921 netstack_t *ns = ipst->ips_netstack;
1921 1922 zoneid_t zoneid;
1922 1923 mblk_t *mp1;
1923 1924 ipha_t *ipha1;
1924 1925 uint_t ira_pktlen = ira->ira_pktlen;
1925 1926 uint16_t ira_ip_hdr_length = ira->ira_ip_hdr_length;
1926 1927
1927 1928 /* ire_recv_multicast has switched to the upper ill for IPMP */
1928 1929 ASSERT(!IS_UNDER_IPMP(ill));
1929 1930
1930 1931 /*
1931 1932 * If we don't have more than one shared-IP zone, or if
1932 1933 * there are no members in anything but the global zone,
1933 1934 * then just set the zoneid and proceed.
1934 1935 */
1935 1936 if (ns->netstack_numzones == 1 ||
1936 1937 !ill_hasmembers_otherzones_v4(ill, ipha->ipha_dst,
1937 1938 GLOBAL_ZONEID)) {
1938 1939 ira->ira_zoneid = GLOBAL_ZONEID;
1939 1940
1940 1941 /* If sender didn't want this zone to receive it, drop */
1941 1942 if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1942 1943 ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1943 1944 ip_drop_input("Multicast but wrong zoneid", mp, ill);
1944 1945 freemsg(mp);
1945 1946 return;
1946 1947 }
1947 1948 ip_fanout_v4(mp, ipha, ira);
1948 1949 return;
1949 1950 }
1950 1951
1951 1952 /*
1952 1953 * Here we loop over all zoneids that have members in the group
1953 1954 * and deliver a packet to ip_fanout for each zoneid.
1954 1955 *
1955 1956 * First find any members in the lowest numeric zoneid by looking for
1956 1957 * first zoneid larger than -1 (ALL_ZONES).
1957 1958 * We terminate the loop when we receive -1 (ALL_ZONES).
1958 1959 */
1959 1960 zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, ALL_ZONES);
1960 1961 for (; zoneid != ALL_ZONES;
1961 1962 zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, zoneid)) {
1962 1963 /*
1963 1964 * Avoid an extra copymsg/freemsg by skipping global zone here
1964 1965 * and doing that at the end.
1965 1966 */
1966 1967 if (zoneid == GLOBAL_ZONEID)
1967 1968 continue;
1968 1969
1969 1970 ira->ira_zoneid = zoneid;
1970 1971
1971 1972 /* If sender didn't want this zone to receive it, skip */
1972 1973 if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1973 1974 ira->ira_no_loop_zoneid == ira->ira_zoneid)
1974 1975 continue;
1975 1976
1976 1977 mp1 = copymsg(mp);
1977 1978 if (mp1 == NULL) {
1978 1979 /* Failed to deliver to one zone */
1979 1980 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1980 1981 ip_drop_input("ipIfStatsInDiscards", mp, ill);
1981 1982 continue;
1982 1983 }
1983 1984 ipha1 = (ipha_t *)mp1->b_rptr;
1984 1985 ip_fanout_v4(mp1, ipha1, ira);
1985 1986 /*
1986 1987 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1987 1988 * so we restore them for a potential next iteration
1988 1989 */
1989 1990 ira->ira_pktlen = ira_pktlen;
1990 1991 ira->ira_ip_hdr_length = ira_ip_hdr_length;
1991 1992 }
1992 1993
1993 1994 /* Do the main ire */
1994 1995 ira->ira_zoneid = GLOBAL_ZONEID;
1995 1996 /* If sender didn't want this zone to receive it, drop */
1996 1997 if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1997 1998 ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1998 1999 ip_drop_input("Multicast but wrong zoneid", mp, ill);
1999 2000 freemsg(mp);
2000 2001 } else {
2001 2002 ip_fanout_v4(mp, ipha, ira);
2002 2003 }
2003 2004 }
2004 2005
2005 2006
2006 2007 /*
2007 2008 * Determine the zoneid and IRAF_TX_* flags if trusted extensions
2008 2009 * is in use. Updates ira_zoneid and ira_flags as a result.
2009 2010 */
2010 2011 static void
2011 2012 ip_fanout_tx_v4(mblk_t *mp, ipha_t *ipha, uint8_t protocol,
2012 2013 uint_t ip_hdr_length, ip_recv_attr_t *ira)
2013 2014 {
2014 2015 uint16_t *up;
2015 2016 uint16_t lport;
2016 2017 zoneid_t zoneid;
2017 2018
2018 2019 ASSERT(ira->ira_flags & IRAF_SYSTEM_LABELED);
2019 2020
2020 2021 /*
2021 2022 * If the packet is unlabeled we might allow read-down
2022 2023 * for MAC_EXEMPT. Below we clear this if it is a multi-level
2023 2024 * port (MLP).
2024 2025 * Note that ira_tsl can be NULL here.
2025 2026 */
2026 2027 if (ira->ira_tsl != NULL && ira->ira_tsl->tsl_flags & TSLF_UNLABELED)
2027 2028 ira->ira_flags |= IRAF_TX_MAC_EXEMPTABLE;
2028 2029
2029 2030 if (ira->ira_zoneid != ALL_ZONES)
2030 2031 return;
2031 2032
2032 2033 ira->ira_flags |= IRAF_TX_SHARED_ADDR;
2033 2034
2034 2035 up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2035 2036 switch (protocol) {
2036 2037 case IPPROTO_TCP:
2037 2038 case IPPROTO_SCTP:
2038 2039 case IPPROTO_UDP:
2039 2040 /* Caller ensures this */
2040 2041 ASSERT(((uchar_t *)ipha) + ip_hdr_length +4 <= mp->b_wptr);
2041 2042
2042 2043 /*
2043 2044 * Only these transports support MLP.
2044 2045 * We know their destination port numbers is in
2045 2046 * the same place in the header.
2046 2047 */
2047 2048 lport = up[1];
2048 2049
2049 2050 /*
2050 2051 * No need to handle exclusive-stack zones
2051 2052 * since ALL_ZONES only applies to the shared IP instance.
2052 2053 */
2053 2054 zoneid = tsol_mlp_findzone(protocol, lport);
2054 2055 /*
2055 2056 * If no shared MLP is found, tsol_mlp_findzone returns
2056 2057 * ALL_ZONES. In that case, we assume it's SLP, and
2057 2058 * search for the zone based on the packet label.
2058 2059 *
2059 2060 * If there is such a zone, we prefer to find a
2060 2061 * connection in it. Otherwise, we look for a
2061 2062 * MAC-exempt connection in any zone whose label
2062 2063 * dominates the default label on the packet.
2063 2064 */
2064 2065 if (zoneid == ALL_ZONES)
2065 2066 zoneid = tsol_attr_to_zoneid(ira);
2066 2067 else
2067 2068 ira->ira_flags &= ~IRAF_TX_MAC_EXEMPTABLE;
2068 2069 break;
2069 2070 default:
2070 2071 /* Handle shared address for other protocols */
2071 2072 zoneid = tsol_attr_to_zoneid(ira);
2072 2073 break;
2073 2074 }
2074 2075 ira->ira_zoneid = zoneid;
2075 2076 }
2076 2077
2077 2078 /*
2078 2079 * Increment checksum failure statistics
2079 2080 */
2080 2081 static void
2081 2082 ip_input_cksum_err_v4(uint8_t protocol, uint16_t hck_flags, ill_t *ill)
2082 2083 {
2083 2084 ip_stack_t *ipst = ill->ill_ipst;
2084 2085
2085 2086 switch (protocol) {
2086 2087 case IPPROTO_TCP:
2087 2088 BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs);
2088 2089
2089 2090 if (hck_flags & HCK_FULLCKSUM)
2090 2091 IP_STAT(ipst, ip_tcp_in_full_hw_cksum_err);
2091 2092 else if (hck_flags & HCK_PARTIALCKSUM)
2092 2093 IP_STAT(ipst, ip_tcp_in_part_hw_cksum_err);
2093 2094 else
2094 2095 IP_STAT(ipst, ip_tcp_in_sw_cksum_err);
2095 2096 break;
2096 2097 case IPPROTO_UDP:
2097 2098 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInCksumErrs);
2098 2099 if (hck_flags & HCK_FULLCKSUM)
2099 2100 IP_STAT(ipst, ip_udp_in_full_hw_cksum_err);
2100 2101 else if (hck_flags & HCK_PARTIALCKSUM)
2101 2102 IP_STAT(ipst, ip_udp_in_part_hw_cksum_err);
2102 2103 else
2103 2104 IP_STAT(ipst, ip_udp_in_sw_cksum_err);
2104 2105 break;
2105 2106 case IPPROTO_ICMP:
2106 2107 BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2107 2108 break;
2108 2109 default:
2109 2110 ASSERT(0);
2110 2111 break;
2111 2112 }
2112 2113 }
2113 2114
2114 2115 /* Calculate the IPv4 pseudo-header checksum */
2115 2116 uint32_t
2116 2117 ip_input_cksum_pseudo_v4(ipha_t *ipha, ip_recv_attr_t *ira)
2117 2118 {
2118 2119 uint_t ulp_len;
2119 2120 uint32_t cksum;
2120 2121 uint8_t protocol = ira->ira_protocol;
2121 2122 uint16_t ip_hdr_length = ira->ira_ip_hdr_length;
2122 2123
2123 2124 #define iphs ((uint16_t *)ipha)
2124 2125
2125 2126 switch (protocol) {
2126 2127 case IPPROTO_TCP:
2127 2128 ulp_len = ira->ira_pktlen - ip_hdr_length;
2128 2129
2129 2130 /* Protocol and length */
2130 2131 cksum = htons(ulp_len) + IP_TCP_CSUM_COMP;
2131 2132 /* IP addresses */
2132 2133 cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2133 2134 break;
2134 2135
2135 2136 case IPPROTO_UDP: {
2136 2137 udpha_t *udpha;
2137 2138
2138 2139 udpha = (udpha_t *)((uchar_t *)ipha + ip_hdr_length);
2139 2140
2140 2141 /* Protocol and length */
2141 2142 cksum = udpha->uha_length + IP_UDP_CSUM_COMP;
2142 2143 /* IP addresses */
2143 2144 cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2144 2145 break;
2145 2146 }
2146 2147
2147 2148 default:
2148 2149 cksum = 0;
2149 2150 break;
2150 2151 }
2151 2152 #undef iphs
2152 2153 return (cksum);
2153 2154 }
2154 2155
2155 2156
2156 2157 /*
2157 2158 * Software verification of the ULP checksums.
2158 2159 * Returns B_TRUE if ok.
2159 2160 * Increments statistics of failed.
2160 2161 */
2161 2162 static boolean_t
2162 2163 ip_input_sw_cksum_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2163 2164 {
2164 2165 ip_stack_t *ipst = ira->ira_ill->ill_ipst;
2165 2166 uint32_t cksum;
2166 2167 uint8_t protocol = ira->ira_protocol;
2167 2168 uint16_t ip_hdr_length = ira->ira_ip_hdr_length;
2168 2169
2169 2170 IP_STAT(ipst, ip_in_sw_cksum);
2170 2171
2171 2172 ASSERT(protocol == IPPROTO_TCP || protocol == IPPROTO_UDP);
2172 2173
2173 2174 cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2174 2175 cksum = IP_CSUM(mp, ip_hdr_length, cksum);
2175 2176 if (cksum == 0)
2176 2177 return (B_TRUE);
2177 2178
2178 2179 ip_input_cksum_err_v4(protocol, 0, ira->ira_ill);
2179 2180 return (B_FALSE);
2180 2181 }
2181 2182
2182 2183 /*
2183 2184 * Verify the ULP checksums.
2184 2185 * Returns B_TRUE if ok, or if the ULP doesn't have a well-defined checksum
2185 2186 * algorithm.
2186 2187 * Increments statistics if failed.
2187 2188 */
2188 2189 static boolean_t
2189 2190 ip_input_cksum_v4(iaflags_t iraflags, mblk_t *mp, ipha_t *ipha,
2190 2191 ip_recv_attr_t *ira)
2191 2192 {
2192 2193 ill_t *ill = ira->ira_rill;
2193 2194 uint16_t hck_flags;
2194 2195 uint32_t cksum;
2195 2196 mblk_t *mp1;
2196 2197 int32_t len;
2197 2198 uint8_t protocol = ira->ira_protocol;
2198 2199 uint16_t ip_hdr_length = ira->ira_ip_hdr_length;
2199 2200
2200 2201
2201 2202 switch (protocol) {
2202 2203 case IPPROTO_TCP:
2203 2204 break;
2204 2205
2205 2206 case IPPROTO_UDP: {
2206 2207 udpha_t *udpha;
2207 2208
2208 2209 udpha = (udpha_t *)((uchar_t *)ipha + ip_hdr_length);
2209 2210 if (udpha->uha_checksum == 0) {
2210 2211 /* Packet doesn't have a UDP checksum */
2211 2212 return (B_TRUE);
2212 2213 }
2213 2214 break;
2214 2215 }
2215 2216 case IPPROTO_SCTP: {
2216 2217 sctp_hdr_t *sctph;
2217 2218 uint32_t pktsum;
2218 2219
2219 2220 sctph = (sctp_hdr_t *)((uchar_t *)ipha + ip_hdr_length);
2220 2221 #ifdef DEBUG
2221 2222 if (skip_sctp_cksum)
2222 2223 return (B_TRUE);
2223 2224 #endif
2224 2225 pktsum = sctph->sh_chksum;
2225 2226 sctph->sh_chksum = 0;
2226 2227 cksum = sctp_cksum(mp, ip_hdr_length);
2227 2228 sctph->sh_chksum = pktsum;
2228 2229 if (cksum == pktsum)
2229 2230 return (B_TRUE);
2230 2231
2231 2232 /*
2232 2233 * Defer until later whether a bad checksum is ok
2233 2234 * in order to allow RAW sockets to use Adler checksum
2234 2235 * with SCTP.
2235 2236 */
2236 2237 ira->ira_flags |= IRAF_SCTP_CSUM_ERR;
2237 2238 return (B_TRUE);
2238 2239 }
2239 2240
2240 2241 default:
2241 2242 /* No ULP checksum to verify. */
2242 2243 return (B_TRUE);
2243 2244 }
2244 2245 /*
2245 2246 * Revert to software checksum calculation if the interface
2246 2247 * isn't capable of checksum offload.
2247 2248 * We clear DB_CKSUMFLAGS when going through IPsec in ip_fanout.
2248 2249 * Note: IRAF_NO_HW_CKSUM is not currently used.
2249 2250 */
2250 2251 ASSERT(!IS_IPMP(ill));
2251 2252 if ((iraflags & IRAF_NO_HW_CKSUM) || !ILL_HCKSUM_CAPABLE(ill) ||
2252 2253 !dohwcksum) {
2253 2254 return (ip_input_sw_cksum_v4(mp, ipha, ira));
2254 2255 }
2255 2256
2256 2257 /*
2257 2258 * We apply this for all ULP protocols. Does the HW know to
2258 2259 * not set the flags for SCTP and other protocols.
2259 2260 */
2260 2261
2261 2262 hck_flags = DB_CKSUMFLAGS(mp);
2262 2263
2263 2264 if (hck_flags & HCK_FULLCKSUM_OK) {
2264 2265 /*
2265 2266 * Hardware has already verified the checksum.
2266 2267 */
2267 2268 return (B_TRUE);
2268 2269 }
2269 2270
2270 2271 if (hck_flags & HCK_FULLCKSUM) {
2271 2272 /*
2272 2273 * Full checksum has been computed by the hardware
2273 2274 * and has been attached. If the driver wants us to
2274 2275 * verify the correctness of the attached value, in
2275 2276 * order to protect against faulty hardware, compare
2276 2277 * it against -0 (0xFFFF) to see if it's valid.
2277 2278 */
2278 2279 cksum = DB_CKSUM16(mp);
2279 2280 if (cksum == 0xFFFF)
2280 2281 return (B_TRUE);
2281 2282 ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2282 2283 return (B_FALSE);
2283 2284 }
2284 2285
2285 2286 mp1 = mp->b_cont;
2286 2287 if ((hck_flags & HCK_PARTIALCKSUM) &&
2287 2288 (mp1 == NULL || mp1->b_cont == NULL) &&
2288 2289 ip_hdr_length >= DB_CKSUMSTART(mp) &&
2289 2290 ((len = ip_hdr_length - DB_CKSUMSTART(mp)) & 1) == 0) {
2290 2291 uint32_t adj;
2291 2292 uchar_t *cksum_start;
2292 2293
2293 2294 cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2294 2295
2295 2296 cksum_start = ((uchar_t *)ipha + DB_CKSUMSTART(mp));
2296 2297
2297 2298 /*
2298 2299 * Partial checksum has been calculated by hardware
2299 2300 * and attached to the packet; in addition, any
2300 2301 * prepended extraneous data is even byte aligned,
2301 2302 * and there are at most two mblks associated with
2302 2303 * the packet. If any such data exists, we adjust
2303 2304 * the checksum; also take care any postpended data.
2304 2305 */
2305 2306 IP_ADJCKSUM_PARTIAL(cksum_start, mp, mp1, len, adj);
2306 2307 /*
2307 2308 * One's complement subtract extraneous checksum
2308 2309 */
2309 2310 cksum += DB_CKSUM16(mp);
2310 2311 if (adj >= cksum)
2311 2312 cksum = ~(adj - cksum) & 0xFFFF;
2312 2313 else
2313 2314 cksum -= adj;
2314 2315 cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2315 2316 cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2316 2317 if (!(~cksum & 0xFFFF))
2317 2318 return (B_TRUE);
2318 2319
2319 2320 ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2320 2321 return (B_FALSE);
2321 2322 }
2322 2323 return (ip_input_sw_cksum_v4(mp, ipha, ira));
2323 2324 }
2324 2325
2325 2326
2326 2327 /*
2327 2328 * Handle fanout of received packets.
2328 2329 * Unicast packets that are looped back (from ire_send_local_v4) and packets
2329 2330 * from the wire are differentiated by checking IRAF_VERIFY_ULP_CKSUM.
2330 2331 *
2331 2332 * IPQoS Notes
2332 2333 * Before sending it to the client, invoke IPPF processing. Policy processing
2333 2334 * takes place only if the callout_position, IPP_LOCAL_IN, is enabled.
2334 2335 */
2335 2336 void
2336 2337 ip_fanout_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2337 2338 {
2338 2339 ill_t *ill = ira->ira_ill;
2339 2340 iaflags_t iraflags = ira->ira_flags;
2340 2341 ip_stack_t *ipst = ill->ill_ipst;
2341 2342 uint8_t protocol = ipha->ipha_protocol;
2342 2343 conn_t *connp;
2343 2344 #define rptr ((uchar_t *)ipha)
2344 2345 uint_t ip_hdr_length;
2345 2346 uint_t min_ulp_header_length;
2346 2347 int offset;
2347 2348 ssize_t len;
2348 2349 netstack_t *ns = ipst->ips_netstack;
2349 2350 ipsec_stack_t *ipss = ns->netstack_ipsec;
2350 2351 ill_t *rill = ira->ira_rill;
2351 2352
2352 2353 ASSERT(ira->ira_pktlen == ntohs(ipha->ipha_length));
2353 2354
2354 2355 ip_hdr_length = ira->ira_ip_hdr_length;
2355 2356 ira->ira_protocol = protocol;
2356 2357
2357 2358 /*
2358 2359 * Time for IPP once we've done reassembly and IPsec.
2359 2360 * We skip this for loopback packets since we don't do IPQoS
2360 2361 * on loopback.
2361 2362 */
2362 2363 if (IPP_ENABLED(IPP_LOCAL_IN, ipst) &&
2363 2364 !(iraflags & IRAF_LOOPBACK) &&
2364 2365 (protocol != IPPROTO_ESP || protocol != IPPROTO_AH)) {
2365 2366 /*
2366 2367 * Use the interface on which the packet arrived - not where
2367 2368 * the IP address is hosted.
2368 2369 */
2369 2370 /* ip_process translates an IS_UNDER_IPMP */
2370 2371 mp = ip_process(IPP_LOCAL_IN, mp, rill, ill);
2371 2372 if (mp == NULL) {
2372 2373 /* ip_drop_packet and MIB done */
2373 2374 return;
2374 2375 }
2375 2376 }
2376 2377
2377 2378 /* Determine the minimum required size of the upper-layer header */
2378 2379 /* Need to do this for at least the set of ULPs that TX handles. */
2379 2380 switch (protocol) {
2380 2381 case IPPROTO_TCP:
2381 2382 min_ulp_header_length = TCP_MIN_HEADER_LENGTH;
↓ open down ↓ |
2253 lines elided |
↑ open up ↑ |
2382 2383 break;
2383 2384 case IPPROTO_SCTP:
2384 2385 min_ulp_header_length = SCTP_COMMON_HDR_LENGTH;
2385 2386 break;
2386 2387 case IPPROTO_UDP:
2387 2388 min_ulp_header_length = UDPH_SIZE;
2388 2389 break;
2389 2390 case IPPROTO_ICMP:
2390 2391 min_ulp_header_length = ICMPH_SIZE;
2391 2392 break;
2393 + case IPPROTO_DCCP:
2394 + min_ulp_header_length = DCCP_MIN_HEADER_LENGTH;
2395 + break;
2392 2396 default:
2393 2397 min_ulp_header_length = 0;
2394 2398 break;
2395 2399 }
2396 2400 /* Make sure we have the min ULP header length */
2397 2401 len = mp->b_wptr - rptr;
2398 2402 if (len < ip_hdr_length + min_ulp_header_length) {
2399 2403 if (ira->ira_pktlen < ip_hdr_length + min_ulp_header_length) {
2400 2404 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2401 2405 ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2402 2406 freemsg(mp);
2403 2407 return;
2404 2408 }
2405 2409 IP_STAT(ipst, ip_recv_pullup);
2406 2410 ipha = ip_pullup(mp, ip_hdr_length + min_ulp_header_length,
2407 2411 ira);
2408 2412 if (ipha == NULL)
2409 2413 goto discard;
2410 2414 len = mp->b_wptr - rptr;
2411 2415 }
2412 2416
2413 2417 /*
2414 2418 * If trusted extensions then determine the zoneid and TX specific
2415 2419 * ira_flags.
2416 2420 */
2417 2421 if (iraflags & IRAF_SYSTEM_LABELED) {
2418 2422 /* This can update ira->ira_flags and ira->ira_zoneid */
2419 2423 ip_fanout_tx_v4(mp, ipha, protocol, ip_hdr_length, ira);
2420 2424 iraflags = ira->ira_flags;
2421 2425 }
2422 2426
2423 2427
2424 2428 /* Verify ULP checksum. Handles TCP, UDP, and SCTP */
2425 2429 if (iraflags & IRAF_VERIFY_ULP_CKSUM) {
2426 2430 if (!ip_input_cksum_v4(iraflags, mp, ipha, ira)) {
2427 2431 /* Bad checksum. Stats are already incremented */
2428 2432 ip_drop_input("Bad ULP checksum", mp, ill);
2429 2433 freemsg(mp);
2430 2434 return;
2431 2435 }
2432 2436 /* IRAF_SCTP_CSUM_ERR could have been set */
2433 2437 iraflags = ira->ira_flags;
2434 2438 }
2435 2439 switch (protocol) {
2436 2440 case IPPROTO_TCP:
2437 2441 /* For TCP, discard broadcast and multicast packets. */
2438 2442 if (iraflags & IRAF_MULTIBROADCAST)
2439 2443 goto discard;
2440 2444
2441 2445 /* First mblk contains IP+TCP headers per above check */
2442 2446 ASSERT(len >= ip_hdr_length + TCP_MIN_HEADER_LENGTH);
2443 2447
2444 2448 /* TCP options present? */
2445 2449 offset = ((uchar_t *)ipha)[ip_hdr_length + 12] >> 4;
2446 2450 if (offset != 5) {
2447 2451 if (offset < 5)
2448 2452 goto discard;
2449 2453
2450 2454 /*
2451 2455 * There must be TCP options.
2452 2456 * Make sure we can grab them.
2453 2457 */
2454 2458 offset <<= 2;
2455 2459 offset += ip_hdr_length;
2456 2460 if (len < offset) {
2457 2461 if (ira->ira_pktlen < offset) {
2458 2462 BUMP_MIB(ill->ill_ip_mib,
2459 2463 ipIfStatsInTruncatedPkts);
2460 2464 ip_drop_input(
2461 2465 "ipIfStatsInTruncatedPkts",
2462 2466 mp, ill);
2463 2467 freemsg(mp);
2464 2468 return;
2465 2469 }
2466 2470 IP_STAT(ipst, ip_recv_pullup);
2467 2471 ipha = ip_pullup(mp, offset, ira);
2468 2472 if (ipha == NULL)
2469 2473 goto discard;
2470 2474 len = mp->b_wptr - rptr;
2471 2475 }
2472 2476 }
2473 2477
2474 2478 /*
2475 2479 * Pass up a squeue hint to tcp.
2476 2480 * If ira_sqp is already set (this is loopback) we leave it
2477 2481 * alone.
2478 2482 */
2479 2483 if (ira->ira_sqp == NULL) {
2480 2484 ira->ira_sqp = ip_squeue_get(ira->ira_ring);
2481 2485 }
2482 2486
2483 2487 /* Look for AF_INET or AF_INET6 that matches */
2484 2488 connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_length,
2485 2489 ira, ipst);
2486 2490 if (connp == NULL) {
2487 2491 /* Send the TH_RST */
2488 2492 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2489 2493 tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2490 2494 return;
2491 2495 }
2492 2496 if (connp->conn_incoming_ifindex != 0 &&
2493 2497 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2494 2498 CONN_DEC_REF(connp);
2495 2499
2496 2500 /* Send the TH_RST */
2497 2501 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2498 2502 tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2499 2503 return;
2500 2504 }
2501 2505 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2502 2506 (iraflags & IRAF_IPSEC_SECURE)) {
2503 2507 mp = ipsec_check_inbound_policy(mp, connp,
2504 2508 ipha, NULL, ira);
2505 2509 if (mp == NULL) {
2506 2510 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2507 2511 /* Note that mp is NULL */
2508 2512 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2509 2513 CONN_DEC_REF(connp);
2510 2514 return;
2511 2515 }
2512 2516 }
2513 2517 /* Found a client; up it goes */
2514 2518 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2515 2519 ira->ira_ill = ira->ira_rill = NULL;
2516 2520 if (!IPCL_IS_TCP(connp)) {
2517 2521 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2518 2522 (connp->conn_recv)(connp, mp, NULL, ira);
2519 2523 CONN_DEC_REF(connp);
2520 2524 ira->ira_ill = ill;
2521 2525 ira->ira_rill = rill;
2522 2526 return;
2523 2527 }
2524 2528
2525 2529 /*
2526 2530 * We do different processing whether called from
2527 2531 * ip_accept_tcp and we match the target, don't match
2528 2532 * the target, and when we are called by ip_input.
2529 2533 */
2530 2534 if (iraflags & IRAF_TARGET_SQP) {
2531 2535 if (ira->ira_target_sqp == connp->conn_sqp) {
2532 2536 mblk_t *attrmp;
2533 2537
2534 2538 attrmp = ip_recv_attr_to_mblk(ira);
2535 2539 if (attrmp == NULL) {
2536 2540 BUMP_MIB(ill->ill_ip_mib,
2537 2541 ipIfStatsInDiscards);
2538 2542 ip_drop_input("ipIfStatsInDiscards",
2539 2543 mp, ill);
2540 2544 freemsg(mp);
2541 2545 CONN_DEC_REF(connp);
2542 2546 } else {
2543 2547 SET_SQUEUE(attrmp, connp->conn_recv,
2544 2548 connp);
2545 2549 attrmp->b_cont = mp;
2546 2550 ASSERT(ira->ira_target_sqp_mp == NULL);
2547 2551 ira->ira_target_sqp_mp = attrmp;
2548 2552 /*
2549 2553 * Conn ref release when drained from
2550 2554 * the squeue.
2551 2555 */
2552 2556 }
2553 2557 } else {
2554 2558 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2555 2559 connp->conn_recv, connp, ira, SQ_FILL,
2556 2560 SQTAG_IP_TCP_INPUT);
2557 2561 }
2558 2562 } else {
2559 2563 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv,
2560 2564 connp, ira, ip_squeue_flag, SQTAG_IP_TCP_INPUT);
2561 2565 }
2562 2566 ira->ira_ill = ill;
2563 2567 ira->ira_rill = rill;
2564 2568 return;
2565 2569
2566 2570 case IPPROTO_SCTP: {
2567 2571 sctp_hdr_t *sctph;
2568 2572 in6_addr_t map_src, map_dst;
2569 2573 uint32_t ports; /* Source and destination ports */
2570 2574 sctp_stack_t *sctps = ipst->ips_netstack->netstack_sctp;
2571 2575
2572 2576 /* For SCTP, discard broadcast and multicast packets. */
2573 2577 if (iraflags & IRAF_MULTIBROADCAST)
2574 2578 goto discard;
2575 2579
2576 2580 /*
2577 2581 * Since there is no SCTP h/w cksum support yet, just
2578 2582 * clear the flag.
2579 2583 */
2580 2584 DB_CKSUMFLAGS(mp) = 0;
2581 2585
2582 2586 /* Length ensured above */
2583 2587 ASSERT(MBLKL(mp) >= ip_hdr_length + SCTP_COMMON_HDR_LENGTH);
2584 2588 sctph = (sctp_hdr_t *)(rptr + ip_hdr_length);
2585 2589
2586 2590 /* get the ports */
2587 2591 ports = *(uint32_t *)&sctph->sh_sport;
2588 2592
2589 2593 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_dst);
2590 2594 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_src);
2591 2595 if (iraflags & IRAF_SCTP_CSUM_ERR) {
2592 2596 /*
2593 2597 * No potential sctp checksum errors go to the Sun
2594 2598 * sctp stack however they might be Adler-32 summed
2595 2599 * packets a userland stack bound to a raw IP socket
2596 2600 * could reasonably use. Note though that Adler-32 is
2597 2601 * a long deprecated algorithm and customer sctp
2598 2602 * networks should eventually migrate to CRC-32 at
2599 2603 * which time this facility should be removed.
2600 2604 */
2601 2605 ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2602 2606 return;
2603 2607 }
2604 2608 connp = sctp_fanout(&map_src, &map_dst, ports, ira, mp,
2605 2609 sctps, sctph);
2606 2610 if (connp == NULL) {
2607 2611 /* Check for raw socket or OOTB handling */
2608 2612 ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2609 2613 return;
2610 2614 }
2611 2615 if (connp->conn_incoming_ifindex != 0 &&
2612 2616 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2613 2617 CONN_DEC_REF(connp);
2614 2618 /* Check for raw socket or OOTB handling */
2615 2619 ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2616 2620 return;
2617 2621 }
2618 2622
2619 2623 /* Found a client; up it goes */
2620 2624 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2621 2625 sctp_input(connp, ipha, NULL, mp, ira);
2622 2626 /* sctp_input does a rele of the sctp_t */
2623 2627 return;
2624 2628 }
2625 2629
2626 2630 case IPPROTO_UDP:
2627 2631 /* First mblk contains IP+UDP headers as checked above */
2628 2632 ASSERT(MBLKL(mp) >= ip_hdr_length + UDPH_SIZE);
2629 2633
2630 2634 if (iraflags & IRAF_MULTIBROADCAST) {
2631 2635 uint16_t *up; /* Pointer to ports in ULP header */
2632 2636
2633 2637 up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2634 2638 ip_fanout_udp_multi_v4(mp, ipha, up[1], up[0], ira);
2635 2639 return;
2636 2640 }
2637 2641
2638 2642 /* Look for AF_INET or AF_INET6 that matches */
2639 2643 connp = ipcl_classify_v4(mp, IPPROTO_UDP, ip_hdr_length,
2640 2644 ira, ipst);
2641 2645 if (connp == NULL) {
2642 2646 no_udp_match:
2643 2647 if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].
2644 2648 connf_head != NULL) {
2645 2649 ASSERT(ira->ira_protocol == IPPROTO_UDP);
2646 2650 ip_fanout_proto_v4(mp, ipha, ira);
2647 2651 } else {
2648 2652 ip_fanout_send_icmp_v4(mp,
2649 2653 ICMP_DEST_UNREACHABLE,
2650 2654 ICMP_PORT_UNREACHABLE, ira);
2651 2655 }
2652 2656 return;
2653 2657
2654 2658 }
2655 2659 if (connp->conn_incoming_ifindex != 0 &&
2656 2660 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2657 2661 CONN_DEC_REF(connp);
2658 2662 goto no_udp_match;
2659 2663 }
2660 2664 if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld :
2661 2665 !canputnext(connp->conn_rq)) {
2662 2666 CONN_DEC_REF(connp);
2663 2667 BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
2664 2668 ip_drop_input("udpIfStatsInOverflows", mp, ill);
2665 2669 freemsg(mp);
2666 2670 return;
2667 2671 }
2668 2672 if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2669 2673 (iraflags & IRAF_IPSEC_SECURE)) {
2670 2674 mp = ipsec_check_inbound_policy(mp, connp,
2671 2675 ipha, NULL, ira);
2672 2676 if (mp == NULL) {
2673 2677 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2674 2678 /* Note that mp is NULL */
2675 2679 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2676 2680 CONN_DEC_REF(connp);
2677 2681 return;
2678 2682 }
2679 2683 }
2680 2684 /*
2681 2685 * Remove 0-spi if it's 0, or move everything behind
2682 2686 * the UDP header over it and forward to ESP via
2683 2687 * ip_fanout_v4().
2684 2688 */
2685 2689 if (connp->conn_udp->udp_nat_t_endpoint) {
2686 2690 if (iraflags & IRAF_IPSEC_SECURE) {
2687 2691 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2688 2692 DROPPER(ipss, ipds_esp_nat_t_ipsec),
2689 2693 &ipss->ipsec_dropper);
2690 2694 CONN_DEC_REF(connp);
2691 2695 return;
2692 2696 }
2693 2697
2694 2698 mp = zero_spi_check(mp, ira);
2695 2699 if (mp == NULL) {
2696 2700 /*
2697 2701 * Packet was consumed - probably sent to
2698 2702 * ip_fanout_v4.
2699 2703 */
2700 2704 CONN_DEC_REF(connp);
2701 2705 return;
2702 2706 }
2703 2707 /* Else continue like a normal UDP packet. */
2704 2708 ipha = (ipha_t *)mp->b_rptr;
2705 2709 protocol = ipha->ipha_protocol;
2706 2710 ira->ira_protocol = protocol;
↓ open down ↓ |
305 lines elided |
↑ open up ↑ |
2707 2711 }
2708 2712 /* Found a client; up it goes */
2709 2713 IP_STAT(ipst, ip_udp_fannorm);
2710 2714 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2711 2715 ira->ira_ill = ira->ira_rill = NULL;
2712 2716 (connp->conn_recv)(connp, mp, NULL, ira);
2713 2717 CONN_DEC_REF(connp);
2714 2718 ira->ira_ill = ill;
2715 2719 ira->ira_rill = rill;
2716 2720 return;
2721 + case IPPROTO_DCCP:
2722 + /* For DCCP, discard broadcast and multicast packets */
2723 + if (iraflags & IRAF_MULTIBROADCAST) {
2724 + goto discard;
2725 + }
2726 +
2727 + /* Checked above */
2728 + ASSERT(len >= ip_hdr_length + DCCP_MIN_HEADER_LENGTH);
2729 +
2730 + /* Squeue hint */
2731 + if (ira->ira_sqp == NULL) {
2732 + ira->ira_sqp = ip_squeue_get(ira->ira_ring);
2733 + }
2734 +
2735 + connp = ipcl_classify_v4(mp, IPPROTO_DCCP, ip_hdr_length,
2736 + ira, ipst);
2737 + if (connp == NULL) {
2738 + cmn_err(CE_NOTE, "ip_input.c: ip_fanout_v4 connp not found");
2739 + BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2740 + dccp_xmit_listeners_reset(mp, ira, ipst, NULL);
2741 + return;
2742 + }
2743 +
2744 + if (connp->conn_incoming_ifindex != 0 &&
2745 + connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2746 + cmn_err(CE_NOTE, "ip_input.c: ip_fanout_v4 ifindex problem");
2747 + BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2748 + dccp_xmit_listeners_reset(mp, ira, ipst, NULL);
2749 + return;
2750 + }
2751 +
2752 + if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2753 + (iraflags & IRAF_IPSEC_SECURE)) {
2754 + mp = ipsec_check_inbound_policy(mp, connp,
2755 + ipha, NULL, ira);
2756 + if (mp == NULL) {
2757 + BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2758 + ip_drop_input("ipIfStatsInDiscards", mp, ill);
2759 + CONN_DEC_REF(connp);
2760 + return;
2761 + }
2762 + }
2763 +
2764 + BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2765 + ira->ira_ill = ira->ira_rill = NULL;
2766 +
2767 + SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv,
2768 + connp, ira, ip_squeue_flag, SQTAG_IP_DCCP_INPUT);
2769 +
2770 + ira->ira_ill = ill;
2771 + ira->ira_rill = rill;
2772 + return;
2717 2773 default:
2718 2774 break;
2719 2775 }
2720 2776
2721 2777 /*
2722 2778 * Clear hardware checksumming flag as it is currently only
2723 2779 * used by TCP and UDP.
2724 2780 */
2725 2781 DB_CKSUMFLAGS(mp) = 0;
2726 2782
2727 2783 switch (protocol) {
2728 2784 case IPPROTO_ICMP:
2729 2785 /*
2730 2786 * We need to accomodate icmp messages coming in clear
2731 2787 * until we get everything secure from the wire. If
2732 2788 * icmp_accept_clear_messages is zero we check with
2733 2789 * the global policy and act accordingly. If it is
2734 2790 * non-zero, we accept the message without any checks.
2735 2791 * But *this does not mean* that this will be delivered
2736 2792 * to RAW socket clients. By accepting we might send
2737 2793 * replies back, change our MTU value etc.,
2738 2794 * but delivery to the ULP/clients depends on their
2739 2795 * policy dispositions.
2740 2796 */
2741 2797 if (ipst->ips_icmp_accept_clear_messages == 0) {
2742 2798 mp = ipsec_check_global_policy(mp, NULL,
2743 2799 ipha, NULL, ira, ns);
2744 2800 if (mp == NULL)
2745 2801 return;
2746 2802 }
2747 2803
2748 2804 /*
2749 2805 * On a labeled system, we have to check whether the zone
2750 2806 * itself is permitted to receive raw traffic.
2751 2807 */
2752 2808 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
2753 2809 if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
2754 2810 BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
2755 2811 ip_drop_input("tsol_can_accept_raw", mp, ill);
2756 2812 freemsg(mp);
2757 2813 return;
2758 2814 }
2759 2815 }
2760 2816
2761 2817 /*
2762 2818 * ICMP header checksum, including checksum field,
2763 2819 * should be zero.
2764 2820 */
2765 2821 if (IP_CSUM(mp, ip_hdr_length, 0)) {
2766 2822 BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2767 2823 ip_drop_input("icmpInCksumErrs", mp, ill);
2768 2824 freemsg(mp);
2769 2825 return;
2770 2826 }
2771 2827 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2772 2828 mp = icmp_inbound_v4(mp, ira);
2773 2829 if (mp == NULL) {
2774 2830 /* No need to pass to RAW sockets */
2775 2831 return;
2776 2832 }
2777 2833 break;
2778 2834
2779 2835 case IPPROTO_IGMP:
2780 2836 /*
2781 2837 * If we are not willing to accept IGMP packets in clear,
2782 2838 * then check with global policy.
2783 2839 */
2784 2840 if (ipst->ips_igmp_accept_clear_messages == 0) {
2785 2841 mp = ipsec_check_global_policy(mp, NULL,
2786 2842 ipha, NULL, ira, ns);
2787 2843 if (mp == NULL)
2788 2844 return;
2789 2845 }
2790 2846 if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2791 2847 !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2792 2848 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2793 2849 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2794 2850 freemsg(mp);
2795 2851 return;
2796 2852 }
2797 2853 /*
2798 2854 * Validate checksum
2799 2855 */
2800 2856 if (IP_CSUM(mp, ip_hdr_length, 0)) {
2801 2857 ++ipst->ips_igmpstat.igps_rcv_badsum;
2802 2858 ip_drop_input("igps_rcv_badsum", mp, ill);
2803 2859 freemsg(mp);
2804 2860 return;
2805 2861 }
2806 2862
2807 2863 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2808 2864 mp = igmp_input(mp, ira);
2809 2865 if (mp == NULL) {
2810 2866 /* Bad packet - discarded by igmp_input */
2811 2867 return;
2812 2868 }
2813 2869 break;
2814 2870 case IPPROTO_PIM:
2815 2871 /*
2816 2872 * If we are not willing to accept PIM packets in clear,
2817 2873 * then check with global policy.
2818 2874 */
2819 2875 if (ipst->ips_pim_accept_clear_messages == 0) {
2820 2876 mp = ipsec_check_global_policy(mp, NULL,
2821 2877 ipha, NULL, ira, ns);
2822 2878 if (mp == NULL)
2823 2879 return;
2824 2880 }
2825 2881 if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2826 2882 !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2827 2883 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2828 2884 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2829 2885 freemsg(mp);
2830 2886 return;
2831 2887 }
2832 2888 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2833 2889
2834 2890 /* Checksum is verified in pim_input */
2835 2891 mp = pim_input(mp, ira);
2836 2892 if (mp == NULL) {
2837 2893 /* Bad packet - discarded by pim_input */
2838 2894 return;
2839 2895 }
2840 2896 break;
2841 2897 case IPPROTO_AH:
2842 2898 case IPPROTO_ESP: {
2843 2899 /*
2844 2900 * Fast path for AH/ESP.
2845 2901 */
2846 2902 netstack_t *ns = ipst->ips_netstack;
2847 2903 ipsec_stack_t *ipss = ns->netstack_ipsec;
2848 2904
2849 2905 IP_STAT(ipst, ipsec_proto_ahesp);
2850 2906
2851 2907 if (!ipsec_loaded(ipss)) {
2852 2908 ip_proto_not_sup(mp, ira);
2853 2909 return;
2854 2910 }
2855 2911
2856 2912 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2857 2913 /* select inbound SA and have IPsec process the pkt */
2858 2914 if (protocol == IPPROTO_ESP) {
2859 2915 esph_t *esph;
2860 2916 boolean_t esp_in_udp_sa;
2861 2917 boolean_t esp_in_udp_packet;
2862 2918
2863 2919 mp = ipsec_inbound_esp_sa(mp, ira, &esph);
2864 2920 if (mp == NULL)
2865 2921 return;
2866 2922
2867 2923 ASSERT(esph != NULL);
2868 2924 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2869 2925 ASSERT(ira->ira_ipsec_esp_sa != NULL);
2870 2926 ASSERT(ira->ira_ipsec_esp_sa->ipsa_input_func != NULL);
2871 2927
2872 2928 esp_in_udp_sa = ((ira->ira_ipsec_esp_sa->ipsa_flags &
2873 2929 IPSA_F_NATT) != 0);
2874 2930 esp_in_udp_packet =
2875 2931 (ira->ira_flags & IRAF_ESP_UDP_PORTS) != 0;
2876 2932
2877 2933 /*
2878 2934 * The following is a fancy, but quick, way of saying:
2879 2935 * ESP-in-UDP SA and Raw ESP packet --> drop
2880 2936 * OR
2881 2937 * ESP SA and ESP-in-UDP packet --> drop
2882 2938 */
2883 2939 if (esp_in_udp_sa != esp_in_udp_packet) {
2884 2940 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2885 2941 ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2886 2942 DROPPER(ipss, ipds_esp_no_sa),
2887 2943 &ipss->ipsec_dropper);
2888 2944 return;
2889 2945 }
2890 2946 mp = ira->ira_ipsec_esp_sa->ipsa_input_func(mp, esph,
2891 2947 ira);
2892 2948 } else {
2893 2949 ah_t *ah;
2894 2950
2895 2951 mp = ipsec_inbound_ah_sa(mp, ira, &ah);
2896 2952 if (mp == NULL)
2897 2953 return;
2898 2954
2899 2955 ASSERT(ah != NULL);
2900 2956 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2901 2957 ASSERT(ira->ira_ipsec_ah_sa != NULL);
2902 2958 ASSERT(ira->ira_ipsec_ah_sa->ipsa_input_func != NULL);
2903 2959 mp = ira->ira_ipsec_ah_sa->ipsa_input_func(mp, ah,
2904 2960 ira);
2905 2961 }
2906 2962
2907 2963 if (mp == NULL) {
2908 2964 /*
2909 2965 * Either it failed or is pending. In the former case
2910 2966 * ipIfStatsInDiscards was increased.
2911 2967 */
2912 2968 return;
2913 2969 }
2914 2970 /* we're done with IPsec processing, send it up */
2915 2971 ip_input_post_ipsec(mp, ira);
2916 2972 return;
2917 2973 }
2918 2974 case IPPROTO_ENCAP: {
2919 2975 ipha_t *inner_ipha;
2920 2976
2921 2977 /*
2922 2978 * Handle self-encapsulated packets (IP-in-IP where
2923 2979 * the inner addresses == the outer addresses).
2924 2980 */
2925 2981 if ((uchar_t *)ipha + ip_hdr_length + sizeof (ipha_t) >
2926 2982 mp->b_wptr) {
2927 2983 if (ira->ira_pktlen <
2928 2984 ip_hdr_length + sizeof (ipha_t)) {
2929 2985 BUMP_MIB(ill->ill_ip_mib,
2930 2986 ipIfStatsInTruncatedPkts);
2931 2987 ip_drop_input("ipIfStatsInTruncatedPkts",
2932 2988 mp, ill);
2933 2989 freemsg(mp);
2934 2990 return;
2935 2991 }
2936 2992 ipha = ip_pullup(mp, (uchar_t *)ipha + ip_hdr_length +
2937 2993 sizeof (ipha_t) - mp->b_rptr, ira);
2938 2994 if (ipha == NULL) {
2939 2995 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2940 2996 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2941 2997 freemsg(mp);
2942 2998 return;
2943 2999 }
2944 3000 }
2945 3001 inner_ipha = (ipha_t *)((uchar_t *)ipha + ip_hdr_length);
2946 3002 /*
2947 3003 * Check the sanity of the inner IP header.
2948 3004 */
2949 3005 if ((IPH_HDR_VERSION(inner_ipha) != IPV4_VERSION)) {
2950 3006 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2951 3007 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2952 3008 freemsg(mp);
2953 3009 return;
2954 3010 }
2955 3011 if (IPH_HDR_LENGTH(inner_ipha) < sizeof (ipha_t)) {
2956 3012 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2957 3013 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2958 3014 freemsg(mp);
2959 3015 return;
2960 3016 }
2961 3017 if (inner_ipha->ipha_src != ipha->ipha_src ||
2962 3018 inner_ipha->ipha_dst != ipha->ipha_dst) {
2963 3019 /* We fallthru to iptun fanout below */
2964 3020 goto iptun;
2965 3021 }
2966 3022
2967 3023 /*
2968 3024 * Self-encapsulated tunnel packet. Remove
2969 3025 * the outer IP header and fanout again.
2970 3026 * We also need to make sure that the inner
2971 3027 * header is pulled up until options.
2972 3028 */
2973 3029 mp->b_rptr = (uchar_t *)inner_ipha;
2974 3030 ipha = inner_ipha;
2975 3031 ip_hdr_length = IPH_HDR_LENGTH(ipha);
2976 3032 if ((uchar_t *)ipha + ip_hdr_length > mp->b_wptr) {
2977 3033 if (ira->ira_pktlen <
2978 3034 (uchar_t *)ipha + ip_hdr_length - mp->b_rptr) {
2979 3035 BUMP_MIB(ill->ill_ip_mib,
2980 3036 ipIfStatsInTruncatedPkts);
2981 3037 ip_drop_input("ipIfStatsInTruncatedPkts",
2982 3038 mp, ill);
2983 3039 freemsg(mp);
2984 3040 return;
2985 3041 }
2986 3042 ipha = ip_pullup(mp,
2987 3043 (uchar_t *)ipha + ip_hdr_length - mp->b_rptr, ira);
2988 3044 if (ipha == NULL) {
2989 3045 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2990 3046 ip_drop_input("ipIfStatsInDiscards", mp, ill);
2991 3047 freemsg(mp);
2992 3048 return;
2993 3049 }
2994 3050 }
2995 3051 if (ip_hdr_length > sizeof (ipha_t)) {
2996 3052 /* We got options on the inner packet. */
2997 3053 ipaddr_t dst = ipha->ipha_dst;
2998 3054 int error = 0;
2999 3055
3000 3056 dst = ip_input_options(ipha, dst, mp, ira, &error);
3001 3057 if (error != 0) {
3002 3058 /*
3003 3059 * An ICMP error has been sent and the packet
3004 3060 * has been dropped.
3005 3061 */
3006 3062 return;
3007 3063 }
3008 3064 if (dst != ipha->ipha_dst) {
3009 3065 /*
3010 3066 * Someone put a source-route in
3011 3067 * the inside header of a self-
3012 3068 * encapsulated packet. Drop it
3013 3069 * with extreme prejudice and let
3014 3070 * the sender know.
3015 3071 */
3016 3072 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
3017 3073 mp, ill);
3018 3074 icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED,
3019 3075 ira);
3020 3076 return;
3021 3077 }
3022 3078 }
3023 3079 if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
3024 3080 /*
3025 3081 * This means that somebody is sending
3026 3082 * Self-encapsualted packets without AH/ESP.
3027 3083 *
3028 3084 * Send this packet to find a tunnel endpoint.
3029 3085 * if I can't find one, an ICMP
3030 3086 * PROTOCOL_UNREACHABLE will get sent.
3031 3087 */
3032 3088 protocol = ipha->ipha_protocol;
3033 3089 ira->ira_protocol = protocol;
3034 3090 goto iptun;
3035 3091 }
3036 3092
3037 3093 /* Update based on removed IP header */
3038 3094 ira->ira_ip_hdr_length = ip_hdr_length;
3039 3095 ira->ira_pktlen = ntohs(ipha->ipha_length);
3040 3096
3041 3097 if (ira->ira_flags & IRAF_IPSEC_DECAPS) {
3042 3098 /*
3043 3099 * This packet is self-encapsulated multiple
3044 3100 * times. We don't want to recurse infinitely.
3045 3101 * To keep it simple, drop the packet.
3046 3102 */
3047 3103 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3048 3104 ip_drop_input("ipIfStatsInDiscards", mp, ill);
3049 3105 freemsg(mp);
3050 3106 return;
3051 3107 }
3052 3108 ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
3053 3109 ira->ira_flags |= IRAF_IPSEC_DECAPS;
3054 3110
3055 3111 ip_input_post_ipsec(mp, ira);
3056 3112 return;
3057 3113 }
3058 3114
3059 3115 iptun: /* IPPROTO_ENCAPS that is not self-encapsulated */
3060 3116 case IPPROTO_IPV6:
3061 3117 /* iptun will verify trusted label */
3062 3118 connp = ipcl_classify_v4(mp, protocol, ip_hdr_length,
3063 3119 ira, ipst);
3064 3120 if (connp != NULL) {
3065 3121 BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3066 3122 ira->ira_ill = ira->ira_rill = NULL;
3067 3123 (connp->conn_recv)(connp, mp, NULL, ira);
3068 3124 CONN_DEC_REF(connp);
3069 3125 ira->ira_ill = ill;
3070 3126 ira->ira_rill = rill;
3071 3127 return;
3072 3128 }
3073 3129 /* FALLTHRU */
3074 3130 default:
3075 3131 /*
3076 3132 * On a labeled system, we have to check whether the zone
3077 3133 * itself is permitted to receive raw traffic.
3078 3134 */
3079 3135 if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
3080 3136 if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
3081 3137 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3082 3138 ip_drop_input("ipIfStatsInDiscards", mp, ill);
3083 3139 freemsg(mp);
3084 3140 return;
3085 3141 }
3086 3142 }
3087 3143 break;
3088 3144 }
3089 3145
3090 3146 /*
3091 3147 * The above input functions may have returned the pulled up message.
3092 3148 * So ipha need to be reinitialized.
3093 3149 */
3094 3150 ipha = (ipha_t *)mp->b_rptr;
3095 3151 ira->ira_protocol = protocol = ipha->ipha_protocol;
3096 3152 if (ipst->ips_ipcl_proto_fanout_v4[protocol].connf_head == NULL) {
3097 3153 /*
3098 3154 * No user-level listener for these packets packets.
3099 3155 * Check for IPPROTO_ENCAP...
3100 3156 */
3101 3157 if (protocol == IPPROTO_ENCAP && ipst->ips_ip_g_mrouter) {
3102 3158 /*
3103 3159 * Check policy here,
3104 3160 * THEN ship off to ip_mroute_decap().
3105 3161 *
3106 3162 * BTW, If I match a configured IP-in-IP
3107 3163 * tunnel above, this path will not be reached, and
3108 3164 * ip_mroute_decap will never be called.
3109 3165 */
3110 3166 mp = ipsec_check_global_policy(mp, connp,
3111 3167 ipha, NULL, ira, ns);
3112 3168 if (mp != NULL) {
3113 3169 ip_mroute_decap(mp, ira);
3114 3170 } /* Else we already freed everything! */
3115 3171 } else {
3116 3172 ip_proto_not_sup(mp, ira);
3117 3173 }
3118 3174 return;
3119 3175 }
3120 3176
3121 3177 /*
3122 3178 * Handle fanout to raw sockets. There
3123 3179 * can be more than one stream bound to a particular
3124 3180 * protocol. When this is the case, each one gets a copy
3125 3181 * of any incoming packets.
3126 3182 */
3127 3183 ASSERT(ira->ira_protocol == ipha->ipha_protocol);
3128 3184 ip_fanout_proto_v4(mp, ipha, ira);
3129 3185 return;
3130 3186
3131 3187 discard:
3132 3188 BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3133 3189 ip_drop_input("ipIfStatsInDiscards", mp, ill);
3134 3190 freemsg(mp);
3135 3191 #undef rptr
3136 3192 }
↓ open down ↓ |
410 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX