4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
23 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
25 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
27 /* Copyright (c) 1990 Mentat Inc. */
29 #include <sys/types.h>
30 #include <sys/stream.h>
32 #include <sys/stropts.h>
33 #include <sys/sysmacros.h>
34 #include <sys/strsubr.h>
35 #include <sys/strlog.h>
36 #include <sys/strsun.h>
38 #define _SUN_TPI_VERSION 2
39 #include <sys/tihdr.h>
40 #include <sys/xti_inet.h>
42 #include <sys/sunddi.h>
43 #include <sys/cmn_err.h>
44 #include <sys/debug.h>
46 #include <sys/modctl.h>
47 #include <sys/atomic.h>
48 #include <sys/policy.h>
51 #include <sys/systm.h>
52 #include <sys/param.h>
55 #include <sys/socket.h>
56 #include <sys/vtrace.h>
57 #include <sys/isa_defs.h>
60 #include <net/if_arp.h>
61 #include <net/route.h>
62 #include <sys/sockio.h>
63 #include <netinet/in.h>
64 #include <net/if_dl.h>
66 #include <inet/common.h>
68 #include <inet/mib2.h>
71 #include <inet/snmpcom.h>
72 #include <inet/kstatcom.h>
74 #include <netinet/igmp_var.h>
75 #include <netinet/ip6.h>
76 #include <netinet/icmp6.h>
77 #include <netinet/sctp.h>
80 #include <inet/ip_impl.h>
82 #include <inet/ip6_asp.h>
83 #include <inet/optcom.h>
85 #include <inet/tcp_impl.h>
86 #include <inet/ip_multi.h>
87 #include <inet/ip_if.h>
88 #include <inet/ip_ire.h>
89 #include <inet/ip_ftable.h>
90 #include <inet/ip_rts.h>
91 #include <inet/ip_ndp.h>
92 #include <inet/ip_listutils.h>
93 #include <netinet/igmp.h>
94 #include <netinet/ip_mroute.h>
95 #include <inet/ipp_common.h>
97 #include <net/pfkeyv2.h>
98 #include <inet/sadb.h>
99 #include <inet/ipsec_impl.h>
100 #include <inet/ipdrop.h>
101 #include <inet/ip_netinfo.h>
102 #include <inet/ilb_ip.h>
103 #include <sys/squeue_impl.h>
104 #include <sys/squeue.h>
106 #include <sys/ethernet.h>
107 #include <net/if_types.h>
108 #include <sys/cpuvar.h>
111 #include <ipp/ipp_impl.h>
112 #include <ipp/ipgpc/ipgpc.h>
114 #include <sys/pattr.h>
115 #include <inet/ipclassifier.h>
116 #include <inet/sctp_ip.h>
117 #include <inet/sctp/sctp_impl.h>
118 #include <inet/udp_impl.h>
119 #include <sys/sunddi.h>
121 #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */
124 extern boolean_t skip_sctp_cksum
;
127 static void ip_input_local_v4(ire_t
*, mblk_t
*, ipha_t
*,
130 static void ip_input_broadcast_v4(ire_t
*, mblk_t
*, ipha_t
*,
132 static void ip_input_multicast_v4(ire_t
*, mblk_t
*, ipha_t
*,
135 #pragma inline(ip_input_common_v4, ip_input_local_v4, ip_forward_xmit_v4)
138 * Direct read side procedure capable of dealing with chains. GLDv3 based
139 * drivers call this function directly with mblk chains while STREAMS
140 * read side procedure ip_rput() calls this for single packet with ip_ring
141 * set to NULL to process one packet at a time.
143 * The ill will always be valid if this function is called directly from
146 * If ip_input() is called from GLDv3:
148 * - This must be a non-VLAN IP stream.
149 * - 'mp' is either an untagged or a special priority-tagged packet.
150 * - Any VLAN tag that was in the MAC header has been stripped.
152 * If the IP header in packet is not 32-bit aligned, every message in the
153 * chain will be aligned before further operations. This is required on SPARC
157 ip_input(ill_t
*ill
, ill_rx_ring_t
*ip_ring
, mblk_t
*mp_chain
,
158 struct mac_header_info_s
*mhip
)
160 (void) ip_input_common_v4(ill
, ip_ring
, mp_chain
, mhip
, NULL
, NULL
,
165 * ip_accept_tcp() - This function is called by the squeue when it retrieves
166 * a chain of packets in the poll mode. The packets have gone through the
167 * data link processing but not IP processing. For performance and latency
168 * reasons, the squeue wants to process the chain in line instead of feeding
169 * it back via ip_input path.
171 * We set up the ip_recv_attr_t with IRAF_TARGET_SQP to that ip_fanout_v4
172 * will pass back any TCP packets matching the target sqp to
173 * ip_input_common_v4 using ira_target_sqp_mp. Other packets are handled by
174 * ip_input_v4 and ip_fanout_v4 as normal.
175 * The TCP packets that match the target squeue are returned to the caller
176 * as a b_next chain after each packet has been prepend with an mblk
177 * from ip_recv_attr_to_mblk.
180 ip_accept_tcp(ill_t
*ill
, ill_rx_ring_t
*ip_ring
, squeue_t
*target_sqp
,
181 mblk_t
*mp_chain
, mblk_t
**last
, uint_t
*cnt
)
183 return (ip_input_common_v4(ill
, ip_ring
, mp_chain
, NULL
, target_sqp
,
188 * Used by ip_input and ip_accept_tcp
189 * The last three arguments are only used by ip_accept_tcp, and mhip is
190 * only used by ip_input.
193 ip_input_common_v4(ill_t
*ill
, ill_rx_ring_t
*ip_ring
, mblk_t
*mp_chain
,
194 struct mac_header_info_s
*mhip
, squeue_t
*target_sqp
,
195 mblk_t
**last
, uint_t
*cnt
)
199 ip_recv_attr_t iras
; /* Receive attributes */
201 iaflags_t chain_flags
= 0; /* Fixed for chain */
202 mblk_t
*ahead
= NULL
; /* Accepted head */
203 mblk_t
*atail
= NULL
; /* Accepted tail */
204 uint_t acnt
= 0; /* Accepted count */
206 ASSERT(mp_chain
!= NULL
);
209 /* These ones do not change as we loop over packets */
210 iras
.ira_ill
= iras
.ira_rill
= ill
;
211 iras
.ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
212 iras
.ira_rifindex
= iras
.ira_ruifindex
;
214 iras
.ira_ring
= ip_ring
;
215 /* For ECMP and outbound transmit ring selection */
216 iras
.ira_xmit_hint
= ILL_RING_TO_XMIT_HINT(ip_ring
);
218 iras
.ira_target_sqp
= target_sqp
;
219 iras
.ira_target_sqp_mp
= NULL
;
220 if (target_sqp
!= NULL
)
221 chain_flags
|= IRAF_TARGET_SQP
;
224 * We try to have a mhip pointer when possible, but
225 * it might be NULL in some cases. In those cases we
226 * have to assume unicast.
228 iras
.ira_mhip
= mhip
;
231 switch (mhip
->mhi_dsttype
) {
232 case MAC_ADDRTYPE_MULTICAST
:
233 chain_flags
|= IRAF_L2DST_MULTICAST
;
235 case MAC_ADDRTYPE_BROADCAST
:
236 chain_flags
|= IRAF_L2DST_BROADCAST
;
242 * Initialize the one-element route cache.
244 * We do ire caching from one iteration to
245 * another. In the event the packet chain contains
246 * all packets from the same dst, this caching saves
247 * an ire_route_recursive for each of the succeeding
248 * packets in a packet chain.
251 rtc
.rtc_ipaddr
= INADDR_ANY
;
253 /* Loop over b_next */
254 for (mp
= mp_chain
; mp
!= NULL
; mp
= mp_chain
) {
255 mp_chain
= mp
->b_next
;
258 ASSERT(DB_TYPE(mp
) == M_DATA
);
262 * if db_ref > 1 then copymsg and free original. Packet
263 * may be changed and we do not want the other entity
264 * who has a reference to this message to trip over the
265 * changes. This is a blind change because trying to
266 * catch all places that might change the packet is too
269 * This corresponds to the fast path case, where we have
270 * a chain of M_DATA mblks. We check the db_ref count
271 * of only the 1st data block in the mblk chain. There
272 * doesn't seem to be a reason why a device driver would
273 * send up data with varying db_ref counts in the mblk
274 * chain. In any case the Fast path is a private
275 * interface, and our drivers don't do such a thing.
276 * Given the above assumption, there is no need to walk
277 * down the entire mblk chain (which could have a
278 * potential performance problem)
280 * The "(DB_REF(mp) > 1)" check was moved from ip_rput()
281 * to here because of exclusive ip stacks and vnics.
282 * Packets transmitted from exclusive stack over vnic
283 * can have db_ref > 1 and when it gets looped back to
284 * another vnic in a different zone, you have ip_input()
285 * getting dblks with db_ref > 1. So if someone
286 * complains of TCP performance under this scenario,
287 * take a serious look here on the impact of copymsg().
289 if (DB_REF(mp
) > 1) {
290 if ((mp
= ip_fix_dbref(mp
, &iras
)) == NULL
) {
291 /* mhip might point into 1st packet in chain */
292 iras
.ira_mhip
= NULL
;
298 * IP header ptr not aligned?
299 * OR IP header not complete in first mblk
301 ipha
= (ipha_t
*)mp
->b_rptr
;
302 if (!OK_32PTR(ipha
) || MBLKL(mp
) < IP_SIMPLE_HDR_LENGTH
) {
303 mp
= ip_check_and_align_header(mp
, IP_SIMPLE_HDR_LENGTH
,
306 /* mhip might point into 1st packet in chain */
307 iras
.ira_mhip
= NULL
;
310 ipha
= (ipha_t
*)mp
->b_rptr
;
313 /* Protect against a mix of Ethertypes and IP versions */
314 if (IPH_HDR_VERSION(ipha
) != IPV4_VERSION
) {
315 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInHdrErrors
);
316 ip_drop_input("ipIfStatsInHdrErrors", mp
, ill
);
318 /* mhip might point into 1st packet in the chain. */
319 iras
.ira_mhip
= NULL
;
324 * Check for Martian addrs; we have to explicitly
325 * test for for zero dst since this is also used as
326 * an indication that the rtc is not used.
328 if (ipha
->ipha_dst
== INADDR_ANY
) {
329 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInAddrErrors
);
330 ip_drop_input("ipIfStatsInAddrErrors", mp
, ill
);
332 /* mhip might point into 1st packet in the chain. */
333 iras
.ira_mhip
= NULL
;
338 * Keep L2SRC from a previous packet in chain since mhip
339 * might point into an earlier packet in the chain.
340 * Keep IRAF_VERIFIED_SRC to avoid redoing broadcast
341 * source check in forwarding path.
343 chain_flags
|= (iras
.ira_flags
&
344 (IRAF_L2SRC_SET
|IRAF_VERIFIED_SRC
));
346 iras
.ira_flags
= IRAF_IS_IPV4
| IRAF_VERIFY_IP_CKSUM
|
347 IRAF_VERIFY_ULP_CKSUM
| chain_flags
;
348 iras
.ira_free_flags
= 0;
349 iras
.ira_cred
= NULL
;
350 iras
.ira_cpid
= NOPID
;
351 iras
.ira_zoneid
= ALL_ZONES
; /* Default for forwarding */
354 * We must count all incoming packets, even if they end
355 * up being dropped later on. Defer counting bytes until
356 * we have the whole IP header in first mblk.
358 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInReceives
);
360 iras
.ira_pktlen
= ntohs(ipha
->ipha_length
);
361 UPDATE_MIB(ill
->ill_ip_mib
, ipIfStatsHCInOctets
,
368 * The former is used in unusual cases. See ill_set_inputfn().
370 (*ill
->ill_inputfn
)(mp
, ipha
, &ipha
->ipha_dst
, &iras
, &rtc
);
372 /* Any references to clean up? No hold on ira_ill */
373 if (iras
.ira_flags
& (IRAF_IPSEC_SECURE
))
374 ira_cleanup(&iras
, B_FALSE
);
376 if (iras
.ira_target_sqp_mp
!= NULL
) {
377 /* Better be called from ip_accept_tcp */
378 ASSERT(target_sqp
!= NULL
);
380 /* Found one packet to accept */
381 mp
= iras
.ira_target_sqp_mp
;
382 iras
.ira_target_sqp_mp
= NULL
;
383 ASSERT(ip_recv_attr_is_mblk(mp
));
393 /* mhip might point into 1st packet in the chain. */
394 iras
.ira_mhip
= NULL
;
396 /* Any remaining references to the route cache? */
397 if (rtc
.rtc_ire
!= NULL
) {
398 ASSERT(rtc
.rtc_ipaddr
!= INADDR_ANY
);
399 ire_refrele(rtc
.rtc_ire
);
403 /* Better be called from ip_accept_tcp */
404 ASSERT(target_sqp
!= NULL
);
414 * This input function is used when
415 * - DHCP unicast before we have an IP address configured
416 * - there is an listener for IPPROTO_RSVP
419 ill_input_full_v4(mblk_t
*mp
, void *iph_arg
, void *nexthop_arg
,
420 ip_recv_attr_t
*ira
, rtc_t
*rtc
)
422 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
423 ipaddr_t nexthop
= *(ipaddr_t
*)nexthop_arg
;
424 ill_t
*ill
= ira
->ira_ill
;
425 ip_stack_t
*ipst
= ill
->ill_ipst
;
428 * Brutal hack for DHCPv4 unicast: RFC2131 allows a DHCP
429 * server to unicast DHCP packets to a DHCP client using the
430 * IP address it is offering to the client. This can be
431 * disabled through the "broadcast bit", but not all DHCP
432 * servers honor that bit. Therefore, to interoperate with as
433 * many DHCP servers as possible, the DHCP client allows the
434 * server to unicast, but we treat those packets as broadcast
435 * here. Note that we don't rewrite the packet itself since
436 * (a) that would mess up the checksums and (b) the DHCP
437 * client conn is bound to INADDR_ANY so ip_fanout_udp() will
438 * hand it the packet regardless.
440 if (ill
->ill_dhcpinit
!= 0 &&
441 ipha
->ipha_version_and_hdr_length
== IP_SIMPLE_HDR_VERSION
&&
442 ipha
->ipha_protocol
== IPPROTO_UDP
) {
445 ipha
= ip_pullup(mp
, sizeof (ipha_t
) + sizeof (udpha_t
), ira
);
447 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
448 ip_drop_input("ipIfStatsInDiscards - dhcp", mp
, ill
);
452 /* Reload since pullupmsg() can change b_rptr. */
453 udpha
= (udpha_t
*)&ipha
[1];
455 if (ntohs(udpha
->uha_dst_port
) == IPPORT_BOOTPC
) {
456 DTRACE_PROBE2(ip4__dhcpinit__pkt
, ill_t
*, ill
,
459 * This assumes that we deliver to all conns for
460 * multicast and broadcast packets.
462 nexthop
= INADDR_BROADCAST
;
463 ira
->ira_flags
|= IRAF_DHCP_UNICAST
;
468 * If rsvpd is running, let RSVP daemon handle its processing
469 * and forwarding of RSVP multicast/unicast packets.
470 * If rsvpd is not running but mrouted is running, RSVP
471 * multicast packets are forwarded as multicast traffic
472 * and RSVP unicast packets are forwarded by unicast router.
473 * If neither rsvpd nor mrouted is running, RSVP multicast
474 * packets are not forwarded, but the unicast packets are
475 * forwarded like unicast traffic.
477 if (ipha
->ipha_protocol
== IPPROTO_RSVP
&&
478 ipst
->ips_ipcl_proto_fanout_v4
[IPPROTO_RSVP
].connf_head
!= NULL
) {
479 /* RSVP packet and rsvpd running. Treat as ours */
480 ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(nexthop
)));
482 * We use a multicast address to get the packet to
483 * ire_recv_multicast_v4. There will not be a membership
484 * check since we set IRAF_RSVP
486 nexthop
= htonl(INADDR_UNSPEC_GROUP
);
487 ira
->ira_flags
|= IRAF_RSVP
;
490 ill_input_short_v4(mp
, ipha
, &nexthop
, ira
, rtc
);
494 * This is the tail-end of the full receive side packet handling.
495 * It can be used directly when the configuration is simple.
498 ill_input_short_v4(mblk_t
*mp
, void *iph_arg
, void *nexthop_arg
,
499 ip_recv_attr_t
*ira
, rtc_t
*rtc
)
503 ill_t
*ill
= ira
->ira_ill
;
504 ip_stack_t
*ipst
= ill
->ill_ipst
;
507 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
508 ipaddr_t nexthop
= *(ipaddr_t
*)nexthop_arg
;
509 ilb_stack_t
*ilbs
= ipst
->ips_netstack
->netstack_ilb
;
511 #define rptr ((uchar_t *)ipha)
513 ASSERT(DB_TYPE(mp
) == M_DATA
);
516 * The following test for loopback is faster than
517 * IP_LOOPBACK_ADDR(), because it avoids any bitwise
519 * Note that these addresses are always in network byte order
521 if (((*(uchar_t
*)&ipha
->ipha_dst
) == IN_LOOPBACKNET
) ||
522 ((*(uchar_t
*)&ipha
->ipha_src
) == IN_LOOPBACKNET
)) {
523 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInAddrErrors
);
524 ip_drop_input("ipIfStatsInAddrErrors", mp
, ill
);
529 len
= mp
->b_wptr
- rptr
;
530 pkt_len
= ira
->ira_pktlen
;
532 /* multiple mblk or too short */
535 mp
= ip_check_length(mp
, rptr
, len
, pkt_len
,
536 IP_SIMPLE_HDR_LENGTH
, ira
);
539 ipha
= (ipha_t
*)mp
->b_rptr
;
542 DTRACE_IP7(receive
, mblk_t
*, mp
, conn_t
*, NULL
, void_ip_t
*,
543 ipha
, __dtrace_ipsr_ill_t
*, ill
, ipha_t
*, ipha
, ip6_t
*, NULL
,
547 * The event for packets being received from a 'physical'
548 * interface is placed after validation of the source and/or
549 * destination address as being local so that packets can be
550 * redirected to loopback addresses using ipnat.
552 DTRACE_PROBE4(ip4__physical__in__start
,
553 ill_t
*, ill
, ill_t
*, NULL
,
554 ipha_t
*, ipha
, mblk_t
*, mp
);
556 if (HOOKS4_INTERESTED_PHYSICAL_IN(ipst
)) {
557 int ll_multicast
= 0;
559 ipaddr_t orig_dst
= ipha
->ipha_dst
;
561 if (ira
->ira_flags
& IRAF_L2DST_MULTICAST
)
562 ll_multicast
= HPE_MULTICAST
;
563 else if (ira
->ira_flags
& IRAF_L2DST_BROADCAST
)
564 ll_multicast
= HPE_BROADCAST
;
566 FW_HOOKS(ipst
->ips_ip4_physical_in_event
,
567 ipst
->ips_ipv4firewall_physical_in
,
568 ill
, NULL
, ipha
, mp
, mp
, ll_multicast
, ipst
, error
);
570 DTRACE_PROBE1(ip4__physical__in__end
, mblk_t
*, mp
);
574 /* The length could have changed */
575 ipha
= (ipha_t
*)mp
->b_rptr
;
576 ira
->ira_pktlen
= ntohs(ipha
->ipha_length
);
577 pkt_len
= ira
->ira_pktlen
;
580 * In case the destination changed we override any previous
583 if (orig_dst
!= ipha
->ipha_dst
)
584 nexthop
= ipha
->ipha_dst
;
585 if (nexthop
== INADDR_ANY
) {
586 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInAddrErrors
);
587 ip_drop_input("ipIfStatsInAddrErrors", mp
, ill
);
593 if (ipst
->ips_ip4_observe
.he_interested
) {
597 * On the inbound path the src zone will be unknown as
598 * this packet has come from the wire.
600 dzone
= ip_get_zoneid_v4(nexthop
, mp
, ira
, ALL_ZONES
);
601 ipobs_hook(mp
, IPOBS_HOOK_INBOUND
, ALL_ZONES
, dzone
, ill
, ipst
);
605 * If there is a good HW IP header checksum we clear the need
606 * look at the IP header checksum.
608 if ((DB_CKSUMFLAGS(mp
) & HCK_IPV4_HDRCKSUM
) &&
609 ILL_HCKSUM_CAPABLE(ill
) && dohwcksum
) {
610 /* Header checksum was ok. Clear the flag */
611 DB_CKSUMFLAGS(mp
) &= ~HCK_IPV4_HDRCKSUM
;
612 ira
->ira_flags
&= ~IRAF_VERIFY_IP_CKSUM
;
616 * Here we check to see if we machine is setup as
617 * L3 loadbalancer and if the incoming packet is for a VIP
619 * Check the following:
620 * - there is at least a rule
621 * - protocol of the packet is supported
623 if (ilb_has_rules(ilbs
) && ILB_SUPP_L4(ipha
->ipha_protocol
)) {
627 /* For convenience, we pull up the mblk. */
628 if (mp
->b_cont
!= NULL
) {
629 if (pullupmsg(mp
, -1) == 0) {
630 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
631 ip_drop_input("ipIfStatsInDiscards - pullupmsg",
636 ipha
= (ipha_t
*)mp
->b_rptr
;
640 * We just drop all fragments going to any VIP, at
643 if (ntohs(ipha
->ipha_fragment_offset_and_flags
) &
644 (IPH_MF
| IPH_OFFSET
)) {
645 if (!ilb_rule_match_vip_v4(ilbs
, nexthop
, NULL
)) {
649 ILB_KSTAT_UPDATE(ilbs
, ip_frag_in
, 1);
650 ILB_KSTAT_UPDATE(ilbs
, ip_frag_dropped
, 1);
651 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
652 ip_drop_input("ILB fragment", mp
, ill
);
656 lb_ret
= ilb_check_v4(ilbs
, ill
, mp
, ipha
, ipha
->ipha_protocol
,
657 (uint8_t *)ipha
+ IPH_HDR_LENGTH(ipha
), &lb_dst
);
659 if (lb_ret
== ILB_DROPPED
) {
660 /* Is this the right counter to increase? */
661 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
662 ip_drop_input("ILB_DROPPED", mp
, ill
);
666 if (lb_ret
== ILB_BALANCED
) {
667 /* Set the dst to that of the chosen server */
669 DB_CKSUMFLAGS(mp
) = 0;
674 opt_len
= ipha
->ipha_version_and_hdr_length
- IP_SIMPLE_HDR_VERSION
;
675 ira
->ira_ip_hdr_length
= IP_SIMPLE_HDR_LENGTH
;
679 ira
->ira_ip_hdr_length
+= (opt_len
<< 2);
680 ira
->ira_flags
|= IRAF_IPV4_OPTIONS
;
682 /* IP Options present! Validate the length. */
683 mp
= ip_check_optlen(mp
, ipha
, opt_len
, pkt_len
, ira
);
687 /* Might have changed */
688 ipha
= (ipha_t
*)mp
->b_rptr
;
690 /* Verify IP header checksum before parsing the options */
691 if ((ira
->ira_flags
& IRAF_VERIFY_IP_CKSUM
) &&
693 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInCksumErrs
);
694 ip_drop_input("ipIfStatsInCksumErrs", mp
, ill
);
698 ira
->ira_flags
&= ~IRAF_VERIFY_IP_CKSUM
;
701 * Go off to ip_input_options which returns the next hop
702 * destination address, which may have been affected
705 IP_STAT(ipst
, ip_opt
);
707 nexthop
= ip_input_options(ipha
, nexthop
, mp
, ira
, &error
);
710 * An ICMP error has been sent and the packet has
717 if (ill
->ill_flags
& ILLF_ROUTER
)
718 irr_flags
= IRR_ALLOCATE
;
720 irr_flags
= IRR_NONE
;
722 if (nexthop
== rtc
->rtc_ipaddr
&& rtc
->rtc_ire
!= NULL
) {
723 /* Use the route cache */
726 /* Update the route cache */
727 if (CLASSD(nexthop
)) {
728 ire
= ire_multicast(ill
);
730 /* Just match the destination */
731 ire
= ire_route_recursive_dstonly_v4(nexthop
, irr_flags
,
732 ira
->ira_xmit_hint
, ipst
);
735 if (rtc
->rtc_ire
!= NULL
)
736 ire_refrele(rtc
->rtc_ire
);
738 rtc
->rtc_ipaddr
= nexthop
;
741 ire
->ire_ib_pkt_count
++;
744 * Based on ire_type and ire_flags call one of:
745 * ire_recv_local_v4 - for IRE_LOCAL
746 * ire_recv_loopback_v4 - for IRE_LOOPBACK
747 * ire_recv_noroute_v4 - if RTF_REJECT or RTF_BLACHOLE
748 * ire_recv_multicast_v4 - for IRE_MULTICAST
749 * ire_recv_broadcast_v4 - for IRE_BROADCAST
750 * ire_recv_noaccept_v4 - for ire_noaccept ones
751 * ire_recv_forward_v4 - for the rest.
753 (*ire
->ire_recvfn
)(ire
, mp
, ipha
, ira
);
758 * ire_recvfn for IREs that need forwarding
761 ire_recv_forward_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
, ip_recv_attr_t
*ira
)
763 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
764 ill_t
*ill
= ira
->ira_ill
;
765 ip_stack_t
*ipst
= ill
->ill_ipst
;
768 ipaddr_t src
= ipha
->ipha_src
;
769 uint32_t added_tx_len
;
770 uint32_t mtu
, iremtu
;
772 if (ira
->ira_flags
& (IRAF_L2DST_MULTICAST
|IRAF_L2DST_BROADCAST
)) {
773 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsForwProhibits
);
774 ip_drop_input("l2 multicast not forwarded", mp
, ill
);
779 if (!(ill
->ill_flags
& ILLF_ROUTER
) && !ip_source_routed(ipha
, ipst
)) {
780 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsForwProhibits
);
781 ip_drop_input("ipIfStatsForwProhibits", mp
, ill
);
787 * Either ire_nce_capable or ire_dep_parent would be set for the IRE
788 * when it is found by ire_route_recursive, but that some other thread
789 * could have changed the routes with the effect of clearing
790 * ire_dep_parent. In that case we'd end up dropping the packet, or
791 * finding a new nce below.
792 * Get, allocate, or update the nce.
793 * We get a refhold on ire_nce_cache as a result of this to avoid races
794 * where ire_nce_cache is deleted.
796 * This ensures that we don't forward if the interface is down since
797 * ipif_down removes all the nces.
799 mutex_enter(&ire
->ire_lock
);
800 nce
= ire
->ire_nce_cache
;
802 /* Not yet set up - try to set one up */
803 mutex_exit(&ire
->ire_lock
);
804 (void) ire_revalidate_nce(ire
);
805 mutex_enter(&ire
->ire_lock
);
806 nce
= ire
->ire_nce_cache
;
808 mutex_exit(&ire
->ire_lock
);
809 /* The ire_dep_parent chain went bad, or no memory */
810 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
811 ip_drop_input("No ire_dep_parent", mp
, ill
);
817 mutex_exit(&ire
->ire_lock
);
819 if (nce
->nce_is_condemned
) {
822 nce1
= ire_handle_condemned_nce(nce
, ire
, ipha
, NULL
, B_FALSE
);
825 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
826 ip_drop_input("No nce", mp
, ill
);
832 dst_ill
= nce
->nce_ill
;
835 * Unless we are forwarding, drop the packet.
836 * We have to let source routed packets through if they go out
837 * the same interface i.e., they are 'ping -l' packets.
839 if (!(dst_ill
->ill_flags
& ILLF_ROUTER
) &&
840 !(ip_source_routed(ipha
, ipst
) && dst_ill
== ill
)) {
841 if (ip_source_routed(ipha
, ipst
)) {
842 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp
, ill
);
843 icmp_unreachable(mp
, ICMP_SOURCE_ROUTE_FAILED
, ira
);
847 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsForwProhibits
);
848 ip_drop_input("ipIfStatsForwProhibits", mp
, ill
);
854 if (ire
->ire_zoneid
!= GLOBAL_ZONEID
&& ire
->ire_zoneid
!= ALL_ZONES
) {
855 ipaddr_t dst
= ipha
->ipha_dst
;
857 ire
->ire_ib_pkt_count
--;
859 * Should only use IREs that are visible from the
860 * global zone for forwarding.
861 * Take a source route into account the same way as ip_input
864 if (ira
->ira_flags
& IRAF_IPV4_OPTIONS
) {
867 dst
= ip_input_options(ipha
, dst
, mp
, ira
, &error
);
868 ASSERT(error
== 0); /* ip_input checked */
870 ire
= ire_route_recursive_v4(dst
, 0, NULL
, GLOBAL_ZONEID
, 0,
871 (ill
->ill_flags
& ILLF_ROUTER
) ? IRR_ALLOCATE
: IRR_NONE
,
872 ira
->ira_xmit_hint
, ipst
, NULL
, NULL
);
873 ire
->ire_ib_pkt_count
++;
874 (*ire
->ire_recvfn
)(ire
, mp
, ipha
, ira
);
881 * ipIfStatsHCInForwDatagrams should only be increment if there
882 * will be an attempt to forward the packet, which is why we
883 * increment after the above condition has been checked.
885 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInForwDatagrams
);
887 /* Initiate Read side IPPF processing */
888 if (IPP_ENABLED(IPP_FWD_IN
, ipst
)) {
889 /* ip_process translates an IS_UNDER_IPMP */
890 mp
= ip_process(IPP_FWD_IN
, mp
, ill
, ill
);
892 /* ip_drop_packet and MIB done */
893 ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred "
894 "during IPPF processing\n"));
900 DTRACE_PROBE4(ip4__forwarding__start
,
901 ill_t
*, ill
, ill_t
*, dst_ill
, ipha_t
*, ipha
, mblk_t
*, mp
);
903 if (HOOKS4_INTERESTED_FORWARDING(ipst
)) {
906 FW_HOOKS(ipst
->ips_ip4_forwarding_event
,
907 ipst
->ips_ipv4firewall_forwarding
,
908 ill
, dst_ill
, ipha
, mp
, mp
, 0, ipst
, error
);
910 DTRACE_PROBE1(ip4__forwarding__end
, mblk_t
*, mp
);
917 * Even if the destination was changed by the filter we use the
918 * forwarding decision that was made based on the address
922 /* Might have changed */
923 ipha
= (ipha_t
*)mp
->b_rptr
;
924 ira
->ira_pktlen
= ntohs(ipha
->ipha_length
);
927 /* Packet is being forwarded. Turning off hwcksum flag. */
928 DB_CKSUMFLAGS(mp
) = 0;
931 * Martian Address Filtering [RFC 1812, Section 5.3.7]
932 * The loopback address check for both src and dst has already
933 * been checked in ip_input
934 * In the future one can envision adding RPF checks using number 3.
935 * If we already checked the same source address we can skip this.
937 if (!(ira
->ira_flags
& IRAF_VERIFIED_SRC
) ||
938 src
!= ira
->ira_verified_src
) {
939 switch (ipst
->ips_src_check
) {
943 if (ip_type_v4(src
, ipst
) == IRE_BROADCAST
) {
944 BUMP_MIB(ill
->ill_ip_mib
,
945 ipIfStatsForwProhibits
);
946 BUMP_MIB(ill
->ill_ip_mib
,
947 ipIfStatsInAddrErrors
);
948 ip_drop_input("ipIfStatsInAddrErrors", mp
, ill
);
957 BUMP_MIB(ill
->ill_ip_mib
,
958 ipIfStatsForwProhibits
);
959 BUMP_MIB(ill
->ill_ip_mib
,
960 ipIfStatsInAddrErrors
);
961 ip_drop_input("ipIfStatsInAddrErrors", mp
, ill
);
968 /* Remember for next packet */
969 ira
->ira_flags
|= IRAF_VERIFIED_SRC
;
970 ira
->ira_verified_src
= src
;
974 * Check if packet is going out the same link on which it arrived.
975 * Means we might need to send a redirect.
977 if (IS_ON_SAME_LAN(dst_ill
, ill
) && ipst
->ips_ip_g_send_redirects
) {
978 ip_send_potential_redirect_v4(mp
, ipha
, ire
, ira
);
983 mtu
= dst_ill
->ill_mtu
;
984 if ((iremtu
= ire
->ire_metrics
.iulp_mtu
) != 0 && iremtu
< mtu
)
986 ip_forward_xmit_v4(nce
, ill
, mp
, ipha
, ira
, mtu
, added_tx_len
);
991 * Used for sending out unicast and multicast packets that are
995 ip_forward_xmit_v4(nce_t
*nce
, ill_t
*ill
, mblk_t
*mp
, ipha_t
*ipha
,
996 ip_recv_attr_t
*ira
, uint32_t mtu
, uint32_t added_tx_len
)
998 ill_t
*dst_ill
= nce
->nce_ill
;
1001 iaflags_t iraflags
= ira
->ira_flags
;
1002 ip_stack_t
*ipst
= ill
->ill_ipst
;
1005 if (ipha
->ipha_ttl
<= 1) {
1006 /* Perhaps the checksum was bad */
1007 if ((iraflags
& IRAF_VERIFY_IP_CKSUM
) && ip_csum_hdr(ipha
)) {
1008 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInCksumErrs
);
1009 ip_drop_input("ipIfStatsInCksumErrs", mp
, ill
);
1013 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1014 ip_drop_input("ICMP_TTL_EXCEEDED", mp
, ill
);
1015 icmp_time_exceeded(mp
, ICMP_TTL_EXCEEDED
, ira
);
1019 /* Adjust the checksum to reflect the ttl decrement. */
1020 sum
= (int)ipha
->ipha_hdr_checksum
+ IP_HDR_CSUM_TTL_ADJUST
;
1021 ipha
->ipha_hdr_checksum
= (uint16_t)(sum
+ (sum
>> 16));
1023 /* Check if there are options to update */
1024 if (iraflags
& IRAF_IPV4_OPTIONS
) {
1025 ASSERT(ipha
->ipha_version_and_hdr_length
!=
1026 IP_SIMPLE_HDR_VERSION
);
1027 ASSERT(!(iraflags
& IRAF_VERIFY_IP_CKSUM
));
1029 if (!ip_forward_options(mp
, ipha
, dst_ill
, ira
)) {
1030 /* ipIfStatsForwProhibits and ip_drop_input done */
1034 ipha
->ipha_hdr_checksum
= 0;
1035 ipha
->ipha_hdr_checksum
= ip_csum_hdr(ipha
);
1038 /* Initiate Write side IPPF processing before any fragmentation */
1039 if (IPP_ENABLED(IPP_FWD_OUT
, ipst
)) {
1040 /* ip_process translates an IS_UNDER_IPMP */
1041 mp
= ip_process(IPP_FWD_OUT
, mp
, dst_ill
, dst_ill
);
1043 /* ip_drop_packet and MIB done */
1044 ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred" \
1045 " during IPPF processing\n"));
1050 pkt_len
= ira
->ira_pktlen
;
1052 BUMP_MIB(dst_ill
->ill_ip_mib
, ipIfStatsHCOutForwDatagrams
);
1054 ixaflags
= IXAF_IS_IPV4
| IXAF_NO_DEV_FLOW_CTL
;
1056 if (pkt_len
> mtu
) {
1058 * It needs fragging on its way out. If we haven't
1059 * verified the header checksum yet we do it now since
1060 * are going to put a surely good checksum in the
1061 * outgoing header, we have to make sure that it
1062 * was good coming in.
1064 if ((iraflags
& IRAF_VERIFY_IP_CKSUM
) && ip_csum_hdr(ipha
)) {
1065 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInCksumErrs
);
1066 ip_drop_input("ipIfStatsInCksumErrs", mp
, ill
);
1070 if (ipha
->ipha_fragment_offset_and_flags
& IPH_DF_HTONS
) {
1071 BUMP_MIB(dst_ill
->ill_ip_mib
, ipIfStatsOutFragFails
);
1072 ip_drop_output("ipIfStatsOutFragFails", mp
, dst_ill
);
1073 icmp_frag_needed(mp
, mtu
, ira
);
1077 (void) ip_fragment_v4(mp
, nce
, ixaflags
, pkt_len
, mtu
,
1078 ira
->ira_xmit_hint
, GLOBAL_ZONEID
, 0, ip_xmit
, NULL
);
1082 ASSERT(pkt_len
== ntohs(((ipha_t
*)mp
->b_rptr
)->ipha_length
));
1083 if (iraflags
& IRAF_LOOPBACK_COPY
) {
1085 * IXAF_NO_LOOP_ZONEID is not set hence 7th arg
1088 (void) ip_postfrag_loopcheck(mp
, nce
,
1089 ixaflags
| IXAF_LOOPBACK_COPY
,
1090 pkt_len
, ira
->ira_xmit_hint
, GLOBAL_ZONEID
, 0, NULL
);
1092 (void) ip_xmit(mp
, nce
, ixaflags
, pkt_len
, ira
->ira_xmit_hint
,
1093 GLOBAL_ZONEID
, 0, NULL
);
1098 * ire_recvfn for RTF_REJECT and RTF_BLACKHOLE routes, including IRE_NOROUTE,
1099 * which is what ire_route_recursive returns when there is no matching ire.
1100 * Send ICMP unreachable unless blackhole.
1103 ire_recv_noroute_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
, ip_recv_attr_t
*ira
)
1105 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
1106 ill_t
*ill
= ira
->ira_ill
;
1107 ip_stack_t
*ipst
= ill
->ill_ipst
;
1109 /* Would we have forwarded this packet if we had a route? */
1110 if (ira
->ira_flags
& (IRAF_L2DST_MULTICAST
|IRAF_L2DST_BROADCAST
)) {
1111 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsForwProhibits
);
1112 ip_drop_input("l2 multicast not forwarded", mp
, ill
);
1117 if (!(ill
->ill_flags
& ILLF_ROUTER
)) {
1118 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsForwProhibits
);
1119 ip_drop_input("ipIfStatsForwProhibits", mp
, ill
);
1124 * If we had a route this could have been forwarded. Count as such.
1126 * ipIfStatsHCInForwDatagrams should only be increment if there
1127 * will be an attempt to forward the packet, which is why we
1128 * increment after the above condition has been checked.
1130 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInForwDatagrams
);
1132 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInNoRoutes
);
1134 ip_rts_change(RTM_MISS
, ipha
->ipha_dst
, 0, 0, 0, 0, 0, 0, RTA_DST
,
1137 if (ire
->ire_flags
& RTF_BLACKHOLE
) {
1138 ip_drop_input("ipIfStatsInNoRoutes RTF_BLACKHOLE", mp
, ill
);
1141 ip_drop_input("ipIfStatsInNoRoutes RTF_REJECT", mp
, ill
);
1143 if (ip_source_routed(ipha
, ipst
)) {
1144 icmp_unreachable(mp
, ICMP_SOURCE_ROUTE_FAILED
, ira
);
1146 icmp_unreachable(mp
, ICMP_HOST_UNREACHABLE
, ira
);
1152 * ire_recvfn for IRE_LOCALs marked with ire_noaccept. Such IREs are used for
1153 * VRRP when in noaccept mode.
1154 * We silently drop the packet. ARP handles packets even if noaccept is set.
1158 ire_recv_noaccept_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
,
1159 ip_recv_attr_t
*ira
)
1161 ill_t
*ill
= ira
->ira_ill
;
1163 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1164 ip_drop_input("ipIfStatsInDiscards - noaccept", mp
, ill
);
1169 * ire_recvfn for IRE_BROADCAST.
1172 ire_recv_broadcast_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
,
1173 ip_recv_attr_t
*ira
)
1175 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
1176 ill_t
*ill
= ira
->ira_ill
;
1177 ill_t
*dst_ill
= ire
->ire_ill
;
1178 ip_stack_t
*ipst
= ill
->ill_ipst
;
1183 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInBcastPkts
);
1185 /* Tag for higher-level protocols */
1186 ira
->ira_flags
|= IRAF_BROADCAST
;
1189 * Whether local or directed broadcast forwarding: don't allow
1192 if (ipha
->ipha_protocol
== IPPROTO_TCP
) {
1193 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1194 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
1200 * So that we don't end up with dups, only one ill an IPMP group is
1201 * nominated to receive broadcast traffic.
1202 * If we have no cast_ill we are liberal and accept everything.
1204 if (IS_UNDER_IPMP(ill
)) {
1205 /* For an under ill_grp can change under lock */
1206 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
1207 if (!ill
->ill_nom_cast
&& ill
->ill_grp
!= NULL
&&
1208 ill
->ill_grp
->ig_cast_ill
!= NULL
) {
1209 rw_exit(&ipst
->ips_ill_g_lock
);
1210 /* No MIB since this is normal operation */
1211 ip_drop_input("not nom_cast", mp
, ill
);
1215 rw_exit(&ipst
->ips_ill_g_lock
);
1217 ira
->ira_ruifindex
= ill_get_upper_ifindex(ill
);
1221 * After reassembly and IPsec we will need to duplicate the
1222 * broadcast packet for all matching zones on the ill.
1224 ira
->ira_zoneid
= ALL_ZONES
;
1227 * Check for directed broadcast i.e. ire->ire_ill is different than
1229 * The same broadcast address can be assigned to multiple interfaces
1230 * so have to check explicitly for that case by looking up the alt_ire
1232 if (dst_ill
== ill
) {
1233 /* Reassemble on the ill on which the packet arrived */
1234 ip_input_local_v4(ire
, mp
, ipha
, ira
);
1236 ira
->ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
1240 /* Is there an IRE_BROADCAST on the incoming ill? */
1241 ipha_dst
= ((ira
->ira_flags
& IRAF_DHCP_UNICAST
) ? INADDR_BROADCAST
:
1243 alt_ire
= ire_ftable_lookup_v4(ipha_dst
, 0, 0, IRE_BROADCAST
, ill
,
1244 ALL_ZONES
, MATCH_IRE_TYPE
|MATCH_IRE_ILL
, 0, ipst
, NULL
);
1245 if (alt_ire
!= NULL
) {
1246 /* Not a directed broadcast */
1247 ire_refrele(alt_ire
);
1248 /* Reassemble on the ill on which the packet arrived */
1249 ip_input_local_v4(ire
, mp
, ipha
, ira
);
1254 * This is a directed broadcast
1256 * If directed broadcast is allowed, then forward the packet out
1257 * the destination interface with IXAF_LOOPBACK_COPY set. That will
1258 * result in ip_input() receiving a copy of the packet on the
1259 * appropriate ill. (We could optimize this to avoid the extra trip
1260 * via ip_input(), but since directed broadcasts are normally disabled
1261 * it doesn't make sense to optimize it.)
1263 if (!ipst
->ips_ip_g_forward_directed_bcast
||
1264 (ira
->ira_flags
& (IRAF_L2DST_MULTICAST
|IRAF_L2DST_BROADCAST
))) {
1265 ip_drop_input("directed broadcast not allowed", mp
, ill
);
1269 if ((ira
->ira_flags
& IRAF_VERIFY_IP_CKSUM
) && ip_csum_hdr(ipha
)) {
1270 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInCksumErrs
);
1271 ip_drop_input("ipIfStatsInCksumErrs", mp
, ill
);
1277 * Clear the indication that this may have hardware
1278 * checksum as we are not using it for forwarding.
1280 DB_CKSUMFLAGS(mp
) = 0;
1283 * Adjust ttl to 2 (1+1 - the forward engine will decrement it by one.
1285 ipha
->ipha_ttl
= ipst
->ips_ip_broadcast_ttl
+ 1;
1286 ipha
->ipha_hdr_checksum
= 0;
1287 ipha
->ipha_hdr_checksum
= ip_csum_hdr(ipha
);
1290 * We use ip_forward_xmit to do any fragmentation.
1291 * and loopback copy on the outbound interface.
1293 * Make it so that IXAF_LOOPBACK_COPY to be set on transmit side.
1295 ira
->ira_flags
|= IRAF_LOOPBACK_COPY
;
1297 nce
= arp_nce_init(dst_ill
, ipha
->ipha_dst
, IRE_BROADCAST
);
1299 BUMP_MIB(dst_ill
->ill_ip_mib
, ipIfStatsOutDiscards
);
1300 ip_drop_output("No nce", mp
, dst_ill
);
1305 ip_forward_xmit_v4(nce
, ill
, mp
, ipha
, ira
, dst_ill
->ill_mc_mtu
, 0);
1309 ira
->ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
1313 * ire_recvfn for IRE_MULTICAST.
1316 ire_recv_multicast_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
,
1317 ip_recv_attr_t
*ira
)
1319 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
1320 ill_t
*ill
= ira
->ira_ill
;
1321 ip_stack_t
*ipst
= ill
->ill_ipst
;
1323 ASSERT(ire
->ire_ill
== ira
->ira_ill
);
1325 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInMcastPkts
);
1326 UPDATE_MIB(ill
->ill_ip_mib
, ipIfStatsHCInMcastOctets
, ira
->ira_pktlen
);
1329 if (ira
->ira_flags
& IRAF_RSVP
)
1332 /* Tag for higher-level protocols */
1333 ira
->ira_flags
|= IRAF_MULTICAST
;
1336 * So that we don't end up with dups, only one ill an IPMP group is
1337 * nominated to receive multicast traffic.
1338 * If we have no cast_ill we are liberal and accept everything.
1340 if (IS_UNDER_IPMP(ill
)) {
1341 ip_stack_t
*ipst
= ill
->ill_ipst
;
1343 /* For an under ill_grp can change under lock */
1344 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
1345 if (!ill
->ill_nom_cast
&& ill
->ill_grp
!= NULL
&&
1346 ill
->ill_grp
->ig_cast_ill
!= NULL
) {
1347 rw_exit(&ipst
->ips_ill_g_lock
);
1348 ip_drop_input("not on cast ill", mp
, ill
);
1352 rw_exit(&ipst
->ips_ill_g_lock
);
1354 * We switch to the upper ill so that mrouter and hasmembers
1355 * can operate on upper here and in ip_input_multicast.
1357 ill
= ipmp_ill_hold_ipmp_ill(ill
);
1359 ASSERT(ill
!= ira
->ira_ill
);
1360 ASSERT(ire
->ire_ill
== ira
->ira_ill
);
1362 ira
->ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
1369 * Check if we are a multicast router - send ip_mforward a copy of
1371 * Due to mroute_decap tunnels we consider forwarding packets even if
1372 * mrouted has not joined the allmulti group on this interface.
1374 if (ipst
->ips_ip_g_mrouter
) {
1378 * Clear the indication that this may have hardware
1379 * checksum as we are not using it for forwarding.
1381 DB_CKSUMFLAGS(mp
) = 0;
1384 * ip_mforward helps us make these distinctions: If received
1385 * on tunnel and not IGMP, then drop.
1386 * If IGMP packet, then don't check membership
1387 * If received on a phyint and IGMP or PIM, then
1388 * don't check membership
1390 retval
= ip_mforward(mp
, ira
);
1391 /* ip_mforward updates mib variables if needed */
1396 * pkt is okay and arrived on phyint.
1398 * If we are running as a multicast router
1399 * we need to see all IGMP and/or PIM packets.
1401 if ((ipha
->ipha_protocol
== IPPROTO_IGMP
) ||
1402 (ipha
->ipha_protocol
== IPPROTO_PIM
)) {
1407 /* pkt is mal-formed, toss it */
1412 * pkt is okay and arrived on a tunnel
1414 * If we are running a multicast router
1415 * we need to see all igmp packets.
1417 if (ipha
->ipha_protocol
== IPPROTO_IGMP
) {
1420 ip_drop_input("Multicast on tunnel ignored", mp
, ill
);
1427 * Check if we have members on this ill. This is not necessary for
1428 * correctness because even if the NIC/GLD had a leaky filter, we
1429 * filter before passing to each conn_t.
1431 if (!ill_hasmembers_v4(ill
, ipha
->ipha_dst
)) {
1435 * This might just be caused by the fact that
1436 * multiple IP Multicast addresses map to the same
1437 * link layer multicast - no need to increment counter!
1439 ip_drop_input("Multicast with no members", mp
, ill
);
1444 ip2dbg(("ire_recv_multicast_v4: multicast for us: 0x%x\n",
1445 ntohl(ipha
->ipha_dst
)));
1448 * After reassembly and IPsec we will need to duplicate the
1449 * multicast packet for all matching zones on the ill.
1451 ira
->ira_zoneid
= ALL_ZONES
;
1453 /* Reassemble on the ill on which the packet arrived */
1454 ip_input_local_v4(ire
, mp
, ipha
, ira
);
1456 if (ill
!= ire
->ire_ill
) {
1458 ira
->ira_ill
= ire
->ire_ill
;
1459 ira
->ira_ruifindex
= ira
->ira_ill
->ill_phyint
->phyint_ifindex
;
1464 * ire_recvfn for IRE_LOOPBACK. This is only used when a FW_HOOK
1465 * has rewritten the packet to have a loopback destination address (We
1466 * filter out packet with a loopback destination from arriving over the wire).
1467 * We don't know what zone to use, thus we always use the GLOBAL_ZONEID.
1470 ire_recv_loopback_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
, ip_recv_attr_t
*ira
)
1472 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
1473 ill_t
*ill
= ira
->ira_ill
;
1474 ill_t
*ire_ill
= ire
->ire_ill
;
1476 ira
->ira_zoneid
= GLOBAL_ZONEID
;
1478 /* Switch to the lo0 ill for further processing */
1479 if (ire_ill
!= ill
) {
1481 * Update ira_ill to be the ILL on which the IP address
1483 * No need to hold the ill since we have a hold on the ire
1485 ASSERT(ira
->ira_ill
== ira
->ira_rill
);
1486 ira
->ira_ill
= ire_ill
;
1488 ip_input_local_v4(ire
, mp
, ipha
, ira
);
1491 ASSERT(ira
->ira_ill
== ire_ill
);
1496 ip_input_local_v4(ire
, mp
, ipha
, ira
);
1500 * ire_recvfn for IRE_LOCAL.
1503 ire_recv_local_v4(ire_t
*ire
, mblk_t
*mp
, void *iph_arg
, ip_recv_attr_t
*ira
)
1505 ipha_t
*ipha
= (ipha_t
*)iph_arg
;
1506 ill_t
*ill
= ira
->ira_ill
;
1507 ill_t
*ire_ill
= ire
->ire_ill
;
1509 /* Make a note for DAD that this address is in use */
1510 ire
->ire_last_used_time
= LBOLT_FASTPATH
;
1512 /* Only target the IRE_LOCAL with the right zoneid. */
1513 ira
->ira_zoneid
= ire
->ire_zoneid
;
1516 * If the packet arrived on the wrong ill, we check that
1518 * If it is, then we ensure that we do the reassembly on
1519 * the ill on which the address is hosted. We keep ira_rill as
1520 * the one on which the packet arrived, so that IP_PKTINFO and
1521 * friends can report this.
1523 if (ire_ill
!= ill
) {
1526 new_ire
= ip_check_multihome(&ipha
->ipha_dst
, ire
, ill
);
1527 if (new_ire
== NULL
) {
1529 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsForwProhibits
);
1530 ip_drop_input("ipIfStatsInForwProhibits", mp
, ill
);
1535 * Update ira_ill to be the ILL on which the IP address
1536 * is hosted. No need to hold the ill since we have a
1537 * hold on the ire. Note that we do the switch even if
1538 * new_ire == ire (for IPMP, ire would be the one corresponding
1541 ASSERT(ira
->ira_ill
== ira
->ira_rill
);
1542 ira
->ira_ill
= new_ire
->ire_ill
;
1544 /* ira_ruifindex tracks the upper for ira_rill */
1545 if (IS_UNDER_IPMP(ill
))
1546 ira
->ira_ruifindex
= ill_get_upper_ifindex(ill
);
1548 ip_input_local_v4(new_ire
, mp
, ipha
, ira
);
1551 ASSERT(ira
->ira_ill
== new_ire
->ire_ill
);
1553 ira
->ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
1556 ire_refrele(new_ire
);
1560 ip_input_local_v4(ire
, mp
, ipha
, ira
);
1564 * Common function for packets arriving for the host. Handles
1565 * checksum verification, reassembly checks, etc.
1568 ip_input_local_v4(ire_t
*ire
, mblk_t
*mp
, ipha_t
*ipha
, ip_recv_attr_t
*ira
)
1570 ill_t
*ill
= ira
->ira_ill
;
1571 iaflags_t iraflags
= ira
->ira_flags
;
1574 * Verify IP header checksum. If the packet was AH or ESP then
1575 * this flag has already been cleared. Likewise if the packet
1576 * had a hardware checksum.
1578 if ((iraflags
& IRAF_VERIFY_IP_CKSUM
) && ip_csum_hdr(ipha
)) {
1579 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInCksumErrs
);
1580 ip_drop_input("ipIfStatsInCksumErrs", mp
, ill
);
1585 if (iraflags
& IRAF_IPV4_OPTIONS
) {
1586 if (!ip_input_local_options(mp
, ipha
, ira
)) {
1587 /* Error has been sent and mp consumed */
1591 * Some old hardware does partial checksum by including the
1592 * whole IP header, so the partial checksum value might have
1593 * become invalid if any option in the packet have been
1594 * updated. Always clear partial checksum flag here.
1596 DB_CKSUMFLAGS(mp
) &= ~HCK_PARTIALCKSUM
;
1600 * Is packet part of fragmented IP packet?
1601 * We compare against defined values in network byte order
1603 if (ipha
->ipha_fragment_offset_and_flags
&
1604 (IPH_MF_HTONS
| IPH_OFFSET_HTONS
)) {
1606 * Make sure we have ira_l2src before we loose the original
1609 if (!(ira
->ira_flags
& IRAF_L2SRC_SET
))
1610 ip_setl2src(mp
, ira
, ira
->ira_rill
);
1612 mp
= ip_input_fragment(mp
, ipha
, ira
);
1615 /* Completed reassembly */
1616 ipha
= (ipha_t
*)mp
->b_rptr
;
1620 * For broadcast and multicast we need some extra work before
1621 * we call ip_fanout_v4(), since in the case of shared-IP zones
1622 * we need to pretend that a packet arrived for each zoneid.
1624 if (iraflags
& IRAF_MULTIBROADCAST
) {
1625 if (iraflags
& IRAF_BROADCAST
)
1626 ip_input_broadcast_v4(ire
, mp
, ipha
, ira
);
1628 ip_input_multicast_v4(ire
, mp
, ipha
, ira
);
1631 ip_fanout_v4(mp
, ipha
, ira
);
1636 * Handle multiple zones which match the same broadcast address
1637 * and ill by delivering a packet to each of them.
1638 * Walk the bucket and look for different ire_zoneid but otherwise
1639 * the same IRE (same ill/addr/mask/type).
1640 * Note that ire_add() tracks IREs that are identical in all
1641 * fields (addr/mask/type/gw/ill/zoneid) within a single IRE by
1642 * increasing ire_identical_cnt. Thus we don't need to be concerned
1646 ip_input_broadcast_v4(ire_t
*ire
, mblk_t
*mp
, ipha_t
*ipha
, ip_recv_attr_t
*ira
)
1648 ill_t
*ill
= ira
->ira_ill
;
1649 ip_stack_t
*ipst
= ill
->ill_ipst
;
1650 netstack_t
*ns
= ipst
->ips_netstack
;
1655 uint_t ira_pktlen
= ira
->ira_pktlen
;
1656 uint16_t ira_ip_hdr_length
= ira
->ira_ip_hdr_length
;
1658 irb
= ire
->ire_bucket
;
1661 * If we don't have more than one shared-IP zone, or if
1662 * there can't be more than one IRE_BROADCAST for this
1663 * IP address, then just set the zoneid and proceed.
1665 if (ns
->netstack_numzones
== 1 || irb
->irb_ire_cnt
== 1) {
1666 ira
->ira_zoneid
= ire
->ire_zoneid
;
1668 ip_fanout_v4(mp
, ipha
, ira
);
1672 for (ire1
= irb
->irb_ire
; ire1
!= NULL
; ire1
= ire1
->ire_next
) {
1673 /* We do the main IRE after the end of the loop */
1678 * Only IREs for the same IP address should be in the same
1681 ASSERT(ire1
->ire_addr
== ire
->ire_addr
);
1682 if (!(ire1
->ire_type
& IRE_BROADCAST
))
1685 if (IRE_IS_CONDEMNED(ire1
))
1690 /* Failed to deliver to one zone */
1691 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1692 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
1695 ira
->ira_zoneid
= ire1
->ire_zoneid
;
1696 ipha1
= (ipha_t
*)mp1
->b_rptr
;
1697 ip_fanout_v4(mp1
, ipha1
, ira
);
1699 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1700 * so we restore them for a potential next iteration
1702 ira
->ira_pktlen
= ira_pktlen
;
1703 ira
->ira_ip_hdr_length
= ira_ip_hdr_length
;
1706 /* Do the main ire */
1707 ira
->ira_zoneid
= ire
->ire_zoneid
;
1708 ip_fanout_v4(mp
, ipha
, ira
);
1712 * Handle multiple zones which want to receive the same multicast packets
1713 * on this ill by delivering a packet to each of them.
1715 * Note that for packets delivered to transports we could instead do this
1716 * as part of the fanout code, but since we need to handle icmp_inbound
1717 * it is simpler to have multicast work the same as broadcast.
1719 * The ip_fanout matching for multicast matches based on ilm independent of
1720 * zoneid since the zoneid restriction is applied when joining a multicast
1725 ip_input_multicast_v4(ire_t
*ire
, mblk_t
*mp
, ipha_t
*ipha
, ip_recv_attr_t
*ira
)
1727 ill_t
*ill
= ira
->ira_ill
;
1728 iaflags_t iraflags
= ira
->ira_flags
;
1729 ip_stack_t
*ipst
= ill
->ill_ipst
;
1730 netstack_t
*ns
= ipst
->ips_netstack
;
1734 uint_t ira_pktlen
= ira
->ira_pktlen
;
1735 uint16_t ira_ip_hdr_length
= ira
->ira_ip_hdr_length
;
1737 /* ire_recv_multicast has switched to the upper ill for IPMP */
1738 ASSERT(!IS_UNDER_IPMP(ill
));
1741 * If we don't have more than one shared-IP zone, or if
1742 * there are no members in anything but the global zone,
1743 * then just set the zoneid and proceed.
1745 if (ns
->netstack_numzones
== 1 ||
1746 !ill_hasmembers_otherzones_v4(ill
, ipha
->ipha_dst
,
1748 ira
->ira_zoneid
= GLOBAL_ZONEID
;
1750 /* If sender didn't want this zone to receive it, drop */
1751 if ((iraflags
& IRAF_NO_LOOP_ZONEID_SET
) &&
1752 ira
->ira_no_loop_zoneid
== ira
->ira_zoneid
) {
1753 ip_drop_input("Multicast but wrong zoneid", mp
, ill
);
1757 ip_fanout_v4(mp
, ipha
, ira
);
1762 * Here we loop over all zoneids that have members in the group
1763 * and deliver a packet to ip_fanout for each zoneid.
1765 * First find any members in the lowest numeric zoneid by looking for
1766 * first zoneid larger than -1 (ALL_ZONES).
1767 * We terminate the loop when we receive -1 (ALL_ZONES).
1769 zoneid
= ill_hasmembers_nextzone_v4(ill
, ipha
->ipha_dst
, ALL_ZONES
);
1770 for (; zoneid
!= ALL_ZONES
;
1771 zoneid
= ill_hasmembers_nextzone_v4(ill
, ipha
->ipha_dst
, zoneid
)) {
1773 * Avoid an extra copymsg/freemsg by skipping global zone here
1774 * and doing that at the end.
1776 if (zoneid
== GLOBAL_ZONEID
)
1779 ira
->ira_zoneid
= zoneid
;
1781 /* If sender didn't want this zone to receive it, skip */
1782 if ((iraflags
& IRAF_NO_LOOP_ZONEID_SET
) &&
1783 ira
->ira_no_loop_zoneid
== ira
->ira_zoneid
)
1788 /* Failed to deliver to one zone */
1789 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1790 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
1793 ipha1
= (ipha_t
*)mp1
->b_rptr
;
1794 ip_fanout_v4(mp1
, ipha1
, ira
);
1796 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1797 * so we restore them for a potential next iteration
1799 ira
->ira_pktlen
= ira_pktlen
;
1800 ira
->ira_ip_hdr_length
= ira_ip_hdr_length
;
1803 /* Do the main ire */
1804 ira
->ira_zoneid
= GLOBAL_ZONEID
;
1805 /* If sender didn't want this zone to receive it, drop */
1806 if ((iraflags
& IRAF_NO_LOOP_ZONEID_SET
) &&
1807 ira
->ira_no_loop_zoneid
== ira
->ira_zoneid
) {
1808 ip_drop_input("Multicast but wrong zoneid", mp
, ill
);
1811 ip_fanout_v4(mp
, ipha
, ira
);
1816 * Increment checksum failure statistics
1819 ip_input_cksum_err_v4(uint8_t protocol
, uint16_t hck_flags
, ill_t
*ill
)
1821 ip_stack_t
*ipst
= ill
->ill_ipst
;
1825 BUMP_MIB(ill
->ill_ip_mib
, tcpIfStatsInErrs
);
1827 if (hck_flags
& HCK_FULLCKSUM
)
1828 IP_STAT(ipst
, ip_tcp_in_full_hw_cksum_err
);
1829 else if (hck_flags
& HCK_PARTIALCKSUM
)
1830 IP_STAT(ipst
, ip_tcp_in_part_hw_cksum_err
);
1832 IP_STAT(ipst
, ip_tcp_in_sw_cksum_err
);
1835 BUMP_MIB(ill
->ill_ip_mib
, udpIfStatsInCksumErrs
);
1836 if (hck_flags
& HCK_FULLCKSUM
)
1837 IP_STAT(ipst
, ip_udp_in_full_hw_cksum_err
);
1838 else if (hck_flags
& HCK_PARTIALCKSUM
)
1839 IP_STAT(ipst
, ip_udp_in_part_hw_cksum_err
);
1841 IP_STAT(ipst
, ip_udp_in_sw_cksum_err
);
1844 BUMP_MIB(&ipst
->ips_icmp_mib
, icmpInCksumErrs
);
1852 /* Calculate the IPv4 pseudo-header checksum */
1854 ip_input_cksum_pseudo_v4(ipha_t
*ipha
, ip_recv_attr_t
*ira
)
1858 uint8_t protocol
= ira
->ira_protocol
;
1859 uint16_t ip_hdr_length
= ira
->ira_ip_hdr_length
;
1861 #define iphs ((uint16_t *)ipha)
1865 ulp_len
= ira
->ira_pktlen
- ip_hdr_length
;
1867 /* Protocol and length */
1868 cksum
= htons(ulp_len
) + IP_TCP_CSUM_COMP
;
1870 cksum
+= iphs
[6] + iphs
[7] + iphs
[8] + iphs
[9];
1876 udpha
= (udpha_t
*)((uchar_t
*)ipha
+ ip_hdr_length
);
1878 /* Protocol and length */
1879 cksum
= udpha
->uha_length
+ IP_UDP_CSUM_COMP
;
1881 cksum
+= iphs
[6] + iphs
[7] + iphs
[8] + iphs
[9];
1895 * Software verification of the ULP checksums.
1896 * Returns B_TRUE if ok.
1897 * Increments statistics of failed.
1900 ip_input_sw_cksum_v4(mblk_t
*mp
, ipha_t
*ipha
, ip_recv_attr_t
*ira
)
1902 ip_stack_t
*ipst
= ira
->ira_ill
->ill_ipst
;
1904 uint8_t protocol
= ira
->ira_protocol
;
1905 uint16_t ip_hdr_length
= ira
->ira_ip_hdr_length
;
1907 IP_STAT(ipst
, ip_in_sw_cksum
);
1909 ASSERT(protocol
== IPPROTO_TCP
|| protocol
== IPPROTO_UDP
);
1911 cksum
= ip_input_cksum_pseudo_v4(ipha
, ira
);
1912 cksum
= IP_CSUM(mp
, ip_hdr_length
, cksum
);
1916 ip_input_cksum_err_v4(protocol
, 0, ira
->ira_ill
);
1921 * Verify the ULP checksums.
1922 * Returns B_TRUE if ok, or if the ULP doesn't have a well-defined checksum
1924 * Increments statistics if failed.
1927 ip_input_cksum_v4(iaflags_t iraflags
, mblk_t
*mp
, ipha_t
*ipha
,
1928 ip_recv_attr_t
*ira
)
1930 ill_t
*ill
= ira
->ira_rill
;
1935 uint8_t protocol
= ira
->ira_protocol
;
1936 uint16_t ip_hdr_length
= ira
->ira_ip_hdr_length
;
1946 udpha
= (udpha_t
*)((uchar_t
*)ipha
+ ip_hdr_length
);
1947 if (udpha
->uha_checksum
== 0) {
1948 /* Packet doesn't have a UDP checksum */
1953 case IPPROTO_SCTP
: {
1957 sctph
= (sctp_hdr_t
*)((uchar_t
*)ipha
+ ip_hdr_length
);
1959 if (skip_sctp_cksum
)
1962 pktsum
= sctph
->sh_chksum
;
1963 sctph
->sh_chksum
= 0;
1964 cksum
= sctp_cksum(mp
, ip_hdr_length
);
1965 sctph
->sh_chksum
= pktsum
;
1966 if (cksum
== pktsum
)
1970 * Defer until later whether a bad checksum is ok
1971 * in order to allow RAW sockets to use Adler checksum
1974 ira
->ira_flags
|= IRAF_SCTP_CSUM_ERR
;
1979 /* No ULP checksum to verify. */
1983 * Revert to software checksum calculation if the interface
1984 * isn't capable of checksum offload.
1985 * We clear DB_CKSUMFLAGS when going through IPsec in ip_fanout.
1986 * Note: IRAF_NO_HW_CKSUM is not currently used.
1988 ASSERT(!IS_IPMP(ill
));
1989 if ((iraflags
& IRAF_NO_HW_CKSUM
) || !ILL_HCKSUM_CAPABLE(ill
) ||
1991 return (ip_input_sw_cksum_v4(mp
, ipha
, ira
));
1995 * We apply this for all ULP protocols. Does the HW know to
1996 * not set the flags for SCTP and other protocols.
1999 hck_flags
= DB_CKSUMFLAGS(mp
);
2001 if (hck_flags
& HCK_FULLCKSUM_OK
) {
2003 * Hardware has already verified the checksum.
2008 if (hck_flags
& HCK_FULLCKSUM
) {
2010 * Full checksum has been computed by the hardware
2011 * and has been attached. If the driver wants us to
2012 * verify the correctness of the attached value, in
2013 * order to protect against faulty hardware, compare
2014 * it against -0 (0xFFFF) to see if it's valid.
2016 cksum
= DB_CKSUM16(mp
);
2017 if (cksum
== 0xFFFF)
2019 ip_input_cksum_err_v4(protocol
, hck_flags
, ira
->ira_ill
);
2024 if ((hck_flags
& HCK_PARTIALCKSUM
) &&
2025 (mp1
== NULL
|| mp1
->b_cont
== NULL
) &&
2026 ip_hdr_length
>= DB_CKSUMSTART(mp
) &&
2027 ((len
= ip_hdr_length
- DB_CKSUMSTART(mp
)) & 1) == 0) {
2029 uchar_t
*cksum_start
;
2031 cksum
= ip_input_cksum_pseudo_v4(ipha
, ira
);
2033 cksum_start
= ((uchar_t
*)ipha
+ DB_CKSUMSTART(mp
));
2036 * Partial checksum has been calculated by hardware
2037 * and attached to the packet; in addition, any
2038 * prepended extraneous data is even byte aligned,
2039 * and there are at most two mblks associated with
2040 * the packet. If any such data exists, we adjust
2041 * the checksum; also take care any postpended data.
2043 IP_ADJCKSUM_PARTIAL(cksum_start
, mp
, mp1
, len
, adj
);
2045 * One's complement subtract extraneous checksum
2047 cksum
+= DB_CKSUM16(mp
);
2049 cksum
= ~(adj
- cksum
) & 0xFFFF;
2052 cksum
= (cksum
& 0xFFFF) + ((int)cksum
>> 16);
2053 cksum
= (cksum
& 0xFFFF) + ((int)cksum
>> 16);
2054 if (!(~cksum
& 0xFFFF))
2057 ip_input_cksum_err_v4(protocol
, hck_flags
, ira
->ira_ill
);
2060 return (ip_input_sw_cksum_v4(mp
, ipha
, ira
));
2065 * Handle fanout of received packets.
2066 * Unicast packets that are looped back (from ire_send_local_v4) and packets
2067 * from the wire are differentiated by checking IRAF_VERIFY_ULP_CKSUM.
2070 * Before sending it to the client, invoke IPPF processing. Policy processing
2071 * takes place only if the callout_position, IPP_LOCAL_IN, is enabled.
2074 ip_fanout_v4(mblk_t
*mp
, ipha_t
*ipha
, ip_recv_attr_t
*ira
)
2076 ill_t
*ill
= ira
->ira_ill
;
2077 iaflags_t iraflags
= ira
->ira_flags
;
2078 ip_stack_t
*ipst
= ill
->ill_ipst
;
2079 uint8_t protocol
= ipha
->ipha_protocol
;
2081 #define rptr ((uchar_t *)ipha)
2082 uint_t ip_hdr_length
;
2083 uint_t min_ulp_header_length
;
2086 netstack_t
*ns
= ipst
->ips_netstack
;
2087 ipsec_stack_t
*ipss
= ns
->netstack_ipsec
;
2088 ill_t
*rill
= ira
->ira_rill
;
2090 ASSERT(ira
->ira_pktlen
== ntohs(ipha
->ipha_length
));
2092 ip_hdr_length
= ira
->ira_ip_hdr_length
;
2093 ira
->ira_protocol
= protocol
;
2096 * Time for IPP once we've done reassembly and IPsec.
2097 * We skip this for loopback packets since we don't do IPQoS
2100 if (IPP_ENABLED(IPP_LOCAL_IN
, ipst
) &&
2101 !(iraflags
& IRAF_LOOPBACK
) &&
2102 (protocol
!= IPPROTO_ESP
|| protocol
!= IPPROTO_AH
)) {
2104 * Use the interface on which the packet arrived - not where
2105 * the IP address is hosted.
2107 /* ip_process translates an IS_UNDER_IPMP */
2108 mp
= ip_process(IPP_LOCAL_IN
, mp
, rill
, ill
);
2110 /* ip_drop_packet and MIB done */
2115 /* Determine the minimum required size of the upper-layer header */
2116 /* Need to do this for at least the set of ULPs that TX handles. */
2119 min_ulp_header_length
= TCP_MIN_HEADER_LENGTH
;
2122 min_ulp_header_length
= SCTP_COMMON_HDR_LENGTH
;
2125 min_ulp_header_length
= UDPH_SIZE
;
2128 min_ulp_header_length
= ICMPH_SIZE
;
2131 min_ulp_header_length
= 0;
2134 /* Make sure we have the min ULP header length */
2135 len
= mp
->b_wptr
- rptr
;
2136 if (len
< ip_hdr_length
+ min_ulp_header_length
) {
2137 if (ira
->ira_pktlen
< ip_hdr_length
+ min_ulp_header_length
) {
2138 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInTruncatedPkts
);
2139 ip_drop_input("ipIfStatsInTruncatedPkts", mp
, ill
);
2143 IP_STAT(ipst
, ip_recv_pullup
);
2144 ipha
= ip_pullup(mp
, ip_hdr_length
+ min_ulp_header_length
,
2148 len
= mp
->b_wptr
- rptr
;
2151 /* Verify ULP checksum. Handles TCP, UDP, and SCTP */
2152 if (iraflags
& IRAF_VERIFY_ULP_CKSUM
) {
2153 if (!ip_input_cksum_v4(iraflags
, mp
, ipha
, ira
)) {
2154 /* Bad checksum. Stats are already incremented */
2155 ip_drop_input("Bad ULP checksum", mp
, ill
);
2159 /* IRAF_SCTP_CSUM_ERR could have been set */
2160 iraflags
= ira
->ira_flags
;
2164 /* For TCP, discard broadcast and multicast packets. */
2165 if (iraflags
& IRAF_MULTIBROADCAST
)
2168 /* First mblk contains IP+TCP headers per above check */
2169 ASSERT(len
>= ip_hdr_length
+ TCP_MIN_HEADER_LENGTH
);
2171 /* TCP options present? */
2172 offset
= ((uchar_t
*)ipha
)[ip_hdr_length
+ 12] >> 4;
2178 * There must be TCP options.
2179 * Make sure we can grab them.
2182 offset
+= ip_hdr_length
;
2184 if (ira
->ira_pktlen
< offset
) {
2185 BUMP_MIB(ill
->ill_ip_mib
,
2186 ipIfStatsInTruncatedPkts
);
2188 "ipIfStatsInTruncatedPkts",
2193 IP_STAT(ipst
, ip_recv_pullup
);
2194 ipha
= ip_pullup(mp
, offset
, ira
);
2197 len
= mp
->b_wptr
- rptr
;
2202 * Pass up a squeue hint to tcp.
2203 * If ira_sqp is already set (this is loopback) we leave it
2206 if (ira
->ira_sqp
== NULL
) {
2207 ira
->ira_sqp
= ip_squeue_get(ira
->ira_ring
);
2210 /* Look for AF_INET or AF_INET6 that matches */
2211 connp
= ipcl_classify_v4(mp
, IPPROTO_TCP
, ip_hdr_length
,
2213 if (connp
== NULL
) {
2214 /* Send the TH_RST */
2215 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2216 tcp_xmit_listeners_reset(mp
, ira
, ipst
, NULL
);
2219 if (connp
->conn_incoming_ifindex
!= 0 &&
2220 connp
->conn_incoming_ifindex
!= ira
->ira_ruifindex
) {
2221 CONN_DEC_REF(connp
);
2223 /* Send the TH_RST */
2224 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2225 tcp_xmit_listeners_reset(mp
, ira
, ipst
, NULL
);
2228 if (CONN_INBOUND_POLICY_PRESENT(connp
, ipss
) ||
2229 (iraflags
& IRAF_IPSEC_SECURE
)) {
2230 mp
= ipsec_check_inbound_policy(mp
, connp
,
2233 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2234 /* Note that mp is NULL */
2235 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2236 CONN_DEC_REF(connp
);
2240 /* Found a client; up it goes */
2241 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2242 ira
->ira_ill
= ira
->ira_rill
= NULL
;
2243 if (!IPCL_IS_TCP(connp
)) {
2244 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2245 (connp
->conn_recv
)(connp
, mp
, NULL
, ira
);
2246 CONN_DEC_REF(connp
);
2248 ira
->ira_rill
= rill
;
2253 * We do different processing whether called from
2254 * ip_accept_tcp and we match the target, don't match
2255 * the target, and when we are called by ip_input.
2257 if (iraflags
& IRAF_TARGET_SQP
) {
2258 if (ira
->ira_target_sqp
== connp
->conn_sqp
) {
2261 attrmp
= ip_recv_attr_to_mblk(ira
);
2262 if (attrmp
== NULL
) {
2263 BUMP_MIB(ill
->ill_ip_mib
,
2264 ipIfStatsInDiscards
);
2265 ip_drop_input("ipIfStatsInDiscards",
2268 CONN_DEC_REF(connp
);
2270 SET_SQUEUE(attrmp
, connp
->conn_recv
,
2272 attrmp
->b_cont
= mp
;
2273 ASSERT(ira
->ira_target_sqp_mp
== NULL
);
2274 ira
->ira_target_sqp_mp
= attrmp
;
2276 * Conn ref release when drained from
2281 SQUEUE_ENTER_ONE(connp
->conn_sqp
, mp
,
2282 connp
->conn_recv
, connp
, ira
, SQ_FILL
,
2283 SQTAG_IP_TCP_INPUT
);
2286 SQUEUE_ENTER_ONE(connp
->conn_sqp
, mp
, connp
->conn_recv
,
2287 connp
, ira
, ip_squeue_flag
, SQTAG_IP_TCP_INPUT
);
2290 ira
->ira_rill
= rill
;
2293 case IPPROTO_SCTP
: {
2295 in6_addr_t map_src
, map_dst
;
2296 uint32_t ports
; /* Source and destination ports */
2297 sctp_stack_t
*sctps
= ipst
->ips_netstack
->netstack_sctp
;
2299 /* For SCTP, discard broadcast and multicast packets. */
2300 if (iraflags
& IRAF_MULTIBROADCAST
)
2304 * Since there is no SCTP h/w cksum support yet, just
2307 DB_CKSUMFLAGS(mp
) = 0;
2309 /* Length ensured above */
2310 ASSERT(MBLKL(mp
) >= ip_hdr_length
+ SCTP_COMMON_HDR_LENGTH
);
2311 sctph
= (sctp_hdr_t
*)(rptr
+ ip_hdr_length
);
2314 ports
= *(uint32_t *)&sctph
->sh_sport
;
2316 IN6_IPADDR_TO_V4MAPPED(ipha
->ipha_dst
, &map_dst
);
2317 IN6_IPADDR_TO_V4MAPPED(ipha
->ipha_src
, &map_src
);
2318 if (iraflags
& IRAF_SCTP_CSUM_ERR
) {
2320 * No potential sctp checksum errors go to the Sun
2321 * sctp stack however they might be Adler-32 summed
2322 * packets a userland stack bound to a raw IP socket
2323 * could reasonably use. Note though that Adler-32 is
2324 * a long deprecated algorithm and customer sctp
2325 * networks should eventually migrate to CRC-32 at
2326 * which time this facility should be removed.
2328 ip_fanout_sctp_raw(mp
, ipha
, NULL
, ports
, ira
);
2331 connp
= sctp_fanout(&map_src
, &map_dst
, ports
, ira
, mp
,
2333 if (connp
== NULL
) {
2334 /* Check for raw socket or OOTB handling */
2335 ip_fanout_sctp_raw(mp
, ipha
, NULL
, ports
, ira
);
2338 if (connp
->conn_incoming_ifindex
!= 0 &&
2339 connp
->conn_incoming_ifindex
!= ira
->ira_ruifindex
) {
2340 CONN_DEC_REF(connp
);
2341 /* Check for raw socket or OOTB handling */
2342 ip_fanout_sctp_raw(mp
, ipha
, NULL
, ports
, ira
);
2346 /* Found a client; up it goes */
2347 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2348 sctp_input(connp
, ipha
, NULL
, mp
, ira
);
2349 /* sctp_input does a rele of the sctp_t */
2354 /* First mblk contains IP+UDP headers as checked above */
2355 ASSERT(MBLKL(mp
) >= ip_hdr_length
+ UDPH_SIZE
);
2357 if (iraflags
& IRAF_MULTIBROADCAST
) {
2358 uint16_t *up
; /* Pointer to ports in ULP header */
2360 up
= (uint16_t *)((uchar_t
*)ipha
+ ip_hdr_length
);
2361 ip_fanout_udp_multi_v4(mp
, ipha
, up
[1], up
[0], ira
);
2365 /* Look for AF_INET or AF_INET6 that matches */
2366 connp
= ipcl_classify_v4(mp
, IPPROTO_UDP
, ip_hdr_length
,
2368 if (connp
== NULL
) {
2370 if (ipst
->ips_ipcl_proto_fanout_v4
[IPPROTO_UDP
].
2371 connf_head
!= NULL
) {
2372 ASSERT(ira
->ira_protocol
== IPPROTO_UDP
);
2373 ip_fanout_proto_v4(mp
, ipha
, ira
);
2375 ip_fanout_send_icmp_v4(mp
,
2376 ICMP_DEST_UNREACHABLE
,
2377 ICMP_PORT_UNREACHABLE
, ira
);
2382 if (connp
->conn_incoming_ifindex
!= 0 &&
2383 connp
->conn_incoming_ifindex
!= ira
->ira_ruifindex
) {
2384 CONN_DEC_REF(connp
);
2387 if (IPCL_IS_NONSTR(connp
) ? connp
->conn_flow_cntrld
:
2388 !canputnext(connp
->conn_rq
)) {
2389 CONN_DEC_REF(connp
);
2390 BUMP_MIB(ill
->ill_ip_mib
, udpIfStatsInOverflows
);
2391 ip_drop_input("udpIfStatsInOverflows", mp
, ill
);
2395 if (CONN_INBOUND_POLICY_PRESENT(connp
, ipss
) ||
2396 (iraflags
& IRAF_IPSEC_SECURE
)) {
2397 mp
= ipsec_check_inbound_policy(mp
, connp
,
2400 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2401 /* Note that mp is NULL */
2402 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2403 CONN_DEC_REF(connp
);
2408 * Remove 0-spi if it's 0, or move everything behind
2409 * the UDP header over it and forward to ESP via
2412 if (connp
->conn_udp
->udp_nat_t_endpoint
) {
2413 if (iraflags
& IRAF_IPSEC_SECURE
) {
2414 ip_drop_packet(mp
, B_TRUE
, ira
->ira_ill
,
2415 DROPPER(ipss
, ipds_esp_nat_t_ipsec
),
2416 &ipss
->ipsec_dropper
);
2417 CONN_DEC_REF(connp
);
2421 mp
= zero_spi_check(mp
, ira
);
2424 * Packet was consumed - probably sent to
2427 CONN_DEC_REF(connp
);
2430 /* Else continue like a normal UDP packet. */
2431 ipha
= (ipha_t
*)mp
->b_rptr
;
2432 protocol
= ipha
->ipha_protocol
;
2433 ira
->ira_protocol
= protocol
;
2435 /* Found a client; up it goes */
2436 IP_STAT(ipst
, ip_udp_fannorm
);
2437 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2438 ira
->ira_ill
= ira
->ira_rill
= NULL
;
2439 (connp
->conn_recv
)(connp
, mp
, NULL
, ira
);
2440 CONN_DEC_REF(connp
);
2442 ira
->ira_rill
= rill
;
2449 * Clear hardware checksumming flag as it is currently only
2450 * used by TCP and UDP.
2452 DB_CKSUMFLAGS(mp
) = 0;
2457 * We need to accomodate icmp messages coming in clear
2458 * until we get everything secure from the wire. If
2459 * icmp_accept_clear_messages is zero we check with
2460 * the global policy and act accordingly. If it is
2461 * non-zero, we accept the message without any checks.
2462 * But *this does not mean* that this will be delivered
2463 * to RAW socket clients. By accepting we might send
2464 * replies back, change our MTU value etc.,
2465 * but delivery to the ULP/clients depends on their
2466 * policy dispositions.
2468 if (ipst
->ips_icmp_accept_clear_messages
== 0) {
2469 mp
= ipsec_check_global_policy(mp
, NULL
,
2470 ipha
, NULL
, ira
, ns
);
2476 * ICMP header checksum, including checksum field,
2479 if (IP_CSUM(mp
, ip_hdr_length
, 0)) {
2480 BUMP_MIB(&ipst
->ips_icmp_mib
, icmpInCksumErrs
);
2481 ip_drop_input("icmpInCksumErrs", mp
, ill
);
2485 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2486 mp
= icmp_inbound_v4(mp
, ira
);
2488 /* No need to pass to RAW sockets */
2495 * If we are not willing to accept IGMP packets in clear,
2496 * then check with global policy.
2498 if (ipst
->ips_igmp_accept_clear_messages
== 0) {
2499 mp
= ipsec_check_global_policy(mp
, NULL
,
2500 ipha
, NULL
, ira
, ns
);
2507 if (IP_CSUM(mp
, ip_hdr_length
, 0)) {
2508 ++ipst
->ips_igmpstat
.igps_rcv_badsum
;
2509 ip_drop_input("igps_rcv_badsum", mp
, ill
);
2514 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2515 mp
= igmp_input(mp
, ira
);
2517 /* Bad packet - discarded by igmp_input */
2523 * If we are not willing to accept PIM packets in clear,
2524 * then check with global policy.
2526 if (ipst
->ips_pim_accept_clear_messages
== 0) {
2527 mp
= ipsec_check_global_policy(mp
, NULL
,
2528 ipha
, NULL
, ira
, ns
);
2532 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2534 /* Checksum is verified in pim_input */
2535 mp
= pim_input(mp
, ira
);
2537 /* Bad packet - discarded by pim_input */
2544 * Fast path for AH/ESP.
2546 netstack_t
*ns
= ipst
->ips_netstack
;
2547 ipsec_stack_t
*ipss
= ns
->netstack_ipsec
;
2549 IP_STAT(ipst
, ipsec_proto_ahesp
);
2551 if (!ipsec_loaded(ipss
)) {
2552 ip_proto_not_sup(mp
, ira
);
2556 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2557 /* select inbound SA and have IPsec process the pkt */
2558 if (protocol
== IPPROTO_ESP
) {
2560 boolean_t esp_in_udp_sa
;
2561 boolean_t esp_in_udp_packet
;
2563 mp
= ipsec_inbound_esp_sa(mp
, ira
, &esph
);
2567 ASSERT(esph
!= NULL
);
2568 ASSERT(ira
->ira_flags
& IRAF_IPSEC_SECURE
);
2569 ASSERT(ira
->ira_ipsec_esp_sa
!= NULL
);
2570 ASSERT(ira
->ira_ipsec_esp_sa
->ipsa_input_func
!= NULL
);
2572 esp_in_udp_sa
= ((ira
->ira_ipsec_esp_sa
->ipsa_flags
&
2575 (ira
->ira_flags
& IRAF_ESP_UDP_PORTS
) != 0;
2578 * The following is a fancy, but quick, way of saying:
2579 * ESP-in-UDP SA and Raw ESP packet --> drop
2581 * ESP SA and ESP-in-UDP packet --> drop
2583 if (esp_in_udp_sa
!= esp_in_udp_packet
) {
2584 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2585 ip_drop_packet(mp
, B_TRUE
, ira
->ira_ill
,
2586 DROPPER(ipss
, ipds_esp_no_sa
),
2587 &ipss
->ipsec_dropper
);
2590 mp
= ira
->ira_ipsec_esp_sa
->ipsa_input_func(mp
, esph
,
2595 mp
= ipsec_inbound_ah_sa(mp
, ira
, &ah
);
2600 ASSERT(ira
->ira_flags
& IRAF_IPSEC_SECURE
);
2601 ASSERT(ira
->ira_ipsec_ah_sa
!= NULL
);
2602 ASSERT(ira
->ira_ipsec_ah_sa
->ipsa_input_func
!= NULL
);
2603 mp
= ira
->ira_ipsec_ah_sa
->ipsa_input_func(mp
, ah
,
2609 * Either it failed or is pending. In the former case
2610 * ipIfStatsInDiscards was increased.
2614 /* we're done with IPsec processing, send it up */
2615 ip_input_post_ipsec(mp
, ira
);
2618 case IPPROTO_ENCAP
: {
2622 * Handle self-encapsulated packets (IP-in-IP where
2623 * the inner addresses == the outer addresses).
2625 if ((uchar_t
*)ipha
+ ip_hdr_length
+ sizeof (ipha_t
) >
2627 if (ira
->ira_pktlen
<
2628 ip_hdr_length
+ sizeof (ipha_t
)) {
2629 BUMP_MIB(ill
->ill_ip_mib
,
2630 ipIfStatsInTruncatedPkts
);
2631 ip_drop_input("ipIfStatsInTruncatedPkts",
2636 ipha
= ip_pullup(mp
, (uchar_t
*)ipha
+ ip_hdr_length
+
2637 sizeof (ipha_t
) - mp
->b_rptr
, ira
);
2639 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2640 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2645 inner_ipha
= (ipha_t
*)((uchar_t
*)ipha
+ ip_hdr_length
);
2647 * Check the sanity of the inner IP header.
2649 if ((IPH_HDR_VERSION(inner_ipha
) != IPV4_VERSION
)) {
2650 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2651 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2655 if (IPH_HDR_LENGTH(inner_ipha
) < sizeof (ipha_t
)) {
2656 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2657 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2661 if (inner_ipha
->ipha_src
!= ipha
->ipha_src
||
2662 inner_ipha
->ipha_dst
!= ipha
->ipha_dst
) {
2663 /* We fallthru to iptun fanout below */
2668 * Self-encapsulated tunnel packet. Remove
2669 * the outer IP header and fanout again.
2670 * We also need to make sure that the inner
2671 * header is pulled up until options.
2673 mp
->b_rptr
= (uchar_t
*)inner_ipha
;
2675 ip_hdr_length
= IPH_HDR_LENGTH(ipha
);
2676 if ((uchar_t
*)ipha
+ ip_hdr_length
> mp
->b_wptr
) {
2677 if (ira
->ira_pktlen
<
2678 (uchar_t
*)ipha
+ ip_hdr_length
- mp
->b_rptr
) {
2679 BUMP_MIB(ill
->ill_ip_mib
,
2680 ipIfStatsInTruncatedPkts
);
2681 ip_drop_input("ipIfStatsInTruncatedPkts",
2686 ipha
= ip_pullup(mp
,
2687 (uchar_t
*)ipha
+ ip_hdr_length
- mp
->b_rptr
, ira
);
2689 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2690 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2695 if (ip_hdr_length
> sizeof (ipha_t
)) {
2696 /* We got options on the inner packet. */
2697 ipaddr_t dst
= ipha
->ipha_dst
;
2700 dst
= ip_input_options(ipha
, dst
, mp
, ira
, &error
);
2703 * An ICMP error has been sent and the packet
2708 if (dst
!= ipha
->ipha_dst
) {
2710 * Someone put a source-route in
2711 * the inside header of a self-
2712 * encapsulated packet. Drop it
2713 * with extreme prejudice and let
2716 ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
2718 icmp_unreachable(mp
, ICMP_SOURCE_ROUTE_FAILED
,
2723 if (!(ira
->ira_flags
& IRAF_IPSEC_SECURE
)) {
2725 * This means that somebody is sending
2726 * Self-encapsualted packets without AH/ESP.
2728 * Send this packet to find a tunnel endpoint.
2729 * if I can't find one, an ICMP
2730 * PROTOCOL_UNREACHABLE will get sent.
2732 protocol
= ipha
->ipha_protocol
;
2733 ira
->ira_protocol
= protocol
;
2737 /* Update based on removed IP header */
2738 ira
->ira_ip_hdr_length
= ip_hdr_length
;
2739 ira
->ira_pktlen
= ntohs(ipha
->ipha_length
);
2741 if (ira
->ira_flags
& IRAF_IPSEC_DECAPS
) {
2743 * This packet is self-encapsulated multiple
2744 * times. We don't want to recurse infinitely.
2745 * To keep it simple, drop the packet.
2747 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2748 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
2752 ASSERT(ira
->ira_flags
& IRAF_IPSEC_SECURE
);
2753 ira
->ira_flags
|= IRAF_IPSEC_DECAPS
;
2755 ip_input_post_ipsec(mp
, ira
);
2759 iptun
: /* IPPROTO_ENCAPS that is not self-encapsulated */
2761 connp
= ipcl_classify_v4(mp
, protocol
, ip_hdr_length
,
2763 if (connp
!= NULL
) {
2764 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsHCInDelivers
);
2765 ira
->ira_ill
= ira
->ira_rill
= NULL
;
2766 (connp
->conn_recv
)(connp
, mp
, NULL
, ira
);
2767 CONN_DEC_REF(connp
);
2769 ira
->ira_rill
= rill
;
2776 * The above input functions may have returned the pulled up message.
2777 * So ipha need to be reinitialized.
2779 ipha
= (ipha_t
*)mp
->b_rptr
;
2780 ira
->ira_protocol
= protocol
= ipha
->ipha_protocol
;
2781 if (ipst
->ips_ipcl_proto_fanout_v4
[protocol
].connf_head
== NULL
) {
2783 * No user-level listener for these packets packets.
2784 * Check for IPPROTO_ENCAP...
2786 if (protocol
== IPPROTO_ENCAP
&& ipst
->ips_ip_g_mrouter
) {
2788 * Check policy here,
2789 * THEN ship off to ip_mroute_decap().
2791 * BTW, If I match a configured IP-in-IP
2792 * tunnel above, this path will not be reached, and
2793 * ip_mroute_decap will never be called.
2795 mp
= ipsec_check_global_policy(mp
, connp
,
2796 ipha
, NULL
, ira
, ns
);
2798 ip_mroute_decap(mp
, ira
);
2799 } /* Else we already freed everything! */
2801 ip_proto_not_sup(mp
, ira
);
2807 * Handle fanout to raw sockets. There
2808 * can be more than one stream bound to a particular
2809 * protocol. When this is the case, each one gets a copy
2810 * of any incoming packets.
2812 ASSERT(ira
->ira_protocol
== ipha
->ipha_protocol
);
2813 ip_fanout_proto_v4(mp
, ipha
, ira
);
2817 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2818 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);