xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_input.c (revision c61a1653)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24  *
25  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
26  * Copyright 2019 Joyent, Inc.
27  */
28 /* Copyright (c) 1990 Mentat Inc. */
29 
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/dlpi.h>
33 #include <sys/stropts.h>
34 #include <sys/sysmacros.h>
35 #include <sys/strsubr.h>
36 #include <sys/strlog.h>
37 #include <sys/strsun.h>
38 #include <sys/zone.h>
39 #define	_SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/xti_inet.h>
42 #include <sys/ddi.h>
43 #include <sys/sunddi.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/kobj.h>
47 #include <sys/modctl.h>
48 #include <sys/atomic.h>
49 #include <sys/policy.h>
50 #include <sys/priv.h>
51 
52 #include <sys/systm.h>
53 #include <sys/param.h>
54 #include <sys/kmem.h>
55 #include <sys/sdt.h>
56 #include <sys/socket.h>
57 #include <sys/vtrace.h>
58 #include <sys/isa_defs.h>
59 #include <sys/mac.h>
60 #include <sys/mac_client.h>
61 #include <net/if.h>
62 #include <net/if_arp.h>
63 #include <net/route.h>
64 #include <sys/sockio.h>
65 #include <netinet/in.h>
66 #include <net/if_dl.h>
67 
68 #include <inet/common.h>
69 #include <inet/mi.h>
70 #include <inet/mib2.h>
71 #include <inet/nd.h>
72 #include <inet/arp.h>
73 #include <inet/snmpcom.h>
74 #include <inet/kstatcom.h>
75 
76 #include <netinet/igmp_var.h>
77 #include <netinet/ip6.h>
78 #include <netinet/icmp6.h>
79 #include <netinet/sctp.h>
80 
81 #include <inet/ip.h>
82 #include <inet/ip_impl.h>
83 #include <inet/ip6.h>
84 #include <inet/ip6_asp.h>
85 #include <inet/optcom.h>
86 #include <inet/tcp.h>
87 #include <inet/tcp_impl.h>
88 #include <inet/ip_multi.h>
89 #include <inet/ip_if.h>
90 #include <inet/ip_ire.h>
91 #include <inet/ip_ftable.h>
92 #include <inet/ip_rts.h>
93 #include <inet/ip_ndp.h>
94 #include <inet/ip_listutils.h>
95 #include <netinet/igmp.h>
96 #include <netinet/ip_mroute.h>
97 #include <inet/ipp_common.h>
98 
99 #include <net/pfkeyv2.h>
100 #include <inet/sadb.h>
101 #include <inet/ipsec_impl.h>
102 #include <inet/ipdrop.h>
103 #include <inet/ip_netinfo.h>
104 #include <inet/ilb_ip.h>
105 #include <sys/squeue_impl.h>
106 #include <sys/squeue.h>
107 
108 #include <sys/ethernet.h>
109 #include <net/if_types.h>
110 #include <sys/cpuvar.h>
111 
112 #include <ipp/ipp.h>
113 #include <ipp/ipp_impl.h>
114 #include <ipp/ipgpc/ipgpc.h>
115 
116 #include <sys/pattr.h>
117 #include <inet/ipclassifier.h>
118 #include <inet/sctp_ip.h>
119 #include <inet/sctp/sctp_impl.h>
120 #include <inet/udp_impl.h>
121 #include <sys/sunddi.h>
122 
123 #include <sys/tsol/label.h>
124 #include <sys/tsol/tnet.h>
125 
126 #include <sys/clock_impl.h>	/* For LBOLT_FASTPATH{,64} */
127 
128 #ifdef	DEBUG
129 extern boolean_t skip_sctp_cksum;
130 #endif
131 
132 static void	ip_input_local_v4(ire_t *, mblk_t *, ipha_t *,
133     ip_recv_attr_t *);
134 
135 static void	ip_input_broadcast_v4(ire_t *, mblk_t *, ipha_t *,
136     ip_recv_attr_t *);
137 static void	ip_input_multicast_v4(ire_t *, mblk_t *, ipha_t *,
138     ip_recv_attr_t *);
139 
140 #pragma inline(ip_input_common_v4, ip_input_local_v4, ip_forward_xmit_v4)
141 
142 /*
143  * Direct read side procedure capable of dealing with chains. GLDv3 based
144  * drivers call this function directly with mblk chains while STREAMS
145  * read side procedure ip_rput() calls this for single packet with ip_ring
146  * set to NULL to process one packet at a time.
147  *
148  * The ill will always be valid if this function is called directly from
149  * the driver.
150  *
151  * If this chain is part of a VLAN stream, then the VLAN tag is
152  * stripped from the MAC header before being delivered to this
153  * function.
154  *
155  * If the IP header in packet is not 32-bit aligned, every message in the
156  * chain will be aligned before further operations. This is required on SPARC
157  * platform.
158  */
159 void
ip_input(ill_t * ill,ill_rx_ring_t * ip_ring,mblk_t * mp_chain,struct mac_header_info_s * mhip)160 ip_input(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
161     struct mac_header_info_s *mhip)
162 {
163 	(void) ip_input_common_v4(ill, ip_ring, mp_chain, mhip, NULL, NULL,
164 	    NULL);
165 }
166 
167 /*
168  * ip_accept_tcp() - This function is called by the squeue when it retrieves
169  * a chain of packets in the poll mode. The packets have gone through the
170  * data link processing but not IP processing. For performance and latency
171  * reasons, the squeue wants to process the chain in line instead of feeding
172  * it back via ip_input path.
173  *
174  * We set up the ip_recv_attr_t with IRAF_TARGET_SQP to that ip_fanout_v4
175  * will pass back any TCP packets matching the target sqp to
176  * ip_input_common_v4 using ira_target_sqp_mp. Other packets are handled by
177  * ip_input_v4 and ip_fanout_v4 as normal.
178  * The TCP packets that match the target squeue are returned to the caller
179  * as a b_next chain after each packet has been prepend with an mblk
180  * from ip_recv_attr_to_mblk.
181  */
182 mblk_t *
ip_accept_tcp(ill_t * ill,ill_rx_ring_t * ip_ring,squeue_t * target_sqp,mblk_t * mp_chain,mblk_t ** last,uint_t * cnt)183 ip_accept_tcp(ill_t *ill, ill_rx_ring_t *ip_ring, squeue_t *target_sqp,
184     mblk_t *mp_chain, mblk_t **last, uint_t *cnt)
185 {
186 	return (ip_input_common_v4(ill, ip_ring, mp_chain, NULL, target_sqp,
187 	    last, cnt));
188 }
189 
190 /*
191  * Used by ip_input and ip_accept_tcp
192  * The last three arguments are only used by ip_accept_tcp, and mhip is
193  * only used by ip_input.
194  */
195 mblk_t *
ip_input_common_v4(ill_t * ill,ill_rx_ring_t * ip_ring,mblk_t * mp_chain,struct mac_header_info_s * mhip,squeue_t * target_sqp,mblk_t ** last,uint_t * cnt)196 ip_input_common_v4(ill_t *ill, ill_rx_ring_t *ip_ring, mblk_t *mp_chain,
197     struct mac_header_info_s *mhip, squeue_t *target_sqp,
198     mblk_t **last, uint_t *cnt)
199 {
200 	mblk_t		*mp;
201 	ipha_t		*ipha;
202 	ip_recv_attr_t	iras;	/* Receive attributes */
203 	rtc_t		rtc;
204 	iaflags_t	chain_flags = 0;	/* Fixed for chain */
205 	mblk_t		*ahead = NULL;	/* Accepted head */
206 	mblk_t		*atail = NULL;	/* Accepted tail */
207 	uint_t		acnt = 0;	/* Accepted count */
208 
209 	ASSERT(mp_chain != NULL);
210 	ASSERT(ill != NULL);
211 
212 	/* These ones do not change as we loop over packets */
213 	iras.ira_ill = iras.ira_rill = ill;
214 	iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
215 	iras.ira_rifindex = iras.ira_ruifindex;
216 	iras.ira_sqp = NULL;
217 	iras.ira_ring = ip_ring;
218 	/* For ECMP and outbound transmit ring selection */
219 	iras.ira_xmit_hint = ILL_RING_TO_XMIT_HINT(ip_ring);
220 
221 	iras.ira_target_sqp = target_sqp;
222 	iras.ira_target_sqp_mp = NULL;
223 	if (target_sqp != NULL)
224 		chain_flags |= IRAF_TARGET_SQP;
225 
226 	/*
227 	 * We try to have a mhip pointer when possible, but
228 	 * it might be NULL in some cases. In those cases we
229 	 * have to assume unicast.
230 	 */
231 	iras.ira_mhip = mhip;
232 	iras.ira_flags = 0;
233 	if (mhip != NULL) {
234 		switch (mhip->mhi_dsttype) {
235 		case MAC_ADDRTYPE_MULTICAST :
236 			chain_flags |= IRAF_L2DST_MULTICAST;
237 			break;
238 		case MAC_ADDRTYPE_BROADCAST :
239 			chain_flags |= IRAF_L2DST_BROADCAST;
240 			break;
241 		}
242 	}
243 
244 	/*
245 	 * Initialize the one-element route cache.
246 	 *
247 	 * We do ire caching from one iteration to
248 	 * another. In the event the packet chain contains
249 	 * all packets from the same dst, this caching saves
250 	 * an ire_route_recursive for each of the succeeding
251 	 * packets in a packet chain.
252 	 */
253 	rtc.rtc_ire = NULL;
254 	rtc.rtc_ipaddr = INADDR_ANY;
255 
256 	/* Loop over b_next */
257 	for (mp = mp_chain; mp != NULL; mp = mp_chain) {
258 		mp_chain = mp->b_next;
259 		mp->b_next = NULL;
260 
261 		ASSERT(DB_TYPE(mp) == M_DATA);
262 
263 
264 		/*
265 		 * if db_ref > 1 then copymsg and free original. Packet
266 		 * may be changed and we do not want the other entity
267 		 * who has a reference to this message to trip over the
268 		 * changes. This is a blind change because trying to
269 		 * catch all places that might change the packet is too
270 		 * difficult.
271 		 *
272 		 * This corresponds to the fast path case, where we have
273 		 * a chain of M_DATA mblks.  We check the db_ref count
274 		 * of only the 1st data block in the mblk chain. There
275 		 * doesn't seem to be a reason why a device driver would
276 		 * send up data with varying db_ref counts in the mblk
277 		 * chain. In any case the Fast path is a private
278 		 * interface, and our drivers don't do such a thing.
279 		 * Given the above assumption, there is no need to walk
280 		 * down the entire mblk chain (which could have a
281 		 * potential performance problem)
282 		 *
283 		 * The "(DB_REF(mp) > 1)" check was moved from ip_rput()
284 		 * to here because of exclusive ip stacks and vnics.
285 		 * Packets transmitted from exclusive stack over vnic
286 		 * can have db_ref > 1 and when it gets looped back to
287 		 * another vnic in a different zone, you have ip_input()
288 		 * getting dblks with db_ref > 1. So if someone
289 		 * complains of TCP performance under this scenario,
290 		 * take a serious look here on the impact of copymsg().
291 		 */
292 		if (DB_REF(mp) > 1) {
293 			if ((mp = ip_fix_dbref(mp, &iras)) == NULL) {
294 				/* mhip might point into 1st packet in chain */
295 				iras.ira_mhip = NULL;
296 				continue;
297 			}
298 		}
299 
300 		/*
301 		 * IP header ptr not aligned?
302 		 * OR IP header not complete in first mblk
303 		 */
304 		ipha = (ipha_t *)mp->b_rptr;
305 		if (!OK_32PTR(ipha) || MBLKL(mp) < IP_SIMPLE_HDR_LENGTH) {
306 			mp = ip_check_and_align_header(mp, IP_SIMPLE_HDR_LENGTH,
307 			    &iras);
308 			if (mp == NULL) {
309 				/* mhip might point into 1st packet in chain */
310 				iras.ira_mhip = NULL;
311 				continue;
312 			}
313 			ipha = (ipha_t *)mp->b_rptr;
314 		}
315 
316 		/* Protect against a mix of Ethertypes and IP versions */
317 		if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
318 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInHdrErrors);
319 			ip_drop_input("ipIfStatsInHdrErrors", mp, ill);
320 			freemsg(mp);
321 			/* mhip might point into 1st packet in the chain. */
322 			iras.ira_mhip = NULL;
323 			continue;
324 		}
325 
326 		/*
327 		 * Check for Martian addrs; we have to explicitly
328 		 * test for for zero dst since this is also used as
329 		 * an indication that the rtc is not used.
330 		 */
331 		if (ipha->ipha_dst == INADDR_ANY) {
332 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
333 			ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
334 			freemsg(mp);
335 			/* mhip might point into 1st packet in the chain. */
336 			iras.ira_mhip = NULL;
337 			continue;
338 		}
339 
340 		/*
341 		 * Keep L2SRC from a previous packet in chain since mhip
342 		 * might point into an earlier packet in the chain.
343 		 * Keep IRAF_VERIFIED_SRC to avoid redoing broadcast
344 		 * source check in forwarding path.
345 		 */
346 		chain_flags |= (iras.ira_flags &
347 		    (IRAF_L2SRC_SET|IRAF_VERIFIED_SRC));
348 
349 		iras.ira_flags = IRAF_IS_IPV4 | IRAF_VERIFY_IP_CKSUM |
350 		    IRAF_VERIFY_ULP_CKSUM | chain_flags;
351 		iras.ira_free_flags = 0;
352 		iras.ira_cred = NULL;
353 		iras.ira_cpid = NOPID;
354 		iras.ira_tsl = NULL;
355 		iras.ira_zoneid = ALL_ZONES;	/* Default for forwarding */
356 
357 		/*
358 		 * We must count all incoming packets, even if they end
359 		 * up being dropped later on. Defer counting bytes until
360 		 * we have the whole IP header in first mblk.
361 		 */
362 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
363 
364 		iras.ira_pktlen = ntohs(ipha->ipha_length);
365 		UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets,
366 		    iras.ira_pktlen);
367 
368 		/*
369 		 * Call one of:
370 		 *	ill_input_full_v4
371 		 *	ill_input_short_v4
372 		 * The former is used in unusual cases. See ill_set_inputfn().
373 		 */
374 		(*ill->ill_inputfn)(mp, ipha, &ipha->ipha_dst, &iras, &rtc);
375 
376 		/* Any references to clean up? No hold on ira_ill */
377 		if (iras.ira_flags & (IRAF_IPSEC_SECURE|IRAF_SYSTEM_LABELED))
378 			ira_cleanup(&iras, B_FALSE);
379 
380 		if (iras.ira_target_sqp_mp != NULL) {
381 			/* Better be called from ip_accept_tcp */
382 			ASSERT(target_sqp != NULL);
383 
384 			/* Found one packet to accept */
385 			mp = iras.ira_target_sqp_mp;
386 			iras.ira_target_sqp_mp = NULL;
387 			ASSERT(ip_recv_attr_is_mblk(mp));
388 
389 			if (atail != NULL)
390 				atail->b_next = mp;
391 			else
392 				ahead = mp;
393 			atail = mp;
394 			acnt++;
395 			mp = NULL;
396 		}
397 		/* mhip might point into 1st packet in the chain. */
398 		iras.ira_mhip = NULL;
399 	}
400 	/* Any remaining references to the route cache? */
401 	if (rtc.rtc_ire != NULL) {
402 		ASSERT(rtc.rtc_ipaddr != INADDR_ANY);
403 		ire_refrele(rtc.rtc_ire);
404 	}
405 
406 	if (ahead != NULL) {
407 		/* Better be called from ip_accept_tcp */
408 		ASSERT(target_sqp != NULL);
409 		*last = atail;
410 		*cnt = acnt;
411 		return (ahead);
412 	}
413 
414 	return (NULL);
415 }
416 
417 /*
418  * This input function is used when
419  *  - is_system_labeled()
420  *  - CGTP filtering
421  *  - DHCP unicast before we have an IP address configured
422  *  - there is an listener for IPPROTO_RSVP
423  */
424 void
ill_input_full_v4(mblk_t * mp,void * iph_arg,void * nexthop_arg,ip_recv_attr_t * ira,rtc_t * rtc)425 ill_input_full_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
426     ip_recv_attr_t *ira, rtc_t *rtc)
427 {
428 	ipha_t		*ipha = (ipha_t *)iph_arg;
429 	ipaddr_t	nexthop = *(ipaddr_t *)nexthop_arg;
430 	ill_t		*ill = ira->ira_ill;
431 	ip_stack_t	*ipst = ill->ill_ipst;
432 	int		cgtp_flt_pkt;
433 
434 	ASSERT(ira->ira_tsl == NULL);
435 
436 	/*
437 	 * Attach any necessary label information to
438 	 * this packet
439 	 */
440 	if (is_system_labeled()) {
441 		ira->ira_flags |= IRAF_SYSTEM_LABELED;
442 
443 		/*
444 		 * This updates ira_cred, ira_tsl and ira_free_flags based
445 		 * on the label.
446 		 */
447 		if (!tsol_get_pkt_label(mp, IPV4_VERSION, ira)) {
448 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
449 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
450 			freemsg(mp);
451 			return;
452 		}
453 		/* Note that ira_tsl can be NULL here. */
454 
455 		/* tsol_get_pkt_label sometimes does pullupmsg */
456 		ipha = (ipha_t *)mp->b_rptr;
457 	}
458 
459 	/*
460 	 * Invoke the CGTP (multirouting) filtering module to process
461 	 * the incoming packet. Packets identified as duplicates
462 	 * must be discarded. Filtering is active only if the
463 	 * the ip_cgtp_filter ndd variable is non-zero.
464 	 */
465 	cgtp_flt_pkt = CGTP_IP_PKT_NOT_CGTP;
466 	if (ipst->ips_ip_cgtp_filter &&
467 	    ipst->ips_ip_cgtp_filter_ops != NULL) {
468 		netstackid_t stackid;
469 
470 		stackid = ipst->ips_netstack->netstack_stackid;
471 		/*
472 		 * CGTP and IPMP are mutually exclusive so
473 		 * phyint_ifindex is fine here.
474 		 */
475 		cgtp_flt_pkt =
476 		    ipst->ips_ip_cgtp_filter_ops->cfo_filter(stackid,
477 		    ill->ill_phyint->phyint_ifindex, mp);
478 		if (cgtp_flt_pkt == CGTP_IP_PKT_DUPLICATE) {
479 			ip_drop_input("CGTP_IP_PKT_DUPLICATE", mp, ill);
480 			freemsg(mp);
481 			return;
482 		}
483 	}
484 
485 	/*
486 	 * Brutal hack for DHCPv4 unicast: RFC2131 allows a DHCP
487 	 * server to unicast DHCP packets to a DHCP client using the
488 	 * IP address it is offering to the client.  This can be
489 	 * disabled through the "broadcast bit", but not all DHCP
490 	 * servers honor that bit.  Therefore, to interoperate with as
491 	 * many DHCP servers as possible, the DHCP client allows the
492 	 * server to unicast, but we treat those packets as broadcast
493 	 * here.  Note that we don't rewrite the packet itself since
494 	 * (a) that would mess up the checksums and (b) the DHCP
495 	 * client conn is bound to INADDR_ANY so ip_fanout_udp() will
496 	 * hand it the packet regardless.
497 	 */
498 	if (ill->ill_dhcpinit != 0 &&
499 	    ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION &&
500 	    ipha->ipha_protocol == IPPROTO_UDP) {
501 		udpha_t *udpha;
502 
503 		ipha = ip_pullup(mp, sizeof (ipha_t) + sizeof (udpha_t), ira);
504 		if (ipha == NULL) {
505 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
506 			ip_drop_input("ipIfStatsInDiscards - dhcp", mp, ill);
507 			freemsg(mp);
508 			return;
509 		}
510 		/* Reload since pullupmsg() can change b_rptr. */
511 		udpha = (udpha_t *)&ipha[1];
512 
513 		if (ntohs(udpha->uha_dst_port) == IPPORT_BOOTPC) {
514 			DTRACE_PROBE2(ip4__dhcpinit__pkt, ill_t *, ill,
515 			    mblk_t *, mp);
516 			/*
517 			 * This assumes that we deliver to all conns for
518 			 * multicast and broadcast packets.
519 			 */
520 			nexthop = INADDR_BROADCAST;
521 			ira->ira_flags |= IRAF_DHCP_UNICAST;
522 		}
523 	}
524 
525 	/*
526 	 * If rsvpd is running, let RSVP daemon handle its processing
527 	 * and forwarding of RSVP multicast/unicast packets.
528 	 * If rsvpd is not running but mrouted is running, RSVP
529 	 * multicast packets are forwarded as multicast traffic
530 	 * and RSVP unicast packets are forwarded by unicast router.
531 	 * If neither rsvpd nor mrouted is running, RSVP multicast
532 	 * packets are not forwarded, but the unicast packets are
533 	 * forwarded like unicast traffic.
534 	 */
535 	if (ipha->ipha_protocol == IPPROTO_RSVP &&
536 	    ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head != NULL) {
537 		/* RSVP packet and rsvpd running. Treat as ours */
538 		ip2dbg(("ip_input: RSVP for us: 0x%x\n", ntohl(nexthop)));
539 		/*
540 		 * We use a multicast address to get the packet to
541 		 * ire_recv_multicast_v4. There will not be a membership
542 		 * check since we set IRAF_RSVP
543 		 */
544 		nexthop = htonl(INADDR_UNSPEC_GROUP);
545 		ira->ira_flags |= IRAF_RSVP;
546 	}
547 
548 	ill_input_short_v4(mp, ipha, &nexthop, ira, rtc);
549 }
550 
551 /*
552  * This is the tail-end of the full receive side packet handling.
553  * It can be used directly when the configuration is simple.
554  */
555 void
ill_input_short_v4(mblk_t * mp,void * iph_arg,void * nexthop_arg,ip_recv_attr_t * ira,rtc_t * rtc)556 ill_input_short_v4(mblk_t *mp, void *iph_arg, void *nexthop_arg,
557     ip_recv_attr_t *ira, rtc_t *rtc)
558 {
559 	ire_t		*ire;
560 	uint_t		opt_len;
561 	ill_t		*ill = ira->ira_ill;
562 	ip_stack_t	*ipst = ill->ill_ipst;
563 	uint_t		pkt_len;
564 	ssize_t		len;
565 	ipha_t		*ipha = (ipha_t *)iph_arg;
566 	ipaddr_t	nexthop = *(ipaddr_t *)nexthop_arg;
567 	ilb_stack_t	*ilbs = ipst->ips_netstack->netstack_ilb;
568 	uint_t		irr_flags;
569 #define	rptr	((uchar_t *)ipha)
570 
571 	ASSERT(DB_TYPE(mp) == M_DATA);
572 
573 	/*
574 	 * The following test for loopback is faster than
575 	 * IP_LOOPBACK_ADDR(), because it avoids any bitwise
576 	 * operations.
577 	 * Note that these addresses are always in network byte order
578 	 */
579 	if (((*(uchar_t *)&ipha->ipha_dst) == IN_LOOPBACKNET) ||
580 	    ((*(uchar_t *)&ipha->ipha_src) == IN_LOOPBACKNET)) {
581 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
582 		ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
583 		freemsg(mp);
584 		return;
585 	}
586 
587 	len = mp->b_wptr - rptr;
588 	pkt_len = ira->ira_pktlen;
589 
590 	/* multiple mblk or too short */
591 	len -= pkt_len;
592 	if (len != 0) {
593 		mp = ip_check_length(mp, rptr, len, pkt_len,
594 		    IP_SIMPLE_HDR_LENGTH, ira);
595 		if (mp == NULL)
596 			return;
597 		ipha = (ipha_t *)mp->b_rptr;
598 	}
599 
600 	DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
601 	    ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *, NULL,
602 	    int, 0);
603 
604 	/*
605 	 * The event for packets being received from a 'physical'
606 	 * interface is placed after validation of the source and/or
607 	 * destination address as being local so that packets can be
608 	 * redirected to loopback addresses using ipnat.
609 	 */
610 	DTRACE_PROBE4(ip4__physical__in__start,
611 	    ill_t *, ill, ill_t *, NULL,
612 	    ipha_t *, ipha, mblk_t *, mp);
613 
614 	if (HOOKS4_INTERESTED_PHYSICAL_IN(ipst)) {
615 		int	ll_multicast = 0;
616 		int	error;
617 		ipaddr_t orig_dst = ipha->ipha_dst;
618 
619 		if (ira->ira_flags & IRAF_L2DST_MULTICAST)
620 			ll_multicast = HPE_MULTICAST;
621 		else if (ira->ira_flags & IRAF_L2DST_BROADCAST)
622 			ll_multicast = HPE_BROADCAST;
623 
624 		FW_HOOKS(ipst->ips_ip4_physical_in_event,
625 		    ipst->ips_ipv4firewall_physical_in,
626 		    ill, NULL, ipha, mp, mp, ll_multicast, ipst, error);
627 
628 		DTRACE_PROBE1(ip4__physical__in__end, mblk_t *, mp);
629 
630 		if (mp == NULL)
631 			return;
632 		/* The length could have changed */
633 		ipha = (ipha_t *)mp->b_rptr;
634 		ira->ira_pktlen = ntohs(ipha->ipha_length);
635 		pkt_len = ira->ira_pktlen;
636 
637 		/*
638 		 * In case the destination changed we override any previous
639 		 * change to nexthop.
640 		 */
641 		if (orig_dst != ipha->ipha_dst)
642 			nexthop = ipha->ipha_dst;
643 		if (nexthop == INADDR_ANY) {
644 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInAddrErrors);
645 			ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
646 			freemsg(mp);
647 			return;
648 		}
649 	}
650 
651 	if (ipst->ips_ip4_observe.he_interested) {
652 		zoneid_t dzone;
653 
654 		/*
655 		 * On the inbound path the src zone will be unknown as
656 		 * this packet has come from the wire.
657 		 */
658 		dzone = ip_get_zoneid_v4(nexthop, mp, ira, ALL_ZONES);
659 		ipobs_hook(mp, IPOBS_HOOK_INBOUND, ALL_ZONES, dzone, ill, ipst);
660 	}
661 
662 	/*
663 	 * If the packet originated from a same-machine sender or
664 	 * there is a good HW IP header checksum, we clear the need
665 	 * look at the IP header checksum.
666 	 */
667 	if (((DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM) &&
668 	    ILL_HCKSUM_CAPABLE(ill) && dohwcksum)) {
669 		/* Header checksum was ok. Clear the flag */
670 		DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM;
671 		ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
672 	}
673 
674 	/*
675 	 * Here we check to see if we machine is setup as
676 	 * L3 loadbalancer and if the incoming packet is for a VIP
677 	 *
678 	 * Check the following:
679 	 * - there is at least a rule
680 	 * - protocol of the packet is supported
681 	 */
682 	if (ilb_has_rules(ilbs) && ILB_SUPP_L4(ipha->ipha_protocol)) {
683 		ipaddr_t	lb_dst;
684 		int		lb_ret;
685 
686 		/* For convenience, we pull up the mblk. */
687 		if (mp->b_cont != NULL) {
688 			if (pullupmsg(mp, -1) == 0) {
689 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
690 				ip_drop_input("ipIfStatsInDiscards - pullupmsg",
691 				    mp, ill);
692 				freemsg(mp);
693 				return;
694 			}
695 			ipha = (ipha_t *)mp->b_rptr;
696 		}
697 
698 		/*
699 		 * We just drop all fragments going to any VIP, at
700 		 * least for now....
701 		 */
702 		if (ntohs(ipha->ipha_fragment_offset_and_flags) &
703 		    (IPH_MF | IPH_OFFSET)) {
704 			if (!ilb_rule_match_vip_v4(ilbs, nexthop, NULL)) {
705 				goto after_ilb;
706 			}
707 
708 			ILB_KSTAT_UPDATE(ilbs, ip_frag_in, 1);
709 			ILB_KSTAT_UPDATE(ilbs, ip_frag_dropped, 1);
710 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
711 			ip_drop_input("ILB fragment", mp, ill);
712 			freemsg(mp);
713 			return;
714 		}
715 		lb_ret = ilb_check_v4(ilbs, ill, mp, ipha, ipha->ipha_protocol,
716 		    (uint8_t *)ipha + IPH_HDR_LENGTH(ipha), &lb_dst);
717 
718 		if (lb_ret == ILB_DROPPED) {
719 			/* Is this the right counter to increase? */
720 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
721 			ip_drop_input("ILB_DROPPED", mp, ill);
722 			freemsg(mp);
723 			return;
724 		}
725 		if (lb_ret == ILB_BALANCED) {
726 			/* Set the dst to that of the chosen server */
727 			nexthop = lb_dst;
728 			DB_CKSUMFLAGS(mp) = 0;
729 		}
730 	}
731 
732 after_ilb:
733 	opt_len = ipha->ipha_version_and_hdr_length - IP_SIMPLE_HDR_VERSION;
734 	ira->ira_ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
735 	if (opt_len != 0) {
736 		int error = 0;
737 
738 		ira->ira_ip_hdr_length += (opt_len << 2);
739 		ira->ira_flags |= IRAF_IPV4_OPTIONS;
740 
741 		/* IP Options present!  Validate the length. */
742 		mp = ip_check_optlen(mp, ipha, opt_len, pkt_len, ira);
743 		if (mp == NULL)
744 			return;
745 
746 		/* Might have changed */
747 		ipha = (ipha_t *)mp->b_rptr;
748 
749 		/* Verify IP header checksum before parsing the options */
750 		if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
751 		    ip_csum_hdr(ipha)) {
752 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
753 			ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
754 			freemsg(mp);
755 			return;
756 		}
757 		ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
758 
759 		/*
760 		 * Go off to ip_input_options which returns the next hop
761 		 * destination address, which may have been affected
762 		 * by source routing.
763 		 */
764 		IP_STAT(ipst, ip_opt);
765 
766 		nexthop = ip_input_options(ipha, nexthop, mp, ira, &error);
767 		if (error != 0) {
768 			/*
769 			 * An ICMP error has been sent and the packet has
770 			 * been dropped.
771 			 */
772 			return;
773 		}
774 	}
775 
776 	if (ill->ill_flags & ILLF_ROUTER)
777 		irr_flags = IRR_ALLOCATE;
778 	else
779 		irr_flags = IRR_NONE;
780 
781 	/* Can not use route cache with TX since the labels can differ */
782 	if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
783 		if (CLASSD(nexthop)) {
784 			ire = ire_multicast(ill);
785 		} else {
786 			/* Match destination and label */
787 			ire = ire_route_recursive_v4(nexthop, 0, NULL,
788 			    ALL_ZONES, ira->ira_tsl, MATCH_IRE_SECATTR,
789 			    irr_flags, ira->ira_xmit_hint, ipst, NULL, NULL,
790 			    NULL);
791 		}
792 		/* Update the route cache so we do the ire_refrele */
793 		ASSERT(ire != NULL);
794 		if (rtc->rtc_ire != NULL)
795 			ire_refrele(rtc->rtc_ire);
796 		rtc->rtc_ire = ire;
797 		rtc->rtc_ipaddr = nexthop;
798 	} else if (nexthop == rtc->rtc_ipaddr && rtc->rtc_ire != NULL) {
799 		/* Use the route cache */
800 		ire = rtc->rtc_ire;
801 	} else {
802 		/* Update the route cache */
803 		if (CLASSD(nexthop)) {
804 			ire = ire_multicast(ill);
805 		} else {
806 			/* Just match the destination */
807 			ire = ire_route_recursive_dstonly_v4(nexthop, irr_flags,
808 			    ira->ira_xmit_hint, ipst);
809 		}
810 		ASSERT(ire != NULL);
811 		if (rtc->rtc_ire != NULL)
812 			ire_refrele(rtc->rtc_ire);
813 		rtc->rtc_ire = ire;
814 		rtc->rtc_ipaddr = nexthop;
815 	}
816 
817 	ire->ire_ib_pkt_count++;
818 
819 	/*
820 	 * Based on ire_type and ire_flags call one of:
821 	 *	ire_recv_local_v4 - for IRE_LOCAL
822 	 *	ire_recv_loopback_v4 - for IRE_LOOPBACK
823 	 *	ire_recv_multirt_v4 - if RTF_MULTIRT
824 	 *	ire_recv_noroute_v4 - if RTF_REJECT or RTF_BLACHOLE
825 	 *	ire_recv_multicast_v4 - for IRE_MULTICAST
826 	 *	ire_recv_broadcast_v4 - for IRE_BROADCAST
827 	 *	ire_recv_noaccept_v4 - for ire_noaccept ones
828 	 *	ire_recv_forward_v4 - for the rest.
829 	 */
830 	(*ire->ire_recvfn)(ire, mp, ipha, ira);
831 }
832 #undef rptr
833 
834 /*
835  * ire_recvfn for IREs that need forwarding
836  */
837 void
ire_recv_forward_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)838 ire_recv_forward_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
839 {
840 	ipha_t		*ipha = (ipha_t *)iph_arg;
841 	ill_t		*ill = ira->ira_ill;
842 	ip_stack_t	*ipst = ill->ill_ipst;
843 	ill_t		*dst_ill;
844 	nce_t		*nce;
845 	ipaddr_t	src = ipha->ipha_src;
846 	uint32_t	added_tx_len;
847 	uint32_t	mtu, iremtu;
848 
849 	if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
850 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
851 		ip_drop_input("l2 multicast not forwarded", mp, ill);
852 		freemsg(mp);
853 		return;
854 	}
855 
856 	if (!(ill->ill_flags & ILLF_ROUTER) && !ip_source_routed(ipha, ipst)) {
857 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
858 		ip_drop_input("ipIfStatsForwProhibits", mp, ill);
859 		freemsg(mp);
860 		return;
861 	}
862 
863 	/*
864 	 * Either ire_nce_capable or ire_dep_parent would be set for the IRE
865 	 * when it is found by ire_route_recursive, but that some other thread
866 	 * could have changed the routes with the effect of clearing
867 	 * ire_dep_parent. In that case we'd end up dropping the packet, or
868 	 * finding a new nce below.
869 	 * Get, allocate, or update the nce.
870 	 * We get a refhold on ire_nce_cache as a result of this to avoid races
871 	 * where ire_nce_cache is deleted.
872 	 *
873 	 * This ensures that we don't forward if the interface is down since
874 	 * ipif_down removes all the nces.
875 	 */
876 	mutex_enter(&ire->ire_lock);
877 	nce = ire->ire_nce_cache;
878 	if (nce == NULL) {
879 		/* Not yet set up - try to set one up */
880 		mutex_exit(&ire->ire_lock);
881 		(void) ire_revalidate_nce(ire);
882 		mutex_enter(&ire->ire_lock);
883 		nce = ire->ire_nce_cache;
884 		if (nce == NULL) {
885 			mutex_exit(&ire->ire_lock);
886 			/* The ire_dep_parent chain went bad, or no memory */
887 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
888 			ip_drop_input("No ire_dep_parent", mp, ill);
889 			freemsg(mp);
890 			return;
891 		}
892 	}
893 	nce_refhold(nce);
894 	mutex_exit(&ire->ire_lock);
895 
896 	if (nce->nce_is_condemned) {
897 		nce_t *nce1;
898 
899 		nce1 = ire_handle_condemned_nce(nce, ire, ipha, NULL, B_FALSE);
900 		nce_refrele(nce);
901 		if (nce1 == NULL) {
902 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
903 			ip_drop_input("No nce", mp, ill);
904 			freemsg(mp);
905 			return;
906 		}
907 		nce = nce1;
908 	}
909 	dst_ill = nce->nce_ill;
910 
911 	/*
912 	 * Unless we are forwarding, drop the packet.
913 	 * We have to let source routed packets through if they go out
914 	 * the same interface i.e., they are 'ping -l' packets.
915 	 */
916 	if (!(dst_ill->ill_flags & ILLF_ROUTER) &&
917 	    !(ip_source_routed(ipha, ipst) && dst_ill == ill)) {
918 		if (ip_source_routed(ipha, ipst)) {
919 			ip_drop_input("ICMP_SOURCE_ROUTE_FAILED", mp, ill);
920 			icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
921 			nce_refrele(nce);
922 			return;
923 		}
924 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
925 		ip_drop_input("ipIfStatsForwProhibits", mp, ill);
926 		freemsg(mp);
927 		nce_refrele(nce);
928 		return;
929 	}
930 
931 	if (ire->ire_zoneid != GLOBAL_ZONEID && ire->ire_zoneid != ALL_ZONES) {
932 		ipaddr_t	dst = ipha->ipha_dst;
933 
934 		ire->ire_ib_pkt_count--;
935 		/*
936 		 * Should only use IREs that are visible from the
937 		 * global zone for forwarding.
938 		 * Take a source route into account the same way as ip_input
939 		 * did.
940 		 */
941 		if (ira->ira_flags & IRAF_IPV4_OPTIONS) {
942 			int		error = 0;
943 
944 			dst = ip_input_options(ipha, dst, mp, ira, &error);
945 			ASSERT(error == 0);	/* ip_input checked */
946 		}
947 		ire = ire_route_recursive_v4(dst, 0, NULL, GLOBAL_ZONEID,
948 		    ira->ira_tsl, MATCH_IRE_SECATTR,
949 		    (ill->ill_flags & ILLF_ROUTER) ? IRR_ALLOCATE : IRR_NONE,
950 		    ira->ira_xmit_hint, ipst, NULL, NULL, NULL);
951 		ire->ire_ib_pkt_count++;
952 		(*ire->ire_recvfn)(ire, mp, ipha, ira);
953 		ire_refrele(ire);
954 		nce_refrele(nce);
955 		return;
956 	}
957 
958 	/*
959 	 * ipIfStatsHCInForwDatagrams should only be increment if there
960 	 * will be an attempt to forward the packet, which is why we
961 	 * increment after the above condition has been checked.
962 	 */
963 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
964 
965 	/* Initiate Read side IPPF processing */
966 	if (IPP_ENABLED(IPP_FWD_IN, ipst)) {
967 		/* ip_process translates an IS_UNDER_IPMP */
968 		mp = ip_process(IPP_FWD_IN, mp, ill, ill);
969 		if (mp == NULL) {
970 			/* ip_drop_packet and MIB done */
971 			ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred "
972 			    "during IPPF processing\n"));
973 			nce_refrele(nce);
974 			return;
975 		}
976 	}
977 
978 	DTRACE_PROBE4(ip4__forwarding__start,
979 	    ill_t *, ill, ill_t *, dst_ill, ipha_t *, ipha, mblk_t *, mp);
980 
981 	if (HOOKS4_INTERESTED_FORWARDING(ipst)) {
982 		int error;
983 
984 		FW_HOOKS(ipst->ips_ip4_forwarding_event,
985 		    ipst->ips_ipv4firewall_forwarding,
986 		    ill, dst_ill, ipha, mp, mp, 0, ipst, error);
987 
988 		DTRACE_PROBE1(ip4__forwarding__end, mblk_t *, mp);
989 
990 		if (mp == NULL) {
991 			nce_refrele(nce);
992 			return;
993 		}
994 		/*
995 		 * Even if the destination was changed by the filter we use the
996 		 * forwarding decision that was made based on the address
997 		 * in ip_input.
998 		 */
999 
1000 		/* Might have changed */
1001 		ipha = (ipha_t *)mp->b_rptr;
1002 		ira->ira_pktlen = ntohs(ipha->ipha_length);
1003 	}
1004 
1005 	/* Packet is being forwarded. Turning off hwcksum flag. */
1006 	DB_CKSUMFLAGS(mp) = 0;
1007 
1008 	/*
1009 	 * Martian Address Filtering [RFC 1812, Section 5.3.7]
1010 	 * The loopback address check for both src and dst has already
1011 	 * been checked in ip_input
1012 	 * In the future one can envision adding RPF checks using number 3.
1013 	 * If we already checked the same source address we can skip this.
1014 	 */
1015 	if (!(ira->ira_flags & IRAF_VERIFIED_SRC) ||
1016 	    src != ira->ira_verified_src) {
1017 		switch (ipst->ips_src_check) {
1018 		case 0:
1019 			break;
1020 		case 2:
1021 			if (ip_type_v4(src, ipst) == IRE_BROADCAST) {
1022 				BUMP_MIB(ill->ill_ip_mib,
1023 				    ipIfStatsForwProhibits);
1024 				BUMP_MIB(ill->ill_ip_mib,
1025 				    ipIfStatsInAddrErrors);
1026 				ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1027 				freemsg(mp);
1028 				nce_refrele(nce);
1029 				return;
1030 			}
1031 			/* FALLTHRU */
1032 
1033 		case 1:
1034 			if (CLASSD(src)) {
1035 				BUMP_MIB(ill->ill_ip_mib,
1036 				    ipIfStatsForwProhibits);
1037 				BUMP_MIB(ill->ill_ip_mib,
1038 				    ipIfStatsInAddrErrors);
1039 				ip_drop_input("ipIfStatsInAddrErrors", mp, ill);
1040 				freemsg(mp);
1041 				nce_refrele(nce);
1042 				return;
1043 			}
1044 			break;
1045 		}
1046 		/* Remember for next packet */
1047 		ira->ira_flags |= IRAF_VERIFIED_SRC;
1048 		ira->ira_verified_src = src;
1049 	}
1050 
1051 	/*
1052 	 * Check if packet is going out the same link on which it arrived.
1053 	 * Means we might need to send a redirect.
1054 	 */
1055 	if (IS_ON_SAME_LAN(dst_ill, ill) && ipst->ips_ip_g_send_redirects) {
1056 		ip_send_potential_redirect_v4(mp, ipha, ire, ira);
1057 	}
1058 
1059 	added_tx_len = 0;
1060 	if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
1061 		mblk_t		*mp1;
1062 		uint32_t	old_pkt_len = ira->ira_pktlen;
1063 
1064 		/* Verify IP header checksum before adding/removing options */
1065 		if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) &&
1066 		    ip_csum_hdr(ipha)) {
1067 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1068 			ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1069 			freemsg(mp);
1070 			nce_refrele(nce);
1071 			return;
1072 		}
1073 		ira->ira_flags &= ~IRAF_VERIFY_IP_CKSUM;
1074 
1075 		/*
1076 		 * Check if it can be forwarded and add/remove
1077 		 * CIPSO options as needed.
1078 		 */
1079 		if ((mp1 = tsol_ip_forward(ire, mp, ira)) == NULL) {
1080 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1081 			ip_drop_input("tsol_ip_forward", mp, ill);
1082 			freemsg(mp);
1083 			nce_refrele(nce);
1084 			return;
1085 		}
1086 		/*
1087 		 * Size may have changed. Remember amount added in case
1088 		 * IP needs to send an ICMP too big.
1089 		 */
1090 		mp = mp1;
1091 		ipha = (ipha_t *)mp->b_rptr;
1092 		ira->ira_pktlen = ntohs(ipha->ipha_length);
1093 		ira->ira_ip_hdr_length = IPH_HDR_LENGTH(ipha);
1094 		if (ira->ira_pktlen > old_pkt_len)
1095 			added_tx_len = ira->ira_pktlen - old_pkt_len;
1096 
1097 		/* Options can have been added or removed */
1098 		if (ira->ira_ip_hdr_length != IP_SIMPLE_HDR_LENGTH)
1099 			ira->ira_flags |= IRAF_IPV4_OPTIONS;
1100 		else
1101 			ira->ira_flags &= ~IRAF_IPV4_OPTIONS;
1102 	}
1103 
1104 	mtu = dst_ill->ill_mtu;
1105 	if ((iremtu = ire->ire_metrics.iulp_mtu) != 0 && iremtu < mtu)
1106 		mtu = iremtu;
1107 	ip_forward_xmit_v4(nce, ill, mp, ipha, ira, mtu, added_tx_len);
1108 	nce_refrele(nce);
1109 }
1110 
1111 /*
1112  * Used for sending out unicast and multicast packets that are
1113  * forwarded.
1114  */
1115 void
ip_forward_xmit_v4(nce_t * nce,ill_t * ill,mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira,uint32_t mtu,uint32_t added_tx_len)1116 ip_forward_xmit_v4(nce_t *nce, ill_t *ill, mblk_t *mp, ipha_t *ipha,
1117     ip_recv_attr_t *ira, uint32_t mtu, uint32_t added_tx_len)
1118 {
1119 	ill_t		*dst_ill = nce->nce_ill;
1120 	uint32_t	pkt_len;
1121 	uint32_t	sum;
1122 	iaflags_t	iraflags = ira->ira_flags;
1123 	ip_stack_t	*ipst = ill->ill_ipst;
1124 	iaflags_t	ixaflags;
1125 
1126 	if (ipha->ipha_ttl <= 1) {
1127 		/* Perhaps the checksum was bad */
1128 		if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1129 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1130 			ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1131 			freemsg(mp);
1132 			return;
1133 		}
1134 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1135 		ip_drop_input("ICMP_TTL_EXCEEDED", mp, ill);
1136 		icmp_time_exceeded(mp, ICMP_TTL_EXCEEDED, ira);
1137 		return;
1138 	}
1139 
1140 	/*
1141 	 * Count the forward as a hop and update the checksum
1142 	 * accordingly.
1143 	 */
1144 	ipha->ipha_ttl--;
1145 	sum = (int)ipha->ipha_hdr_checksum + IP_HDR_CSUM_TTL_ADJUST;
1146 	ipha->ipha_hdr_checksum = (uint16_t)(sum + (sum >> 16));
1147 
1148 	/* Check if there are options to update */
1149 	if (iraflags & IRAF_IPV4_OPTIONS) {
1150 		ASSERT(ipha->ipha_version_and_hdr_length !=
1151 		    IP_SIMPLE_HDR_VERSION);
1152 		ASSERT(!(iraflags & IRAF_VERIFY_IP_CKSUM));
1153 
1154 		if (!ip_forward_options(mp, ipha, dst_ill, ira)) {
1155 			/* ipIfStatsForwProhibits and ip_drop_input done */
1156 			return;
1157 		}
1158 
1159 		ipha->ipha_hdr_checksum = 0;
1160 		ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1161 	}
1162 
1163 	/* Initiate Write side IPPF processing before any fragmentation */
1164 	if (IPP_ENABLED(IPP_FWD_OUT, ipst)) {
1165 		/* ip_process translates an IS_UNDER_IPMP */
1166 		mp = ip_process(IPP_FWD_OUT, mp, dst_ill, dst_ill);
1167 		if (mp == NULL) {
1168 			/* ip_drop_packet and MIB done */
1169 			ip2dbg(("ire_recv_forward_v4: pkt dropped/deferred" \
1170 			    " during IPPF processing\n"));
1171 			return;
1172 		}
1173 	}
1174 
1175 	pkt_len = ira->ira_pktlen;
1176 
1177 	BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsHCOutForwDatagrams);
1178 
1179 	ixaflags = IXAF_IS_IPV4 | IXAF_NO_DEV_FLOW_CTL;
1180 
1181 	if (pkt_len > mtu) {
1182 		/*
1183 		 * It needs fragging on its way out.  If we haven't
1184 		 * verified the header checksum yet we do it now since
1185 		 * are going to put a surely good checksum in the
1186 		 * outgoing header, we have to make sure that it
1187 		 * was good coming in.
1188 		 */
1189 		if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1190 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1191 			ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1192 			freemsg(mp);
1193 			return;
1194 		}
1195 		if (ipha->ipha_fragment_offset_and_flags & IPH_DF_HTONS) {
1196 			BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutFragFails);
1197 			ip_drop_output("ipIfStatsOutFragFails", mp, dst_ill);
1198 			if (iraflags & IRAF_SYSTEM_LABELED) {
1199 				/*
1200 				 * Remove any CIPSO option added by
1201 				 * tsol_ip_forward, and make sure we report
1202 				 * a path MTU so that there
1203 				 * is room to add such a CIPSO option for future
1204 				 * packets.
1205 				 */
1206 				mtu = tsol_pmtu_adjust(mp, mtu, added_tx_len,
1207 				    AF_INET);
1208 			}
1209 
1210 			icmp_frag_needed(mp, mtu, ira);
1211 			return;
1212 		}
1213 
1214 		(void) ip_fragment_v4(mp, nce, ixaflags, pkt_len, mtu,
1215 		    ira->ira_xmit_hint, GLOBAL_ZONEID, 0, ip_xmit, NULL);
1216 		return;
1217 	}
1218 
1219 	ASSERT(pkt_len == ntohs(((ipha_t *)mp->b_rptr)->ipha_length));
1220 	if (iraflags & IRAF_LOOPBACK_COPY) {
1221 		/*
1222 		 * IXAF_NO_LOOP_ZONEID is not set hence 7th arg
1223 		 * is don't care
1224 		 */
1225 		(void) ip_postfrag_loopcheck(mp, nce,
1226 		    ixaflags | IXAF_LOOPBACK_COPY,
1227 		    pkt_len, ira->ira_xmit_hint, GLOBAL_ZONEID, 0, NULL);
1228 	} else {
1229 		(void) ip_xmit(mp, nce, ixaflags, pkt_len, ira->ira_xmit_hint,
1230 		    GLOBAL_ZONEID, 0, NULL);
1231 	}
1232 }
1233 
1234 /*
1235  * ire_recvfn for RTF_REJECT and RTF_BLACKHOLE routes, including IRE_NOROUTE,
1236  * which is what ire_route_recursive returns when there is no matching ire.
1237  * Send ICMP unreachable unless blackhole.
1238  */
1239 void
ire_recv_noroute_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1240 ire_recv_noroute_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1241 {
1242 	ipha_t		*ipha = (ipha_t *)iph_arg;
1243 	ill_t		*ill = ira->ira_ill;
1244 	ip_stack_t	*ipst = ill->ill_ipst;
1245 
1246 	/* Would we have forwarded this packet if we had a route? */
1247 	if (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST)) {
1248 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1249 		ip_drop_input("l2 multicast not forwarded", mp, ill);
1250 		freemsg(mp);
1251 		return;
1252 	}
1253 
1254 	if (!(ill->ill_flags & ILLF_ROUTER)) {
1255 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1256 		ip_drop_input("ipIfStatsForwProhibits", mp, ill);
1257 		freemsg(mp);
1258 		return;
1259 	}
1260 	/*
1261 	 * If we had a route this could have been forwarded. Count as such.
1262 	 *
1263 	 * ipIfStatsHCInForwDatagrams should only be increment if there
1264 	 * will be an attempt to forward the packet, which is why we
1265 	 * increment after the above condition has been checked.
1266 	 */
1267 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInForwDatagrams);
1268 
1269 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1270 
1271 	ip_rts_change(RTM_MISS, ipha->ipha_dst, 0, 0, 0, 0, 0, 0, RTA_DST,
1272 	    ipst);
1273 
1274 	if (ire->ire_flags & RTF_BLACKHOLE) {
1275 		ip_drop_input("ipIfStatsInNoRoutes RTF_BLACKHOLE", mp, ill);
1276 		freemsg(mp);
1277 	} else {
1278 		ip_drop_input("ipIfStatsInNoRoutes RTF_REJECT", mp, ill);
1279 
1280 		if (ip_source_routed(ipha, ipst)) {
1281 			icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, ira);
1282 		} else {
1283 			icmp_unreachable(mp, ICMP_HOST_UNREACHABLE, ira);
1284 		}
1285 	}
1286 }
1287 
1288 /*
1289  * ire_recvfn for IRE_LOCALs marked with ire_noaccept. Such IREs are used for
1290  * VRRP when in noaccept mode.
1291  * We silently drop the packet. ARP handles packets even if noaccept is set.
1292  */
1293 /* ARGSUSED */
1294 void
ire_recv_noaccept_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1295 ire_recv_noaccept_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1296     ip_recv_attr_t *ira)
1297 {
1298 	ill_t		*ill = ira->ira_ill;
1299 
1300 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1301 	ip_drop_input("ipIfStatsInDiscards - noaccept", mp, ill);
1302 	freemsg(mp);
1303 }
1304 
1305 /*
1306  * ire_recvfn for IRE_BROADCAST.
1307  */
1308 void
ire_recv_broadcast_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1309 ire_recv_broadcast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1310     ip_recv_attr_t *ira)
1311 {
1312 	ipha_t		*ipha = (ipha_t *)iph_arg;
1313 	ill_t		*ill = ira->ira_ill;
1314 	ill_t		*dst_ill = ire->ire_ill;
1315 	ip_stack_t	*ipst = ill->ill_ipst;
1316 	ire_t		*alt_ire;
1317 	nce_t		*nce;
1318 	ipaddr_t	ipha_dst;
1319 
1320 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInBcastPkts);
1321 
1322 	/* Tag for higher-level protocols */
1323 	ira->ira_flags |= IRAF_BROADCAST;
1324 
1325 	/*
1326 	 * Whether local or directed broadcast forwarding: don't allow
1327 	 * for TCP.
1328 	 */
1329 	if (ipha->ipha_protocol == IPPROTO_TCP) {
1330 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1331 		ip_drop_input("ipIfStatsInDiscards", mp, ill);
1332 		freemsg(mp);
1333 		return;
1334 	}
1335 
1336 	/*
1337 	 * So that we don't end up with dups, only one ill an IPMP group is
1338 	 * nominated to receive broadcast traffic.
1339 	 * If we have no cast_ill we are liberal and accept everything.
1340 	 */
1341 	if (IS_UNDER_IPMP(ill)) {
1342 		/* For an under ill_grp can change under lock */
1343 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1344 		if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1345 		    ill->ill_grp->ig_cast_ill != NULL) {
1346 			rw_exit(&ipst->ips_ill_g_lock);
1347 			/* No MIB since this is normal operation */
1348 			ip_drop_input("not nom_cast", mp, ill);
1349 			freemsg(mp);
1350 			return;
1351 		}
1352 		rw_exit(&ipst->ips_ill_g_lock);
1353 
1354 		ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1355 	}
1356 
1357 	/*
1358 	 * After reassembly and IPsec we will need to duplicate the
1359 	 * broadcast packet for all matching zones on the ill.
1360 	 */
1361 	ira->ira_zoneid = ALL_ZONES;
1362 
1363 	/*
1364 	 * Check for directed broadcast i.e. ire->ire_ill is different than
1365 	 * the incoming ill.
1366 	 * The same broadcast address can be assigned to multiple interfaces
1367 	 * so have to check explicitly for that case by looking up the alt_ire
1368 	 */
1369 	if (dst_ill == ill && !(ire->ire_flags & RTF_MULTIRT)) {
1370 		/* Reassemble on the ill on which the packet arrived */
1371 		ip_input_local_v4(ire, mp, ipha, ira);
1372 		/* Restore */
1373 		ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1374 		return;
1375 	}
1376 
1377 	/* Is there an IRE_BROADCAST on the incoming ill? */
1378 	ipha_dst = ((ira->ira_flags & IRAF_DHCP_UNICAST) ? INADDR_BROADCAST :
1379 	    ipha->ipha_dst);
1380 	alt_ire = ire_ftable_lookup_v4(ipha_dst, 0, 0, IRE_BROADCAST, ill,
1381 	    ALL_ZONES, ira->ira_tsl,
1382 	    MATCH_IRE_TYPE|MATCH_IRE_ILL|MATCH_IRE_SECATTR, 0, ipst, NULL);
1383 	if (alt_ire != NULL) {
1384 		/* Not a directed broadcast */
1385 		/*
1386 		 * In the special case of multirouted broadcast
1387 		 * packets, we unconditionally need to "gateway"
1388 		 * them to the appropriate interface here so that reassembly
1389 		 * works. We know that the IRE_BROADCAST on cgtp0 doesn't
1390 		 * have RTF_MULTIRT set so we look for such an IRE in the
1391 		 * bucket.
1392 		 */
1393 		if (alt_ire->ire_flags & RTF_MULTIRT) {
1394 			irb_t		*irb;
1395 			ire_t		*ire1;
1396 
1397 			irb = ire->ire_bucket;
1398 			irb_refhold(irb);
1399 			for (ire1 = irb->irb_ire; ire1 != NULL;
1400 			    ire1 = ire1->ire_next) {
1401 				if (IRE_IS_CONDEMNED(ire1))
1402 					continue;
1403 				if (!(ire1->ire_type & IRE_BROADCAST) ||
1404 				    (ire1->ire_flags & RTF_MULTIRT))
1405 					continue;
1406 				ill = ire1->ire_ill;
1407 				ill_refhold(ill);
1408 				break;
1409 			}
1410 			irb_refrele(irb);
1411 			if (ire1 != NULL) {
1412 				ill_t *orig_ill = ira->ira_ill;
1413 
1414 				ire_refrele(alt_ire);
1415 				/* Reassemble on the new ill */
1416 				ira->ira_ill = ill;
1417 				ip_input_local_v4(ire, mp, ipha, ira);
1418 				ill_refrele(ill);
1419 				/* Restore */
1420 				ira->ira_ill = orig_ill;
1421 				ira->ira_ruifindex =
1422 				    orig_ill->ill_phyint->phyint_ifindex;
1423 				return;
1424 			}
1425 		}
1426 		ire_refrele(alt_ire);
1427 		/* Reassemble on the ill on which the packet arrived */
1428 		ip_input_local_v4(ire, mp, ipha, ira);
1429 		goto done;
1430 	}
1431 
1432 	/*
1433 	 * This is a directed broadcast
1434 	 *
1435 	 * If directed broadcast is allowed, then forward the packet out
1436 	 * the destination interface with IXAF_LOOPBACK_COPY set. That will
1437 	 * result in ip_input() receiving a copy of the packet on the
1438 	 * appropriate ill. (We could optimize this to avoid the extra trip
1439 	 * via ip_input(), but since directed broadcasts are normally disabled
1440 	 * it doesn't make sense to optimize it.)
1441 	 */
1442 	if (!ipst->ips_ip_g_forward_directed_bcast ||
1443 	    (ira->ira_flags & (IRAF_L2DST_MULTICAST|IRAF_L2DST_BROADCAST))) {
1444 		ip_drop_input("directed broadcast not allowed", mp, ill);
1445 		freemsg(mp);
1446 		goto done;
1447 	}
1448 	if ((ira->ira_flags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1449 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1450 		ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1451 		freemsg(mp);
1452 		goto done;
1453 	}
1454 
1455 	/*
1456 	 * Clear the indication that this may have hardware
1457 	 * checksum as we are not using it for forwarding.
1458 	 */
1459 	DB_CKSUMFLAGS(mp) = 0;
1460 
1461 	/*
1462 	 * Adjust ttl to 2 (1+1 - the forward engine will decrement it by one.
1463 	 */
1464 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl + 1;
1465 	ipha->ipha_hdr_checksum = 0;
1466 	ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1467 
1468 	/*
1469 	 * We use ip_forward_xmit to do any fragmentation.
1470 	 * and loopback copy on the outbound interface.
1471 	 *
1472 	 * Make it so that IXAF_LOOPBACK_COPY to be set on transmit side.
1473 	 */
1474 	ira->ira_flags |= IRAF_LOOPBACK_COPY;
1475 
1476 	nce = arp_nce_init(dst_ill, ipha->ipha_dst, IRE_BROADCAST);
1477 	if (nce == NULL) {
1478 		BUMP_MIB(dst_ill->ill_ip_mib, ipIfStatsOutDiscards);
1479 		ip_drop_output("No nce", mp, dst_ill);
1480 		freemsg(mp);
1481 		goto done;
1482 	}
1483 
1484 	ip_forward_xmit_v4(nce, ill, mp, ipha, ira, dst_ill->ill_mc_mtu, 0);
1485 	nce_refrele(nce);
1486 done:
1487 	/* Restore */
1488 	ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1489 }
1490 
1491 /*
1492  * ire_recvfn for IRE_MULTICAST.
1493  */
1494 void
ire_recv_multicast_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1495 ire_recv_multicast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1496     ip_recv_attr_t *ira)
1497 {
1498 	ipha_t		*ipha = (ipha_t *)iph_arg;
1499 	ill_t		*ill = ira->ira_ill;
1500 	ip_stack_t	*ipst = ill->ill_ipst;
1501 
1502 	ASSERT(ire->ire_ill == ira->ira_ill);
1503 
1504 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastPkts);
1505 	UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInMcastOctets, ira->ira_pktlen);
1506 
1507 	/* RSVP hook */
1508 	if (ira->ira_flags & IRAF_RSVP)
1509 		goto forus;
1510 
1511 	/* Tag for higher-level protocols */
1512 	ira->ira_flags |= IRAF_MULTICAST;
1513 
1514 	/*
1515 	 * So that we don't end up with dups, only one ill an IPMP group is
1516 	 * nominated to receive multicast traffic.
1517 	 * If we have no cast_ill we are liberal and accept everything.
1518 	 */
1519 	if (IS_UNDER_IPMP(ill)) {
1520 		ip_stack_t	*ipst = ill->ill_ipst;
1521 
1522 		/* For an under ill_grp can change under lock */
1523 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1524 		if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
1525 		    ill->ill_grp->ig_cast_ill != NULL) {
1526 			rw_exit(&ipst->ips_ill_g_lock);
1527 			ip_drop_input("not on cast ill", mp, ill);
1528 			freemsg(mp);
1529 			return;
1530 		}
1531 		rw_exit(&ipst->ips_ill_g_lock);
1532 		/*
1533 		 * We switch to the upper ill so that mrouter and hasmembers
1534 		 * can operate on upper here and in ip_input_multicast.
1535 		 */
1536 		ill = ipmp_ill_hold_ipmp_ill(ill);
1537 		if (ill != NULL) {
1538 			ASSERT(ill != ira->ira_ill);
1539 			ASSERT(ire->ire_ill == ira->ira_ill);
1540 			ira->ira_ill = ill;
1541 			ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1542 		} else {
1543 			ill = ira->ira_ill;
1544 		}
1545 	}
1546 
1547 	/*
1548 	 * Check if we are a multicast router - send ip_mforward a copy of
1549 	 * the packet.
1550 	 * Due to mroute_decap tunnels we consider forwarding packets even if
1551 	 * mrouted has not joined the allmulti group on this interface.
1552 	 */
1553 	if (ipst->ips_ip_g_mrouter) {
1554 		int retval;
1555 
1556 		/*
1557 		 * Clear the indication that this may have hardware
1558 		 * checksum as we are not using it for forwarding.
1559 		 */
1560 		DB_CKSUMFLAGS(mp) = 0;
1561 
1562 		/*
1563 		 * ip_mforward helps us make these distinctions: If received
1564 		 * on tunnel and not IGMP, then drop.
1565 		 * If IGMP packet, then don't check membership
1566 		 * If received on a phyint and IGMP or PIM, then
1567 		 * don't check membership
1568 		 */
1569 		retval = ip_mforward(mp, ira);
1570 		/* ip_mforward updates mib variables if needed */
1571 
1572 		switch (retval) {
1573 		case 0:
1574 			/*
1575 			 * pkt is okay and arrived on phyint.
1576 			 *
1577 			 * If we are running as a multicast router
1578 			 * we need to see all IGMP and/or PIM packets.
1579 			 */
1580 			if ((ipha->ipha_protocol == IPPROTO_IGMP) ||
1581 			    (ipha->ipha_protocol == IPPROTO_PIM)) {
1582 				goto forus;
1583 			}
1584 			break;
1585 		case -1:
1586 			/* pkt is mal-formed, toss it */
1587 			freemsg(mp);
1588 			goto done;
1589 		case 1:
1590 			/*
1591 			 * pkt is okay and arrived on a tunnel
1592 			 *
1593 			 * If we are running a multicast router
1594 			 * we need to see all igmp packets.
1595 			 */
1596 			if (ipha->ipha_protocol == IPPROTO_IGMP) {
1597 				goto forus;
1598 			}
1599 			ip_drop_input("Multicast on tunnel ignored", mp, ill);
1600 			freemsg(mp);
1601 			goto done;
1602 		}
1603 	}
1604 
1605 	/*
1606 	 * Check if we have members on this ill. This is not necessary for
1607 	 * correctness because even if the NIC/GLD had a leaky filter, we
1608 	 * filter before passing to each conn_t.
1609 	 */
1610 	if (!ill_hasmembers_v4(ill, ipha->ipha_dst)) {
1611 		/*
1612 		 * Nobody interested
1613 		 *
1614 		 * This might just be caused by the fact that
1615 		 * multiple IP Multicast addresses map to the same
1616 		 * link layer multicast - no need to increment counter!
1617 		 */
1618 		ip_drop_input("Multicast with no members", mp, ill);
1619 		freemsg(mp);
1620 		goto done;
1621 	}
1622 forus:
1623 	ip2dbg(("ire_recv_multicast_v4: multicast for us: 0x%x\n",
1624 	    ntohl(ipha->ipha_dst)));
1625 
1626 	/*
1627 	 * After reassembly and IPsec we will need to duplicate the
1628 	 * multicast packet for all matching zones on the ill.
1629 	 */
1630 	ira->ira_zoneid = ALL_ZONES;
1631 
1632 	/* Reassemble on the ill on which the packet arrived */
1633 	ip_input_local_v4(ire, mp, ipha, ira);
1634 done:
1635 	if (ill != ire->ire_ill) {
1636 		ill_refrele(ill);
1637 		ira->ira_ill = ire->ire_ill;
1638 		ira->ira_ruifindex = ira->ira_ill->ill_phyint->phyint_ifindex;
1639 	}
1640 }
1641 
1642 /*
1643  * ire_recvfn for IRE_OFFLINK with RTF_MULTIRT.
1644  * Drop packets since we don't forward out multirt routes.
1645  */
1646 /* ARGSUSED */
1647 void
ire_recv_multirt_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1648 ire_recv_multirt_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1649 {
1650 	ill_t		*ill = ira->ira_ill;
1651 
1652 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInNoRoutes);
1653 	ip_drop_input("Not forwarding out MULTIRT", mp, ill);
1654 	freemsg(mp);
1655 }
1656 
1657 /*
1658  * ire_recvfn for IRE_LOOPBACK. This is only used when a FW_HOOK
1659  * has rewritten the packet to have a loopback destination address (We
1660  * filter out packet with a loopback destination from arriving over the wire).
1661  * We don't know what zone to use, thus we always use the GLOBAL_ZONEID.
1662  */
1663 void
ire_recv_loopback_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1664 ire_recv_loopback_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1665 {
1666 	ipha_t		*ipha = (ipha_t *)iph_arg;
1667 	ill_t		*ill = ira->ira_ill;
1668 	ill_t		*ire_ill = ire->ire_ill;
1669 
1670 	ira->ira_zoneid = GLOBAL_ZONEID;
1671 
1672 	/* Switch to the lo0 ill for further processing  */
1673 	if (ire_ill != ill) {
1674 		/*
1675 		 * Update ira_ill to be the ILL on which the IP address
1676 		 * is hosted.
1677 		 * No need to hold the ill since we have a hold on the ire
1678 		 */
1679 		ASSERT(ira->ira_ill == ira->ira_rill);
1680 		ira->ira_ill = ire_ill;
1681 
1682 		ip_input_local_v4(ire, mp, ipha, ira);
1683 
1684 		/* Restore */
1685 		ASSERT(ira->ira_ill == ire_ill);
1686 		ira->ira_ill = ill;
1687 		return;
1688 
1689 	}
1690 	ip_input_local_v4(ire, mp, ipha, ira);
1691 }
1692 
1693 /*
1694  * ire_recvfn for IRE_LOCAL.
1695  */
1696 void
ire_recv_local_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_recv_attr_t * ira)1697 ire_recv_local_v4(ire_t *ire, mblk_t *mp, void *iph_arg, ip_recv_attr_t *ira)
1698 {
1699 	ipha_t		*ipha = (ipha_t *)iph_arg;
1700 	ill_t		*ill = ira->ira_ill;
1701 	ill_t		*ire_ill = ire->ire_ill;
1702 
1703 	/* Make a note for DAD that this address is in use */
1704 	ire->ire_last_used_time = LBOLT_FASTPATH;
1705 
1706 	/* Only target the IRE_LOCAL with the right zoneid. */
1707 	ira->ira_zoneid = ire->ire_zoneid;
1708 
1709 	/*
1710 	 * If the packet arrived on the wrong ill, we check that
1711 	 * this is ok.
1712 	 * If it is, then we ensure that we do the reassembly on
1713 	 * the ill on which the address is hosted. We keep ira_rill as
1714 	 * the one on which the packet arrived, so that IP_PKTINFO and
1715 	 * friends can report this.
1716 	 */
1717 	if (ire_ill != ill) {
1718 		ire_t *new_ire;
1719 
1720 		new_ire = ip_check_multihome(&ipha->ipha_dst, ire, ill);
1721 		if (new_ire == NULL) {
1722 			/* Drop packet */
1723 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsForwProhibits);
1724 			ip_drop_input("ipIfStatsInForwProhibits", mp, ill);
1725 			freemsg(mp);
1726 			return;
1727 		}
1728 		/*
1729 		 * Update ira_ill to be the ILL on which the IP address
1730 		 * is hosted. No need to hold the ill since we have a
1731 		 * hold on the ire. Note that we do the switch even if
1732 		 * new_ire == ire (for IPMP, ire would be the one corresponding
1733 		 * to the IPMP ill).
1734 		 */
1735 		ASSERT(ira->ira_ill == ira->ira_rill);
1736 		ira->ira_ill = new_ire->ire_ill;
1737 
1738 		/* ira_ruifindex tracks the upper for ira_rill */
1739 		if (IS_UNDER_IPMP(ill))
1740 			ira->ira_ruifindex = ill_get_upper_ifindex(ill);
1741 
1742 		ip_input_local_v4(new_ire, mp, ipha, ira);
1743 
1744 		/* Restore */
1745 		ASSERT(ira->ira_ill == new_ire->ire_ill);
1746 		ira->ira_ill = ill;
1747 		ira->ira_ruifindex = ill->ill_phyint->phyint_ifindex;
1748 
1749 		if (new_ire != ire)
1750 			ire_refrele(new_ire);
1751 		return;
1752 	}
1753 
1754 	ip_input_local_v4(ire, mp, ipha, ira);
1755 }
1756 
1757 /*
1758  * Common function for packets arriving for the host. Handles
1759  * checksum verification, reassembly checks, etc.
1760  */
1761 static void
ip_input_local_v4(ire_t * ire,mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira)1762 ip_input_local_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1763 {
1764 	ill_t		*ill = ira->ira_ill;
1765 	iaflags_t	iraflags = ira->ira_flags;
1766 
1767 	/*
1768 	 * Verify IP header checksum. If the packet was AH or ESP then
1769 	 * this flag has already been cleared. Likewise if the packet
1770 	 * had a hardware checksum.
1771 	 */
1772 	if ((iraflags & IRAF_VERIFY_IP_CKSUM) && ip_csum_hdr(ipha)) {
1773 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsInCksumErrs);
1774 		ip_drop_input("ipIfStatsInCksumErrs", mp, ill);
1775 		freemsg(mp);
1776 		return;
1777 	}
1778 
1779 	if (iraflags & IRAF_IPV4_OPTIONS) {
1780 		if (!ip_input_local_options(mp, ipha, ira)) {
1781 			/* Error has been sent and mp consumed */
1782 			return;
1783 		}
1784 		/*
1785 		 * Some old hardware does partial checksum by including the
1786 		 * whole IP header, so the partial checksum value might have
1787 		 * become invalid if any option in the packet have been
1788 		 * updated. Always clear partial checksum flag here.
1789 		 */
1790 		DB_CKSUMFLAGS(mp) &= ~HCK_PARTIALCKSUM;
1791 	}
1792 
1793 	/*
1794 	 * Is packet part of fragmented IP packet?
1795 	 * We compare against defined values in network byte order
1796 	 */
1797 	if (ipha->ipha_fragment_offset_and_flags &
1798 	    (IPH_MF_HTONS | IPH_OFFSET_HTONS)) {
1799 		/*
1800 		 * Make sure we have ira_l2src before we loose the original
1801 		 * mblk
1802 		 */
1803 		if (!(ira->ira_flags & IRAF_L2SRC_SET))
1804 			ip_setl2src(mp, ira, ira->ira_rill);
1805 
1806 		mp = ip_input_fragment(mp, ipha, ira);
1807 		if (mp == NULL)
1808 			return;
1809 		/* Completed reassembly */
1810 		ipha = (ipha_t *)mp->b_rptr;
1811 	}
1812 
1813 	/*
1814 	 * For broadcast and multicast we need some extra work before
1815 	 * we call ip_fanout_v4(), since in the case of shared-IP zones
1816 	 * we need to pretend that a packet arrived for each zoneid.
1817 	 */
1818 	if (iraflags & IRAF_MULTIBROADCAST) {
1819 		if (iraflags & IRAF_BROADCAST)
1820 			ip_input_broadcast_v4(ire, mp, ipha, ira);
1821 		else
1822 			ip_input_multicast_v4(ire, mp, ipha, ira);
1823 		return;
1824 	}
1825 	ip_fanout_v4(mp, ipha, ira);
1826 }
1827 
1828 
1829 /*
1830  * Handle multiple zones which match the same broadcast address
1831  * and ill by delivering a packet to each of them.
1832  * Walk the bucket and look for different ire_zoneid but otherwise
1833  * the same IRE (same ill/addr/mask/type).
1834  * Note that ire_add() tracks IREs that are identical in all
1835  * fields (addr/mask/type/gw/ill/zoneid) within a single IRE by
1836  * increasing ire_identical_cnt. Thus we don't need to be concerned
1837  * about those.
1838  */
1839 static void
ip_input_broadcast_v4(ire_t * ire,mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira)1840 ip_input_broadcast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1841 {
1842 	ill_t		*ill = ira->ira_ill;
1843 	ip_stack_t	*ipst = ill->ill_ipst;
1844 	netstack_t	*ns = ipst->ips_netstack;
1845 	irb_t		*irb;
1846 	ire_t		*ire1;
1847 	mblk_t		*mp1;
1848 	ipha_t		*ipha1;
1849 	uint_t		ira_pktlen = ira->ira_pktlen;
1850 	uint16_t	ira_ip_hdr_length = ira->ira_ip_hdr_length;
1851 
1852 	irb = ire->ire_bucket;
1853 
1854 	/*
1855 	 * If we don't have more than one shared-IP zone, or if
1856 	 * there can't be more than one IRE_BROADCAST for this
1857 	 * IP address, then just set the zoneid and proceed.
1858 	 */
1859 	if (ns->netstack_numzones == 1 || irb->irb_ire_cnt == 1) {
1860 		ira->ira_zoneid = ire->ire_zoneid;
1861 
1862 		ip_fanout_v4(mp, ipha, ira);
1863 		return;
1864 	}
1865 	irb_refhold(irb);
1866 	for (ire1 = irb->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
1867 		/* We do the main IRE after the end of the loop */
1868 		if (ire1 == ire)
1869 			continue;
1870 
1871 		/*
1872 		 * Only IREs for the same IP address should be in the same
1873 		 * bucket.
1874 		 * But could have IRE_HOSTs in the case of CGTP.
1875 		 */
1876 		ASSERT(ire1->ire_addr == ire->ire_addr);
1877 		if (!(ire1->ire_type & IRE_BROADCAST))
1878 			continue;
1879 
1880 		if (IRE_IS_CONDEMNED(ire1))
1881 			continue;
1882 
1883 		mp1 = copymsg(mp);
1884 		if (mp1 == NULL) {
1885 			/* Failed to deliver to one zone */
1886 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1887 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
1888 			continue;
1889 		}
1890 		ira->ira_zoneid = ire1->ire_zoneid;
1891 		ipha1 = (ipha_t *)mp1->b_rptr;
1892 		ip_fanout_v4(mp1, ipha1, ira);
1893 		/*
1894 		 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1895 		 * so we restore them for a potential next iteration
1896 		 */
1897 		ira->ira_pktlen = ira_pktlen;
1898 		ira->ira_ip_hdr_length = ira_ip_hdr_length;
1899 	}
1900 	irb_refrele(irb);
1901 	/* Do the main ire */
1902 	ira->ira_zoneid = ire->ire_zoneid;
1903 	ip_fanout_v4(mp, ipha, ira);
1904 }
1905 
1906 /*
1907  * Handle multiple zones which want to receive the same multicast packets
1908  * on this ill by delivering a packet to each of them.
1909  *
1910  * Note that for packets delivered to transports we could instead do this
1911  * as part of the fanout code, but since we need to handle icmp_inbound
1912  * it is simpler to have multicast work the same as broadcast.
1913  *
1914  * The ip_fanout matching for multicast matches based on ilm independent of
1915  * zoneid since the zoneid restriction is applied when joining a multicast
1916  * group.
1917  */
1918 /* ARGSUSED */
1919 static void
ip_input_multicast_v4(ire_t * ire,mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira)1920 ip_input_multicast_v4(ire_t *ire, mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
1921 {
1922 	ill_t		*ill = ira->ira_ill;
1923 	iaflags_t	iraflags = ira->ira_flags;
1924 	ip_stack_t	*ipst = ill->ill_ipst;
1925 	netstack_t	*ns = ipst->ips_netstack;
1926 	zoneid_t	zoneid;
1927 	mblk_t		*mp1;
1928 	ipha_t		*ipha1;
1929 	uint_t		ira_pktlen = ira->ira_pktlen;
1930 	uint16_t	ira_ip_hdr_length = ira->ira_ip_hdr_length;
1931 
1932 	/* ire_recv_multicast has switched to the upper ill for IPMP */
1933 	ASSERT(!IS_UNDER_IPMP(ill));
1934 
1935 	/*
1936 	 * If we don't have more than one shared-IP zone, or if
1937 	 * there are no members in anything but the global zone,
1938 	 * then just set the zoneid and proceed.
1939 	 */
1940 	if (ns->netstack_numzones == 1 ||
1941 	    !ill_hasmembers_otherzones_v4(ill, ipha->ipha_dst,
1942 	    GLOBAL_ZONEID)) {
1943 		ira->ira_zoneid = GLOBAL_ZONEID;
1944 
1945 		/* If sender didn't want this zone to receive it, drop */
1946 		if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1947 		    ira->ira_no_loop_zoneid == ira->ira_zoneid) {
1948 			ip_drop_input("Multicast but wrong zoneid", mp, ill);
1949 			freemsg(mp);
1950 			return;
1951 		}
1952 		ip_fanout_v4(mp, ipha, ira);
1953 		return;
1954 	}
1955 
1956 	/*
1957 	 * Here we loop over all zoneids that have members in the group
1958 	 * and deliver a packet to ip_fanout for each zoneid.
1959 	 *
1960 	 * First find any members in the lowest numeric zoneid by looking for
1961 	 * first zoneid larger than -1 (ALL_ZONES).
1962 	 * We terminate the loop when we receive -1 (ALL_ZONES).
1963 	 */
1964 	zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, ALL_ZONES);
1965 	for (; zoneid != ALL_ZONES;
1966 	    zoneid = ill_hasmembers_nextzone_v4(ill, ipha->ipha_dst, zoneid)) {
1967 		/*
1968 		 * Avoid an extra copymsg/freemsg by skipping global zone here
1969 		 * and doing that at the end.
1970 		 */
1971 		if (zoneid == GLOBAL_ZONEID)
1972 			continue;
1973 
1974 		ira->ira_zoneid = zoneid;
1975 
1976 		/* If sender didn't want this zone to receive it, skip */
1977 		if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
1978 		    ira->ira_no_loop_zoneid == ira->ira_zoneid)
1979 			continue;
1980 
1981 		mp1 = copymsg(mp);
1982 		if (mp1 == NULL) {
1983 			/* Failed to deliver to one zone */
1984 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1985 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
1986 			continue;
1987 		}
1988 		ipha1 = (ipha_t *)mp1->b_rptr;
1989 		ip_fanout_v4(mp1, ipha1, ira);
1990 		/*
1991 		 * IPsec might have modified ira_pktlen and ira_ip_hdr_length
1992 		 * so we restore them for a potential next iteration
1993 		 */
1994 		ira->ira_pktlen = ira_pktlen;
1995 		ira->ira_ip_hdr_length = ira_ip_hdr_length;
1996 	}
1997 
1998 	/* Do the main ire */
1999 	ira->ira_zoneid = GLOBAL_ZONEID;
2000 	/* If sender didn't want this zone to receive it, drop */
2001 	if ((iraflags & IRAF_NO_LOOP_ZONEID_SET) &&
2002 	    ira->ira_no_loop_zoneid == ira->ira_zoneid) {
2003 		ip_drop_input("Multicast but wrong zoneid", mp, ill);
2004 		freemsg(mp);
2005 	} else {
2006 		ip_fanout_v4(mp, ipha, ira);
2007 	}
2008 }
2009 
2010 
2011 /*
2012  * Determine the zoneid and IRAF_TX_* flags if trusted extensions
2013  * is in use. Updates ira_zoneid and ira_flags as a result.
2014  */
2015 static void
ip_fanout_tx_v4(mblk_t * mp,ipha_t * ipha,uint8_t protocol,uint_t ip_hdr_length,ip_recv_attr_t * ira)2016 ip_fanout_tx_v4(mblk_t *mp, ipha_t *ipha, uint8_t protocol,
2017     uint_t ip_hdr_length, ip_recv_attr_t *ira)
2018 {
2019 	uint16_t	*up;
2020 	uint16_t	lport;
2021 	zoneid_t	zoneid;
2022 
2023 	ASSERT(ira->ira_flags & IRAF_SYSTEM_LABELED);
2024 
2025 	/*
2026 	 * If the packet is unlabeled we might allow read-down
2027 	 * for MAC_EXEMPT. Below we clear this if it is a multi-level
2028 	 * port (MLP).
2029 	 * Note that ira_tsl can be NULL here.
2030 	 */
2031 	if (ira->ira_tsl != NULL && ira->ira_tsl->tsl_flags & TSLF_UNLABELED)
2032 		ira->ira_flags |= IRAF_TX_MAC_EXEMPTABLE;
2033 
2034 	if (ira->ira_zoneid != ALL_ZONES)
2035 		return;
2036 
2037 	ira->ira_flags |= IRAF_TX_SHARED_ADDR;
2038 
2039 	up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2040 	switch (protocol) {
2041 	case IPPROTO_TCP:
2042 	case IPPROTO_SCTP:
2043 	case IPPROTO_UDP:
2044 		/* Caller ensures this */
2045 		ASSERT(((uchar_t *)ipha) + ip_hdr_length +4 <= mp->b_wptr);
2046 
2047 		/*
2048 		 * Only these transports support MLP.
2049 		 * We know their destination port numbers is in
2050 		 * the same place in the header.
2051 		 */
2052 		lport = up[1];
2053 
2054 		/*
2055 		 * No need to handle exclusive-stack zones
2056 		 * since ALL_ZONES only applies to the shared IP instance.
2057 		 */
2058 		zoneid = tsol_mlp_findzone(protocol, lport);
2059 		/*
2060 		 * If no shared MLP is found, tsol_mlp_findzone returns
2061 		 * ALL_ZONES.  In that case, we assume it's SLP, and
2062 		 * search for the zone based on the packet label.
2063 		 *
2064 		 * If there is such a zone, we prefer to find a
2065 		 * connection in it.  Otherwise, we look for a
2066 		 * MAC-exempt connection in any zone whose label
2067 		 * dominates the default label on the packet.
2068 		 */
2069 		if (zoneid == ALL_ZONES)
2070 			zoneid = tsol_attr_to_zoneid(ira);
2071 		else
2072 			ira->ira_flags &= ~IRAF_TX_MAC_EXEMPTABLE;
2073 		break;
2074 	default:
2075 		/* Handle shared address for other protocols */
2076 		zoneid = tsol_attr_to_zoneid(ira);
2077 		break;
2078 	}
2079 	ira->ira_zoneid = zoneid;
2080 }
2081 
2082 /*
2083  * Increment checksum failure statistics
2084  */
2085 static void
ip_input_cksum_err_v4(uint8_t protocol,uint16_t hck_flags,ill_t * ill)2086 ip_input_cksum_err_v4(uint8_t protocol, uint16_t hck_flags, ill_t *ill)
2087 {
2088 	ip_stack_t	*ipst = ill->ill_ipst;
2089 
2090 	switch (protocol) {
2091 	case IPPROTO_TCP:
2092 		BUMP_MIB(ill->ill_ip_mib, tcpIfStatsInErrs);
2093 
2094 		if (hck_flags & HCK_FULLCKSUM)
2095 			IP_STAT(ipst, ip_tcp_in_full_hw_cksum_err);
2096 		else if (hck_flags & HCK_PARTIALCKSUM)
2097 			IP_STAT(ipst, ip_tcp_in_part_hw_cksum_err);
2098 		else
2099 			IP_STAT(ipst, ip_tcp_in_sw_cksum_err);
2100 		break;
2101 	case IPPROTO_UDP:
2102 		BUMP_MIB(ill->ill_ip_mib, udpIfStatsInCksumErrs);
2103 		if (hck_flags & HCK_FULLCKSUM)
2104 			IP_STAT(ipst, ip_udp_in_full_hw_cksum_err);
2105 		else if (hck_flags & HCK_PARTIALCKSUM)
2106 			IP_STAT(ipst, ip_udp_in_part_hw_cksum_err);
2107 		else
2108 			IP_STAT(ipst, ip_udp_in_sw_cksum_err);
2109 		break;
2110 	case IPPROTO_ICMP:
2111 		BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2112 		break;
2113 	default:
2114 		ASSERT(0);
2115 		break;
2116 	}
2117 }
2118 
2119 /* Calculate the IPv4 pseudo-header checksum */
2120 uint32_t
ip_input_cksum_pseudo_v4(ipha_t * ipha,ip_recv_attr_t * ira)2121 ip_input_cksum_pseudo_v4(ipha_t *ipha, ip_recv_attr_t *ira)
2122 {
2123 	uint_t		ulp_len;
2124 	uint32_t	cksum;
2125 	uint8_t		protocol = ira->ira_protocol;
2126 	uint16_t	ip_hdr_length = ira->ira_ip_hdr_length;
2127 
2128 #define	iphs    ((uint16_t *)ipha)
2129 
2130 	switch (protocol) {
2131 	case IPPROTO_TCP:
2132 		ulp_len = ira->ira_pktlen - ip_hdr_length;
2133 
2134 		/* Protocol and length */
2135 		cksum = htons(ulp_len) + IP_TCP_CSUM_COMP;
2136 		/* IP addresses */
2137 		cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2138 		break;
2139 
2140 	case IPPROTO_UDP: {
2141 		udpha_t		*udpha;
2142 
2143 		udpha = (udpha_t  *)((uchar_t *)ipha + ip_hdr_length);
2144 
2145 		/* Protocol and length */
2146 		cksum = udpha->uha_length + IP_UDP_CSUM_COMP;
2147 		/* IP addresses */
2148 		cksum += iphs[6] + iphs[7] + iphs[8] + iphs[9];
2149 		break;
2150 	}
2151 
2152 	default:
2153 		cksum = 0;
2154 		break;
2155 	}
2156 #undef	iphs
2157 	return (cksum);
2158 }
2159 
2160 
2161 /*
2162  * Software verification of the ULP checksums.
2163  * Returns B_TRUE if ok.
2164  * Increments statistics of failed.
2165  */
2166 static boolean_t
ip_input_sw_cksum_v4(mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira)2167 ip_input_sw_cksum_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2168 {
2169 	ip_stack_t	*ipst = ira->ira_ill->ill_ipst;
2170 	uint32_t	cksum;
2171 	uint8_t		protocol = ira->ira_protocol;
2172 	uint16_t	ip_hdr_length = ira->ira_ip_hdr_length;
2173 
2174 	IP_STAT(ipst, ip_in_sw_cksum);
2175 
2176 	ASSERT(protocol == IPPROTO_TCP || protocol == IPPROTO_UDP);
2177 
2178 	cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2179 	cksum = IP_CSUM(mp, ip_hdr_length, cksum);
2180 	if (cksum == 0)
2181 		return (B_TRUE);
2182 
2183 	ip_input_cksum_err_v4(protocol, 0, ira->ira_ill);
2184 	return (B_FALSE);
2185 }
2186 
2187 /*
2188  * Verify the ULP checksums.
2189  * Returns B_TRUE if ok, or if the ULP doesn't have a well-defined checksum
2190  * algorithm.
2191  * Increments statistics if failed.
2192  */
2193 static boolean_t
ip_input_cksum_v4(iaflags_t iraflags,mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira)2194 ip_input_cksum_v4(iaflags_t iraflags, mblk_t *mp, ipha_t *ipha,
2195     ip_recv_attr_t *ira)
2196 {
2197 	ill_t		*ill = ira->ira_rill;
2198 	uint16_t	hck_flags;
2199 	uint32_t	cksum;
2200 	mblk_t		*mp1;
2201 	int32_t		len;
2202 	uint8_t		protocol = ira->ira_protocol;
2203 	uint16_t	ip_hdr_length = ira->ira_ip_hdr_length;
2204 
2205 
2206 	switch (protocol) {
2207 	case IPPROTO_TCP:
2208 		break;
2209 
2210 	case IPPROTO_UDP: {
2211 		udpha_t		*udpha;
2212 
2213 		udpha = (udpha_t  *)((uchar_t *)ipha + ip_hdr_length);
2214 		if (udpha->uha_checksum == 0) {
2215 			/* Packet doesn't have a UDP checksum */
2216 			return (B_TRUE);
2217 		}
2218 		break;
2219 	}
2220 	case IPPROTO_SCTP: {
2221 		sctp_hdr_t	*sctph;
2222 		uint32_t	pktsum;
2223 
2224 		sctph = (sctp_hdr_t *)((uchar_t *)ipha + ip_hdr_length);
2225 #ifdef	DEBUG
2226 		if (skip_sctp_cksum)
2227 			return (B_TRUE);
2228 #endif
2229 		pktsum = sctph->sh_chksum;
2230 		sctph->sh_chksum = 0;
2231 		cksum = sctp_cksum(mp, ip_hdr_length);
2232 		sctph->sh_chksum = pktsum;
2233 		if (cksum == pktsum)
2234 			return (B_TRUE);
2235 
2236 		/*
2237 		 * Defer until later whether a bad checksum is ok
2238 		 * in order to allow RAW sockets to use Adler checksum
2239 		 * with SCTP.
2240 		 */
2241 		ira->ira_flags |= IRAF_SCTP_CSUM_ERR;
2242 		return (B_TRUE);
2243 	}
2244 
2245 	default:
2246 		/* No ULP checksum to verify. */
2247 		return (B_TRUE);
2248 	}
2249 
2250 	/*
2251 	 * Revert to software checksum calculation if the interface
2252 	 * isn't capable of checksum offload.
2253 	 * We clear DB_CKSUMFLAGS when going through IPsec in ip_fanout.
2254 	 * Note: IRAF_NO_HW_CKSUM is not currently used.
2255 	 */
2256 	ASSERT(!IS_IPMP(ill));
2257 	if ((iraflags & IRAF_NO_HW_CKSUM) || !ILL_HCKSUM_CAPABLE(ill) ||
2258 	    !dohwcksum) {
2259 		return (ip_input_sw_cksum_v4(mp, ipha, ira));
2260 	}
2261 
2262 	hck_flags = DB_CKSUMFLAGS(mp);
2263 
2264 	/*
2265 	 * We apply this for all ULP protocols. Does the HW know to
2266 	 * not set the flags for SCTP and other protocols.
2267 	 */
2268 	if (hck_flags & HCK_FULLCKSUM_OK) {
2269 		/*
2270 		 * Hardware has already verified the checksum.
2271 		 */
2272 		return (B_TRUE);
2273 	}
2274 
2275 	if (hck_flags & HCK_FULLCKSUM) {
2276 		/*
2277 		 * Full checksum has been computed by the hardware
2278 		 * and has been attached.  If the driver wants us to
2279 		 * verify the correctness of the attached value, in
2280 		 * order to protect against faulty hardware, compare
2281 		 * it against -0 (0xFFFF) to see if it's valid.
2282 		 */
2283 		cksum = DB_CKSUM16(mp);
2284 		if (cksum == 0xFFFF)
2285 			return (B_TRUE);
2286 		ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2287 		return (B_FALSE);
2288 	}
2289 
2290 	mp1 = mp->b_cont;
2291 	if ((hck_flags & HCK_PARTIALCKSUM) &&
2292 	    (mp1 == NULL || mp1->b_cont == NULL) &&
2293 	    ip_hdr_length >= DB_CKSUMSTART(mp) &&
2294 	    ((len = ip_hdr_length - DB_CKSUMSTART(mp)) & 1) == 0) {
2295 		uint32_t	adj;
2296 		uchar_t		*cksum_start;
2297 
2298 		cksum = ip_input_cksum_pseudo_v4(ipha, ira);
2299 
2300 		cksum_start = ((uchar_t *)ipha + DB_CKSUMSTART(mp));
2301 
2302 		/*
2303 		 * Partial checksum has been calculated by hardware
2304 		 * and attached to the packet; in addition, any
2305 		 * prepended extraneous data is even byte aligned,
2306 		 * and there are at most two mblks associated with
2307 		 * the packet.  If any such data exists, we adjust
2308 		 * the checksum; also take care any postpended data.
2309 		 */
2310 		IP_ADJCKSUM_PARTIAL(cksum_start, mp, mp1, len, adj);
2311 		/*
2312 		 * One's complement subtract extraneous checksum
2313 		 */
2314 		cksum += DB_CKSUM16(mp);
2315 		if (adj >= cksum)
2316 			cksum = ~(adj - cksum) & 0xFFFF;
2317 		else
2318 			cksum -= adj;
2319 		cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2320 		cksum = (cksum & 0xFFFF) + ((int)cksum >> 16);
2321 		if (!(~cksum & 0xFFFF))
2322 			return (B_TRUE);
2323 
2324 		ip_input_cksum_err_v4(protocol, hck_flags, ira->ira_ill);
2325 		return (B_FALSE);
2326 	}
2327 	return (ip_input_sw_cksum_v4(mp, ipha, ira));
2328 }
2329 
2330 
2331 /*
2332  * Handle fanout of received packets.
2333  * Unicast packets that are looped back (from ire_send_local_v4) and packets
2334  * from the wire are differentiated by checking IRAF_VERIFY_ULP_CKSUM.
2335  *
2336  * IPQoS Notes
2337  * Before sending it to the client, invoke IPPF processing. Policy processing
2338  * takes place only if the callout_position, IPP_LOCAL_IN, is enabled.
2339  */
2340 void
ip_fanout_v4(mblk_t * mp,ipha_t * ipha,ip_recv_attr_t * ira)2341 ip_fanout_v4(mblk_t *mp, ipha_t *ipha, ip_recv_attr_t *ira)
2342 {
2343 	ill_t		*ill = ira->ira_ill;
2344 	iaflags_t	iraflags = ira->ira_flags;
2345 	ip_stack_t	*ipst = ill->ill_ipst;
2346 	uint8_t		protocol = ipha->ipha_protocol;
2347 	conn_t		*connp;
2348 #define	rptr	((uchar_t *)ipha)
2349 	uint_t		ip_hdr_length;
2350 	uint_t		min_ulp_header_length;
2351 	int		offset;
2352 	ssize_t		len;
2353 	netstack_t	*ns = ipst->ips_netstack;
2354 	ipsec_stack_t	*ipss = ns->netstack_ipsec;
2355 	ill_t		*rill = ira->ira_rill;
2356 
2357 	ASSERT(ira->ira_pktlen == ntohs(ipha->ipha_length));
2358 
2359 	ip_hdr_length = ira->ira_ip_hdr_length;
2360 	ira->ira_protocol = protocol;
2361 
2362 	/*
2363 	 * Time for IPP once we've done reassembly and IPsec.
2364 	 * We skip this for loopback packets since we don't do IPQoS
2365 	 * on loopback.
2366 	 */
2367 	if (IPP_ENABLED(IPP_LOCAL_IN, ipst) &&
2368 	    !(iraflags & IRAF_LOOPBACK) &&
2369 	    (protocol != IPPROTO_ESP && protocol != IPPROTO_AH)) {
2370 		/*
2371 		 * Use the interface on which the packet arrived - not where
2372 		 * the IP address is hosted.
2373 		 */
2374 		/* ip_process translates an IS_UNDER_IPMP */
2375 		mp = ip_process(IPP_LOCAL_IN, mp, rill, ill);
2376 		if (mp == NULL) {
2377 			/* ip_drop_packet and MIB done */
2378 			return;
2379 		}
2380 	}
2381 
2382 	/* Determine the minimum required size of the upper-layer header */
2383 	/* Need to do this for at least the set of ULPs that TX handles. */
2384 	switch (protocol) {
2385 	case IPPROTO_TCP:
2386 		min_ulp_header_length = TCP_MIN_HEADER_LENGTH;
2387 		break;
2388 	case IPPROTO_SCTP:
2389 		min_ulp_header_length = SCTP_COMMON_HDR_LENGTH;
2390 		break;
2391 	case IPPROTO_UDP:
2392 		min_ulp_header_length = UDPH_SIZE;
2393 		break;
2394 	case IPPROTO_ICMP:
2395 		min_ulp_header_length = ICMPH_SIZE;
2396 		break;
2397 	default:
2398 		min_ulp_header_length = 0;
2399 		break;
2400 	}
2401 	/* Make sure we have the min ULP header length */
2402 	len = mp->b_wptr - rptr;
2403 	if (len < ip_hdr_length + min_ulp_header_length) {
2404 		if (ira->ira_pktlen < ip_hdr_length + min_ulp_header_length) {
2405 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInTruncatedPkts);
2406 			ip_drop_input("ipIfStatsInTruncatedPkts", mp, ill);
2407 			freemsg(mp);
2408 			return;
2409 		}
2410 		IP_STAT(ipst, ip_recv_pullup);
2411 		ipha = ip_pullup(mp, ip_hdr_length + min_ulp_header_length,
2412 		    ira);
2413 		if (ipha == NULL)
2414 			goto discard;
2415 		len = mp->b_wptr - rptr;
2416 	}
2417 
2418 	/*
2419 	 * If trusted extensions then determine the zoneid and TX specific
2420 	 * ira_flags.
2421 	 */
2422 	if (iraflags & IRAF_SYSTEM_LABELED) {
2423 		/* This can update ira->ira_flags and ira->ira_zoneid */
2424 		ip_fanout_tx_v4(mp, ipha, protocol, ip_hdr_length, ira);
2425 		iraflags = ira->ira_flags;
2426 	}
2427 
2428 
2429 	/* Verify ULP checksum. Handles TCP, UDP, and SCTP */
2430 	if (iraflags & IRAF_VERIFY_ULP_CKSUM) {
2431 		if (!ip_input_cksum_v4(iraflags, mp, ipha, ira)) {
2432 			/* Bad checksum. Stats are already incremented */
2433 			ip_drop_input("Bad ULP checksum", mp, ill);
2434 			freemsg(mp);
2435 			return;
2436 		}
2437 		/* IRAF_SCTP_CSUM_ERR could have been set */
2438 		iraflags = ira->ira_flags;
2439 	}
2440 	switch (protocol) {
2441 	case IPPROTO_TCP:
2442 		/* For TCP, discard broadcast and multicast packets. */
2443 		if (iraflags & IRAF_MULTIBROADCAST)
2444 			goto discard;
2445 
2446 		/* First mblk contains IP+TCP headers per above check */
2447 		ASSERT(len >= ip_hdr_length + TCP_MIN_HEADER_LENGTH);
2448 
2449 		/* TCP options present? */
2450 		offset = ((uchar_t *)ipha)[ip_hdr_length + 12] >> 4;
2451 		if (offset != 5) {
2452 			if (offset < 5)
2453 				goto discard;
2454 
2455 			/*
2456 			 * There must be TCP options.
2457 			 * Make sure we can grab them.
2458 			 */
2459 			offset <<= 2;
2460 			offset += ip_hdr_length;
2461 			if (len < offset) {
2462 				if (ira->ira_pktlen < offset) {
2463 					BUMP_MIB(ill->ill_ip_mib,
2464 					    ipIfStatsInTruncatedPkts);
2465 					ip_drop_input(
2466 					    "ipIfStatsInTruncatedPkts",
2467 					    mp, ill);
2468 					freemsg(mp);
2469 					return;
2470 				}
2471 				IP_STAT(ipst, ip_recv_pullup);
2472 				ipha = ip_pullup(mp, offset, ira);
2473 				if (ipha == NULL)
2474 					goto discard;
2475 				len = mp->b_wptr - rptr;
2476 			}
2477 		}
2478 
2479 		/*
2480 		 * Pass up a squeue hint to tcp.
2481 		 * If ira_sqp is already set (this is loopback) we leave it
2482 		 * alone.
2483 		 */
2484 		if (ira->ira_sqp == NULL) {
2485 			ira->ira_sqp = ip_squeue_get(ira->ira_ring);
2486 		}
2487 
2488 		/* Look for AF_INET or AF_INET6 that matches */
2489 		connp = ipcl_classify_v4(mp, IPPROTO_TCP, ip_hdr_length,
2490 		    ira, ipst);
2491 		if (connp == NULL) {
2492 			/* Send the TH_RST */
2493 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2494 			tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2495 			return;
2496 		}
2497 		if (connp->conn_incoming_ifindex != 0 &&
2498 		    connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2499 			CONN_DEC_REF(connp);
2500 
2501 			/* Send the TH_RST */
2502 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2503 			tcp_xmit_listeners_reset(mp, ira, ipst, NULL);
2504 			return;
2505 		}
2506 		if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2507 		    (iraflags & IRAF_IPSEC_SECURE)) {
2508 			mp = ipsec_check_inbound_policy(mp, connp,
2509 			    ipha, NULL, ira);
2510 			if (mp == NULL) {
2511 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2512 				/* Note that mp is NULL */
2513 				ip_drop_input("ipIfStatsInDiscards", mp, ill);
2514 				CONN_DEC_REF(connp);
2515 				return;
2516 			}
2517 		}
2518 		/* Found a client; up it goes */
2519 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2520 		ira->ira_ill = ira->ira_rill = NULL;
2521 		if (!IPCL_IS_TCP(connp)) {
2522 			/* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
2523 			(connp->conn_recv)(connp, mp, NULL, ira);
2524 			CONN_DEC_REF(connp);
2525 			ira->ira_ill = ill;
2526 			ira->ira_rill = rill;
2527 			return;
2528 		}
2529 
2530 		/*
2531 		 * We do different processing whether called from
2532 		 * ip_accept_tcp and we match the target, don't match
2533 		 * the target, and when we are called by ip_input.
2534 		 */
2535 		if (iraflags & IRAF_TARGET_SQP) {
2536 			if (ira->ira_target_sqp == connp->conn_sqp) {
2537 				mblk_t	*attrmp;
2538 
2539 				attrmp = ip_recv_attr_to_mblk(ira);
2540 				if (attrmp == NULL) {
2541 					BUMP_MIB(ill->ill_ip_mib,
2542 					    ipIfStatsInDiscards);
2543 					ip_drop_input("ipIfStatsInDiscards",
2544 					    mp, ill);
2545 					freemsg(mp);
2546 					CONN_DEC_REF(connp);
2547 				} else {
2548 					SET_SQUEUE(attrmp, connp->conn_recv,
2549 					    connp);
2550 					attrmp->b_cont = mp;
2551 					ASSERT(ira->ira_target_sqp_mp == NULL);
2552 					ira->ira_target_sqp_mp = attrmp;
2553 					/*
2554 					 * Conn ref release when drained from
2555 					 * the squeue.
2556 					 */
2557 				}
2558 			} else {
2559 				SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2560 				    connp->conn_recv, connp, ira, SQ_FILL,
2561 				    SQTAG_IP_TCP_INPUT);
2562 			}
2563 		} else {
2564 			SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv,
2565 			    connp, ira, ip_squeue_flag, SQTAG_IP_TCP_INPUT);
2566 		}
2567 		ira->ira_ill = ill;
2568 		ira->ira_rill = rill;
2569 		return;
2570 
2571 	case IPPROTO_SCTP: {
2572 		sctp_hdr_t	*sctph;
2573 		in6_addr_t	map_src, map_dst;
2574 		uint32_t	ports;	/* Source and destination ports */
2575 		sctp_stack_t	*sctps = ipst->ips_netstack->netstack_sctp;
2576 
2577 		/* For SCTP, discard broadcast and multicast packets. */
2578 		if (iraflags & IRAF_MULTIBROADCAST)
2579 			goto discard;
2580 
2581 		/*
2582 		 * Since there is no SCTP h/w cksum support yet, just
2583 		 * clear the flag.
2584 		 */
2585 		DB_CKSUMFLAGS(mp) = 0;
2586 
2587 		/* Length ensured above */
2588 		ASSERT(MBLKL(mp) >= ip_hdr_length + SCTP_COMMON_HDR_LENGTH);
2589 		sctph = (sctp_hdr_t *)(rptr + ip_hdr_length);
2590 
2591 		/* get the ports */
2592 		ports = *(uint32_t *)&sctph->sh_sport;
2593 
2594 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &map_dst);
2595 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &map_src);
2596 		if (iraflags & IRAF_SCTP_CSUM_ERR) {
2597 			/*
2598 			 * No potential sctp checksum errors go to the Sun
2599 			 * sctp stack however they might be Adler-32 summed
2600 			 * packets a userland stack bound to a raw IP socket
2601 			 * could reasonably use. Note though that Adler-32 is
2602 			 * a long deprecated algorithm and customer sctp
2603 			 * networks should eventually migrate to CRC-32 at
2604 			 * which time this facility should be removed.
2605 			 */
2606 			ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2607 			return;
2608 		}
2609 		connp = sctp_fanout(&map_src, &map_dst, ports, ira, mp,
2610 		    sctps, sctph);
2611 		if (connp == NULL) {
2612 			/* Check for raw socket or OOTB handling */
2613 			ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2614 			return;
2615 		}
2616 		if (connp->conn_incoming_ifindex != 0 &&
2617 		    connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2618 			CONN_DEC_REF(connp);
2619 			/* Check for raw socket or OOTB handling */
2620 			ip_fanout_sctp_raw(mp, ipha, NULL, ports, ira);
2621 			return;
2622 		}
2623 
2624 		/* Found a client; up it goes */
2625 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2626 		sctp_input(connp, ipha, NULL, mp, ira);
2627 		/* sctp_input does a rele of the sctp_t */
2628 		return;
2629 	}
2630 
2631 	case IPPROTO_UDP:
2632 		/* First mblk contains IP+UDP headers as checked above */
2633 		ASSERT(MBLKL(mp) >= ip_hdr_length + UDPH_SIZE);
2634 
2635 		if (iraflags & IRAF_MULTIBROADCAST) {
2636 			uint16_t *up;	/* Pointer to ports in ULP header */
2637 
2638 			up = (uint16_t *)((uchar_t *)ipha + ip_hdr_length);
2639 			ip_fanout_udp_multi_v4(mp, ipha, up[1], up[0], ira);
2640 			return;
2641 		}
2642 
2643 		/* Look for AF_INET or AF_INET6 that matches */
2644 		connp = ipcl_classify_v4(mp, IPPROTO_UDP, ip_hdr_length,
2645 		    ira, ipst);
2646 		if (connp == NULL) {
2647 	no_udp_match:
2648 			if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_UDP].
2649 			    connf_head != NULL) {
2650 				ASSERT(ira->ira_protocol == IPPROTO_UDP);
2651 				ip_fanout_proto_v4(mp, ipha, ira);
2652 			} else {
2653 				ip_fanout_send_icmp_v4(mp,
2654 				    ICMP_DEST_UNREACHABLE,
2655 				    ICMP_PORT_UNREACHABLE, ira);
2656 			}
2657 			return;
2658 
2659 		}
2660 		if (connp->conn_incoming_ifindex != 0 &&
2661 		    connp->conn_incoming_ifindex != ira->ira_ruifindex) {
2662 			CONN_DEC_REF(connp);
2663 			goto no_udp_match;
2664 		}
2665 		if (IPCL_IS_NONSTR(connp) ? connp->conn_flow_cntrld :
2666 		    !canputnext(connp->conn_rq)) {
2667 			CONN_DEC_REF(connp);
2668 			BUMP_MIB(ill->ill_ip_mib, udpIfStatsInOverflows);
2669 			ip_drop_input("udpIfStatsInOverflows", mp, ill);
2670 			freemsg(mp);
2671 			return;
2672 		}
2673 		if (CONN_INBOUND_POLICY_PRESENT(connp, ipss) ||
2674 		    (iraflags & IRAF_IPSEC_SECURE)) {
2675 			mp = ipsec_check_inbound_policy(mp, connp,
2676 			    ipha, NULL, ira);
2677 			if (mp == NULL) {
2678 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2679 				/* Note that mp is NULL */
2680 				ip_drop_input("ipIfStatsInDiscards", mp, ill);
2681 				CONN_DEC_REF(connp);
2682 				return;
2683 			}
2684 		}
2685 		/*
2686 		 * Remove 0-spi if it's 0, or move everything behind
2687 		 * the UDP header over it and forward to ESP via
2688 		 * ip_fanout_v4().
2689 		 */
2690 		if (connp->conn_udp->udp_nat_t_endpoint) {
2691 			if (iraflags & IRAF_IPSEC_SECURE) {
2692 				ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2693 				    DROPPER(ipss, ipds_esp_nat_t_ipsec),
2694 				    &ipss->ipsec_dropper);
2695 				CONN_DEC_REF(connp);
2696 				return;
2697 			}
2698 
2699 			mp = zero_spi_check(mp, ira);
2700 			if (mp == NULL) {
2701 				/*
2702 				 * Packet was consumed - probably sent to
2703 				 * ip_fanout_v4.
2704 				 */
2705 				CONN_DEC_REF(connp);
2706 				return;
2707 			}
2708 			/* Else continue like a normal UDP packet. */
2709 			ipha = (ipha_t *)mp->b_rptr;
2710 			protocol = ipha->ipha_protocol;
2711 			ira->ira_protocol = protocol;
2712 		}
2713 		/* Found a client; up it goes */
2714 		IP_STAT(ipst, ip_udp_fannorm);
2715 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2716 		ira->ira_ill = ira->ira_rill = NULL;
2717 		(connp->conn_recv)(connp, mp, NULL, ira);
2718 		CONN_DEC_REF(connp);
2719 		ira->ira_ill = ill;
2720 		ira->ira_rill = rill;
2721 		return;
2722 	default:
2723 		break;
2724 	}
2725 
2726 	/*
2727 	 * Clear hardware checksumming flag as it is currently only
2728 	 * used by TCP and UDP.
2729 	 */
2730 	DB_CKSUMFLAGS(mp) = 0;
2731 
2732 	switch (protocol) {
2733 	case IPPROTO_ICMP:
2734 		/*
2735 		 * We need to accomodate icmp messages coming in clear
2736 		 * until we get everything secure from the wire. If
2737 		 * icmp_accept_clear_messages is zero we check with
2738 		 * the global policy and act accordingly. If it is
2739 		 * non-zero, we accept the message without any checks.
2740 		 * But *this does not mean* that this will be delivered
2741 		 * to RAW socket clients. By accepting we might send
2742 		 * replies back, change our MTU value etc.,
2743 		 * but delivery to the ULP/clients depends on their
2744 		 * policy dispositions.
2745 		 */
2746 		if (ipst->ips_icmp_accept_clear_messages == 0) {
2747 			mp = ipsec_check_global_policy(mp, NULL,
2748 			    ipha, NULL, ira, ns);
2749 			if (mp == NULL)
2750 				return;
2751 		}
2752 
2753 		/*
2754 		 * On a labeled system, we have to check whether the zone
2755 		 * itself is permitted to receive raw traffic.
2756 		 */
2757 		if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
2758 			if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
2759 				BUMP_MIB(&ipst->ips_icmp_mib, icmpInErrors);
2760 				ip_drop_input("tsol_can_accept_raw", mp, ill);
2761 				freemsg(mp);
2762 				return;
2763 			}
2764 		}
2765 
2766 		/*
2767 		 * ICMP header checksum, including checksum field,
2768 		 * should be zero.
2769 		 */
2770 		if (IP_CSUM(mp, ip_hdr_length, 0)) {
2771 			BUMP_MIB(&ipst->ips_icmp_mib, icmpInCksumErrs);
2772 			ip_drop_input("icmpInCksumErrs", mp, ill);
2773 			freemsg(mp);
2774 			return;
2775 		}
2776 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2777 		mp = icmp_inbound_v4(mp, ira);
2778 		if (mp == NULL) {
2779 			/* No need to pass to RAW sockets */
2780 			return;
2781 		}
2782 		break;
2783 
2784 	case IPPROTO_IGMP:
2785 		/*
2786 		 * If we are not willing to accept IGMP packets in clear,
2787 		 * then check with global policy.
2788 		 */
2789 		if (ipst->ips_igmp_accept_clear_messages == 0) {
2790 			mp = ipsec_check_global_policy(mp, NULL,
2791 			    ipha, NULL, ira, ns);
2792 			if (mp == NULL)
2793 				return;
2794 		}
2795 		if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2796 		    !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2797 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2798 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
2799 			freemsg(mp);
2800 			return;
2801 		}
2802 		/*
2803 		 * Validate checksum
2804 		 */
2805 		if (IP_CSUM(mp, ip_hdr_length, 0)) {
2806 			++ipst->ips_igmpstat.igps_rcv_badsum;
2807 			ip_drop_input("igps_rcv_badsum", mp, ill);
2808 			freemsg(mp);
2809 			return;
2810 		}
2811 
2812 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2813 		mp = igmp_input(mp, ira);
2814 		if (mp == NULL) {
2815 			/* Bad packet - discarded by igmp_input */
2816 			return;
2817 		}
2818 		break;
2819 	case IPPROTO_PIM:
2820 		/*
2821 		 * If we are not willing to accept PIM packets in clear,
2822 		 * then check with global policy.
2823 		 */
2824 		if (ipst->ips_pim_accept_clear_messages == 0) {
2825 			mp = ipsec_check_global_policy(mp, NULL,
2826 			    ipha, NULL, ira, ns);
2827 			if (mp == NULL)
2828 				return;
2829 		}
2830 		if ((ira->ira_flags & IRAF_SYSTEM_LABELED) &&
2831 		    !tsol_can_accept_raw(mp, ira, B_TRUE)) {
2832 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2833 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
2834 			freemsg(mp);
2835 			return;
2836 		}
2837 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2838 
2839 		/* Checksum is verified in pim_input */
2840 		mp = pim_input(mp, ira);
2841 		if (mp == NULL) {
2842 			/* Bad packet - discarded by pim_input */
2843 			return;
2844 		}
2845 		break;
2846 	case IPPROTO_AH:
2847 	case IPPROTO_ESP: {
2848 		/*
2849 		 * Fast path for AH/ESP.
2850 		 */
2851 		netstack_t *ns = ipst->ips_netstack;
2852 		ipsec_stack_t *ipss = ns->netstack_ipsec;
2853 
2854 		IP_STAT(ipst, ipsec_proto_ahesp);
2855 
2856 		if (!ipsec_loaded(ipss)) {
2857 			ip_proto_not_sup(mp, ira);
2858 			return;
2859 		}
2860 
2861 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
2862 		/* select inbound SA and have IPsec process the pkt */
2863 		if (protocol == IPPROTO_ESP) {
2864 			esph_t *esph;
2865 			boolean_t esp_in_udp_sa;
2866 			boolean_t esp_in_udp_packet;
2867 
2868 			mp = ipsec_inbound_esp_sa(mp, ira, &esph);
2869 			if (mp == NULL)
2870 				return;
2871 
2872 			ASSERT(esph != NULL);
2873 			ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2874 			ASSERT(ira->ira_ipsec_esp_sa != NULL);
2875 			ASSERT(ira->ira_ipsec_esp_sa->ipsa_input_func != NULL);
2876 
2877 			esp_in_udp_sa = ((ira->ira_ipsec_esp_sa->ipsa_flags &
2878 			    IPSA_F_NATT) != 0);
2879 			esp_in_udp_packet =
2880 			    (ira->ira_flags & IRAF_ESP_UDP_PORTS) != 0;
2881 
2882 			/*
2883 			 * The following is a fancy, but quick, way of saying:
2884 			 * ESP-in-UDP SA and Raw ESP packet --> drop
2885 			 *    OR
2886 			 * ESP SA and ESP-in-UDP packet --> drop
2887 			 */
2888 			if (esp_in_udp_sa != esp_in_udp_packet) {
2889 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2890 				ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2891 				    DROPPER(ipss, ipds_esp_no_sa),
2892 				    &ipss->ipsec_dropper);
2893 				return;
2894 			}
2895 			mp = ira->ira_ipsec_esp_sa->ipsa_input_func(mp, esph,
2896 			    ira);
2897 		} else {
2898 			ah_t *ah;
2899 
2900 			mp = ipsec_inbound_ah_sa(mp, ira, &ah);
2901 			if (mp == NULL)
2902 				return;
2903 
2904 			ASSERT(ah != NULL);
2905 			ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
2906 			ASSERT(ira->ira_ipsec_ah_sa != NULL);
2907 			ASSERT(ira->ira_ipsec_ah_sa->ipsa_input_func != NULL);
2908 			mp = ira->ira_ipsec_ah_sa->ipsa_input_func(mp, ah,
2909 			    ira);
2910 		}
2911 
2912 		if (mp == NULL) {
2913 			/*
2914 			 * Either it failed or is pending. In the former case
2915 			 * ipIfStatsInDiscards was increased.
2916 			 */
2917 			return;
2918 		}
2919 		/* we're done with IPsec processing, send it up */
2920 		ip_input_post_ipsec(mp, ira);
2921 		return;
2922 	}
2923 	case IPPROTO_ENCAP: {
2924 		ipha_t		*inner_ipha;
2925 
2926 		/*
2927 		 * Handle self-encapsulated packets (IP-in-IP where
2928 		 * the inner addresses == the outer addresses).
2929 		 */
2930 		if ((uchar_t *)ipha + ip_hdr_length + sizeof (ipha_t) >
2931 		    mp->b_wptr) {
2932 			if (ira->ira_pktlen <
2933 			    ip_hdr_length + sizeof (ipha_t)) {
2934 				BUMP_MIB(ill->ill_ip_mib,
2935 				    ipIfStatsInTruncatedPkts);
2936 				ip_drop_input("ipIfStatsInTruncatedPkts",
2937 				    mp, ill);
2938 				freemsg(mp);
2939 				return;
2940 			}
2941 			ipha = ip_pullup(mp, (uchar_t *)ipha + ip_hdr_length +
2942 			    sizeof (ipha_t) - mp->b_rptr, ira);
2943 			if (ipha == NULL) {
2944 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2945 				ip_drop_input("ipIfStatsInDiscards", mp, ill);
2946 				freemsg(mp);
2947 				return;
2948 			}
2949 		}
2950 		inner_ipha = (ipha_t *)((uchar_t *)ipha + ip_hdr_length);
2951 		/*
2952 		 * Check the sanity of the inner IP header.
2953 		 */
2954 		if ((IPH_HDR_VERSION(inner_ipha) != IPV4_VERSION)) {
2955 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2956 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
2957 			freemsg(mp);
2958 			return;
2959 		}
2960 		if (IPH_HDR_LENGTH(inner_ipha) < sizeof (ipha_t)) {
2961 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2962 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
2963 			freemsg(mp);
2964 			return;
2965 		}
2966 		if (inner_ipha->ipha_src != ipha->ipha_src ||
2967 		    inner_ipha->ipha_dst != ipha->ipha_dst) {
2968 			/* We fallthru to iptun fanout below */
2969 			goto iptun;
2970 		}
2971 
2972 		/*
2973 		 * Self-encapsulated tunnel packet. Remove
2974 		 * the outer IP header and fanout again.
2975 		 * We also need to make sure that the inner
2976 		 * header is pulled up until options.
2977 		 */
2978 		mp->b_rptr = (uchar_t *)inner_ipha;
2979 		ipha = inner_ipha;
2980 		ip_hdr_length = IPH_HDR_LENGTH(ipha);
2981 		if ((uchar_t *)ipha + ip_hdr_length > mp->b_wptr) {
2982 			if (ira->ira_pktlen <
2983 			    (uchar_t *)ipha + ip_hdr_length - mp->b_rptr) {
2984 				BUMP_MIB(ill->ill_ip_mib,
2985 				    ipIfStatsInTruncatedPkts);
2986 				ip_drop_input("ipIfStatsInTruncatedPkts",
2987 				    mp, ill);
2988 				freemsg(mp);
2989 				return;
2990 			}
2991 			ipha = ip_pullup(mp,
2992 			    (uchar_t *)ipha + ip_hdr_length - mp->b_rptr, ira);
2993 			if (ipha == NULL) {
2994 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2995 				ip_drop_input("ipIfStatsInDiscards", mp, ill);
2996 				freemsg(mp);
2997 				return;
2998 			}
2999 		}
3000 		if (ip_hdr_length > sizeof (ipha_t)) {
3001 			/* We got options on the inner packet. */
3002 			ipaddr_t	dst = ipha->ipha_dst;
3003 			int		error = 0;
3004 
3005 			dst = ip_input_options(ipha, dst, mp, ira, &error);
3006 			if (error != 0) {
3007 				/*
3008 				 * An ICMP error has been sent and the packet
3009 				 * has been dropped.
3010 				 */
3011 				return;
3012 			}
3013 			if (dst != ipha->ipha_dst) {
3014 				/*
3015 				 * Someone put a source-route in
3016 				 * the inside header of a self-
3017 				 * encapsulated packet.  Drop it
3018 				 * with extreme prejudice and let
3019 				 * the sender know.
3020 				 */
3021 				ip_drop_input("ICMP_SOURCE_ROUTE_FAILED",
3022 				    mp, ill);
3023 				icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED,
3024 				    ira);
3025 				return;
3026 			}
3027 		}
3028 		if (!(ira->ira_flags & IRAF_IPSEC_SECURE)) {
3029 			/*
3030 			 * This means that somebody is sending
3031 			 * Self-encapsualted packets without AH/ESP.
3032 			 *
3033 			 * Send this packet to find a tunnel endpoint.
3034 			 * if I can't find one, an ICMP
3035 			 * PROTOCOL_UNREACHABLE will get sent.
3036 			 */
3037 			protocol = ipha->ipha_protocol;
3038 			ira->ira_protocol = protocol;
3039 			goto iptun;
3040 		}
3041 
3042 		/* Update based on removed IP header */
3043 		ira->ira_ip_hdr_length = ip_hdr_length;
3044 		ira->ira_pktlen = ntohs(ipha->ipha_length);
3045 
3046 		if (ira->ira_flags & IRAF_IPSEC_DECAPS) {
3047 			/*
3048 			 * This packet is self-encapsulated multiple
3049 			 * times. We don't want to recurse infinitely.
3050 			 * To keep it simple, drop the packet.
3051 			 */
3052 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3053 			ip_drop_input("ipIfStatsInDiscards", mp, ill);
3054 			freemsg(mp);
3055 			return;
3056 		}
3057 		ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
3058 		ira->ira_flags |= IRAF_IPSEC_DECAPS;
3059 
3060 		ip_input_post_ipsec(mp, ira);
3061 		return;
3062 	}
3063 
3064 	iptun:	/* IPPROTO_ENCAPS that is not self-encapsulated */
3065 	case IPPROTO_IPV6:
3066 		/* iptun will verify trusted label */
3067 		connp = ipcl_classify_v4(mp, protocol, ip_hdr_length,
3068 		    ira, ipst);
3069 		if (connp != NULL) {
3070 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInDelivers);
3071 			ira->ira_ill = ira->ira_rill = NULL;
3072 			(connp->conn_recv)(connp, mp, NULL, ira);
3073 			CONN_DEC_REF(connp);
3074 			ira->ira_ill = ill;
3075 			ira->ira_rill = rill;
3076 			return;
3077 		}
3078 		/* FALLTHRU */
3079 	default:
3080 		/*
3081 		 * On a labeled system, we have to check whether the zone
3082 		 * itself is permitted to receive raw traffic.
3083 		 */
3084 		if (ira->ira_flags & IRAF_SYSTEM_LABELED) {
3085 			if (!tsol_can_accept_raw(mp, ira, B_FALSE)) {
3086 				BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3087 				ip_drop_input("ipIfStatsInDiscards", mp, ill);
3088 				freemsg(mp);
3089 				return;
3090 			}
3091 		}
3092 		break;
3093 	}
3094 
3095 	/*
3096 	 * The above input functions may have returned the pulled up message.
3097 	 * So ipha need to be reinitialized.
3098 	 */
3099 	ipha = (ipha_t *)mp->b_rptr;
3100 	ira->ira_protocol = protocol = ipha->ipha_protocol;
3101 	if (ipst->ips_ipcl_proto_fanout_v4[protocol].connf_head == NULL) {
3102 		/*
3103 		 * No user-level listener for these packets packets.
3104 		 * Check for IPPROTO_ENCAP...
3105 		 */
3106 		if (protocol == IPPROTO_ENCAP && ipst->ips_ip_g_mrouter) {
3107 			/*
3108 			 * Check policy here,
3109 			 * THEN ship off to ip_mroute_decap().
3110 			 *
3111 			 * BTW,  If I match a configured IP-in-IP
3112 			 * tunnel above, this path will not be reached, and
3113 			 * ip_mroute_decap will never be called.
3114 			 */
3115 			mp = ipsec_check_global_policy(mp, connp,
3116 			    ipha, NULL, ira, ns);
3117 			if (mp != NULL) {
3118 				ip_mroute_decap(mp, ira);
3119 			} /* Else we already freed everything! */
3120 		} else {
3121 			ip_proto_not_sup(mp, ira);
3122 		}
3123 		return;
3124 	}
3125 
3126 	/*
3127 	 * Handle fanout to raw sockets.  There
3128 	 * can be more than one stream bound to a particular
3129 	 * protocol.  When this is the case, each one gets a copy
3130 	 * of any incoming packets.
3131 	 */
3132 	ASSERT(ira->ira_protocol == ipha->ipha_protocol);
3133 	ip_fanout_proto_v4(mp, ipha, ira);
3134 	return;
3135 
3136 discard:
3137 	BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
3138 	ip_drop_input("ipIfStatsInDiscards", mp, ill);
3139 	freemsg(mp);
3140 #undef rptr
3141 }
3142