1bd670b35SErik Nordmark /*
2bd670b35SErik Nordmark * CDDL HEADER START
3bd670b35SErik Nordmark *
4bd670b35SErik Nordmark * The contents of this file are subject to the terms of the
5bd670b35SErik Nordmark * Common Development and Distribution License (the "License").
6bd670b35SErik Nordmark * You may not use this file except in compliance with the License.
7bd670b35SErik Nordmark *
8bd670b35SErik Nordmark * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9bd670b35SErik Nordmark * or http://www.opensolaris.org/os/licensing.
10bd670b35SErik Nordmark * See the License for the specific language governing permissions
11bd670b35SErik Nordmark * and limitations under the License.
12bd670b35SErik Nordmark *
13bd670b35SErik Nordmark * When distributing Covered Code, include this CDDL HEADER in each
14bd670b35SErik Nordmark * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15bd670b35SErik Nordmark * If applicable, add the following below this CDDL HEADER, with the
16bd670b35SErik Nordmark * fields enclosed by brackets "[]" replaced with your own identifying
17bd670b35SErik Nordmark * information: Portions Copyright [yyyy] [name of copyright owner]
18bd670b35SErik Nordmark *
19bd670b35SErik Nordmark * CDDL HEADER END
20bd670b35SErik Nordmark */
21bd670b35SErik Nordmark
22bd670b35SErik Nordmark /*
231eee170aSErik Nordmark * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24*b22a70abSPatrick Mooney * Copyright 2018 Joyent, Inc.
25bd670b35SErik Nordmark */
26bd670b35SErik Nordmark /* Copyright (c) 1990 Mentat Inc. */
27bd670b35SErik Nordmark
28bd670b35SErik Nordmark #include <sys/types.h>
29bd670b35SErik Nordmark #include <sys/stream.h>
30bd670b35SErik Nordmark #include <sys/strsubr.h>
31bd670b35SErik Nordmark #include <sys/dlpi.h>
32bd670b35SErik Nordmark #include <sys/strsun.h>
33bd670b35SErik Nordmark #include <sys/zone.h>
34bd670b35SErik Nordmark #include <sys/ddi.h>
35bd670b35SErik Nordmark #include <sys/sunddi.h>
36bd670b35SErik Nordmark #include <sys/cmn_err.h>
37bd670b35SErik Nordmark #include <sys/debug.h>
38bd670b35SErik Nordmark #include <sys/atomic.h>
39bd670b35SErik Nordmark
40bd670b35SErik Nordmark #include <sys/systm.h>
41bd670b35SErik Nordmark #include <sys/param.h>
42bd670b35SErik Nordmark #include <sys/kmem.h>
43bd670b35SErik Nordmark #include <sys/sdt.h>
44bd670b35SErik Nordmark #include <sys/socket.h>
45bd670b35SErik Nordmark #include <sys/mac.h>
46bd670b35SErik Nordmark #include <net/if.h>
47bd670b35SErik Nordmark #include <net/if_arp.h>
48bd670b35SErik Nordmark #include <net/route.h>
49bd670b35SErik Nordmark #include <sys/sockio.h>
50bd670b35SErik Nordmark #include <netinet/in.h>
51bd670b35SErik Nordmark #include <net/if_dl.h>
52bd670b35SErik Nordmark
53bd670b35SErik Nordmark #include <inet/common.h>
54bd670b35SErik Nordmark #include <inet/mi.h>
55bd670b35SErik Nordmark #include <inet/mib2.h>
56bd670b35SErik Nordmark #include <inet/nd.h>
57bd670b35SErik Nordmark #include <inet/arp.h>
58bd670b35SErik Nordmark #include <inet/snmpcom.h>
59bd670b35SErik Nordmark #include <inet/kstatcom.h>
60bd670b35SErik Nordmark
61bd670b35SErik Nordmark #include <netinet/igmp_var.h>
62bd670b35SErik Nordmark #include <netinet/ip6.h>
63bd670b35SErik Nordmark #include <netinet/icmp6.h>
64bd670b35SErik Nordmark #include <netinet/sctp.h>
65bd670b35SErik Nordmark
66bd670b35SErik Nordmark #include <inet/ip.h>
67bd670b35SErik Nordmark #include <inet/ip_impl.h>
68bd670b35SErik Nordmark #include <inet/ip6.h>
69bd670b35SErik Nordmark #include <inet/ip6_asp.h>
70bd670b35SErik Nordmark #include <inet/tcp.h>
71bd670b35SErik Nordmark #include <inet/ip_multi.h>
72bd670b35SErik Nordmark #include <inet/ip_if.h>
73bd670b35SErik Nordmark #include <inet/ip_ire.h>
74bd670b35SErik Nordmark #include <inet/ip_ftable.h>
75bd670b35SErik Nordmark #include <inet/ip_rts.h>
76bd670b35SErik Nordmark #include <inet/optcom.h>
77bd670b35SErik Nordmark #include <inet/ip_ndp.h>
78bd670b35SErik Nordmark #include <inet/ip_listutils.h>
79bd670b35SErik Nordmark #include <netinet/igmp.h>
80bd670b35SErik Nordmark #include <netinet/ip_mroute.h>
81bd670b35SErik Nordmark #include <inet/ipp_common.h>
82bd670b35SErik Nordmark
83bd670b35SErik Nordmark #include <net/pfkeyv2.h>
84bd670b35SErik Nordmark #include <inet/sadb.h>
85bd670b35SErik Nordmark #include <inet/ipsec_impl.h>
86bd670b35SErik Nordmark #include <inet/ipdrop.h>
87bd670b35SErik Nordmark #include <inet/ip_netinfo.h>
88bd670b35SErik Nordmark
89bd670b35SErik Nordmark #include <sys/pattr.h>
90bd670b35SErik Nordmark #include <inet/ipclassifier.h>
91bd670b35SErik Nordmark #include <inet/sctp_ip.h>
92bd670b35SErik Nordmark #include <inet/sctp/sctp_impl.h>
93bd670b35SErik Nordmark #include <inet/udp_impl.h>
94bd670b35SErik Nordmark #include <sys/sunddi.h>
95bd670b35SErik Nordmark
96bd670b35SErik Nordmark #include <sys/tsol/label.h>
97bd670b35SErik Nordmark #include <sys/tsol/tnet.h>
98bd670b35SErik Nordmark
99b36a561eSErik Nordmark #include <sys/clock_impl.h> /* For LBOLT_FASTPATH{,64} */
100b36a561eSErik Nordmark
101bd670b35SErik Nordmark #ifdef DEBUG
102bd670b35SErik Nordmark extern boolean_t skip_sctp_cksum;
103bd670b35SErik Nordmark #endif
104bd670b35SErik Nordmark
105bd670b35SErik Nordmark static int ip_verify_nce(mblk_t *, ip_xmit_attr_t *);
106bd670b35SErik Nordmark static int ip_verify_dce(mblk_t *, ip_xmit_attr_t *);
107bd670b35SErik Nordmark static boolean_t ip_verify_lso(ill_t *, ip_xmit_attr_t *);
108bd670b35SErik Nordmark static boolean_t ip_verify_zcopy(ill_t *, ip_xmit_attr_t *);
109bd670b35SErik Nordmark static void ip_output_simple_broadcast(ip_xmit_attr_t *, mblk_t *);
110bd670b35SErik Nordmark
111bd670b35SErik Nordmark /*
112bd670b35SErik Nordmark * There are two types of output functions for IP used for different
113bd670b35SErik Nordmark * purposes:
114bd670b35SErik Nordmark * - ip_output_simple() is when sending ICMP errors, TCP resets, etc when there
115bd670b35SErik Nordmark * is no context in the form of a conn_t. However, there is a
116bd670b35SErik Nordmark * ip_xmit_attr_t that the callers use to influence interface selection
117bd670b35SErik Nordmark * (needed for ICMP echo as well as IPv6 link-locals) and IPsec.
118bd670b35SErik Nordmark *
119bd670b35SErik Nordmark * - conn_ip_output() is used when sending packets with a conn_t and
120bd670b35SErik Nordmark * ip_set_destination has been called to cache information. In that case
121bd670b35SErik Nordmark * various socket options are recorded in the ip_xmit_attr_t and should
122bd670b35SErik Nordmark * be taken into account.
123bd670b35SErik Nordmark */
124bd670b35SErik Nordmark
125bd670b35SErik Nordmark /*
126bd670b35SErik Nordmark * The caller *must* have called conn_connect() or ip_attr_connect()
127bd670b35SErik Nordmark * before calling conn_ip_output(). The caller needs to redo that each time
128bd670b35SErik Nordmark * the destination IP address or port changes, as well as each time there is
129bd670b35SErik Nordmark * a change to any socket option that would modify how packets are routed out
130bd670b35SErik Nordmark * of the box (e.g., SO_DONTROUTE, IP_NEXTHOP, IP_BOUND_IF).
131bd670b35SErik Nordmark *
132bd670b35SErik Nordmark * The ULP caller has to serialize the use of a single ip_xmit_attr_t.
133bd670b35SErik Nordmark * We assert for that here.
134bd670b35SErik Nordmark */
135bd670b35SErik Nordmark int
conn_ip_output(mblk_t * mp,ip_xmit_attr_t * ixa)136bd670b35SErik Nordmark conn_ip_output(mblk_t *mp, ip_xmit_attr_t *ixa)
137bd670b35SErik Nordmark {
138bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags;
139bd670b35SErik Nordmark ire_t *ire;
140bd670b35SErik Nordmark nce_t *nce;
141bd670b35SErik Nordmark dce_t *dce;
142bd670b35SErik Nordmark ill_t *ill;
143bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
144bd670b35SErik Nordmark int error;
145bd670b35SErik Nordmark
146bd670b35SErik Nordmark /* We defer ipIfStatsHCOutRequests until an error or we have an ill */
147bd670b35SErik Nordmark
148bd670b35SErik Nordmark ASSERT(ixa->ixa_ire != NULL);
149bd670b35SErik Nordmark /* Note there is no ixa_nce when reject and blackhole routes */
150bd670b35SErik Nordmark ASSERT(ixa->ixa_dce != NULL); /* Could be default dce */
151bd670b35SErik Nordmark
152bd670b35SErik Nordmark #ifdef DEBUG
153bd670b35SErik Nordmark ASSERT(ixa->ixa_curthread == NULL);
154bd670b35SErik Nordmark ixa->ixa_curthread = curthread;
155bd670b35SErik Nordmark #endif
156bd670b35SErik Nordmark
157bd670b35SErik Nordmark /*
158bd670b35SErik Nordmark * Even on labeled systems we can have a NULL ixa_tsl e.g.,
159bd670b35SErik Nordmark * for IGMP/MLD traffic.
160bd670b35SErik Nordmark */
161bd670b35SErik Nordmark
162bd670b35SErik Nordmark ire = ixa->ixa_ire;
163bd670b35SErik Nordmark
164bd670b35SErik Nordmark /*
165bd670b35SErik Nordmark * If the ULP says the (old) IRE resulted in reachability we
166bd670b35SErik Nordmark * record this before determine whether to use a new IRE.
167bd670b35SErik Nordmark * No locking for performance reasons.
168bd670b35SErik Nordmark */
169bd670b35SErik Nordmark if (ixaflags & IXAF_REACH_CONF)
170bd670b35SErik Nordmark ire->ire_badcnt = 0;
171bd670b35SErik Nordmark
172bd670b35SErik Nordmark /*
173bd670b35SErik Nordmark * Has routing changed since we cached the results of the lookup?
174bd670b35SErik Nordmark *
175bd670b35SErik Nordmark * This check captures all of:
176bd670b35SErik Nordmark * - the cached ire being deleted (by means of the special
177bd670b35SErik Nordmark * IRE_GENERATION_CONDEMNED)
178bd670b35SErik Nordmark * - A potentially better ire being added (ire_generation being
179bd670b35SErik Nordmark * increased)
180bd670b35SErik Nordmark * - A deletion of the nexthop ire that was used when we did the
181bd670b35SErik Nordmark * lookup.
182bd670b35SErik Nordmark * - An addition of a potentially better nexthop ire.
183bd670b35SErik Nordmark * The last two are handled by walking and increasing the generation
184bd670b35SErik Nordmark * number on all dependant IREs in ire_flush_cache().
185bd670b35SErik Nordmark *
186bd670b35SErik Nordmark * The check also handles all cases of RTF_REJECT and RTF_BLACKHOLE
187bd670b35SErik Nordmark * since we ensure that each time we set ixa_ire to such an IRE we
188bd670b35SErik Nordmark * make sure the ixa_ire_generation does not match (by using
189bd670b35SErik Nordmark * IRE_GENERATION_VERIFY).
190bd670b35SErik Nordmark */
191bd670b35SErik Nordmark if (ire->ire_generation != ixa->ixa_ire_generation) {
192bd670b35SErik Nordmark error = ip_verify_ire(mp, ixa);
193bd670b35SErik Nordmark if (error != 0) {
194bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - verify ire",
195bd670b35SErik Nordmark mp, NULL);
196bd670b35SErik Nordmark goto drop;
197bd670b35SErik Nordmark }
198bd670b35SErik Nordmark ire = ixa->ixa_ire;
199bd670b35SErik Nordmark ASSERT(ire != NULL);
200bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
201bd670b35SErik Nordmark #ifdef DEBUG
202bd670b35SErik Nordmark ASSERT(ixa->ixa_curthread == curthread);
203bd670b35SErik Nordmark ixa->ixa_curthread = NULL;
204bd670b35SErik Nordmark #endif
205bd670b35SErik Nordmark ire->ire_ob_pkt_count++;
206bd670b35SErik Nordmark /* ixa_dce might be condemned; use default one */
207bd670b35SErik Nordmark return ((ire->ire_sendfn)(ire, mp, mp->b_rptr, ixa,
208bd670b35SErik Nordmark &ipst->ips_dce_default->dce_ident));
209bd670b35SErik Nordmark }
210bd670b35SErik Nordmark /*
211bd670b35SErik Nordmark * If the ncec changed then ip_verify_ire already set
212bd670b35SErik Nordmark * ixa->ixa_dce_generation = DCE_GENERATION_VERIFY;
213bd670b35SErik Nordmark * so we can recheck the interface mtu.
214bd670b35SErik Nordmark */
215bd670b35SErik Nordmark
216bd670b35SErik Nordmark /*
217bd670b35SErik Nordmark * Note that ire->ire_generation could already have changed.
218bd670b35SErik Nordmark * We catch that next time we send a packet.
219bd670b35SErik Nordmark */
220bd670b35SErik Nordmark }
221bd670b35SErik Nordmark
222bd670b35SErik Nordmark /*
223bd670b35SErik Nordmark * No need to lock access to ixa_nce since the ip_xmit_attr usage
224bd670b35SErik Nordmark * is single threaded.
225bd670b35SErik Nordmark */
226bd670b35SErik Nordmark ASSERT(ixa->ixa_nce != NULL);
227bd670b35SErik Nordmark nce = ixa->ixa_nce;
228bd670b35SErik Nordmark if (nce->nce_is_condemned) {
229bd670b35SErik Nordmark error = ip_verify_nce(mp, ixa);
230bd670b35SErik Nordmark /*
231bd670b35SErik Nordmark * In case ZEROCOPY capability become not available, we
232bd670b35SErik Nordmark * copy the message and free the original one. We might
233bd670b35SErik Nordmark * be copying more data than needed but it doesn't hurt
234bd670b35SErik Nordmark * since such change rarely happens.
235bd670b35SErik Nordmark */
236bd670b35SErik Nordmark switch (error) {
237bd670b35SErik Nordmark case 0:
238bd670b35SErik Nordmark break;
239bd670b35SErik Nordmark case ENOTSUP: { /* ZEROCOPY */
240bd670b35SErik Nordmark mblk_t *nmp;
241bd670b35SErik Nordmark
242bd670b35SErik Nordmark if ((nmp = copymsg(mp)) != NULL) {
243bd670b35SErik Nordmark freemsg(mp);
244bd670b35SErik Nordmark mp = nmp;
245bd670b35SErik Nordmark
246bd670b35SErik Nordmark break;
247bd670b35SErik Nordmark }
248bd670b35SErik Nordmark }
249a9f62b1aSToomas Soome /* FALLTHROUGH */
250bd670b35SErik Nordmark default:
251bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - verify nce",
252bd670b35SErik Nordmark mp, NULL);
253bd670b35SErik Nordmark goto drop;
254bd670b35SErik Nordmark }
255bd670b35SErik Nordmark ire = ixa->ixa_ire;
256bd670b35SErik Nordmark ASSERT(ire != NULL);
257bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
258bd670b35SErik Nordmark #ifdef DEBUG
259bd670b35SErik Nordmark ASSERT(ixa->ixa_curthread == curthread);
260bd670b35SErik Nordmark ixa->ixa_curthread = NULL;
261bd670b35SErik Nordmark #endif
262bd670b35SErik Nordmark ire->ire_ob_pkt_count++;
263bd670b35SErik Nordmark /* ixa_dce might be condemned; use default one */
264bd670b35SErik Nordmark return ((ire->ire_sendfn)(ire, mp, mp->b_rptr,
265bd670b35SErik Nordmark ixa, &ipst->ips_dce_default->dce_ident));
266bd670b35SErik Nordmark }
267bd670b35SErik Nordmark ASSERT(ixa->ixa_nce != NULL);
268bd670b35SErik Nordmark nce = ixa->ixa_nce;
269bd670b35SErik Nordmark
270bd670b35SErik Nordmark /*
271bd670b35SErik Nordmark * Note that some other event could already have made
272bd670b35SErik Nordmark * the new nce condemned. We catch that next time we
273bd670b35SErik Nordmark * try to send a packet.
274bd670b35SErik Nordmark */
275bd670b35SErik Nordmark }
276bd670b35SErik Nordmark /*
277bd670b35SErik Nordmark * If there is no per-destination dce_t then we have a reference to
278bd670b35SErik Nordmark * the default dce_t (which merely contains the dce_ipid).
279bd670b35SErik Nordmark * The generation check captures both the introduction of a
280bd670b35SErik Nordmark * per-destination dce_t (e.g., due to ICMP packet too big) and
281bd670b35SErik Nordmark * any change to the per-destination dce (including it becoming
282bd670b35SErik Nordmark * condemned by use of the special DCE_GENERATION_CONDEMNED).
283bd670b35SErik Nordmark */
284bd670b35SErik Nordmark dce = ixa->ixa_dce;
285bd670b35SErik Nordmark
286bd670b35SErik Nordmark /*
287bd670b35SErik Nordmark * To avoid a periodic timer to increase the path MTU we
288bd670b35SErik Nordmark * look at dce_last_change_time each time we send a packet.
289bd670b35SErik Nordmark */
290b36a561eSErik Nordmark if (dce->dce_flags & DCEF_PMTU) {
291b36a561eSErik Nordmark int64_t now = LBOLT_FASTPATH64;
292b36a561eSErik Nordmark
293b36a561eSErik Nordmark if ((TICK_TO_SEC(now) - dce->dce_last_change_time >
294b36a561eSErik Nordmark ipst->ips_ip_pathmtu_interval)) {
295b36a561eSErik Nordmark /*
296b36a561eSErik Nordmark * Older than 20 minutes. Drop the path MTU information.
297b36a561eSErik Nordmark * Since the path MTU changes as a result of this,
298b36a561eSErik Nordmark * twiddle ixa_dce_generation to make us go through the
299b36a561eSErik Nordmark * dce verification code in conn_ip_output.
300b36a561eSErik Nordmark */
301b36a561eSErik Nordmark mutex_enter(&dce->dce_lock);
302b36a561eSErik Nordmark dce->dce_flags &= ~(DCEF_PMTU|DCEF_TOO_SMALL_PMTU);
303b36a561eSErik Nordmark dce->dce_last_change_time = TICK_TO_SEC(now);
304b36a561eSErik Nordmark mutex_exit(&dce->dce_lock);
305b36a561eSErik Nordmark dce_increment_generation(dce);
306b36a561eSErik Nordmark }
307bd670b35SErik Nordmark }
308bd670b35SErik Nordmark
309bd670b35SErik Nordmark if (dce->dce_generation != ixa->ixa_dce_generation) {
310bd670b35SErik Nordmark error = ip_verify_dce(mp, ixa);
311bd670b35SErik Nordmark if (error != 0) {
312bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - verify dce",
313bd670b35SErik Nordmark mp, NULL);
314bd670b35SErik Nordmark goto drop;
315bd670b35SErik Nordmark }
316bd670b35SErik Nordmark dce = ixa->ixa_dce;
317bd670b35SErik Nordmark
318bd670b35SErik Nordmark /*
319bd670b35SErik Nordmark * Note that some other event could already have made the
320bd670b35SErik Nordmark * new dce's generation number change.
321bd670b35SErik Nordmark * We catch that next time we try to send a packet.
322bd670b35SErik Nordmark */
323bd670b35SErik Nordmark }
324bd670b35SErik Nordmark
325bd670b35SErik Nordmark ill = nce->nce_ill;
326bd670b35SErik Nordmark
327bd670b35SErik Nordmark /*
328bd670b35SErik Nordmark * An initial ixa_fragsize was set in ip_set_destination
329bd670b35SErik Nordmark * and we update it if any routing changes above.
330bd670b35SErik Nordmark * A change to ill_mtu with ifconfig will increase all dce_generation
3311eee170aSErik Nordmark * so that we will detect that with the generation check. Ditto for
3321eee170aSErik Nordmark * ill_mc_mtu.
333bd670b35SErik Nordmark */
334bd670b35SErik Nordmark
335bd670b35SErik Nordmark /*
336bd670b35SErik Nordmark * Caller needs to make sure IXAF_VERIFY_SRC is not set if
337bd670b35SErik Nordmark * conn_unspec_src.
338bd670b35SErik Nordmark */
339bd670b35SErik Nordmark if ((ixaflags & IXAF_VERIFY_SOURCE) &&
340bd670b35SErik Nordmark ixa->ixa_src_generation != ipst->ips_src_generation) {
341bd670b35SErik Nordmark /* Check if the IP source is still assigned to the host. */
342bd670b35SErik Nordmark uint_t gen;
343bd670b35SErik Nordmark
344bd670b35SErik Nordmark if (!ip_verify_src(mp, ixa, &gen)) {
345bd670b35SErik Nordmark /* Don't send a packet with a source that isn't ours */
346bd670b35SErik Nordmark error = EADDRNOTAVAIL;
347bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - invalid src",
348bd670b35SErik Nordmark mp, NULL);
349bd670b35SErik Nordmark goto drop;
350bd670b35SErik Nordmark }
351bd670b35SErik Nordmark /* The source is still valid - update the generation number */
352bd670b35SErik Nordmark ixa->ixa_src_generation = gen;
353bd670b35SErik Nordmark }
354bd670b35SErik Nordmark
355bd670b35SErik Nordmark /*
356bd670b35SErik Nordmark * We don't have an IRE when we fragment, hence ire_ob_pkt_count
357bd670b35SErik Nordmark * can only count the use prior to fragmentation. However the MIB
358bd670b35SErik Nordmark * counters on the ill will be incremented in post fragmentation.
359bd670b35SErik Nordmark */
360bd670b35SErik Nordmark ire->ire_ob_pkt_count++;
361bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutRequests);
362bd670b35SErik Nordmark
363bd670b35SErik Nordmark /*
364bd670b35SErik Nordmark * Based on ire_type and ire_flags call one of:
365bd670b35SErik Nordmark * ire_send_local_v* - for IRE_LOCAL and IRE_LOOPBACK
366bd670b35SErik Nordmark * ire_send_multirt_v* - if RTF_MULTIRT
367bd670b35SErik Nordmark * ire_send_noroute_v* - if RTF_REJECT or RTF_BLACHOLE
368bd670b35SErik Nordmark * ire_send_multicast_v* - for IRE_MULTICAST
369bd670b35SErik Nordmark * ire_send_broadcast_v4 - for IRE_BROADCAST
370bd670b35SErik Nordmark * ire_send_wire_v* - for the rest.
371bd670b35SErik Nordmark */
372bd670b35SErik Nordmark #ifdef DEBUG
373bd670b35SErik Nordmark ASSERT(ixa->ixa_curthread == curthread);
374bd670b35SErik Nordmark ixa->ixa_curthread = NULL;
375bd670b35SErik Nordmark #endif
376bd670b35SErik Nordmark return ((ire->ire_sendfn)(ire, mp, mp->b_rptr, ixa, &dce->dce_ident));
377bd670b35SErik Nordmark
378bd670b35SErik Nordmark drop:
379bd670b35SErik Nordmark if (ixaflags & IXAF_IS_IPV4) {
380bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
381bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
382bd670b35SErik Nordmark } else {
383bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsHCOutRequests);
384bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
385bd670b35SErik Nordmark }
386bd670b35SErik Nordmark freemsg(mp);
387bd670b35SErik Nordmark #ifdef DEBUG
388bd670b35SErik Nordmark ASSERT(ixa->ixa_curthread == curthread);
389bd670b35SErik Nordmark ixa->ixa_curthread = NULL;
390bd670b35SErik Nordmark #endif
391bd670b35SErik Nordmark return (error);
392bd670b35SErik Nordmark }
393bd670b35SErik Nordmark
394bd670b35SErik Nordmark /*
395bd670b35SErik Nordmark * Handle both IPv4 and IPv6. Sets the generation number
396bd670b35SErik Nordmark * to allow the caller to know when to call us again.
397bd670b35SErik Nordmark * Returns true if the source address in the packet is a valid source.
398bd670b35SErik Nordmark * We handle callers which try to send with a zero address (since we only
399bd670b35SErik Nordmark * get here if UNSPEC_SRC is not set).
400bd670b35SErik Nordmark */
401bd670b35SErik Nordmark boolean_t
ip_verify_src(mblk_t * mp,ip_xmit_attr_t * ixa,uint_t * generationp)402bd670b35SErik Nordmark ip_verify_src(mblk_t *mp, ip_xmit_attr_t *ixa, uint_t *generationp)
403bd670b35SErik Nordmark {
404bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
405bd670b35SErik Nordmark
406bd670b35SErik Nordmark /*
407bd670b35SErik Nordmark * Need to grab the generation number before we check to
408bd670b35SErik Nordmark * avoid a race with a change to the set of local addresses.
409bd670b35SErik Nordmark * No lock needed since the thread which updates the set of local
410bd670b35SErik Nordmark * addresses use ipif/ill locks and exit those (hence a store memory
411bd670b35SErik Nordmark * barrier) before doing the atomic increase of ips_src_generation.
412bd670b35SErik Nordmark */
413bd670b35SErik Nordmark if (generationp != NULL)
414bd670b35SErik Nordmark *generationp = ipst->ips_src_generation;
415bd670b35SErik Nordmark
416bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4) {
417bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)mp->b_rptr;
418bd670b35SErik Nordmark
419bd670b35SErik Nordmark if (ipha->ipha_src == INADDR_ANY)
420bd670b35SErik Nordmark return (B_FALSE);
421bd670b35SErik Nordmark
422bd670b35SErik Nordmark return (ip_laddr_verify_v4(ipha->ipha_src, ixa->ixa_zoneid,
423bd670b35SErik Nordmark ipst, B_FALSE) != IPVL_BAD);
424bd670b35SErik Nordmark } else {
425bd670b35SErik Nordmark ip6_t *ip6h = (ip6_t *)mp->b_rptr;
426bd670b35SErik Nordmark uint_t scopeid;
427bd670b35SErik Nordmark
428bd670b35SErik Nordmark if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src))
429bd670b35SErik Nordmark return (B_FALSE);
430bd670b35SErik Nordmark
431bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_SCOPEID_SET)
432bd670b35SErik Nordmark scopeid = ixa->ixa_scopeid;
433bd670b35SErik Nordmark else
434bd670b35SErik Nordmark scopeid = 0;
435bd670b35SErik Nordmark
436bd670b35SErik Nordmark return (ip_laddr_verify_v6(&ip6h->ip6_src, ixa->ixa_zoneid,
437bd670b35SErik Nordmark ipst, B_FALSE, scopeid) != IPVL_BAD);
438bd670b35SErik Nordmark }
439bd670b35SErik Nordmark }
440bd670b35SErik Nordmark
441bd670b35SErik Nordmark /*
442bd670b35SErik Nordmark * Handle both IPv4 and IPv6. Reverify/recalculate the IRE to use.
443bd670b35SErik Nordmark */
444bd670b35SErik Nordmark int
ip_verify_ire(mblk_t * mp,ip_xmit_attr_t * ixa)445bd670b35SErik Nordmark ip_verify_ire(mblk_t *mp, ip_xmit_attr_t *ixa)
446bd670b35SErik Nordmark {
447bd670b35SErik Nordmark uint_t gen;
448bd670b35SErik Nordmark ire_t *ire;
449bd670b35SErik Nordmark nce_t *nce;
450bd670b35SErik Nordmark int error;
451bd670b35SErik Nordmark boolean_t multirt = B_FALSE;
452bd670b35SErik Nordmark
453bd670b35SErik Nordmark /*
454bd670b35SErik Nordmark * Redo ip_select_route.
455bd670b35SErik Nordmark * Need to grab generation number as part of the lookup to
456bd670b35SErik Nordmark * avoid race.
457bd670b35SErik Nordmark */
458bd670b35SErik Nordmark error = 0;
459bd670b35SErik Nordmark ire = ip_select_route_pkt(mp, ixa, &gen, &error, &multirt);
460bd670b35SErik Nordmark ASSERT(ire != NULL); /* IRE_NOROUTE if none found */
461bd670b35SErik Nordmark if (error != 0) {
462bd670b35SErik Nordmark ire_refrele(ire);
463bd670b35SErik Nordmark return (error);
464bd670b35SErik Nordmark }
465bd670b35SErik Nordmark
466bd670b35SErik Nordmark if (ixa->ixa_ire != NULL)
467bd670b35SErik Nordmark ire_refrele_notr(ixa->ixa_ire);
468bd670b35SErik Nordmark #ifdef DEBUG
469bd670b35SErik Nordmark ire_refhold_notr(ire);
470bd670b35SErik Nordmark ire_refrele(ire);
471bd670b35SErik Nordmark #endif
472bd670b35SErik Nordmark ixa->ixa_ire = ire;
473bd670b35SErik Nordmark ixa->ixa_ire_generation = gen;
474bd670b35SErik Nordmark if (multirt) {
475bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4)
476bd670b35SErik Nordmark ixa->ixa_postfragfn = ip_postfrag_multirt_v4;
477bd670b35SErik Nordmark else
478bd670b35SErik Nordmark ixa->ixa_postfragfn = ip_postfrag_multirt_v6;
479bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_MULTIRT_MULTICAST;
480bd670b35SErik Nordmark } else {
481bd670b35SErik Nordmark ixa->ixa_postfragfn = ire->ire_postfragfn;
482bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_MULTIRT_MULTICAST;
483bd670b35SErik Nordmark }
484bd670b35SErik Nordmark
485bd670b35SErik Nordmark /*
486bd670b35SErik Nordmark * Don't look for an nce for reject or blackhole.
487bd670b35SErik Nordmark * They have ire_generation set to IRE_GENERATION_VERIFY which
488bd670b35SErik Nordmark * makes conn_ip_output avoid references to ixa_nce.
489bd670b35SErik Nordmark */
490bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
491bd670b35SErik Nordmark ASSERT(ixa->ixa_ire_generation == IRE_GENERATION_VERIFY);
492bd670b35SErik Nordmark ixa->ixa_dce_generation = DCE_GENERATION_VERIFY;
493bd670b35SErik Nordmark return (0);
494bd670b35SErik Nordmark }
495bd670b35SErik Nordmark
496bd670b35SErik Nordmark /* The NCE could now be different */
497bd670b35SErik Nordmark nce = ire_to_nce_pkt(ire, mp);
498bd670b35SErik Nordmark if (nce == NULL) {
499bd670b35SErik Nordmark /*
500bd670b35SErik Nordmark * Allocation failure. Make sure we redo ire/nce selection
501bd670b35SErik Nordmark * next time we send.
502bd670b35SErik Nordmark */
503bd670b35SErik Nordmark ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
504bd670b35SErik Nordmark ixa->ixa_dce_generation = DCE_GENERATION_VERIFY;
505bd670b35SErik Nordmark return (ENOBUFS);
506bd670b35SErik Nordmark }
507bd670b35SErik Nordmark if (nce == ixa->ixa_nce) {
508bd670b35SErik Nordmark /* No change */
509bd670b35SErik Nordmark nce_refrele(nce);
510bd670b35SErik Nordmark return (0);
511bd670b35SErik Nordmark }
512bd670b35SErik Nordmark
513bd670b35SErik Nordmark /*
514bd670b35SErik Nordmark * Since the path MTU might change as a result of this
515bd670b35SErik Nordmark * route change, we twiddle ixa_dce_generation to
516bd670b35SErik Nordmark * make conn_ip_output go through the ip_verify_dce code.
517bd670b35SErik Nordmark */
518bd670b35SErik Nordmark ixa->ixa_dce_generation = DCE_GENERATION_VERIFY;
519bd670b35SErik Nordmark
520bd670b35SErik Nordmark if (ixa->ixa_nce != NULL)
521bd670b35SErik Nordmark nce_refrele(ixa->ixa_nce);
522bd670b35SErik Nordmark ixa->ixa_nce = nce;
523bd670b35SErik Nordmark return (0);
524bd670b35SErik Nordmark }
525bd670b35SErik Nordmark
526bd670b35SErik Nordmark /*
527bd670b35SErik Nordmark * Handle both IPv4 and IPv6. Reverify/recalculate the NCE to use.
528bd670b35SErik Nordmark */
529bd670b35SErik Nordmark static int
ip_verify_nce(mblk_t * mp,ip_xmit_attr_t * ixa)530bd670b35SErik Nordmark ip_verify_nce(mblk_t *mp, ip_xmit_attr_t *ixa)
531bd670b35SErik Nordmark {
532bd670b35SErik Nordmark ire_t *ire = ixa->ixa_ire;
533bd670b35SErik Nordmark nce_t *nce;
534bd670b35SErik Nordmark int error = 0;
535bd670b35SErik Nordmark ipha_t *ipha = NULL;
536bd670b35SErik Nordmark ip6_t *ip6h = NULL;
537bd670b35SErik Nordmark
538bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION)
539bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr;
540bd670b35SErik Nordmark else
541bd670b35SErik Nordmark ip6h = (ip6_t *)mp->b_rptr;
542bd670b35SErik Nordmark
543bd670b35SErik Nordmark nce = ire_handle_condemned_nce(ixa->ixa_nce, ire, ipha, ip6h, B_TRUE);
544bd670b35SErik Nordmark if (nce == NULL) {
545bd670b35SErik Nordmark /* Try to find a better ire */
546bd670b35SErik Nordmark return (ip_verify_ire(mp, ixa));
547bd670b35SErik Nordmark }
548bd670b35SErik Nordmark
549bd670b35SErik Nordmark /*
550bd670b35SErik Nordmark * The hardware offloading capabilities, for example LSO, of the
551bd670b35SErik Nordmark * interface might have changed, so do sanity verification here.
552bd670b35SErik Nordmark */
553bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_VERIFY_LSO) {
554bd670b35SErik Nordmark if (!ip_verify_lso(nce->nce_ill, ixa)) {
555bd670b35SErik Nordmark ASSERT(ixa->ixa_notify != NULL);
556bd670b35SErik Nordmark ixa->ixa_notify(ixa->ixa_notify_cookie, ixa,
557bd670b35SErik Nordmark IXAN_LSO, 0);
558bd670b35SErik Nordmark error = ENOTSUP;
559bd670b35SErik Nordmark }
560bd670b35SErik Nordmark }
561bd670b35SErik Nordmark
562bd670b35SErik Nordmark /*
563bd670b35SErik Nordmark * Verify ZEROCOPY capability of underlying ill. Notify the ULP with
564bd670b35SErik Nordmark * any ZEROCOPY changes. In case ZEROCOPY capability is not available
565bd670b35SErik Nordmark * any more, return error so that conn_ip_output() can take care of
566bd670b35SErik Nordmark * the ZEROCOPY message properly. It's safe to continue send the
567bd670b35SErik Nordmark * message when ZEROCOPY newly become available.
568bd670b35SErik Nordmark */
569bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_VERIFY_ZCOPY) {
570bd670b35SErik Nordmark if (!ip_verify_zcopy(nce->nce_ill, ixa)) {
571bd670b35SErik Nordmark ASSERT(ixa->ixa_notify != NULL);
572bd670b35SErik Nordmark ixa->ixa_notify(ixa->ixa_notify_cookie, ixa,
573bd670b35SErik Nordmark IXAN_ZCOPY, 0);
574bd670b35SErik Nordmark if ((ixa->ixa_flags & IXAF_ZCOPY_CAPAB) == 0)
575bd670b35SErik Nordmark error = ENOTSUP;
576bd670b35SErik Nordmark }
577bd670b35SErik Nordmark }
578bd670b35SErik Nordmark
579bd670b35SErik Nordmark /*
580bd670b35SErik Nordmark * Since the path MTU might change as a result of this
581bd670b35SErik Nordmark * change, we twiddle ixa_dce_generation to
582bd670b35SErik Nordmark * make conn_ip_output go through the ip_verify_dce code.
583bd670b35SErik Nordmark */
584bd670b35SErik Nordmark ixa->ixa_dce_generation = DCE_GENERATION_VERIFY;
585bd670b35SErik Nordmark
586bd670b35SErik Nordmark nce_refrele(ixa->ixa_nce);
587bd670b35SErik Nordmark ixa->ixa_nce = nce;
588bd670b35SErik Nordmark return (error);
589bd670b35SErik Nordmark }
590bd670b35SErik Nordmark
591bd670b35SErik Nordmark /*
592bd670b35SErik Nordmark * Handle both IPv4 and IPv6. Reverify/recalculate the DCE to use.
593bd670b35SErik Nordmark */
594bd670b35SErik Nordmark static int
ip_verify_dce(mblk_t * mp,ip_xmit_attr_t * ixa)595bd670b35SErik Nordmark ip_verify_dce(mblk_t *mp, ip_xmit_attr_t *ixa)
596bd670b35SErik Nordmark {
597bd670b35SErik Nordmark dce_t *dce;
598bd670b35SErik Nordmark uint_t gen;
599bd670b35SErik Nordmark uint_t pmtu;
600bd670b35SErik Nordmark
601bd670b35SErik Nordmark dce = dce_lookup_pkt(mp, ixa, &gen);
602bd670b35SErik Nordmark ASSERT(dce != NULL);
603bd670b35SErik Nordmark
604bd670b35SErik Nordmark dce_refrele_notr(ixa->ixa_dce);
605bd670b35SErik Nordmark #ifdef DEBUG
606bd670b35SErik Nordmark dce_refhold_notr(dce);
607bd670b35SErik Nordmark dce_refrele(dce);
608bd670b35SErik Nordmark #endif
609bd670b35SErik Nordmark ixa->ixa_dce = dce;
610bd670b35SErik Nordmark ixa->ixa_dce_generation = gen;
611bd670b35SErik Nordmark
612bd670b35SErik Nordmark /* Extract the (path) mtu from the dce, ncec_ill etc */
613bd670b35SErik Nordmark pmtu = ip_get_pmtu(ixa);
614bd670b35SErik Nordmark
615bd670b35SErik Nordmark /*
616bd670b35SErik Nordmark * Tell ULP about PMTU changes - increase or decrease - by returning
617bd670b35SErik Nordmark * an error if IXAF_VERIFY_PMTU is set. In such case, ULP should update
618bd670b35SErik Nordmark * both ixa_pmtu and ixa_fragsize appropriately.
619bd670b35SErik Nordmark *
620bd670b35SErik Nordmark * If ULP doesn't set that flag then we need to update ixa_fragsize
621bd670b35SErik Nordmark * since routing could have changed the ill after after ixa_fragsize
622bd670b35SErik Nordmark * was set previously in the conn_ip_output path or in
623bd670b35SErik Nordmark * ip_set_destination.
624bd670b35SErik Nordmark *
625bd670b35SErik Nordmark * In case of LSO, ixa_fragsize might be greater than ixa_pmtu.
626bd670b35SErik Nordmark *
627bd670b35SErik Nordmark * In the case of a path MTU increase we send the packet after the
628bd670b35SErik Nordmark * notify to the ULP.
629bd670b35SErik Nordmark */
630bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_VERIFY_PMTU) {
631bd670b35SErik Nordmark if (ixa->ixa_pmtu != pmtu) {
632bd670b35SErik Nordmark uint_t oldmtu = ixa->ixa_pmtu;
633bd670b35SErik Nordmark
634bd670b35SErik Nordmark DTRACE_PROBE2(verify_pmtu, uint32_t, pmtu,
635bd670b35SErik Nordmark uint32_t, ixa->ixa_pmtu);
636bd670b35SErik Nordmark ASSERT(ixa->ixa_notify != NULL);
637bd670b35SErik Nordmark ixa->ixa_notify(ixa->ixa_notify_cookie, ixa,
638bd670b35SErik Nordmark IXAN_PMTU, pmtu);
639bd670b35SErik Nordmark if (pmtu < oldmtu)
640bd670b35SErik Nordmark return (EMSGSIZE);
641bd670b35SErik Nordmark }
642bd670b35SErik Nordmark } else {
643bd670b35SErik Nordmark ixa->ixa_fragsize = pmtu;
644bd670b35SErik Nordmark }
645bd670b35SErik Nordmark return (0);
646bd670b35SErik Nordmark }
647bd670b35SErik Nordmark
648bd670b35SErik Nordmark /*
649bd670b35SErik Nordmark * Verify LSO usability. Keep the return value simple to indicate whether
650bd670b35SErik Nordmark * the LSO capability has changed. Handle both IPv4 and IPv6.
651bd670b35SErik Nordmark */
652bd670b35SErik Nordmark static boolean_t
ip_verify_lso(ill_t * ill,ip_xmit_attr_t * ixa)653bd670b35SErik Nordmark ip_verify_lso(ill_t *ill, ip_xmit_attr_t *ixa)
654bd670b35SErik Nordmark {
655bd670b35SErik Nordmark ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab;
656bd670b35SErik Nordmark ill_lso_capab_t *new_lsoc = ill->ill_lso_capab;
657bd670b35SErik Nordmark
658bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_LSO_CAPAB) {
659bd670b35SErik Nordmark /*
660bd670b35SErik Nordmark * Not unsable any more.
661bd670b35SErik Nordmark */
662bd670b35SErik Nordmark if ((ixa->ixa_flags & IXAF_IPSEC_SECURE) ||
663bd670b35SErik Nordmark (ixa->ixa_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) ||
664bd670b35SErik Nordmark (ixa->ixa_ire->ire_flags & RTF_MULTIRT) ||
665bd670b35SErik Nordmark ((ixa->ixa_flags & IXAF_IS_IPV4) ?
666bd670b35SErik Nordmark !ILL_LSO_TCP_IPV4_USABLE(ill) :
667bd670b35SErik Nordmark !ILL_LSO_TCP_IPV6_USABLE(ill))) {
668bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_LSO_CAPAB;
669bd670b35SErik Nordmark
670bd670b35SErik Nordmark return (B_FALSE);
671bd670b35SErik Nordmark }
672bd670b35SErik Nordmark
673bd670b35SErik Nordmark /*
674bd670b35SErik Nordmark * Capability has changed, refresh the copy in ixa.
675bd670b35SErik Nordmark */
67662366fbbSRobert Mustacchi if (lsoc->ill_lso_max_tcpv4 != new_lsoc->ill_lso_max_tcpv4 ||
67762366fbbSRobert Mustacchi lsoc->ill_lso_max_tcpv6 != new_lsoc->ill_lso_max_tcpv6) {
678bd670b35SErik Nordmark *lsoc = *new_lsoc;
679bd670b35SErik Nordmark
680bd670b35SErik Nordmark return (B_FALSE);
681bd670b35SErik Nordmark }
682bd670b35SErik Nordmark } else { /* Was not usable */
683bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE) &&
684bd670b35SErik Nordmark !(ixa->ixa_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) &&
685bd670b35SErik Nordmark !(ixa->ixa_ire->ire_flags & RTF_MULTIRT) &&
686bd670b35SErik Nordmark ((ixa->ixa_flags & IXAF_IS_IPV4) ?
687bd670b35SErik Nordmark ILL_LSO_TCP_IPV4_USABLE(ill) :
688bd670b35SErik Nordmark ILL_LSO_TCP_IPV6_USABLE(ill))) {
689bd670b35SErik Nordmark *lsoc = *new_lsoc;
690bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_LSO_CAPAB;
691bd670b35SErik Nordmark
692bd670b35SErik Nordmark return (B_FALSE);
693bd670b35SErik Nordmark }
694bd670b35SErik Nordmark }
695bd670b35SErik Nordmark
696bd670b35SErik Nordmark return (B_TRUE);
697bd670b35SErik Nordmark }
698bd670b35SErik Nordmark
699bd670b35SErik Nordmark /*
700bd670b35SErik Nordmark * Verify ZEROCOPY usability. Keep the return value simple to indicate whether
701bd670b35SErik Nordmark * the ZEROCOPY capability has changed. Handle both IPv4 and IPv6.
702bd670b35SErik Nordmark */
703bd670b35SErik Nordmark static boolean_t
ip_verify_zcopy(ill_t * ill,ip_xmit_attr_t * ixa)704bd670b35SErik Nordmark ip_verify_zcopy(ill_t *ill, ip_xmit_attr_t *ixa)
705bd670b35SErik Nordmark {
706bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_ZCOPY_CAPAB) {
707bd670b35SErik Nordmark /*
708bd670b35SErik Nordmark * Not unsable any more.
709bd670b35SErik Nordmark */
710bd670b35SErik Nordmark if ((ixa->ixa_flags & IXAF_IPSEC_SECURE) ||
711bd670b35SErik Nordmark (ixa->ixa_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) ||
712bd670b35SErik Nordmark (ixa->ixa_ire->ire_flags & RTF_MULTIRT) ||
713bd670b35SErik Nordmark !ILL_ZCOPY_USABLE(ill)) {
714bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_ZCOPY_CAPAB;
715bd670b35SErik Nordmark
716bd670b35SErik Nordmark return (B_FALSE);
717bd670b35SErik Nordmark }
718bd670b35SErik Nordmark } else { /* Was not usable */
719bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_IPSEC_SECURE) &&
720bd670b35SErik Nordmark !(ixa->ixa_ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) &&
721bd670b35SErik Nordmark !(ixa->ixa_ire->ire_flags & RTF_MULTIRT) &&
722bd670b35SErik Nordmark ILL_ZCOPY_USABLE(ill)) {
723bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_ZCOPY_CAPAB;
724bd670b35SErik Nordmark
725bd670b35SErik Nordmark return (B_FALSE);
726bd670b35SErik Nordmark }
727bd670b35SErik Nordmark }
728bd670b35SErik Nordmark
729bd670b35SErik Nordmark return (B_TRUE);
730bd670b35SErik Nordmark }
731bd670b35SErik Nordmark
732bd670b35SErik Nordmark
733bd670b35SErik Nordmark /*
734bd670b35SErik Nordmark * When there is no conn_t context, this will send a packet.
735bd670b35SErik Nordmark * The caller must *not* have called conn_connect() or ip_attr_connect()
736bd670b35SErik Nordmark * before calling ip_output_simple().
737bd670b35SErik Nordmark * Handles IPv4 and IPv6. Returns zero or an errno such as ENETUNREACH.
738bd670b35SErik Nordmark * Honors IXAF_SET_SOURCE.
739bd670b35SErik Nordmark *
740bd670b35SErik Nordmark * We acquire the ire and after calling ire_sendfn we release
741bd670b35SErik Nordmark * the hold on the ire. Ditto for the nce and dce.
742bd670b35SErik Nordmark *
743bd670b35SErik Nordmark * This assumes that the caller has set the following in ip_xmit_attr_t:
744bd670b35SErik Nordmark * ixa_tsl, ixa_zoneid, and ixa_ipst must always be set.
745bd670b35SErik Nordmark * If ixa_ifindex is non-zero it means send out that ill. (If it is
746bd670b35SErik Nordmark * an upper IPMP ill we load balance across the group; if a lower we send
747bd670b35SErik Nordmark * on that lower ill without load balancing.)
748bd670b35SErik Nordmark * IXAF_IS_IPV4 must be set correctly.
749bd670b35SErik Nordmark * If IXAF_IPSEC_SECURE is set then the ixa_ipsec_* fields must be set.
750bd670b35SErik Nordmark * If IXAF_NO_IPSEC is set we'd skip IPsec policy lookup.
751bd670b35SErik Nordmark * If neither of those two are set we do an IPsec policy lookup.
752bd670b35SErik Nordmark *
753bd670b35SErik Nordmark * We handle setting things like
754bd670b35SErik Nordmark * ixa_pktlen
755bd670b35SErik Nordmark * ixa_ip_hdr_length
756bd670b35SErik Nordmark * ixa->ixa_protocol
757bd670b35SErik Nordmark *
758bd670b35SErik Nordmark * The caller may set ixa_xmit_hint, which is used for ECMP selection and
759bd670b35SErik Nordmark * transmit ring selecting in GLD.
760bd670b35SErik Nordmark *
761bd670b35SErik Nordmark * The caller must do an ixa_cleanup() to release any IPsec references
762bd670b35SErik Nordmark * after we return.
763bd670b35SErik Nordmark */
764bd670b35SErik Nordmark int
ip_output_simple(mblk_t * mp,ip_xmit_attr_t * ixa)765bd670b35SErik Nordmark ip_output_simple(mblk_t *mp, ip_xmit_attr_t *ixa)
766bd670b35SErik Nordmark {
767bd670b35SErik Nordmark ts_label_t *effective_tsl = NULL;
768bd670b35SErik Nordmark int err;
769bd670b35SErik Nordmark
770bd670b35SErik Nordmark ASSERT(ixa->ixa_ipst != NULL);
771bd670b35SErik Nordmark
772bd670b35SErik Nordmark if (is_system_labeled()) {
773bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
774bd670b35SErik Nordmark
775bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4) {
776bd670b35SErik Nordmark err = tsol_check_label_v4(ixa->ixa_tsl, ixa->ixa_zoneid,
777bd670b35SErik Nordmark &mp, CONN_MAC_DEFAULT, B_FALSE, ixa->ixa_ipst,
778bd670b35SErik Nordmark &effective_tsl);
779bd670b35SErik Nordmark } else {
780bd670b35SErik Nordmark err = tsol_check_label_v6(ixa->ixa_tsl, ixa->ixa_zoneid,
781bd670b35SErik Nordmark &mp, CONN_MAC_DEFAULT, B_FALSE, ixa->ixa_ipst,
782bd670b35SErik Nordmark &effective_tsl);
783bd670b35SErik Nordmark }
784bd670b35SErik Nordmark if (err != 0) {
785bd670b35SErik Nordmark ip2dbg(("tsol_check: label check failed (%d)\n", err));
786bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
787bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
788bd670b35SErik Nordmark ip_drop_output("tsol_check_label", mp, NULL);
789bd670b35SErik Nordmark freemsg(mp);
790bd670b35SErik Nordmark return (err);
791bd670b35SErik Nordmark }
792bd670b35SErik Nordmark if (effective_tsl != NULL) {
793bd670b35SErik Nordmark /* Update the label */
794bd670b35SErik Nordmark ip_xmit_attr_replace_tsl(ixa, effective_tsl);
795bd670b35SErik Nordmark }
796bd670b35SErik Nordmark }
797bd670b35SErik Nordmark
798bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4)
799bd670b35SErik Nordmark return (ip_output_simple_v4(mp, ixa));
800bd670b35SErik Nordmark else
801bd670b35SErik Nordmark return (ip_output_simple_v6(mp, ixa));
802bd670b35SErik Nordmark }
803bd670b35SErik Nordmark
804bd670b35SErik Nordmark int
ip_output_simple_v4(mblk_t * mp,ip_xmit_attr_t * ixa)805bd670b35SErik Nordmark ip_output_simple_v4(mblk_t *mp, ip_xmit_attr_t *ixa)
806bd670b35SErik Nordmark {
807bd670b35SErik Nordmark ipha_t *ipha;
808bd670b35SErik Nordmark ipaddr_t firsthop; /* In IP header */
809bd670b35SErik Nordmark ipaddr_t dst; /* End of source route, or ipha_dst if none */
810bd670b35SErik Nordmark ire_t *ire;
811bd670b35SErik Nordmark ipaddr_t setsrc; /* RTF_SETSRC */
812bd670b35SErik Nordmark int error;
813bd670b35SErik Nordmark ill_t *ill = NULL;
814bd670b35SErik Nordmark dce_t *dce = NULL;
815bd670b35SErik Nordmark nce_t *nce;
816bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags;
817bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
818bd670b35SErik Nordmark boolean_t repeat = B_FALSE;
819bd670b35SErik Nordmark boolean_t multirt = B_FALSE;
820d3d50737SRafael Vanoni int64_t now;
821bd670b35SErik Nordmark
822bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr;
823bd670b35SErik Nordmark ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
824bd670b35SErik Nordmark
825bd670b35SErik Nordmark /*
826bd670b35SErik Nordmark * Even on labeled systems we can have a NULL ixa_tsl e.g.,
827bd670b35SErik Nordmark * for IGMP/MLD traffic.
828bd670b35SErik Nordmark */
829bd670b35SErik Nordmark
830bd670b35SErik Nordmark /* Caller already set flags */
831bd670b35SErik Nordmark ASSERT(ixa->ixa_flags & IXAF_IS_IPV4);
832bd670b35SErik Nordmark
833bd670b35SErik Nordmark ASSERT(ixa->ixa_nce == NULL);
834bd670b35SErik Nordmark
835bd670b35SErik Nordmark ixa->ixa_pktlen = ntohs(ipha->ipha_length);
836bd670b35SErik Nordmark ASSERT(ixa->ixa_pktlen == msgdsize(mp));
837bd670b35SErik Nordmark ixa->ixa_ip_hdr_length = IPH_HDR_LENGTH(ipha);
838bd670b35SErik Nordmark ixa->ixa_protocol = ipha->ipha_protocol;
839bd670b35SErik Nordmark
840bd670b35SErik Nordmark /*
841bd670b35SErik Nordmark * Assumes that source routed packets have already been massaged by
842bd670b35SErik Nordmark * the ULP (ip_massage_options) and as a result ipha_dst is the next
843bd670b35SErik Nordmark * hop in the source route. The final destination is used for IPsec
844bd670b35SErik Nordmark * policy and DCE lookup.
845bd670b35SErik Nordmark */
846bd670b35SErik Nordmark firsthop = ipha->ipha_dst;
847bd670b35SErik Nordmark dst = ip_get_dst(ipha);
848bd670b35SErik Nordmark
849bd670b35SErik Nordmark repeat_ire:
850bd670b35SErik Nordmark error = 0;
851bd670b35SErik Nordmark setsrc = INADDR_ANY;
85244b099c4SSowmini Varadhan ire = ip_select_route_v4(firsthop, ipha->ipha_src, ixa, NULL,
85344b099c4SSowmini Varadhan &setsrc, &error, &multirt);
854bd670b35SErik Nordmark ASSERT(ire != NULL); /* IRE_NOROUTE if none found */
855bd670b35SErik Nordmark if (error != 0) {
856bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
857bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
858bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - select route", mp, NULL);
859bd670b35SErik Nordmark freemsg(mp);
860bd670b35SErik Nordmark goto done;
861bd670b35SErik Nordmark }
862bd670b35SErik Nordmark
863bd670b35SErik Nordmark if (ire->ire_flags & (RTF_BLACKHOLE|RTF_REJECT)) {
864bd670b35SErik Nordmark /* ire_ill might be NULL hence need to skip some code */
865bd670b35SErik Nordmark if (ixaflags & IXAF_SET_SOURCE)
866bd670b35SErik Nordmark ipha->ipha_src = htonl(INADDR_LOOPBACK);
867bd670b35SErik Nordmark ixa->ixa_fragsize = IP_MAXPACKET;
868bd670b35SErik Nordmark ill = NULL;
869bd670b35SErik Nordmark nce = NULL;
870bd670b35SErik Nordmark ire->ire_ob_pkt_count++;
871bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
872bd670b35SErik Nordmark /* No dce yet; use default one */
873bd670b35SErik Nordmark error = (ire->ire_sendfn)(ire, mp, ipha, ixa,
874bd670b35SErik Nordmark &ipst->ips_dce_default->dce_ident);
875bd670b35SErik Nordmark goto done;
876bd670b35SErik Nordmark }
877bd670b35SErik Nordmark
878bd670b35SErik Nordmark /* Note that ipha_dst is only used for IRE_MULTICAST */
879bd670b35SErik Nordmark nce = ire_to_nce(ire, ipha->ipha_dst, NULL);
880bd670b35SErik Nordmark if (nce == NULL) {
881bd670b35SErik Nordmark /* Allocation failure? */
882bd670b35SErik Nordmark ip_drop_output("ire_to_nce", mp, ill);
883bd670b35SErik Nordmark freemsg(mp);
884bd670b35SErik Nordmark error = ENOBUFS;
885bd670b35SErik Nordmark goto done;
886bd670b35SErik Nordmark }
887bd670b35SErik Nordmark if (nce->nce_is_condemned) {
888bd670b35SErik Nordmark nce_t *nce1;
889bd670b35SErik Nordmark
890bd670b35SErik Nordmark nce1 = ire_handle_condemned_nce(nce, ire, ipha, NULL, B_TRUE);
891bd670b35SErik Nordmark nce_refrele(nce);
892bd670b35SErik Nordmark if (nce1 == NULL) {
893bd670b35SErik Nordmark if (!repeat) {
894bd670b35SErik Nordmark /* Try finding a better IRE */
895bd670b35SErik Nordmark repeat = B_TRUE;
896bd670b35SErik Nordmark ire_refrele(ire);
897bd670b35SErik Nordmark goto repeat_ire;
898bd670b35SErik Nordmark }
899bd670b35SErik Nordmark /* Tried twice - drop packet */
900bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
901bd670b35SErik Nordmark ip_drop_output("No nce", mp, ill);
902bd670b35SErik Nordmark freemsg(mp);
903bd670b35SErik Nordmark error = ENOBUFS;
904bd670b35SErik Nordmark goto done;
905bd670b35SErik Nordmark }
906bd670b35SErik Nordmark nce = nce1;
907bd670b35SErik Nordmark }
908bd670b35SErik Nordmark
909bd670b35SErik Nordmark /*
910bd670b35SErik Nordmark * For multicast with multirt we have a flag passed back from
911bd670b35SErik Nordmark * ire_lookup_multi_ill_v4 since we don't have an IRE for each
912bd670b35SErik Nordmark * possible multicast address.
913bd670b35SErik Nordmark * We also need a flag for multicast since we can't check
914bd670b35SErik Nordmark * whether RTF_MULTIRT is set in ixa_ire for multicast.
915bd670b35SErik Nordmark */
916bd670b35SErik Nordmark if (multirt) {
917bd670b35SErik Nordmark ixa->ixa_postfragfn = ip_postfrag_multirt_v4;
918bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_MULTIRT_MULTICAST;
919bd670b35SErik Nordmark } else {
920bd670b35SErik Nordmark ixa->ixa_postfragfn = ire->ire_postfragfn;
921bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_MULTIRT_MULTICAST;
922bd670b35SErik Nordmark }
923bd670b35SErik Nordmark ASSERT(ixa->ixa_nce == NULL);
924bd670b35SErik Nordmark ixa->ixa_nce = nce;
925bd670b35SErik Nordmark
926bd670b35SErik Nordmark /*
927bd670b35SErik Nordmark * Check for a dce_t with a path mtu.
928bd670b35SErik Nordmark */
929bd670b35SErik Nordmark dce = dce_lookup_v4(dst, ipst, NULL);
930bd670b35SErik Nordmark ASSERT(dce != NULL);
931bd670b35SErik Nordmark
932bd670b35SErik Nordmark if (!(ixaflags & IXAF_PMTU_DISCOVERY)) {
933bd670b35SErik Nordmark ixa->ixa_fragsize = ip_get_base_mtu(nce->nce_ill, ire);
934bd670b35SErik Nordmark } else if (dce->dce_flags & DCEF_PMTU) {
935bd670b35SErik Nordmark /*
936bd670b35SErik Nordmark * To avoid a periodic timer to increase the path MTU we
937bd670b35SErik Nordmark * look at dce_last_change_time each time we send a packet.
938bd670b35SErik Nordmark */
939d3d50737SRafael Vanoni now = ddi_get_lbolt64();
940d3d50737SRafael Vanoni if (TICK_TO_SEC(now) - dce->dce_last_change_time >
941bd670b35SErik Nordmark ipst->ips_ip_pathmtu_interval) {
942bd670b35SErik Nordmark /*
943bd670b35SErik Nordmark * Older than 20 minutes. Drop the path MTU information.
944bd670b35SErik Nordmark */
945bd670b35SErik Nordmark mutex_enter(&dce->dce_lock);
946bd670b35SErik Nordmark dce->dce_flags &= ~(DCEF_PMTU|DCEF_TOO_SMALL_PMTU);
947d3d50737SRafael Vanoni dce->dce_last_change_time = TICK_TO_SEC(now);
948bd670b35SErik Nordmark mutex_exit(&dce->dce_lock);
949bd670b35SErik Nordmark dce_increment_generation(dce);
950bd670b35SErik Nordmark ixa->ixa_fragsize = ip_get_base_mtu(nce->nce_ill, ire);
951bd670b35SErik Nordmark } else {
952bd670b35SErik Nordmark uint_t fragsize;
953bd670b35SErik Nordmark
954bd670b35SErik Nordmark fragsize = ip_get_base_mtu(nce->nce_ill, ire);
955bd670b35SErik Nordmark if (fragsize > dce->dce_pmtu)
956bd670b35SErik Nordmark fragsize = dce->dce_pmtu;
957bd670b35SErik Nordmark ixa->ixa_fragsize = fragsize;
958bd670b35SErik Nordmark }
959bd670b35SErik Nordmark } else {
960bd670b35SErik Nordmark ixa->ixa_fragsize = ip_get_base_mtu(nce->nce_ill, ire);
961bd670b35SErik Nordmark }
962bd670b35SErik Nordmark
963bd670b35SErik Nordmark /*
964bd670b35SErik Nordmark * We use use ire_nexthop_ill (and not ncec_ill) to avoid the under ipmp
965bd670b35SErik Nordmark * interface for source address selection.
966bd670b35SErik Nordmark */
967bd670b35SErik Nordmark ill = ire_nexthop_ill(ire);
968bd670b35SErik Nordmark
969bd670b35SErik Nordmark if (ixaflags & IXAF_SET_SOURCE) {
970bd670b35SErik Nordmark ipaddr_t src;
971bd670b35SErik Nordmark
972bd670b35SErik Nordmark /*
973bd670b35SErik Nordmark * We use the final destination to get
974bd670b35SErik Nordmark * correct selection for source routed packets
975bd670b35SErik Nordmark */
976bd670b35SErik Nordmark
977bd670b35SErik Nordmark /* If unreachable we have no ill but need some source */
978bd670b35SErik Nordmark if (ill == NULL) {
979bd670b35SErik Nordmark src = htonl(INADDR_LOOPBACK);
980bd670b35SErik Nordmark error = 0;
981bd670b35SErik Nordmark } else {
982bd670b35SErik Nordmark error = ip_select_source_v4(ill, setsrc, dst,
983bd670b35SErik Nordmark ixa->ixa_multicast_ifaddr, ixa->ixa_zoneid, ipst,
984bd670b35SErik Nordmark &src, NULL, NULL);
985bd670b35SErik Nordmark }
986bd670b35SErik Nordmark if (error != 0) {
987bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutRequests);
988bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
989bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - no source",
990bd670b35SErik Nordmark mp, ill);
991bd670b35SErik Nordmark freemsg(mp);
992bd670b35SErik Nordmark goto done;
993bd670b35SErik Nordmark }
994bd670b35SErik Nordmark ipha->ipha_src = src;
995bd670b35SErik Nordmark } else if (ixaflags & IXAF_VERIFY_SOURCE) {
996bd670b35SErik Nordmark /* Check if the IP source is assigned to the host. */
997bd670b35SErik Nordmark if (!ip_verify_src(mp, ixa, NULL)) {
998bd670b35SErik Nordmark /* Don't send a packet with a source that isn't ours */
999bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
1000bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
1001bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - invalid source",
1002bd670b35SErik Nordmark mp, ill);
1003bd670b35SErik Nordmark freemsg(mp);
1004bd670b35SErik Nordmark error = EADDRNOTAVAIL;
1005bd670b35SErik Nordmark goto done;
1006bd670b35SErik Nordmark }
1007bd670b35SErik Nordmark }
1008bd670b35SErik Nordmark
1009bd670b35SErik Nordmark
1010bd670b35SErik Nordmark /*
1011bd670b35SErik Nordmark * Check against global IPsec policy to set the AH/ESP attributes.
1012bd670b35SErik Nordmark * IPsec will set IXAF_IPSEC_* and ixa_ipsec_* as appropriate.
1013bd670b35SErik Nordmark */
1014bd670b35SErik Nordmark if (!(ixaflags & (IXAF_NO_IPSEC|IXAF_IPSEC_SECURE))) {
1015bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_policy == NULL);
1016bd670b35SErik Nordmark mp = ip_output_attach_policy(mp, ipha, NULL, NULL, ixa);
1017bd670b35SErik Nordmark if (mp == NULL) {
1018bd670b35SErik Nordmark /* MIB and ip_drop_packet already done */
1019bd670b35SErik Nordmark return (EHOSTUNREACH); /* IPsec policy failure */
1020bd670b35SErik Nordmark }
1021bd670b35SErik Nordmark }
1022bd670b35SErik Nordmark
1023bd670b35SErik Nordmark if (ill != NULL) {
1024bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCOutRequests);
1025bd670b35SErik Nordmark } else {
1026bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsHCOutRequests);
1027bd670b35SErik Nordmark }
1028bd670b35SErik Nordmark
1029bd670b35SErik Nordmark /*
1030bd670b35SErik Nordmark * We update the statistics on the most specific IRE i.e., the first
1031bd670b35SErik Nordmark * one we found.
1032bd670b35SErik Nordmark * We don't have an IRE when we fragment, hence ire_ob_pkt_count
1033bd670b35SErik Nordmark * can only count the use prior to fragmentation. However the MIB
1034bd670b35SErik Nordmark * counters on the ill will be incremented in post fragmentation.
1035bd670b35SErik Nordmark */
1036bd670b35SErik Nordmark ire->ire_ob_pkt_count++;
1037bd670b35SErik Nordmark
1038bd670b35SErik Nordmark /*
1039bd670b35SErik Nordmark * Based on ire_type and ire_flags call one of:
1040bd670b35SErik Nordmark * ire_send_local_v4 - for IRE_LOCAL and IRE_LOOPBACK
1041bd670b35SErik Nordmark * ire_send_multirt_v4 - if RTF_MULTIRT
1042bd670b35SErik Nordmark * ire_send_noroute_v4 - if RTF_REJECT or RTF_BLACHOLE
1043bd670b35SErik Nordmark * ire_send_multicast_v4 - for IRE_MULTICAST
1044bd670b35SErik Nordmark * ire_send_broadcast_v4 - for IRE_BROADCAST
1045bd670b35SErik Nordmark * ire_send_wire_v4 - for the rest.
1046bd670b35SErik Nordmark */
1047bd670b35SErik Nordmark error = (ire->ire_sendfn)(ire, mp, ipha, ixa, &dce->dce_ident);
1048bd670b35SErik Nordmark done:
1049bd670b35SErik Nordmark ire_refrele(ire);
1050bd670b35SErik Nordmark if (dce != NULL)
1051bd670b35SErik Nordmark dce_refrele(dce);
1052bd670b35SErik Nordmark if (ill != NULL)
1053bd670b35SErik Nordmark ill_refrele(ill);
1054bd670b35SErik Nordmark if (ixa->ixa_nce != NULL)
1055bd670b35SErik Nordmark nce_refrele(ixa->ixa_nce);
1056bd670b35SErik Nordmark ixa->ixa_nce = NULL;
1057bd670b35SErik Nordmark return (error);
1058bd670b35SErik Nordmark }
1059bd670b35SErik Nordmark
1060bd670b35SErik Nordmark /*
1061bd670b35SErik Nordmark * ire_sendfn() functions.
1062bd670b35SErik Nordmark * These functions use the following xmit_attr:
1063bd670b35SErik Nordmark * - ixa_fragsize - read to determine whether or not to fragment
1064bd670b35SErik Nordmark * - IXAF_IPSEC_SECURE - to determine whether or not to invoke IPsec
1065bd670b35SErik Nordmark * - ixa_ipsec_* are used inside IPsec
1066bd670b35SErik Nordmark * - IXAF_SET_SOURCE - replace IP source in broadcast case.
1067bd670b35SErik Nordmark * - IXAF_LOOPBACK_COPY - for multicast and broadcast
1068bd670b35SErik Nordmark */
1069bd670b35SErik Nordmark
1070bd670b35SErik Nordmark
1071bd670b35SErik Nordmark /*
1072bd670b35SErik Nordmark * ire_sendfn for IRE_LOCAL and IRE_LOOPBACK
1073bd670b35SErik Nordmark *
1074bd670b35SErik Nordmark * The checks for restrict_interzone_loopback are done in ire_route_recursive.
1075bd670b35SErik Nordmark */
1076bd670b35SErik Nordmark /* ARGSUSED4 */
1077bd670b35SErik Nordmark int
ire_send_local_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_xmit_attr_t * ixa,uint32_t * identp)1078bd670b35SErik Nordmark ire_send_local_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1079bd670b35SErik Nordmark ip_xmit_attr_t *ixa, uint32_t *identp)
1080bd670b35SErik Nordmark {
1081bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)iph_arg;
1082bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1083bd670b35SErik Nordmark ill_t *ill = ire->ire_ill;
1084bd670b35SErik Nordmark ip_recv_attr_t iras; /* NOTE: No bzero for performance */
1085bd670b35SErik Nordmark uint_t pktlen = ixa->ixa_pktlen;
1086bd670b35SErik Nordmark
1087bd670b35SErik Nordmark /*
1088bd670b35SErik Nordmark * No fragmentation, no nce, no application of IPsec,
1089bd670b35SErik Nordmark * and no ipha_ident assignment.
1090bd670b35SErik Nordmark *
1091bd670b35SErik Nordmark * Note different order between IP provider and FW_HOOKS than in
1092bd670b35SErik Nordmark * send_wire case.
1093bd670b35SErik Nordmark */
1094bd670b35SErik Nordmark
1095bd670b35SErik Nordmark /*
1096bd670b35SErik Nordmark * DTrace this as ip:::send. A packet blocked by FW_HOOKS will fire the
1097bd670b35SErik Nordmark * send probe, but not the receive probe.
1098bd670b35SErik Nordmark */
1099bd670b35SErik Nordmark DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
1100bd670b35SErik Nordmark ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *, NULL,
1101bd670b35SErik Nordmark int, 1);
1102bd670b35SErik Nordmark
1103bd670b35SErik Nordmark if (HOOKS4_INTERESTED_LOOPBACK_OUT(ipst)) {
1104ab82c29bSToomas Soome int error = 0;
1105bd670b35SErik Nordmark
1106bd670b35SErik Nordmark DTRACE_PROBE4(ip4__loopback__out__start, ill_t *, NULL,
1107bd670b35SErik Nordmark ill_t *, ill, ipha_t *, ipha, mblk_t *, mp);
1108bd670b35SErik Nordmark FW_HOOKS(ipst->ips_ip4_loopback_out_event,
1109bd670b35SErik Nordmark ipst->ips_ipv4firewall_loopback_out,
1110bd670b35SErik Nordmark NULL, ill, ipha, mp, mp, 0, ipst, error);
1111bd670b35SErik Nordmark DTRACE_PROBE1(ip4__loopback__out__end, mblk_t *, mp);
1112bd670b35SErik Nordmark if (mp == NULL)
1113bd670b35SErik Nordmark return (error);
1114bd670b35SErik Nordmark
1115bd670b35SErik Nordmark /*
1116bd670b35SErik Nordmark * Even if the destination was changed by the filter we use the
1117bd670b35SErik Nordmark * forwarding decision that was made based on the address
1118bd670b35SErik Nordmark * in ip_output/ip_set_destination.
1119bd670b35SErik Nordmark */
1120bd670b35SErik Nordmark /* Length could be different */
1121bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr;
1122bd670b35SErik Nordmark pktlen = ntohs(ipha->ipha_length);
1123bd670b35SErik Nordmark }
1124bd670b35SErik Nordmark
1125bd670b35SErik Nordmark /*
1126bd670b35SErik Nordmark * If a callback is enabled then we need to know the
1127bd670b35SErik Nordmark * source and destination zoneids for the packet. We already
1128bd670b35SErik Nordmark * have those handy.
1129bd670b35SErik Nordmark */
1130bd670b35SErik Nordmark if (ipst->ips_ip4_observe.he_interested) {
1131bd670b35SErik Nordmark zoneid_t szone, dzone;
1132bd670b35SErik Nordmark zoneid_t stackzoneid;
1133bd670b35SErik Nordmark
1134bd670b35SErik Nordmark stackzoneid = netstackid_to_zoneid(
1135bd670b35SErik Nordmark ipst->ips_netstack->netstack_stackid);
1136bd670b35SErik Nordmark
1137bd670b35SErik Nordmark if (stackzoneid == GLOBAL_ZONEID) {
1138bd670b35SErik Nordmark /* Shared-IP zone */
1139bd670b35SErik Nordmark dzone = ire->ire_zoneid;
1140bd670b35SErik Nordmark szone = ixa->ixa_zoneid;
1141bd670b35SErik Nordmark } else {
1142bd670b35SErik Nordmark szone = dzone = stackzoneid;
1143bd670b35SErik Nordmark }
1144bd670b35SErik Nordmark ipobs_hook(mp, IPOBS_HOOK_LOCAL, szone, dzone, ill, ipst);
1145bd670b35SErik Nordmark }
1146bd670b35SErik Nordmark
1147bd670b35SErik Nordmark /* Handle lo0 stats */
1148bd670b35SErik Nordmark ipst->ips_loopback_packets++;
1149bd670b35SErik Nordmark
1150bd670b35SErik Nordmark /* Map ixa to ira including IPsec policies */
1151bd670b35SErik Nordmark ipsec_out_to_in(ixa, ill, &iras);
1152bd670b35SErik Nordmark iras.ira_pktlen = pktlen;
1153bd670b35SErik Nordmark
1154bd670b35SErik Nordmark if (!IS_SIMPLE_IPH(ipha)) {
1155bd670b35SErik Nordmark ip_output_local_options(ipha, ipst);
1156bd670b35SErik Nordmark iras.ira_flags |= IRAF_IPV4_OPTIONS;
1157bd670b35SErik Nordmark }
1158bd670b35SErik Nordmark
1159bd670b35SErik Nordmark if (HOOKS4_INTERESTED_LOOPBACK_IN(ipst)) {
1160ab82c29bSToomas Soome int error = 0;
1161bd670b35SErik Nordmark
1162bd670b35SErik Nordmark DTRACE_PROBE4(ip4__loopback__in__start, ill_t *, ill,
1163bd670b35SErik Nordmark ill_t *, NULL, ipha_t *, ipha, mblk_t *, mp);
1164bd670b35SErik Nordmark FW_HOOKS(ipst->ips_ip4_loopback_in_event,
1165bd670b35SErik Nordmark ipst->ips_ipv4firewall_loopback_in,
1166bd670b35SErik Nordmark ill, NULL, ipha, mp, mp, 0, ipst, error);
1167bd670b35SErik Nordmark
1168bd670b35SErik Nordmark DTRACE_PROBE1(ip4__loopback__in__end, mblk_t *, mp);
1169bd670b35SErik Nordmark if (mp == NULL) {
1170bd670b35SErik Nordmark ira_cleanup(&iras, B_FALSE);
1171bd670b35SErik Nordmark return (error);
1172bd670b35SErik Nordmark }
1173bd670b35SErik Nordmark /*
1174bd670b35SErik Nordmark * Even if the destination was changed by the filter we use the
1175bd670b35SErik Nordmark * forwarding decision that was made based on the address
1176bd670b35SErik Nordmark * in ip_output/ip_set_destination.
1177bd670b35SErik Nordmark */
1178bd670b35SErik Nordmark /* Length could be different */
1179bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr;
1180bd670b35SErik Nordmark pktlen = iras.ira_pktlen = ntohs(ipha->ipha_length);
1181bd670b35SErik Nordmark }
1182bd670b35SErik Nordmark
1183bd670b35SErik Nordmark DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
1184bd670b35SErik Nordmark ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *, NULL,
1185bd670b35SErik Nordmark int, 1);
1186bd670b35SErik Nordmark
1187bd670b35SErik Nordmark ire->ire_ib_pkt_count++;
1188bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
1189bd670b35SErik Nordmark UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets, pktlen);
1190bd670b35SErik Nordmark
1191bd670b35SErik Nordmark /* Destined to ire_zoneid - use that for fanout */
1192bd670b35SErik Nordmark iras.ira_zoneid = ire->ire_zoneid;
1193bd670b35SErik Nordmark
1194bd670b35SErik Nordmark if (is_system_labeled()) {
1195bd670b35SErik Nordmark iras.ira_flags |= IRAF_SYSTEM_LABELED;
1196bd670b35SErik Nordmark
1197bd670b35SErik Nordmark /*
1198bd670b35SErik Nordmark * This updates ira_cred, ira_tsl and ira_free_flags based
1199bd670b35SErik Nordmark * on the label. We don't expect this to ever fail for
1200bd670b35SErik Nordmark * loopback packets, so we silently drop the packet should it
1201bd670b35SErik Nordmark * fail.
1202bd670b35SErik Nordmark */
1203bd670b35SErik Nordmark if (!tsol_get_pkt_label(mp, IPV4_VERSION, &iras)) {
1204bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
1205bd670b35SErik Nordmark ip_drop_input("tsol_get_pkt_label", mp, ill);
1206bd670b35SErik Nordmark freemsg(mp);
1207bd670b35SErik Nordmark return (0);
1208bd670b35SErik Nordmark }
1209bd670b35SErik Nordmark ASSERT(iras.ira_tsl != NULL);
1210bd670b35SErik Nordmark
1211bd670b35SErik Nordmark /* tsol_get_pkt_label sometimes does pullupmsg */
1212bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr;
1213bd670b35SErik Nordmark }
1214bd670b35SErik Nordmark
1215bd670b35SErik Nordmark ip_fanout_v4(mp, ipha, &iras);
1216bd670b35SErik Nordmark
1217bd670b35SErik Nordmark /* We moved any IPsec refs from ixa to iras */
1218bd670b35SErik Nordmark ira_cleanup(&iras, B_FALSE);
1219bd670b35SErik Nordmark return (0);
1220bd670b35SErik Nordmark }
1221bd670b35SErik Nordmark
1222bd670b35SErik Nordmark /*
1223bd670b35SErik Nordmark * ire_sendfn for IRE_BROADCAST
1224bd670b35SErik Nordmark * If the broadcast address is present on multiple ills and ixa_ifindex
1225bd670b35SErik Nordmark * isn't set, then we generate
1226bd670b35SErik Nordmark * a separate datagram (potentially with different source address) for
1227bd670b35SErik Nordmark * those ills. In any case, only one copy is looped back to ip_input_v4.
1228bd670b35SErik Nordmark */
1229bd670b35SErik Nordmark int
ire_send_broadcast_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_xmit_attr_t * ixa,uint32_t * identp)1230bd670b35SErik Nordmark ire_send_broadcast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1231bd670b35SErik Nordmark ip_xmit_attr_t *ixa, uint32_t *identp)
1232bd670b35SErik Nordmark {
1233bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)iph_arg;
1234bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1235bd670b35SErik Nordmark irb_t *irb = ire->ire_bucket;
1236bd670b35SErik Nordmark ire_t *ire1;
1237bd670b35SErik Nordmark mblk_t *mp1;
1238bd670b35SErik Nordmark ipha_t *ipha1;
1239bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags;
1240bd670b35SErik Nordmark nce_t *nce1, *nce_orig;
1241bd670b35SErik Nordmark
1242bd670b35SErik Nordmark /*
1243bd670b35SErik Nordmark * Unless ire_send_multirt_v4 already set a ttl, force the
1244bd670b35SErik Nordmark * ttl to a smallish value.
1245bd670b35SErik Nordmark */
1246bd670b35SErik Nordmark if (!(ixa->ixa_flags & IXAF_NO_TTL_CHANGE)) {
1247bd670b35SErik Nordmark /*
1248bd670b35SErik Nordmark * To avoid broadcast storms, we usually set the TTL to 1 for
1249bd670b35SErik Nordmark * broadcasts. This can
1250bd670b35SErik Nordmark * be overridden stack-wide through the ip_broadcast_ttl
1251bd670b35SErik Nordmark * ndd tunable, or on a per-connection basis through the
1252bd670b35SErik Nordmark * IP_BROADCAST_TTL socket option.
1253bd670b35SErik Nordmark *
1254bd670b35SErik Nordmark * If SO_DONTROUTE/IXAF_DONTROUTE is set, then ire_send_wire_v4
1255bd670b35SErik Nordmark * will force ttl to one after we've set this.
1256bd670b35SErik Nordmark */
1257bd670b35SErik Nordmark if (ixaflags & IXAF_BROADCAST_TTL_SET)
1258bd670b35SErik Nordmark ipha->ipha_ttl = ixa->ixa_broadcast_ttl;
1259bd670b35SErik Nordmark else
1260bd670b35SErik Nordmark ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
1261bd670b35SErik Nordmark }
1262bd670b35SErik Nordmark /*
1263bd670b35SErik Nordmark * Make sure we get a loopback copy (after IPsec and frag)
1264bd670b35SErik Nordmark * Skip hardware checksum so that loopback copy is checksumed.
1265bd670b35SErik Nordmark */
1266bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_LOOPBACK_COPY | IXAF_NO_HW_CKSUM;
1267bd670b35SErik Nordmark
1268bd670b35SErik Nordmark /* Do we need to potentially generate multiple copies? */
1269bd670b35SErik Nordmark if (irb->irb_ire_cnt == 1 || ixa->ixa_ifindex != 0)
1270bd670b35SErik Nordmark return (ire_send_wire_v4(ire, mp, ipha, ixa, identp));
1271bd670b35SErik Nordmark
1272bd670b35SErik Nordmark /*
1273bd670b35SErik Nordmark * Loop over all IRE_BROADCAST in the bucket (might only be one).
1274bd670b35SErik Nordmark * Note that everything in the bucket has the same destination address.
1275bd670b35SErik Nordmark */
1276bd670b35SErik Nordmark irb_refhold(irb);
1277bd670b35SErik Nordmark for (ire1 = irb->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
1278bd670b35SErik Nordmark /* We do the main IRE after the end of the loop */
1279bd670b35SErik Nordmark if (ire1 == ire)
1280bd670b35SErik Nordmark continue;
1281bd670b35SErik Nordmark
1282bd670b35SErik Nordmark /*
1283bd670b35SErik Nordmark * Only IREs for the same IP address should be in the same
1284bd670b35SErik Nordmark * bucket.
1285bd670b35SErik Nordmark * But could have IRE_HOSTs in the case of CGTP.
1286bd670b35SErik Nordmark * If we find any multirt routes we bail out of the loop
1287bd670b35SErik Nordmark * and just do the single packet at the end; ip_postfrag_multirt
1288bd670b35SErik Nordmark * will duplicate the packet.
1289bd670b35SErik Nordmark */
1290bd670b35SErik Nordmark ASSERT(ire1->ire_addr == ire->ire_addr);
1291bd670b35SErik Nordmark if (!(ire1->ire_type & IRE_BROADCAST))
1292bd670b35SErik Nordmark continue;
1293bd670b35SErik Nordmark
1294bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire1))
1295bd670b35SErik Nordmark continue;
1296bd670b35SErik Nordmark
1297bd670b35SErik Nordmark if (ixa->ixa_zoneid != ALL_ZONES &&
1298bd670b35SErik Nordmark ire->ire_zoneid != ire1->ire_zoneid)
1299bd670b35SErik Nordmark continue;
1300bd670b35SErik Nordmark
1301bd670b35SErik Nordmark ASSERT(ire->ire_ill != ire1->ire_ill && ire1->ire_ill != NULL);
1302bd670b35SErik Nordmark
1303bd670b35SErik Nordmark if (ire1->ire_flags & RTF_MULTIRT)
1304bd670b35SErik Nordmark break;
1305bd670b35SErik Nordmark
1306bd670b35SErik Nordmark /*
1307bd670b35SErik Nordmark * For IPMP we only send for the ipmp_ill. arp_nce_init() will
1308bd670b35SErik Nordmark * ensure that this goes out on the cast_ill.
1309bd670b35SErik Nordmark */
1310bd670b35SErik Nordmark if (IS_UNDER_IPMP(ire1->ire_ill))
1311bd670b35SErik Nordmark continue;
1312bd670b35SErik Nordmark
1313bd670b35SErik Nordmark mp1 = copymsg(mp);
1314bd670b35SErik Nordmark if (mp1 == NULL) {
1315bd670b35SErik Nordmark BUMP_MIB(ire1->ire_ill->ill_ip_mib,
1316bd670b35SErik Nordmark ipIfStatsOutDiscards);
1317bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards",
1318bd670b35SErik Nordmark mp, ire1->ire_ill);
1319bd670b35SErik Nordmark continue;
1320bd670b35SErik Nordmark }
1321bd670b35SErik Nordmark
1322bd670b35SErik Nordmark ipha1 = (ipha_t *)mp1->b_rptr;
1323bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_SET_SOURCE) {
1324bd670b35SErik Nordmark /*
1325bd670b35SErik Nordmark * Need to pick a different source address for each
1326bd670b35SErik Nordmark * interface. If we have a global IPsec policy and
1327bd670b35SErik Nordmark * no per-socket policy then we punt to
1328bd670b35SErik Nordmark * ip_output_simple_v4 using a separate ip_xmit_attr_t.
1329bd670b35SErik Nordmark */
1330bd670b35SErik Nordmark if (ixaflags & IXAF_IPSEC_GLOBAL_POLICY) {
1331bd670b35SErik Nordmark ip_output_simple_broadcast(ixa, mp1);
1332bd670b35SErik Nordmark continue;
1333bd670b35SErik Nordmark }
1334bd670b35SErik Nordmark /* Pick a new source address for each interface */
1335bd670b35SErik Nordmark if (ip_select_source_v4(ire1->ire_ill, INADDR_ANY,
1336bd670b35SErik Nordmark ipha1->ipha_dst, INADDR_ANY, ixa->ixa_zoneid, ipst,
1337bd670b35SErik Nordmark &ipha1->ipha_src, NULL, NULL) != 0) {
1338bd670b35SErik Nordmark BUMP_MIB(ire1->ire_ill->ill_ip_mib,
1339bd670b35SErik Nordmark ipIfStatsOutDiscards);
1340bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - select "
1341bd670b35SErik Nordmark "broadcast source", mp1, ire1->ire_ill);
1342bd670b35SErik Nordmark freemsg(mp1);
1343bd670b35SErik Nordmark continue;
1344bd670b35SErik Nordmark }
1345bd670b35SErik Nordmark /*
1346bd670b35SErik Nordmark * Check against global IPsec policy to set the AH/ESP
1347bd670b35SErik Nordmark * attributes. IPsec will set IXAF_IPSEC_* and
1348bd670b35SErik Nordmark * ixa_ipsec_* as appropriate.
1349bd670b35SErik Nordmark */
1350bd670b35SErik Nordmark if (!(ixaflags & (IXAF_NO_IPSEC|IXAF_IPSEC_SECURE))) {
1351bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_policy == NULL);
1352bd670b35SErik Nordmark mp1 = ip_output_attach_policy(mp1, ipha, NULL,
1353bd670b35SErik Nordmark NULL, ixa);
1354bd670b35SErik Nordmark if (mp1 == NULL) {
1355bd670b35SErik Nordmark /*
1356bd670b35SErik Nordmark * MIB and ip_drop_packet already
1357bd670b35SErik Nordmark * done
1358bd670b35SErik Nordmark */
1359bd670b35SErik Nordmark continue;
1360bd670b35SErik Nordmark }
1361bd670b35SErik Nordmark }
1362bd670b35SErik Nordmark }
1363bd670b35SErik Nordmark /* Make sure we have an NCE on this ill */
1364bd670b35SErik Nordmark nce1 = arp_nce_init(ire1->ire_ill, ire1->ire_addr,
1365bd670b35SErik Nordmark ire1->ire_type);
1366bd670b35SErik Nordmark if (nce1 == NULL) {
1367bd670b35SErik Nordmark BUMP_MIB(ire1->ire_ill->ill_ip_mib,
1368bd670b35SErik Nordmark ipIfStatsOutDiscards);
1369bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - broadcast nce",
1370bd670b35SErik Nordmark mp1, ire1->ire_ill);
1371bd670b35SErik Nordmark freemsg(mp1);
1372bd670b35SErik Nordmark continue;
1373bd670b35SErik Nordmark }
1374bd670b35SErik Nordmark nce_orig = ixa->ixa_nce;
1375bd670b35SErik Nordmark ixa->ixa_nce = nce1;
1376bd670b35SErik Nordmark
1377bd670b35SErik Nordmark ire_refhold(ire1);
1378bd670b35SErik Nordmark /*
1379bd670b35SErik Nordmark * Ignore any errors here. We just collect the errno for
1380bd670b35SErik Nordmark * the main ire below
1381bd670b35SErik Nordmark */
1382bd670b35SErik Nordmark (void) ire_send_wire_v4(ire1, mp1, ipha1, ixa, identp);
1383bd670b35SErik Nordmark ire_refrele(ire1);
1384bd670b35SErik Nordmark
1385bd670b35SErik Nordmark ixa->ixa_nce = nce_orig;
1386bd670b35SErik Nordmark nce_refrele(nce1);
1387bd670b35SErik Nordmark
1388bd670b35SErik Nordmark ixa->ixa_flags &= ~IXAF_LOOPBACK_COPY;
1389bd670b35SErik Nordmark }
1390bd670b35SErik Nordmark irb_refrele(irb);
1391bd670b35SErik Nordmark /* Finally, the main one */
1392bd670b35SErik Nordmark
1393bd670b35SErik Nordmark /*
1394bd670b35SErik Nordmark * For IPMP we only send broadcasts on the ipmp_ill.
1395bd670b35SErik Nordmark */
1396bd670b35SErik Nordmark if (IS_UNDER_IPMP(ire->ire_ill)) {
1397bd670b35SErik Nordmark freemsg(mp);
1398bd670b35SErik Nordmark return (0);
1399bd670b35SErik Nordmark }
1400bd670b35SErik Nordmark
1401bd670b35SErik Nordmark return (ire_send_wire_v4(ire, mp, ipha, ixa, identp));
1402bd670b35SErik Nordmark }
1403bd670b35SErik Nordmark
1404bd670b35SErik Nordmark /*
1405bd670b35SErik Nordmark * Send a packet using a different source address and different
1406bd670b35SErik Nordmark * IPsec policy.
1407bd670b35SErik Nordmark */
1408bd670b35SErik Nordmark static void
ip_output_simple_broadcast(ip_xmit_attr_t * ixa,mblk_t * mp)1409bd670b35SErik Nordmark ip_output_simple_broadcast(ip_xmit_attr_t *ixa, mblk_t *mp)
1410bd670b35SErik Nordmark {
1411bd670b35SErik Nordmark ip_xmit_attr_t ixas;
1412bd670b35SErik Nordmark
1413bd670b35SErik Nordmark bzero(&ixas, sizeof (ixas));
1414bd670b35SErik Nordmark ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
1415bd670b35SErik Nordmark ixas.ixa_zoneid = ixa->ixa_zoneid;
1416bd670b35SErik Nordmark ixas.ixa_ifindex = 0;
1417bd670b35SErik Nordmark ixas.ixa_ipst = ixa->ixa_ipst;
1418bd670b35SErik Nordmark ixas.ixa_cred = ixa->ixa_cred;
1419bd670b35SErik Nordmark ixas.ixa_cpid = ixa->ixa_cpid;
1420bd670b35SErik Nordmark ixas.ixa_tsl = ixa->ixa_tsl;
1421bd670b35SErik Nordmark ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1422bd670b35SErik Nordmark
1423bd670b35SErik Nordmark (void) ip_output_simple(mp, &ixas);
1424bd670b35SErik Nordmark ixa_cleanup(&ixas);
1425bd670b35SErik Nordmark }
1426bd670b35SErik Nordmark
1427bd670b35SErik Nordmark
1428bd670b35SErik Nordmark static void
multirt_check_v4(ire_t * ire,ipha_t * ipha,ip_xmit_attr_t * ixa)1429bd670b35SErik Nordmark multirt_check_v4(ire_t *ire, ipha_t *ipha, ip_xmit_attr_t *ixa)
1430bd670b35SErik Nordmark {
1431bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1432bd670b35SErik Nordmark
1433bd670b35SErik Nordmark /* Limit the TTL on multirt packets */
1434bd670b35SErik Nordmark if (ire->ire_type & IRE_MULTICAST) {
1435bd670b35SErik Nordmark if (ipha->ipha_ttl > 1) {
1436bd670b35SErik Nordmark ip2dbg(("ire_send_multirt_v4: forcing multicast "
1437bd670b35SErik Nordmark "multirt TTL to 1 (was %d), dst 0x%08x\n",
1438bd670b35SErik Nordmark ipha->ipha_ttl, ntohl(ire->ire_addr)));
1439bd670b35SErik Nordmark ipha->ipha_ttl = 1;
1440bd670b35SErik Nordmark }
1441bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_NO_TTL_CHANGE;
1442bd670b35SErik Nordmark } else if ((ipst->ips_ip_multirt_ttl > 0) &&
1443bd670b35SErik Nordmark (ipha->ipha_ttl > ipst->ips_ip_multirt_ttl)) {
1444bd670b35SErik Nordmark ipha->ipha_ttl = ipst->ips_ip_multirt_ttl;
1445bd670b35SErik Nordmark /*
1446bd670b35SErik Nordmark * Need to ensure we don't increase the ttl should we go through
1447bd670b35SErik Nordmark * ire_send_broadcast or multicast.
1448bd670b35SErik Nordmark */
1449bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_NO_TTL_CHANGE;
1450bd670b35SErik Nordmark }
1451bd670b35SErik Nordmark }
1452bd670b35SErik Nordmark
1453bd670b35SErik Nordmark /*
1454bd670b35SErik Nordmark * ire_sendfn for IRE_MULTICAST
1455bd670b35SErik Nordmark */
1456bd670b35SErik Nordmark int
ire_send_multicast_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_xmit_attr_t * ixa,uint32_t * identp)1457bd670b35SErik Nordmark ire_send_multicast_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1458bd670b35SErik Nordmark ip_xmit_attr_t *ixa, uint32_t *identp)
1459bd670b35SErik Nordmark {
1460bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)iph_arg;
1461bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1462bd670b35SErik Nordmark ill_t *ill = ire->ire_ill;
1463bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags;
1464bd670b35SErik Nordmark
1465bd670b35SErik Nordmark /*
1466bd670b35SErik Nordmark * The IRE_MULTICAST is the same whether or not multirt is in use.
1467bd670b35SErik Nordmark * Hence we need special-case code.
1468bd670b35SErik Nordmark */
1469bd670b35SErik Nordmark if (ixaflags & IXAF_MULTIRT_MULTICAST)
1470bd670b35SErik Nordmark multirt_check_v4(ire, ipha, ixa);
1471bd670b35SErik Nordmark
1472bd670b35SErik Nordmark /*
1473bd670b35SErik Nordmark * Check if anything in ip_input_v4 wants a copy of the transmitted
1474bd670b35SErik Nordmark * packet (after IPsec and fragmentation)
1475bd670b35SErik Nordmark *
1476bd670b35SErik Nordmark * 1. Multicast routers always need a copy unless SO_DONTROUTE is set
1477bd670b35SErik Nordmark * RSVP and the rsvp daemon is an example of a
1478bd670b35SErik Nordmark * protocol and user level process that
1479bd670b35SErik Nordmark * handles it's own routing. Hence, it uses the
1480bd670b35SErik Nordmark * SO_DONTROUTE option to accomplish this.
1481bd670b35SErik Nordmark * 2. If the sender has set IP_MULTICAST_LOOP, then we just
1482bd670b35SErik Nordmark * check whether there are any receivers for the group on the ill
1483bd670b35SErik Nordmark * (ignoring the zoneid).
1484bd670b35SErik Nordmark * 3. If IP_MULTICAST_LOOP is not set, then we check if there are
1485bd670b35SErik Nordmark * any members in other shared-IP zones.
1486bd670b35SErik Nordmark * If such members exist, then we indicate that the sending zone
1487bd670b35SErik Nordmark * shouldn't get a loopback copy to preserve the IP_MULTICAST_LOOP
1488bd670b35SErik Nordmark * behavior.
1489bd670b35SErik Nordmark *
1490bd670b35SErik Nordmark * When we loopback we skip hardware checksum to make sure loopback
1491bd670b35SErik Nordmark * copy is checksumed.
1492bd670b35SErik Nordmark *
1493bd670b35SErik Nordmark * Note that ire_ill is the upper in the case of IPMP.
1494bd670b35SErik Nordmark */
1495bd670b35SErik Nordmark ixa->ixa_flags &= ~(IXAF_LOOPBACK_COPY | IXAF_NO_HW_CKSUM);
1496bd670b35SErik Nordmark if (ipst->ips_ip_g_mrouter && ill->ill_mrouter_cnt > 0 &&
1497bd670b35SErik Nordmark !(ixaflags & IXAF_DONTROUTE)) {
1498bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_LOOPBACK_COPY | IXAF_NO_HW_CKSUM;
1499bd670b35SErik Nordmark } else if (ixaflags & IXAF_MULTICAST_LOOP) {
1500bd670b35SErik Nordmark /*
1501bd670b35SErik Nordmark * If this zone or any other zone has members then loopback
1502bd670b35SErik Nordmark * a copy.
1503bd670b35SErik Nordmark */
1504bd670b35SErik Nordmark if (ill_hasmembers_v4(ill, ipha->ipha_dst))
1505bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_LOOPBACK_COPY | IXAF_NO_HW_CKSUM;
1506bd670b35SErik Nordmark } else if (ipst->ips_netstack->netstack_numzones > 1) {
1507bd670b35SErik Nordmark /*
1508bd670b35SErik Nordmark * This zone should not have a copy. But there are some other
1509bd670b35SErik Nordmark * zones which might have members.
1510bd670b35SErik Nordmark */
1511bd670b35SErik Nordmark if (ill_hasmembers_otherzones_v4(ill, ipha->ipha_dst,
1512bd670b35SErik Nordmark ixa->ixa_zoneid)) {
1513bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_NO_LOOP_ZONEID_SET;
1514bd670b35SErik Nordmark ixa->ixa_no_loop_zoneid = ixa->ixa_zoneid;
1515bd670b35SErik Nordmark ixa->ixa_flags |= IXAF_LOOPBACK_COPY | IXAF_NO_HW_CKSUM;
1516bd670b35SErik Nordmark }
1517bd670b35SErik Nordmark }
1518bd670b35SErik Nordmark
1519bd670b35SErik Nordmark /*
1520bd670b35SErik Nordmark * Unless ire_send_multirt_v4 or icmp_output_hdrincl already set a ttl,
1521bd670b35SErik Nordmark * force the ttl to the IP_MULTICAST_TTL value
1522bd670b35SErik Nordmark */
1523bd670b35SErik Nordmark if (!(ixaflags & IXAF_NO_TTL_CHANGE)) {
1524bd670b35SErik Nordmark ipha->ipha_ttl = ixa->ixa_multicast_ttl;
1525bd670b35SErik Nordmark }
1526bd670b35SErik Nordmark
1527bd670b35SErik Nordmark return (ire_send_wire_v4(ire, mp, ipha, ixa, identp));
1528bd670b35SErik Nordmark }
1529bd670b35SErik Nordmark
1530bd670b35SErik Nordmark /*
1531bd670b35SErik Nordmark * ire_sendfn for IREs with RTF_MULTIRT
1532bd670b35SErik Nordmark */
1533bd670b35SErik Nordmark int
ire_send_multirt_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_xmit_attr_t * ixa,uint32_t * identp)1534bd670b35SErik Nordmark ire_send_multirt_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1535bd670b35SErik Nordmark ip_xmit_attr_t *ixa, uint32_t *identp)
1536bd670b35SErik Nordmark {
1537bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)iph_arg;
1538bd670b35SErik Nordmark
1539bd670b35SErik Nordmark multirt_check_v4(ire, ipha, ixa);
1540bd670b35SErik Nordmark
1541bd670b35SErik Nordmark if (ire->ire_type & IRE_MULTICAST)
1542bd670b35SErik Nordmark return (ire_send_multicast_v4(ire, mp, ipha, ixa, identp));
1543bd670b35SErik Nordmark else if (ire->ire_type & IRE_BROADCAST)
1544bd670b35SErik Nordmark return (ire_send_broadcast_v4(ire, mp, ipha, ixa, identp));
1545bd670b35SErik Nordmark else
1546bd670b35SErik Nordmark return (ire_send_wire_v4(ire, mp, ipha, ixa, identp));
1547bd670b35SErik Nordmark }
1548bd670b35SErik Nordmark
1549bd670b35SErik Nordmark /*
1550bd670b35SErik Nordmark * ire_sendfn for IREs with RTF_REJECT/RTF_BLACKHOLE, including IRE_NOROUTE
1551bd670b35SErik Nordmark */
1552bd670b35SErik Nordmark int
ire_send_noroute_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_xmit_attr_t * ixa,uint32_t * identp)1553bd670b35SErik Nordmark ire_send_noroute_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1554bd670b35SErik Nordmark ip_xmit_attr_t *ixa, uint32_t *identp)
1555bd670b35SErik Nordmark {
1556bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1557bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)iph_arg;
1558bd670b35SErik Nordmark ill_t *ill;
1559bd670b35SErik Nordmark ip_recv_attr_t iras;
1560bd670b35SErik Nordmark boolean_t dummy;
1561bd670b35SErik Nordmark
1562bd670b35SErik Nordmark /* We assign an IP ident for nice errors */
15631a5e258fSJosef 'Jeff' Sipek ipha->ipha_ident = atomic_inc_32_nv(identp);
1564bd670b35SErik Nordmark
1565bd670b35SErik Nordmark BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutNoRoutes);
1566bd670b35SErik Nordmark
1567bd670b35SErik Nordmark if (ire->ire_type & IRE_NOROUTE) {
1568bd670b35SErik Nordmark /* A lack of a route as opposed to RTF_REJECT|BLACKHOLE */
1569bd670b35SErik Nordmark ip_rts_change(RTM_MISS, ipha->ipha_dst, 0, 0, 0, 0, 0, 0,
1570bd670b35SErik Nordmark RTA_DST, ipst);
1571bd670b35SErik Nordmark }
1572bd670b35SErik Nordmark
1573bd670b35SErik Nordmark if (ire->ire_flags & RTF_BLACKHOLE) {
1574bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutNoRoutes RTF_BLACKHOLE", mp, NULL);
1575bd670b35SErik Nordmark freemsg(mp);
1576bd670b35SErik Nordmark /* No error even for local senders - silent blackhole */
1577bd670b35SErik Nordmark return (0);
1578bd670b35SErik Nordmark }
1579bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutNoRoutes RTF_REJECT", mp, NULL);
1580bd670b35SErik Nordmark
1581bd670b35SErik Nordmark /*
1582bd670b35SErik Nordmark * We need an ill_t for the ip_recv_attr_t even though this packet
1583bd670b35SErik Nordmark * was never received and icmp_unreachable doesn't currently use
1584bd670b35SErik Nordmark * ira_ill.
1585bd670b35SErik Nordmark */
1586bd670b35SErik Nordmark ill = ill_lookup_on_name("lo0", B_FALSE,
1587bd670b35SErik Nordmark !(ixa->ixa_flags & IRAF_IS_IPV4), &dummy, ipst);
1588bd670b35SErik Nordmark if (ill == NULL) {
1589bd670b35SErik Nordmark freemsg(mp);
1590bd670b35SErik Nordmark return (EHOSTUNREACH);
1591bd670b35SErik Nordmark }
1592bd670b35SErik Nordmark
1593bd670b35SErik Nordmark bzero(&iras, sizeof (iras));
1594bd670b35SErik Nordmark /* Map ixa to ira including IPsec policies */
1595bd670b35SErik Nordmark ipsec_out_to_in(ixa, ill, &iras);
1596bd670b35SErik Nordmark
1597bd670b35SErik Nordmark if (ip_source_routed(ipha, ipst)) {
1598bd670b35SErik Nordmark icmp_unreachable(mp, ICMP_SOURCE_ROUTE_FAILED, &iras);
1599bd670b35SErik Nordmark } else {
1600bd670b35SErik Nordmark icmp_unreachable(mp, ICMP_HOST_UNREACHABLE, &iras);
1601bd670b35SErik Nordmark }
1602bd670b35SErik Nordmark /* We moved any IPsec refs from ixa to iras */
1603bd670b35SErik Nordmark ira_cleanup(&iras, B_FALSE);
1604bd670b35SErik Nordmark ill_refrele(ill);
1605bd670b35SErik Nordmark return (EHOSTUNREACH);
1606bd670b35SErik Nordmark }
1607bd670b35SErik Nordmark
1608bd670b35SErik Nordmark /*
1609bd670b35SErik Nordmark * Calculate a checksum ignoring any hardware capabilities
1610bd670b35SErik Nordmark *
1611bd670b35SErik Nordmark * Returns B_FALSE if the packet was too short for the checksum. Caller
1612bd670b35SErik Nordmark * should free and do stats.
1613bd670b35SErik Nordmark */
1614bd670b35SErik Nordmark static boolean_t
ip_output_sw_cksum_v4(mblk_t * mp,ipha_t * ipha,ip_xmit_attr_t * ixa)1615bd670b35SErik Nordmark ip_output_sw_cksum_v4(mblk_t *mp, ipha_t *ipha, ip_xmit_attr_t *ixa)
1616bd670b35SErik Nordmark {
1617bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1618bd670b35SErik Nordmark uint_t pktlen = ixa->ixa_pktlen;
1619bd670b35SErik Nordmark uint16_t *cksump;
1620bd670b35SErik Nordmark uint32_t cksum;
1621bd670b35SErik Nordmark uint8_t protocol = ixa->ixa_protocol;
1622bd670b35SErik Nordmark uint16_t ip_hdr_length = ixa->ixa_ip_hdr_length;
1623bd670b35SErik Nordmark ipaddr_t dst = ipha->ipha_dst;
1624bd670b35SErik Nordmark ipaddr_t src = ipha->ipha_src;
1625bd670b35SErik Nordmark
1626bd670b35SErik Nordmark /* Just in case it contained garbage */
1627bd670b35SErik Nordmark DB_CKSUMFLAGS(mp) &= ~HCK_FLAGS;
1628bd670b35SErik Nordmark
1629bd670b35SErik Nordmark /*
1630bd670b35SErik Nordmark * Calculate ULP checksum
1631bd670b35SErik Nordmark */
1632bd670b35SErik Nordmark if (protocol == IPPROTO_TCP) {
1633bd670b35SErik Nordmark cksump = IPH_TCPH_CHECKSUMP(ipha, ip_hdr_length);
1634bd670b35SErik Nordmark cksum = IP_TCP_CSUM_COMP;
1635bd670b35SErik Nordmark } else if (protocol == IPPROTO_UDP) {
1636bd670b35SErik Nordmark cksump = IPH_UDPH_CHECKSUMP(ipha, ip_hdr_length);
1637bd670b35SErik Nordmark cksum = IP_UDP_CSUM_COMP;
1638bd670b35SErik Nordmark } else if (protocol == IPPROTO_SCTP) {
1639bd670b35SErik Nordmark sctp_hdr_t *sctph;
1640bd670b35SErik Nordmark
1641bd670b35SErik Nordmark ASSERT(MBLKL(mp) >= (ip_hdr_length + sizeof (*sctph)));
1642bd670b35SErik Nordmark sctph = (sctp_hdr_t *)(mp->b_rptr + ip_hdr_length);
1643bd670b35SErik Nordmark /*
1644bd670b35SErik Nordmark * Zero out the checksum field to ensure proper
1645bd670b35SErik Nordmark * checksum calculation.
1646bd670b35SErik Nordmark */
1647bd670b35SErik Nordmark sctph->sh_chksum = 0;
1648bd670b35SErik Nordmark #ifdef DEBUG
1649bd670b35SErik Nordmark if (!skip_sctp_cksum)
1650bd670b35SErik Nordmark #endif
1651bd670b35SErik Nordmark sctph->sh_chksum = sctp_cksum(mp, ip_hdr_length);
1652bd670b35SErik Nordmark goto ip_hdr_cksum;
1653bd670b35SErik Nordmark } else {
1654bd670b35SErik Nordmark goto ip_hdr_cksum;
1655bd670b35SErik Nordmark }
1656bd670b35SErik Nordmark
1657bd670b35SErik Nordmark /* ULP puts the checksum field is in the first mblk */
1658bd670b35SErik Nordmark ASSERT(((uchar_t *)cksump) + sizeof (uint16_t) <= mp->b_wptr);
1659bd670b35SErik Nordmark
1660bd670b35SErik Nordmark /*
1661bd670b35SErik Nordmark * We accumulate the pseudo header checksum in cksum.
1662bd670b35SErik Nordmark * This is pretty hairy code, so watch close. One
1663bd670b35SErik Nordmark * thing to keep in mind is that UDP and TCP have
1664bd670b35SErik Nordmark * stored their respective datagram lengths in their
1665bd670b35SErik Nordmark * checksum fields. This lines things up real nice.
1666bd670b35SErik Nordmark */
1667bd670b35SErik Nordmark cksum += (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF);
1668bd670b35SErik Nordmark
1669bd670b35SErik Nordmark cksum = IP_CSUM(mp, ip_hdr_length, cksum);
1670bd670b35SErik Nordmark /*
1671bd670b35SErik Nordmark * For UDP/IPv4 a zero means that the packets wasn't checksummed.
1672bd670b35SErik Nordmark * Change to 0xffff
1673bd670b35SErik Nordmark */
1674bd670b35SErik Nordmark if (protocol == IPPROTO_UDP && cksum == 0)
1675bd670b35SErik Nordmark *cksump = ~cksum;
1676bd670b35SErik Nordmark else
1677bd670b35SErik Nordmark *cksump = cksum;
1678bd670b35SErik Nordmark
1679bd670b35SErik Nordmark IP_STAT(ipst, ip_out_sw_cksum);
1680bd670b35SErik Nordmark IP_STAT_UPDATE(ipst, ip_out_sw_cksum_bytes, pktlen);
1681bd670b35SErik Nordmark
1682bd670b35SErik Nordmark ip_hdr_cksum:
1683bd670b35SErik Nordmark /* Calculate IPv4 header checksum */
1684bd670b35SErik Nordmark ipha->ipha_hdr_checksum = 0;
1685bd670b35SErik Nordmark ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1686bd670b35SErik Nordmark return (B_TRUE);
1687bd670b35SErik Nordmark }
1688bd670b35SErik Nordmark
1689bd670b35SErik Nordmark /*
1690bd670b35SErik Nordmark * Calculate the ULP checksum - try to use hardware.
1691bd670b35SErik Nordmark * In the case of MULTIRT, broadcast or multicast the
1692bd670b35SErik Nordmark * IXAF_NO_HW_CKSUM is set in which case we use software.
1693bd670b35SErik Nordmark *
1694bd670b35SErik Nordmark * If the hardware supports IP header checksum offload; then clear the
1695bd670b35SErik Nordmark * contents of IP header checksum field as expected by NIC.
1696bd670b35SErik Nordmark * Do this only if we offloaded either full or partial sum.
1697bd670b35SErik Nordmark *
1698bd670b35SErik Nordmark * Returns B_FALSE if the packet was too short for the checksum. Caller
1699bd670b35SErik Nordmark * should free and do stats.
1700bd670b35SErik Nordmark */
1701bd670b35SErik Nordmark static boolean_t
ip_output_cksum_v4(iaflags_t ixaflags,mblk_t * mp,ipha_t * ipha,ip_xmit_attr_t * ixa,ill_t * ill)1702bd670b35SErik Nordmark ip_output_cksum_v4(iaflags_t ixaflags, mblk_t *mp, ipha_t *ipha,
1703bd670b35SErik Nordmark ip_xmit_attr_t *ixa, ill_t *ill)
1704bd670b35SErik Nordmark {
1705bd670b35SErik Nordmark uint_t pktlen = ixa->ixa_pktlen;
1706bd670b35SErik Nordmark uint16_t *cksump;
1707bd670b35SErik Nordmark uint16_t hck_flags;
1708bd670b35SErik Nordmark uint32_t cksum;
1709bd670b35SErik Nordmark uint8_t protocol = ixa->ixa_protocol;
1710bd670b35SErik Nordmark uint16_t ip_hdr_length = ixa->ixa_ip_hdr_length;
1711bd670b35SErik Nordmark
1712bd670b35SErik Nordmark if ((ixaflags & IXAF_NO_HW_CKSUM) || !ILL_HCKSUM_CAPABLE(ill) ||
1713bd670b35SErik Nordmark !dohwcksum) {
1714bd670b35SErik Nordmark return (ip_output_sw_cksum_v4(mp, ipha, ixa));
1715bd670b35SErik Nordmark }
1716bd670b35SErik Nordmark
1717bd670b35SErik Nordmark /*
1718bd670b35SErik Nordmark * Calculate ULP checksum. Note that we don't use cksump and cksum
1719bd670b35SErik Nordmark * if the ill has FULL support.
1720bd670b35SErik Nordmark */
1721bd670b35SErik Nordmark if (protocol == IPPROTO_TCP) {
1722bd670b35SErik Nordmark cksump = IPH_TCPH_CHECKSUMP(ipha, ip_hdr_length);
1723bd670b35SErik Nordmark cksum = IP_TCP_CSUM_COMP; /* Pseudo-header cksum */
1724bd670b35SErik Nordmark } else if (protocol == IPPROTO_UDP) {
1725bd670b35SErik Nordmark cksump = IPH_UDPH_CHECKSUMP(ipha, ip_hdr_length);
1726bd670b35SErik Nordmark cksum = IP_UDP_CSUM_COMP; /* Pseudo-header cksum */
1727bd670b35SErik Nordmark } else if (protocol == IPPROTO_SCTP) {
1728bd670b35SErik Nordmark sctp_hdr_t *sctph;
1729bd670b35SErik Nordmark
1730bd670b35SErik Nordmark ASSERT(MBLKL(mp) >= (ip_hdr_length + sizeof (*sctph)));
1731bd670b35SErik Nordmark sctph = (sctp_hdr_t *)(mp->b_rptr + ip_hdr_length);
1732bd670b35SErik Nordmark /*
1733bd670b35SErik Nordmark * Zero out the checksum field to ensure proper
1734bd670b35SErik Nordmark * checksum calculation.
1735bd670b35SErik Nordmark */
1736bd670b35SErik Nordmark sctph->sh_chksum = 0;
1737bd670b35SErik Nordmark #ifdef DEBUG
1738bd670b35SErik Nordmark if (!skip_sctp_cksum)
1739bd670b35SErik Nordmark #endif
1740bd670b35SErik Nordmark sctph->sh_chksum = sctp_cksum(mp, ip_hdr_length);
1741bd670b35SErik Nordmark goto ip_hdr_cksum;
1742*b22a70abSPatrick Mooney } else if (protocol == IPPROTO_ICMP) {
1743*b22a70abSPatrick Mooney /*
1744*b22a70abSPatrick Mooney * Note that we always calculate a SW checksum for ICMP. In the
1745*b22a70abSPatrick Mooney * future, if HW support for ICMP is advertised, we can change
1746*b22a70abSPatrick Mooney * this.
1747*b22a70abSPatrick Mooney */
1748*b22a70abSPatrick Mooney return (ip_output_sw_cksum_v4(mp, ipha, ixa));
1749bd670b35SErik Nordmark } else {
1750bd670b35SErik Nordmark ip_hdr_cksum:
1751bd670b35SErik Nordmark /* Calculate IPv4 header checksum */
1752bd670b35SErik Nordmark ipha->ipha_hdr_checksum = 0;
1753bd670b35SErik Nordmark ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1754bd670b35SErik Nordmark return (B_TRUE);
1755bd670b35SErik Nordmark }
1756bd670b35SErik Nordmark
1757bd670b35SErik Nordmark /* ULP puts the checksum field is in the first mblk */
1758bd670b35SErik Nordmark ASSERT(((uchar_t *)cksump) + sizeof (uint16_t) <= mp->b_wptr);
1759bd670b35SErik Nordmark
1760bd670b35SErik Nordmark /*
1761bd670b35SErik Nordmark * Underlying interface supports hardware checksum offload for
1762bd670b35SErik Nordmark * the payload; leave the payload checksum for the hardware to
1763bd670b35SErik Nordmark * calculate. N.B: We only need to set up checksum info on the
1764bd670b35SErik Nordmark * first mblk.
1765bd670b35SErik Nordmark */
1766bd670b35SErik Nordmark hck_flags = ill->ill_hcksum_capab->ill_hcksum_txflags;
1767bd670b35SErik Nordmark
1768bd670b35SErik Nordmark DB_CKSUMFLAGS(mp) &= ~HCK_FLAGS;
1769bd670b35SErik Nordmark if (hck_flags & HCKSUM_INET_FULL_V4) {
1770bd670b35SErik Nordmark /*
1771bd670b35SErik Nordmark * Hardware calculates pseudo-header, header and the
1772bd670b35SErik Nordmark * payload checksums, so clear the checksum field in
1773bd670b35SErik Nordmark * the protocol header.
1774bd670b35SErik Nordmark */
1775bd670b35SErik Nordmark *cksump = 0;
1776bd670b35SErik Nordmark DB_CKSUMFLAGS(mp) |= HCK_FULLCKSUM;
1777bd670b35SErik Nordmark
1778bd670b35SErik Nordmark ipha->ipha_hdr_checksum = 0;
1779bd670b35SErik Nordmark if (hck_flags & HCKSUM_IPHDRCKSUM) {
1780bd670b35SErik Nordmark DB_CKSUMFLAGS(mp) |= HCK_IPV4_HDRCKSUM;
1781bd670b35SErik Nordmark } else {
1782bd670b35SErik Nordmark ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1783bd670b35SErik Nordmark }
1784bd670b35SErik Nordmark return (B_TRUE);
1785bd670b35SErik Nordmark }
1786bd670b35SErik Nordmark if ((hck_flags) & HCKSUM_INET_PARTIAL) {
1787bd670b35SErik Nordmark ipaddr_t dst = ipha->ipha_dst;
1788bd670b35SErik Nordmark ipaddr_t src = ipha->ipha_src;
1789bd670b35SErik Nordmark /*
1790bd670b35SErik Nordmark * Partial checksum offload has been enabled. Fill
1791bd670b35SErik Nordmark * the checksum field in the protocol header with the
1792bd670b35SErik Nordmark * pseudo-header checksum value.
1793bd670b35SErik Nordmark *
1794bd670b35SErik Nordmark * We accumulate the pseudo header checksum in cksum.
1795bd670b35SErik Nordmark * This is pretty hairy code, so watch close. One
1796bd670b35SErik Nordmark * thing to keep in mind is that UDP and TCP have
1797bd670b35SErik Nordmark * stored their respective datagram lengths in their
1798bd670b35SErik Nordmark * checksum fields. This lines things up real nice.
1799bd670b35SErik Nordmark */
1800bd670b35SErik Nordmark cksum += (dst >> 16) + (dst & 0xFFFF) +
1801bd670b35SErik Nordmark (src >> 16) + (src & 0xFFFF);
1802bd670b35SErik Nordmark cksum += *(cksump);
1803bd670b35SErik Nordmark cksum = (cksum & 0xFFFF) + (cksum >> 16);
1804bd670b35SErik Nordmark *(cksump) = (cksum & 0xFFFF) + (cksum >> 16);
1805bd670b35SErik Nordmark
1806bd670b35SErik Nordmark /*
1807bd670b35SErik Nordmark * Offsets are relative to beginning of IP header.
1808bd670b35SErik Nordmark */
1809bd670b35SErik Nordmark DB_CKSUMSTART(mp) = ip_hdr_length;
1810bd670b35SErik Nordmark DB_CKSUMSTUFF(mp) = (uint8_t *)cksump - (uint8_t *)ipha;
1811bd670b35SErik Nordmark DB_CKSUMEND(mp) = pktlen;
1812bd670b35SErik Nordmark DB_CKSUMFLAGS(mp) |= HCK_PARTIALCKSUM;
1813bd670b35SErik Nordmark
1814bd670b35SErik Nordmark ipha->ipha_hdr_checksum = 0;
1815bd670b35SErik Nordmark if (hck_flags & HCKSUM_IPHDRCKSUM) {
1816bd670b35SErik Nordmark DB_CKSUMFLAGS(mp) |= HCK_IPV4_HDRCKSUM;
1817bd670b35SErik Nordmark } else {
1818bd670b35SErik Nordmark ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1819bd670b35SErik Nordmark }
1820bd670b35SErik Nordmark return (B_TRUE);
1821bd670b35SErik Nordmark }
1822bd670b35SErik Nordmark /* Hardware capabilities include neither full nor partial IPv4 */
1823bd670b35SErik Nordmark return (ip_output_sw_cksum_v4(mp, ipha, ixa));
1824bd670b35SErik Nordmark }
1825bd670b35SErik Nordmark
1826bd670b35SErik Nordmark /*
1827bd670b35SErik Nordmark * ire_sendfn for offlink and onlink destinations.
1828bd670b35SErik Nordmark * Also called from the multicast, broadcast, multirt send functions.
1829bd670b35SErik Nordmark *
1830bd670b35SErik Nordmark * Assumes that the caller has a hold on the ire.
1831bd670b35SErik Nordmark *
1832bd670b35SErik Nordmark * This function doesn't care if the IRE just became condemned since that
1833bd670b35SErik Nordmark * can happen at any time.
1834bd670b35SErik Nordmark */
1835bd670b35SErik Nordmark /* ARGSUSED */
1836bd670b35SErik Nordmark int
ire_send_wire_v4(ire_t * ire,mblk_t * mp,void * iph_arg,ip_xmit_attr_t * ixa,uint32_t * identp)1837bd670b35SErik Nordmark ire_send_wire_v4(ire_t *ire, mblk_t *mp, void *iph_arg,
1838bd670b35SErik Nordmark ip_xmit_attr_t *ixa, uint32_t *identp)
1839bd670b35SErik Nordmark {
1840bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
1841bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)iph_arg;
1842bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags;
1843bd670b35SErik Nordmark ill_t *ill;
1844bd670b35SErik Nordmark
1845bd670b35SErik Nordmark ASSERT(ixa->ixa_nce != NULL);
1846bd670b35SErik Nordmark ill = ixa->ixa_nce->nce_ill;
1847bd670b35SErik Nordmark
1848bd670b35SErik Nordmark if (ixaflags & IXAF_DONTROUTE)
1849bd670b35SErik Nordmark ipha->ipha_ttl = 1;
1850bd670b35SErik Nordmark
1851bd670b35SErik Nordmark /*
1852bd670b35SErik Nordmark * Assign an ident value for this packet. There could be other
1853bd670b35SErik Nordmark * threads targeting the same destination, so we have to arrange
1854bd670b35SErik Nordmark * for a atomic increment. Note that we use a 32-bit atomic add
1855bd670b35SErik Nordmark * because it has better performance than its 16-bit sibling.
1856bd670b35SErik Nordmark *
1857bd670b35SErik Nordmark * Normally ixa_extra_ident is 0, but in the case of LSO it will
1858bd670b35SErik Nordmark * be the number of TCP segments that the driver/hardware will
1859bd670b35SErik Nordmark * extraly construct.
1860bd670b35SErik Nordmark *
1861bd670b35SErik Nordmark * If running in cluster mode and if the source address
1862bd670b35SErik Nordmark * belongs to a replicated service then vector through
1863bd670b35SErik Nordmark * cl_inet_ipident vector to allocate ip identifier
1864bd670b35SErik Nordmark * NOTE: This is a contract private interface with the
1865bd670b35SErik Nordmark * clustering group.
1866bd670b35SErik Nordmark */
1867bd670b35SErik Nordmark if (cl_inet_ipident != NULL) {
1868bd670b35SErik Nordmark ipaddr_t src = ipha->ipha_src;
1869bd670b35SErik Nordmark ipaddr_t dst = ipha->ipha_dst;
1870bd670b35SErik Nordmark netstackid_t stack_id = ipst->ips_netstack->netstack_stackid;
1871bd670b35SErik Nordmark
1872bd670b35SErik Nordmark ASSERT(cl_inet_isclusterwide != NULL);
1873bd670b35SErik Nordmark if ((*cl_inet_isclusterwide)(stack_id, IPPROTO_IP,
1874bd670b35SErik Nordmark AF_INET, (uint8_t *)(uintptr_t)src, NULL)) {
1875bd670b35SErik Nordmark /*
1876bd670b35SErik Nordmark * Note: not correct with LSO since we can't allocate
1877bd670b35SErik Nordmark * ixa_extra_ident+1 consecutive values.
1878bd670b35SErik Nordmark */
1879bd670b35SErik Nordmark ipha->ipha_ident = (*cl_inet_ipident)(stack_id,
1880bd670b35SErik Nordmark IPPROTO_IP, AF_INET, (uint8_t *)(uintptr_t)src,
1881bd670b35SErik Nordmark (uint8_t *)(uintptr_t)dst, NULL);
1882bd670b35SErik Nordmark } else {
1883bd670b35SErik Nordmark ipha->ipha_ident = atomic_add_32_nv(identp,
1884bd670b35SErik Nordmark ixa->ixa_extra_ident + 1);
1885bd670b35SErik Nordmark }
1886bd670b35SErik Nordmark } else {
1887bd670b35SErik Nordmark ipha->ipha_ident = atomic_add_32_nv(identp,
1888bd670b35SErik Nordmark ixa->ixa_extra_ident + 1);
1889bd670b35SErik Nordmark }
1890bd670b35SErik Nordmark #ifndef _BIG_ENDIAN
1891bd670b35SErik Nordmark ipha->ipha_ident = htons(ipha->ipha_ident);
1892bd670b35SErik Nordmark #endif
1893bd670b35SErik Nordmark
1894bd670b35SErik Nordmark /*
1895bd670b35SErik Nordmark * This might set b_band, thus the IPsec and fragmentation
1896bd670b35SErik Nordmark * code in IP ensures that b_band is updated in the first mblk.
1897bd670b35SErik Nordmark */
1898bd670b35SErik Nordmark if (IPP_ENABLED(IPP_LOCAL_OUT, ipst)) {
1899bd670b35SErik Nordmark /* ip_process translates an IS_UNDER_IPMP */
1900bd670b35SErik Nordmark mp = ip_process(IPP_LOCAL_OUT, mp, ill, ill);
1901bd670b35SErik Nordmark if (mp == NULL) {
1902bd670b35SErik Nordmark /* ip_drop_packet and MIB done */
1903bd670b35SErik Nordmark return (0); /* Might just be delayed */
1904bd670b35SErik Nordmark }
1905bd670b35SErik Nordmark }
1906bd670b35SErik Nordmark
1907bd670b35SErik Nordmark /*
1908bd670b35SErik Nordmark * Verify any IPv4 options.
1909bd670b35SErik Nordmark *
1910bd670b35SErik Nordmark * The presense of IP options also forces the network stack to
1911bd670b35SErik Nordmark * calculate the checksum in software. This is because:
1912bd670b35SErik Nordmark *
1913bd670b35SErik Nordmark * Wrap around: certain partial-checksum NICs (eri, ce) limit
1914bd670b35SErik Nordmark * the size of "start offset" width to 6-bit. This effectively
1915bd670b35SErik Nordmark * sets the largest value of the offset to 64-bytes, starting
1916bd670b35SErik Nordmark * from the MAC header. When the cumulative MAC and IP headers
1917bd670b35SErik Nordmark * exceed such limit, the offset will wrap around. This causes
1918bd670b35SErik Nordmark * the checksum to be calculated at the wrong place.
1919bd670b35SErik Nordmark *
1920bd670b35SErik Nordmark * IPv4 source routing: none of the full-checksum capable NICs
1921bd670b35SErik Nordmark * is capable of correctly handling the IPv4 source-routing
1922bd670b35SErik Nordmark * option for purposes of calculating the pseudo-header; the
1923bd670b35SErik Nordmark * actual destination is different from the destination in the
1924bd670b35SErik Nordmark * header which is that of the next-hop. (This case may not be
1925bd670b35SErik Nordmark * true for NICs which can parse IPv6 extension headers, but
1926bd670b35SErik Nordmark * we choose to simplify the implementation by not offloading
1927bd670b35SErik Nordmark * checksum when they are present.)
1928bd670b35SErik Nordmark */
1929bd670b35SErik Nordmark if (!IS_SIMPLE_IPH(ipha)) {
1930bd670b35SErik Nordmark ixaflags = ixa->ixa_flags |= IXAF_NO_HW_CKSUM;
1931bd670b35SErik Nordmark /* An IS_UNDER_IPMP ill is ok here */
1932bd670b35SErik Nordmark if (ip_output_options(mp, ipha, ixa, ill)) {
1933bd670b35SErik Nordmark /* Packet has been consumed and ICMP error sent */
1934bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
1935bd670b35SErik Nordmark return (EINVAL);
1936bd670b35SErik Nordmark }
1937bd670b35SErik Nordmark }
1938bd670b35SErik Nordmark
1939bd670b35SErik Nordmark /*
1940bd670b35SErik Nordmark * To handle IPsec/iptun's labeling needs we need to tag packets
1941bd670b35SErik Nordmark * while we still have ixa_tsl
1942bd670b35SErik Nordmark */
1943bd670b35SErik Nordmark if (is_system_labeled() && ixa->ixa_tsl != NULL &&
1944bd670b35SErik Nordmark (ill->ill_mactype == DL_6TO4 || ill->ill_mactype == DL_IPV4 ||
1945bd670b35SErik Nordmark ill->ill_mactype == DL_IPV6)) {
1946bd670b35SErik Nordmark cred_t *newcr;
1947bd670b35SErik Nordmark
1948bd670b35SErik Nordmark newcr = copycred_from_tslabel(ixa->ixa_cred, ixa->ixa_tsl,
1949bd670b35SErik Nordmark KM_NOSLEEP);
1950bd670b35SErik Nordmark if (newcr == NULL) {
1951bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
1952bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - newcr",
1953bd670b35SErik Nordmark mp, ill);
1954bd670b35SErik Nordmark freemsg(mp);
1955bd670b35SErik Nordmark return (ENOBUFS);
1956bd670b35SErik Nordmark }
1957bd670b35SErik Nordmark mblk_setcred(mp, newcr, NOPID);
1958bd670b35SErik Nordmark crfree(newcr); /* mblk_setcred did its own crhold */
1959bd670b35SErik Nordmark }
1960bd670b35SErik Nordmark
1961bd670b35SErik Nordmark if (ixa->ixa_pktlen > ixa->ixa_fragsize ||
1962bd670b35SErik Nordmark (ixaflags & IXAF_IPSEC_SECURE)) {
1963bd670b35SErik Nordmark uint32_t pktlen;
1964bd670b35SErik Nordmark
1965bd670b35SErik Nordmark pktlen = ixa->ixa_pktlen;
1966bd670b35SErik Nordmark if (ixaflags & IXAF_IPSEC_SECURE)
1967bd670b35SErik Nordmark pktlen += ipsec_out_extra_length(ixa);
1968bd670b35SErik Nordmark
1969bd670b35SErik Nordmark if (pktlen > IP_MAXPACKET)
1970bd670b35SErik Nordmark return (EMSGSIZE);
1971bd670b35SErik Nordmark
1972bd670b35SErik Nordmark if (ixaflags & IXAF_SET_ULP_CKSUM) {
1973bd670b35SErik Nordmark /*
1974bd670b35SErik Nordmark * Compute ULP checksum and IP header checksum
1975bd670b35SErik Nordmark * using software
1976bd670b35SErik Nordmark */
1977bd670b35SErik Nordmark if (!ip_output_sw_cksum_v4(mp, ipha, ixa)) {
1978bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
1979bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", mp, ill);
1980bd670b35SErik Nordmark freemsg(mp);
1981bd670b35SErik Nordmark return (EINVAL);
1982bd670b35SErik Nordmark }
1983bd670b35SErik Nordmark } else {
1984bd670b35SErik Nordmark /* Calculate IPv4 header checksum */
1985bd670b35SErik Nordmark ipha->ipha_hdr_checksum = 0;
1986bd670b35SErik Nordmark ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
1987bd670b35SErik Nordmark }
1988bd670b35SErik Nordmark
1989bd670b35SErik Nordmark /*
1990bd670b35SErik Nordmark * If this packet would generate a icmp_frag_needed
1991bd670b35SErik Nordmark * message, we need to handle it before we do the IPsec
1992bd670b35SErik Nordmark * processing. Otherwise, we need to strip the IPsec
1993bd670b35SErik Nordmark * headers before we send up the message to the ULPs
1994bd670b35SErik Nordmark * which becomes messy and difficult.
1995bd670b35SErik Nordmark *
1996bd670b35SErik Nordmark * We check using IXAF_DONTFRAG. The DF bit in the header
1997bd670b35SErik Nordmark * is not inspected - it will be copied to any generated
1998bd670b35SErik Nordmark * fragments.
1999bd670b35SErik Nordmark */
2000bd670b35SErik Nordmark if ((pktlen > ixa->ixa_fragsize) &&
2001bd670b35SErik Nordmark (ixaflags & IXAF_DONTFRAG)) {
2002bd670b35SErik Nordmark /* Generate ICMP and return error */
2003bd670b35SErik Nordmark ip_recv_attr_t iras;
2004bd670b35SErik Nordmark
2005bd670b35SErik Nordmark DTRACE_PROBE4(ip4__fragsize__fail, uint_t, pktlen,
2006bd670b35SErik Nordmark uint_t, ixa->ixa_fragsize, uint_t, ixa->ixa_pktlen,
2007bd670b35SErik Nordmark uint_t, ixa->ixa_pmtu);
2008bd670b35SErik Nordmark
2009bd670b35SErik Nordmark bzero(&iras, sizeof (iras));
2010bd670b35SErik Nordmark /* Map ixa to ira including IPsec policies */
2011bd670b35SErik Nordmark ipsec_out_to_in(ixa, ill, &iras);
2012bd670b35SErik Nordmark
2013bd670b35SErik Nordmark ip_drop_output("ICMP_FRAG_NEEDED", mp, ill);
2014bd670b35SErik Nordmark icmp_frag_needed(mp, ixa->ixa_fragsize, &iras);
2015bd670b35SErik Nordmark /* We moved any IPsec refs from ixa to iras */
2016bd670b35SErik Nordmark ira_cleanup(&iras, B_FALSE);
2017bd670b35SErik Nordmark return (EMSGSIZE);
2018bd670b35SErik Nordmark }
2019bd670b35SErik Nordmark DTRACE_PROBE4(ip4__fragsize__ok, uint_t, pktlen,
2020bd670b35SErik Nordmark uint_t, ixa->ixa_fragsize, uint_t, ixa->ixa_pktlen,
2021bd670b35SErik Nordmark uint_t, ixa->ixa_pmtu);
2022bd670b35SErik Nordmark
2023bd670b35SErik Nordmark if (ixaflags & IXAF_IPSEC_SECURE) {
2024bd670b35SErik Nordmark /*
2025bd670b35SErik Nordmark * Pass in sufficient information so that
2026bd670b35SErik Nordmark * IPsec can determine whether to fragment, and
2027bd670b35SErik Nordmark * which function to call after fragmentation.
2028bd670b35SErik Nordmark */
2029bd670b35SErik Nordmark return (ipsec_out_process(mp, ixa));
2030bd670b35SErik Nordmark }
2031bd670b35SErik Nordmark return (ip_fragment_v4(mp, ixa->ixa_nce, ixaflags,
2032bd670b35SErik Nordmark ixa->ixa_pktlen, ixa->ixa_fragsize, ixa->ixa_xmit_hint,
2033bd670b35SErik Nordmark ixa->ixa_zoneid, ixa->ixa_no_loop_zoneid,
2034bd670b35SErik Nordmark ixa->ixa_postfragfn, &ixa->ixa_cookie));
2035bd670b35SErik Nordmark }
2036bd670b35SErik Nordmark if (ixaflags & IXAF_SET_ULP_CKSUM) {
2037bd670b35SErik Nordmark /* Compute ULP checksum and IP header checksum */
2038bd670b35SErik Nordmark /* An IS_UNDER_IPMP ill is ok here */
2039bd670b35SErik Nordmark if (!ip_output_cksum_v4(ixaflags, mp, ipha, ixa, ill)) {
2040bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2041bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", mp, ill);
2042bd670b35SErik Nordmark freemsg(mp);
2043bd670b35SErik Nordmark return (EINVAL);
2044bd670b35SErik Nordmark }
2045bd670b35SErik Nordmark } else {
2046bd670b35SErik Nordmark /* Calculate IPv4 header checksum */
2047bd670b35SErik Nordmark ipha->ipha_hdr_checksum = 0;
2048bd670b35SErik Nordmark ipha->ipha_hdr_checksum = ip_csum_hdr(ipha);
2049bd670b35SErik Nordmark }
2050bd670b35SErik Nordmark return ((ixa->ixa_postfragfn)(mp, ixa->ixa_nce, ixaflags,
2051bd670b35SErik Nordmark ixa->ixa_pktlen, ixa->ixa_xmit_hint, ixa->ixa_zoneid,
2052bd670b35SErik Nordmark ixa->ixa_no_loop_zoneid, &ixa->ixa_cookie));
2053bd670b35SErik Nordmark }
2054bd670b35SErik Nordmark
2055bd670b35SErik Nordmark /*
2056bd670b35SErik Nordmark * Send mp into ip_input
2057bd670b35SErik Nordmark * Common for IPv4 and IPv6
2058bd670b35SErik Nordmark */
2059bd670b35SErik Nordmark void
ip_postfrag_loopback(mblk_t * mp,nce_t * nce,iaflags_t ixaflags,uint_t pkt_len,zoneid_t nolzid)2060bd670b35SErik Nordmark ip_postfrag_loopback(mblk_t *mp, nce_t *nce, iaflags_t ixaflags,
2061bd670b35SErik Nordmark uint_t pkt_len, zoneid_t nolzid)
2062bd670b35SErik Nordmark {
2063bd670b35SErik Nordmark rtc_t rtc;
2064bd670b35SErik Nordmark ill_t *ill = nce->nce_ill;
2065bd670b35SErik Nordmark ip_recv_attr_t iras; /* NOTE: No bzero for performance */
2066bd670b35SErik Nordmark ncec_t *ncec;
2067bd670b35SErik Nordmark
2068bd670b35SErik Nordmark ncec = nce->nce_common;
2069bd670b35SErik Nordmark iras.ira_flags = IRAF_VERIFY_IP_CKSUM | IRAF_VERIFY_ULP_CKSUM |
2070bd670b35SErik Nordmark IRAF_LOOPBACK | IRAF_L2SRC_LOOPBACK;
2071bd670b35SErik Nordmark if (ncec->ncec_flags & NCE_F_BCAST)
2072bd670b35SErik Nordmark iras.ira_flags |= IRAF_L2DST_BROADCAST;
2073bd670b35SErik Nordmark else if (ncec->ncec_flags & NCE_F_MCAST)
2074bd670b35SErik Nordmark iras.ira_flags |= IRAF_L2DST_MULTICAST;
2075bd670b35SErik Nordmark
2076bd670b35SErik Nordmark iras.ira_free_flags = 0;
2077bd670b35SErik Nordmark iras.ira_cred = NULL;
2078bd670b35SErik Nordmark iras.ira_cpid = NOPID;
2079bd670b35SErik Nordmark iras.ira_tsl = NULL;
2080bd670b35SErik Nordmark iras.ira_zoneid = ALL_ZONES;
2081bd670b35SErik Nordmark iras.ira_pktlen = pkt_len;
2082bd670b35SErik Nordmark UPDATE_MIB(ill->ill_ip_mib, ipIfStatsHCInOctets, iras.ira_pktlen);
2083bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsHCInReceives);
2084bd670b35SErik Nordmark
2085bd670b35SErik Nordmark if (ixaflags & IXAF_IS_IPV4)
2086bd670b35SErik Nordmark iras.ira_flags |= IRAF_IS_IPV4;
2087bd670b35SErik Nordmark
2088bd670b35SErik Nordmark iras.ira_ill = iras.ira_rill = ill;
2089bd670b35SErik Nordmark iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
2090bd670b35SErik Nordmark iras.ira_rifindex = iras.ira_ruifindex;
2091bd670b35SErik Nordmark iras.ira_mhip = NULL;
2092bd670b35SErik Nordmark
2093bd670b35SErik Nordmark iras.ira_flags |= ixaflags & IAF_MASK;
2094bd670b35SErik Nordmark iras.ira_no_loop_zoneid = nolzid;
2095bd670b35SErik Nordmark
2096bd670b35SErik Nordmark /* Broadcast and multicast doesn't care about the squeue */
2097bd670b35SErik Nordmark iras.ira_sqp = NULL;
2098bd670b35SErik Nordmark
2099bd670b35SErik Nordmark rtc.rtc_ire = NULL;
2100bd670b35SErik Nordmark if (ixaflags & IXAF_IS_IPV4) {
2101bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)mp->b_rptr;
2102bd670b35SErik Nordmark
2103bd670b35SErik Nordmark rtc.rtc_ipaddr = INADDR_ANY;
2104bd670b35SErik Nordmark
2105bd670b35SErik Nordmark (*ill->ill_inputfn)(mp, ipha, &ipha->ipha_dst, &iras, &rtc);
2106bd670b35SErik Nordmark if (rtc.rtc_ire != NULL) {
2107bd670b35SErik Nordmark ASSERT(rtc.rtc_ipaddr != INADDR_ANY);
2108bd670b35SErik Nordmark ire_refrele(rtc.rtc_ire);
2109bd670b35SErik Nordmark }
2110bd670b35SErik Nordmark } else {
2111bd670b35SErik Nordmark ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2112bd670b35SErik Nordmark
2113bd670b35SErik Nordmark rtc.rtc_ip6addr = ipv6_all_zeros;
2114bd670b35SErik Nordmark
2115bd670b35SErik Nordmark (*ill->ill_inputfn)(mp, ip6h, &ip6h->ip6_dst, &iras, &rtc);
2116bd670b35SErik Nordmark if (rtc.rtc_ire != NULL) {
2117bd670b35SErik Nordmark ASSERT(!IN6_IS_ADDR_UNSPECIFIED(&rtc.rtc_ip6addr));
2118bd670b35SErik Nordmark ire_refrele(rtc.rtc_ire);
2119bd670b35SErik Nordmark }
2120bd670b35SErik Nordmark }
2121bd670b35SErik Nordmark /* Any references to clean up? No hold on ira */
2122bd670b35SErik Nordmark if (iras.ira_flags & (IRAF_IPSEC_SECURE|IRAF_SYSTEM_LABELED))
2123bd670b35SErik Nordmark ira_cleanup(&iras, B_FALSE);
2124bd670b35SErik Nordmark }
2125bd670b35SErik Nordmark
2126bd670b35SErik Nordmark /*
2127bd670b35SErik Nordmark * Post fragmentation function for IRE_MULTICAST and IRE_BROADCAST which
2128bd670b35SErik Nordmark * looks at the IXAF_LOOPBACK_COPY flag.
2129bd670b35SErik Nordmark * Common for IPv4 and IPv6.
2130bd670b35SErik Nordmark *
2131bd670b35SErik Nordmark * If the loopback copy fails (due to no memory) but we send the packet out
2132bd670b35SErik Nordmark * on the wire we return no failure. Only in the case we supress the wire
2133bd670b35SErik Nordmark * sending do we take the loopback failure into account.
2134bd670b35SErik Nordmark *
2135bd670b35SErik Nordmark * Note that we do not perform DTRACE_IP7 and FW_HOOKS for the looped back copy.
2136bd670b35SErik Nordmark * Those operations are performed on this packet in ip_xmit() and it would
2137bd670b35SErik Nordmark * be odd to do it twice for the same packet.
2138bd670b35SErik Nordmark */
2139bd670b35SErik Nordmark int
ip_postfrag_loopcheck(mblk_t * mp,nce_t * nce,iaflags_t ixaflags,uint_t pkt_len,uint32_t xmit_hint,zoneid_t szone,zoneid_t nolzid,uintptr_t * ixacookie)2140bd670b35SErik Nordmark ip_postfrag_loopcheck(mblk_t *mp, nce_t *nce, iaflags_t ixaflags,
2141bd670b35SErik Nordmark uint_t pkt_len, uint32_t xmit_hint, zoneid_t szone, zoneid_t nolzid,
2142bd670b35SErik Nordmark uintptr_t *ixacookie)
2143bd670b35SErik Nordmark {
2144bd670b35SErik Nordmark ill_t *ill = nce->nce_ill;
2145bd670b35SErik Nordmark int error = 0;
2146bd670b35SErik Nordmark
2147bd670b35SErik Nordmark /*
2148bd670b35SErik Nordmark * Check for IXAF_LOOPBACK_COPY - send a copy to ip as if the driver
2149bd670b35SErik Nordmark * had looped it back
2150bd670b35SErik Nordmark */
2151bd670b35SErik Nordmark if (ixaflags & IXAF_LOOPBACK_COPY) {
2152bd670b35SErik Nordmark mblk_t *mp1;
2153bd670b35SErik Nordmark
2154bd670b35SErik Nordmark mp1 = copymsg(mp);
2155bd670b35SErik Nordmark if (mp1 == NULL) {
2156bd670b35SErik Nordmark /* Failed to deliver the loopback copy. */
2157bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2158bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", mp, ill);
2159bd670b35SErik Nordmark error = ENOBUFS;
2160bd670b35SErik Nordmark } else {
2161bd670b35SErik Nordmark ip_postfrag_loopback(mp1, nce, ixaflags, pkt_len,
2162bd670b35SErik Nordmark nolzid);
2163bd670b35SErik Nordmark }
2164bd670b35SErik Nordmark }
2165bd670b35SErik Nordmark
2166bd670b35SErik Nordmark /*
2167bd670b35SErik Nordmark * If TTL = 0 then only do the loopback to this host i.e. we are
2168bd670b35SErik Nordmark * done. We are also done if this was the
2169bd670b35SErik Nordmark * loopback interface since it is sufficient
2170bd670b35SErik Nordmark * to loopback one copy of a multicast packet.
2171bd670b35SErik Nordmark */
2172bd670b35SErik Nordmark if (ixaflags & IXAF_IS_IPV4) {
2173bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)mp->b_rptr;
2174bd670b35SErik Nordmark
2175bd670b35SErik Nordmark if (ipha->ipha_ttl == 0) {
2176bd670b35SErik Nordmark ip_drop_output("multicast ipha_ttl not sent to wire",
2177bd670b35SErik Nordmark mp, ill);
2178bd670b35SErik Nordmark freemsg(mp);
2179bd670b35SErik Nordmark return (error);
2180bd670b35SErik Nordmark }
2181bd670b35SErik Nordmark } else {
2182bd670b35SErik Nordmark ip6_t *ip6h = (ip6_t *)mp->b_rptr;
2183bd670b35SErik Nordmark
2184bd670b35SErik Nordmark if (ip6h->ip6_hops == 0) {
2185bd670b35SErik Nordmark ip_drop_output("multicast ipha_ttl not sent to wire",
2186bd670b35SErik Nordmark mp, ill);
2187bd670b35SErik Nordmark freemsg(mp);
2188bd670b35SErik Nordmark return (error);
2189bd670b35SErik Nordmark }
2190bd670b35SErik Nordmark }
2191bd670b35SErik Nordmark if (nce->nce_ill->ill_wq == NULL) {
2192bd670b35SErik Nordmark /* Loopback interface */
2193bd670b35SErik Nordmark ip_drop_output("multicast on lo0 not sent to wire", mp, ill);
2194bd670b35SErik Nordmark freemsg(mp);
2195bd670b35SErik Nordmark return (error);
2196bd670b35SErik Nordmark }
2197bd670b35SErik Nordmark
2198bd670b35SErik Nordmark return (ip_xmit(mp, nce, ixaflags, pkt_len, xmit_hint, szone, 0,
2199bd670b35SErik Nordmark ixacookie));
2200bd670b35SErik Nordmark }
2201bd670b35SErik Nordmark
2202bd670b35SErik Nordmark /*
2203bd670b35SErik Nordmark * Post fragmentation function for RTF_MULTIRT routes.
2204bd670b35SErik Nordmark * Since IRE_BROADCASTs can have RTF_MULTIRT, this function
2205bd670b35SErik Nordmark * checks IXAF_LOOPBACK_COPY.
2206bd670b35SErik Nordmark *
2207bd670b35SErik Nordmark * If no packet is sent due to failures then we return an errno, but if at
2208bd670b35SErik Nordmark * least one succeeded we return zero.
2209bd670b35SErik Nordmark */
2210bd670b35SErik Nordmark int
ip_postfrag_multirt_v4(mblk_t * mp,nce_t * nce,iaflags_t ixaflags,uint_t pkt_len,uint32_t xmit_hint,zoneid_t szone,zoneid_t nolzid,uintptr_t * ixacookie)2211bd670b35SErik Nordmark ip_postfrag_multirt_v4(mblk_t *mp, nce_t *nce, iaflags_t ixaflags,
2212bd670b35SErik Nordmark uint_t pkt_len, uint32_t xmit_hint, zoneid_t szone, zoneid_t nolzid,
2213bd670b35SErik Nordmark uintptr_t *ixacookie)
2214bd670b35SErik Nordmark {
2215bd670b35SErik Nordmark irb_t *irb;
2216bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)mp->b_rptr;
2217bd670b35SErik Nordmark ire_t *ire;
2218bd670b35SErik Nordmark ire_t *ire1;
2219bd670b35SErik Nordmark mblk_t *mp1;
2220bd670b35SErik Nordmark nce_t *nce1;
2221bd670b35SErik Nordmark ill_t *ill = nce->nce_ill;
2222bd670b35SErik Nordmark ill_t *ill1;
2223bd670b35SErik Nordmark ip_stack_t *ipst = ill->ill_ipst;
2224bd670b35SErik Nordmark int error = 0;
2225bd670b35SErik Nordmark int num_sent = 0;
2226bd670b35SErik Nordmark int err;
2227bd670b35SErik Nordmark uint_t ire_type;
2228bd670b35SErik Nordmark ipaddr_t nexthop;
2229bd670b35SErik Nordmark
2230bd670b35SErik Nordmark ASSERT(ixaflags & IXAF_IS_IPV4);
2231bd670b35SErik Nordmark
2232bd670b35SErik Nordmark /* Check for IXAF_LOOPBACK_COPY */
2233bd670b35SErik Nordmark if (ixaflags & IXAF_LOOPBACK_COPY) {
2234bd670b35SErik Nordmark mblk_t *mp1;
2235bd670b35SErik Nordmark
2236bd670b35SErik Nordmark mp1 = copymsg(mp);
2237bd670b35SErik Nordmark if (mp1 == NULL) {
2238bd670b35SErik Nordmark /* Failed to deliver the loopback copy. */
2239bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2240bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", mp, ill);
2241bd670b35SErik Nordmark error = ENOBUFS;
2242bd670b35SErik Nordmark } else {
2243bd670b35SErik Nordmark ip_postfrag_loopback(mp1, nce, ixaflags, pkt_len,
2244bd670b35SErik Nordmark nolzid);
2245bd670b35SErik Nordmark }
2246bd670b35SErik Nordmark }
2247bd670b35SErik Nordmark
2248bd670b35SErik Nordmark /*
2249bd670b35SErik Nordmark * Loop over RTF_MULTIRT for ipha_dst in the same bucket. Send
2250bd670b35SErik Nordmark * a copy to each one.
2251bd670b35SErik Nordmark * Use the nce (nexthop) and ipha_dst to find the ire.
2252bd670b35SErik Nordmark *
2253bd670b35SErik Nordmark * MULTIRT is not designed to work with shared-IP zones thus we don't
2254bd670b35SErik Nordmark * need to pass a zoneid or a label to the IRE lookup.
2255bd670b35SErik Nordmark */
2256bd670b35SErik Nordmark if (V4_PART_OF_V6(nce->nce_addr) == ipha->ipha_dst) {
2257bd670b35SErik Nordmark /* Broadcast and multicast case */
2258bd670b35SErik Nordmark ire = ire_ftable_lookup_v4(ipha->ipha_dst, 0, 0, 0,
2259bd670b35SErik Nordmark NULL, ALL_ZONES, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
2260bd670b35SErik Nordmark } else {
2261bd670b35SErik Nordmark ipaddr_t v4addr = V4_PART_OF_V6(nce->nce_addr);
2262bd670b35SErik Nordmark
2263bd670b35SErik Nordmark /* Unicast case */
2264bd670b35SErik Nordmark ire = ire_ftable_lookup_v4(ipha->ipha_dst, 0, v4addr, 0,
2265bd670b35SErik Nordmark NULL, ALL_ZONES, NULL, MATCH_IRE_GW, 0, ipst, NULL);
2266bd670b35SErik Nordmark }
2267bd670b35SErik Nordmark
2268bd670b35SErik Nordmark if (ire == NULL ||
2269bd670b35SErik Nordmark (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
2270bd670b35SErik Nordmark !(ire->ire_flags & RTF_MULTIRT)) {
2271bd670b35SErik Nordmark /* Drop */
2272bd670b35SErik Nordmark ip_drop_output("ip_postfrag_multirt didn't find route",
2273bd670b35SErik Nordmark mp, nce->nce_ill);
2274bd670b35SErik Nordmark if (ire != NULL)
2275bd670b35SErik Nordmark ire_refrele(ire);
2276bd670b35SErik Nordmark return (ENETUNREACH);
2277bd670b35SErik Nordmark }
2278bd670b35SErik Nordmark
2279bd670b35SErik Nordmark irb = ire->ire_bucket;
2280bd670b35SErik Nordmark irb_refhold(irb);
2281bd670b35SErik Nordmark for (ire1 = irb->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
2282bd670b35SErik Nordmark /*
2283bd670b35SErik Nordmark * For broadcast we can have a mixture of IRE_BROADCAST and
2284bd670b35SErik Nordmark * IRE_HOST due to the manually added IRE_HOSTs that are used
2285bd670b35SErik Nordmark * to trigger the creation of the special CGTP broadcast routes.
2286bd670b35SErik Nordmark * Thus we have to skip if ire_type doesn't match the original.
2287bd670b35SErik Nordmark */
2288bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire1) ||
2289bd670b35SErik Nordmark !(ire1->ire_flags & RTF_MULTIRT) ||
2290bd670b35SErik Nordmark ire1->ire_type != ire->ire_type)
2291bd670b35SErik Nordmark continue;
2292bd670b35SErik Nordmark
2293bd670b35SErik Nordmark /* Do the ire argument one after the loop */
2294bd670b35SErik Nordmark if (ire1 == ire)
2295bd670b35SErik Nordmark continue;
2296bd670b35SErik Nordmark
2297bd670b35SErik Nordmark ill1 = ire_nexthop_ill(ire1);
2298bd670b35SErik Nordmark if (ill1 == NULL) {
2299bd670b35SErik Nordmark /*
2300bd670b35SErik Nordmark * This ire might not have been picked by
2301bd670b35SErik Nordmark * ire_route_recursive, in which case ire_dep might
2302bd670b35SErik Nordmark * not have been setup yet.
2303bd670b35SErik Nordmark * We kick ire_route_recursive to try to resolve
2304bd670b35SErik Nordmark * starting at ire1.
2305bd670b35SErik Nordmark */
2306bd670b35SErik Nordmark ire_t *ire2;
230744b099c4SSowmini Varadhan uint_t match_flags = MATCH_IRE_DSTONLY;
2308bd670b35SErik Nordmark
230944b099c4SSowmini Varadhan if (ire1->ire_ill != NULL)
231044b099c4SSowmini Varadhan match_flags |= MATCH_IRE_ILL;
2311bd670b35SErik Nordmark ire2 = ire_route_recursive_impl_v4(ire1,
2312bd670b35SErik Nordmark ire1->ire_addr, ire1->ire_type, ire1->ire_ill,
231344b099c4SSowmini Varadhan ire1->ire_zoneid, NULL, match_flags,
23149e3469d3SErik Nordmark IRR_ALLOCATE, 0, ipst, NULL, NULL, NULL);
2315bd670b35SErik Nordmark if (ire2 != NULL)
2316bd670b35SErik Nordmark ire_refrele(ire2);
2317bd670b35SErik Nordmark ill1 = ire_nexthop_ill(ire1);
2318bd670b35SErik Nordmark }
2319bd670b35SErik Nordmark
2320bd670b35SErik Nordmark if (ill1 == NULL) {
2321bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2322bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - no ill",
2323bd670b35SErik Nordmark mp, ill);
2324bd670b35SErik Nordmark error = ENETUNREACH;
2325bd670b35SErik Nordmark continue;
2326bd670b35SErik Nordmark }
2327bd670b35SErik Nordmark
2328bd670b35SErik Nordmark /* Pick the addr and type to use for arp_nce_init */
2329bd670b35SErik Nordmark if (nce->nce_common->ncec_flags & NCE_F_BCAST) {
2330bd670b35SErik Nordmark ire_type = IRE_BROADCAST;
2331bd670b35SErik Nordmark nexthop = ire1->ire_gateway_addr;
2332bd670b35SErik Nordmark } else if (nce->nce_common->ncec_flags & NCE_F_MCAST) {
2333bd670b35SErik Nordmark ire_type = IRE_MULTICAST;
2334bd670b35SErik Nordmark nexthop = ipha->ipha_dst;
2335bd670b35SErik Nordmark } else {
2336bd670b35SErik Nordmark ire_type = ire1->ire_type; /* Doesn't matter */
2337bd670b35SErik Nordmark nexthop = ire1->ire_gateway_addr;
2338bd670b35SErik Nordmark }
2339bd670b35SErik Nordmark
2340bd670b35SErik Nordmark /* If IPMP meta or under, then we just drop */
2341bd670b35SErik Nordmark if (ill1->ill_grp != NULL) {
2342bd670b35SErik Nordmark BUMP_MIB(ill1->ill_ip_mib, ipIfStatsOutDiscards);
2343bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - IPMP",
2344bd670b35SErik Nordmark mp, ill1);
2345bd670b35SErik Nordmark ill_refrele(ill1);
2346bd670b35SErik Nordmark error = ENETUNREACH;
2347bd670b35SErik Nordmark continue;
2348bd670b35SErik Nordmark }
2349bd670b35SErik Nordmark
2350bd670b35SErik Nordmark nce1 = arp_nce_init(ill1, nexthop, ire_type);
2351bd670b35SErik Nordmark if (nce1 == NULL) {
2352bd670b35SErik Nordmark BUMP_MIB(ill1->ill_ip_mib, ipIfStatsOutDiscards);
2353bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards - no nce",
2354bd670b35SErik Nordmark mp, ill1);
2355bd670b35SErik Nordmark ill_refrele(ill1);
2356bd670b35SErik Nordmark error = ENETUNREACH;
2357bd670b35SErik Nordmark continue;
2358bd670b35SErik Nordmark }
2359bd670b35SErik Nordmark mp1 = copymsg(mp);
2360bd670b35SErik Nordmark if (mp1 == NULL) {
2361bd670b35SErik Nordmark BUMP_MIB(ill1->ill_ip_mib, ipIfStatsOutDiscards);
2362bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", mp, ill1);
2363bd670b35SErik Nordmark nce_refrele(nce1);
2364bd670b35SErik Nordmark ill_refrele(ill1);
2365bd670b35SErik Nordmark error = ENOBUFS;
2366bd670b35SErik Nordmark continue;
2367bd670b35SErik Nordmark }
2368bd670b35SErik Nordmark /* Preserve HW checksum for this copy */
2369bd670b35SErik Nordmark DB_CKSUMSTART(mp1) = DB_CKSUMSTART(mp);
2370bd670b35SErik Nordmark DB_CKSUMSTUFF(mp1) = DB_CKSUMSTUFF(mp);
2371bd670b35SErik Nordmark DB_CKSUMEND(mp1) = DB_CKSUMEND(mp);
2372bd670b35SErik Nordmark DB_CKSUMFLAGS(mp1) = DB_CKSUMFLAGS(mp);
2373bd670b35SErik Nordmark DB_LSOMSS(mp1) = DB_LSOMSS(mp);
2374bd670b35SErik Nordmark
2375bd670b35SErik Nordmark ire1->ire_ob_pkt_count++;
2376bd670b35SErik Nordmark err = ip_xmit(mp1, nce1, ixaflags, pkt_len, xmit_hint, szone,
2377bd670b35SErik Nordmark 0, ixacookie);
2378bd670b35SErik Nordmark if (err == 0)
2379bd670b35SErik Nordmark num_sent++;
2380bd670b35SErik Nordmark else
2381bd670b35SErik Nordmark error = err;
2382bd670b35SErik Nordmark nce_refrele(nce1);
2383bd670b35SErik Nordmark ill_refrele(ill1);
2384bd670b35SErik Nordmark }
2385bd670b35SErik Nordmark irb_refrele(irb);
2386bd670b35SErik Nordmark ire_refrele(ire);
2387bd670b35SErik Nordmark /* Finally, the main one */
2388bd670b35SErik Nordmark err = ip_xmit(mp, nce, ixaflags, pkt_len, xmit_hint, szone, 0,
2389bd670b35SErik Nordmark ixacookie);
2390bd670b35SErik Nordmark if (err == 0)
2391bd670b35SErik Nordmark num_sent++;
2392bd670b35SErik Nordmark else
2393bd670b35SErik Nordmark error = err;
2394bd670b35SErik Nordmark if (num_sent > 0)
2395bd670b35SErik Nordmark return (0);
2396bd670b35SErik Nordmark else
2397bd670b35SErik Nordmark return (error);
2398bd670b35SErik Nordmark }
2399bd670b35SErik Nordmark
2400bd670b35SErik Nordmark /*
2401bd670b35SErik Nordmark * Verify local connectivity. This check is called by ULP fusion code.
2402bd670b35SErik Nordmark * The generation number on an IRE_LOCAL or IRE_LOOPBACK only changes if
2403bd670b35SErik Nordmark * the interface is brought down and back up. So we simply fail the local
2404bd670b35SErik Nordmark * process. The caller, TCP Fusion, should unfuse the connection.
2405bd670b35SErik Nordmark */
2406bd670b35SErik Nordmark boolean_t
ip_output_verify_local(ip_xmit_attr_t * ixa)2407bd670b35SErik Nordmark ip_output_verify_local(ip_xmit_attr_t *ixa)
2408bd670b35SErik Nordmark {
2409bd670b35SErik Nordmark ire_t *ire = ixa->ixa_ire;
2410bd670b35SErik Nordmark
2411bd670b35SErik Nordmark if (!(ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)))
2412bd670b35SErik Nordmark return (B_FALSE);
2413bd670b35SErik Nordmark
2414bd670b35SErik Nordmark return (ixa->ixa_ire->ire_generation == ixa->ixa_ire_generation);
2415bd670b35SErik Nordmark }
2416bd670b35SErik Nordmark
2417bd670b35SErik Nordmark /*
2418bd670b35SErik Nordmark * Local process for ULP loopback, TCP Fusion. Handle both IPv4 and IPv6.
2419bd670b35SErik Nordmark *
2420bd670b35SErik Nordmark * The caller must call ip_output_verify_local() first. This function handles
2421bd670b35SErik Nordmark * IPobs, FW_HOOKS, and/or IPsec cases sequentially.
2422bd670b35SErik Nordmark */
2423bd670b35SErik Nordmark mblk_t *
ip_output_process_local(mblk_t * mp,ip_xmit_attr_t * ixa,boolean_t hooks_out,boolean_t hooks_in,conn_t * peer_connp)2424bd670b35SErik Nordmark ip_output_process_local(mblk_t *mp, ip_xmit_attr_t *ixa, boolean_t hooks_out,
2425bd670b35SErik Nordmark boolean_t hooks_in, conn_t *peer_connp)
2426bd670b35SErik Nordmark {
2427bd670b35SErik Nordmark ill_t *ill = ixa->ixa_ire->ire_ill;
2428bd670b35SErik Nordmark ipha_t *ipha = NULL;
2429bd670b35SErik Nordmark ip6_t *ip6h = NULL;
2430bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst;
2431bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags;
2432bd670b35SErik Nordmark ip_recv_attr_t iras;
2433bd670b35SErik Nordmark int error;
2434bd670b35SErik Nordmark
2435bd670b35SErik Nordmark ASSERT(mp != NULL);
2436bd670b35SErik Nordmark
2437bd670b35SErik Nordmark if (ixaflags & IXAF_IS_IPV4) {
2438bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr;
2439bd670b35SErik Nordmark
2440bd670b35SErik Nordmark /*
2441bd670b35SErik Nordmark * If a callback is enabled then we need to know the
2442bd670b35SErik Nordmark * source and destination zoneids for the packet. We already
2443bd670b35SErik Nordmark * have those handy.
2444bd670b35SErik Nordmark */
2445bd670b35SErik Nordmark if (ipst->ips_ip4_observe.he_interested) {
2446bd670b35SErik Nordmark zoneid_t szone, dzone;
2447bd670b35SErik Nordmark zoneid_t stackzoneid;
2448bd670b35SErik Nordmark
2449bd670b35SErik Nordmark stackzoneid = netstackid_to_zoneid(
2450bd670b35SErik Nordmark ipst->ips_netstack->netstack_stackid);
2451bd670b35SErik Nordmark
2452bd670b35SErik Nordmark if (stackzoneid == GLOBAL_ZONEID) {
2453bd670b35SErik Nordmark /* Shared-IP zone */
2454bd670b35SErik Nordmark dzone = ixa->ixa_ire->ire_zoneid;
2455bd670b35SErik Nordmark szone = ixa->ixa_zoneid;
2456bd670b35SErik Nordmark } else {
2457bd670b35SErik Nordmark szone = dzone = stackzoneid;
2458bd670b35SErik Nordmark }
2459bd670b35SErik Nordmark ipobs_hook(mp, IPOBS_HOOK_LOCAL, szone, dzone, ill,
2460bd670b35SErik Nordmark ipst);
2461bd670b35SErik Nordmark }
2462bd670b35SErik Nordmark DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
2463bd670b35SErik Nordmark ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *,
2464bd670b35SErik Nordmark NULL, int, 1);
2465bd670b35SErik Nordmark
2466bd670b35SErik Nordmark /* FW_HOOKS: LOOPBACK_OUT */
2467bd670b35SErik Nordmark if (hooks_out) {
2468bd670b35SErik Nordmark DTRACE_PROBE4(ip4__loopback__out__start, ill_t *, NULL,
2469bd670b35SErik Nordmark ill_t *, ill, ipha_t *, ipha, mblk_t *, mp);
2470bd670b35SErik Nordmark FW_HOOKS(ipst->ips_ip4_loopback_out_event,
2471bd670b35SErik Nordmark ipst->ips_ipv4firewall_loopback_out,
2472bd670b35SErik Nordmark NULL, ill, ipha, mp, mp, 0, ipst, error);
2473bd670b35SErik Nordmark DTRACE_PROBE1(ip4__loopback__out__end, mblk_t *, mp);
2474bd670b35SErik Nordmark }
2475bd670b35SErik Nordmark if (mp == NULL)
2476bd670b35SErik Nordmark return (NULL);
2477bd670b35SErik Nordmark
2478bd670b35SErik Nordmark /* FW_HOOKS: LOOPBACK_IN */
2479bd670b35SErik Nordmark if (hooks_in) {
2480bd670b35SErik Nordmark DTRACE_PROBE4(ip4__loopback__in__start, ill_t *, ill,
2481bd670b35SErik Nordmark ill_t *, NULL, ipha_t *, ipha, mblk_t *, mp);
2482bd670b35SErik Nordmark FW_HOOKS(ipst->ips_ip4_loopback_in_event,
2483bd670b35SErik Nordmark ipst->ips_ipv4firewall_loopback_in,
2484bd670b35SErik Nordmark ill, NULL, ipha, mp, mp, 0, ipst, error);
2485bd670b35SErik Nordmark DTRACE_PROBE1(ip4__loopback__in__end, mblk_t *, mp);
2486bd670b35SErik Nordmark }
2487bd670b35SErik Nordmark if (mp == NULL)
2488bd670b35SErik Nordmark return (NULL);
2489bd670b35SErik Nordmark
2490bd670b35SErik Nordmark DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
2491bd670b35SErik Nordmark ipha, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, ip6_t *,
2492bd670b35SErik Nordmark NULL, int, 1);
2493bd670b35SErik Nordmark
2494bd670b35SErik Nordmark /* Inbound IPsec polocies */
2495bd670b35SErik Nordmark if (peer_connp != NULL) {
2496bd670b35SErik Nordmark /* Map ixa to ira including IPsec policies. */
2497bd670b35SErik Nordmark ipsec_out_to_in(ixa, ill, &iras);
2498bd670b35SErik Nordmark mp = ipsec_check_inbound_policy(mp, peer_connp, ipha,
2499bd670b35SErik Nordmark NULL, &iras);
2500bd670b35SErik Nordmark }
2501bd670b35SErik Nordmark } else {
2502bd670b35SErik Nordmark ip6h = (ip6_t *)mp->b_rptr;
2503bd670b35SErik Nordmark
2504bd670b35SErik Nordmark /*
2505bd670b35SErik Nordmark * If a callback is enabled then we need to know the
2506bd670b35SErik Nordmark * source and destination zoneids for the packet. We already
2507bd670b35SErik Nordmark * have those handy.
2508bd670b35SErik Nordmark */
2509bd670b35SErik Nordmark if (ipst->ips_ip6_observe.he_interested) {
2510bd670b35SErik Nordmark zoneid_t szone, dzone;
2511bd670b35SErik Nordmark zoneid_t stackzoneid;
2512bd670b35SErik Nordmark
2513bd670b35SErik Nordmark stackzoneid = netstackid_to_zoneid(
2514bd670b35SErik Nordmark ipst->ips_netstack->netstack_stackid);
2515bd670b35SErik Nordmark
2516bd670b35SErik Nordmark if (stackzoneid == GLOBAL_ZONEID) {
2517bd670b35SErik Nordmark /* Shared-IP zone */
2518bd670b35SErik Nordmark dzone = ixa->ixa_ire->ire_zoneid;
2519bd670b35SErik Nordmark szone = ixa->ixa_zoneid;
2520bd670b35SErik Nordmark } else {
2521bd670b35SErik Nordmark szone = dzone = stackzoneid;
2522bd670b35SErik Nordmark }
2523bd670b35SErik Nordmark ipobs_hook(mp, IPOBS_HOOK_LOCAL, szone, dzone, ill,
2524bd670b35SErik Nordmark ipst);
2525bd670b35SErik Nordmark }
2526bd670b35SErik Nordmark DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
2527bd670b35SErik Nordmark ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *, NULL, ip6_t *,
2528bd670b35SErik Nordmark ip6h, int, 1);
2529bd670b35SErik Nordmark
2530bd670b35SErik Nordmark /* FW_HOOKS: LOOPBACK_OUT */
2531bd670b35SErik Nordmark if (hooks_out) {
2532bd670b35SErik Nordmark DTRACE_PROBE4(ip6__loopback__out__start, ill_t *, NULL,
2533bd670b35SErik Nordmark ill_t *, ill, ip6_t *, ip6h, mblk_t *, mp);
2534bd670b35SErik Nordmark FW_HOOKS6(ipst->ips_ip6_loopback_out_event,
2535bd670b35SErik Nordmark ipst->ips_ipv6firewall_loopback_out,
2536bd670b35SErik Nordmark NULL, ill, ip6h, mp, mp, 0, ipst, error);
2537bd670b35SErik Nordmark DTRACE_PROBE1(ip6__loopback__out__end, mblk_t *, mp);
2538bd670b35SErik Nordmark }
2539bd670b35SErik Nordmark if (mp == NULL)
2540bd670b35SErik Nordmark return (NULL);
2541bd670b35SErik Nordmark
2542bd670b35SErik Nordmark /* FW_HOOKS: LOOPBACK_IN */
2543bd670b35SErik Nordmark if (hooks_in) {
2544bd670b35SErik Nordmark DTRACE_PROBE4(ip6__loopback__in__start, ill_t *, ill,
2545bd670b35SErik Nordmark ill_t *, NULL, ip6_t *, ip6h, mblk_t *, mp);
2546bd670b35SErik Nordmark FW_HOOKS6(ipst->ips_ip6_loopback_in_event,
2547bd670b35SErik Nordmark ipst->ips_ipv6firewall_loopback_in,
2548bd670b35SErik Nordmark ill, NULL, ip6h, mp, mp, 0, ipst, error);
2549bd670b35SErik Nordmark DTRACE_PROBE1(ip6__loopback__in__end, mblk_t *, mp);
2550bd670b35SErik Nordmark }
2551bd670b35SErik Nordmark if (mp == NULL)
2552bd670b35SErik Nordmark return (NULL);
2553bd670b35SErik Nordmark
2554bd670b35SErik Nordmark DTRACE_IP7(receive, mblk_t *, mp, conn_t *, NULL, void_ip_t *,
2555bd670b35SErik Nordmark ip6h, __dtrace_ipsr_ill_t *, ill, ipha_t *, NULL, ip6_t *,
2556bd670b35SErik Nordmark ip6h, int, 1);
2557bd670b35SErik Nordmark
2558bd670b35SErik Nordmark /* Inbound IPsec polocies */
2559bd670b35SErik Nordmark if (peer_connp != NULL) {
2560bd670b35SErik Nordmark /* Map ixa to ira including IPsec policies. */
2561bd670b35SErik Nordmark ipsec_out_to_in(ixa, ill, &iras);
2562bd670b35SErik Nordmark mp = ipsec_check_inbound_policy(mp, peer_connp, NULL,
2563bd670b35SErik Nordmark ip6h, &iras);
2564bd670b35SErik Nordmark }
2565bd670b35SErik Nordmark }
2566bd670b35SErik Nordmark
2567bd670b35SErik Nordmark if (mp == NULL) {
2568bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
2569bd670b35SErik Nordmark ip_drop_input("ipIfStatsInDiscards", NULL, ill);
2570bd670b35SErik Nordmark }
2571bd670b35SErik Nordmark
2572bd670b35SErik Nordmark return (mp);
2573bd670b35SErik Nordmark }
2574