xref: /freebsd/sys/netinet/ip_input.c (revision 4ce386ff25d77954b8cfa11534f632172e848244)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_bootp.h"
36 #include "opt_ipfw.h"
37 #include "opt_ipstealth.h"
38 #include "opt_ipsec.h"
39 #include "opt_route.h"
40 #include "opt_rss.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/malloc.h>
46 #include <sys/domain.h>
47 #include <sys/protosw.h>
48 #include <sys/socket.h>
49 #include <sys/time.h>
50 #include <sys/kernel.h>
51 #include <sys/lock.h>
52 #include <sys/rwlock.h>
53 #include <sys/sdt.h>
54 #include <sys/syslog.h>
55 #include <sys/sysctl.h>
56 
57 #include <net/pfil.h>
58 #include <net/if.h>
59 #include <net/if_types.h>
60 #include <net/if_var.h>
61 #include <net/if_dl.h>
62 #include <net/route.h>
63 #include <net/netisr.h>
64 #include <net/rss_config.h>
65 #include <net/vnet.h>
66 
67 #include <netinet/in.h>
68 #include <netinet/in_kdtrace.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/in_var.h>
71 #include <netinet/ip.h>
72 #include <netinet/in_pcb.h>
73 #include <netinet/ip_var.h>
74 #include <netinet/ip_fw.h>
75 #include <netinet/ip_icmp.h>
76 #include <netinet/ip_options.h>
77 #include <machine/in_cksum.h>
78 #include <netinet/ip_carp.h>
79 #ifdef IPSEC
80 #include <netinet/ip_ipsec.h>
81 #endif /* IPSEC */
82 #include <netinet/in_rss.h>
83 
84 #include <sys/socketvar.h>
85 
86 #include <security/mac/mac_framework.h>
87 
88 #ifdef CTASSERT
89 CTASSERT(sizeof(struct ip) == 20);
90 #endif
91 
92 struct	rwlock in_ifaddr_lock;
93 RW_SYSINIT(in_ifaddr_lock, &in_ifaddr_lock, "in_ifaddr_lock");
94 
95 VNET_DEFINE(int, rsvp_on);
96 
97 VNET_DEFINE(int, ipforwarding);
98 SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_VNET | CTLFLAG_RW,
99     &VNET_NAME(ipforwarding), 0,
100     "Enable IP forwarding between interfaces");
101 
102 static VNET_DEFINE(int, ipsendredirects) = 1;	/* XXX */
103 #define	V_ipsendredirects	VNET(ipsendredirects)
104 SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_VNET | CTLFLAG_RW,
105     &VNET_NAME(ipsendredirects), 0,
106     "Enable sending IP redirects");
107 
108 VNET_DEFINE(int, ip_do_randomid);
109 SYSCTL_INT(_net_inet_ip, OID_AUTO, random_id, CTLFLAG_VNET | CTLFLAG_RW,
110     &VNET_NAME(ip_do_randomid), 0,
111     "Assign random ip_id values");
112 
113 /*
114  * XXX - Setting ip_checkinterface mostly implements the receive side of
115  * the Strong ES model described in RFC 1122, but since the routing table
116  * and transmit implementation do not implement the Strong ES model,
117  * setting this to 1 results in an odd hybrid.
118  *
119  * XXX - ip_checkinterface currently must be disabled if you use ipnat
120  * to translate the destination address to another local interface.
121  *
122  * XXX - ip_checkinterface must be disabled if you add IP aliases
123  * to the loopback interface instead of the interface where the
124  * packets for those addresses are received.
125  */
126 static VNET_DEFINE(int, ip_checkinterface);
127 #define	V_ip_checkinterface	VNET(ip_checkinterface)
128 SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_VNET | CTLFLAG_RW,
129     &VNET_NAME(ip_checkinterface), 0,
130     "Verify packet arrives on correct interface");
131 
132 VNET_DEFINE(struct pfil_head, inet_pfil_hook);	/* Packet filter hooks */
133 
134 static struct netisr_handler ip_nh = {
135 	.nh_name = "ip",
136 	.nh_handler = ip_input,
137 	.nh_proto = NETISR_IP,
138 #ifdef	RSS
139 	.nh_m2cpuid = rss_soft_m2cpuid,
140 	.nh_policy = NETISR_POLICY_CPU,
141 	.nh_dispatch = NETISR_DISPATCH_HYBRID,
142 #else
143 	.nh_policy = NETISR_POLICY_FLOW,
144 #endif
145 };
146 
147 #ifdef	RSS
148 /*
149  * Directly dispatched frames are currently assumed
150  * to have a flowid already calculated.
151  *
152  * It should likely have something that assert it
153  * actually has valid flow details.
154  */
155 static struct netisr_handler ip_direct_nh = {
156 	.nh_name = "ip_direct",
157 	.nh_handler = ip_direct_input,
158 	.nh_proto = NETISR_IP_DIRECT,
159 	.nh_m2cpuid = rss_m2cpuid,
160 	.nh_policy = NETISR_POLICY_CPU,
161 	.nh_dispatch = NETISR_DISPATCH_HYBRID,
162 };
163 #endif
164 
165 extern	struct domain inetdomain;
166 extern	struct protosw inetsw[];
167 u_char	ip_protox[IPPROTO_MAX];
168 VNET_DEFINE(struct in_ifaddrhead, in_ifaddrhead);  /* first inet address */
169 VNET_DEFINE(struct in_ifaddrhashhead *, in_ifaddrhashtbl); /* inet addr hash table  */
170 VNET_DEFINE(u_long, in_ifaddrhmask);		/* mask for hash table */
171 
172 static VNET_DEFINE(uma_zone_t, ipq_zone);
173 static VNET_DEFINE(TAILQ_HEAD(ipqhead, ipq), ipq[IPREASS_NHASH]);
174 static struct mtx ipqlock;
175 
176 #define	V_ipq_zone		VNET(ipq_zone)
177 #define	V_ipq			VNET(ipq)
178 
179 #define	IPQ_LOCK()	mtx_lock(&ipqlock)
180 #define	IPQ_UNLOCK()	mtx_unlock(&ipqlock)
181 #define	IPQ_LOCK_INIT()	mtx_init(&ipqlock, "ipqlock", NULL, MTX_DEF)
182 #define	IPQ_LOCK_ASSERT()	mtx_assert(&ipqlock, MA_OWNED)
183 
184 static void	maxnipq_update(void);
185 static void	ipq_zone_change(void *);
186 static void	ip_drain_locked(void);
187 
188 static VNET_DEFINE(int, maxnipq);  /* Administrative limit on # reass queues. */
189 static VNET_DEFINE(int, nipq);			/* Total # of reass queues */
190 #define	V_maxnipq		VNET(maxnipq)
191 #define	V_nipq			VNET(nipq)
192 SYSCTL_INT(_net_inet_ip, OID_AUTO, fragpackets, CTLFLAG_VNET | CTLFLAG_RD,
193     &VNET_NAME(nipq), 0,
194     "Current number of IPv4 fragment reassembly queue entries");
195 
196 static VNET_DEFINE(int, maxfragsperpacket);
197 #define	V_maxfragsperpacket	VNET(maxfragsperpacket)
198 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragsperpacket, CTLFLAG_VNET | CTLFLAG_RW,
199     &VNET_NAME(maxfragsperpacket), 0,
200     "Maximum number of IPv4 fragments allowed per packet");
201 
202 #ifdef IPCTL_DEFMTU
203 SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW,
204     &ip_mtu, 0, "Default MTU");
205 #endif
206 
207 #ifdef IPSTEALTH
208 VNET_DEFINE(int, ipstealth);
209 SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_VNET | CTLFLAG_RW,
210     &VNET_NAME(ipstealth), 0,
211     "IP stealth mode, no TTL decrementation on forwarding");
212 #endif
213 
214 static void	ip_freef(struct ipqhead *, struct ipq *);
215 
216 /*
217  * IP statistics are stored in the "array" of counter(9)s.
218  */
219 VNET_PCPUSTAT_DEFINE(struct ipstat, ipstat);
220 VNET_PCPUSTAT_SYSINIT(ipstat);
221 SYSCTL_VNET_PCPUSTAT(_net_inet_ip, IPCTL_STATS, stats, struct ipstat, ipstat,
222     "IP statistics (struct ipstat, netinet/ip_var.h)");
223 
224 #ifdef VIMAGE
225 VNET_PCPUSTAT_SYSUNINIT(ipstat);
226 #endif /* VIMAGE */
227 
228 /*
229  * Kernel module interface for updating ipstat.  The argument is an index
230  * into ipstat treated as an array.
231  */
232 void
233 kmod_ipstat_inc(int statnum)
234 {
235 
236 	counter_u64_add(VNET(ipstat)[statnum], 1);
237 }
238 
239 void
240 kmod_ipstat_dec(int statnum)
241 {
242 
243 	counter_u64_add(VNET(ipstat)[statnum], -1);
244 }
245 
246 static int
247 sysctl_netinet_intr_queue_maxlen(SYSCTL_HANDLER_ARGS)
248 {
249 	int error, qlimit;
250 
251 	netisr_getqlimit(&ip_nh, &qlimit);
252 	error = sysctl_handle_int(oidp, &qlimit, 0, req);
253 	if (error || !req->newptr)
254 		return (error);
255 	if (qlimit < 1)
256 		return (EINVAL);
257 	return (netisr_setqlimit(&ip_nh, qlimit));
258 }
259 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen,
260     CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_queue_maxlen, "I",
261     "Maximum size of the IP input queue");
262 
263 static int
264 sysctl_netinet_intr_queue_drops(SYSCTL_HANDLER_ARGS)
265 {
266 	u_int64_t qdrops_long;
267 	int error, qdrops;
268 
269 	netisr_getqdrops(&ip_nh, &qdrops_long);
270 	qdrops = qdrops_long;
271 	error = sysctl_handle_int(oidp, &qdrops, 0, req);
272 	if (error || !req->newptr)
273 		return (error);
274 	if (qdrops != 0)
275 		return (EINVAL);
276 	netisr_clearqdrops(&ip_nh);
277 	return (0);
278 }
279 
280 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops,
281     CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_queue_drops, "I",
282     "Number of packets dropped from the IP input queue");
283 
284 #ifdef	RSS
285 static int
286 sysctl_netinet_intr_direct_queue_maxlen(SYSCTL_HANDLER_ARGS)
287 {
288 	int error, qlimit;
289 
290 	netisr_getqlimit(&ip_direct_nh, &qlimit);
291 	error = sysctl_handle_int(oidp, &qlimit, 0, req);
292 	if (error || !req->newptr)
293 		return (error);
294 	if (qlimit < 1)
295 		return (EINVAL);
296 	return (netisr_setqlimit(&ip_direct_nh, qlimit));
297 }
298 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_direct_queue_maxlen,
299     CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_direct_queue_maxlen, "I",
300     "Maximum size of the IP direct input queue");
301 
302 static int
303 sysctl_netinet_intr_direct_queue_drops(SYSCTL_HANDLER_ARGS)
304 {
305 	u_int64_t qdrops_long;
306 	int error, qdrops;
307 
308 	netisr_getqdrops(&ip_direct_nh, &qdrops_long);
309 	qdrops = qdrops_long;
310 	error = sysctl_handle_int(oidp, &qdrops, 0, req);
311 	if (error || !req->newptr)
312 		return (error);
313 	if (qdrops != 0)
314 		return (EINVAL);
315 	netisr_clearqdrops(&ip_direct_nh);
316 	return (0);
317 }
318 
319 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_direct_queue_drops,
320     CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_direct_queue_drops, "I",
321     "Number of packets dropped from the IP direct input queue");
322 #endif	/* RSS */
323 
324 /*
325  * IP initialization: fill in IP protocol switch table.
326  * All protocols not implemented in kernel go to raw IP protocol handler.
327  */
328 void
329 ip_init(void)
330 {
331 	struct protosw *pr;
332 	int i;
333 
334 	V_ip_id = time_second & 0xffff;
335 
336 	TAILQ_INIT(&V_in_ifaddrhead);
337 	V_in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &V_in_ifaddrhmask);
338 
339 	/* Initialize IP reassembly queue. */
340 	for (i = 0; i < IPREASS_NHASH; i++)
341 		TAILQ_INIT(&V_ipq[i]);
342 	V_maxnipq = nmbclusters / 32;
343 	V_maxfragsperpacket = 16;
344 	V_ipq_zone = uma_zcreate("ipq", sizeof(struct ipq), NULL, NULL, NULL,
345 	    NULL, UMA_ALIGN_PTR, 0);
346 	maxnipq_update();
347 
348 	/* Initialize packet filter hooks. */
349 	V_inet_pfil_hook.ph_type = PFIL_TYPE_AF;
350 	V_inet_pfil_hook.ph_af = AF_INET;
351 	if ((i = pfil_head_register(&V_inet_pfil_hook)) != 0)
352 		printf("%s: WARNING: unable to register pfil hook, "
353 			"error %d\n", __func__, i);
354 
355 	/* Skip initialization of globals for non-default instances. */
356 	if (!IS_DEFAULT_VNET(curvnet))
357 		return;
358 
359 	pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);
360 	if (pr == NULL)
361 		panic("ip_init: PF_INET not found");
362 
363 	/* Initialize the entire ip_protox[] array to IPPROTO_RAW. */
364 	for (i = 0; i < IPPROTO_MAX; i++)
365 		ip_protox[i] = pr - inetsw;
366 	/*
367 	 * Cycle through IP protocols and put them into the appropriate place
368 	 * in ip_protox[].
369 	 */
370 	for (pr = inetdomain.dom_protosw;
371 	    pr < inetdomain.dom_protoswNPROTOSW; pr++)
372 		if (pr->pr_domain->dom_family == PF_INET &&
373 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) {
374 			/* Be careful to only index valid IP protocols. */
375 			if (pr->pr_protocol < IPPROTO_MAX)
376 				ip_protox[pr->pr_protocol] = pr - inetsw;
377 		}
378 
379 	EVENTHANDLER_REGISTER(nmbclusters_change, ipq_zone_change,
380 		NULL, EVENTHANDLER_PRI_ANY);
381 
382 	/* Initialize various other remaining things. */
383 	IPQ_LOCK_INIT();
384 	netisr_register(&ip_nh);
385 #ifdef	RSS
386 	netisr_register(&ip_direct_nh);
387 #endif
388 }
389 
390 #ifdef VIMAGE
391 void
392 ip_destroy(void)
393 {
394 	int i;
395 
396 	if ((i = pfil_head_unregister(&V_inet_pfil_hook)) != 0)
397 		printf("%s: WARNING: unable to unregister pfil hook, "
398 		    "error %d\n", __func__, i);
399 
400 	/* Cleanup in_ifaddr hash table; should be empty. */
401 	hashdestroy(V_in_ifaddrhashtbl, M_IFADDR, V_in_ifaddrhmask);
402 
403 	IPQ_LOCK();
404 	ip_drain_locked();
405 	IPQ_UNLOCK();
406 
407 	uma_zdestroy(V_ipq_zone);
408 }
409 #endif
410 
411 #ifdef	RSS
412 /*
413  * IP direct input routine.
414  *
415  * This is called when reinjecting completed fragments where
416  * all of the previous checking and book-keeping has been done.
417  */
418 void
419 ip_direct_input(struct mbuf *m)
420 {
421 	struct ip *ip;
422 	int hlen;
423 
424 	ip = mtod(m, struct ip *);
425 	hlen = ip->ip_hl << 2;
426 
427 	IPSTAT_INC(ips_delivered);
428 	(*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p);
429 	return;
430 }
431 #endif
432 
433 /*
434  * Ip input routine.  Checksum and byte swap header.  If fragmented
435  * try to reassemble.  Process options.  Pass to next level.
436  */
437 void
438 ip_input(struct mbuf *m)
439 {
440 	struct ip *ip = NULL;
441 	struct in_ifaddr *ia = NULL;
442 	struct ifaddr *ifa;
443 	struct ifnet *ifp;
444 	int    checkif, hlen = 0;
445 	uint16_t sum, ip_len;
446 	int dchg = 0;				/* dest changed after fw */
447 	struct in_addr odst;			/* original dst address */
448 
449 	M_ASSERTPKTHDR(m);
450 
451 	if (m->m_flags & M_FASTFWD_OURS) {
452 		m->m_flags &= ~M_FASTFWD_OURS;
453 		/* Set up some basics that will be used later. */
454 		ip = mtod(m, struct ip *);
455 		hlen = ip->ip_hl << 2;
456 		ip_len = ntohs(ip->ip_len);
457 		goto ours;
458 	}
459 
460 	IPSTAT_INC(ips_total);
461 
462 	if (m->m_pkthdr.len < sizeof(struct ip))
463 		goto tooshort;
464 
465 	if (m->m_len < sizeof (struct ip) &&
466 	    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
467 		IPSTAT_INC(ips_toosmall);
468 		return;
469 	}
470 	ip = mtod(m, struct ip *);
471 
472 	if (ip->ip_v != IPVERSION) {
473 		IPSTAT_INC(ips_badvers);
474 		goto bad;
475 	}
476 
477 	hlen = ip->ip_hl << 2;
478 	if (hlen < sizeof(struct ip)) {	/* minimum header length */
479 		IPSTAT_INC(ips_badhlen);
480 		goto bad;
481 	}
482 	if (hlen > m->m_len) {
483 		if ((m = m_pullup(m, hlen)) == NULL) {
484 			IPSTAT_INC(ips_badhlen);
485 			return;
486 		}
487 		ip = mtod(m, struct ip *);
488 	}
489 
490 	IP_PROBE(receive, NULL, NULL, ip, m->m_pkthdr.rcvif, ip, NULL);
491 
492 	/* 127/8 must not appear on wire - RFC1122 */
493 	ifp = m->m_pkthdr.rcvif;
494 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
495 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
496 		if ((ifp->if_flags & IFF_LOOPBACK) == 0) {
497 			IPSTAT_INC(ips_badaddr);
498 			goto bad;
499 		}
500 	}
501 
502 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
503 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
504 	} else {
505 		if (hlen == sizeof(struct ip)) {
506 			sum = in_cksum_hdr(ip);
507 		} else {
508 			sum = in_cksum(m, hlen);
509 		}
510 	}
511 	if (sum) {
512 		IPSTAT_INC(ips_badsum);
513 		goto bad;
514 	}
515 
516 #ifdef ALTQ
517 	if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0)
518 		/* packet is dropped by traffic conditioner */
519 		return;
520 #endif
521 
522 	ip_len = ntohs(ip->ip_len);
523 	if (ip_len < hlen) {
524 		IPSTAT_INC(ips_badlen);
525 		goto bad;
526 	}
527 
528 	/*
529 	 * Check that the amount of data in the buffers
530 	 * is as at least much as the IP header would have us expect.
531 	 * Trim mbufs if longer than we expect.
532 	 * Drop packet if shorter than we expect.
533 	 */
534 	if (m->m_pkthdr.len < ip_len) {
535 tooshort:
536 		IPSTAT_INC(ips_tooshort);
537 		goto bad;
538 	}
539 	if (m->m_pkthdr.len > ip_len) {
540 		if (m->m_len == m->m_pkthdr.len) {
541 			m->m_len = ip_len;
542 			m->m_pkthdr.len = ip_len;
543 		} else
544 			m_adj(m, ip_len - m->m_pkthdr.len);
545 	}
546 
547 #ifdef IPSEC
548 	/*
549 	 * Bypass packet filtering for packets previously handled by IPsec.
550 	 */
551 	if (ip_ipsec_filtertunnel(m))
552 		goto passin;
553 #endif /* IPSEC */
554 
555 	/*
556 	 * Run through list of hooks for input packets.
557 	 *
558 	 * NB: Beware of the destination address changing (e.g.
559 	 *     by NAT rewriting).  When this happens, tell
560 	 *     ip_forward to do the right thing.
561 	 */
562 
563 	/* Jump over all PFIL processing if hooks are not active. */
564 	if (!PFIL_HOOKED(&V_inet_pfil_hook))
565 		goto passin;
566 
567 	odst = ip->ip_dst;
568 	if (pfil_run_hooks(&V_inet_pfil_hook, &m, ifp, PFIL_IN, NULL) != 0)
569 		return;
570 	if (m == NULL)			/* consumed by filter */
571 		return;
572 
573 	ip = mtod(m, struct ip *);
574 	dchg = (odst.s_addr != ip->ip_dst.s_addr);
575 	ifp = m->m_pkthdr.rcvif;
576 
577 	if (m->m_flags & M_FASTFWD_OURS) {
578 		m->m_flags &= ~M_FASTFWD_OURS;
579 		goto ours;
580 	}
581 	if (m->m_flags & M_IP_NEXTHOP) {
582 		dchg = (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL);
583 		if (dchg != 0) {
584 			/*
585 			 * Directly ship the packet on.  This allows
586 			 * forwarding packets originally destined to us
587 			 * to some other directly connected host.
588 			 */
589 			ip_forward(m, 1);
590 			return;
591 		}
592 	}
593 passin:
594 
595 	/*
596 	 * Process options and, if not destined for us,
597 	 * ship it on.  ip_dooptions returns 1 when an
598 	 * error was detected (causing an icmp message
599 	 * to be sent and the original packet to be freed).
600 	 */
601 	if (hlen > sizeof (struct ip) && ip_dooptions(m, 0))
602 		return;
603 
604         /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no
605          * matter if it is destined to another node, or whether it is
606          * a multicast one, RSVP wants it! and prevents it from being forwarded
607          * anywhere else. Also checks if the rsvp daemon is running before
608 	 * grabbing the packet.
609          */
610 	if (V_rsvp_on && ip->ip_p==IPPROTO_RSVP)
611 		goto ours;
612 
613 	/*
614 	 * Check our list of addresses, to see if the packet is for us.
615 	 * If we don't have any addresses, assume any unicast packet
616 	 * we receive might be for us (and let the upper layers deal
617 	 * with it).
618 	 */
619 	if (TAILQ_EMPTY(&V_in_ifaddrhead) &&
620 	    (m->m_flags & (M_MCAST|M_BCAST)) == 0)
621 		goto ours;
622 
623 	/*
624 	 * Enable a consistency check between the destination address
625 	 * and the arrival interface for a unicast packet (the RFC 1122
626 	 * strong ES model) if IP forwarding is disabled and the packet
627 	 * is not locally generated and the packet is not subject to
628 	 * 'ipfw fwd'.
629 	 *
630 	 * XXX - Checking also should be disabled if the destination
631 	 * address is ipnat'ed to a different interface.
632 	 *
633 	 * XXX - Checking is incompatible with IP aliases added
634 	 * to the loopback interface instead of the interface where
635 	 * the packets are received.
636 	 *
637 	 * XXX - This is the case for carp vhost IPs as well so we
638 	 * insert a workaround. If the packet got here, we already
639 	 * checked with carp_iamatch() and carp_forus().
640 	 */
641 	checkif = V_ip_checkinterface && (V_ipforwarding == 0) &&
642 	    ifp != NULL && ((ifp->if_flags & IFF_LOOPBACK) == 0) &&
643 	    ifp->if_carp == NULL && (dchg == 0);
644 
645 	/*
646 	 * Check for exact addresses in the hash bucket.
647 	 */
648 	/* IN_IFADDR_RLOCK(); */
649 	LIST_FOREACH(ia, INADDR_HASH(ip->ip_dst.s_addr), ia_hash) {
650 		/*
651 		 * If the address matches, verify that the packet
652 		 * arrived via the correct interface if checking is
653 		 * enabled.
654 		 */
655 		if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_dst.s_addr &&
656 		    (!checkif || ia->ia_ifp == ifp)) {
657 			counter_u64_add(ia->ia_ifa.ifa_ipackets, 1);
658 			counter_u64_add(ia->ia_ifa.ifa_ibytes,
659 			    m->m_pkthdr.len);
660 			/* IN_IFADDR_RUNLOCK(); */
661 			goto ours;
662 		}
663 	}
664 	/* IN_IFADDR_RUNLOCK(); */
665 
666 	/*
667 	 * Check for broadcast addresses.
668 	 *
669 	 * Only accept broadcast packets that arrive via the matching
670 	 * interface.  Reception of forwarded directed broadcasts would
671 	 * be handled via ip_forward() and ether_output() with the loopback
672 	 * into the stack for SIMPLEX interfaces handled by ether_output().
673 	 */
674 	if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) {
675 		IF_ADDR_RLOCK(ifp);
676 	        TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
677 			if (ifa->ifa_addr->sa_family != AF_INET)
678 				continue;
679 			ia = ifatoia(ifa);
680 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
681 			    ip->ip_dst.s_addr) {
682 				counter_u64_add(ia->ia_ifa.ifa_ipackets, 1);
683 				counter_u64_add(ia->ia_ifa.ifa_ibytes,
684 				    m->m_pkthdr.len);
685 				IF_ADDR_RUNLOCK(ifp);
686 				goto ours;
687 			}
688 #ifdef BOOTP_COMPAT
689 			if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY) {
690 				counter_u64_add(ia->ia_ifa.ifa_ipackets, 1);
691 				counter_u64_add(ia->ia_ifa.ifa_ibytes,
692 				    m->m_pkthdr.len);
693 				IF_ADDR_RUNLOCK(ifp);
694 				goto ours;
695 			}
696 #endif
697 		}
698 		IF_ADDR_RUNLOCK(ifp);
699 		ia = NULL;
700 	}
701 	/* RFC 3927 2.7: Do not forward datagrams for 169.254.0.0/16. */
702 	if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) {
703 		IPSTAT_INC(ips_cantforward);
704 		m_freem(m);
705 		return;
706 	}
707 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
708 		if (V_ip_mrouter) {
709 			/*
710 			 * If we are acting as a multicast router, all
711 			 * incoming multicast packets are passed to the
712 			 * kernel-level multicast forwarding function.
713 			 * The packet is returned (relatively) intact; if
714 			 * ip_mforward() returns a non-zero value, the packet
715 			 * must be discarded, else it may be accepted below.
716 			 */
717 			if (ip_mforward && ip_mforward(ip, ifp, m, 0) != 0) {
718 				IPSTAT_INC(ips_cantforward);
719 				m_freem(m);
720 				return;
721 			}
722 
723 			/*
724 			 * The process-level routing daemon needs to receive
725 			 * all multicast IGMP packets, whether or not this
726 			 * host belongs to their destination groups.
727 			 */
728 			if (ip->ip_p == IPPROTO_IGMP)
729 				goto ours;
730 			IPSTAT_INC(ips_forward);
731 		}
732 		/*
733 		 * Assume the packet is for us, to avoid prematurely taking
734 		 * a lock on the in_multi hash. Protocols must perform
735 		 * their own filtering and update statistics accordingly.
736 		 */
737 		goto ours;
738 	}
739 	if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST)
740 		goto ours;
741 	if (ip->ip_dst.s_addr == INADDR_ANY)
742 		goto ours;
743 
744 	/*
745 	 * Not for us; forward if possible and desirable.
746 	 */
747 	if (V_ipforwarding == 0) {
748 		IPSTAT_INC(ips_cantforward);
749 		m_freem(m);
750 	} else {
751 		ip_forward(m, dchg);
752 	}
753 	return;
754 
755 ours:
756 #ifdef IPSTEALTH
757 	/*
758 	 * IPSTEALTH: Process non-routing options only
759 	 * if the packet is destined for us.
760 	 */
761 	if (V_ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1))
762 		return;
763 #endif /* IPSTEALTH */
764 
765 	/*
766 	 * Attempt reassembly; if it succeeds, proceed.
767 	 * ip_reass() will return a different mbuf.
768 	 */
769 	if (ip->ip_off & htons(IP_MF | IP_OFFMASK)) {
770 		/* XXXGL: shouldn't we save & set m_flags? */
771 		m = ip_reass(m);
772 		if (m == NULL)
773 			return;
774 		ip = mtod(m, struct ip *);
775 		/* Get the header length of the reassembled packet */
776 		hlen = ip->ip_hl << 2;
777 	}
778 
779 #ifdef IPSEC
780 	/*
781 	 * enforce IPsec policy checking if we are seeing last header.
782 	 * note that we do not visit this with protocols with pcb layer
783 	 * code - like udp/tcp/raw ip.
784 	 */
785 	if (ip_ipsec_input(m, ip->ip_p) != 0)
786 		goto bad;
787 #endif /* IPSEC */
788 
789 	/*
790 	 * Switch out to protocol's input routine.
791 	 */
792 	IPSTAT_INC(ips_delivered);
793 
794 	(*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p);
795 	return;
796 bad:
797 	m_freem(m);
798 }
799 
800 /*
801  * After maxnipq has been updated, propagate the change to UMA.  The UMA zone
802  * max has slightly different semantics than the sysctl, for historical
803  * reasons.
804  */
805 static void
806 maxnipq_update(void)
807 {
808 
809 	/*
810 	 * -1 for unlimited allocation.
811 	 */
812 	if (V_maxnipq < 0)
813 		uma_zone_set_max(V_ipq_zone, 0);
814 	/*
815 	 * Positive number for specific bound.
816 	 */
817 	if (V_maxnipq > 0)
818 		uma_zone_set_max(V_ipq_zone, V_maxnipq);
819 	/*
820 	 * Zero specifies no further fragment queue allocation -- set the
821 	 * bound very low, but rely on implementation elsewhere to actually
822 	 * prevent allocation and reclaim current queues.
823 	 */
824 	if (V_maxnipq == 0)
825 		uma_zone_set_max(V_ipq_zone, 1);
826 }
827 
828 static void
829 ipq_zone_change(void *tag)
830 {
831 
832 	if (V_maxnipq > 0 && V_maxnipq < (nmbclusters / 32)) {
833 		V_maxnipq = nmbclusters / 32;
834 		maxnipq_update();
835 	}
836 }
837 
838 static int
839 sysctl_maxnipq(SYSCTL_HANDLER_ARGS)
840 {
841 	int error, i;
842 
843 	i = V_maxnipq;
844 	error = sysctl_handle_int(oidp, &i, 0, req);
845 	if (error || !req->newptr)
846 		return (error);
847 
848 	/*
849 	 * XXXRW: Might be a good idea to sanity check the argument and place
850 	 * an extreme upper bound.
851 	 */
852 	if (i < -1)
853 		return (EINVAL);
854 	V_maxnipq = i;
855 	maxnipq_update();
856 	return (0);
857 }
858 
859 SYSCTL_PROC(_net_inet_ip, OID_AUTO, maxfragpackets, CTLTYPE_INT|CTLFLAG_RW,
860     NULL, 0, sysctl_maxnipq, "I",
861     "Maximum number of IPv4 fragment reassembly queue entries");
862 
863 #define	M_IP_FRAG	M_PROTO9
864 
865 /*
866  * Take incoming datagram fragment and try to reassemble it into
867  * whole datagram.  If the argument is the first fragment or one
868  * in between the function will return NULL and store the mbuf
869  * in the fragment chain.  If the argument is the last fragment
870  * the packet will be reassembled and the pointer to the new
871  * mbuf returned for further processing.  Only m_tags attached
872  * to the first packet/fragment are preserved.
873  * The IP header is *NOT* adjusted out of iplen.
874  */
875 struct mbuf *
876 ip_reass(struct mbuf *m)
877 {
878 	struct ip *ip;
879 	struct mbuf *p, *q, *nq, *t;
880 	struct ipq *fp = NULL;
881 	struct ipqhead *head;
882 	int i, hlen, next;
883 	u_int8_t ecn, ecn0;
884 	u_short hash;
885 #ifdef	RSS
886 	uint32_t rss_hash, rss_type;
887 #endif
888 
889 	/* If maxnipq or maxfragsperpacket are 0, never accept fragments. */
890 	if (V_maxnipq == 0 || V_maxfragsperpacket == 0) {
891 		IPSTAT_INC(ips_fragments);
892 		IPSTAT_INC(ips_fragdropped);
893 		m_freem(m);
894 		return (NULL);
895 	}
896 
897 	ip = mtod(m, struct ip *);
898 	hlen = ip->ip_hl << 2;
899 
900 	hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);
901 	head = &V_ipq[hash];
902 	IPQ_LOCK();
903 
904 	/*
905 	 * Look for queue of fragments
906 	 * of this datagram.
907 	 */
908 	TAILQ_FOREACH(fp, head, ipq_list)
909 		if (ip->ip_id == fp->ipq_id &&
910 		    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
911 		    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
912 #ifdef MAC
913 		    mac_ipq_match(m, fp) &&
914 #endif
915 		    ip->ip_p == fp->ipq_p)
916 			goto found;
917 
918 	fp = NULL;
919 
920 	/*
921 	 * Attempt to trim the number of allocated fragment queues if it
922 	 * exceeds the administrative limit.
923 	 */
924 	if ((V_nipq > V_maxnipq) && (V_maxnipq > 0)) {
925 		/*
926 		 * drop something from the tail of the current queue
927 		 * before proceeding further
928 		 */
929 		struct ipq *q = TAILQ_LAST(head, ipqhead);
930 		if (q == NULL) {   /* gak */
931 			for (i = 0; i < IPREASS_NHASH; i++) {
932 				struct ipq *r = TAILQ_LAST(&V_ipq[i], ipqhead);
933 				if (r) {
934 					IPSTAT_ADD(ips_fragtimeout,
935 					    r->ipq_nfrags);
936 					ip_freef(&V_ipq[i], r);
937 					break;
938 				}
939 			}
940 		} else {
941 			IPSTAT_ADD(ips_fragtimeout, q->ipq_nfrags);
942 			ip_freef(head, q);
943 		}
944 	}
945 
946 found:
947 	/*
948 	 * Adjust ip_len to not reflect header,
949 	 * convert offset of this to bytes.
950 	 */
951 	ip->ip_len = htons(ntohs(ip->ip_len) - hlen);
952 	if (ip->ip_off & htons(IP_MF)) {
953 		/*
954 		 * Make sure that fragments have a data length
955 		 * that's a non-zero multiple of 8 bytes.
956 		 */
957 		if (ip->ip_len == htons(0) || (ntohs(ip->ip_len) & 0x7) != 0) {
958 			IPSTAT_INC(ips_toosmall); /* XXX */
959 			goto dropfrag;
960 		}
961 		m->m_flags |= M_IP_FRAG;
962 	} else
963 		m->m_flags &= ~M_IP_FRAG;
964 	ip->ip_off = htons(ntohs(ip->ip_off) << 3);
965 
966 	/*
967 	 * Attempt reassembly; if it succeeds, proceed.
968 	 * ip_reass() will return a different mbuf.
969 	 */
970 	IPSTAT_INC(ips_fragments);
971 	m->m_pkthdr.PH_loc.ptr = ip;
972 
973 	/* Previous ip_reass() started here. */
974 	/*
975 	 * Presence of header sizes in mbufs
976 	 * would confuse code below.
977 	 */
978 	m->m_data += hlen;
979 	m->m_len -= hlen;
980 
981 	/*
982 	 * If first fragment to arrive, create a reassembly queue.
983 	 */
984 	if (fp == NULL) {
985 		fp = uma_zalloc(V_ipq_zone, M_NOWAIT);
986 		if (fp == NULL)
987 			goto dropfrag;
988 #ifdef MAC
989 		if (mac_ipq_init(fp, M_NOWAIT) != 0) {
990 			uma_zfree(V_ipq_zone, fp);
991 			fp = NULL;
992 			goto dropfrag;
993 		}
994 		mac_ipq_create(m, fp);
995 #endif
996 		TAILQ_INSERT_HEAD(head, fp, ipq_list);
997 		V_nipq++;
998 		fp->ipq_nfrags = 1;
999 		fp->ipq_ttl = IPFRAGTTL;
1000 		fp->ipq_p = ip->ip_p;
1001 		fp->ipq_id = ip->ip_id;
1002 		fp->ipq_src = ip->ip_src;
1003 		fp->ipq_dst = ip->ip_dst;
1004 		fp->ipq_frags = m;
1005 		m->m_nextpkt = NULL;
1006 		goto done;
1007 	} else {
1008 		fp->ipq_nfrags++;
1009 #ifdef MAC
1010 		mac_ipq_update(m, fp);
1011 #endif
1012 	}
1013 
1014 #define GETIP(m)	((struct ip*)((m)->m_pkthdr.PH_loc.ptr))
1015 
1016 	/*
1017 	 * Handle ECN by comparing this segment with the first one;
1018 	 * if CE is set, do not lose CE.
1019 	 * drop if CE and not-ECT are mixed for the same packet.
1020 	 */
1021 	ecn = ip->ip_tos & IPTOS_ECN_MASK;
1022 	ecn0 = GETIP(fp->ipq_frags)->ip_tos & IPTOS_ECN_MASK;
1023 	if (ecn == IPTOS_ECN_CE) {
1024 		if (ecn0 == IPTOS_ECN_NOTECT)
1025 			goto dropfrag;
1026 		if (ecn0 != IPTOS_ECN_CE)
1027 			GETIP(fp->ipq_frags)->ip_tos |= IPTOS_ECN_CE;
1028 	}
1029 	if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT)
1030 		goto dropfrag;
1031 
1032 	/*
1033 	 * Find a segment which begins after this one does.
1034 	 */
1035 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt)
1036 		if (ntohs(GETIP(q)->ip_off) > ntohs(ip->ip_off))
1037 			break;
1038 
1039 	/*
1040 	 * If there is a preceding segment, it may provide some of
1041 	 * our data already.  If so, drop the data from the incoming
1042 	 * segment.  If it provides all of our data, drop us, otherwise
1043 	 * stick new segment in the proper place.
1044 	 *
1045 	 * If some of the data is dropped from the preceding
1046 	 * segment, then it's checksum is invalidated.
1047 	 */
1048 	if (p) {
1049 		i = ntohs(GETIP(p)->ip_off) + ntohs(GETIP(p)->ip_len) -
1050 		    ntohs(ip->ip_off);
1051 		if (i > 0) {
1052 			if (i >= ntohs(ip->ip_len))
1053 				goto dropfrag;
1054 			m_adj(m, i);
1055 			m->m_pkthdr.csum_flags = 0;
1056 			ip->ip_off = htons(ntohs(ip->ip_off) + i);
1057 			ip->ip_len = htons(ntohs(ip->ip_len) - i);
1058 		}
1059 		m->m_nextpkt = p->m_nextpkt;
1060 		p->m_nextpkt = m;
1061 	} else {
1062 		m->m_nextpkt = fp->ipq_frags;
1063 		fp->ipq_frags = m;
1064 	}
1065 
1066 	/*
1067 	 * While we overlap succeeding segments trim them or,
1068 	 * if they are completely covered, dequeue them.
1069 	 */
1070 	for (; q != NULL && ntohs(ip->ip_off) + ntohs(ip->ip_len) >
1071 	    ntohs(GETIP(q)->ip_off); q = nq) {
1072 		i = (ntohs(ip->ip_off) + ntohs(ip->ip_len)) -
1073 		    ntohs(GETIP(q)->ip_off);
1074 		if (i < ntohs(GETIP(q)->ip_len)) {
1075 			GETIP(q)->ip_len = htons(ntohs(GETIP(q)->ip_len) - i);
1076 			GETIP(q)->ip_off = htons(ntohs(GETIP(q)->ip_off) + i);
1077 			m_adj(q, i);
1078 			q->m_pkthdr.csum_flags = 0;
1079 			break;
1080 		}
1081 		nq = q->m_nextpkt;
1082 		m->m_nextpkt = nq;
1083 		IPSTAT_INC(ips_fragdropped);
1084 		fp->ipq_nfrags--;
1085 		m_freem(q);
1086 	}
1087 
1088 	/*
1089 	 * Check for complete reassembly and perform frag per packet
1090 	 * limiting.
1091 	 *
1092 	 * Frag limiting is performed here so that the nth frag has
1093 	 * a chance to complete the packet before we drop the packet.
1094 	 * As a result, n+1 frags are actually allowed per packet, but
1095 	 * only n will ever be stored. (n = maxfragsperpacket.)
1096 	 *
1097 	 */
1098 	next = 0;
1099 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
1100 		if (ntohs(GETIP(q)->ip_off) != next) {
1101 			if (fp->ipq_nfrags > V_maxfragsperpacket) {
1102 				IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags);
1103 				ip_freef(head, fp);
1104 			}
1105 			goto done;
1106 		}
1107 		next += ntohs(GETIP(q)->ip_len);
1108 	}
1109 	/* Make sure the last packet didn't have the IP_MF flag */
1110 	if (p->m_flags & M_IP_FRAG) {
1111 		if (fp->ipq_nfrags > V_maxfragsperpacket) {
1112 			IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags);
1113 			ip_freef(head, fp);
1114 		}
1115 		goto done;
1116 	}
1117 
1118 	/*
1119 	 * Reassembly is complete.  Make sure the packet is a sane size.
1120 	 */
1121 	q = fp->ipq_frags;
1122 	ip = GETIP(q);
1123 	if (next + (ip->ip_hl << 2) > IP_MAXPACKET) {
1124 		IPSTAT_INC(ips_toolong);
1125 		IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags);
1126 		ip_freef(head, fp);
1127 		goto done;
1128 	}
1129 
1130 	/*
1131 	 * Concatenate fragments.
1132 	 */
1133 	m = q;
1134 	t = m->m_next;
1135 	m->m_next = NULL;
1136 	m_cat(m, t);
1137 	nq = q->m_nextpkt;
1138 	q->m_nextpkt = NULL;
1139 	for (q = nq; q != NULL; q = nq) {
1140 		nq = q->m_nextpkt;
1141 		q->m_nextpkt = NULL;
1142 		m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags;
1143 		m->m_pkthdr.csum_data += q->m_pkthdr.csum_data;
1144 		m_cat(m, q);
1145 	}
1146 	/*
1147 	 * In order to do checksumming faster we do 'end-around carry' here
1148 	 * (and not in for{} loop), though it implies we are not going to
1149 	 * reassemble more than 64k fragments.
1150 	 */
1151 	while (m->m_pkthdr.csum_data & 0xffff0000)
1152 		m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) +
1153 		    (m->m_pkthdr.csum_data >> 16);
1154 #ifdef MAC
1155 	mac_ipq_reassemble(fp, m);
1156 	mac_ipq_destroy(fp);
1157 #endif
1158 
1159 	/*
1160 	 * Create header for new ip packet by modifying header of first
1161 	 * packet;  dequeue and discard fragment reassembly header.
1162 	 * Make header visible.
1163 	 */
1164 	ip->ip_len = htons((ip->ip_hl << 2) + next);
1165 	ip->ip_src = fp->ipq_src;
1166 	ip->ip_dst = fp->ipq_dst;
1167 	TAILQ_REMOVE(head, fp, ipq_list);
1168 	V_nipq--;
1169 	uma_zfree(V_ipq_zone, fp);
1170 	m->m_len += (ip->ip_hl << 2);
1171 	m->m_data -= (ip->ip_hl << 2);
1172 	/* some debugging cruft by sklower, below, will go away soon */
1173 	if (m->m_flags & M_PKTHDR)	/* XXX this should be done elsewhere */
1174 		m_fixhdr(m);
1175 	IPSTAT_INC(ips_reassembled);
1176 	IPQ_UNLOCK();
1177 
1178 #ifdef	RSS
1179 	/*
1180 	 * Query the RSS layer for the flowid / flowtype for the
1181 	 * mbuf payload.
1182 	 *
1183 	 * For now, just assume we have to calculate a new one.
1184 	 * Later on we should check to see if the assigned flowid matches
1185 	 * what RSS wants for the given IP protocol and if so, just keep it.
1186 	 *
1187 	 * We then queue into the relevant netisr so it can be dispatched
1188 	 * to the correct CPU.
1189 	 *
1190 	 * Note - this may return 1, which means the flowid in the mbuf
1191 	 * is correct for the configured RSS hash types and can be used.
1192 	 */
1193 	if (rss_mbuf_software_hash_v4(m, 0, &rss_hash, &rss_type) == 0) {
1194 		m->m_pkthdr.flowid = rss_hash;
1195 		M_HASHTYPE_SET(m, rss_type);
1196 	}
1197 
1198 	/*
1199 	 * Queue/dispatch for reprocessing.
1200 	 *
1201 	 * Note: this is much slower than just handling the frame in the
1202 	 * current receive context.  It's likely worth investigating
1203 	 * why this is.
1204 	 */
1205 	netisr_dispatch(NETISR_IP_DIRECT, m);
1206 	return (NULL);
1207 #endif
1208 
1209 	/* Handle in-line */
1210 	return (m);
1211 
1212 dropfrag:
1213 	IPSTAT_INC(ips_fragdropped);
1214 	if (fp != NULL)
1215 		fp->ipq_nfrags--;
1216 	m_freem(m);
1217 done:
1218 	IPQ_UNLOCK();
1219 	return (NULL);
1220 
1221 #undef GETIP
1222 }
1223 
1224 /*
1225  * Free a fragment reassembly header and all
1226  * associated datagrams.
1227  */
1228 static void
1229 ip_freef(struct ipqhead *fhp, struct ipq *fp)
1230 {
1231 	struct mbuf *q;
1232 
1233 	IPQ_LOCK_ASSERT();
1234 
1235 	while (fp->ipq_frags) {
1236 		q = fp->ipq_frags;
1237 		fp->ipq_frags = q->m_nextpkt;
1238 		m_freem(q);
1239 	}
1240 	TAILQ_REMOVE(fhp, fp, ipq_list);
1241 	uma_zfree(V_ipq_zone, fp);
1242 	V_nipq--;
1243 }
1244 
1245 /*
1246  * IP timer processing;
1247  * if a timer expires on a reassembly
1248  * queue, discard it.
1249  */
1250 void
1251 ip_slowtimo(void)
1252 {
1253 	VNET_ITERATOR_DECL(vnet_iter);
1254 	struct ipq *fp;
1255 	int i;
1256 
1257 	VNET_LIST_RLOCK_NOSLEEP();
1258 	IPQ_LOCK();
1259 	VNET_FOREACH(vnet_iter) {
1260 		CURVNET_SET(vnet_iter);
1261 		for (i = 0; i < IPREASS_NHASH; i++) {
1262 			for(fp = TAILQ_FIRST(&V_ipq[i]); fp;) {
1263 				struct ipq *fpp;
1264 
1265 				fpp = fp;
1266 				fp = TAILQ_NEXT(fp, ipq_list);
1267 				if(--fpp->ipq_ttl == 0) {
1268 					IPSTAT_ADD(ips_fragtimeout,
1269 					    fpp->ipq_nfrags);
1270 					ip_freef(&V_ipq[i], fpp);
1271 				}
1272 			}
1273 		}
1274 		/*
1275 		 * If we are over the maximum number of fragments
1276 		 * (due to the limit being lowered), drain off
1277 		 * enough to get down to the new limit.
1278 		 */
1279 		if (V_maxnipq >= 0 && V_nipq > V_maxnipq) {
1280 			for (i = 0; i < IPREASS_NHASH; i++) {
1281 				while (V_nipq > V_maxnipq &&
1282 				    !TAILQ_EMPTY(&V_ipq[i])) {
1283 					IPSTAT_ADD(ips_fragdropped,
1284 					    TAILQ_FIRST(&V_ipq[i])->ipq_nfrags);
1285 					ip_freef(&V_ipq[i],
1286 					    TAILQ_FIRST(&V_ipq[i]));
1287 				}
1288 			}
1289 		}
1290 		CURVNET_RESTORE();
1291 	}
1292 	IPQ_UNLOCK();
1293 	VNET_LIST_RUNLOCK_NOSLEEP();
1294 }
1295 
1296 /*
1297  * Drain off all datagram fragments.
1298  */
1299 static void
1300 ip_drain_locked(void)
1301 {
1302 	int     i;
1303 
1304 	IPQ_LOCK_ASSERT();
1305 
1306 	for (i = 0; i < IPREASS_NHASH; i++) {
1307 		while(!TAILQ_EMPTY(&V_ipq[i])) {
1308 			IPSTAT_ADD(ips_fragdropped,
1309 			    TAILQ_FIRST(&V_ipq[i])->ipq_nfrags);
1310 			ip_freef(&V_ipq[i], TAILQ_FIRST(&V_ipq[i]));
1311 		}
1312 	}
1313 }
1314 
1315 void
1316 ip_drain(void)
1317 {
1318 	VNET_ITERATOR_DECL(vnet_iter);
1319 
1320 	VNET_LIST_RLOCK_NOSLEEP();
1321 	IPQ_LOCK();
1322 	VNET_FOREACH(vnet_iter) {
1323 		CURVNET_SET(vnet_iter);
1324 		ip_drain_locked();
1325 		CURVNET_RESTORE();
1326 	}
1327 	IPQ_UNLOCK();
1328 	VNET_LIST_RUNLOCK_NOSLEEP();
1329 }
1330 
1331 /*
1332  * The protocol to be inserted into ip_protox[] must be already registered
1333  * in inetsw[], either statically or through pf_proto_register().
1334  */
1335 int
1336 ipproto_register(short ipproto)
1337 {
1338 	struct protosw *pr;
1339 
1340 	/* Sanity checks. */
1341 	if (ipproto <= 0 || ipproto >= IPPROTO_MAX)
1342 		return (EPROTONOSUPPORT);
1343 
1344 	/*
1345 	 * The protocol slot must not be occupied by another protocol
1346 	 * already.  An index pointing to IPPROTO_RAW is unused.
1347 	 */
1348 	pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);
1349 	if (pr == NULL)
1350 		return (EPFNOSUPPORT);
1351 	if (ip_protox[ipproto] != pr - inetsw)	/* IPPROTO_RAW */
1352 		return (EEXIST);
1353 
1354 	/* Find the protocol position in inetsw[] and set the index. */
1355 	for (pr = inetdomain.dom_protosw;
1356 	     pr < inetdomain.dom_protoswNPROTOSW; pr++) {
1357 		if (pr->pr_domain->dom_family == PF_INET &&
1358 		    pr->pr_protocol && pr->pr_protocol == ipproto) {
1359 			ip_protox[pr->pr_protocol] = pr - inetsw;
1360 			return (0);
1361 		}
1362 	}
1363 	return (EPROTONOSUPPORT);
1364 }
1365 
1366 int
1367 ipproto_unregister(short ipproto)
1368 {
1369 	struct protosw *pr;
1370 
1371 	/* Sanity checks. */
1372 	if (ipproto <= 0 || ipproto >= IPPROTO_MAX)
1373 		return (EPROTONOSUPPORT);
1374 
1375 	/* Check if the protocol was indeed registered. */
1376 	pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);
1377 	if (pr == NULL)
1378 		return (EPFNOSUPPORT);
1379 	if (ip_protox[ipproto] == pr - inetsw)  /* IPPROTO_RAW */
1380 		return (ENOENT);
1381 
1382 	/* Reset the protocol slot to IPPROTO_RAW. */
1383 	ip_protox[ipproto] = pr - inetsw;
1384 	return (0);
1385 }
1386 
1387 /*
1388  * Given address of next destination (final or next hop), return (referenced)
1389  * internet address info of interface to be used to get there.
1390  */
1391 struct in_ifaddr *
1392 ip_rtaddr(struct in_addr dst, u_int fibnum)
1393 {
1394 	struct route sro;
1395 	struct sockaddr_in *sin;
1396 	struct in_ifaddr *ia;
1397 
1398 	bzero(&sro, sizeof(sro));
1399 	sin = (struct sockaddr_in *)&sro.ro_dst;
1400 	sin->sin_family = AF_INET;
1401 	sin->sin_len = sizeof(*sin);
1402 	sin->sin_addr = dst;
1403 	in_rtalloc_ign(&sro, 0, fibnum);
1404 
1405 	if (sro.ro_rt == NULL)
1406 		return (NULL);
1407 
1408 	ia = ifatoia(sro.ro_rt->rt_ifa);
1409 	ifa_ref(&ia->ia_ifa);
1410 	RTFREE(sro.ro_rt);
1411 	return (ia);
1412 }
1413 
1414 u_char inetctlerrmap[PRC_NCMDS] = {
1415 	0,		0,		0,		0,
1416 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
1417 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
1418 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
1419 	0,		0,		EHOSTUNREACH,	0,
1420 	ENOPROTOOPT,	ECONNREFUSED
1421 };
1422 
1423 /*
1424  * Forward a packet.  If some error occurs return the sender
1425  * an icmp packet.  Note we can't always generate a meaningful
1426  * icmp message because icmp doesn't have a large enough repertoire
1427  * of codes and types.
1428  *
1429  * If not forwarding, just drop the packet.  This could be confusing
1430  * if ipforwarding was zero but some routing protocol was advancing
1431  * us as a gateway to somewhere.  However, we must let the routing
1432  * protocol deal with that.
1433  *
1434  * The srcrt parameter indicates whether the packet is being forwarded
1435  * via a source route.
1436  */
1437 void
1438 ip_forward(struct mbuf *m, int srcrt)
1439 {
1440 	struct ip *ip = mtod(m, struct ip *);
1441 	struct in_ifaddr *ia;
1442 	struct mbuf *mcopy;
1443 	struct in_addr dest;
1444 	struct route ro;
1445 	int error, type = 0, code = 0, mtu = 0;
1446 
1447 	if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) {
1448 		IPSTAT_INC(ips_cantforward);
1449 		m_freem(m);
1450 		return;
1451 	}
1452 #ifdef IPSEC
1453 	if (ip_ipsec_fwd(m) != 0) {
1454 		IPSTAT_INC(ips_cantforward);
1455 		m_freem(m);
1456 		return;
1457 	}
1458 #endif /* IPSEC */
1459 #ifdef IPSTEALTH
1460 	if (!V_ipstealth) {
1461 #endif
1462 		if (ip->ip_ttl <= IPTTLDEC) {
1463 			icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS,
1464 			    0, 0);
1465 			return;
1466 		}
1467 #ifdef IPSTEALTH
1468 	}
1469 #endif
1470 
1471 	ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m));
1472 #ifndef IPSEC
1473 	/*
1474 	 * 'ia' may be NULL if there is no route for this destination.
1475 	 * In case of IPsec, Don't discard it just yet, but pass it to
1476 	 * ip_output in case of outgoing IPsec policy.
1477 	 */
1478 	if (!srcrt && ia == NULL) {
1479 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
1480 		return;
1481 	}
1482 #endif
1483 
1484 	/*
1485 	 * Save the IP header and at most 8 bytes of the payload,
1486 	 * in case we need to generate an ICMP message to the src.
1487 	 *
1488 	 * XXX this can be optimized a lot by saving the data in a local
1489 	 * buffer on the stack (72 bytes at most), and only allocating the
1490 	 * mbuf if really necessary. The vast majority of the packets
1491 	 * are forwarded without having to send an ICMP back (either
1492 	 * because unnecessary, or because rate limited), so we are
1493 	 * really we are wasting a lot of work here.
1494 	 *
1495 	 * We don't use m_copy() because it might return a reference
1496 	 * to a shared cluster. Both this function and ip_output()
1497 	 * assume exclusive access to the IP header in `m', so any
1498 	 * data in a cluster may change before we reach icmp_error().
1499 	 */
1500 	mcopy = m_gethdr(M_NOWAIT, m->m_type);
1501 	if (mcopy != NULL && !m_dup_pkthdr(mcopy, m, M_NOWAIT)) {
1502 		/*
1503 		 * It's probably ok if the pkthdr dup fails (because
1504 		 * the deep copy of the tag chain failed), but for now
1505 		 * be conservative and just discard the copy since
1506 		 * code below may some day want the tags.
1507 		 */
1508 		m_free(mcopy);
1509 		mcopy = NULL;
1510 	}
1511 	if (mcopy != NULL) {
1512 		mcopy->m_len = min(ntohs(ip->ip_len), M_TRAILINGSPACE(mcopy));
1513 		mcopy->m_pkthdr.len = mcopy->m_len;
1514 		m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t));
1515 	}
1516 
1517 #ifdef IPSTEALTH
1518 	if (!V_ipstealth) {
1519 #endif
1520 		ip->ip_ttl -= IPTTLDEC;
1521 #ifdef IPSTEALTH
1522 	}
1523 #endif
1524 
1525 	/*
1526 	 * If forwarding packet using same interface that it came in on,
1527 	 * perhaps should send a redirect to sender to shortcut a hop.
1528 	 * Only send redirect if source is sending directly to us,
1529 	 * and if packet was not source routed (or has any options).
1530 	 * Also, don't send redirect if forwarding using a default route
1531 	 * or a route modified by a redirect.
1532 	 */
1533 	dest.s_addr = 0;
1534 	if (!srcrt && V_ipsendredirects &&
1535 	    ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) {
1536 		struct sockaddr_in *sin;
1537 		struct rtentry *rt;
1538 
1539 		bzero(&ro, sizeof(ro));
1540 		sin = (struct sockaddr_in *)&ro.ro_dst;
1541 		sin->sin_family = AF_INET;
1542 		sin->sin_len = sizeof(*sin);
1543 		sin->sin_addr = ip->ip_dst;
1544 		in_rtalloc_ign(&ro, 0, M_GETFIB(m));
1545 
1546 		rt = ro.ro_rt;
1547 
1548 		if (rt && (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 &&
1549 		    satosin(rt_key(rt))->sin_addr.s_addr != 0) {
1550 #define	RTA(rt)	((struct in_ifaddr *)(rt->rt_ifa))
1551 			u_long src = ntohl(ip->ip_src.s_addr);
1552 
1553 			if (RTA(rt) &&
1554 			    (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) {
1555 				if (rt->rt_flags & RTF_GATEWAY)
1556 					dest.s_addr = satosin(rt->rt_gateway)->sin_addr.s_addr;
1557 				else
1558 					dest.s_addr = ip->ip_dst.s_addr;
1559 				/* Router requirements says to only send host redirects */
1560 				type = ICMP_REDIRECT;
1561 				code = ICMP_REDIRECT_HOST;
1562 			}
1563 		}
1564 		if (rt)
1565 			RTFREE(rt);
1566 	}
1567 
1568 	/*
1569 	 * Try to cache the route MTU from ip_output so we can consider it for
1570 	 * the ICMP_UNREACH_NEEDFRAG "Next-Hop MTU" field described in RFC1191.
1571 	 */
1572 	bzero(&ro, sizeof(ro));
1573 
1574 	error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL, NULL);
1575 
1576 	if (error == EMSGSIZE && ro.ro_rt)
1577 		mtu = ro.ro_rt->rt_mtu;
1578 	RO_RTFREE(&ro);
1579 
1580 	if (error)
1581 		IPSTAT_INC(ips_cantforward);
1582 	else {
1583 		IPSTAT_INC(ips_forward);
1584 		if (type)
1585 			IPSTAT_INC(ips_redirectsent);
1586 		else {
1587 			if (mcopy)
1588 				m_freem(mcopy);
1589 			if (ia != NULL)
1590 				ifa_free(&ia->ia_ifa);
1591 			return;
1592 		}
1593 	}
1594 	if (mcopy == NULL) {
1595 		if (ia != NULL)
1596 			ifa_free(&ia->ia_ifa);
1597 		return;
1598 	}
1599 
1600 	switch (error) {
1601 
1602 	case 0:				/* forwarded, but need redirect */
1603 		/* type, code set above */
1604 		break;
1605 
1606 	case ENETUNREACH:
1607 	case EHOSTUNREACH:
1608 	case ENETDOWN:
1609 	case EHOSTDOWN:
1610 	default:
1611 		type = ICMP_UNREACH;
1612 		code = ICMP_UNREACH_HOST;
1613 		break;
1614 
1615 	case EMSGSIZE:
1616 		type = ICMP_UNREACH;
1617 		code = ICMP_UNREACH_NEEDFRAG;
1618 
1619 #ifdef IPSEC
1620 		/*
1621 		 * If IPsec is configured for this path,
1622 		 * override any possibly mtu value set by ip_output.
1623 		 */
1624 		mtu = ip_ipsec_mtu(mcopy, mtu);
1625 #endif /* IPSEC */
1626 		/*
1627 		 * If the MTU was set before make sure we are below the
1628 		 * interface MTU.
1629 		 * If the MTU wasn't set before use the interface mtu or
1630 		 * fall back to the next smaller mtu step compared to the
1631 		 * current packet size.
1632 		 */
1633 		if (mtu != 0) {
1634 			if (ia != NULL)
1635 				mtu = min(mtu, ia->ia_ifp->if_mtu);
1636 		} else {
1637 			if (ia != NULL)
1638 				mtu = ia->ia_ifp->if_mtu;
1639 			else
1640 				mtu = ip_next_mtu(ntohs(ip->ip_len), 0);
1641 		}
1642 		IPSTAT_INC(ips_cantfrag);
1643 		break;
1644 
1645 	case ENOBUFS:
1646 	case EACCES:			/* ipfw denied packet */
1647 		m_freem(mcopy);
1648 		if (ia != NULL)
1649 			ifa_free(&ia->ia_ifa);
1650 		return;
1651 	}
1652 	if (ia != NULL)
1653 		ifa_free(&ia->ia_ifa);
1654 	icmp_error(mcopy, type, code, dest.s_addr, mtu);
1655 }
1656 
1657 void
1658 ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip,
1659     struct mbuf *m)
1660 {
1661 
1662 	if (inp->inp_socket->so_options & (SO_BINTIME | SO_TIMESTAMP)) {
1663 		struct bintime bt;
1664 
1665 		bintime(&bt);
1666 		if (inp->inp_socket->so_options & SO_BINTIME) {
1667 			*mp = sbcreatecontrol((caddr_t)&bt, sizeof(bt),
1668 			    SCM_BINTIME, SOL_SOCKET);
1669 			if (*mp)
1670 				mp = &(*mp)->m_next;
1671 		}
1672 		if (inp->inp_socket->so_options & SO_TIMESTAMP) {
1673 			struct timeval tv;
1674 
1675 			bintime2timeval(&bt, &tv);
1676 			*mp = sbcreatecontrol((caddr_t)&tv, sizeof(tv),
1677 			    SCM_TIMESTAMP, SOL_SOCKET);
1678 			if (*mp)
1679 				mp = &(*mp)->m_next;
1680 		}
1681 	}
1682 	if (inp->inp_flags & INP_RECVDSTADDR) {
1683 		*mp = sbcreatecontrol((caddr_t)&ip->ip_dst,
1684 		    sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP);
1685 		if (*mp)
1686 			mp = &(*mp)->m_next;
1687 	}
1688 	if (inp->inp_flags & INP_RECVTTL) {
1689 		*mp = sbcreatecontrol((caddr_t)&ip->ip_ttl,
1690 		    sizeof(u_char), IP_RECVTTL, IPPROTO_IP);
1691 		if (*mp)
1692 			mp = &(*mp)->m_next;
1693 	}
1694 #ifdef notyet
1695 	/* XXX
1696 	 * Moving these out of udp_input() made them even more broken
1697 	 * than they already were.
1698 	 */
1699 	/* options were tossed already */
1700 	if (inp->inp_flags & INP_RECVOPTS) {
1701 		*mp = sbcreatecontrol((caddr_t)opts_deleted_above,
1702 		    sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP);
1703 		if (*mp)
1704 			mp = &(*mp)->m_next;
1705 	}
1706 	/* ip_srcroute doesn't do what we want here, need to fix */
1707 	if (inp->inp_flags & INP_RECVRETOPTS) {
1708 		*mp = sbcreatecontrol((caddr_t)ip_srcroute(m),
1709 		    sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP);
1710 		if (*mp)
1711 			mp = &(*mp)->m_next;
1712 	}
1713 #endif
1714 	if (inp->inp_flags & INP_RECVIF) {
1715 		struct ifnet *ifp;
1716 		struct sdlbuf {
1717 			struct sockaddr_dl sdl;
1718 			u_char	pad[32];
1719 		} sdlbuf;
1720 		struct sockaddr_dl *sdp;
1721 		struct sockaddr_dl *sdl2 = &sdlbuf.sdl;
1722 
1723 		if ((ifp = m->m_pkthdr.rcvif) &&
1724 		    ifp->if_index && ifp->if_index <= V_if_index) {
1725 			sdp = (struct sockaddr_dl *)ifp->if_addr->ifa_addr;
1726 			/*
1727 			 * Change our mind and don't try copy.
1728 			 */
1729 			if (sdp->sdl_family != AF_LINK ||
1730 			    sdp->sdl_len > sizeof(sdlbuf)) {
1731 				goto makedummy;
1732 			}
1733 			bcopy(sdp, sdl2, sdp->sdl_len);
1734 		} else {
1735 makedummy:
1736 			sdl2->sdl_len =
1737 			    offsetof(struct sockaddr_dl, sdl_data[0]);
1738 			sdl2->sdl_family = AF_LINK;
1739 			sdl2->sdl_index = 0;
1740 			sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0;
1741 		}
1742 		*mp = sbcreatecontrol((caddr_t)sdl2, sdl2->sdl_len,
1743 		    IP_RECVIF, IPPROTO_IP);
1744 		if (*mp)
1745 			mp = &(*mp)->m_next;
1746 	}
1747 	if (inp->inp_flags & INP_RECVTOS) {
1748 		*mp = sbcreatecontrol((caddr_t)&ip->ip_tos,
1749 		    sizeof(u_char), IP_RECVTOS, IPPROTO_IP);
1750 		if (*mp)
1751 			mp = &(*mp)->m_next;
1752 	}
1753 
1754 	if (inp->inp_flags2 & INP_RECVFLOWID) {
1755 		uint32_t flowid, flow_type;
1756 
1757 		flowid = m->m_pkthdr.flowid;
1758 		flow_type = M_HASHTYPE_GET(m);
1759 
1760 		/*
1761 		 * XXX should handle the failure of one or the
1762 		 * other - don't populate both?
1763 		 */
1764 		*mp = sbcreatecontrol((caddr_t) &flowid,
1765 		    sizeof(uint32_t), IP_FLOWID, IPPROTO_IP);
1766 		if (*mp)
1767 			mp = &(*mp)->m_next;
1768 		*mp = sbcreatecontrol((caddr_t) &flow_type,
1769 		    sizeof(uint32_t), IP_FLOWTYPE, IPPROTO_IP);
1770 		if (*mp)
1771 			mp = &(*mp)->m_next;
1772 	}
1773 
1774 #ifdef	RSS
1775 	if (inp->inp_flags2 & INP_RECVRSSBUCKETID) {
1776 		uint32_t flowid, flow_type;
1777 		uint32_t rss_bucketid;
1778 
1779 		flowid = m->m_pkthdr.flowid;
1780 		flow_type = M_HASHTYPE_GET(m);
1781 
1782 		if (rss_hash2bucket(flowid, flow_type, &rss_bucketid) == 0) {
1783 			*mp = sbcreatecontrol((caddr_t) &rss_bucketid,
1784 			   sizeof(uint32_t), IP_RSSBUCKETID, IPPROTO_IP);
1785 			if (*mp)
1786 				mp = &(*mp)->m_next;
1787 		}
1788 	}
1789 #endif
1790 }
1791 
1792 /*
1793  * XXXRW: Multicast routing code in ip_mroute.c is generally MPSAFE, but the
1794  * ip_rsvp and ip_rsvp_on variables need to be interlocked with rsvp_on
1795  * locking.  This code remains in ip_input.c as ip_mroute.c is optionally
1796  * compiled.
1797  */
1798 static VNET_DEFINE(int, ip_rsvp_on);
1799 VNET_DEFINE(struct socket *, ip_rsvpd);
1800 
1801 #define	V_ip_rsvp_on		VNET(ip_rsvp_on)
1802 
1803 int
1804 ip_rsvp_init(struct socket *so)
1805 {
1806 
1807 	if (so->so_type != SOCK_RAW ||
1808 	    so->so_proto->pr_protocol != IPPROTO_RSVP)
1809 		return EOPNOTSUPP;
1810 
1811 	if (V_ip_rsvpd != NULL)
1812 		return EADDRINUSE;
1813 
1814 	V_ip_rsvpd = so;
1815 	/*
1816 	 * This may seem silly, but we need to be sure we don't over-increment
1817 	 * the RSVP counter, in case something slips up.
1818 	 */
1819 	if (!V_ip_rsvp_on) {
1820 		V_ip_rsvp_on = 1;
1821 		V_rsvp_on++;
1822 	}
1823 
1824 	return 0;
1825 }
1826 
1827 int
1828 ip_rsvp_done(void)
1829 {
1830 
1831 	V_ip_rsvpd = NULL;
1832 	/*
1833 	 * This may seem silly, but we need to be sure we don't over-decrement
1834 	 * the RSVP counter, in case something slips up.
1835 	 */
1836 	if (V_ip_rsvp_on) {
1837 		V_ip_rsvp_on = 0;
1838 		V_rsvp_on--;
1839 	}
1840 	return 0;
1841 }
1842 
1843 int
1844 rsvp_input(struct mbuf **mp, int *offp, int proto)
1845 {
1846 	struct mbuf *m;
1847 
1848 	m = *mp;
1849 	*mp = NULL;
1850 
1851 	if (rsvp_input_p) { /* call the real one if loaded */
1852 		*mp = m;
1853 		rsvp_input_p(mp, offp, proto);
1854 		return (IPPROTO_DONE);
1855 	}
1856 
1857 	/* Can still get packets with rsvp_on = 0 if there is a local member
1858 	 * of the group to which the RSVP packet is addressed.  But in this
1859 	 * case we want to throw the packet away.
1860 	 */
1861 
1862 	if (!V_rsvp_on) {
1863 		m_freem(m);
1864 		return (IPPROTO_DONE);
1865 	}
1866 
1867 	if (V_ip_rsvpd != NULL) {
1868 		*mp = m;
1869 		rip_input(mp, offp, proto);
1870 		return (IPPROTO_DONE);
1871 	}
1872 	/* Drop the packet */
1873 	m_freem(m);
1874 	return (IPPROTO_DONE);
1875 }
1876