include/inet/ipclassifier.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #ifndef _INET_IPCLASSIFIER_H
  27 #define _INET_IPCLASSIFIER_H
  28
  29 #ifdef  __cplusplus
  30 extern "C" {
  31 #endif
  32
  33 #include <inet/common.h>
  34 #include <inet/ip.h>
  35 #include <inet/mi.h>
  36 #include <inet/tcp.h>
  37 #include <inet/ip6.h>
  38 #include <netinet/in.h>         /* for IPPROTO_* constants */
  39 #include <sys/sdt.h>
  40 #include <sys/socket_proto.h>
  41 #include <sys/sunddi.h>
  42 #include <sys/sunldi.h>
  43
  44 typedef void (*edesc_rpf)(void *, mblk_t *, void *, ip_recv_attr_t *);
  45 struct icmph_s;
  46 struct icmp6_hdr;
  47 typedef boolean_t (*edesc_vpf)(conn_t *, void *, struct icmph_s *,
  48     struct icmp6_hdr *, ip_recv_attr_t *);
  49
  50 /*
  51  * ==============================
  52  * =    The CONNECTION          =
  53  * ==============================
  54  */
  55
  56 /*
  57  * The connection structure contains the common information/flags/ref needed.
  58  * Implementation will keep the connection struct, the layers (with their
  59  * respective data for event i.e. tcp_t if event was tcp_input_data) all in one
  60  * contiguous memory location.
  61  */
  62
  63 /* Conn Flags */
  64 /* Unused                       0x00020000 */
  65 /* Unused                       0x00040000 */
  66 #define IPCL_FULLY_BOUND        0x00080000      /* Bound to correct squeue */
  67 /* Unused                       0x00100000 */
  68 /* Unused                       0x00200000 */
  69 /* Unused                       0x00400000 */
  70 /* Unused                       0x00800000 */
  71 /* Unused                       0x01000000 */
  72 /* Unused                       0x02000000 */
  73 /* Unused                       0x04000000 */
  74 /* Unused                       0x08000000 */
  75 /* Unused                       0x10000000 */
  76 /* Unused                       0x20000000 */
  77 #define IPCL_CONNECTED          0x40000000      /* Conn in connected table */
  78 #define IPCL_BOUND              0x80000000      /* Conn in bind table */
  79
  80 /* Flags identifying the type of conn */
  81 #define IPCL_TCPCONN            0x00000001      /* From tcp_conn_cache */
  82 #define IPCL_SCTPCONN           0x00000002      /* From sctp_conn_cache */
  83 #define IPCL_IPCCONN            0x00000004      /* From ip_conn_cache */
  84 #define IPCL_UDPCONN            0x00000008      /* From udp_conn_cache */
  85 #define IPCL_RAWIPCONN          0x00000010      /* From rawip_conn_cache */
  86 #define IPCL_RTSCONN            0x00000020      /* From rts_conn_cache */
  87 /* Unused                       0x00000040 */
  88 #define IPCL_IPTUN              0x00000080      /* iptun module above us */
  89
  90 #define IPCL_NONSTR             0x00001000      /* A non-STREAMS socket */
  91 /* Unused                       0x10000000 */
  92
  93 #define IPCL_REMOVED            0x00000100
  94 #define IPCL_REUSED             0x00000200
  95
  96 #define IPCL_IS_CONNECTED(connp)                                        \
  97         ((connp)->conn_flags & IPCL_CONNECTED)
  98
  99 #define IPCL_IS_BOUND(connp)                                            \
 100         ((connp)->conn_flags & IPCL_BOUND)
 101
 102 /*
 103  * Can't use conn_proto since we need to tell difference
 104  * between a real TCP socket and a SOCK_RAW, IPPROTO_TCP.
 105  */
 106 #define IPCL_IS_TCP(connp)                                              \
 107         ((connp)->conn_flags & IPCL_TCPCONN)
 108
 109 #define IPCL_IS_SCTP(connp)                                             \
 110         ((connp)->conn_flags & IPCL_SCTPCONN)
 111
 112 #define IPCL_IS_UDP(connp)                                              \
 113         ((connp)->conn_flags & IPCL_UDPCONN)
 114
 115 #define IPCL_IS_RAWIP(connp)                                            \
 116         ((connp)->conn_flags & IPCL_RAWIPCONN)
 117
 118 #define IPCL_IS_RTS(connp)                                              \
 119         ((connp)->conn_flags & IPCL_RTSCONN)
 120
 121 #define IPCL_IS_IPTUN(connp)                                            \
 122         ((connp)->conn_flags & IPCL_IPTUN)
 123
 124 #define IPCL_IS_NONSTR(connp)   ((connp)->conn_flags & IPCL_NONSTR)
 125
 126 typedef struct connf_s connf_t;
 127
 128 typedef struct
 129 {
 130         int     ctb_depth;
 131 #define CONN_STACK_DEPTH        15
 132         pc_t    ctb_stack[CONN_STACK_DEPTH];
 133 } conn_trace_t;
 134
 135 typedef struct ip_helper_minor_info_s {
 136         dev_t   ip_minfo_dev;           /* Device */
 137         vmem_t  *ip_minfo_arena;        /* Arena */
 138 } ip_helper_minfo_t;
 139
 140 /*
 141  * ip helper stream info
 142  */
 143 typedef struct ip_helper_stream_info_s {
 144         ldi_handle_t            iphs_handle;
 145         queue_t                 *iphs_rq;
 146         queue_t                 *iphs_wq;
 147         ip_helper_minfo_t       *iphs_minfo;
 148 } ip_helper_stream_info_t;
 149
 150 /*
 151  * conn receive ancillary definition.
 152  *
 153  * These are the set of socket options that make the receive side
 154  * potentially pass up ancillary data items.
 155  * We have a union with an integer so that we can quickly check whether
 156  * any ancillary data items need to be added.
 157  */
 158 typedef struct crb_s {
 159         union {
 160                 uint32_t        crbu_all;
 161                 struct {
 162                         uint32_t
 163         crbb_recvdstaddr : 1,           /* IP_RECVDSTADDR option */
 164         crbb_recvopts : 1,              /* IP_RECVOPTS option */
 165         crbb_recvif : 1,                /* IP_RECVIF option */
 166         crbb_recvslla : 1,              /* IP_RECVSLLA option */
 167
 168         crbb_recvttl : 1,               /* IP_RECVTTL option */
 169         crbb_ip_recvpktinfo : 1,        /* IP*_RECVPKTINFO option  */
 170         crbb_ipv6_recvhoplimit : 1,     /* IPV6_RECVHOPLIMIT option */
 171         crbb_ipv6_recvhopopts : 1,      /* IPV6_RECVHOPOPTS option */
 172
 173         crbb_ipv6_recvdstopts : 1,      /* IPV6_RECVDSTOPTS option */
 174         crbb_ipv6_recvrthdr : 1,        /* IPV6_RECVRTHDR option */
 175         crbb_old_ipv6_recvdstopts : 1,  /* old form of IPV6_DSTOPTS */
 176         crbb_ipv6_recvrthdrdstopts : 1, /* IPV6_RECVRTHDRDSTOPTS */
 177
 178         crbb_ipv6_recvtclass : 1,       /* IPV6_RECVTCLASS */
 179         crbb_recvucred : 1,             /* IP_RECVUCRED option */
 180         crbb_timestamp : 1;             /* SO_TIMESTAMP "socket" option */
 181
 182                 } crbb;
 183         } crbu;
 184 } crb_t;
 185
 186 #define crb_all                         crbu.crbu_all
 187 #define crb_recvdstaddr                 crbu.crbb.crbb_recvdstaddr
 188 #define crb_recvopts                    crbu.crbb.crbb_recvopts
 189 #define crb_recvif                      crbu.crbb.crbb_recvif
 190 #define crb_recvslla                    crbu.crbb.crbb_recvslla
 191 #define crb_recvttl                     crbu.crbb.crbb_recvttl
 192 #define crb_ip_recvpktinfo              crbu.crbb.crbb_ip_recvpktinfo
 193 #define crb_ipv6_recvhoplimit           crbu.crbb.crbb_ipv6_recvhoplimit
 194 #define crb_ipv6_recvhopopts            crbu.crbb.crbb_ipv6_recvhopopts
 195 #define crb_ipv6_recvdstopts            crbu.crbb.crbb_ipv6_recvdstopts
 196 #define crb_ipv6_recvrthdr              crbu.crbb.crbb_ipv6_recvrthdr
 197 #define crb_old_ipv6_recvdstopts        crbu.crbb.crbb_old_ipv6_recvdstopts
 198 #define crb_ipv6_recvrthdrdstopts       crbu.crbb.crbb_ipv6_recvrthdrdstopts
 199 #define crb_ipv6_recvtclass             crbu.crbb.crbb_ipv6_recvtclass
 200 #define crb_recvucred                   crbu.crbb.crbb_recvucred
 201 #define crb_timestamp                   crbu.crbb.crbb_timestamp
 202
 203 /*
 204  * The initial fields in the conn_t are setup by the kmem_cache constructor,
 205  * and are preserved when it is freed. Fields after that are bzero'ed when
 206  * the conn_t is freed.
 207  *
 208  * Much of the conn_t is protected by conn_lock.
 209  *
 210  * conn_lock is also used by some ULPs (like UDP and RAWIP) to protect
 211  * their state.
 212  */
 213 struct conn_s {
 214         kmutex_t        conn_lock;
 215         uint32_t        conn_ref;               /* Reference counter */
 216         uint32_t        conn_flags;             /* Conn Flags */
 217
 218         union {
 219                 tcp_t           *cp_tcp;        /* Pointer to the tcp struct */
 220                 struct udp_s    *cp_udp;        /* Pointer to the udp struct */
 221                 struct icmp_s   *cp_icmp;       /* Pointer to rawip struct */
 222                 struct rts_s    *cp_rts;        /* Pointer to rts struct */
 223                 struct iptun_s  *cp_iptun;      /* Pointer to iptun_t */
 224                 struct sctp_s   *cp_sctp;       /* For IPCL_SCTPCONN */
 225                 void            *cp_priv;
 226         } conn_proto_priv;
 227 #define conn_tcp        conn_proto_priv.cp_tcp
 228 #define conn_udp        conn_proto_priv.cp_udp
 229 #define conn_icmp       conn_proto_priv.cp_icmp
 230 #define conn_rts        conn_proto_priv.cp_rts
 231 #define conn_iptun      conn_proto_priv.cp_iptun
 232 #define conn_sctp       conn_proto_priv.cp_sctp
 233 #define conn_priv       conn_proto_priv.cp_priv
 234
 235         kcondvar_t      conn_cv;
 236         uint8_t         conn_proto;             /* protocol type */
 237
 238         edesc_rpf       conn_recv;              /* Pointer to recv routine */
 239         edesc_rpf       conn_recvicmp;          /* For ICMP error */
 240         edesc_vpf       conn_verifyicmp;        /* Verify ICMP error */
 241
 242         ip_xmit_attr_t  *conn_ixa;              /* Options if no ancil data */
 243
 244         /* Fields after this are bzero'ed when the conn_t is freed. */
 245 #define conn_start_clr  conn_recv_ancillary
 246
 247         /* Options for receive-side ancillary data */
 248         crb_t           conn_recv_ancillary;
 249
 250         squeue_t        *conn_sqp;              /* Squeue for processing */
 251         uint_t          conn_state_flags;       /* IP state flags */
 252
 253         int             conn_lingertime;        /* linger time (in seconds) */
 254
 255         unsigned int
 256                 conn_on_sqp : 1,                /* Conn is being processed */
 257                 conn_linger : 1,                /* SO_LINGER state */
 258                 conn_useloopback : 1,           /* SO_USELOOPBACK state */
 259                 conn_broadcast : 1,             /* SO_BROADCAST state */
 260
 261                 conn_reuseaddr : 1,             /* SO_REUSEADDR state */
 262                 conn_keepalive : 1,             /* SO_KEEPALIVE state */
 263                 conn_multi_router : 1,          /* Wants all multicast pkts */
 264                 conn_unspec_src : 1,            /* IP_UNSPEC_SRC */
 265
 266                 conn_policy_cached : 1,         /* Is policy cached/latched ? */
 267                 conn_in_enforce_policy : 1,     /* Enforce Policy on inbound */
 268                 conn_out_enforce_policy : 1,    /* Enforce Policy on outbound */
 269                 conn_debug : 1,                 /* SO_DEBUG */
 270
 271                 conn_ipv6_v6only : 1,           /* IPV6_V6ONLY */
 272                 conn_oobinline : 1,             /* SO_OOBINLINE state */
 273                 conn_dgram_errind : 1,          /* SO_DGRAM_ERRIND state */
 274                 conn_exclbind : 1,              /* SO_EXCLBIND state */
 275
 276                 conn_mdt_ok : 1,                /* MDT is permitted */
 277                 conn_allzones : 1,              /* SO_ALLZONES */
 278                 conn_ipv6_recvpathmtu : 1,      /* IPV6_RECVPATHMTU */
 279                 conn_mcbc_bind : 1,             /* Bound to multi/broadcast */
 280
 281                 conn_pad_to_bit_31 : 12;
 282
 283         boolean_t       conn_blocked;           /* conn is flow-controlled */
 284
 285         squeue_t        *conn_initial_sqp;      /* Squeue at open time */
 286         squeue_t        *conn_final_sqp;        /* Squeue after connect */
 287         ill_t           *conn_dhcpinit_ill;     /* IP_DHCPINIT_IF */
 288         ipsec_latch_t   *conn_latch;            /* latched IDS */
 289         struct ipsec_policy_s   *conn_latch_in_policy; /* latched policy (in) */
 290         struct ipsec_action_s   *conn_latch_in_action; /* latched action (in) */
 291         uint_t          conn_bound_if;          /* IP*_BOUND_IF */
 292         queue_t         *conn_rq;               /* Read queue */
 293         queue_t         *conn_wq;               /* Write queue */
 294         dev_t           conn_dev;               /* Minor number */
 295         vmem_t          *conn_minor_arena;      /* Minor arena */
 296         ip_helper_stream_info_t *conn_helper_info;
 297
 298         cred_t          *conn_cred;             /* Credentials */
 299         pid_t           conn_cpid;              /* pid from open/connect */
 300         uint64_t        conn_open_time;         /* time when this was opened */
 301
 302         connf_t         *conn_g_fanout;         /* Global Hash bucket head */
 303         struct conn_s   *conn_g_next;           /* Global Hash chain next */
 304         struct conn_s   *conn_g_prev;           /* Global Hash chain prev */
 305         struct ipsec_policy_head_s *conn_policy; /* Configured policy */
 306         in6_addr_t      conn_bound_addr_v6;     /* Address in bind() */
 307 #define conn_bound_addr_v4      V4_PART_OF_V6(conn_bound_addr_v6)
 308         connf_t         *conn_fanout;           /* Hash bucket we're part of */
 309         struct conn_s   *conn_next;             /* Hash chain next */
 310         struct conn_s   *conn_prev;             /* Hash chain prev */
 311
 312         struct {
 313                 in6_addr_t connua_laddr;        /* Local address - match */
 314                 in6_addr_t connua_faddr;        /* Remote address */
 315         } connua_v6addr;
 316 #define conn_laddr_v4   V4_PART_OF_V6(connua_v6addr.connua_laddr)
 317 #define conn_faddr_v4   V4_PART_OF_V6(connua_v6addr.connua_faddr)
 318 #define conn_laddr_v6   connua_v6addr.connua_laddr
 319 #define conn_faddr_v6   connua_v6addr.connua_faddr
 320         in6_addr_t      conn_saddr_v6;          /* Local address - source */
 321 #define conn_saddr_v4   V4_PART_OF_V6(conn_saddr_v6)
 322
 323         union {
 324                 /* Used for classifier match performance */
 325                 uint32_t                connu_ports2;
 326                 struct {
 327                         in_port_t       connu_fport;    /* Remote port */
 328                         in_port_t       connu_lport;    /* Local port */
 329                 } connu_ports;
 330         } u_port;
 331 #define conn_fport      u_port.connu_ports.connu_fport
 332 #define conn_lport      u_port.connu_ports.connu_lport
 333 #define conn_ports      u_port.connu_ports2
 334
 335         uint_t          conn_incoming_ifindex;  /* IP{,V6}_BOUND_IF, scopeid */
 336         ill_t           *conn_oper_pending_ill; /* pending shared ioctl */
 337
 338         krwlock_t       conn_ilg_lock;          /* Protects conn_ilg_* */
 339         ilg_t           *conn_ilg;              /* Group memberships */
 340
 341         kcondvar_t      conn_refcv;             /* For conn_oper_pending_ill */
 342
 343         struct conn_s   *conn_drain_next;       /* Next conn in drain list */
 344         struct conn_s   *conn_drain_prev;       /* Prev conn in drain list */
 345         idl_t           *conn_idl;              /* Ptr to the drain list head */
 346         mblk_t          *conn_ipsec_opt_mp;     /* ipsec option mblk */
 347         zoneid_t        conn_zoneid;            /* zone connection is in */
 348         int             conn_rtaware;           /* RT_AWARE sockopt value */
 349         kcondvar_t      conn_sq_cv;             /* For non-STREAMS socket IO */
 350         sock_upcalls_t  *conn_upcalls;          /* Upcalls to sockfs */
 351         sock_upper_handle_t conn_upper_handle;  /* Upper handle: sonode * */
 352
 353         unsigned int
 354                 conn_anon_port : 1,             /* user bound anonymously */
 355
 356                 conn_anon_priv_bind : 1,        /* *_ANON_PRIV_BIND state */
 357                 conn_zone_is_global : 1,        /* GLOBAL_ZONEID */
 358                 conn_isvrrp : 1,                /* VRRP control socket */
 359                 conn_spare : 23;
 360
 361         boolean_t       conn_flow_cntrld;
 362         netstack_t      *conn_netstack; /* Corresponds to a netstack_hold */
 363
 364         /*
 365          * IP format that packets received for this struct should use.
 366          * Value can be IP4_VERSION or IPV6_VERSION.
 367          * The sending version is encoded using IXAF_IS_IPV4.
 368          */
 369         ushort_t        conn_ipversion;
 370
 371         /* Written to only once at the time of opening the endpoint */
 372         sa_family_t     conn_family;            /* Family from socket() call */
 373         uint_t          conn_so_type;           /* Type from socket() call */
 374
 375         uint_t          conn_sndbuf;            /* SO_SNDBUF state */
 376         uint_t          conn_rcvbuf;            /* SO_RCVBUF state */
 377         uint_t          conn_wroff;             /* Current write offset */
 378
 379         uint_t          conn_sndlowat;          /* Send buffer low water mark */
 380         uint_t          conn_rcvlowat;          /* Recv buffer low water mark */
 381
 382         uint8_t         conn_default_ttl;       /* Default TTL/hoplimit */
 383
 384         uint32_t        conn_flowinfo;  /* Connected flow id and tclass */
 385
 386         /*
 387          * The most recent address for sendto. Initially set to zero
 388          * which is always different than then the destination address
 389          * since the send interprets zero as the loopback address.
 390          */
 391         in6_addr_t      conn_v6lastdst;
 392 #define conn_v4lastdst  V4_PART_OF_V6(conn_v6lastdst)
 393         ushort_t        conn_lastipversion;
 394         in_port_t       conn_lastdstport;
 395         uint32_t        conn_lastflowinfo;      /* IPv6-only */
 396         uint_t          conn_lastscopeid;       /* IPv6-only */
 397         uint_t          conn_lastsrcid;         /* Only for AF_INET6 */
 398         /*
 399          * When we are not connected conn_saddr might be unspecified.
 400          * We track the source that was used with conn_v6lastdst here.
 401          */
 402         in6_addr_t      conn_v6lastsrc;
 403 #define conn_v4lastsrc  V4_PART_OF_V6(conn_v6lastsrc)
 404
 405         /* Templates for transmitting packets */
 406         ip_pkt_t        conn_xmit_ipp;          /* Options if no ancil data */
 407
 408         /*
 409          * Header template - conn_ht_ulp is a pointer into conn_ht_iphc.
 410          * Note that ixa_ip_hdr_length indicates the offset of ht_ulp in
 411          * ht_iphc
 412          *
 413          * The header template is maintained for connected endpoints (and
 414          * updated when sticky options are changed) and also for the lastdst.
 415          * There is no conflict between those usages since SOCK_DGRAM and
 416          * SOCK_RAW can not be used to specify a destination address (with
 417          * sendto/sendmsg) if the socket has been connected.
 418          */
 419         uint8_t         *conn_ht_iphc;          /* Start of IP header */
 420         uint_t          conn_ht_iphc_allocated; /* Allocated buffer size */
 421         uint_t          conn_ht_iphc_len;       /* IP+ULP size */
 422         uint8_t         *conn_ht_ulp;           /* Upper-layer header */
 423         uint_t          conn_ht_ulp_len;        /* ULP header len */
 424
 425         /* Checksum to compensate for source routed packets. Host byte order */
 426         uint32_t        conn_sum;
 427
 428         uint32_t        conn_ioctlref;          /* ioctl ref count */
 429 #ifdef CONN_DEBUG
 430 #define CONN_TRACE_MAX  10
 431         int             conn_trace_last;        /* ndx of last used tracebuf */
 432         conn_trace_t    conn_trace_buf[CONN_TRACE_MAX];
 433 #endif
 434 };
 435
 436 /*
 437  * connf_t - connection fanout data.
 438  *
 439  * The hash tables and their linkage (conn_t.{hashnextp, hashprevp} are
 440  * protected by the per-bucket lock. Each conn_t inserted in the list
 441  * points back at the connf_t that heads the bucket.
 442  */
 443 struct connf_s {
 444         struct conn_s   *connf_head;
 445         kmutex_t        connf_lock;
 446 };
 447
 448 #define CONN_INC_REF(connp)     {                               \
 449         mutex_enter(&(connp)->conn_lock);                       \
 450         DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);         \
 451         ASSERT(conn_trace_ref(connp));                          \
 452         (connp)->conn_ref++;                                    \
 453         ASSERT((connp)->conn_ref != 0);                         \
 454         mutex_exit(&(connp)->conn_lock);                        \
 455 }
 456
 457 #define CONN_INC_REF_LOCKED(connp)      {                       \
 458         DTRACE_PROBE1(conn__inc__ref, conn_t *, connp);         \
 459         ASSERT(MUTEX_HELD(&(connp)->conn_lock));                \
 460         ASSERT(conn_trace_ref(connp));                          \
 461         (connp)->conn_ref++;                                    \
 462         ASSERT((connp)->conn_ref != 0);                         \
 463 }
 464
 465 #define CONN_DEC_REF(connp)     {                                       \
 466         mutex_enter(&(connp)->conn_lock);                               \
 467         DTRACE_PROBE1(conn__dec__ref, conn_t *, connp);                 \
 468         /*                                                              \
 469          * The squeue framework always does a CONN_DEC_REF after return \
 470          * from TCP. Hence the refcnt must be at least 2 if conn_on_sqp \
 471          * is B_TRUE and conn_ref is being decremented. This is to      \
 472          * account for the mblk being currently processed.              \
 473          */                                                             \
 474         if ((connp)->conn_ref == 0 ||                                   \
 475             ((connp)->conn_ref == 1 && (connp)->conn_on_sqp))           \
 476                 cmn_err(CE_PANIC, "CONN_DEC_REF: connp(%p) has ref "    \
 477                         "= %d\n", (void *)(connp), (connp)->conn_ref);  \
 478         ASSERT(conn_untrace_ref(connp));                                \
 479         (connp)->conn_ref--;                                            \
 480         if ((connp)->conn_ref == 0) {                                   \
 481                 /* Refcnt can't increase again, safe to drop lock */    \
 482                 mutex_exit(&(connp)->conn_lock);                        \
 483                 ipcl_conn_destroy(connp);                               \
 484         } else {                                                        \
 485                 cv_broadcast(&(connp)->conn_cv);                        \
 486                 mutex_exit(&(connp)->conn_lock);                        \
 487         }                                                               \
 488 }
 489
 490 /*
 491  * For use with subsystems within ip which use ALL_ZONES as a wildcard
 492  */
 493 #define IPCL_ZONEID(connp)                                              \
 494         ((connp)->conn_allzones ? ALL_ZONES : (connp)->conn_zoneid)
 495
 496 /*
 497  * For matching between a conn_t and a zoneid.
 498  */
 499 #define IPCL_ZONE_MATCH(connp, zoneid)                                  \
 500         (((connp)->conn_allzones) ||                                    \
 501             ((zoneid) == ALL_ZONES) ||                                  \
 502             (connp)->conn_zoneid == (zoneid))
 503
 504 #define IPCL_BIND_ZONE_MATCH(conn1, conn2)                              \
 505         (IPCL_ZONE_MATCH(conn1, conn2->conn_zoneid) ||                  \
 506         IPCL_ZONE_MATCH(conn2, conn1->conn_zoneid))
 507
 508
 509 #define _IPCL_V4_MATCH(v6addr, v4addr)  \
 510         (V4_PART_OF_V6((v6addr)) == (v4addr) && IN6_IS_ADDR_V4MAPPED(&(v6addr)))
 511
 512 #define _IPCL_V4_MATCH_ANY(addr)        \
 513         (IN6_IS_ADDR_V4MAPPED_ANY(&(addr)) || IN6_IS_ADDR_UNSPECIFIED(&(addr)))
 514
 515
 516 /*
 517  * IPCL_PROTO_MATCH() and IPCL_PROTO_MATCH_V6() only matches conns with
 518  * the specified ira_zoneid or conn_allzones by calling conn_wantpacket.
 519  */
 520 #define IPCL_PROTO_MATCH(connp, ira, ipha)                              \
 521         ((((connp)->conn_laddr_v4 == INADDR_ANY) ||                     \
 522         (((connp)->conn_laddr_v4 == ((ipha)->ipha_dst)) &&              \
 523             (((connp)->conn_faddr_v4 == INADDR_ANY) ||                  \
 524         ((connp)->conn_faddr_v4 == ((ipha)->ipha_src))))) &&            \
 525         conn_wantpacket((connp), (ira), (ipha)))
 526
 527 #define IPCL_PROTO_MATCH_V6(connp, ira, ip6h)                           \
 528         ((IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||           \
 529         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &((ip6h)->ip6_dst)) &&   \
 530         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) ||                  \
 531         IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &((ip6h)->ip6_src))))) && \
 532         (conn_wantpacket_v6((connp), (ira), (ip6h))))
 533
 534 #define IPCL_CONN_HASH(src, ports, ipst)                                \
 535         ((unsigned)(ntohl((src)) ^ ((ports) >> 24) ^ ((ports) >> 16) ^  \
 536         ((ports) >> 8) ^ (ports)) % (ipst)->ips_ipcl_conn_fanout_size)
 537
 538 #define IPCL_CONN_HASH_V6(src, ports, ipst)                             \
 539         IPCL_CONN_HASH(V4_PART_OF_V6((src)), (ports), (ipst))
 540
 541 #define IPCL_CONN_MATCH(connp, proto, src, dst, ports)                  \
 542         ((connp)->conn_proto == (proto) &&                              \
 543                 (connp)->conn_ports == (ports) &&                       \
 544                 _IPCL_V4_MATCH((connp)->conn_faddr_v6, (src)) &&        \
 545                 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (dst)) &&        \
 546                 !(connp)->conn_ipv6_v6only)
 547
 548 #define IPCL_CONN_MATCH_V6(connp, proto, src, dst, ports)               \
 549         ((connp)->conn_proto == (proto) &&                              \
 550                 (connp)->conn_ports == (ports) &&                       \
 551                 IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(src)) &&  \
 552                 IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(dst)))
 553
 554 #define IPCL_PORT_HASH(port, size) \
 555         ((((port) >> 8) ^ (port)) & ((size) - 1))
 556
 557 #define IPCL_BIND_HASH(lport, ipst)                                     \
 558         ((unsigned)(((lport) >> 8) ^ (lport)) % \
 559             (ipst)->ips_ipcl_bind_fanout_size)
 560
 561 #define IPCL_BIND_MATCH(connp, proto, laddr, lport)                     \
 562         ((connp)->conn_proto == (proto) &&                              \
 563                 (connp)->conn_lport == (lport) &&                       \
 564                 (_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||          \
 565                 _IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))) &&     \
 566                 !(connp)->conn_ipv6_v6only)
 567
 568 #define IPCL_BIND_MATCH_V6(connp, proto, laddr, lport)                  \
 569         ((connp)->conn_proto == (proto) &&                              \
 570                 (connp)->conn_lport == (lport) &&                       \
 571                 (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) || \
 572                 IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6)))
 573
 574 /*
 575  * We compare conn_laddr since it captures both connected and a bind to
 576  * a multicast or broadcast address.
 577  * The caller needs to match the zoneid and also call conn_wantpacket
 578  * for multicast, broadcast, or when conn_incoming_ifindex is set.
 579  */
 580 #define IPCL_UDP_MATCH(connp, lport, laddr, fport, faddr)               \
 581         (((connp)->conn_lport == (lport)) &&                            \
 582         ((_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||                 \
 583         (_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) &&             \
 584         (_IPCL_V4_MATCH_ANY((connp)->conn_faddr_v6) ||                  \
 585         (_IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)) &&             \
 586         (connp)->conn_fport == (fport)))))) &&                          \
 587         !(connp)->conn_ipv6_v6only)
 588
 589 /*
 590  * We compare conn_laddr since it captures both connected and a bind to
 591  * a multicast or broadcast address.
 592  * The caller needs to match the zoneid and also call conn_wantpacket_v6
 593  * for multicast or when conn_incoming_ifindex is set.
 594  */
 595 #define IPCL_UDP_MATCH_V6(connp, lport, laddr, fport, faddr)    \
 596         (((connp)->conn_lport == (lport)) &&                    \
 597         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||    \
 598         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr)) &&       \
 599         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_faddr_v6) ||    \
 600         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, &(faddr)) &&       \
 601         (connp)->conn_fport == (fport))))))
 602
 603 #define IPCL_IPTUN_HASH(laddr, faddr)                                   \
 604         ((ntohl(laddr) ^ ((ntohl(faddr) << 24) | (ntohl(faddr) >> 8))) % \
 605         ipcl_iptun_fanout_size)
 606
 607 #define IPCL_IPTUN_HASH_V6(laddr, faddr)                                \
 608         IPCL_IPTUN_HASH((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^ \
 609             (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3],              \
 610             (faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^             \
 611             (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3])
 612
 613 #define IPCL_IPTUN_MATCH(connp, laddr, faddr)                   \
 614         (_IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr)) &&     \
 615         _IPCL_V4_MATCH((connp)->conn_faddr_v6, (faddr)))
 616
 617 #define IPCL_IPTUN_MATCH_V6(connp, laddr, faddr)                \
 618         (IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, (laddr)) &&        \
 619         IN6_ARE_ADDR_EQUAL(&(connp)->conn_faddr_v6, (faddr)))
 620
 621 #define IPCL_UDP_HASH(lport, ipst)      \
 622         IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_udp_fanout_size)
 623
 624 #define CONN_G_HASH_SIZE        1024
 625
 626 /* Raw socket hash function. */
 627 #define IPCL_RAW_HASH(lport, ipst)      \
 628         IPCL_PORT_HASH(lport, (ipst)->ips_ipcl_raw_fanout_size)
 629
 630 /*
 631  * This is similar to IPCL_BIND_MATCH except that the local port check
 632  * is changed to a wildcard port check.
 633  * We compare conn_laddr since it captures both connected and a bind to
 634  * a multicast or broadcast address.
 635  */
 636 #define IPCL_RAW_MATCH(connp, proto, laddr)                     \
 637         ((connp)->conn_proto == (proto) &&                      \
 638         (connp)->conn_lport == 0 &&                             \
 639         (_IPCL_V4_MATCH_ANY((connp)->conn_laddr_v6) ||          \
 640         _IPCL_V4_MATCH((connp)->conn_laddr_v6, (laddr))))
 641
 642 #define IPCL_RAW_MATCH_V6(connp, proto, laddr)                  \
 643         ((connp)->conn_proto == (proto) &&                      \
 644         (connp)->conn_lport == 0 &&                             \
 645         (IN6_IS_ADDR_UNSPECIFIED(&(connp)->conn_laddr_v6) ||    \
 646         IN6_ARE_ADDR_EQUAL(&(connp)->conn_laddr_v6, &(laddr))))
 647
 648 /* Function prototypes */
 649 extern void ipcl_g_init(void);
 650 extern void ipcl_init(ip_stack_t *);
 651 extern void ipcl_g_destroy(void);
 652 extern void ipcl_destroy(ip_stack_t *);
 653 extern conn_t *ipcl_conn_create(uint32_t, int, netstack_t *);
 654 extern void ipcl_conn_destroy(conn_t *);
 655
 656 void ipcl_hash_insert_wildcard(connf_t *, conn_t *);
 657 void ipcl_hash_remove(conn_t *);
 658 void ipcl_hash_remove_locked(conn_t *connp, connf_t *connfp);
 659
 660 extern int      ipcl_bind_insert(conn_t *);
 661 extern int      ipcl_bind_insert_v4(conn_t *);
 662 extern int      ipcl_bind_insert_v6(conn_t *);
 663 extern int      ipcl_conn_insert(conn_t *);
 664 extern int      ipcl_conn_insert_v4(conn_t *);
 665 extern int      ipcl_conn_insert_v6(conn_t *);
 666 extern conn_t   *ipcl_get_next_conn(connf_t *, conn_t *, uint32_t);
 667
 668 conn_t *ipcl_classify_v4(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *,
 669             ip_stack_t *);
 670 conn_t *ipcl_classify_v6(mblk_t *, uint8_t, uint_t, ip_recv_attr_t *,
 671             ip_stack_t *);
 672 conn_t *ipcl_classify(mblk_t *, ip_recv_attr_t *, ip_stack_t *);
 673 conn_t *ipcl_classify_raw(mblk_t *, uint8_t, uint32_t, ipha_t *,
 674     ip6_t *, ip_recv_attr_t *, ip_stack_t *);
 675 conn_t *ipcl_iptun_classify_v4(ipaddr_t *, ipaddr_t *, ip_stack_t *);
 676 conn_t *ipcl_iptun_classify_v6(in6_addr_t *, in6_addr_t *, ip_stack_t *);
 677 void    ipcl_globalhash_insert(conn_t *);
 678 void    ipcl_globalhash_remove(conn_t *);
 679 void    ipcl_walk(pfv_t, void *, ip_stack_t *);
 680 conn_t  *ipcl_tcp_lookup_reversed_ipv4(ipha_t *, tcpha_t *, int, ip_stack_t *);
 681 conn_t  *ipcl_tcp_lookup_reversed_ipv6(ip6_t *, tcpha_t *, int, uint_t,
 682             ip_stack_t *);
 683 conn_t  *ipcl_lookup_listener_v4(uint16_t, ipaddr_t, zoneid_t, ip_stack_t *);
 684 conn_t  *ipcl_lookup_listener_v6(uint16_t, in6_addr_t *, uint_t, zoneid_t,
 685             ip_stack_t *);
 686 int     conn_trace_ref(conn_t *);
 687 int     conn_untrace_ref(conn_t *);
 688 void    ipcl_conn_cleanup(conn_t *);
 689 extern uint_t   conn_recvancillary_size(conn_t *, crb_t, ip_recv_attr_t *,
 690     mblk_t *, ip_pkt_t *);
 691 extern void     conn_recvancillary_add(conn_t *, crb_t, ip_recv_attr_t *,
 692     ip_pkt_t *, uchar_t *, uint_t);
 693 conn_t *ipcl_conn_tcp_lookup_reversed_ipv4(conn_t *, ipha_t *, tcpha_t *,
 694             ip_stack_t *);
 695 conn_t *ipcl_conn_tcp_lookup_reversed_ipv6(conn_t *, ip6_t *, tcpha_t *,
 696             ip_stack_t *);
 697
 698 extern int ip_create_helper_stream(conn_t *, ldi_ident_t);
 699 extern void ip_free_helper_stream(conn_t *);
 700 extern int      ip_helper_stream_setup(queue_t *, dev_t *, int, int,
 701     cred_t *, boolean_t);
 702
 703 #ifdef  __cplusplus
 704 }
 705 #endif
 706
 707 #endif  /* _INET_IPCLASSIFIER_H */